@zapier/policy-context 1.3.0-mr.6.c3a1f51e → 2.0.0

package/dist/index.cjs

@@ -44,6 +44,7 @@ __export(index_exports, {
   buildHttpRequestContext: () => buildHttpRequestContext,
   buildUrlString: () => buildUrlString,
   globSelectedApiVersion: () => globSelectedApiVersion,
+  isIgnoredHeader: () => isIgnoredHeader,
   isWriteRequest: () => isWriteRequest,
   parseActionResource: () => parseActionResource,
   parseUrl: () => parseUrl,
@@ -265,8 +266,15 @@ var IGNORED_HEADERS = /* @__PURE__ */ new Set([
   "x-real-ip",
   // Proxy internal — sdkapi-specific headers
   "x-is-interactive-session",
-  "x-relay-callback-url"
+  "x-relay-callback-url",
+  // Subsumed by isIgnoredHeader's x-zapier- prefix rule; kept for byte-parity
+  // with the approvalsapi source and for consumers reading the set directly.
+  "x-zapier-approval-token"
 ]);
+function isIgnoredHeader(name) {
+  const normalized = name.toLowerCase();
+  return IGNORED_HEADERS.has(normalized) || normalized.startsWith("zapier-") || normalized.startsWith("x-zapier-");
+}
 
 // src/builders.ts
 var import_zod2 = require("zod");
@@ -306,7 +314,7 @@ function buildExactHttpConditions(context) {
     });
   }
   for (const [key, value] of Object.entries(context.headers)) {
-    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+    if (!isIgnoredHeader(key) && typeof value === "string") {
       conditions.push({
         path: ["headers", key.toLowerCase()],
         operator: "equals",
@@ -348,7 +356,7 @@ var BuildHttpRequestContextOptionsSchema = import_zod2.z.object({
   method: import_zod2.z.string(),
   /** Raw URL string. Will be normalized with https:// if no protocol present. */
   url: import_zod2.z.string(),
-  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */
+  /** Raw headers from the request. Will be filtered through isIgnoredHeader. */
   headers: import_zod2.z.record(
     import_zod2.z.string(),
     import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string()), import_zod2.z.undefined()])
@@ -368,7 +376,7 @@ function buildHttpRequestContext(options) {
   if (parsed.headers) {
     for (const [key, value] of Object.entries(parsed.headers)) {
       const lowerKey = key.toLowerCase();
-      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === "string") {
+      if (!isIgnoredHeader(lowerKey) && typeof value === "string") {
         headers[lowerKey] = value;
       }
     }
@@ -391,7 +399,7 @@ function buildHttpRequestContext(options) {
     method: parsed.method.toUpperCase(),
     url,
     headers,
-    body: parsed.body ?? null,
+    body: body_json === null ? parsed.body ?? null : null,
     body_json,
     connection_id: parsed.connection_id
   });
@@ -595,6 +603,7 @@ function buildConnectionlessPolicy(options) {
   buildHttpRequestContext,
   buildUrlString,
   globSelectedApiVersion,
+  isIgnoredHeader,
   isWriteRequest,
   parseActionResource,
   parseUrl,

