npm - @zapier/policy-context - Versions diffs - 1.1.0 → 1.1.1 - Mend

@zapier/policy-context 1.1.0 → 1.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/index.cjs CHANGED Viewed

@@ -133,6 +133,7 @@ var ActionTypeSchema = import_zod.z.enum([
   "write"
 ]).openapi("action_type", { description: "Canonical Zapier action type." });
 var ACTION_RESOURCE_SEGMENT_PATTERN = /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;
+var ACTION_KEY_SEGMENT_PATTERN = /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;
 function parseActionResource(resource) {
   const segments = resource.split("/");
   if (segments.length !== 4 || segments[0] !== "action") {
@@ -155,7 +156,7 @@ function parseActionResource(resource) {
       `action resource has invalid selected_api segment "${selectedApi}": ${resource}`
     );
   }
-  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(actionKey)) {
+  if (!ACTION_KEY_SEGMENT_PATTERN.test(actionKey)) {
     throw new Error(
       `action resource has invalid action_key segment "${actionKey}": ${resource}`
     );
@@ -394,8 +395,8 @@ var BuildActionRunContextOptionsSchema = import_zod2.z.object({
     message: "selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)"
   }),
   action_type: ActionTypeSchema,
-  action_key: import_zod2.z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {
-    message: "action_key must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)"
+  action_key: import_zod2.z.string().regex(ACTION_KEY_SEGMENT_PATTERN, {
+    message: "action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)"
   }),
   connection_id: import_zod2.z.string().optional(),
   inputs: import_zod2.z.json().optional(),

package/dist/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n HttpRequestContextSchema,\n ActionRunContextSchema,\n ActionRunContextInputSchema,\n ActionTypeSchema,\n RequestContextSchema,\n ParsedUrlSchema,\n DEFAULT_PORTS,\n parseUrl,\n buildUrlString,\n parseActionResource,\n type HttpRequestContext,\n type ActionRunContext,\n type ActionType,\n type RequestContext,\n type ParsedUrl,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport {\n buildHttpRequestContext,\n buildActionRunContext,\n BuildHttpRequestContextOptionsSchema,\n BuildActionRunContextOptionsSchema,\n type BuildHttpRequestContextOptions,\n type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n buildExactHttpConditions,\n buildDomainHttpConditions,\n buildExactActionConditions,\n buildActionResource,\n buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n\nexport {\n buildConnectionPolicy,\n isWriteRequest,\n AccessLevelSchema,\n READ_ACTION_TYPES,\n READ_HTTP_METHODS,\n type AccessLevel,\n} from \"./connection-policy.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport { extendZodWithOpenApi } from \"@asteasolutions/zod-to-openapi\";\n\nextendZodWithOpenApi(z);\n\n/*\n Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n /\nexport const ParsedUrlSchema = z\n .object({\n scheme: z.string().openapi({ description: 'URL scheme, e.g. \"https\"' }),\n host: z.string().openapi({ description: 'Hostname, e.g. \"api.example.com\"' }),\n port: z\n .number()\n .int()\n .openapi({\n description: \"Port number (defaults to 443 for https, 80 for http)\",\n }),\n path: z.string().openapi({ description: 'URL path, e.g. \"/v1/foo\"' }),\n query: z\n .record(z.string(), z.array(z.string()))\n .openapi({\n description: \"Query parameters as key to string array mapping\",\n }),\n })\n .openapi(\"ParsedUrl\", {\n description: \"Parsed URL components for policy condition matching\",\n });\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/* Default ports by scheme, used when URL has no explicit port. /\nexport const DEFAULT_PORTS: Record<string, number> = {\n http: 80,\n https: 443,\n};\n\n/\n Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n /\nexport function parseUrl(raw: string): ParsedUrl {\n const url = new URL(raw);\n const scheme = url.protocol.slice(0, -1).toLowerCase();\n const host = url.hostname.toLowerCase();\n const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n const path = url.pathname \|\| \"/\";\n const query: Record<string, string[]> = {};\n for (const [key, value] of url.searchParams) {\n if (!query[key]) {\n query[key] = [];\n }\n query[key].push(value);\n }\n return { scheme, host, port, path, query };\n}\n\n/\n Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n /\nexport function buildUrlString(parsed: ParsedUrl): string {\n const { scheme, host, port, path, query } = parsed;\n const defaultPort = DEFAULT_PORTS[scheme];\n const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n const params = new URLSearchParams();\n for (const [key, values] of Object.entries(query)) {\n for (const value of values) {\n params.append(key, value);\n }\n }\n const queryString = params.toString();\n return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/\n HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n \n The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n /\nexport const HttpRequestContextSchema = z\n .object({\n request_type: z\n .literal(\"http_request\")\n .openapi({ description: \"Context type discriminator\" }),\n method: z\n .string()\n .max(10)\n .transform((m) => m.toUpperCase())\n .openapi({ description: \"HTTP method\" }),\n /* Parsed URL components for policy condition matching /\n url: ParsedUrlSchema,\n /* Filtered headers (IGNORED_HEADERS excluded, keys lowercased) /\n headers: z\n .record(z.string(), z.string())\n .openapi({\n description: \"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\",\n }),\n /* Raw body string /\n body: z\n .string()\n .max(65536)\n .nullable()\n .openapi({ description: \"Raw body string\" }),\n /\n Parsed JSON body. Authored as `z.unknown().pipe(z.json())` so\n * zod-to-openapi sees the outer `z.unknown()` and emits a permissive\n * field (no recursive `$ref`, no type), while the inner `z.json()`\n * still rejects non-JSON values (`Date`, `undefined`, functions) at\n * parse time. Same inferred `JsonValue` type either way.\n /\n body_json: z\n .unknown()\n .pipe(z.json())\n .nullable()\n .describe(\"Parsed JSON body (if applicable)\"),\n /* Zapier connection ID used for this request /\n connection_id: z\n .string()\n .max(255)\n .optional()\n .openapi({ description: \"Zapier connection ID used for this request\" }),\n /* Optional human-readable reason for the request /\n reason: z\n .string()\n .max(1024)\n .optional()\n .openapi({ description: \"Optional human-readable reason for the request\" }),\n })\n .openapi(\"HttpRequestContext\");\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/\n Canonical Zapier action types.\n \n Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n /\nexport const ActionTypeSchema = z\n .enum([\n \"filter\",\n \"read\",\n \"read_bulk\",\n \"run\",\n \"search\",\n \"search_and_write\",\n \"search_or_write\",\n \"write\",\n ])\n .openapi(\"action_type\", { description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/\n Allowed character set for `selected_api` and `action_key` segments of\n * an action resource. Blocks ``, `/`, whitespace, and other glob/path\n metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n /\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/\n Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n /\nexport function parseActionResource(resource: string): {\n selected_api: string;\n action_type: ActionType;\n action_key: string;\n} {\n const segments = resource.split(\"/\");\n if (segments.length !== 4 \|\| segments[0] !== \"action\") {\n throw new Error(\n `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n );\n }\n const [, selectedApi, actionTypeRaw, actionKey] = segments;\n if (!selectedApi \|\| !actionTypeRaw \|\| !actionKey) {\n throw new Error(`action resource has empty segment: ${resource}`);\n }\n const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n if (!actionType.success) {\n throw new Error(\n `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n );\n }\n if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n throw new Error(\n `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n );\n }\n if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(actionKey)) {\n throw new Error(\n `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n );\n }\n return {\n selected_api: selectedApi,\n action_type: actionType.data,\n action_key: actionKey,\n };\n}\n\n/\n Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should use `ActionRunContextSchema`, which accepts either the canonical\n * `resource` field or the legacy `{selected_api, action_type, action_key}`\n * triple on input.\n /\nexport const ActionRunContextInputSchema = z\n .object({\n request_type: z\n .literal(\"action_run\")\n .openapi({ description: \"Context type discriminator\" }),\n resource: z\n .string()\n .max(1024)\n .optional()\n .openapi({\n description:\n \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n }),\n selected_api: z\n .string()\n .max(255)\n .optional()\n .openapi({\n deprecated: true,\n description:\n \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n }),\n action_type: ActionTypeSchema.optional().openapi({\n deprecated: true,\n description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n }),\n action_key: z\n .string()\n .max(255)\n .optional()\n .openapi({\n deprecated: true,\n description:\n \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n }),\n connection_id: z\n .string()\n .max(255)\n .optional()\n .openapi({ description: \"Zapier connection ID used for this request\" }),\n /* Action input parameters. See body_json above for the pipe rationale. /\n inputs: z\n .unknown()\n .pipe(z.json())\n .optional()\n .describe(\"Action input parameters\"),\n reason: z\n .string()\n .max(1024)\n .optional()\n .openapi({ description: \"Optional human-readable reason for the request\" }),\n })\n .openapi(\"ActionRunContext\", {\n description:\n \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n (input, ctx) => {\n const resource =\n input.resource ??\n (input.selected_api && input.action_type && input.action_key\n ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n : undefined);\n if (resource === undefined) {\n ctx.addIssue({\n code: \"custom\",\n message:\n \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n });\n return z.NEVER;\n }\n try {\n parseActionResource(resource);\n } catch (err) {\n ctx.addIssue({\n code: \"custom\",\n message: err instanceof Error ? err.message : String(err),\n });\n return z.NEVER;\n }\n return {\n request_type: \"action_run\" as const,\n resource,\n ...(input.connection_id !== undefined && {\n connection_id: input.connection_id,\n }),\n ...(input.inputs !== undefined && { inputs: input.inputs }),\n ...(input.reason !== undefined && { reason: input.reason }),\n };\n },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/\n Union of all request context types, keyed on `request_type`.\n \n Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member. The discriminator metadata\n * below tells OpenAPI consumers how to narrow the union — zod-to-openapi\n * emits this as `anyOf` + discriminator, which openapi-typescript and\n * other codegen targets render as a properly narrowed TS union.\n /\nexport const RequestContextSchema = z\n .union([HttpRequestContextSchema, ActionRunContextSchema])\n .openapi(\"RequestContext\", {\n description: \"Union of request context shapes, keyed on `request_type`.\",\n discriminator: {\n propertyName: \"request_type\",\n mapping: {\n http_request: \"#/components/schemas/HttpRequestContext\",\n action_run: \"#/components/schemas/ActionRunContext\",\n },\n },\n });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/\n Headers to exclude when building request contexts from raw HTTP requests.\n \n These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n /\nexport const IGNORED_HEADERS = new Set([\n // Auth / credentials — never include in contexts or policy conditions\n \"authorization\",\n \"x-relay-authorization\",\n \"x-relay-authentication-id\",\n \"x-api-key\",\n \"cookie\",\n \"set-cookie\",\n \"proxy-authorization\",\n\n // HTTP infrastructure — varies per-request, not policy-relevant\n \"host\",\n \"connection\",\n \"content-length\",\n \"transfer-encoding\",\n \"accept-encoding\",\n \"user-agent\",\n \"accept\",\n \"accept-language\",\n \"sec-fetch-mode\",\n\n // Proxy / forwarding — infrastructure, not meaningful for policy\n \"x-forwarded-for\",\n \"x-forwarded-host\",\n \"x-forwarded-proto\",\n \"x-real-ip\",\n\n // Proxy internal — sdkapi-specific headers\n \"x-is-interactive-session\",\n \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n HttpRequestContextSchema,\n ActionRunContextSchema,\n ActionTypeSchema,\n parseUrl,\n ACTION_RESOURCE_SEGMENT_PATTERN,\n type HttpRequestContext,\n type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n method: z.string(),\n /* Raw URL string. Will be normalized with https:// if no protocol present. /\n url: z.string(),\n /* Raw headers from the request. Will be filtered through IGNORED_HEADERS. /\n headers: z\n .record(\n z.string(),\n z.union([z.string(), z.array(z.string()), z.undefined()]),\n )\n .optional(),\n /* Raw body string /\n body: z.string().nullable().optional(),\n /* Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) /\n body_json: z.json().optional(),\n /* Connection ID associated with this request /\n connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/\n Build a canonical HttpRequestContext from raw request parts.\n \n This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n \n Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n \n - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n /\nexport function buildHttpRequestContext(\n options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n // see well-typed values. Mirrors the pattern in buildActionRunContext.