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts","../src/connectionless-policy.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  ActionRunContextInputSchema,\n  ActionTypeSchema,\n  RequestContextSchema,\n  ParsedUrlSchema,\n  DEFAULT_PORTS,\n  parseUrl,\n  buildUrlString,\n  parseActionResource,\n  toAppKey,\n  globSelectedApiVersion,\n  type HttpRequestContext,\n  type ActionRunContext,\n  type ActionType,\n  type RequestContext,\n  type ParsedUrl,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport {\n  buildHttpRequestContext,\n  buildActionRunContext,\n  BuildHttpRequestContextOptionsSchema,\n  BuildActionRunContextOptionsSchema,\n  type BuildHttpRequestContextOptions,\n  type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n  buildExactHttpConditions,\n  buildDomainHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n  buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n\nexport {\n  buildConnectionPolicy,\n  isWriteRequest,\n  AccessLevelSchema,\n  READ_ACTION_TYPES,\n  READ_HTTP_METHODS,\n  type AccessLevel,\n} from \"./connection-policy.ts\";\n\nexport { buildConnectionlessPolicy } from \"./connectionless-policy.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\n\n/**\n * Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n */\nexport const ParsedUrlSchema = z\n  .object({\n    scheme: z.string().describe('URL scheme, e.g. \"https\"'),\n    host: z.string().describe('Hostname, e.g. \"api.example.com\"'),\n    port: z\n      .number()\n      .int()\n      .describe(\"Port number (defaults to 443 for https, 80 for http)\"),\n    path: z.string().describe('URL path, e.g. \"/v1/foo\"'),\n    query: z\n      .record(z.string(), z.array(z.string()))\n      .describe(\"Query parameters as key to string array mapping\"),\n  })\n  .meta({\n    id: \"ParsedUrl\",\n    description: \"Parsed URL components for policy condition matching\",\n  });\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/** Default ports by scheme, used when URL has no explicit port. */\nexport const DEFAULT_PORTS: Record<string, number> = {\n  http: 80,\n  https: 443,\n};\n\n/**\n * Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n */\nexport function parseUrl(raw: string): ParsedUrl {\n  const url = new URL(raw);\n  const scheme = url.protocol.slice(0, -1).toLowerCase();\n  const host = url.hostname.toLowerCase();\n  const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n  const path = url.pathname || \"/\";\n  const query: Record<string, string[]> = {};\n  for (const [key, value] of url.searchParams) {\n    if (!query[key]) {\n      query[key] = [];\n    }\n    query[key].push(value);\n  }\n  return { scheme, host, port, path, query };\n}\n\n/**\n * Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n */\nexport function buildUrlString(parsed: ParsedUrl): string {\n  const { scheme, host, port, path, query } = parsed;\n  const defaultPort = DEFAULT_PORTS[scheme];\n  const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n  const params = new URLSearchParams();\n  for (const [key, values] of Object.entries(query)) {\n    for (const value of values) {\n      params.append(key, value);\n    }\n  }\n  const queryString = params.toString();\n  return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n *\n * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n */\nexport const HttpRequestContextSchema = z\n  .object({\n    request_type: z\n      .literal(\"http_request\")\n      .describe(\"Context type discriminator\"),\n    method: z\n      .string()\n      .max(10)\n      .transform((m) => m.toUpperCase())\n      .describe(\"HTTP method\"),\n    /** Parsed URL components for policy condition matching */\n    url: ParsedUrlSchema,\n    /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n    headers: z\n      .record(z.string(), z.string())\n      .describe(\"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\"),\n    /** Raw body string */\n    body: z.string().max(65536).nullable().describe(\"Raw body string\"),\n    /**\n     * Parsed JSON body. Authored as `z.unknown().pipe(z.json())` so\n     * the OpenAPI generator sees the outer `z.unknown()` and emits a\n     * permissive field (no recursive `$ref`, no type), while the inner\n     * `z.json()` still rejects non-JSON values (`Date`, `undefined`,\n     * functions) at parse time. Same inferred `JsonValue` type either way.\n     */\n    body_json: z\n      .unknown()\n      .pipe(z.json())\n      .nullable()\n      .describe(\"Parsed JSON body (if applicable)\"),\n    /** Zapier connection ID used for this request */\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .describe(\"Zapier connection ID used for this request\"),\n    /** Optional human-readable reason for the request */\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\"Optional human-readable reason for the request\"),\n  })\n  .meta({ id: \"HttpRequestContext\" });\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Canonical Zapier action types.\n *\n * Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n */\nexport const ActionTypeSchema = z\n  .enum([\n    \"filter\",\n    \"read\",\n    \"read_bulk\",\n    \"run\",\n    \"search\",\n    \"search_and_write\",\n    \"search_or_write\",\n    \"write\",\n  ])\n  .meta({ id: \"action_type\", description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/**\n * Allowed character set for the `selected_api` segment of an action\n * resource. Blocks `*`, `/`, `:`, whitespace, and other glob/path\n * metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n */\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/**\n * Allowed character set for the `action_key` segment of an action\n * resource. More permissive than `ACTION_RESOURCE_SEGMENT_PATTERN`\n * because sdkapi emits keys like `ae:358405` and `core:123abc` that\n * carry a namespace prefix separated by `:`. Still blocks `*`, `/`,\n * whitespace, and other glob/path metacharacters.\n */\nexport const ACTION_KEY_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;\n\n/**\n * Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n */\nexport function parseActionResource(resource: string): {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n} {\n  const segments = resource.split(\"/\");\n  if (segments.length !== 4 || segments[0] !== \"action\") {\n    throw new Error(\n      `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n    );\n  }\n  const [, selectedApi, actionTypeRaw, actionKey] = segments;\n  if (!selectedApi || !actionTypeRaw || !actionKey) {\n    throw new Error(`action resource has empty segment: ${resource}`);\n  }\n  const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n  if (!actionType.success) {\n    throw new Error(\n      `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n    );\n  }\n  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n    throw new Error(\n      `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n    );\n  }\n  if (!ACTION_KEY_SEGMENT_PATTERN.test(actionKey)) {\n    throw new Error(\n      `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n    );\n  }\n  return {\n    selected_api: selectedApi,\n    action_type: actionType.data,\n    action_key: actionKey,\n  };\n}\n\n/**\n * Strip the `@<version>` suffix from a `selected_api` / implementation\n * identifier. `Slack@1.0.0` → `Slack`. Passing a value without `@` is a\n * no-op. Used by UIs to render a human-friendly app key independent of\n * version, and by `globSelectedApiVersion` below.\n */\nexport function toAppKey(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at);\n}\n\n/**\n * Replace the implementation-version suffix of a `selected_api` with a `@*`\n * wildcard so policies stay valid across version bumps. A runtime request\n * with `selected_api: \"App@2.7.3\"` matches a policy resource scoped to\n * `App@*` while still being distinguishable from a different app\n * (e.g. `App2@1.0.0`).\n *\n * No-op when the input has no `@` — assumed to be already version-less.\n */\nexport function globSelectedApiVersion(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@*\";\n}\n\n/**\n * Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should use `ActionRunContextSchema`, which accepts either the canonical\n * `resource` field or the legacy `{selected_api, action_type, action_key}`\n * triple on input.\n */\nexport const ActionRunContextInputSchema = z\n  .object({\n    request_type: z\n      .literal(\"action_run\")\n      .describe(\"Context type discriminator\"),\n    resource: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\n        \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n      ),\n    selected_api: z.string().max(255).optional().meta({\n      deprecated: true,\n      description:\n        \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n    }),\n    action_type: ActionTypeSchema.optional().meta({\n      deprecated: true,\n      description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n    }),\n    action_key: z.string().max(255).optional().meta({\n      deprecated: true,\n      description: \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n    }),\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .describe(\"Zapier connection ID used for this request\"),\n    /** Action input parameters. See body_json above for the pipe rationale. */\n    inputs: z\n      .unknown()\n      .pipe(z.json())\n      .optional()\n      .describe(\"Action input parameters\"),\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\"Optional human-readable reason for the request\"),\n  })\n  .meta({\n    id: \"ActionRunContext\",\n    description:\n      \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n  });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n  (input, ctx) => {\n    const resource =\n      input.resource ??\n      (input.selected_api && input.action_type && input.action_key\n        ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n        : undefined);\n    if (resource === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n      });\n      return z.NEVER;\n    }\n    try {\n      parseActionResource(resource);\n    } catch (err) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n      return z.NEVER;\n    }\n    return {\n      request_type: \"action_run\" as const,\n      resource,\n      ...(input.connection_id !== undefined && {\n        connection_id: input.connection_id,\n      }),\n      ...(input.inputs !== undefined && { inputs: input.inputs }),\n      ...(input.reason !== undefined && { reason: input.reason }),\n    };\n  },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Union of all request context types, keyed on `request_type`.\n *\n * Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member. The `request_type`\n * discriminator carried in `.meta()` below is read natively by the\n * OpenAPI generator (`@zapier/openapi-spec`), which emits it as\n * `anyOf` + discriminator that openapi-typescript and other codegen\n * targets render as a properly narrowed TS union.\n */\nexport const RequestContextSchema = z\n  .union([HttpRequestContextSchema, ActionRunContextSchema])\n  .meta({\n    id: \"RequestContext\",\n    description: \"Union of request context shapes, keyed on `request_type`.\",\n    discriminator: {\n      propertyName: \"request_type\",\n      mapping: {\n        http_request: \"#/components/schemas/HttpRequestContext\",\n        action_run: \"#/components/schemas/ActionRunContext\",\n      },\n    },\n  });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  ActionTypeSchema,\n  parseUrl,\n  ACTION_RESOURCE_SEGMENT_PATTERN,\n  ACTION_KEY_SEGMENT_PATTERN,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: z.json().optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n *\n * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n  // see well-typed values. Mirrors the pattern in buildActionRunContext.\n  const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n  // Normalize URL — SDK CLI strips the protocol\n  const rawUrl = parsed.url.includes(\"://\")\n    ? parsed.url\n    : `https://${parsed.url}`;\n  const url = parseUrl(rawUrl);\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (parsed.headers) {\n    for (const [key, value] of Object.entries(parsed.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  // Auto-parse body_json from body when content-type is JSON\n  // (matches createPolicyHttpRequest behavior from @zapier/policy)\n  let body_json: unknown = null;\n  if (parsed.body_json !== undefined) {\n    body_json = parsed.body_json;\n  } else if (parsed.body) {\n    const contentType = headers[\"content-type\"];\n    const isJson =\n      typeof contentType === \"string\" &&\n      (contentType.includes(\"application/json\") ||\n        (contentType.includes(\"application/\") &&\n          contentType.includes(\"+json\")));\n    if (isJson) {\n      try {\n        body_json = JSON.parse(parsed.body);\n      } catch {\n        // Invalid JSON body — leave body_json as null\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: parsed.method.toUpperCase(),\n    url,\n    headers,\n    body: parsed.body ?? null,\n    body_json,\n    connection_id: parsed.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n    message:\n      \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n  }),\n  action_type: ActionTypeSchema,\n  action_key: z.string().regex(ACTION_KEY_SEGMENT_PATTERN, {\n    message:\n      \"action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)\",\n  }),\n  connection_id: z.string().optional(),\n  inputs: z.json().optional(),\n  reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n *\n * Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  const parsed = BuildActionRunContextOptionsSchema.parse(options);\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    resource: buildActionResource({\n      selected_api: parsed.selected_api,\n      action_type: parsed.action_type,\n      action_key: parsed.action_key,\n    }),\n    connection_id: parsed.connection_id,\n    inputs: parsed.inputs,\n    reason: parsed.reason,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n  HttpRequestContext,\n  ActionRunContext,\n  ActionType,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  const { url } = context;\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const defaultPort =\n    url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n  const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  for (const [key, values] of Object.entries(url.query)) {\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  } else if (context.body !== null) {\n    // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n    // exact-match policies actually match the originating request.\n    conditions.push({\n      path: [\"body\"],\n      operator: \"equals\",\n      value: context.body,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  for (const [key, value] of Object.entries(context.headers)) {\n    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === \"string\") {\n      conditions.push({\n        path: [\"headers\", key.toLowerCase()],\n        operator: \"equals\",\n        value,\n      });\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: context.url.host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (context.inputs !== undefined && context.inputs !== null) {\n    conditions.push({\n      path: [\"inputs\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * The three identity fields that compose an action resource string.\n */\nexport interface ActionResourceParts {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(parts: ActionResourceParts): string {\n  return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n *\n * Format: action/{selected_api}/{action_type}/{wildcard}\n */\nexport function buildBroadActionResource(\n  parts: Pick<ActionResourceParts, \"selected_api\" | \"action_type\">,\n): string {\n  return `action/${parts.selected_api}/${parts.action_type}/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  conditions.push({\n    path: [\"url\", \"query\"],\n    operator: \"keys_in\",\n    value: Object.keys(context.url.query),\n  });\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [context.resource],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  globSelectedApiVersion,\n  parseActionResource,\n  type ActionType,\n  type RequestContext,\n} from \"./types.ts\";\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. */\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/**\n * Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n */\nexport const READ_ACTION_TYPES = [\n  \"read\",\n  \"read_bulk\",\n  \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n  READ_ACTION_TYPES,\n);\n\n/**\n * Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n */\nexport function isWriteRequest(context: RequestContext): boolean {\n  if (context.request_type === \"http_request\") {\n    // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n    // it on the way in), so no normalization is needed here.\n    return !READ_HTTP_METHOD_SET.has(context.method);\n  }\n  const { action_type } = parseActionResource(context.resource);\n  return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/**\n * Build a connection-level policy that covers both HTTP and action access.\n *\n * Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/*` per allowed type,\n *    scoped by connection_id. For read access, the resource list expands to\n *    one entry per read action_type so the engine matches via the resource\n *    string rather than a separate `path: [\"action_type\"]` condition.\n */\nexport function buildConnectionPolicy(options: {\n  connectionId: string;\n  selectedApi: string;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { connectionId, selectedApi, accessLevel } = options;\n\n  const authStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${connectionId}`],\n    conditions: [],\n  };\n\n  const connectionCondition: Condition = {\n    path: [\"connection_id\"],\n    operator: \"equals\",\n    value: connectionId,\n  };\n\n  const httpConditions: Condition[] = [connectionCondition];\n  if (accessLevel === \"read\") {\n    httpConditions.push({\n      path: [\"method\"],\n      operator: \"in\",\n      value: [...READ_HTTP_METHODS],\n    });\n  }\n\n  const httpStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions: httpConditions,\n  };\n\n  const apiPattern = globSelectedApiVersion(selectedApi);\n  const actionResources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const actionStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: actionResources,\n    conditions: [connectionCondition],\n  };\n\n  return {\n    version: 2,\n    statements: [authStatement, httpStatement, actionStatement],\n  };\n}\n","// ABOUTME: Builds connectionless approval policies bound to a domain (HTTP) or an action (action_run).\n// ABOUTME: Used when the smart-policy flag is off and the request has no connection_id.\n\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  globSelectedApiVersion,\n  parseActionResource,\n  type RequestContext,\n} from \"./types.ts\";\nimport {\n  READ_ACTION_TYPES,\n  READ_HTTP_METHODS,\n  type AccessLevel,\n} from \"./connection-policy.ts\";\n\n/**\n * Build a connectionless policy that scopes access to the request's domain\n * (HTTP) or its app (action_run). Mirrors the read/write semantics of\n * `buildConnectionPolicy` minus the auth statement and `connection_id`\n * condition, since there is no connection to bind to.\n */\nexport function buildConnectionlessPolicy(options: {\n  context: RequestContext;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { context, accessLevel } = options;\n\n  if (context.request_type === \"http_request\") {\n    const conditions: Condition[] = [\n      {\n        path: [\"url\", \"host\"],\n        operator: \"matches_host\",\n        value: context.url.host,\n      },\n    ];\n    if (accessLevel === \"read\") {\n      conditions.push({\n        path: [\"method\"],\n        operator: \"in\",\n        value: [...READ_HTTP_METHODS],\n      });\n    }\n\n    const statement: Statement = {\n      effect: \"allow\",\n      permissions: [\"can_execute\"],\n      resources: [\"http\"],\n      conditions,\n    };\n    return { version: 2, statements: [statement] };\n  }\n\n  const { selected_api } = parseActionResource(context.resource);\n  const apiPattern = globSelectedApiVersion(selected_api);\n  const resources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const statement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources,\n    conditions: [],\n  };\n  return { version: 2, statements: [statement] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAOX,IAAM,kBAAkB,aAC5B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,SAAS,0BAA0B;AAAA,EACtD,MAAM,aAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC5D,MAAM,aACH,OAAO,EACP,IAAI,EACJ,SAAS,sDAAsD;AAAA,EAClE,MAAM,aAAE,OAAO,EAAE,SAAS,0BAA0B;AAAA,EACpD,OAAO,aACJ,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC,EACtC,SAAS,iDAAiD;AAC/D,CAAC,EACA,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aAAa;AACf,CAAC;AAII,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,aACrC,OAAO;AAAA,EACN,cAAc,aACX,QAAQ,cAAc,EACtB,SAAS,4BAA4B;AAAA,EACxC,QAAQ,aACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAChC,SAAS,aAAa;AAAA;AAAA,EAEzB,KAAK;AAAA;AAAA,EAEL,SAAS,aACN,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAC7B,SAAS,8DAA8D;AAAA;AAAA,EAE1E,MAAM,aAAE,OAAO,EAAE,IAAI,KAAK,EAAE,SAAS,EAAE,SAAS,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjE,WAAW,aACR,QAAQ,EACR,KAAK,aAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,kCAAkC;AAAA;AAAA,EAE9C,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,SAAS,4CAA4C;AAAA;AAAA,EAExD,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,SAAS,gDAAgD;AAC9D,CAAC,EACA,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAY7B,IAAM,mBAAmB,aAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,KAAK,EAAE,IAAI,eAAe,aAAa,gCAAgC,CAAC;AAUpE,IAAM,kCACX;AASK,IAAM,6BACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,2BAA2B,KAAK,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAQO,SAAS,SAAS,aAA6B;AACpD,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE;AAC1D;AAWO,SAAS,uBAAuB,aAA6B;AAClE,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAUO,IAAM,8BAA8B,aACxC,OAAO;AAAA,EACN,cAAc,aACX,QAAQ,YAAY,EACpB,SAAS,4BAA4B;AAAA,EACxC,UAAU,aACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,cAAc,aAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK;AAAA,IAChD,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa,iBAAiB,SAAS,EAAE,KAAK;AAAA,IAC5C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,aAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK;AAAA,IAC9C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,SAAS,4CAA4C;AAAA;AAAA,EAExD,QAAQ,aACL,QAAQ,EACR,KAAK,aAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,yBAAyB;AAAA,EACrC,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,SAAS,gDAAgD;AAC9D,CAAC,EACA,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,aACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,eAAe;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,MACP,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF;AACF,CAAC;;;AC5VI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,IAAAA,cAAkB;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KAAK,OAAO,UAAU,UAAU;AACxE,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADlIO,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,cAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE7B,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ;AAAA,IACrB;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAY,cAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,cAAE,KAAK,EAAE,SAAS;AAAA,EAC1B,QAAQ,cAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AErIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,IAAAC,cAAkB;AASX,IAAM,oBAAoB,cAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;;;ACjGO,SAAS,0BAA0B,SAG/B;AACT,QAAM,EAAE,SAAS,YAAY,IAAI;AAEjC,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,UAAM,aAA0B;AAAA,MAC9B;AAAA,QACE,MAAM,CAAC,OAAO,MAAM;AAAA,QACpB,UAAU;AAAA,QACV,OAAO,QAAQ,IAAI;AAAA,MACrB;AAAA,IACF;AACA,QAAI,gBAAgB,QAAQ;AAC1B,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,QAAQ;AAAA,QACf,UAAU;AAAA,QACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,MAC9B,CAAC;AAAA,IACH;AAEA,UAAMC,aAAuB;AAAA,MAC3B,QAAQ;AAAA,MACR,aAAa,CAAC,aAAa;AAAA,MAC3B,WAAW,CAAC,MAAM;AAAA,MAClB;AAAA,IACF;AACA,WAAO,EAAE,SAAS,GAAG,YAAY,CAACA,UAAS,EAAE;AAAA,EAC/C;AAEA,QAAM,EAAE,aAAa,IAAI,oBAAoB,QAAQ,QAAQ;AAC7D,QAAM,aAAa,uBAAuB,YAAY;AACtD,QAAM,YACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,YAAuB;AAAA,IAC3B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B;AAAA,IACA,YAAY,CAAC;AAAA,EACf;AACA,SAAO,EAAE,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE;AAC/C;","names":["import_zod","import_zod","statement"]}