\n const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n // Normalize URL — SDK CLI strips the protocol\n const rawUrl = parsed.url.includes(\"://\")\n ? parsed.url\n : `https://${parsed.url}`;\n const url = parseUrl(rawUrl);\n\n // Filter headers: exclude ignored, lowercase keys, string values only\n const headers: Record<string, string> = {};\n if (parsed.headers) {\n for (const [key, value] of Object.entries(parsed.headers)) {\n const lowerKey = key.toLowerCase();\n if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n headers[lowerKey] = value;\n }\n }\n }\n\n // Auto-parse body_json from body when content-type is JSON\n // (matches createPolicyHttpRequest behavior from @zapier/policy)\n let body_json: unknown = null;\n if (parsed.body_json !== undefined) {\n body_json = parsed.body_json;\n } else if (parsed.body) {\n const contentType = headers[\"content-type\"];\n const isJson =\n typeof contentType === \"string\" &&\n (contentType.includes(\"application/json\") \|\|\n (contentType.includes(\"application/\") &&\n contentType.includes(\"+json\")));\n if (isJson) {\n try {\n body_json = JSON.parse(parsed.body);\n } catch {\n // Invalid JSON body — leave body_json as null\n }\n }\n }\n\n return HttpRequestContextSchema.parse({\n request_type: \"http_request\",\n method: parsed.method.toUpperCase(),\n url,\n headers,\n body: parsed.body ?? null,\n body_json,\n connection_id: parsed.connection_id,\n });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n message:\n \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n }),\n action_type: ActionTypeSchema,\n action_key: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n message:\n \"action_key must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n }),\n connection_id: z.string().optional(),\n inputs: z.json().optional(),\n reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n typeof BuildActionRunContextOptionsSchema\n>;\n\n/\n Build a canonical ActionRunContext from raw action parts.\n \n Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n /\nexport function buildActionRunContext(\n options: BuildActionRunContextOptions,\n): ActionRunContext {\n const parsed = BuildActionRunContextOptionsSchema.parse(options);\n return ActionRunContextSchema.parse({\n request_type: \"action_run\",\n resource: buildActionResource({\n selected_api: parsed.selected_api,\n action_type: parsed.action_type,\n action_key: parsed.action_key,\n }),\n connection_id: parsed.connection_id,\n inputs: parsed.inputs,\n reason: parsed.reason,\n });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n HttpRequestContext,\n ActionRunContext,\n ActionType,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/\n Build conditions that match an exact HTTP request.\n \n Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n \n @returns Condition[] for an http permission statement\n /\nexport function buildExactHttpConditions(\n context: HttpRequestContext,\n): Condition[] {\n const conditions: Condition[] = [\n { path: [\"method\"], operator: \"equals\", value: context.method },\n ];\n\n const { url } = context;\n\n // matches_url condition uses URL without query string (per @zapier/policy spec)\n const defaultPort =\n url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n conditions.push({\n path: [\"url\"],\n operator: \"matches_url\",\n value: urlWithoutQuery,\n });\n\n // Add decomposed conditions for each query parameter.\n for (const [key, values] of Object.entries(url.query)) {\n conditions.push({\n path: [\"url\", \"query\", key],\n operator: \"equals\",\n value: values,\n });\n }\n\n // body_json condition\n if (context.body_json !== null) {\n conditions.push({\n path: [\"body_json\"],\n operator: \"equals\",\n value: context.body_json,\n });\n } else if (context.body !== null) {\n // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n // exact-match policies actually match the originating request.\n conditions.push({\n path: [\"body\"],\n operator: \"equals\",\n value: context.body,\n });\n }\n\n // Header conditions (filtered through IGNORED_HEADERS again for safety)\n for (const [key, value] of Object.entries(context.headers)) {\n if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === \"string\") {\n conditions.push({\n path: [\"headers\", key.toLowerCase()],\n operator: \"equals\",\n value,\n });\n }\n }\n\n return conditions;\n}\n\n/\n Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n \n @returns Condition[] for an http permission statement\n /\nexport function buildDomainHttpConditions(\n context: HttpRequestContext,\n): Condition[] {\n return [\n {\n path: [\"url\", \"host\"],\n operator: \"matches_host\",\n value: context.url.host,\n },\n ];\n}\n\n/\n Build conditions that match an exact action run (with inputs).\n \n @returns Condition[] for an action permission statement\n /\nexport function buildExactActionConditions(\n context: ActionRunContext,\n): Condition[] {\n const conditions: Condition[] = [];\n\n if (context.inputs !== undefined && context.inputs !== null) {\n conditions.push({\n path: [\"inputs\"],\n operator: \"equals\",\n value: context.inputs,\n });\n }\n\n return conditions;\n}\n\n/\n The three identity fields that compose an action resource string.\n /\nexport interface ActionResourceParts {\n selected_api: string;\n action_type: ActionType;\n action_key: string;\n}\n\n/\n Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n /\nexport function buildActionResource(parts: ActionResourceParts): string {\n return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/\n Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n \n Format: action/{selected_api}/{action_type}/{wildcard}\n /\nexport function buildBroadActionResource(\n parts: Pick<ActionResourceParts, \"selected_api\" \| \"action_type\">,\n): string {\n return `action/${parts.selected_api}/${parts.action_type}/`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n RequestContext,\n HttpRequestContext,\n ActionRunContext,\n} from \"./types.ts\";\nimport {\n buildExactHttpConditions,\n buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/*\n Build a `can_use` authentication statement, if the context has a connection_id.\n /\nfunction buildAuthStatement(authenticationId: string): Statement {\n return {\n effect: \"allow\",\n permissions: [\"can_use\"],\n resources: [`connection/${authenticationId}`],\n conditions: [],\n };\n}\n\n/\n Build an exact-match policy from an HTTP request context.\n \n Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n * plus a `keys_in` guard restricting allowed query parameter keys\n /\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n const statements: Statement[] = [];\n\n if (context.connection_id) {\n statements.push(buildAuthStatement(context.connection_id));\n }\n\n const conditions = buildExactHttpConditions(context);\n\n // Add a keys_in guard so only the query param keys present in the original\n // request are allowed — blocks injection of extra query params.\n conditions.push({\n path: [\"url\", \"query\"],\n operator: \"keys_in\",\n value: Object.keys(context.url.query),\n });\n\n statements.push({\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [\"http\"],\n conditions,\n });\n\n return { version: 2, statements };\n}\n\n/\n Build an exact-match policy from an action run context.\n \n Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n /\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n const statements: Statement[] = [];\n\n if (context.connection_id) {\n statements.push(buildAuthStatement(context.connection_id));\n }\n\n statements.push({\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [context.resource],\n conditions: buildExactActionConditions(context),\n });\n\n return { version: 2, statements };\n}\n\n/\n Build an exact-match policy from any supported request context.\n \n This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n /\nexport function toExactPolicy(context: RequestContext): Policy {\n if (context.request_type === \"http_request\") {\n return httpContextToPolicy(context);\n }\n return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n parseActionResource,\n type ActionType,\n type RequestContext,\n} from \"./types.ts\";\n\n/\n Replace the implementation-version suffix of a `selected_api` with a `@`\n wildcard so connection-level policies stay valid across version bumps. A\n * runtime request with `selected_api: \"App@2.7.3\"` matches a policy resource\n * scoped to `App@` while still being distinguishable from a different app\n (e.g. `App2@1.0.0`).\n \n No-op when the input has no `@` — assumed to be already version-less.\n /\nfunction globSelectedApiVersion(selectedApi: string): string {\n const at = selectedApi.indexOf(\"@\");\n return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@\";\n}\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. /\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/\n Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n /\nexport const READ_ACTION_TYPES = [\n \"read\",\n \"read_bulk\",\n \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n READ_ACTION_TYPES,\n);\n\n/\n Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n /\nexport function isWriteRequest(context: RequestContext): boolean {\n if (context.request_type === \"http_request\") {\n // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n // it on the way in), so no normalization is needed here.\n return !READ_HTTP_METHOD_SET.has(context.method);\n }\n const { action_type } = parseActionResource(context.resource);\n return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/\n Build a connection-level policy that covers both HTTP and action access.\n \n Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/` per allowed type,\n scoped by connection_id. For read access, the resource list expands to\n * one entry per read action_type so the engine matches via the resource\n * string rather than a separate `path: [\"action_type\"]` condition.\n /\nexport function buildConnectionPolicy(options: {\n connectionId: string;\n selectedApi: string;\n accessLevel: AccessLevel;\n}): Policy {\n const { connectionId, selectedApi, accessLevel } = options;\n\n const authStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_use\"],\n resources: [`connection/${connectionId}`],\n conditions: [],\n };\n\n const connectionCondition: Condition = {\n path: [\"connection_id\"],\n operator: \"equals\",\n value: connectionId,\n };\n\n const httpConditions: Condition[] = [connectionCondition];\n if (accessLevel === \"read\") {\n httpConditions.push({\n path: [\"method\"],\n operator: \"in\",\n value: [...READ_HTTP_METHODS],\n });\n }\n\n const httpStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [\"http\"],\n conditions: httpConditions,\n };\n\n const apiPattern = globSelectedApiVersion(selectedApi);\n const actionResources =\n accessLevel === \"read\"\n ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/`)\n : [`action/${apiPattern}//`];\n\n const actionStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: actionResources,\n conditions: [connectionCondition],\n };\n\n return {\n version: 2,\n statements: [authStatement, httpStatement, actionStatement],\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAClB,4BAAqC;AAAA,IAErC,4CAAqB,YAAC;AAOf,IAAM,kBAAkB,aAC5B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACtE,MAAM,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,mCAAmC,CAAC;AAAA,EAC5E,MAAM,aACH,OAAO,EACP,IAAI,EACJ,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA,EACH,MAAM,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACpE,OAAO,aACJ,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC,EACtC,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACL,CAAC,EACA,QAAQ,aAAa;AAAA,EACpB,aAAa;AACf,CAAC;AAII,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,aACrC,OAAO;AAAA,EACN,cAAc,aACX,QAAQ,cAAc,EACtB,QAAQ,EAAE,aAAa,6BAA6B,CAAC;AAAA,EACxD,QAAQ,aACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAChC,QAAQ,EAAE,aAAa,cAAc,CAAC;AAAA;AAAA,EAEzC,KAAK;AAAA;AAAA,EAEL,SAAS,aACN,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAC7B,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA;AAAA,EAEH,MAAM,aACH,OAAO,EACP,IAAI,KAAK,EACT,SAAS,EACT,QAAQ,EAAE,aAAa,kBAAkB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7C,WAAW,aACR,QAAQ,EACR,KAAK,aAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,kCAAkC;AAAA;AAAA,EAE9C,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAYxB,IAAM,mBAAmB,aAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,QAAQ,eAAe,EAAE,aAAa,gCAAgC,CAAC;AAUnE,IAAM,kCACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,SAAS,GAAG;AACpD,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAUO,IAAM,8BAA8B,aACxC,OAAO;AAAA,EACN,cAAc,aACX,QAAQ,YAAY,EACpB,QAAQ,EAAE,aAAa,6BAA6B,CAAC;AAAA,EACxD,UAAU,aACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ;AAAA,IACP,aACE;AAAA,EACJ,CAAC;AAAA,EACH,cAAc,aACX,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,aAAa,iBAAiB,SAAS,EAAE,QAAQ;AAAA,IAC/C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,aACT,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,aACL,QAAQ,EACR,KAAK,aAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,yBAAyB;AAAA,EACrC,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAAA,EAC3B,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAaO,IAAM,uBAAuB,aACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,QAAQ,kBAAkB;AAAA,EACzB,aAAa;AAAA,EACb,eAAe;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,MACP,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF;AACF,CAAC;;;AC5UI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,IAAAA,cAAkB;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KAAK,OAAO,UAAU,UAAU;AACxE,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADnIO,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,cAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE7B,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ;AAAA,IACrB;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAY,cAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC5D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,cAAE,KAAK,EAAE,SAAS;AAAA,EAC1B,QAAQ,cAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AEpIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,IAAAC,cAAkB;AAiBlB,SAAS,uBAAuB,aAA6B;AAC3D,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAEO,IAAM,oBAAoB,cAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;","names":["import_zod","import_zod"]}