+{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts","../src/connectionless-policy.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  ActionRunContextInputSchema,\n  ActionTypeSchema,\n  RequestContextSchema,\n  ParsedUrlSchema,\n  DEFAULT_PORTS,\n  parseUrl,\n  buildUrlString,\n  parseActionResource,\n  toAppKey,\n  globSelectedApiVersion,\n  type HttpRequestContext,\n  type ActionRunContext,\n  type ActionType,\n  type RequestContext,\n  type ParsedUrl,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS, isIgnoredHeader } from \"./constants.ts\";\n\nexport {\n  buildHttpRequestContext,\n  buildActionRunContext,\n  BuildHttpRequestContextOptionsSchema,\n  BuildActionRunContextOptionsSchema,\n  type BuildHttpRequestContextOptions,\n  type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n  buildExactHttpConditions,\n  buildDomainHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n  buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n\nexport {\n  buildConnectionPolicy,\n  isWriteRequest,\n  AccessLevelSchema,\n  READ_ACTION_TYPES,\n  READ_HTTP_METHODS,\n  type AccessLevel,\n} from \"./connection-policy.ts\";\n\nexport { buildConnectionlessPolicy } from \"./connectionless-policy.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\n\n/**\n * Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n */\nexport const ParsedUrlSchema = z\n  .object({\n    scheme: z.string().describe('URL scheme, e.g. \"https\"'),\n    host: z.string().describe('Hostname, e.g. \"api.example.com\"'),\n    port: z\n      .number()\n      .int()\n      .describe(\"Port number (defaults to 443 for https, 80 for http)\"),\n    path: z.string().describe('URL path, e.g. \"/v1/foo\"'),\n    query: z\n      .record(z.string(), z.array(z.string()))\n      .describe(\"Query parameters as key to string array mapping\"),\n  })\n  .meta({\n    id: \"ParsedUrl\",\n    description: \"Parsed URL components for policy condition matching\",\n  });\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/** Default ports by scheme, used when URL has no explicit port. */\nexport const DEFAULT_PORTS: Record<string, number> = {\n  http: 80,\n  https: 443,\n};\n\n/**\n * Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n */\nexport function parseUrl(raw: string): ParsedUrl {\n  const url = new URL(raw);\n  const scheme = url.protocol.slice(0, -1).toLowerCase();\n  const host = url.hostname.toLowerCase();\n  const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n  const path = url.pathname || \"/\";\n  const query: Record<string, string[]> = {};\n  for (const [key, value] of url.searchParams) {\n    if (!query[key]) {\n      query[key] = [];\n    }\n    query[key].push(value);\n  }\n  return { scheme, host, port, path, query };\n}\n\n/**\n * Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n */\nexport function buildUrlString(parsed: ParsedUrl): string {\n  const { scheme, host, port, path, query } = parsed;\n  const defaultPort = DEFAULT_PORTS[scheme];\n  const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n  const params = new URLSearchParams();\n  for (const [key, values] of Object.entries(query)) {\n    for (const value of values) {\n      params.append(key, value);\n    }\n  }\n  const queryString = params.toString();\n  return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n *\n * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n */\nexport const HttpRequestContextSchema = z\n  .object({\n    request_type: z\n      .literal(\"http_request\")\n      .describe(\"Context type discriminator\"),\n    method: z\n      .string()\n      .max(10)\n      .transform((m) => m.toUpperCase())\n      .describe(\"HTTP method\"),\n    /** Parsed URL components for policy condition matching */\n    url: ParsedUrlSchema,\n    /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n    headers: z\n      .record(z.string(), z.string())\n      .describe(\"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\"),\n    /** Raw body string */\n    body: z.string().max(65536).nullable().describe(\"Raw body string\"),\n    /**\n     * Parsed JSON body. Authored as `z.unknown().pipe(z.json())` so\n     * the OpenAPI generator sees the outer `z.unknown()` and emits a\n     * permissive field (no recursive `$ref`, no type), while the inner\n     * `z.json()` still rejects non-JSON values (`Date`, `undefined`,\n     * functions) at parse time. Same inferred `JsonValue` type either way.\n     */\n    body_json: z\n      .unknown()\n      .pipe(z.json())\n      .nullable()\n      .describe(\"Parsed JSON body (if applicable)\"),\n    /** Zapier connection ID used for this request */\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .describe(\"Zapier connection ID used for this request\"),\n    /** Optional human-readable reason for the request */\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\"Optional human-readable reason for the request\"),\n  })\n  .meta({ id: \"HttpRequestContext\" });\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Canonical Zapier action types.\n *\n * Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n */\nexport const ActionTypeSchema = z\n  .enum([\n    \"filter\",\n    \"read\",\n    \"read_bulk\",\n    \"run\",\n    \"search\",\n    \"search_and_write\",\n    \"search_or_write\",\n    \"write\",\n  ])\n  .meta({ id: \"action_type\", description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/**\n * Allowed character set for the `selected_api` segment of an action\n * resource. Blocks `*`, `/`, `:`, whitespace, and other glob/path\n * metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n */\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/**\n * Allowed character set for the `action_key` segment of an action\n * resource. More permissive than `ACTION_RESOURCE_SEGMENT_PATTERN`\n * because sdkapi emits keys like `ae:358405` and `core:123abc` that\n * carry a namespace prefix separated by `:`. Still blocks `*`, `/`,\n * whitespace, and other glob/path metacharacters.\n */\nexport const ACTION_KEY_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;\n\n/**\n * Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n */\nexport function parseActionResource(resource: string): {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n} {\n  const segments = resource.split(\"/\");\n  if (segments.length !== 4 || segments[0] !== \"action\") {\n    throw new Error(\n      `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n    );\n  }\n  const [, selectedApi, actionTypeRaw, actionKey] = segments;\n  if (!selectedApi || !actionTypeRaw || !actionKey) {\n    throw new Error(`action resource has empty segment: ${resource}`);\n  }\n  const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n  if (!actionType.success) {\n    throw new Error(\n      `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n    );\n  }\n  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n    throw new Error(\n      `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n    );\n  }\n  if (!ACTION_KEY_SEGMENT_PATTERN.test(actionKey)) {\n    throw new Error(\n      `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n    );\n  }\n  return {\n    selected_api: selectedApi,\n    action_type: actionType.data,\n    action_key: actionKey,\n  };\n}\n\n/**\n * Strip the `@<version>` suffix from a `selected_api` / implementation\n * identifier. `Slack@1.0.0` → `Slack`. Passing a value without `@` is a\n * no-op. Used by UIs to render a human-friendly app key independent of\n * version, and by `globSelectedApiVersion` below.\n */\nexport function toAppKey(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at);\n}\n\n/**\n * Replace the implementation-version suffix of a `selected_api` with a `@*`\n * wildcard so policies stay valid across version bumps. A runtime request\n * with `selected_api: \"App@2.7.3\"` matches a policy resource scoped to\n * `App@*` while still being distinguishable from a different app\n * (e.g. `App2@1.0.0`).\n *\n * No-op when the input has no `@` — assumed to be already version-less.\n */\nexport function globSelectedApiVersion(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@*\";\n}\n\n/**\n * Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should use `ActionRunContextSchema`, which accepts either the canonical\n * `resource` field or the legacy `{selected_api, action_type, action_key}`\n * triple on input.\n */\nexport const ActionRunContextInputSchema = z\n  .object({\n    request_type: z\n      .literal(\"action_run\")\n      .describe(\"Context type discriminator\"),\n    resource: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\n        \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n      ),\n    selected_api: z.string().max(255).optional().meta({\n      deprecated: true,\n      description:\n        \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n    }),\n    action_type: ActionTypeSchema.optional().meta({\n      deprecated: true,\n      description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n    }),\n    action_key: z.string().max(255).optional().meta({\n      deprecated: true,\n      description: \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n    }),\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .describe(\"Zapier connection ID used for this request\"),\n    /** Action input parameters. See body_json above for the pipe rationale. */\n    inputs: z\n      .unknown()\n      .pipe(z.json())\n      .optional()\n      .describe(\"Action input parameters\"),\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\"Optional human-readable reason for the request\"),\n  })\n  .meta({\n    id: \"ActionRunContext\",\n    description:\n      \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n  });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n  (input, ctx) => {\n    const resource =\n      input.resource ??\n      (input.selected_api && input.action_type && input.action_key\n        ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n        : undefined);\n    if (resource === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n      });\n      return z.NEVER;\n    }\n    try {\n      parseActionResource(resource);\n    } catch (err) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n      return z.NEVER;\n    }\n    return {\n      request_type: \"action_run\" as const,\n      resource,\n      ...(input.connection_id !== undefined && {\n        connection_id: input.connection_id,\n      }),\n      ...(input.inputs !== undefined && { inputs: input.inputs }),\n      ...(input.reason !== undefined && { reason: input.reason }),\n    };\n  },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Union of all request context types, keyed on `request_type`.\n *\n * Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member. The `request_type`\n * discriminator carried in `.meta()` below is read natively by the\n * OpenAPI generator (`@zapier/openapi-spec`), which emits it as\n * `anyOf` + discriminator that openapi-typescript and other codegen\n * targets render as a properly narrowed TS union.\n */\nexport const RequestContextSchema = z\n  .union([HttpRequestContextSchema, ActionRunContextSchema])\n  .meta({\n    id: \"RequestContext\",\n    description: \"Union of request context shapes, keyed on `request_type`.\",\n    discriminator: {\n      propertyName: \"request_type\",\n      mapping: {\n        http_request: \"#/components/schemas/HttpRequestContext\",\n        action_run: \"#/components/schemas/ActionRunContext\",\n      },\n    },\n  });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n  // Subsumed by isIgnoredHeader's x-zapier- prefix rule; kept for byte-parity\n  // with the approvalsapi source and for consumers reading the set directly.\n  \"x-zapier-approval-token\",\n]);\n\nexport function isIgnoredHeader(name: string): boolean {\n  const normalized = name.toLowerCase();\n  return (\n    IGNORED_HEADERS.has(normalized) ||\n    normalized.startsWith(\"zapier-\") ||\n    normalized.startsWith(\"x-zapier-\")\n  );\n}\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  ActionTypeSchema,\n  parseUrl,\n  ACTION_RESOURCE_SEGMENT_PATTERN,\n  ACTION_KEY_SEGMENT_PATTERN,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { isIgnoredHeader } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through isIgnoredHeader. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: z.json().optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * two additions: header filtering through isIgnoredHeader, and body/body_json\n * exclusivity (createPolicyHttpRequest keeps the raw body alongside body_json).\n *\n * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through isIgnoredHeader (IGNORED_HEADERS set plus\n *   zapier-* / x-zapier-* prefixes), lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - Exactly one of body / body_json is populated: body is null whenever\n *   body_json is set; both default to null (not undefined)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n  // see well-typed values. Mirrors the pattern in buildActionRunContext.\n  const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n  // Normalize URL — SDK CLI strips the protocol\n  const rawUrl = parsed.url.includes(\"://\")\n    ? parsed.url\n    : `https://${parsed.url}`;\n  const url = parseUrl(rawUrl);\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (parsed.headers) {\n    for (const [key, value] of Object.entries(parsed.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!isIgnoredHeader(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  // Auto-parse body_json from body when content-type is JSON\n  // (matches createPolicyHttpRequest behavior from @zapier/policy)\n  let body_json: unknown = null;\n  if (parsed.body_json !== undefined) {\n    body_json = parsed.body_json;\n  } else if (parsed.body) {\n    const contentType = headers[\"content-type\"];\n    const isJson =\n      typeof contentType === \"string\" &&\n      (contentType.includes(\"application/json\") ||\n        (contentType.includes(\"application/\") &&\n          contentType.includes(\"+json\")));\n    if (isJson) {\n      try {\n        body_json = JSON.parse(parsed.body);\n      } catch {\n        // Invalid JSON body — leave body_json as null\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: parsed.method.toUpperCase(),\n    url,\n    headers,\n    body: body_json === null ? (parsed.body ?? null) : null,\n    body_json,\n    connection_id: parsed.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n    message:\n      \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n  }),\n  action_type: ActionTypeSchema,\n  action_key: z.string().regex(ACTION_KEY_SEGMENT_PATTERN, {\n    message:\n      \"action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)\",\n  }),\n  connection_id: z.string().optional(),\n  inputs: z.json().optional(),\n  reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n *\n * Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  const parsed = BuildActionRunContextOptionsSchema.parse(options);\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    resource: buildActionResource({\n      selected_api: parsed.selected_api,\n      action_type: parsed.action_type,\n      action_key: parsed.action_key,\n    }),\n    connection_id: parsed.connection_id,\n    inputs: parsed.inputs,\n    reason: parsed.reason,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n  HttpRequestContext,\n  ActionRunContext,\n  ActionType,\n} from \"./types.ts\";\nimport { isIgnoredHeader } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  const { url } = context;\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const defaultPort =\n    url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n  const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  for (const [key, values] of Object.entries(url.query)) {\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  } else if (context.body !== null) {\n    // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n    // exact-match policies actually match the originating request.\n    conditions.push({\n      path: [\"body\"],\n      operator: \"equals\",\n      value: context.body,\n    });\n  }\n\n  // Header conditions (filtered through isIgnoredHeader again for safety)\n  for (const [key, value] of Object.entries(context.headers)) {\n    if (!isIgnoredHeader(key) && typeof value === \"string\") {\n      conditions.push({\n        path: [\"headers\", key.toLowerCase()],\n        operator: \"equals\",\n        value,\n      });\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: context.url.host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (context.inputs !== undefined && context.inputs !== null) {\n    conditions.push({\n      path: [\"inputs\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * The three identity fields that compose an action resource string.\n */\nexport interface ActionResourceParts {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(parts: ActionResourceParts): string {\n  return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n *\n * Format: action/{selected_api}/{action_type}/{wildcard}\n */\nexport function buildBroadActionResource(\n  parts: Pick<ActionResourceParts, \"selected_api\" | \"action_type\">,\n): string {\n  return `action/${parts.selected_api}/${parts.action_type}/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  conditions.push({\n    path: [\"url\", \"query\"],\n    operator: \"keys_in\",\n    value: Object.keys(context.url.query),\n  });\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [context.resource],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  globSelectedApiVersion,\n  parseActionResource,\n  type ActionType,\n  type RequestContext,\n} from \"./types.ts\";\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. */\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/**\n * Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n */\nexport const READ_ACTION_TYPES = [\n  \"read\",\n  \"read_bulk\",\n  \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n  READ_ACTION_TYPES,\n);\n\n/**\n * Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n */\nexport function isWriteRequest(context: RequestContext): boolean {\n  if (context.request_type === \"http_request\") {\n    // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n    // it on the way in), so no normalization is needed here.\n    return !READ_HTTP_METHOD_SET.has(context.method);\n  }\n  const { action_type } = parseActionResource(context.resource);\n  return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/**\n * Build a connection-level policy that covers both HTTP and action access.\n *\n * Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/*` per allowed type,\n *    scoped by connection_id. For read access, the resource list expands to\n *    one entry per read action_type so the engine matches via the resource\n *    string rather than a separate `path: [\"action_type\"]` condition.\n */\nexport function buildConnectionPolicy(options: {\n  connectionId: string;\n  selectedApi: string;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { connectionId, selectedApi, accessLevel } = options;\n\n  const authStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${connectionId}`],\n    conditions: [],\n  };\n\n  const connectionCondition: Condition = {\n    path: [\"connection_id\"],\n    operator: \"equals\",\n    value: connectionId,\n  };\n\n  const httpConditions: Condition[] = [connectionCondition];\n  if (accessLevel === \"read\") {\n    httpConditions.push({\n      path: [\"method\"],\n      operator: \"in\",\n      value: [...READ_HTTP_METHODS],\n    });\n  }\n\n  const httpStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions: httpConditions,\n  };\n\n  const apiPattern = globSelectedApiVersion(selectedApi);\n  const actionResources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const actionStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: actionResources,\n    conditions: [connectionCondition],\n  };\n\n  return {\n    version: 2,\n    statements: [authStatement, httpStatement, actionStatement],\n  };\n}\n","// ABOUTME: Builds connectionless approval policies bound to a domain (HTTP) or an action (action_run).\n// ABOUTME: Used when the smart-policy flag is off and the request has no connection_id.\n\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  globSelectedApiVersion,\n  parseActionResource,\n  type RequestContext,\n} from \"./types.ts\";\nimport {\n  READ_ACTION_TYPES,\n  READ_HTTP_METHODS,\n  type AccessLevel,\n} from \"./connection-policy.ts\";\n\n/**\n * Build a connectionless policy that scopes access to the request's domain\n * (HTTP) or its app (action_run). Mirrors the read/write semantics of\n * `buildConnectionPolicy` minus the auth statement and `connection_id`\n * condition, since there is no connection to bind to.\n */\nexport function buildConnectionlessPolicy(options: {\n  context: RequestContext;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { context, accessLevel } = options;\n\n  if (context.request_type === \"http_request\") {\n    const conditions: Condition[] = [\n      {\n        path: [\"url\", \"host\"],\n        operator: \"matches_host\",\n        value: context.url.host,\n      },\n    ];\n    if (accessLevel === \"read\") {\n      conditions.push({\n        path: [\"method\"],\n        operator: \"in\",\n        value: [...READ_HTTP_METHODS],\n      });\n    }\n\n    const statement: Statement = {\n      effect: \"allow\",\n      permissions: [\"can_execute\"],\n      resources: [\"http\"],\n      conditions,\n    };\n    return { version: 2, statements: [statement] };\n  }\n\n  const { selected_api } = parseActionResource(context.resource);\n  const apiPattern = globSelectedApiVersion(selected_api);\n  const resources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const statement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources,\n    conditions: [],\n  };\n  return { version: 2, statements: [statement] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAOX,IAAM,kBAAkB,aAC5B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,SAAS,0BAA0B;AAAA,EACtD,MAAM,aAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC5D,MAAM,aACH,OAAO,EACP,IAAI,EACJ,SAAS,sDAAsD;AAAA,EAClE,MAAM,aAAE,OAAO,EAAE,SAAS,0BAA0B;AAAA,EACpD,OAAO,aACJ,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC,EACtC,SAAS,iDAAiD;AAC/D,CAAC,EACA,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aAAa;AACf,CAAC;AAII,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,aACrC,OAAO;AAAA,EACN,cAAc,aACX,QAAQ,cAAc,EACtB,SAAS,4BAA4B;AAAA,EACxC,QAAQ,aACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAChC,SAAS,aAAa;AAAA;AAAA,EAEzB,KAAK;AAAA;AAAA,EAEL,SAAS,aACN,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAC7B,SAAS,8DAA8D;AAAA;AAAA,EAE1E,MAAM,aAAE,OAAO,EAAE,IAAI,KAAK,EAAE,SAAS,EAAE,SAAS,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjE,WAAW,aACR,QAAQ,EACR,KAAK,aAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,kCAAkC;AAAA;AAAA,EAE9C,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,SAAS,4CAA4C;AAAA;AAAA,EAExD,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,SAAS,gDAAgD;AAC9D,CAAC,EACA,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAY7B,IAAM,mBAAmB,aAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,KAAK,EAAE,IAAI,eAAe,aAAa,gCAAgC,CAAC;AAUpE,IAAM,kCACX;AASK,IAAM,6BACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,2BAA2B,KAAK,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAQO,SAAS,SAAS,aAA6B;AACpD,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE;AAC1D;AAWO,SAAS,uBAAuB,aAA6B;AAClE,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAUO,IAAM,8BAA8B,aACxC,OAAO;AAAA,EACN,cAAc,aACX,QAAQ,YAAY,EACpB,SAAS,4BAA4B;AAAA,EACxC,UAAU,aACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,cAAc,aAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK;AAAA,IAChD,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa,iBAAiB,SAAS,EAAE,KAAK;AAAA,IAC5C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,aAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK;AAAA,IAC9C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,SAAS,4CAA4C;AAAA;AAAA,EAExD,QAAQ,aACL,QAAQ,EACR,KAAK,aAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,yBAAyB;AAAA,EACrC,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,SAAS,gDAAgD;AAC9D,CAAC,EACA,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,aACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,eAAe;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,MACP,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF;AACF,CAAC;;;AC5VI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AACF,CAAC;AAEM,SAAS,gBAAgB,MAAuB;AACrD,QAAM,aAAa,KAAK,YAAY;AACpC,SACE,gBAAgB,IAAI,UAAU,KAC9B,WAAW,WAAW,SAAS,KAC/B,WAAW,WAAW,WAAW;AAErC;;;ACjDA,IAAAA,cAAkB;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,GAAG,KAAK,OAAO,UAAU,UAAU;AACtD,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADlIO,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,cAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE7B,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAuBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC3D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,cAAc,OAAQ,OAAO,QAAQ,OAAQ;AAAA,IACnD;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAY,cAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,cAAE,KAAK,EAAE,SAAS;AAAA,EAC1B,QAAQ,cAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AExIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,IAAAC,cAAkB;AASX,IAAM,oBAAoB,cAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;;;ACjGO,SAAS,0BAA0B,SAG/B;AACT,QAAM,EAAE,SAAS,YAAY,IAAI;AAEjC,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,UAAM,aAA0B;AAAA,MAC9B;AAAA,QACE,MAAM,CAAC,OAAO,MAAM;AAAA,QACpB,UAAU;AAAA,QACV,OAAO,QAAQ,IAAI;AAAA,MACrB;AAAA,IACF;AACA,QAAI,gBAAgB,QAAQ;AAC1B,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,QAAQ;AAAA,QACf,UAAU;AAAA,QACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,MAC9B,CAAC;AAAA,IACH;AAEA,UAAMC,aAAuB;AAAA,MAC3B,QAAQ;AAAA,MACR,aAAa,CAAC,aAAa;AAAA,MAC3B,WAAW,CAAC,MAAM;AAAA,MAClB;AAAA,IACF;AACA,WAAO,EAAE,SAAS,GAAG,YAAY,CAACA,UAAS,EAAE;AAAA,EAC/C;AAEA,QAAM,EAAE,aAAa,IAAI,oBAAoB,QAAQ,QAAQ;AAC7D,QAAM,aAAa,uBAAuB,YAAY;AACtD,QAAM,YACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,YAAuB;AAAA,IAC3B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B;AAAA,IACA,YAAY,CAAC;AAAA,EACf;AACA,SAAO,EAAE,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE;AAC/C;","names":["import_zod","import_zod","statement"]}

package/dist/index.d.cts

@@ -234,6 +234,7 @@ type RequestContext = z.infer<typeof RequestContextSchema>;
  * for policy decisions.
  */
 declare const IGNORED_HEADERS: Set<string>;
+declare function isIgnoredHeader(name: string): boolean;
 
 declare const BuildHttpRequestContextOptionsSchema: z.ZodObject<{
     method: z.ZodString;
@@ -252,12 +253,15 @@ type BuildHttpRequestContextOptions = z.infer<typeof BuildHttpRequestContextOpti
  * should use this to ensure the context shape is consistent.
  *
  * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with
- * the addition of header filtering through IGNORED_HEADERS.
+ * two additions: header filtering through isIgnoredHeader, and body/body_json
+ * exclusivity (createPolicyHttpRequest keeps the raw body alongside body_json).
  *
  * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }
- * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only
+ * - Filters headers through isIgnoredHeader (IGNORED_HEADERS set plus
+ *   zapier-* / x-zapier-* prefixes), lowercases keys, string values only
  * - Auto-parses body_json from body when content-type is JSON and body_json not provided
- * - body defaults to null (not undefined)
+ * - Exactly one of body / body_json is populated: body is null whenever
+ *   body_json is set; both default to null (not undefined)
  */
 declare function buildHttpRequestContext(options: BuildHttpRequestContextOptions): HttpRequestContext;
 declare const BuildActionRunContextOptionsSchema: z.ZodObject<{
@@ -392,4 +396,4 @@ declare function buildConnectionlessPolicy(options: {
     accessLevel: AccessLevel;
 }): Policy;
 