1	+ {"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n HttpRequestContextSchema,\n ActionRunContextSchema,\n ActionRunContextInputSchema,\n ActionTypeSchema,\n RequestContextSchema,\n ParsedUrlSchema,\n DEFAULT_PORTS,\n parseUrl,\n buildUrlString,\n parseActionResource,\n type HttpRequestContext,\n type ActionRunContext,\n type ActionType,\n type RequestContext,\n type ParsedUrl,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport {\n buildHttpRequestContext,\n buildActionRunContext,\n BuildHttpRequestContextOptionsSchema,\n BuildActionRunContextOptionsSchema,\n type BuildHttpRequestContextOptions,\n type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n buildExactHttpConditions,\n buildDomainHttpConditions,\n buildExactActionConditions,\n buildActionResource,\n buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n\nexport {\n buildConnectionPolicy,\n isWriteRequest,\n AccessLevelSchema,\n READ_ACTION_TYPES,\n READ_HTTP_METHODS,\n type AccessLevel,\n} from \"./connection-policy.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport { extendZodWithOpenApi } from \"@asteasolutions/zod-to-openapi\";\n\nextendZodWithOpenApi(z);\n\n/*\n Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n /\nexport const ParsedUrlSchema = z\n .object({\n scheme: z.string().openapi({ description: 'URL scheme, e.g. \"https\"' }),\n host: z.string().openapi({ description: 'Hostname, e.g. \"api.example.com\"' }),\n port: z\n .number()\n .int()\n .openapi({\n description: \"Port number (defaults to 443 for https, 80 for http)\",\n }),\n path: z.string().openapi({ description: 'URL path, e.g. \"/v1/foo\"' }),\n query: z\n .record(z.string(), z.array(z.string()))\n .openapi({\n description: \"Query parameters as key to string array mapping\",\n }),\n })\n .openapi(\"ParsedUrl\", {\n description: \"Parsed URL components for policy condition matching\",\n });\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/* Default ports by scheme, used when URL has no explicit port. /\nexport const DEFAULT_PORTS: Record<string, number> = {\n http: 80,\n https: 443,\n};\n\n/\n Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n /\nexport function parseUrl(raw: string): ParsedUrl {\n const url = new URL(raw);\n const scheme = url.protocol.slice(0, -1).toLowerCase();\n const host = url.hostname.toLowerCase();\n const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n const path = url.pathname \|\| \"/\";\n const query: Record<string, string[]> = {};\n for (const [key, value] of url.searchParams) {\n if (!query[key]) {\n query[key] = [];\n }\n query[key].push(value);\n }\n return { scheme, host, port, path, query };\n}\n\n/\n Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n /\nexport function buildUrlString(parsed: ParsedUrl): string {\n const { scheme, host, port, path, query } = parsed;\n const defaultPort = DEFAULT_PORTS[scheme];\n const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n const params = new URLSearchParams();\n for (const [key, values] of Object.entries(query)) {\n for (const value of values) {\n params.append(key, value);\n }\n }\n const queryString = params.toString();\n return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/\n HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n \n The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n /\nexport const HttpRequestContextSchema = z\n .object({\n request_type: z\n .literal(\"http_request\")\n .openapi({ description: \"Context type discriminator\" }),\n method: z\n .string()\n .max(10)\n .transform((m) => m.toUpperCase())\n .openapi({ description: \"HTTP method\" }),\n /* Parsed URL components for policy condition matching /\n url: ParsedUrlSchema,\n /* Filtered headers (IGNORED_HEADERS excluded, keys lowercased) /\n headers: z\n .record(z.string(), z.string())\n .openapi({\n description: \"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\",\n }),\n /* Raw body string /\n body: z\n .string()\n .max(65536)\n .nullable()\n .openapi({ description: \"Raw body string\" }),\n /\n Parsed JSON body. Authored as `z.unknown().pipe(z.json())` so\n * zod-to-openapi sees the outer `z.unknown()` and emits a permissive\n * field (no recursive `$ref`, no type), while the inner `z.json()`\n * still rejects non-JSON values (`Date`, `undefined`, functions) at\n * parse time. Same inferred `JsonValue` type either way.\n /\n body_json: z\n .unknown()\n .pipe(z.json())\n .nullable()\n .describe(\"Parsed JSON body (if applicable)\"),\n /* Zapier connection ID used for this request /\n connection_id: z\n .string()\n .max(255)\n .optional()\n .openapi({ description: \"Zapier connection ID used for this request\" }),\n /* Optional human-readable reason for the request /\n reason: z\n .string()\n .max(1024)\n .optional()\n .openapi({ description: \"Optional human-readable reason for the request\" }),\n })\n .openapi(\"HttpRequestContext\");\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/\n Canonical Zapier action types.\n \n Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n /\nexport const ActionTypeSchema = z\n .enum([\n \"filter\",\n \"read\",\n \"read_bulk\",\n \"run\",\n \"search\",\n \"search_and_write\",\n \"search_or_write\",\n \"write\",\n ])\n .openapi(\"action_type\", { description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/\n Allowed character set for the `selected_api` segment of an action\n * resource. Blocks ``, `/`, `:`, whitespace, and other glob/path\n metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n /\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/\n Allowed character set for the `action_key` segment of an action\n * resource. More permissive than `ACTION_RESOURCE_SEGMENT_PATTERN`\n * because sdkapi emits keys like `ae:358405` and `core:123abc` that\n * carry a namespace prefix separated by `:`. Still blocks ``, `/`,\n whitespace, and other glob/path metacharacters.\n /\nexport const ACTION_KEY_SEGMENT_PATTERN =\n /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;\n\n/\n Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n /\nexport function parseActionResource(resource: string): {\n selected_api: string;\n action_type: ActionType;\n action_key: string;\n} {\n const segments = resource.split(\"/\");\n if (segments.length !== 4 \|\| segments[0] !== \"action\") {\n throw new Error(\n `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n );\n }\n const [, selectedApi, actionTypeRaw, actionKey] = segments;\n if (!selectedApi \|\| !actionTypeRaw \|\| !actionKey) {\n throw new Error(`action resource has empty segment: ${resource}`);\n }\n const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n if (!actionType.success) {\n throw new Error(\n `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n );\n }\n if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n throw new Error(\n `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n );\n }\n if (!ACTION_KEY_SEGMENT_PATTERN.test(actionKey)) {\n throw new Error(\n `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n );\n }\n return {\n selected_api: selectedApi,\n action_type: actionType.data,\n action_key: actionKey,\n };\n}\n\n/\n Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should use `ActionRunContextSchema`, which accepts either the canonical\n * `resource` field or the legacy `{selected_api, action_type, action_key}`\n * triple on input.\n /\nexport const ActionRunContextInputSchema = z\n .object({\n request_type: z\n .literal(\"action_run\")\n .openapi({ description: \"Context type discriminator\" }),\n resource: z\n .string()\n .max(1024)\n .optional()\n .openapi({\n description:\n \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n }),\n selected_api: z\n .string()\n .max(255)\n .optional()\n .openapi({\n deprecated: true,\n description:\n \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n }),\n action_type: ActionTypeSchema.optional().openapi({\n deprecated: true,\n description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n }),\n action_key: z\n .string()\n .max(255)\n .optional()\n .openapi({\n deprecated: true,\n description:\n \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n }),\n connection_id: z\n .string()\n .max(255)\n .optional()\n .openapi({ description: \"Zapier connection ID used for this request\" }),\n /* Action input parameters. See body_json above for the pipe rationale. /\n inputs: z\n .unknown()\n .pipe(z.json())\n .optional()\n .describe(\"Action input parameters\"),\n reason: z\n .string()\n .max(1024)\n .optional()\n .openapi({ description: \"Optional human-readable reason for the request\" }),\n })\n .openapi(\"ActionRunContext\", {\n description:\n \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n (input, ctx) => {\n const resource =\n input.resource ??\n (input.selected_api && input.action_type && input.action_key\n ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n : undefined);\n if (resource === undefined) {\n ctx.addIssue({\n code: \"custom\",\n message:\n \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n });\n return z.NEVER;\n }\n try {\n parseActionResource(resource);\n } catch (err) {\n ctx.addIssue({\n code: \"custom\",\n message: err instanceof Error ? err.message : String(err),\n });\n return z.NEVER;\n }\n return {\n request_type: \"action_run\" as const,\n resource,\n ...(input.connection_id !== undefined && {\n connection_id: input.connection_id,\n }),\n ...(input.inputs !== undefined && { inputs: input.inputs }),\n ...(input.reason !== undefined && { reason: input.reason }),\n };\n },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/\n Union of all request context types, keyed on `request_type`.\n \n Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member. The discriminator metadata\n * below tells OpenAPI consumers how to narrow the union — zod-to-openapi\n * emits this as `anyOf` + discriminator, which openapi-typescript and\n * other codegen targets render as a properly narrowed TS union.\n /\nexport const RequestContextSchema = z\n .union([HttpRequestContextSchema, ActionRunContextSchema])\n .openapi(\"RequestContext\", {\n description: \"Union of request context shapes, keyed on `request_type`.\",\n discriminator: {\n propertyName: \"request_type\",\n mapping: {\n http_request: \"#/components/schemas/HttpRequestContext\",\n action_run: \"#/components/schemas/ActionRunContext\",\n },\n },\n });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/\n Headers to exclude when building request contexts from raw HTTP requests.\n \n These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n /\nexport const IGNORED_HEADERS = new Set([\n // Auth / credentials — never include in contexts or policy conditions\n \"authorization\",\n \"x-relay-authorization\",\n \"x-relay-authentication-id\",\n \"x-api-key\",\n \"cookie\",\n \"set-cookie\",\n \"proxy-authorization\",\n\n // HTTP infrastructure — varies per-request, not policy-relevant\n \"host\",\n \"connection\",\n \"content-length\",\n \"transfer-encoding\",\n \"accept-encoding\",\n \"user-agent\",\n \"accept\",\n \"accept-language\",\n \"sec-fetch-mode\",\n\n // Proxy / forwarding — infrastructure, not meaningful for policy\n \"x-forwarded-for\",\n \"x-forwarded-host\",\n \"x-forwarded-proto\",\n \"x-real-ip\",\n\n // Proxy internal — sdkapi-specific headers\n \"x-is-interactive-session\",\n \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n HttpRequestContextSchema,\n ActionRunContextSchema,\n ActionTypeSchema,\n parseUrl,\n ACTION_RESOURCE_SEGMENT_PATTERN,\n ACTION_KEY_SEGMENT_PATTERN,\n type HttpRequestContext,\n type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n method: z.string(),\n /* Raw URL string. Will be normalized with https:// if no protocol present. /\n url: z.string(),\n /* Raw headers from the request. Will be filtered through IGNORED_HEADERS. /\n headers: z\n .record(\n z.string(),\n z.union([z.string(), z.array(z.string()), z.undefined()]),\n )\n .optional(),\n /* Raw body string /\n body: z.string().nullable().optional(),\n /* Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) /\n body_json: z.json().optional(),\n /* Connection ID associated with this request /\n connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/\n Build a canonical HttpRequestContext from raw request parts.\n \n This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n \n Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n \n - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n /\nexport function buildHttpRequestContext(\n options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n // see well-typed values. Mirrors the pattern in buildActionRunContext.