-export { type AccessLevel, AccessLevelSchema, type ActionRunContext, ActionRunContextInputSchema, ActionRunContextSchema, type ActionType, ActionTypeSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, DEFAULT_PORTS, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, type ParsedUrl, ParsedUrlSchema, READ_ACTION_TYPES, READ_HTTP_METHODS, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildConnectionPolicy, buildConnectionlessPolicy, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, buildUrlString, globSelectedApiVersion, isWriteRequest, parseActionResource, parseUrl, toAppKey, toExactPolicy };
+export { type AccessLevel, AccessLevelSchema, type ActionRunContext, ActionRunContextInputSchema, ActionRunContextSchema, type ActionType, ActionTypeSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, DEFAULT_PORTS, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, type ParsedUrl, ParsedUrlSchema, READ_ACTION_TYPES, READ_HTTP_METHODS, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildConnectionPolicy, buildConnectionlessPolicy, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, buildUrlString, globSelectedApiVersion, isIgnoredHeader, isWriteRequest, parseActionResource, parseUrl, toAppKey, toExactPolicy };

package/dist/index.d.ts

@@ -234,6 +234,7 @@ type RequestContext = z.infer<typeof RequestContextSchema>;
  * for policy decisions.
  */
 declare const IGNORED_HEADERS: Set<string>;
+declare function isIgnoredHeader(name: string): boolean;
 
 declare const BuildHttpRequestContextOptionsSchema: z.ZodObject<{
     method: z.ZodString;
@@ -252,12 +253,15 @@ type BuildHttpRequestContextOptions = z.infer<typeof BuildHttpRequestContextOpti
  * should use this to ensure the context shape is consistent.
  *
  * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with
- * the addition of header filtering through IGNORED_HEADERS.
+ * two additions: header filtering through isIgnoredHeader, and body/body_json
+ * exclusivity (createPolicyHttpRequest keeps the raw body alongside body_json).
  *
  * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }
- * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only
+ * - Filters headers through isIgnoredHeader (IGNORED_HEADERS set plus
+ *   zapier-* / x-zapier-* prefixes), lowercases keys, string values only
  * - Auto-parses body_json from body when content-type is JSON and body_json not provided
- * - body defaults to null (not undefined)
+ * - Exactly one of body / body_json is populated: body is null whenever
+ *   body_json is set; both default to null (not undefined)
  */
 declare function buildHttpRequestContext(options: BuildHttpRequestContextOptions): HttpRequestContext;
 declare const BuildActionRunContextOptionsSchema: z.ZodObject<{
@@ -392,4 +396,4 @@ declare function buildConnectionlessPolicy(options: {
     accessLevel: AccessLevel;
 }): Policy;
 
-export { type AccessLevel, AccessLevelSchema, type ActionRunContext, ActionRunContextInputSchema, ActionRunContextSchema, type ActionType, ActionTypeSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, DEFAULT_PORTS, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, type ParsedUrl, ParsedUrlSchema, READ_ACTION_TYPES, READ_HTTP_METHODS, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildConnectionPolicy, buildConnectionlessPolicy, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, buildUrlString, globSelectedApiVersion, isWriteRequest, parseActionResource, parseUrl, toAppKey, toExactPolicy };
+export { type AccessLevel, AccessLevelSchema, type ActionRunContext, ActionRunContextInputSchema, ActionRunContextSchema, type ActionType, ActionTypeSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, DEFAULT_PORTS, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, type ParsedUrl, ParsedUrlSchema, READ_ACTION_TYPES, READ_HTTP_METHODS, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildConnectionPolicy, buildConnectionlessPolicy, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, buildUrlString, globSelectedApiVersion, isIgnoredHeader, isWriteRequest, parseActionResource, parseUrl, toAppKey, toExactPolicy };

package/dist/index.js

@@ -211,8 +211,15 @@ var IGNORED_HEADERS = /* @__PURE__ */ new Set([
   "x-real-ip",
   // Proxy internal — sdkapi-specific headers
   "x-is-interactive-session",
-  "x-relay-callback-url"
+  "x-relay-callback-url",
+  // Subsumed by isIgnoredHeader's x-zapier- prefix rule; kept for byte-parity
+  // with the approvalsapi source and for consumers reading the set directly.
+  "x-zapier-approval-token"
 ]);
+function isIgnoredHeader(name) {
+  const normalized = name.toLowerCase();
+  return IGNORED_HEADERS.has(normalized) || normalized.startsWith("zapier-") || normalized.startsWith("x-zapier-");
+}
 