\n const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n // Normalize URL — SDK CLI strips the protocol\n const rawUrl = parsed.url.includes(\"://\")\n ? parsed.url\n : `https://${parsed.url}`;\n const url = parseUrl(rawUrl);\n\n // Filter headers: exclude ignored, lowercase keys, string values only\n const headers: Record<string, string> = {};\n if (parsed.headers) {\n for (const [key, value] of Object.entries(parsed.headers)) {\n const lowerKey = key.toLowerCase();\n if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n headers[lowerKey] = value;\n }\n }\n }\n\n // Auto-parse body_json from body when content-type is JSON\n // (matches createPolicyHttpRequest behavior from @zapier/policy)\n let body_json: unknown = null;\n if (parsed.body_json !== undefined) {\n body_json = parsed.body_json;\n } else if (parsed.body) {\n const contentType = headers[\"content-type\"];\n const isJson =\n typeof contentType === \"string\" &&\n (contentType.includes(\"application/json\") \|\|\n (contentType.includes(\"application/\") &&\n contentType.includes(\"+json\")));\n if (isJson) {\n try {\n body_json = JSON.parse(parsed.body);\n } catch {\n // Invalid JSON body — leave body_json as null\n }\n }\n }\n\n return HttpRequestContextSchema.parse({\n request_type: \"http_request\",\n method: parsed.method.toUpperCase(),\n url,\n headers,\n body: parsed.body ?? null,\n body_json,\n connection_id: parsed.connection_id,\n });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n message:\n \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n }),\n action_type: ActionTypeSchema,\n action_key: z.string().regex(ACTION_KEY_SEGMENT_PATTERN, {\n message:\n \"action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)\",\n }),\n connection_id: z.string().optional(),\n inputs: z.json().optional(),\n reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n typeof BuildActionRunContextOptionsSchema\n>;\n\n/\n Build a canonical ActionRunContext from raw action parts.\n \n Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n /\nexport function buildActionRunContext(\n options: BuildActionRunContextOptions,\n): ActionRunContext {\n const parsed = BuildActionRunContextOptionsSchema.parse(options);\n return ActionRunContextSchema.parse({\n request_type: \"action_run\",\n resource: buildActionResource({\n selected_api: parsed.selected_api,\n action_type: parsed.action_type,\n action_key: parsed.action_key,\n }),\n connection_id: parsed.connection_id,\n inputs: parsed.inputs,\n reason: parsed.reason,\n });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n HttpRequestContext,\n ActionRunContext,\n ActionType,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/\n Build conditions that match an exact HTTP request.\n \n Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n \n @returns Condition[] for an http permission statement\n /\nexport function buildExactHttpConditions(\n context: HttpRequestContext,\n): Condition[] {\n const conditions: Condition[] = [\n { path: [\"method\"], operator: \"equals\", value: context.method },\n ];\n\n const { url } = context;\n\n // matches_url condition uses URL without query string (per @zapier/policy spec)\n const defaultPort =\n url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n conditions.push({\n path: [\"url\"],\n operator: \"matches_url\",\n value: urlWithoutQuery,\n });\n\n // Add decomposed conditions for each query parameter.\n for (const [key, values] of Object.entries(url.query)) {\n conditions.push({\n path: [\"url\", \"query\", key],\n operator: \"equals\",\n value: values,\n });\n }\n\n // body_json condition\n if (context.body_json !== null) {\n conditions.push({\n path: [\"body_json\"],\n operator: \"equals\",\n value: context.body_json,\n });\n } else if (context.body !== null) {\n // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n // exact-match policies actually match the originating request.\n conditions.push({\n path: [\"body\"],\n operator: \"equals\",\n value: context.body,\n });\n }\n\n // Header conditions (filtered through IGNORED_HEADERS again for safety)\n for (const [key, value] of Object.entries(context.headers)) {\n if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === \"string\") {\n conditions.push({\n path: [\"headers\", key.toLowerCase()],\n operator: \"equals\",\n value,\n });\n }\n }\n\n return conditions;\n}\n\n/\n Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n \n @returns Condition[] for an http permission statement\n /\nexport function buildDomainHttpConditions(\n context: HttpRequestContext,\n): Condition[] {\n return [\n {\n path: [\"url\", \"host\"],\n operator: \"matches_host\",\n value: context.url.host,\n },\n ];\n}\n\n/\n Build conditions that match an exact action run (with inputs).\n \n @returns Condition[] for an action permission statement\n /\nexport function buildExactActionConditions(\n context: ActionRunContext,\n): Condition[] {\n const conditions: Condition[] = [];\n\n if (context.inputs !== undefined && context.inputs !== null) {\n conditions.push({\n path: [\"inputs\"],\n operator: \"equals\",\n value: context.inputs,\n });\n }\n\n return conditions;\n}\n\n/\n The three identity fields that compose an action resource string.\n /\nexport interface ActionResourceParts {\n selected_api: string;\n action_type: ActionType;\n action_key: string;\n}\n\n/\n Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n /\nexport function buildActionResource(parts: ActionResourceParts): string {\n return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/\n Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n \n Format: action/{selected_api}/{action_type}/{wildcard}\n /\nexport function buildBroadActionResource(\n parts: Pick<ActionResourceParts, \"selected_api\" \| \"action_type\">,\n): string {\n return `action/${parts.selected_api}/${parts.action_type}/`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n RequestContext,\n HttpRequestContext,\n ActionRunContext,\n} from \"./types.ts\";\nimport {\n buildExactHttpConditions,\n buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/*\n Build a `can_use` authentication statement, if the context has a connection_id.\n /\nfunction buildAuthStatement(authenticationId: string): Statement {\n return {\n effect: \"allow\",\n permissions: [\"can_use\"],\n resources: [`connection/${authenticationId}`],\n conditions: [],\n };\n}\n\n/\n Build an exact-match policy from an HTTP request context.\n \n Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n * plus a `keys_in` guard restricting allowed query parameter keys\n /\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n const statements: Statement[] = [];\n\n if (context.connection_id) {\n statements.push(buildAuthStatement(context.connection_id));\n }\n\n const conditions = buildExactHttpConditions(context);\n\n // Add a keys_in guard so only the query param keys present in the original\n // request are allowed — blocks injection of extra query params.\n conditions.push({\n path: [\"url\", \"query\"],\n operator: \"keys_in\",\n value: Object.keys(context.url.query),\n });\n\n statements.push({\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [\"http\"],\n conditions,\n });\n\n return { version: 2, statements };\n}\n\n/\n Build an exact-match policy from an action run context.\n \n Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n /\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n const statements: Statement[] = [];\n\n if (context.connection_id) {\n statements.push(buildAuthStatement(context.connection_id));\n }\n\n statements.push({\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [context.resource],\n conditions: buildExactActionConditions(context),\n });\n\n return { version: 2, statements };\n}\n\n/\n Build an exact-match policy from any supported request context.\n \n This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n /\nexport function toExactPolicy(context: RequestContext): Policy {\n if (context.request_type === \"http_request\") {\n return httpContextToPolicy(context);\n }\n return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n parseActionResource,\n type ActionType,\n type RequestContext,\n} from \"./types.ts\";\n\n/\n Replace the implementation-version suffix of a `selected_api` with a `@`\n wildcard so connection-level policies stay valid across version bumps. A\n * runtime request with `selected_api: \"App@2.7.3\"` matches a policy resource\n * scoped to `App@` while still being distinguishable from a different app\n (e.g. `App2@1.0.0`).\n \n No-op when the input has no `@` — assumed to be already version-less.\n /\nfunction globSelectedApiVersion(selectedApi: string): string {\n const at = selectedApi.indexOf(\"@\");\n return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@\";\n}\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. /\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/\n Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n /\nexport const READ_ACTION_TYPES = [\n \"read\",\n \"read_bulk\",\n \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n READ_ACTION_TYPES,\n);\n\n/\n Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n /\nexport function isWriteRequest(context: RequestContext): boolean {\n if (context.request_type === \"http_request\") {\n // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n // it on the way in), so no normalization is needed here.\n return !READ_HTTP_METHOD_SET.has(context.method);\n }\n const { action_type } = parseActionResource(context.resource);\n return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/\n Build a connection-level policy that covers both HTTP and action access.\n \n Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/` per allowed type,\n scoped by connection_id. For read access, the resource list expands to\n * one entry per read action_type so the engine matches via the resource\n * string rather than a separate `path: [\"action_type\"]` condition.\n /\nexport function buildConnectionPolicy(options: {\n connectionId: string;\n selectedApi: string;\n accessLevel: AccessLevel;\n}): Policy {\n const { connectionId, selectedApi, accessLevel } = options;\n\n const authStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_use\"],\n resources: [`connection/${connectionId}`],\n conditions: [],\n };\n\n const connectionCondition: Condition = {\n path: [\"connection_id\"],\n operator: \"equals\",\n value: connectionId,\n };\n\n const httpConditions: Condition[] = [connectionCondition];\n if (accessLevel === \"read\") {\n httpConditions.push({\n path: [\"method\"],\n operator: \"in\",\n value: [...READ_HTTP_METHODS],\n });\n }\n\n const httpStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [\"http\"],\n conditions: httpConditions,\n };\n\n const apiPattern = globSelectedApiVersion(selectedApi);\n const actionResources =\n accessLevel === \"read\"\n ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/`)\n : [`action/${apiPattern}//`];\n\n const actionStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: actionResources,\n conditions: [connectionCondition],\n };\n\n return {\n version: 2,\n statements: [authStatement, httpStatement, actionStatement],\n };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAClB,4BAAqC;AAAA,IAErC,4CAAqB,YAAC;AAOf,IAAM,kBAAkB,aAC5B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACtE,MAAM,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,mCAAmC,CAAC;AAAA,EAC5E,MAAM,aACH,OAAO,EACP,IAAI,EACJ,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA,EACH,MAAM,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACpE,OAAO,aACJ,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC,EACtC,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACL,CAAC,EACA,QAAQ,aAAa;AAAA,EACpB,aAAa;AACf,CAAC;AAII,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,aACrC,OAAO;AAAA,EACN,cAAc,aACX,QAAQ,cAAc,EACtB,QAAQ,EAAE,aAAa,6BAA6B,CAAC;AAAA,EACxD,QAAQ,aACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAChC,QAAQ,EAAE,aAAa,cAAc,CAAC;AAAA;AAAA,EAEzC,KAAK;AAAA;AAAA,EAEL,SAAS,aACN,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAC7B,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA;AAAA,EAEH,MAAM,aACH,OAAO,EACP,IAAI,KAAK,EACT,SAAS,EACT,QAAQ,EAAE,aAAa,kBAAkB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7C,WAAW,aACR,QAAQ,EACR,KAAK,aAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,kCAAkC;AAAA;AAAA,EAE9C,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAYxB,IAAM,mBAAmB,aAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,QAAQ,eAAe,EAAE,aAAa,gCAAgC,CAAC;AAUnE,IAAM,kCACX;AASK,IAAM,6BACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,2BAA2B,KAAK,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAUO,IAAM,8BAA8B,aACxC,OAAO;AAAA,EACN,cAAc,aACX,QAAQ,YAAY,EACpB,QAAQ,EAAE,aAAa,6BAA6B,CAAC;AAAA,EACxD,UAAU,aACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ;AAAA,IACP,aACE;AAAA,EACJ,CAAC;AAAA,EACH,cAAc,aACX,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,aAAa,iBAAiB,SAAS,EAAE,QAAQ;AAAA,IAC/C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,aACT,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,aACL,QAAQ,EACR,KAAK,aAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,yBAAyB;AAAA,EACrC,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAAA,EAC3B,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAaO,IAAM,uBAAuB,aACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,QAAQ,kBAAkB;AAAA,EACzB,aAAa;AAAA,EACb,eAAe;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,MACP,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF;AACF,CAAC;;;ACtVI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,IAAAA,cAAkB;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KAAK,OAAO,UAAU,UAAU;AACxE,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADlIO,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,cAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE7B,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ;AAAA,IACrB;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAY,cAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,cAAE,KAAK,EAAE,SAAS;AAAA,EAC1B,QAAQ,cAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AErIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,IAAAC,cAAkB;AAiBlB,SAAS,uBAAuB,aAA6B;AAC3D,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAEO,IAAM,oBAAoB,cAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;","names":["import_zod","import_zod"]}

package/dist/index.js CHANGED Viewed

@@ -82,6 +82,7 @@ var ActionTypeSchema = z.enum([
   "write"
 ]).openapi("action_type", { description: "Canonical Zapier action type." });
 var ACTION_RESOURCE_SEGMENT_PATTERN = /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;
+var ACTION_KEY_SEGMENT_PATTERN = /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;
 function parseActionResource(resource) {
   const segments = resource.split("/");
   if (segments.length !== 4 || segments[0] !== "action") {
@@ -104,7 +105,7 @@ function parseActionResource(resource) {
       `action resource has invalid selected_api segment "${selectedApi}": ${resource}`
     );
   }
-  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(actionKey)) {
+  if (!ACTION_KEY_SEGMENT_PATTERN.test(actionKey)) {
     throw new Error(
       `action resource has invalid action_key segment "${actionKey}": ${resource}`
     );
@@ -343,8 +344,8 @@ var BuildActionRunContextOptionsSchema = z2.object({
     message: "selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)"
   }),
   action_type: ActionTypeSchema,
-  action_key: z2.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {
-    message: "action_key must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)"
+  action_key: z2.string().regex(ACTION_KEY_SEGMENT_PATTERN, {
+    message: "action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)"
   }),
   connection_id: z2.string().optional(),
   inputs: z2.json().optional(),

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts"],"sourcesContent":["// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport { extendZodWithOpenApi } from \"@asteasolutions/zod-to-openapi\";\n\nextendZodWithOpenApi(z);\n\n/*\n Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n /\nexport const ParsedUrlSchema = z\n .object({\n scheme: z.string().openapi({ description: 'URL scheme, e.g. \"https\"' }),\n host: z.string().openapi({ description: 'Hostname, e.g. \"api.example.com\"' }),\n port: z\n .number()\n .int()\n .openapi({\n description: \"Port number (defaults to 443 for https, 80 for http)\",\n }),\n path: z.string().openapi({ description: 'URL path, e.g. \"/v1/foo\"' }),\n query: z\n .record(z.string(), z.array(z.string()))\n .openapi({\n description: \"Query parameters as key to string array mapping\",\n }),\n })\n .openapi(\"ParsedUrl\", {\n description: \"Parsed URL components for policy condition matching\",\n });\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/* Default ports by scheme, used when URL has no explicit port. /\nexport const DEFAULT_PORTS: Record<string, number> = {\n http: 80,\n https: 443,\n};\n\n/\n Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n /\nexport function parseUrl(raw: string): ParsedUrl {\n const url = new URL(raw);\n const scheme = url.protocol.slice(0, -1).toLowerCase();\n const host = url.hostname.toLowerCase();\n const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n const path = url.pathname \|\| \"/\";\n const query: Record<string, string[]> = {};\n for (const [key, value] of url.searchParams) {\n if (!query[key]) {\n query[key] = [];\n }\n query[key].push(value);\n }\n return { scheme, host, port, path, query };\n}\n\n/\n Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n /\nexport function buildUrlString(parsed: ParsedUrl): string {\n const { scheme, host, port, path, query } = parsed;\n const defaultPort = DEFAULT_PORTS[scheme];\n const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n const params = new URLSearchParams();\n for (const [key, values] of Object.entries(query)) {\n for (const value of values) {\n params.append(key, value);\n }\n }\n const queryString = params.toString();\n return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/\n HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n \n The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n /\nexport const HttpRequestContextSchema = z\n .object({\n request_type: z\n .literal(\"http_request\")\n .openapi({ description: \"Context type discriminator\" }),\n method: z\n .string()\n .max(10)\n .transform((m) => m.toUpperCase())\n .openapi({ description: \"HTTP method\" }),\n /* Parsed URL components for policy condition matching /\n url: ParsedUrlSchema,\n /* Filtered headers (IGNORED_HEADERS excluded, keys lowercased) /\n headers: z\n .record(z.string(), z.string())\n .openapi({\n description: \"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\",\n }),\n /* Raw body string /\n body: z\n .string()\n .max(65536)\n .nullable()\n .openapi({ description: \"Raw body string\" }),\n /\n Parsed JSON body. Authored as `z.unknown().pipe(z.json())` so\n * zod-to-openapi sees the outer `z.unknown()` and emits a permissive\n * field (no recursive `$ref`, no type), while the inner `z.json()`\n * still rejects non-JSON values (`Date`, `undefined`, functions) at\n * parse time. Same inferred `JsonValue` type either way.\n /\n body_json: z\n .unknown()\n .pipe(z.json())\n .nullable()\n .describe(\"Parsed JSON body (if applicable)\"),\n /* Zapier connection ID used for this request /\n connection_id: z\n .string()\n .max(255)\n .optional()\n .openapi({ description: \"Zapier connection ID used for this request\" }),\n /* Optional human-readable reason for the request /\n reason: z\n .string()\n .max(1024)\n .optional()\n .openapi({ description: \"Optional human-readable reason for the request\" }),\n })\n .openapi(\"HttpRequestContext\");\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/\n Canonical Zapier action types.\n \n Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n /\nexport const ActionTypeSchema = z\n .enum([\n \"filter\",\n \"read\",\n \"read_bulk\",\n \"run\",\n \"search\",\n \"search_and_write\",\n \"search_or_write\",\n \"write\",\n ])\n .openapi(\"action_type\", { description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/\n Allowed character set for `selected_api` and `action_key` segments of\n * an action resource. Blocks ``, `/`, whitespace, and other glob/path\n metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n /\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/\n Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n /\nexport function parseActionResource(resource: string): {\n selected_api: string;\n action_type: ActionType;\n action_key: string;\n} {\n const segments = resource.split(\"/\");\n if (segments.length !== 4 \|\| segments[0] !== \"action\") {\n throw new Error(\n `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n );\n }\n const [, selectedApi, actionTypeRaw, actionKey] = segments;\n if (!selectedApi \|\| !actionTypeRaw \|\| !actionKey) {\n throw new Error(`action resource has empty segment: ${resource}`);\n }\n const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n if (!actionType.success) {\n throw new Error(\n `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n );\n }\n if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n throw new Error(\n `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n );\n }\n if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(actionKey)) {\n throw new Error(\n `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n );\n }\n return {\n selected_api: selectedApi,\n action_type: actionType.data,\n action_key: actionKey,\n };\n}\n\n/\n Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should use `ActionRunContextSchema`, which accepts either the canonical\n * `resource` field or the legacy `{selected_api, action_type, action_key}`\n * triple on input.\n /\nexport const ActionRunContextInputSchema = z\n .object({\n request_type: z\n .literal(\"action_run\")\n .openapi({ description: \"Context type discriminator\" }),\n resource: z\n .string()\n .max(1024)\n .optional()\n .openapi({\n description:\n \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n }),\n selected_api: z\n .string()\n .max(255)\n .optional()\n .openapi({\n deprecated: true,\n description:\n \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n }),\n action_type: ActionTypeSchema.optional().openapi({\n deprecated: true,\n description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n }),\n action_key: z\n .string()\n .max(255)\n .optional()\n .openapi({\n deprecated: true,\n description:\n \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n }),\n connection_id: z\n .string()\n .max(255)\n .optional()\n .openapi({ description: \"Zapier connection ID used for this request\" }),\n /* Action input parameters. See body_json above for the pipe rationale. /\n inputs: z\n .unknown()\n .pipe(z.json())\n .optional()\n .describe(\"Action input parameters\"),\n reason: z\n .string()\n .max(1024)\n .optional()\n .openapi({ description: \"Optional human-readable reason for the request\" }),\n })\n .openapi(\"ActionRunContext\", {\n description:\n \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n (input, ctx) => {\n const resource =\n input.resource ??\n (input.selected_api && input.action_type && input.action_key\n ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n : undefined);\n if (resource === undefined) {\n ctx.addIssue({\n code: \"custom\",\n message:\n \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n });\n return z.NEVER;\n }\n try {\n parseActionResource(resource);\n } catch (err) {\n ctx.addIssue({\n code: \"custom\",\n message: err instanceof Error ? err.message : String(err),\n });\n return z.NEVER;\n }\n return {\n request_type: \"action_run\" as const,\n resource,\n ...(input.connection_id !== undefined && {\n connection_id: input.connection_id,\n }),\n ...(input.inputs !== undefined && { inputs: input.inputs }),\n ...(input.reason !== undefined && { reason: input.reason }),\n };\n },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/\n Union of all request context types, keyed on `request_type`.\n \n Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member. The discriminator metadata\n * below tells OpenAPI consumers how to narrow the union — zod-to-openapi\n * emits this as `anyOf` + discriminator, which openapi-typescript and\n * other codegen targets render as a properly narrowed TS union.\n /\nexport const RequestContextSchema = z\n .union([HttpRequestContextSchema, ActionRunContextSchema])\n .openapi(\"RequestContext\", {\n description: \"Union of request context shapes, keyed on `request_type`.\",\n discriminator: {\n propertyName: \"request_type\",\n mapping: {\n http_request: \"#/components/schemas/HttpRequestContext\",\n action_run: \"#/components/schemas/ActionRunContext\",\n },\n },\n });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/\n Headers to exclude when building request contexts from raw HTTP requests.\n \n These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n /\nexport const IGNORED_HEADERS = new Set([\n // Auth / credentials — never include in contexts or policy conditions\n \"authorization\",\n \"x-relay-authorization\",\n \"x-relay-authentication-id\",\n \"x-api-key\",\n \"cookie\",\n \"set-cookie\",\n \"proxy-authorization\",\n\n // HTTP infrastructure — varies per-request, not policy-relevant\n \"host\",\n \"connection\",\n \"content-length\",\n \"transfer-encoding\",\n \"accept-encoding\",\n \"user-agent\",\n \"accept\",\n \"accept-language\",\n \"sec-fetch-mode\",\n\n // Proxy / forwarding — infrastructure, not meaningful for policy\n \"x-forwarded-for\",\n \"x-forwarded-host\",\n \"x-forwarded-proto\",\n \"x-real-ip\",\n\n // Proxy internal — sdkapi-specific headers\n \"x-is-interactive-session\",\n \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n HttpRequestContextSchema,\n ActionRunContextSchema,\n ActionTypeSchema,\n parseUrl,\n ACTION_RESOURCE_SEGMENT_PATTERN,\n type HttpRequestContext,\n type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n method: z.string(),\n /* Raw URL string. Will be normalized with https:// if no protocol present. /\n url: z.string(),\n /* Raw headers from the request. Will be filtered through IGNORED_HEADERS. /\n headers: z\n .record(\n z.string(),\n z.union([z.string(), z.array(z.string()), z.undefined()]),\n )\n .optional(),\n /* Raw body string /\n body: z.string().nullable().optional(),\n /* Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) /\n body_json: z.json().optional(),\n /* Connection ID associated with this request /\n connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/\n Build a canonical HttpRequestContext from raw request parts.\n \n This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n \n Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n \n - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n /\nexport function buildHttpRequestContext(\n options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n // see well-typed values. Mirrors the pattern in buildActionRunContext.\n const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n // Normalize URL — SDK CLI strips the protocol\n const rawUrl = parsed.url.includes(\"://\")\n ? parsed.url\n : `https://${parsed.url}`;\n const url = parseUrl(rawUrl);\n\n // Filter headers: exclude ignored, lowercase keys, string values only\n const headers: Record<string, string> = {};\n if (parsed.headers) {\n for (const [key, value] of Object.entries(parsed.headers)) {\n const lowerKey = key.toLowerCase();\n if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n headers[lowerKey] = value;\n }\n }\n }\n\n // Auto-parse body_json from body when content-type is JSON\n // (matches createPolicyHttpRequest behavior from @zapier/policy)\n let body_json: unknown = null;\n if (parsed.body_json !