 // src/builders.ts
 import { z as z2 } from "zod";
@@ -252,7 +259,7 @@ function buildExactHttpConditions(context) {
     });
   }
   for (const [key, value] of Object.entries(context.headers)) {
-    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+    if (!isIgnoredHeader(key) && typeof value === "string") {
       conditions.push({
         path: ["headers", key.toLowerCase()],
         operator: "equals",
@@ -294,7 +301,7 @@ var BuildHttpRequestContextOptionsSchema = z2.object({
   method: z2.string(),
   /** Raw URL string. Will be normalized with https:// if no protocol present. */
   url: z2.string(),
-  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */
+  /** Raw headers from the request. Will be filtered through isIgnoredHeader. */
   headers: z2.record(
     z2.string(),
     z2.union([z2.string(), z2.array(z2.string()), z2.undefined()])
@@ -314,7 +321,7 @@ function buildHttpRequestContext(options) {
   if (parsed.headers) {
     for (const [key, value] of Object.entries(parsed.headers)) {
       const lowerKey = key.toLowerCase();
-      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === "string") {
+      if (!isIgnoredHeader(lowerKey) && typeof value === "string") {
         headers[lowerKey] = value;
       }
     }
@@ -337,7 +344,7 @@ function buildHttpRequestContext(options) {
     method: parsed.method.toUpperCase(),
     url,
     headers,
-    body: parsed.body ?? null,
+    body: body_json === null ? parsed.body ?? null : null,
     body_json,
     connection_id: parsed.connection_id
   });
@@ -540,6 +547,7 @@ export {
   buildHttpRequestContext,
   buildUrlString,
   globSelectedApiVersion,
+  isIgnoredHeader,
   isWriteRequest,
   parseActionResource,
   parseUrl,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts","../src/connectionless-policy.ts"],"sourcesContent":["// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\n\n/**\n * Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n */\nexport const ParsedUrlSchema = z\n  .object({\n    scheme: z.string().describe('URL scheme, e.g. \"https\"'),\n    host: z.string().describe('Hostname, e.g. \"api.example.com\"'),\n    port: z\n      .number()\n      .int()\n      .describe(\"Port number (defaults to 443 for https, 80 for http)\"),\n    path: z.string().describe('URL path, e.g. \"/v1/foo\"'),\n    query: z\n      .record(z.string(), z.array(z.string()))\n      .describe(\"Query parameters as key to string array mapping\"),\n  })\n  .meta({\n    id: \"ParsedUrl\",\n    description: \"Parsed URL components for policy condition matching\",\n  });\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/** Default ports by scheme, used when URL has no explicit port. */\nexport const DEFAULT_PORTS: Record<string, number> = {\n  http: 80,\n  https: 443,\n};\n\n/**\n * Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n */\nexport function parseUrl(raw: string): ParsedUrl {\n  const url = new URL(raw);\n  const scheme = url.protocol.slice(0, -1).toLowerCase();\n  const host = url.hostname.toLowerCase();\n  const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n  const path = url.pathname || \"/\";\n  const query: Record<string, string[]> = {};\n  for (const [key, value] of url.searchParams) {\n    if (!query[key]) {\n      query[key] = [];\n    }\n    query[key].push(value);\n  }\n  return { scheme, host, port, path, query };\n}\n\n/**\n * Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n */\nexport function buildUrlString(parsed: ParsedUrl): string {\n  const { scheme, host, port, path, query } = parsed;\n  const defaultPort = DEFAULT_PORTS[scheme];\n  const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n  const params = new URLSearchParams();\n  for (const [key, values] of Object.entries(query)) {\n    for (const value of values) {\n      params.append(key, value);\n    }\n  }\n  const queryString = params.toString();\n  return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n *\n * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n */\nexport const HttpRequestContextSchema = z\n  .object({\n    request_type: z\n      .literal(\"http_request\")\n      .describe(\"Context type discriminator\"),\n    method: z\n      .string()\n      .max(10)\n      .transform((m) => m.toUpperCase())\n      .describe(\"HTTP method\"),\n    /** Parsed URL components for policy condition matching */\n    url: ParsedUrlSchema,\n    /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n    headers: z\n      .record(z.string(), z.string())\n      .describe(\"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\"),\n    /** Raw body string */\n    body: z.string().max(65536).nullable().describe(\"Raw body string\"),\n    /**\n     * Parsed JSON body. Authored as `z.unknown().pipe(z.json())` so\n     * the OpenAPI generator sees the outer `z.unknown()` and emits a\n     * permissive field (no recursive `$ref`, no type), while the inner\n     * `z.json()` still rejects non-JSON values (`Date`, `undefined`,\n     * functions) at parse time. Same inferred `JsonValue` type either way.\n     */\n    body_json: z\n      .unknown()\n      .pipe(z.json())\n      .nullable()\n      .describe(\"Parsed JSON body (if applicable)\"),\n    /** Zapier connection ID used for this request */\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .describe(\"Zapier connection ID used for this request\"),\n    /** Optional human-readable reason for the request */\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\"Optional human-readable reason for the request\"),\n  })\n  .meta({ id: \"HttpRequestContext\" });\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Canonical Zapier action types.\n *\n * Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n */\nexport const ActionTypeSchema = z\n  .enum([\n    \"filter\",\n    \"read\",\n    \"read_bulk\",\n    \"run\",\n    \"search\",\n    \"search_and_write\",\n    \"search_or_write\",\n    \"write\",\n  ])\n  .meta({ id: \"action_type\", description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/**\n * Allowed character set for the `selected_api` segment of an action\n * resource. Blocks `*`, `/`, `:`, whitespace, and other glob/path\n * metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n */\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/**\n * Allowed character set for the `action_key` segment of an action\n * resource. More permissive than `ACTION_RESOURCE_SEGMENT_PATTERN`\n * because sdkapi emits keys like `ae:358405` and `core:123abc` that\n * carry a namespace prefix separated by `:`. Still blocks `*`, `/`,\n * whitespace, and other glob/path metacharacters.\n */\nexport const ACTION_KEY_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;\n\n/**\n * Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n */\nexport function parseActionResource(resource: string): {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n} {\n  const segments = resource.split(\"/\");\n  if (segments.length !== 4 || segments[0] !== \"action\") {\n    throw new Error(\n      `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n    );\n  }\n  const [, selectedApi, actionTypeRaw, actionKey] = segments;\n  if (!selectedApi || !actionTypeRaw || !actionKey) {\n    throw new Error(`action resource has empty segment: ${resource}`);\n  }\n  const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n  if (!actionType.success) {\n    throw new Error(\n      `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n    );\n  }\n  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n    throw new Error(\n      `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n    );\n  }\n  if (!ACTION_KEY_SEGMENT_PATTERN.test(actionKey)) {\n    throw new Error(\n      `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n    );\n  }\n  return {\n    selected_api: selectedApi,\n    action_type: actionType.data,\n    action_key: actionKey,\n  };\n}\n\n/**\n * Strip the `@<version>` suffix from a `selected_api` / implementation\n * identifier. `Slack@1.0.0` → `Slack`. Passing a value without `@` is a\n * no-op. Used by UIs to render a human-friendly app key independent of\n * version, and by `globSelectedApiVersion` below.\n */\nexport function toAppKey(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at);\n}\n\n/**\n * Replace the implementation-version suffix of a `selected_api` with a `@*`\n * wildcard so policies stay valid across version bumps. A runtime request\n * with `selected_api: \"App@2.7.3\"` matches a policy resource scoped to\n * `App@*` while still being distinguishable from a different app\n * (e.g. `App2@1.0.0`).\n *\n * No-op when the input has no `@` — assumed to be already version-less.\n */\nexport function globSelectedApiVersion(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@*\";\n}\n\n/**\n * Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should use `ActionRunContextSchema`, which accepts either the canonical\n * `resource` field or the legacy `{selected_api, action_type, action_key}`\n * triple on input.\n */\nexport const ActionRunContextInputSchema = z\n  .object({\n    request_type: z\n      .literal(\"action_run\")\n      .describe(\"Context type discriminator\"),\n    resource: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\n        \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n      ),\n    selected_api: z.string().max(255).optional().meta({\n      deprecated: true,\n      description:\n        \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n    }),\n    action_type: ActionTypeSchema.optional().meta({\n      deprecated: true,\n      description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n    }),\n    action_key: z.string().max(255).optional().meta({\n      deprecated: true,\n      description: \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n    }),\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .describe(\"Zapier connection ID used for this request\"),\n    /** Action input parameters. See body_json above for the pipe rationale. */\n    inputs: z\n      .unknown()\n      .pipe(z.json())\n      .optional()\n      .describe(\"Action input parameters\"),\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\"Optional human-readable reason for the request\"),\n  })\n  .meta({\n    id: \"ActionRunContext\",\n    description:\n      \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n  });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n  (input, ctx) => {\n    const resource =\n      input.resource ??\n      (input.selected_api && input.action_type && input.action_key\n        ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n        : undefined);\n    if (resource === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n      });\n      return z.NEVER;\n    }\n    try {\n      parseActionResource(resource);\n    } catch (err) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n      return z.NEVER;\n    }\n    return {\n      request_type: \"action_run\" as const,\n      resource,\n      ...(input.connection_id !== undefined && {\n        connection_id: input.connection_id,\n      }),\n      ...(input.inputs !== undefined && { inputs: input.inputs }),\n      ...(input.reason !== undefined && { reason: input.reason }),\n    };\n  },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Union of all request context types, keyed on `request_type`.\n *\n * Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member. The `request_type`\n * discriminator carried in `.meta()` below is read natively by the\n * OpenAPI generator (`@zapier/openapi-spec`), which emits it as\n * `anyOf` + discriminator that openapi-typescript and other codegen\n * targets render as a properly narrowed TS union.\n */\nexport const RequestContextSchema = z\n  .union([HttpRequestContextSchema, ActionRunContextSchema])\n  .meta({\n    id: \"RequestContext\",\n    description: \"Union of request context shapes, keyed on `request_type`.\",\n    discriminator: {\n      propertyName: \"request_type\",\n      mapping: {\n        http_request: \"#/components/schemas/HttpRequestContext\",\n        action_run: \"#/components/schemas/ActionRunContext\",\n      },\n    },\n  });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  ActionTypeSchema,\n  parseUrl,\n  ACTION_RESOURCE_SEGMENT_PATTERN,\n  ACTION_KEY_SEGMENT_PATTERN,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: z.json().optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n *\n * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n  // see well-typed values. Mirrors the pattern in buildActionRunContext.\n  const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n  // Normalize URL — SDK CLI strips the protocol\n  const rawUrl = parsed.url.includes(\"://\")\n    ? parsed.url\n    : `https://${parsed.url}`;\n  const url = parseUrl(rawUrl);\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (parsed.headers) {\n    for (const [key, value] of Object.entries(parsed.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  // Auto-parse body_json from body when content-type is JSON\n  // (matches createPolicyHttpRequest behavior from @zapier/policy)\n  let body_json: unknown = null;\n  if (parsed.body_json !== undefined) {\n    body_json = parsed.body_json;\n  } else if (parsed.body) {\n    const contentType = headers[\"content-type\"];\n    const isJson =\n      typeof contentType === \"string\" &&\n      (contentType.includes(\"application/json\") ||\n        (contentType.includes(\"application/\") &&\n          contentType.includes(\"+json\")));\n    if (isJson) {\n      try {\n        body_json = JSON.parse(parsed.body);\n      } catch {\n        // Invalid JSON body — leave body_json as null\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: parsed.method.toUpperCase(),\n    url,\n    headers,\n    body: parsed.body ?? null,\n    body_json,\n    connection_id: parsed.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n    message:\n      \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n  }),\n  action_type: ActionTypeSchema,\n  action_key: z.string().regex(ACTION_KEY_SEGMENT_PATTERN, {\n    message:\n      \"action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)\",\n  }),\n  connection_id: z.string().optional(),\n  inputs: z.json().optional(),\n  reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n *\n * Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  const parsed = BuildActionRunContextOptionsSchema.parse(options);\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    resource: buildActionResource({\n      selected_api: parsed.selected_api,\n      action_type: parsed.action_type,\n      action_key: parsed.action_key,\n    }),\n    connection_id: parsed.connection_id,\n    inputs: parsed.inputs,\n    reason: parsed.reason,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n  HttpRequestContext,\n  ActionRunContext,\n  ActionType,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  const { url } = context;\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const defaultPort =\n    url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n  const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  for (const [key, values] of Object.entries(url.query)) {\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  } else if (context.body !== null) {\n    // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n    // exact-match policies actually match the originating request.\n    conditions.push({\n      path: [\"body\"],\n      operator: \"equals\",\n      value: context.body,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  for (const [key, value] of Object.entries(context.headers)) {\n    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === \"string\") {\n      conditions.push({\n        path: [\"headers\", key.toLowerCase()],\n        operator: \"equals\",\n        value,\n      });\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: context.url.host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (context.inputs !== undefined && context.inputs !== null) {\n    conditions.push({\n      path: [\"inputs\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * The three identity fields that compose an action resource string.\n */\nexport interface ActionResourceParts {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(parts: ActionResourceParts): string {\n  return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n *\n * Format: action/{selected_api}/{action_type}/{wildcard}\n */\nexport function buildBroadActionResource(\n  parts: Pick<ActionResourceParts, \"selected_api\" | \"action_type\">,\n): string {\n  return `action/${parts.selected_api}/${parts.action_type}/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  conditions.push({\n    path: [\"url\", \"query\"],\n    operator: \"keys_in\",\n    value: Object.keys(context.url.query),\n  });\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [context.resource],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  globSelectedApiVersion,\n  parseActionResource,\n  type ActionType,\n  type RequestContext,\n} from \"./types.ts\";\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. */\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/**\n * Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n */\nexport const READ_ACTION_TYPES = [\n  \"read\",\n  \"read_bulk\",\n  \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n  READ_ACTION_TYPES,\n);\n\n/**\n * Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n */\nexport function isWriteRequest(context: RequestContext): boolean {\n  if (context.request_type === \"http_request\") {\n    // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n    // it on the way in), so no normalization is needed here.