== undefined) {\n body_json = parsed.body_json;\n } else if (parsed.body) {\n const contentType = headers[\"content-type\"];\n const isJson =\n typeof contentType === \"string\" &&\n (contentType.includes(\"application/json\") \|\|\n (contentType.includes(\"application/\") &&\n contentType.includes(\"+json\")));\n if (isJson) {\n try {\n body_json = JSON.parse(parsed.body);\n } catch {\n // Invalid JSON body — leave body_json as null\n }\n }\n }\n\n return HttpRequestContextSchema.parse({\n request_type: \"http_request\",\n method: parsed.method.toUpperCase(),\n url,\n headers,\n body: parsed.body ?? null,\n body_json,\n connection_id: parsed.connection_id,\n });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n message:\n \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n }),\n action_type: ActionTypeSchema,\n action_key: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n message:\n \"action_key must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n }),\n connection_id: z.string().optional(),\n inputs: z.json().optional(),\n reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n typeof BuildActionRunContextOptionsSchema\n>;\n\n/\n Build a canonical ActionRunContext from raw action parts.\n \n Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n /\nexport function buildActionRunContext(\n options: BuildActionRunContextOptions,\n): ActionRunContext {\n const parsed = BuildActionRunContextOptionsSchema.parse(options);\n return ActionRunContextSchema.parse({\n request_type: \"action_run\",\n resource: buildActionResource({\n selected_api: parsed.selected_api,\n action_type: parsed.action_type,\n action_key: parsed.action_key,\n }),\n connection_id: parsed.connection_id,\n inputs: parsed.inputs,\n reason: parsed.reason,\n });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n HttpRequestContext,\n ActionRunContext,\n ActionType,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/\n Build conditions that match an exact HTTP request.\n \n Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n \n @returns Condition[] for an http permission statement\n /\nexport function buildExactHttpConditions(\n context: HttpRequestContext,\n): Condition[] {\n const conditions: Condition[] = [\n { path: [\"method\"], operator: \"equals\", value: context.method },\n ];\n\n const { url } = context;\n\n // matches_url condition uses URL without query string (per @zapier/policy spec)\n const defaultPort =\n url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n conditions.push({\n path: [\"url\"],\n operator: \"matches_url\",\n value: urlWithoutQuery,\n });\n\n // Add decomposed conditions for each query parameter.\n for (const [key, values] of Object.entries(url.query)) {\n conditions.push({\n path: [\"url\", \"query\", key],\n operator: \"equals\",\n value: values,\n });\n }\n\n // body_json condition\n if (context.body_json !== null) {\n conditions.push({\n path: [\"body_json\"],\n operator: \"equals\",\n value: context.body_json,\n });\n } else if (context.body !== null) {\n // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n // exact-match policies actually match the originating request.\n conditions.push({\n path: [\"body\"],\n operator: \"equals\",\n value: context.body,\n });\n }\n\n // Header conditions (filtered through IGNORED_HEADERS again for safety)\n for (const [key, value] of Object.entries(context.headers)) {\n if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === \"string\") {\n conditions.push({\n path: [\"headers\", key.toLowerCase()],\n operator: \"equals\",\n value,\n });\n }\n }\n\n return conditions;\n}\n\n/\n Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n \n @returns Condition[] for an http permission statement\n /\nexport function buildDomainHttpConditions(\n context: HttpRequestContext,\n): Condition[] {\n return [\n {\n path: [\"url\", \"host\"],\n operator: \"matches_host\",\n value: context.url.host,\n },\n ];\n}\n\n/\n Build conditions that match an exact action run (with inputs).\n \n @returns Condition[] for an action permission statement\n /\nexport function buildExactActionConditions(\n context: ActionRunContext,\n): Condition[] {\n const conditions: Condition[] = [];\n\n if (context.inputs !== undefined && context.inputs !== null) {\n conditions.push({\n path: [\"inputs\"],\n operator: \"equals\",\n value: context.inputs,\n });\n }\n\n return conditions;\n}\n\n/\n The three identity fields that compose an action resource string.\n /\nexport interface ActionResourceParts {\n selected_api: string;\n action_type: ActionType;\n action_key: string;\n}\n\n/\n Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n /\nexport function buildActionResource(parts: ActionResourceParts): string {\n return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/\n Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n \n Format: action/{selected_api}/{action_type}/{wildcard}\n /\nexport function buildBroadActionResource(\n parts: Pick<ActionResourceParts, \"selected_api\" \| \"action_type\">,\n): string {\n return `action/${parts.selected_api}/${parts.action_type}/`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n RequestContext,\n HttpRequestContext,\n ActionRunContext,\n} from \"./types.ts\";\nimport {\n buildExactHttpConditions,\n buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/*\n Build a `can_use` authentication statement, if the context has a connection_id.\n /\nfunction buildAuthStatement(authenticationId: string): Statement {\n return {\n effect: \"allow\",\n permissions: [\"can_use\"],\n resources: [`connection/${authenticationId}`],\n conditions: [],\n };\n}\n\n/\n Build an exact-match policy from an HTTP request context.\n \n Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n * plus a `keys_in` guard restricting allowed query parameter keys\n /\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n const statements: Statement[] = [];\n\n if (context.connection_id) {\n statements.push(buildAuthStatement(context.connection_id));\n }\n\n const conditions = buildExactHttpConditions(context);\n\n // Add a keys_in guard so only the query param keys present in the original\n // request are allowed — blocks injection of extra query params.\n conditions.push({\n path: [\"url\", \"query\"],\n operator: \"keys_in\",\n value: Object.keys(context.url.query),\n });\n\n statements.push({\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [\"http\"],\n conditions,\n });\n\n return { version: 2, statements };\n}\n\n/\n Build an exact-match policy from an action run context.\n \n Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n /\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n const statements: Statement[] = [];\n\n if (context.connection_id) {\n statements.push(buildAuthStatement(context.connection_id));\n }\n\n statements.push({\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [context.resource],\n conditions: buildExactActionConditions(context),\n });\n\n return { version: 2, statements };\n}\n\n/\n Build an exact-match policy from any supported request context.\n \n This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n /\nexport function toExactPolicy(context: RequestContext): Policy {\n if (context.request_type === \"http_request\") {\n return httpContextToPolicy(context);\n }\n return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n parseActionResource,\n type ActionType,\n type RequestContext,\n} from \"./types.ts\";\n\n/\n Replace the implementation-version suffix of a `selected_api` with a `@`\n wildcard so connection-level policies stay valid across version bumps. A\n * runtime request with `selected_api: \"App@2.7.3\"` matches a policy resource\n * scoped to `App@` while still being distinguishable from a different app\n (e.g. `App2@1.0.0`).\n \n No-op when the input has no `@` — assumed to be already version-less.\n /\nfunction globSelectedApiVersion(selectedApi: string): string {\n const at = selectedApi.indexOf(\"@\");\n return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@\";\n}\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. /\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/\n Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n /\nexport const READ_ACTION_TYPES = [\n \"read\",\n \"read_bulk\",\n \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n READ_ACTION_TYPES,\n);\n\n/\n Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n /\nexport function isWriteRequest(context: RequestContext): boolean {\n if (context.request_type === \"http_request\") {\n // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n // it on the way in), so no normalization is needed here.\n return !READ_HTTP_METHOD_SET.has(context.method);\n }\n const { action_type } = parseActionResource(context.resource);\n return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/\n Build a connection-level policy that covers both HTTP and action access.\n \n Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/` per allowed type,\n scoped by connection_id. For read access, the resource list expands to\n * one entry per read action_type so the engine matches via the resource\n * string rather than a separate `path: [\"action_type\"]` condition.\n /\nexport function buildConnectionPolicy(options: {\n connectionId: string;\n selectedApi: string;\n accessLevel: AccessLevel;\n}): Policy {\n const { connectionId, selectedApi, accessLevel } = options;\n\n const authStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_use\"],\n resources: [`connection/${connectionId}`],\n conditions: [],\n };\n\n const connectionCondition: Condition = {\n path: [\"connection_id\"],\n operator: \"equals\",\n value: connectionId,\n };\n\n const httpConditions: Condition[] = [connectionCondition];\n if (accessLevel === \"read\") {\n httpConditions.push({\n path: [\"method\"],\n operator: \"in\",\n value: [...READ_HTTP_METHODS],\n });\n }\n\n const httpStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [\"http\"],\n conditions: httpConditions,\n };\n\n const apiPattern = globSelectedApiVersion(selectedApi);\n const actionResources =\n accessLevel === \"read\"\n ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/`)\n : [`action/${apiPattern}//`];\n\n const actionStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: actionResources,\n conditions: [connectionCondition],\n };\n\n return {\n version: 2,\n statements: [authStatement, httpStatement, actionStatement],\n };\n}\n"],"mappings":";AAGA,SAAS,SAAS;AAClB,SAAS,4BAA4B;AAErC,qBAAqB,CAAC;AAOf,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,mCAAmC,CAAC;AAAA,EAC5E,MAAM,EACH,OAAO,EACP,IAAI,EACJ,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA,EACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACpE,OAAO,EACJ,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EACtC,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACL,CAAC,EACA,QAAQ,aAAa;AAAA,EACpB,aAAa;AACf,CAAC;AAII,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc,EACX,QAAQ,cAAc,EACtB,QAAQ,EAAE,aAAa,6BAA6B,CAAC;AAAA,EACxD,QAAQ,EACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAChC,QAAQ,EAAE,aAAa,cAAc,CAAC;AAAA;AAAA,EAEzC,KAAK;AAAA;AAAA,EAEL,SAAS,EACN,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAC7B,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA;AAAA,EAEH,MAAM,EACH,OAAO,EACP,IAAI,KAAK,EACT,SAAS,EACT,QAAQ,EAAE,aAAa,kBAAkB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7C,WAAW,EACR,QAAQ,EACR,KAAK,EAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,kCAAkC;AAAA;AAAA,EAE9C,eAAe,EACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,EACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAYxB,IAAM,mBAAmB,EAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,QAAQ,eAAe,EAAE,aAAa,gCAAgC,CAAC;AAUnE,IAAM,kCACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,SAAS,GAAG;AACpD,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAUO,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,cAAc,EACX,QAAQ,YAAY,EACpB,QAAQ,EAAE,aAAa,6BAA6B,CAAC;AAAA,EACxD,UAAU,EACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ;AAAA,IACP,aACE;AAAA,EACJ,CAAC;AAAA,EACH,cAAc,EACX,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,aAAa,iBAAiB,SAAS,EAAE,QAAQ;AAAA,IAC/C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,EACT,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,eAAe,EACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,EACL,QAAQ,EACR,KAAK,EAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,yBAAyB;AAAA,EACrC,QAAQ,EACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAAA,EAC3B,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,EAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,EAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAaO,IAAM,uBAAuB,EACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,QAAQ,kBAAkB;AAAA,EACzB,aAAa;AAAA,EACb,eAAe;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,MACP,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF;AACF,CAAC;;;AC5UI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,SAAS,KAAAA,UAAS;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KAAK,OAAO,UAAU,UAAU;AACxE,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADnIO,IAAM,uCAAuCC,GAAE,OAAO;AAAA,EAC3D,QAAQA,GAAE,OAAO;AAAA;AAAA,EAEjB,KAAKA,GAAE,OAAO;AAAA;AAAA,EAEd,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,IACTA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,GAAGA,GAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAWA,GAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE7B,eAAeA,GAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ;AAAA,IACrB;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,cAAcA,GAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAYA,GAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC5D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQA,GAAE,KAAK,EAAE,SAAS;AAAA,EAC1B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AEpIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,SAAS,KAAAC,UAAS;AAiBlB,SAAS,uBAAuB,aAA6B;AAC3D,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAEO,IAAM,oBAAoBC,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;","names":["z","z","z","z"]}
1	+ {"version":3,"sources":["../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts"],"sourcesContent":["// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport { extendZodWithOpenApi } from \"@asteasolutions/zod-to-openapi\";\n\nextendZodWithOpenApi(z);\n\n/*\n Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n /\nexport const ParsedUrlSchema = z\n .object({\n scheme: z.string().openapi({ description: 'URL scheme, e.g. \"https\"' }),\n host: z.string().openapi({ description: 'Hostname, e.g. \"api.example.com\"' }),\n port: z\n .number()\n .int()\n .openapi({\n description: \"Port number (defaults to 443 for https, 80 for http)\",\n }),\n path: z.string().openapi({ description: 'URL path, e.g. \"/v1/foo\"' }),\n query: z\n .record(z.string(), z.array(z.string()))\n .openapi({\n description: \"Query parameters as key to string array mapping\",\n }),\n })\n .openapi(\"ParsedUrl\", {\n description: \"Parsed URL components for policy condition matching\",\n });\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/* Default ports by scheme, used when URL has no explicit port. /\nexport const DEFAULT_PORTS: Record<string, number> = {\n http: 80,\n https: 443,\n};\n\n/\n Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n /\nexport function parseUrl(raw: string): ParsedUrl {\n const url = new URL(raw);\n const scheme = url.protocol.slice(0, -1).toLowerCase();\n const host = url.hostname.toLowerCase();\n const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n const path = url.pathname \|\| \"/\";\n const query: Record<string, string[]> = {};\n for (const [key, value] of url.searchParams) {\n if (!query[key]) {\n query[key] = [];\n }\n query[key].push(value);\n }\n return { scheme, host, port, path, query };\n}\n\n/\n Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n /\nexport function buildUrlString(parsed: ParsedUrl): string {\n const { scheme, host, port, path, query } = parsed;\n const defaultPort = DEFAULT_PORTS[scheme];\n const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n const params = new URLSearchParams();\n for (const [key, values] of Object.entries(query)) {\n for (const value of values) {\n params.append(key, value);\n }\n }\n const queryString = params.toString();\n return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/\n HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n \n The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n /\nexport const HttpRequestContextSchema = z\n .object({\n request_type: z\n .literal(\"http_request\")\n .openapi({ description: \"Context type discriminator\" }),\n method: z\n .string()\n .max(10)\n .transform((m) => m.toUpperCase())\n .openapi({ description: \"HTTP method\" }),\n /* Parsed URL components for policy condition matching /\n url: ParsedUrlSchema,\n /* Filtered headers (IGNORED_HEADERS excluded, keys lowercased) /\n headers: z\n .record(z.string(), z.string())\n .openapi({\n description: \"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\",\n }),\n /* Raw body string /\n body: z\n .string()\n .max(65536)\n .nullable()\n .openapi({ description: \"Raw body string\" }),\n /\n Parsed JSON body. Authored as `z.unknown().pipe(z.json())` so\n * zod-to-openapi sees the outer `z.unknown()` and emits a permissive\n * field (no recursive `$ref`, no type), while the inner `z.json()`\n * still rejects non-JSON values (`Date`, `undefined`, functions) at\n * parse time. Same inferred `JsonValue` type either way.\n /\n body_json: z\n .unknown()\n .pipe(z.json())\n .nullable()\n .describe(\"Parsed JSON body (if applicable)\"),\n /* Zapier connection ID used for this request /\n connection_id: z\n .string()\n .max(255)\n .optional()\n .openapi({ description: \"Zapier connection ID used for this request\" }),\n /* Optional human-readable reason for the request /\n reason: z\n .string()\n .max(1024)\n .optional()\n .openapi({ description: \"Optional human-readable reason for the request\" }),\n })\n .openapi(\"HttpRequestContext\");\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/\n Canonical Zapier action types.\n \n Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n /\nexport const ActionTypeSchema = z\n .enum([\n \"filter\",\n \"read\",\n \"read_bulk\",\n \"run\",\n \"search\",\n \"search_and_write\",\n \"search_or_write\",\n \"write\",\n ])\n .openapi(\"action_type\", { description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/\n Allowed character set for the `selected_api` segment of an action\n * resource. Blocks ``, `/`, `:`, whitespace, and other glob/path\n metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n /\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/\n Allowed character set for the `action_key` segment of an action\n * resource. More permissive than `ACTION_RESOURCE_SEGMENT_PATTERN`\n * because sdkapi emits keys like `ae:358405` and `core:123abc` that\n * carry a namespace prefix separated by `:`. Still blocks ``, `/`,\n whitespace, and other glob/path metacharacters.\n /\nexport const ACTION_KEY_SEGMENT_PATTERN =\n /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;\n\n/\n Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n /\nexport function parseActionResource(resource: string): {\n selected_api: string;\n action_type: ActionType;\n action_key: string;\n} {\n const segments = resource.split(\"/\");\n if (segments.length !== 4 \|\| segments[0] !== \"action\") {\n throw new Error(\n `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n );\n }\n const [, selectedApi, actionTypeRaw, actionKey] = segments;\n if (!selectedApi \|\| !actionTypeRaw \|\| !actionKey) {\n throw new Error(`action resource has empty segment: ${resource}`);\n }\n const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n if (!actionType.success) {\n throw new Error(\n `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n );\n }\n if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n throw new Error(\n `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n );\n }\n if (!ACTION_KEY_SEGMENT_PATTERN.test(actionKey)) {\n throw new Error(\n `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n );\n }\n return {\n selected_api: selectedApi,\n action_type: actionType.data,\n action_key: actionKey,\n };\n}\n\n/\n Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should use `ActionRunContextSchema`, which accepts either the canonical\n * `resource` field or the legacy `{selected_api, action_type, action_key}`\n * triple on input.\n /\nexport const ActionRunContextInputSchema = z\n .object({\n request_type: z\n .literal(\"action_run\")\n .openapi({ description: \"Context type discriminator\" }),\n resource: z\n .string()\n .max(1024)\n .optional()\n .openapi({\n description:\n \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n }),\n selected_api: z\n .string()\n .max(255)\n .optional()\n .openapi({\n deprecated: true,\n description:\n \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n }),\n action_type: ActionTypeSchema.optional().openapi({\n deprecated: true,\n description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n }),\n action_key: z\n .string()\n .max(255)\n .optional()\n .openapi({\n deprecated: true,\n description:\n \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n }),\n connection_id: z\n .string()\n .max(255)\n .optional()\n .openapi({ description: \"Zapier connection ID used for this request\" }),\n /* Action input parameters. See body_json above for the pipe rationale. /\n inputs: z\n .unknown()\n .pipe(z.json())\n .optional()\n .describe(\"Action input parameters\"),\n reason: z\n .string()\n .max(1024)\n .optional()\n .openapi({ description: \"Optional human-readable reason for the request\" }),\n })\n .openapi(\"ActionRunContext\", {\n description:\n \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n (input, ctx) => {\n const resource =\n input.resource ??\n (input.selected_api && input.action_type && input.action_key\n ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n : undefined);\n if (resource === undefined) {\n ctx.addIssue({\n code: \"custom\",\n message:\n \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n });\n return z.NEVER;\n }\n try {\n parseActionResource(resource);\n } catch (err) {\n ctx.addIssue({\n code: \"custom\",\n message: err instanceof Error ? err.message : String(err),\n });\n return z.NEVER;\n }\n return {\n request_type: \"action_run\" as const,\n resource,\n ...(input.connection_id !== undefined && {\n connection_id: input.connection_id,\n }),\n ...(input.inputs !== undefined && { inputs: input.inputs }),\n ...(input.reason !== undefined && { reason: input.reason }),\n };\n },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/\n Union of all request context types, keyed on `request_type`.\n \n Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member. The discriminator metadata\n * below tells OpenAPI consumers how to narrow the union — zod-to-openapi\n * emits this as `anyOf` + discriminator, which openapi-typescript and\n * other codegen targets render as a properly narrowed TS union.\n /\nexport const RequestContextSchema = z\n .union([HttpRequestContextSchema, ActionRunContextSchema])\n .openapi(\"RequestContext\", {\n description: \"Union of request context shapes, keyed on `request_type`.\",\n discriminator: {\n propertyName: \"request_type\",\n mapping: {\n http_request: \"#/components/schemas/HttpRequestContext\",\n action_run: \"#/components/schemas/ActionRunContext\",\n },\n },\n });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/\n Headers to exclude when building request contexts from raw HTTP requests.\n \n These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n /\nexport const IGNORED_HEADERS = new Set([\n // Auth / credentials — never include in contexts or policy conditions\n \"authorization\",\n \"x-relay-authorization\",\n \"x-relay-authentication-id\",\n \"x-api-key\",\n \"cookie\",\n \"set-cookie\",\n \"proxy-authorization\",\n\n // HTTP infrastructure — varies per-request, not policy-relevant\n \"host\",\n \"connection\",\n \"content-length\",\n \"transfer-encoding\",\n \"accept-encoding\",\n \"user-agent\",\n \"accept\",\n \"accept-language\",\n \"sec-fetch-mode\",\n\n // Proxy / forwarding — infrastructure, not meaningful for policy\n \"x-forwarded-for\",\n \"x-forwarded-host\",\n \"x-forwarded-proto\",\n \"x-real-ip\",\n\n // Proxy internal — sdkapi-specific headers\n \"x-is-interactive-session\",\n \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n HttpRequestContextSchema,\n ActionRunContextSchema,\n ActionTypeSchema,\n parseUrl,\n ACTION_RESOURCE_SEGMENT_PATTERN,\n ACTION_KEY_SEGMENT_PATTERN,\n type HttpRequestContext,\n type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n method: z.string(),\n /* Raw URL string. Will be normalized with https:// if no protocol present. /\n url: z.string(),\n /* Raw headers from the request. Will be filtered through IGNORED_HEADERS. /\n headers: z\n .record(\n z.string(),\n z.union([z.string(), z.array(z.string()), z.undefined()]),\n )\n .optional(),\n /* Raw body string /\n body: z.string().nullable().optional(),\n /* Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) /\n body_json: z.json().optional(),\n /* Connection ID associated with this request /\n connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/\n Build a canonical HttpRequestContext from raw request parts.\n \n This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n \n Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n \n - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n /\nexport function buildHttpRequestContext(\n options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n // see well-typed values. Mirrors the pattern in buildActionRunContext.\n const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n // Normalize URL — SDK CLI strips the protocol\n const rawUrl = parsed.url.includes(\"://\")\n ? parsed.url\n : `https://${parsed.url}`;\n const url = parseUrl(rawUrl);\n\n // Filter headers: exclude ignored, lowercase keys, string values only\n const headers: Record<string, string> = {};\n if (parsed.headers) {\n for (const [key, value] of Object.entries(parsed.headers)) {\n const lowerKey = key.toLowerCase();\n if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n headers[lowerKey] = value;\n }\n }\n }\n\n // Auto-parse body_json from body when content-type is JSON\n // (matches createPolicyHttpRequest behavior from @zapier/policy)\n let body_json: unknown = null;\n if (parsed.body_json !== undefined) {\n body_json = parsed.body_json;\n } else if (parsed.body) {\n const contentType = headers[\"content-type\"];\n const isJson =\n typeof contentType === \"string\" &&\n (contentType.includes(\"application/json\") \|\|\n (contentType.includes(\"application/\") &&\n contentType.includes(\"+json\")));\n if (isJson) {\n try {\n body_json = JSON.parse(parsed.body);\n } catch {\n // Invalid JSON body — leave body_json as null\n }\n }\n }\n\n return HttpRequestContextSchema.parse({\n request_type: \"http_request\",\n method: parsed.method.toUpperCase(),\n url,\n headers,\n body: parsed.body ?? null,\n body_json,\n connection_id: parsed.connection_id,\n });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n message:\n \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n }),\n action_type: ActionTypeSchema,\n action_key: z.string().regex(ACTION_KEY_SEGMENT_PATTERN, {\n message:\n \"action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)\",\n }),\n connection_id: z.string().optional(),\n inputs: z.json().optional(),\n reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n typeof BuildActionRunContextOptionsSchema\n>;\n\n/\n Build a canonical ActionRunContext from raw action parts.\n \n Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n /\nexport function buildActionRunContext(\n options: BuildActionRunContextOptions,\n): ActionRunContext {\n const parsed = BuildActionRunContextOptionsSchema.parse(options);\n return ActionRunContextSchema.parse({\n request_type: \"action_run\",\n resource: buildActionResource({\n selected_api: parsed.selected_api,\n action_type: parsed.action_type,\n action_key: parsed.action_key,\n }),\n connection_id: parsed.connection_id,\n inputs: parsed.inputs,\n reason: parsed.reason,\n });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n HttpRequestContext,\n ActionRunContext,\n ActionType,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/\n Build conditions that match an exact HTTP request.\n \n Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n \n @returns Condition[] for an http permission statement\n /\nexport function buildExactHttpConditions(\n context: HttpRequestContext,\n): Condition[] {\n const conditions: Condition[] = [\n { path: [\"method\"], operator: \"equals\", value: context.method },\n ];\n\n const { url } = context;\n\n // matches_url condition uses URL without query string (per @zapier/policy spec)\n const defaultPort =\n url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n conditions.push({\n path: [\"url\"],\n operator: \"matches_url\",\n value: urlWithoutQuery,\n });\n\n // Add decomposed conditions for each query parameter.\n for (const [key, values] of Object.entries(url.query)) {\n conditions.push({\n path: [\"url\", \"query\", key],\n operator: \"equals\",\n value: values,\n });\n }\n\n // body_json condition\n if (context.body_json !== null) {\n conditions.push({\n path: [\"body_json\"],\n operator: \"equals\",\n value: context.body_json,\n });\n } else if (context.body !== null) {\n // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n // exact-match policies actually match the originating request.\n conditions.push({\n path: [\"body\"],\n operator: \"equals\",\n value: context.body,\n });\n }\n\n // Header conditions (filtered through IGNORED_HEADERS again for safety)\n for (const [key, value] of Object.entries(context.headers)) {\n if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === \"string\") {\n conditions.push({\n path: [\"headers\", key.toLowerCase()],\n operator: \"equals\",\n value,\n });\n }\n }\n\n return conditions;\n}\n\n/\n Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n \n @returns Condition[] for an http permission statement\n /\nexport function buildDomainHttpConditions(\n context: HttpRequestContext,\n): Condition[] {\n return [\n {\n path: [\"url\", \"host\"],\n operator: \"matches_host\",\n value: context.url.host,\n },\n ];\n}\n\n/\n Build conditions that match an exact action run (with inputs).\n \n @returns Condition[] for an action permission statement\n /\nexport function buildExactActionConditions(\n context: ActionRunContext,\n): Condition[] {\n const conditions: Condition[] = [];\n\n if (context.inputs !== undefined && context.inputs !== null) {\n conditions.push({\n path: [\"inputs\"],\n operator: \"equals\",\n value: context.inputs,\n });\n }\n\n return conditions;\n}\n\n/\n The three identity fields that compose an action resource string.\n /\nexport interface ActionResourceParts {\n selected_api: string;\n action_type: ActionType;\n action_key: string;\n}\n\n/\n Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n /\nexport function buildActionResource(parts: ActionResourceParts): string {\n return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/\n Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n \n Format: action/{selected_api}/{action_type}/{wildcard}\n /\nexport function buildBroadActionResource(\n parts: Pick<ActionResourceParts, \"selected_api\" \| \"action_type\">,\n): string {\n return `action/${parts.selected_api}/${parts.action_type}/`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n RequestContext,\n HttpRequestContext,\n ActionRunContext,\n} from \"./types.ts\";\nimport {\n buildExactHttpConditions,\n buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/*\n Build a `can_use` authentication statement, if the context has a connection_id.\n /\nfunction buildAuthStatement(authenticationId: string): Statement {\n return {\n effect: \"allow\",\n permissions: [\"can_use\"],\n resources: [`connection/${authenticationId}`],\n conditions: [],\n };\n}\n\n/\n Build an exact-match policy from an HTTP request context.\n \n Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n * plus a `keys_in` guard restricting allowed query parameter keys\n /\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n const statements: Statement[] = [];\n\n if (context.connection_id) {\n statements.push(buildAuthStatement(context.connection_id));\n }\n\n const conditions = buildExactHttpConditions(context);\n\n // Add a keys_in guard so only the query param keys present in the original\n // request are allowed — blocks injection of extra query params.\n conditions.push({\n path: [\"url\", \"query\"],\n operator: \"keys_in\",\n value: Object.keys(context.url.query),\n });\n\n statements.push({\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [\"http\"],\n conditions,\n });\n\n return { version: 2, statements };\n}\n\n/\n Build an exact-match policy from an action run context.\n \n Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n /\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n const statements: Statement[] = [];\n\n if (context.connection_id) {\n statements.push(buildAuthStatement(context.connection_id));\n }\n\n statements.push({\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [context.resource],\n conditions: buildExactActionConditions(context),\n });\n\n return { version: 2, statements };\n}\n\n/\n Build an exact-match policy from any supported request context.\n \n This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n /\nexport function toExactPolicy(context: RequestContext): Policy {\n if (context.request_type === \"http_request\") {\n return httpContextToPolicy(context);\n }\n return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n parseActionResource,\n type ActionType,\n type RequestContext,\n} from \"./types.ts\";\n\n/\n Replace the implementation-version suffix of a `selected_api` with a `@`\n wildcard so connection-level policies stay valid across version bumps. A\n * runtime request with `selected_api: \"App@2.7.3\"` matches a policy resource\n * scoped to `App@` while still being distinguishable from a different app\n (e.g. `App2@1.0.0`).\n \n No-op when the input has no `@` — assumed to be already version-less.\n /\nfunction globSelectedApiVersion(selectedApi: string): string {\n const at = selectedApi.indexOf(\"@\");\n return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@\";\n}\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. /\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/\n Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n /\nexport const READ_ACTION_TYPES = [\n \"read\",\n \"read_bulk\",\n \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n READ_ACTION_TYPES,\n);\n\n/\n Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n /\nexport function isWriteRequest(context: RequestContext): boolean {\n if (context.request_type === \"http_request\") {\n // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n // it on the way in), so no normalization is needed here.\n return !READ_HTTP_METHOD_SET.has(context.method);\n }\n const { action_type } = parseActionResource(context.resource);\n return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/\n Build a connection-level policy that covers both HTTP and action access.\n \n Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/` per allowed type,\n scoped by connection_id. For read access, the resource list expands to\n * one entry per read action_type so the engine matches via the resource\n * string rather than a separate `path: [\"action_type\"]` condition.\n /\nexport function buildConnectionPolicy(options: {\n connectionId: string;\n selectedApi: string;\n accessLevel: AccessLevel;\n}): Policy {\n const { connectionId, selectedApi, accessLevel } = options;\n\n const authStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_use\"],\n resources: [`connection/${connectionId}`],\n conditions: [],\n };\n\n const connectionCondition: Condition = {\n path: [\"connection_id\"],\n operator: \"equals\",\n value: connectionId,\n };\n\n const httpConditions: Condition[] = [connectionCondition];\n if (accessLevel === \"read\") {\n httpConditions.push({\n path: [\"method\"],\n operator: \"in\",\n value: [...READ_HTTP_METHODS],\n });\n }\n\n const httpStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: [\"http\"],\n conditions: httpConditions,\n };\n\n const apiPattern = globSelectedApiVersion(selectedApi);\n const actionResources =\n accessLevel === \"read\"\n ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/`)\n : [`action/${apiPattern}//`];\n\n const actionStatement: Statement = {\n effect: \"allow\",\n permissions: [\"can_execute\"],\n resources: actionResources,\n conditions: [connectionCondition],\n };\n\n return {\n version: 2,\n statements: [authStatement, httpStatement, actionStatement],\n };\n}\n"],"mappings":";AAGA,SAAS,SAAS;AAClB,SAAS,4BAA4B;AAErC,qBAAqB,CAAC;AAOf,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACtE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,mCAAmC,CAAC;AAAA,EAC5E,MAAM,EACH,OAAO,EACP,IAAI,EACJ,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA,EACH,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACpE,OAAO,EACJ,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EACtC,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACL,CAAC,EACA,QAAQ,aAAa;AAAA,EACpB,aAAa;AACf,CAAC;AAII,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc,EACX,QAAQ,cAAc,EACtB,QAAQ,EAAE,aAAa,6BAA6B,CAAC;AAAA,EACxD,QAAQ,EACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAChC,QAAQ,EAAE,aAAa,cAAc,CAAC;AAAA;AAAA,EAEzC,KAAK;AAAA;AAAA,EAEL,SAAS,EACN,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAC7B,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA;AAAA,EAEH,MAAM,EACH,OAAO,EACP,IAAI,KAAK,EACT,SAAS,EACT,QAAQ,EAAE,aAAa,kBAAkB,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ7C,WAAW,EACR,QAAQ,EACR,KAAK,EAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,kCAAkC;AAAA;AAAA,EAE9C,eAAe,EACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,EACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAYxB,IAAM,mBAAmB,EAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,QAAQ,eAAe,EAAE,aAAa,gCAAgC,CAAC;AAUnE,IAAM,kCACX;AASK,IAAM,6BACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,2BAA2B,KAAK,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAUO,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,cAAc,EACX,QAAQ,YAAY,EACpB,QAAQ,EAAE,aAAa,6BAA6B,CAAC;AAAA,EACxD,UAAU,EACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ;AAAA,IACP,aACE;AAAA,EACJ,CAAC;AAAA,EACH,cAAc,EACX,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,aAAa,iBAAiB,SAAS,EAAE,QAAQ;AAAA,IAC/C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,EACT,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,eAAe,EACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,EACL,QAAQ,EACR,KAAK,EAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,yBAAyB;AAAA,EACrC,QAAQ,EACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAAA,EAC3B,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,EAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,EAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAaO,IAAM,uBAAuB,EACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,QAAQ,kBAAkB;AAAA,EACzB,aAAa;AAAA,EACb,eAAe;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,MACP,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF;AACF,CAAC;;;ACtVI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,SAAS,KAAAA,UAAS;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KAAK,OAAO,UAAU,UAAU;AACxE,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADlIO,IAAM,uCAAuCC,GAAE,OAAO;AAAA,EAC3D,QAAQA,GAAE,OAAO;AAAA;AAAA,EAEjB,KAAKA,GAAE,OAAO;AAAA;AAAA,EAEd,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,IACTA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,GAAGA,GAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAWA,GAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE7B,eAAeA,GAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ;AAAA,IACrB;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,cAAcA,GAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAYA,GAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQA,GAAE,KAAK,EAAE,SAAS;AAAA,EAC1B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AErIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,SAAS,KAAAC,UAAS;AAiBlB,SAAS,uBAAuB,aAA6B;AAC3D,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAEO,IAAM,oBAAoBC,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;","names":["z","z","z","z"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/policy-context",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Shared request context types, builders, and policy condition generators for sdkapi and approvalsapi",
   "repository": {
     "type": "git",