\n    return !READ_HTTP_METHOD_SET.has(context.method);\n  }\n  const { action_type } = parseActionResource(context.resource);\n  return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/**\n * Build a connection-level policy that covers both HTTP and action access.\n *\n * Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/*` per allowed type,\n *    scoped by connection_id. For read access, the resource list expands to\n *    one entry per read action_type so the engine matches via the resource\n *    string rather than a separate `path: [\"action_type\"]` condition.\n */\nexport function buildConnectionPolicy(options: {\n  connectionId: string;\n  selectedApi: string;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { connectionId, selectedApi, accessLevel } = options;\n\n  const authStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${connectionId}`],\n    conditions: [],\n  };\n\n  const connectionCondition: Condition = {\n    path: [\"connection_id\"],\n    operator: \"equals\",\n    value: connectionId,\n  };\n\n  const httpConditions: Condition[] = [connectionCondition];\n  if (accessLevel === \"read\") {\n    httpConditions.push({\n      path: [\"method\"],\n      operator: \"in\",\n      value: [...READ_HTTP_METHODS],\n    });\n  }\n\n  const httpStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions: httpConditions,\n  };\n\n  const apiPattern = globSelectedApiVersion(selectedApi);\n  const actionResources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const actionStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: actionResources,\n    conditions: [connectionCondition],\n  };\n\n  return {\n    version: 2,\n    statements: [authStatement, httpStatement, actionStatement],\n  };\n}\n","// ABOUTME: Builds connectionless approval policies bound to a domain (HTTP) or an action (action_run).\n// ABOUTME: Used when the smart-policy flag is off and the request has no connection_id.\n\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  globSelectedApiVersion,\n  parseActionResource,\n  type RequestContext,\n} from \"./types.ts\";\nimport {\n  READ_ACTION_TYPES,\n  READ_HTTP_METHODS,\n  type AccessLevel,\n} from \"./connection-policy.ts\";\n\n/**\n * Build a connectionless policy that scopes access to the request's domain\n * (HTTP) or its app (action_run). Mirrors the read/write semantics of\n * `buildConnectionPolicy` minus the auth statement and `connection_id`\n * condition, since there is no connection to bind to.\n */\nexport function buildConnectionlessPolicy(options: {\n  context: RequestContext;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { context, accessLevel } = options;\n\n  if (context.request_type === \"http_request\") {\n    const conditions: Condition[] = [\n      {\n        path: [\"url\", \"host\"],\n        operator: \"matches_host\",\n        value: context.url.host,\n      },\n    ];\n    if (accessLevel === \"read\") {\n      conditions.push({\n        path: [\"method\"],\n        operator: \"in\",\n        value: [...READ_HTTP_METHODS],\n      });\n    }\n\n    const statement: Statement = {\n      effect: \"allow\",\n      permissions: [\"can_execute\"],\n      resources: [\"http\"],\n      conditions,\n    };\n    return { version: 2, statements: [statement] };\n  }\n\n  const { selected_api } = parseActionResource(context.resource);\n  const apiPattern = globSelectedApiVersion(selected_api);\n  const resources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const statement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources,\n    conditions: [],\n  };\n  return { version: 2, statements: [statement] };\n}\n"],"mappings":";AAGA,SAAS,SAAS;AAOX,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,SAAS,0BAA0B;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC5D,MAAM,EACH,OAAO,EACP,IAAI,EACJ,SAAS,sDAAsD;AAAA,EAClE,MAAM,EAAE,OAAO,EAAE,SAAS,0BAA0B;AAAA,EACpD,OAAO,EACJ,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EACtC,SAAS,iDAAiD;AAC/D,CAAC,EACA,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aAAa;AACf,CAAC;AAII,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc,EACX,QAAQ,cAAc,EACtB,SAAS,4BAA4B;AAAA,EACxC,QAAQ,EACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAChC,SAAS,aAAa;AAAA;AAAA,EAEzB,KAAK;AAAA;AAAA,EAEL,SAAS,EACN,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAC7B,SAAS,8DAA8D;AAAA;AAAA,EAE1E,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,SAAS,EAAE,SAAS,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjE,WAAW,EACR,QAAQ,EACR,KAAK,EAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,kCAAkC;AAAA;AAAA,EAE9C,eAAe,EACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,SAAS,4CAA4C;AAAA;AAAA,EAExD,QAAQ,EACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,SAAS,gDAAgD;AAC9D,CAAC,EACA,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAY7B,IAAM,mBAAmB,EAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,KAAK,EAAE,IAAI,eAAe,aAAa,gCAAgC,CAAC;AAUpE,IAAM,kCACX;AASK,IAAM,6BACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,2BAA2B,KAAK,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAQO,SAAS,SAAS,aAA6B;AACpD,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE;AAC1D;AAWO,SAAS,uBAAuB,aAA6B;AAClE,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAUO,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,cAAc,EACX,QAAQ,YAAY,EACpB,SAAS,4BAA4B;AAAA,EACxC,UAAU,EACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,cAAc,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK;AAAA,IAChD,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa,iBAAiB,SAAS,EAAE,KAAK;AAAA,IAC5C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK;AAAA,IAC9C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,eAAe,EACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,SAAS,4CAA4C;AAAA;AAAA,EAExD,QAAQ,EACL,QAAQ,EACR,KAAK,EAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,yBAAyB;AAAA,EACrC,QAAQ,EACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,SAAS,gDAAgD;AAC9D,CAAC,EACA,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,EAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,EAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,EACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,eAAe;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,MACP,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF;AACF,CAAC;;;AC5VI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,SAAS,KAAAA,UAAS;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KAAK,OAAO,UAAU,UAAU;AACxE,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADlIO,IAAM,uCAAuCC,GAAE,OAAO;AAAA,EAC3D,QAAQA,GAAE,OAAO;AAAA;AAAA,EAEjB,KAAKA,GAAE,OAAO;AAAA;AAAA,EAEd,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,IACTA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,GAAGA,GAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAWA,GAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE7B,eAAeA,GAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ;AAAA,IACrB;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,cAAcA,GAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAYA,GAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQA,GAAE,KAAK,EAAE,SAAS;AAAA,EAC1B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AErIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,SAAS,KAAAC,UAAS;AASX,IAAM,oBAAoBC,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;;;ACjGO,SAAS,0BAA0B,SAG/B;AACT,QAAM,EAAE,SAAS,YAAY,IAAI;AAEjC,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,UAAM,aAA0B;AAAA,MAC9B;AAAA,QACE,MAAM,CAAC,OAAO,MAAM;AAAA,QACpB,UAAU;AAAA,QACV,OAAO,QAAQ,IAAI;AAAA,MACrB;AAAA,IACF;AACA,QAAI,gBAAgB,QAAQ;AAC1B,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,QAAQ;AAAA,QACf,UAAU;AAAA,QACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,MAC9B,CAAC;AAAA,IACH;AAEA,UAAMC,aAAuB;AAAA,MAC3B,QAAQ;AAAA,MACR,aAAa,CAAC,aAAa;AAAA,MAC3B,WAAW,CAAC,MAAM;AAAA,MAClB;AAAA,IACF;AACA,WAAO,EAAE,SAAS,GAAG,YAAY,CAACA,UAAS,EAAE;AAAA,EAC/C;AAEA,QAAM,EAAE,aAAa,IAAI,oBAAoB,QAAQ,QAAQ;AAC7D,QAAM,aAAa,uBAAuB,YAAY;AACtD,QAAM,YACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,YAAuB;AAAA,IAC3B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B;AAAA,IACA,YAAY,CAAC;AAAA,EACf;AACA,SAAO,EAAE,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE;AAC/C;","names":["z","z","z","z","statement"]}
+{"version":3,"sources":["../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts","../src/connectionless-policy.ts"],"sourcesContent":["// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\n\n/**\n * Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n */\nexport const ParsedUrlSchema = z\n  .object({\n    scheme: z.string().describe('URL scheme, e.g. \"https\"'),\n    host: z.string().describe('Hostname, e.g. \"api.example.com\"'),\n    port: z\n      .number()\n      .int()\n      .describe(\"Port number (defaults to 443 for https, 80 for http)\"),\n    path: z.string().describe('URL path, e.g. \"/v1/foo\"'),\n    query: z\n      .record(z.string(), z.array(z.string()))\n      .describe(\"Query parameters as key to string array mapping\"),\n  })\n  .meta({\n    id: \"ParsedUrl\",\n    description: \"Parsed URL components for policy condition matching\",\n  });\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/** Default ports by scheme, used when URL has no explicit port. */\nexport const DEFAULT_PORTS: Record<string, number> = {\n  http: 80,\n  https: 443,\n};\n\n/**\n * Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n */\nexport function parseUrl(raw: string): ParsedUrl {\n  const url = new URL(raw);\n  const scheme = url.protocol.slice(0, -1).toLowerCase();\n  const host = url.hostname.toLowerCase();\n  const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n  const path = url.pathname || \"/\";\n  const query: Record<string, string[]> = {};\n  for (const [key, value] of url.searchParams) {\n    if (!query[key]) {\n      query[key] = [];\n    }\n    query[key].push(value);\n  }\n  return { scheme, host, port, path, query };\n}\n\n/**\n * Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n */\nexport function buildUrlString(parsed: ParsedUrl): string {\n  const { scheme, host, port, path, query } = parsed;\n  const defaultPort = DEFAULT_PORTS[scheme];\n  const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n  const params = new URLSearchParams();\n  for (const [key, values] of Object.entries(query)) {\n    for (const value of values) {\n      params.append(key, value);\n    }\n  }\n  const queryString = params.toString();\n  return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n *\n * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n */\nexport const HttpRequestContextSchema = z\n  .object({\n    request_type: z\n      .literal(\"http_request\")\n      .describe(\"Context type discriminator\"),\n    method: z\n      .string()\n      .max(10)\n      .transform((m) => m.toUpperCase())\n      .describe(\"HTTP method\"),\n    /** Parsed URL components for policy condition matching */\n    url: ParsedUrlSchema,\n    /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n    headers: z\n      .record(z.string(), z.string())\n      .describe(\"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\"),\n    /** Raw body string */\n    body: z.string().max(65536).nullable().describe(\"Raw body string\"),\n    /**\n     * Parsed JSON body. Authored as `z.unknown().pipe(z.json())` so\n     * the OpenAPI generator sees the outer `z.unknown()` and emits a\n     * permissive field (no recursive `$ref`, no type), while the inner\n     * `z.json()` still rejects non-JSON values (`Date`, `undefined`,\n     * functions) at parse time. Same inferred `JsonValue` type either way.\n     */\n    body_json: z\n      .unknown()\n      .pipe(z.json())\n      .nullable()\n      .describe(\"Parsed JSON body (if applicable)\"),\n    /** Zapier connection ID used for this request */\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .describe(\"Zapier connection ID used for this request\"),\n    /** Optional human-readable reason for the request */\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\"Optional human-readable reason for the request\"),\n  })\n  .meta({ id: \"HttpRequestContext\" });\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Canonical Zapier action types.\n *\n * Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n */\nexport const ActionTypeSchema = z\n  .enum([\n    \"filter\",\n    \"read\",\n    \"read_bulk\",\n    \"run\",\n    \"search\",\n    \"search_and_write\",\n    \"search_or_write\",\n    \"write\",\n  ])\n  .meta({ id: \"action_type\", description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/**\n * Allowed character set for the `selected_api` segment of an action\n * resource. Blocks `*`, `/`, `:`, whitespace, and other glob/path\n * metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n */\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/**\n * Allowed character set for the `action_key` segment of an action\n * resource. More permissive than `ACTION_RESOURCE_SEGMENT_PATTERN`\n * because sdkapi emits keys like `ae:358405` and `core:123abc` that\n * carry a namespace prefix separated by `:`. Still blocks `*`, `/`,\n * whitespace, and other glob/path metacharacters.\n */\nexport const ACTION_KEY_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+:-]+(?:@[A-Za-z0-9._+:-]+)?$/;\n\n/**\n * Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n */\nexport function parseActionResource(resource: string): {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n} {\n  const segments = resource.split(\"/\");\n  if (segments.length !== 4 || segments[0] !== \"action\") {\n    throw new Error(\n      `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n    );\n  }\n  const [, selectedApi, actionTypeRaw, actionKey] = segments;\n  if (!selectedApi || !actionTypeRaw || !actionKey) {\n    throw new Error(`action resource has empty segment: ${resource}`);\n  }\n  const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n  if (!actionType.success) {\n    throw new Error(\n      `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n    );\n  }\n  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n    throw new Error(\n      `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n    );\n  }\n  if (!ACTION_KEY_SEGMENT_PATTERN.test(actionKey)) {\n    throw new Error(\n      `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n    );\n  }\n  return {\n    selected_api: selectedApi,\n    action_type: actionType.data,\n    action_key: actionKey,\n  };\n}\n\n/**\n * Strip the `@<version>` suffix from a `selected_api` / implementation\n * identifier. `Slack@1.0.0` → `Slack`. Passing a value without `@` is a\n * no-op. Used by UIs to render a human-friendly app key independent of\n * version, and by `globSelectedApiVersion` below.\n */\nexport function toAppKey(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at);\n}\n\n/**\n * Replace the implementation-version suffix of a `selected_api` with a `@*`\n * wildcard so policies stay valid across version bumps. A runtime request\n * with `selected_api: \"App@2.7.3\"` matches a policy resource scoped to\n * `App@*` while still being distinguishable from a different app\n * (e.g. `App2@1.0.0`).\n *\n * No-op when the input has no `@` — assumed to be already version-less.\n */\nexport function globSelectedApiVersion(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@*\";\n}\n\n/**\n * Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should use `ActionRunContextSchema`, which accepts either the canonical\n * `resource` field or the legacy `{selected_api, action_type, action_key}`\n * triple on input.\n */\nexport const ActionRunContextInputSchema = z\n  .object({\n    request_type: z\n      .literal(\"action_run\")\n      .describe(\"Context type discriminator\"),\n    resource: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\n        \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n      ),\n    selected_api: z.string().max(255).optional().meta({\n      deprecated: true,\n      description:\n        \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n    }),\n    action_type: ActionTypeSchema.optional().meta({\n      deprecated: true,\n      description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n    }),\n    action_key: z.string().max(255).optional().meta({\n      deprecated: true,\n      description: \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n    }),\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .describe(\"Zapier connection ID used for this request\"),\n    /** Action input parameters. See body_json above for the pipe rationale. */\n    inputs: z\n      .unknown()\n      .pipe(z.json())\n      .optional()\n      .describe(\"Action input parameters\"),\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .describe(\"Optional human-readable reason for the request\"),\n  })\n  .meta({\n    id: \"ActionRunContext\",\n    description:\n      \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n  });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n  (input, ctx) => {\n    const resource =\n      input.resource ??\n      (input.selected_api && input.action_type && input.action_key\n        ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n        : undefined);\n    if (resource === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n      });\n      return z.NEVER;\n    }\n    try {\n      parseActionResource(resource);\n    } catch (err) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n      return z.NEVER;\n    }\n    return {\n      request_type: \"action_run\" as const,\n      resource,\n      ...(input.connection_id !== undefined && {\n        connection_id: input.connection_id,\n      }),\n      ...(input.inputs !== undefined && { inputs: input.inputs }),\n      ...(input.reason !== undefined && { reason: input.reason }),\n    };\n  },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Union of all request context types, keyed on `request_type`.\n *\n * Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member. The `request_type`\n * discriminator carried in `.meta()` below is read natively by the\n * OpenAPI generator (`@zapier/openapi-spec`), which emits it as\n * `anyOf` + discriminator that openapi-typescript and other codegen\n * targets render as a properly narrowed TS union.\n */\nexport const RequestContextSchema = z\n  .union([HttpRequestContextSchema, ActionRunContextSchema])\n  .meta({\n    id: \"RequestContext\",\n    description: \"Union of request context shapes, keyed on `request_type`.\",\n    discriminator: {\n      propertyName: \"request_type\",\n      mapping: {\n        http_request: \"#/components/schemas/HttpRequestContext\",\n        action_run: \"#/components/schemas/ActionRunContext\",\n      },\n    },\n  });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n  // Subsumed by isIgnoredHeader's x-zapier- prefix rule; kept for byte-parity\n  // with the approvalsapi source and for consumers reading the set directly.\n  \"x-zapier-approval-token\",\n]);\n\nexport function isIgnoredHeader(name: string): boolean {\n  const normalized = name.toLowerCase();\n  return (\n    IGNORED_HEADERS.has(normalized) ||\n    normalized.startsWith(\"zapier-\") ||\n    normalized.startsWith(\"x-zapier-\")\n  );\n}\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  ActionTypeSchema,\n  parseUrl,\n  ACTION_RESOURCE_SEGMENT_PATTERN,\n  ACTION_KEY_SEGMENT_PATTERN,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { isIgnoredHeader } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through isIgnoredHeader. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: z.json().optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * two additions: header filtering through isIgnoredHeader, and body/body_json\n * exclusivity (createPolicyHttpRequest keeps the raw body alongside body_json).\n *\n * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through isIgnoredHeader (IGNORED_HEADERS set plus\n *   zapier-* / x-zapier-* prefixes), lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - Exactly one of body / body_json is populated: body is null whenever\n *   body_json is set; both default to null (not undefined)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n  // see well-typed values. Mirrors the pattern in buildActionRunContext.\n  const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n  // Normalize URL — SDK CLI strips the protocol\n  const rawUrl = parsed.url.includes(\"://\")\n    ? parsed.url\n    : `https://${parsed.url}`;\n  const url = parseUrl(rawUrl);\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (parsed.headers) {\n    for (const [key, value] of Object.entries(parsed.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!isIgnoredHeader(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  // Auto-parse body_json from body when content-type is JSON\n  // (matches createPolicyHttpRequest behavior from @zapier/policy)\n  let body_json: unknown = null;\n  if (parsed.body_json !== undefined) {\n    body_json = parsed.body_json;\n  } else if (parsed.body) {\n    const contentType = headers[\"content-type\"];\n    const isJson =\n      typeof contentType === \"string\" &&\n      (contentType.includes(\"application/json\") ||\n        (contentType.includes(\"application/\") &&\n          contentType.includes(\"+json\")));\n    if (isJson) {\n      try {\n        body_json = JSON.parse(parsed.body);\n      } catch {\n        // Invalid JSON body — leave body_json as null\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: parsed.method.toUpperCase(),\n    url,\n    headers,\n    body: body_json === null ? (parsed.body ?? null) : null,\n    body_json,\n    connection_id: parsed.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n    message:\n      \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n  }),\n  action_type: ActionTypeSchema,\n  action_key: z.string().regex(ACTION_KEY_SEGMENT_PATTERN, {\n    message:\n      \"action_key must contain only [A-Za-z0-9._@:+-] (no globs, slashes, or whitespace)\",\n  }),\n  connection_id: z.string().optional(),\n  inputs: z.json().optional(),\n  reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n *\n * Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  const parsed = BuildActionRunContextOptionsSchema.parse(options);\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    resource: buildActionResource({\n      selected_api: parsed.selected_api,\n      action_type: parsed.action_type,\n      action_key: parsed.action_key,\n    }),\n    connection_id: parsed.connection_id,\n    inputs: parsed.inputs,\n    reason: parsed.reason,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n  HttpRequestContext,\n  ActionRunContext,\n  ActionType,\n} from \"./types.ts\";\nimport { isIgnoredHeader } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  const { url } = context;\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const defaultPort =\n    url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n  const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  for (const [key, values] of Object.entries(url.query)) {\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  } else if (context.body !== null) {\n    // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n    // exact-match policies actually match the originating request.\n    conditions.push({\n      path: [\"body\"],\n      operator: \"equals\",\n      value: context.body,\n    });\n  }\n\n  // Header conditions (filtered through isIgnoredHeader again for safety)\n  for (const [key, value] of Object.entries(context.headers)) {\n    if (!isIgnoredHeader(key) && typeof value === \"string\") {\n      conditions.push({\n        path: [\"headers\", key.toLowerCase()],\n        operator: \"equals\",\n        value,\n      });\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: context.url.host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (context.inputs !== undefined && context.inputs !== null) {\n    conditions.push({\n      path: [\"inputs\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * The three identity fields that compose an action resource string.\n */\nexport interface ActionResourceParts {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(parts: ActionResourceParts): string {\n  return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n *\n * Format: action/{selected_api}/{action_type}/{wildcard}\n */\nexport function buildBroadActionResource(\n  parts: Pick<ActionResourceParts, \"selected_api\" | \"action_type\">,\n): string {\n  return `action/${parts.selected_api}/${parts.action_type}/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  conditions.push({\n    path: [\"url\", \"query\"],\n    operator: \"keys_in\",\n    value: Object.keys(context.url.query),\n  });\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [context.resource],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  globSelectedApiVersion,\n  parseActionResource,\n  type ActionType,\n  type RequestContext,\n} from \"./types.ts\";\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. */\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/**\n * Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n */\nexport const READ_ACTION_TYPES = [\n  \"read\",\n  \"read_bulk\",\n  \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n  READ_ACTION_TYPES,\n);\n\n/**\n * Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n */\nexport function isWriteRequest(context: RequestContext): boolean {\n  if (context.request_type === \"http_request\") {\n    // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n    // it on the way in), so no normalization is needed here.\n    return !READ_HTTP_METHOD_SET.has(context.method);\n  }\n  const { action_type } = parseActionResource(context.resource);\n  return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/**\n * Build a connection-level policy that covers both HTTP and action access.\n *\n * Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/*` per allowed type,\n *    scoped by connection_id. For read access, the resource list expands to\n *    one entry per read action_type so the engine matches via the resource\n *    string rather than a separate `path: [\"action_type\"]` condition.\n */\nexport function buildConnectionPolicy(options: {\n  connectionId: string;\n  selectedApi: string;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { connectionId, selectedApi, accessLevel } = options;\n\n  const authStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${connectionId}`],\n    conditions: [],\n  };\n\n  const connectionCondition: Condition = {\n    path: [\"connection_id\"],\n    operator: \"equals\",\n    value: connectionId,\n  };\n\n  const httpConditions: Condition[] = [connectionCondition];\n  if (accessLevel === \"read\") {\n    httpConditions.push({\n      path: [\"method\"],\n      operator: \"in\",\n      value: [...READ_HTTP_METHODS],\n    });\n  }\n\n  const httpStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions: httpConditions,\n  };\n\n  const apiPattern = globSelectedApiVersion(selectedApi);\n  const actionResources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const actionStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: actionResources,\n    conditions: [connectionCondition],\n  };\n\n  return {\n    version: 2,\n    statements: [authStatement, httpStatement, actionStatement],\n  };\n}\n","// ABOUTME: Builds connectionless approval policies bound to a domain (HTTP) or an action (action_run).\n// ABOUTME: Used when the smart-policy flag is off and the request has no connection_id.\n\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  globSelectedApiVersion,\n  parseActionResource,\n  type RequestContext,\n} from \"./types.ts\";\nimport {\n  READ_ACTION_TYPES,\n  READ_HTTP_METHODS,\n  type AccessLevel,\n} from \"./connection-policy.ts\";\n\n/**\n * Build a connectionless policy that scopes access to the request's domain\n * (HTTP) or its app (action_run). Mirrors the read/write semantics of\n * `buildConnectionPolicy` minus the auth statement and `connection_id`\n * condition, since there is no connection to bind to.\n */\nexport function buildConnectionlessPolicy(options: {\n  context: RequestContext;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { context, accessLevel } = options;\n\n  if (context.request_type === \"http_request\") {\n    const conditions: Condition[] = [\n      {\n        path: [\"url\", \"host\"],\n        operator: \"matches_host\",\n        value: context.url.host,\n      },\n    ];\n    if (accessLevel === \"read\") {\n      conditions.push({\n        path: [\"method\"],\n        operator: \"in\",\n        value: [...READ_HTTP_METHODS],\n      });\n    }\n\n    const statement: Statement = {\n      effect: \"allow\",\n      permissions: [\"can_execute\"],\n      resources: [\"http\"],\n      conditions,\n    };\n    return { version: 2, statements: [statement] };\n  }\n\n  const { selected_api } = parseActionResource(context.resource);\n  const apiPattern = globSelectedApiVersion(selected_api);\n  const resources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const statement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources,\n    conditions: [],\n  };\n  return { version: 2, statements: [statement] };\n}\n"],"mappings":";AAGA,SAAS,SAAS;AAOX,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,SAAS,0BAA0B;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,SAAS,kCAAkC;AAAA,EAC5D,MAAM,EACH,OAAO,EACP,IAAI,EACJ,SAAS,sDAAsD;AAAA,EAClE,MAAM,EAAE,OAAO,EAAE,SAAS,0BAA0B;AAAA,EACpD,OAAO,EACJ,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EACtC,SAAS,iDAAiD;AAC/D,CAAC,EACA,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aAAa;AACf,CAAC;AAII,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc,EACX,QAAQ,cAAc,EACtB,SAAS,4BAA4B;AAAA,EACxC,QAAQ,EACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAChC,SAAS,aAAa;AAAA;AAAA,EAEzB,KAAK;AAAA;AAAA,EAEL,SAAS,EACN,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAC7B,SAAS,8DAA8D;AAAA;AAAA,EAE1E,MAAM,EAAE,OAAO,EAAE,IAAI,KAAK,EAAE,SAAS,EAAE,SAAS,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQjE,WAAW,EACR,QAAQ,EACR,KAAK,EAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,kCAAkC;AAAA;AAAA,EAE9C,eAAe,EACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,SAAS,4CAA4C;AAAA;AAAA,EAExD,QAAQ,EACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,SAAS,gDAAgD;AAC9D,CAAC,EACA,KAAK,EAAE,IAAI,qBAAqB,CAAC;AAY7B,IAAM,mBAAmB,EAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,KAAK,EAAE,IAAI,eAAe,aAAa,gCAAgC,CAAC;AAUpE,IAAM,kCACX;AASK,IAAM,6BACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,2BAA2B,KAAK,SAAS,GAAG;AAC/C,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAQO,SAAS,SAAS,aAA6B;AACpD,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE;AAC1D;AAWO,SAAS,uBAAuB,aAA6B;AAClE,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAUO,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,cAAc,EACX,QAAQ,YAAY,EACpB,SAAS,4BAA4B;AAAA,EACxC,UAAU,EACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT;AAAA,IACC;AAAA,EACF;AAAA,EACF,cAAc,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK;AAAA,IAChD,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa,iBAAiB,SAAS,EAAE,KAAK;AAAA,IAC5C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK;AAAA,IAC9C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,eAAe,EACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,SAAS,4CAA4C;AAAA;AAAA,EAExD,QAAQ,EACL,QAAQ,EACR,KAAK,EAAE,KAAK,CAAC,EACb,SAAS,EACT,SAAS,yBAAyB;AAAA,EACrC,QAAQ,EACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,SAAS,gDAAgD;AAC9D,CAAC,EACA,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,EAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,EAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAcO,IAAM,uBAAuB,EACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,KAAK;AAAA,EACJ,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,eAAe;AAAA,IACb,cAAc;AAAA,IACd,SAAS;AAAA,MACP,cAAc;AAAA,MACd,YAAY;AAAA,IACd;AAAA,EACF;AACF,CAAC;;;AC5VI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AACF,CAAC;AAEM,SAAS,gBAAgB,MAAuB;AACrD,QAAM,aAAa,KAAK,YAAY;AACpC,SACE,gBAAgB,IAAI,UAAU,KAC9B,WAAW,WAAW,SAAS,KAC/B,WAAW,WAAW,WAAW;AAErC;;;ACjDA,SAAS,KAAAA,UAAS;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,GAAG,KAAK,OAAO,UAAU,UAAU;AACtD,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADlIO,IAAM,uCAAuCC,GAAE,OAAO;AAAA,EAC3D,QAAQA,GAAE,OAAO;AAAA;AAAA,EAEjB,KAAKA,GAAE,OAAO;AAAA;AAAA,EAEd,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,IACTA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,GAAGA,GAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAWA,GAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE7B,eAAeA,GAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAuBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC3D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,cAAc,OAAQ,OAAO,QAAQ,OAAQ;AAAA,IACnD;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,cAAcA,GAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAYA,GAAE,OAAO,EAAE,MAAM,4BAA4B;AAAA,IACvD,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQA,GAAE,KAAK,EAAE,SAAS;AAAA,EAC1B,QAAQA,GAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AExIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,SAAS,KAAAC,UAAS;AASX,IAAM,oBAAoBC,GAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;;;ACjGO,SAAS,0BAA0B,SAG/B;AACT,QAAM,EAAE,SAAS,YAAY,IAAI;AAEjC,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,UAAM,aAA0B;AAAA,MAC9B;AAAA,QACE,MAAM,CAAC,OAAO,MAAM;AAAA,QACpB,UAAU;AAAA,QACV,OAAO,QAAQ,IAAI;AAAA,MACrB;AAAA,IACF;AACA,QAAI,gBAAgB,QAAQ;AAC1B,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,QAAQ;AAAA,QACf,UAAU;AAAA,QACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,MAC9B,CAAC;AAAA,IACH;AAEA,UAAMC,aAAuB;AAAA,MAC3B,QAAQ;AAAA,MACR,aAAa,CAAC,aAAa;AAAA,MAC3B,WAAW,CAAC,MAAM;AAAA,MAClB;AAAA,IACF;AACA,WAAO,EAAE,SAAS,GAAG,YAAY,CAACA,UAAS,EAAE;AAAA,EAC/C;AAEA,QAAM,EAAE,aAAa,IAAI,oBAAoB,QAAQ,QAAQ;AAC7D,QAAM,aAAa,uBAAuB,YAAY;AACtD,QAAM,YACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,YAAuB;AAAA,IAC3B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B;AAAA,IACA,YAAY,CAAC;AAAA,EACf;AACA,SAAO,EAAE,SAAS,GAAG,YAAY,CAAC,SAAS,EAAE;AAC/C;","names":["z","z","z","z","statement"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/policy-context",
-  "version": "1.3.0-mr.6.c3a1f51e",
+  "version": "2.0.0",
   "description": "Shared request-context types, builders, and policy condition generators — the canonical encoding of a request (HTTP, action, connection) into the shape the policy engine expects.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {