@zapier/policy-schema 0.11.1 → 0.13.0

package/dist/index.cjs

@@ -20,20 +20,10 @@ var VALID_OPERATOR_LIST = [
 ];
 var ScalarSchema = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]);
 var PathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()])).min(1);
-var JsonValueSchema = zod.z.lazy(
-  () => zod.z.union([
-    zod.z.string(),
-    zod.z.number(),
-    zod.z.boolean(),
-    zod.z.null(),
-    zod.z.array(JsonValueSchema),
-    zod.z.record(zod.z.string(), JsonValueSchema)
-  ])
-);
 var EqualsConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("equals"),
-  value: JsonValueSchema
+  value: zod.z.json()
 }).strict();
 var InConditionSchema = zod.z.object({
   path: PathSchema,
@@ -139,7 +129,7 @@ var OperatorSchema = zod.z.enum([
   "keys_in",
   "size"
 ]);
-var ConditionValueSchema = JsonValueSchema;
+var ConditionValueSchema = zod.z.json();
 var V1StatementSchema = zod.z.object({
   id: zod.z.string().optional(),
   effect: zod.z.enum(["allow", "deny"]),
@@ -164,6 +154,26 @@ var V2PolicySchema = zod.z.object({
   statements: zod.z.array(V2StatementSchema)
 }).strict();
 var PolicySchema = zod.z.union([V1PolicySchema, V2PolicySchema]);
+var CanonicalHashSchema = zod.z.custom(
+  (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value),
+  { error: "Expected a 64-character lowercase hex SHA-256 digest" }
+);
+var OverrideBaseShape = {
+  id: zod.z.string().optional(),
+  statementHash: CanonicalHashSchema,
+  effect: zod.z.literal("allow")
+};
+var OverrideSchema = zod.z.union([
+  zod.z.object({ ...OverrideBaseShape, match: zod.z.literal("any") }).strict(),
+  zod.z.object({ ...OverrideBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // Empty conditionals is intentional (the "blank check"): the override
+  // applies whenever the targeted ask statement fires, with no extra
+  // conditions. Do not add .min(1) here.
+  zod.z.object({
+    ...OverrideBaseShape,
+    conditionals: zod.z.array(ConditionSchema)
+  }).strict()
+]);
 function getOpenApiSchema() {
   return {
     type: "object",
@@ -236,11 +246,12 @@ function getOpenApiSchema() {
 }
 
 exports.ArrayOperatorSchema = ArrayOperatorSchema;
+exports.CanonicalHashSchema = CanonicalHashSchema;
 exports.ConditionSchema = ConditionSchema;
 exports.ConditionValueSchema = ConditionValueSchema;
-exports.JsonValueSchema = JsonValueSchema;
 exports.OperatorSchema = OperatorSchema;
 exports.OtherOperatorSchema = OtherOperatorSchema;
+exports.OverrideSchema = OverrideSchema;
 exports.PolicySchema = PolicySchema;
 exports.RangeValueSchema = RangeValueSchema;
 exports.ScalarOperatorSchema = ScalarOperatorSchema;

package/dist/index.d.cts

@@ -1,142 +1,29 @@
 import { z } from 'zod';
 
-type ScalarOperator = "equals" | "in" | "matches" | "matches_host" | "matches_path" | "range";
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-type ArrayOperator = "values_in";
-type UrlOperator = "matches_url";
-type OtherOperator = "exists" | "keys_in" | "size";
-type Operator = ScalarOperator | ArrayOperator | UrlOperator | OtherOperator;
-type RangeValue = {
-    min?: number;
-    max?: number;
-};
-type SizeValue = number | RangeValue;
-type ConditionValue = JsonValue | RangeValue | SizeValue;
-interface Condition {
-    path: (string | number)[];
-    operator: Operator;
-    value?: ConditionValue;
-}
-type Effect = "allow" | "ask" | "deny";
-interface Statement {
-    id?: string;
-    effect: Effect;
-    permissions: string[];
-    resources: string[];
-    conditions?: Condition[];
-}
-interface Policy {
-    version: 1 | 2;
-    statements: Statement[];
-}
-interface PolicyRequest {
-    permission: string;
-    resource: string;
-    context?: Record<string, unknown>;
-}
-/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
-type CanonicalHash = string & {
-    readonly __brand: "CanonicalHash";
-};
-interface OverrideBase {
-    id?: string;
-    statementHash: CanonicalHash;
-    effect: "allow";
-}
-type Override = (OverrideBase & {
-    match: "any";
-}) | (OverrideBase & {
-    contextHash: CanonicalHash;
-}) | (OverrideBase & {
-    conditionals: Condition[];
-});
-interface ConditionTrace {
-    condition: Condition;
-    resolved: unknown;
-    passed: boolean;
-}
-interface OverrideTrace {
-    override: Override;
-    matched: boolean;
-    conditionResults?: ConditionTrace[];
-}
-interface StatementTrace {
-    statement: Statement;
-    permissionMatched: boolean;
-    resourceMatched: boolean;
-    conditionResults?: ConditionTrace[];
-    passed: boolean;
-    overrides?: OverrideTrace[];
-}
-interface EvaluatePolicyOptions {
-    policy: Policy;
-    request: PolicyRequest;
-    overrides?: Override[];
-    trace?: boolean;
-}
-type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
-interface PolicyResult {
-    effect: Effect;
-    explicit: boolean;
-    reason: PolicyReason;
-    statements: StatementTrace[];
-}
-interface ParsedUrl {
-    scheme: string;
-    host: string;
-    port: number;
-    path: string;
-    query: Record<string, string[]>;
-}
-interface PolicyHttpRequest {
-    method: string;
-    url: ParsedUrl;
-    headers: Record<string, string | string[]>;
-    body: string | null;
-    body_json: unknown;
-    connection_id?: string;
-}
-interface PolicyActionRequest {
-    connection_id?: string;
-    selected_api?: string;
-    action_type?: string;
-    action_key?: string;
-    inputs?: Record<string, unknown>;
-}
-/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
-interface OpenApiSchema {
-    type?: string;
-    required?: string[];
-    properties?: Record<string, OpenApiSchema>;
-    items?: OpenApiSchema;
-    enum?: (string | number)[];
-    description?: string;
-    minItems?: number;
-    oneOf?: OpenApiSchema[];
-    anyOf?: OpenApiSchema[];
-}
-
 /** Current policy document version. */
 declare const VALID_VERSIONS: readonly [1, 2];
 /** Valid policy effects. */
 declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
+/** Derived from VALID_EFFECTS — the constant is the single source of truth. */
+type Effect = (typeof VALID_EFFECTS)[number];
 /** Valid condition operators. */
 declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
-declare const JsonValueSchema: z.ZodType<JsonValue>;
 declare const RangeValueSchema: z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
+/** Derived from RangeValueSchema — the schema is the single source of truth. */
+type RangeValue = z.infer<typeof RangeValueSchema>;
 declare const SizeValueSchema: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>]>;
+/** Derived from SizeValueSchema — the schema is the single source of truth. */
+type SizeValue = z.infer<typeof SizeValueSchema>;
 declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
     path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     operator: z.ZodLiteral<"equals">;
-    value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    value: z.ZodJSONSchema;
 }, z.core.$strict>, z.ZodObject<{
     path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     operator: z.ZodLiteral<"in">;
@@ -183,6 +70,8 @@ declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
         max: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>]>;
 }, z.core.$strict>]>;
+/** Derived from ConditionSchema — the schema is the single source of truth. */
+type Condition = z.infer<typeof ConditionSchema>;
 declare const ScalarOperatorSchema: z.ZodEnum<{
     equals: "equals";
     in: "in";
@@ -191,31 +80,41 @@ declare const ScalarOperatorSchema: z.ZodEnum<{
     matches_path: "matches_path";
     range: "range";
 }>;
+/** Derived from ScalarOperatorSchema — the schema is the single source of truth. */
+type ScalarOperator = z.infer<typeof ScalarOperatorSchema>;
 declare const ArrayOperatorSchema: z.ZodEnum<{
     values_in: "values_in";
 }>;
+/** Derived from ArrayOperatorSchema — the schema is the single source of truth. */
+type ArrayOperator = z.infer<typeof ArrayOperatorSchema>;
 declare const UrlOperatorSchema: z.ZodEnum<{
     matches_url: "matches_url";
 }>;
+/** Derived from UrlOperatorSchema — the schema is the single source of truth. */
+type UrlOperator = z.infer<typeof UrlOperatorSchema>;
 declare const OtherOperatorSchema: z.ZodEnum<{
     exists: "exists";
     keys_in: "keys_in";
     size: "size";
 }>;
+/** Derived from OtherOperatorSchema — the schema is the single source of truth. */
+type OtherOperator = z.infer<typeof OtherOperatorSchema>;
 declare const OperatorSchema: z.ZodEnum<{
     equals: "equals";
+    exists: "exists";
     in: "in";
+    keys_in: "keys_in";
     matches: "matches";
     matches_host: "matches_host";
     matches_path: "matches_path";
+    matches_url: "matches_url";
     range: "range";
-    exists: "exists";
-    keys_in: "keys_in";
     size: "size";
     values_in: "values_in";
-    matches_url: "matches_url";
 }>;
-declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+/** Derived from OperatorSchema — the schema is the single source of truth. */
+type Operator = z.infer<typeof OperatorSchema>;
+declare const ConditionValueSchema: z.ZodJSONSchema;
 /** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
 declare const StatementSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -229,7 +128,7 @@ declare const StatementSchema: z.ZodObject<{
     conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
         path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
         operator: z.ZodLiteral<"equals">;
-        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        value: z.ZodJSONSchema;
     }, z.core.$strict>, z.ZodObject<{
         path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
         operator: z.ZodLiteral<"in">;
@@ -277,6 +176,8 @@ declare const StatementSchema: z.ZodObject<{
         }, z.core.$strict>]>;
     }, z.core.$strict>]>>>;
 }, z.core.$strict>;
+/** Derived from StatementSchema — the schema is the single source of truth. */
+type Statement = z.infer<typeof StatementSchema>;
 declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
     version: z.ZodLiteral<1>;
     statements: z.ZodArray<z.ZodObject<{
@@ -290,7 +191,7 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
         conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
             path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             operator: z.ZodLiteral<"equals">;
-            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+            value: z.ZodJSONSchema;
         }, z.core.$strict>, z.ZodObject<{
             path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             operator: z.ZodLiteral<"in">;
@@ -352,7 +253,7 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
         conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
             path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             operator: z.ZodLiteral<"equals">;
-            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+            value: z.ZodJSONSchema;
         }, z.core.$strict>, z.ZodObject<{
             path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             operator: z.ZodLiteral<"in">;
@@ -401,6 +302,82 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
         }, z.core.$strict>]>>>;
     }, z.core.$strict>>;
 }, z.core.$strict>]>;
+/** Derived from PolicySchema — the schema is the single source of truth. */
+type Policy = z.infer<typeof PolicySchema>;
+/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
+declare const CanonicalHashSchema: z.ZodCustom<CanonicalHash, CanonicalHash>;
+/**
+ * Runtime schema for the Override type. `.strict()` keeps the variants
+ * mutually exclusive (an object carrying two variant fields fails all
+ * branches).
+ */
+declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>]>;
+/** Derived from OverrideSchema — the schema is the single source of truth. */
+type Override = z.infer<typeof OverrideSchema>;
 /**
  * Returns an OpenAPI-compatible JSON Schema object for a policy document.
  *
@@ -409,4 +386,83 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
  */
 declare function getOpenApiSchema(): OpenApiSchema;
 
-export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, JsonValueSchema, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+type ConditionValue = JsonValue | RangeValue | SizeValue;
+interface PolicyRequest {
+    permission: string;
+    resource: string;
+    context?: Record<string, unknown>;
+}
+/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
+type CanonicalHash = string & {
+    readonly __brand: "CanonicalHash";
+};
+interface ConditionTrace {
+    condition: Condition;
+    resolved: unknown;
+    passed: boolean;
+}
+interface OverrideTrace {
+    override: Override;
+    matched: boolean;
+    conditionResults?: ConditionTrace[];
+}
+interface StatementTrace {
+    statement: Statement;
+    permissionMatched: boolean;
+    resourceMatched: boolean;
+    conditionResults?: ConditionTrace[];
+    passed: boolean;
+    overrides?: OverrideTrace[];
+}
+interface EvaluatePolicyOptions {
+    policy: Policy;
+    request: PolicyRequest;
+    overrides?: Override[];
+    trace?: boolean;
+}
+type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
+interface PolicyResult {
+    effect: Effect;
+    explicit: boolean;
+    reason: PolicyReason;
+    statements: StatementTrace[];
+}
+interface ParsedUrl {
+    scheme: string;
+    host: string;
+    port: number;
+    path: string;
+    query: Record<string, string[]>;
+}
+interface PolicyHttpRequest {
+    method: string;
+    url: ParsedUrl;
+    headers: Record<string, string | string[]>;
+    body: string | null;
+    body_json: unknown;
+    connection_id?: string;
+}
+interface PolicyActionRequest {
+    connection_id?: string;
+    selected_api?: string;
+    action_type?: string;
+    action_key?: string;
+    inputs?: Record<string, unknown>;
+}
+/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
+interface OpenApiSchema {
+    type?: string;
+    required?: string[];
+    properties?: Record<string, OpenApiSchema>;
+    items?: OpenApiSchema;
+    enum?: (string | number)[];
+    description?: string;
+    minItems?: number;
+    oneOf?: OpenApiSchema[];
+    anyOf?: OpenApiSchema[];
+}
+
+export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/dist/index.d.ts

@@ -1,142 +1,29 @@
 import { z } from 'zod';
 
-type ScalarOperator = "equals" | "in" | "matches" | "matches_host" | "matches_path" | "range";
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-type ArrayOperator = "values_in";
-type UrlOperator = "matches_url";
-type OtherOperator = "exists" | "keys_in" | "size";
-type Operator = ScalarOperator | ArrayOperator | UrlOperator | OtherOperator;
-type RangeValue = {
-    min?: number;
-    max?: number;
-};
-type SizeValue = number | RangeValue;
-type ConditionValue = JsonValue | RangeValue | SizeValue;
-interface Condition {
-    path: (string | number)[];
-    operator: Operator;
-    value?: ConditionValue;
-}
-type Effect = "allow" | "ask" | "deny";
-interface Statement {
-    id?: string;
-    effect: Effect;
-    permissions: string[];
-    resources: string[];
-    conditions?: Condition[];
-}
-interface Policy {
-    version: 1 | 2;
-    statements: Statement[];
-}
-interface PolicyRequest {
-    permission: string;
-    resource: string;
-    context?: Record<string, unknown>;
-}
-/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
-type CanonicalHash = string & {
-    readonly __brand: "CanonicalHash";
-};
-interface OverrideBase {
-    id?: string;
-    statementHash: CanonicalHash;
-    effect: "allow";
-}
-type Override = (OverrideBase & {
-    match: "any";
-}) | (OverrideBase & {
-    contextHash: CanonicalHash;
-}) | (OverrideBase & {
-    conditionals: Condition[];
-});
-interface ConditionTrace {
-    condition: Condition;
-    resolved: unknown;
-    passed: boolean;
-}
-interface OverrideTrace {
-    override: Override;
-    matched: boolean;
-    conditionResults?: ConditionTrace[];
-}
-interface StatementTrace {
-    statement: Statement;
-    permissionMatched: boolean;
-    resourceMatched: boolean;
-    conditionResults?: ConditionTrace[];
-    passed: boolean;
-    overrides?: OverrideTrace[];
-}
-interface EvaluatePolicyOptions {
-    policy: Policy;
-    request: PolicyRequest;
-    overrides?: Override[];
-    trace?: boolean;
-}
-type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
-interface PolicyResult {
-    effect: Effect;
-    explicit: boolean;
-    reason: PolicyReason;
-    statements: StatementTrace[];
-}
-interface ParsedUrl {
-    scheme: string;
-    host: string;
-    port: number;
-    path: string;
-    query: Record<string, string[]>;
-}
-interface PolicyHttpRequest {
-    method: string;
-    url: ParsedUrl;
-    headers: Record<string, string | string[]>;
-    body: string | null;
-    body_json: unknown;
-    connection_id?: string;
-}
-interface PolicyActionRequest {
-    connection_id?: string;
-    selected_api?: string;
-    action_type?: string;
-    action_key?: string;
-    inputs?: Record<string, unknown>;
-}
-/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
-interface OpenApiSchema {
-    type?: string;
-    required?: string[];
-    properties?: Record<string, OpenApiSchema>;
-    items?: OpenApiSchema;
-    enum?: (string | number)[];
-    description?: string;
-    minItems?: number;
-    oneOf?: OpenApiSchema[];
-    anyOf?: OpenApiSchema[];
-}
-
 /** Current policy document version. */
 declare const VALID_VERSIONS: readonly [1, 2];
 /** Valid policy effects. */
 declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
+/** Derived from VALID_EFFECTS — the constant is the single source of truth. */
+type Effect = (typeof VALID_EFFECTS)[number];
 /** Valid condition operators. */
 declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
-declare const JsonValueSchema: z.ZodType<JsonValue>;
 declare const RangeValueSchema: z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
+/** Derived from RangeValueSchema — the schema is the single source of truth. */
+type RangeValue = z.infer<typeof RangeValueSchema>;
 declare const SizeValueSchema: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>]>;
+/** Derived from SizeValueSchema — the schema is the single source of truth. */
+type SizeValue = z.infer<typeof SizeValueSchema>;
 declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
     path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     operator: z.ZodLiteral<"equals">;
-    value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+    value: z.ZodJSONSchema;
 }, z.core.$strict>, z.ZodObject<{
     path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     operator: z.ZodLiteral<"in">;
@@ -183,6 +70,8 @@ declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
         max: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>]>;
 }, z.core.$strict>]>;
+/** Derived from ConditionSchema — the schema is the single source of truth. */
+type Condition = z.infer<typeof ConditionSchema>;
 declare const ScalarOperatorSchema: z.ZodEnum<{
     equals: "equals";
     in: "in";
@@ -191,31 +80,41 @@ declare const ScalarOperatorSchema: z.ZodEnum<{
     matches_path: "matches_path";
     range: "range";
 }>;
+/** Derived from ScalarOperatorSchema — the schema is the single source of truth. */
+type ScalarOperator = z.infer<typeof ScalarOperatorSchema>;
 declare const ArrayOperatorSchema: z.ZodEnum<{
     values_in: "values_in";
 }>;
+/** Derived from ArrayOperatorSchema — the schema is the single source of truth. */
+type ArrayOperator = z.infer<typeof ArrayOperatorSchema>;
 declare const UrlOperatorSchema: z.ZodEnum<{
     matches_url: "matches_url";
 }>;
+/** Derived from UrlOperatorSchema — the schema is the single source of truth. */
+type UrlOperator = z.infer<typeof UrlOperatorSchema>;
 declare const OtherOperatorSchema: z.ZodEnum<{
     exists: "exists";
     keys_in: "keys_in";
     size: "size";
 }>;
+/** Derived from OtherOperatorSchema — the schema is the single source of truth. */
+type OtherOperator = z.infer<typeof OtherOperatorSchema>;
 declare const OperatorSchema: z.ZodEnum<{
     equals: "equals";
+    exists: "exists";
     in: "in";
+    keys_in: "keys_in";
     matches: "matches";
     matches_host: "matches_host";
     matches_path: "matches_path";
+    matches_url: "matches_url";
     range: "range";
-    exists: "exists";
-    keys_in: "keys_in";
     size: "size";
     values_in: "values_in";
-    matches_url: "matches_url";
 }>;
-declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+/** Derived from OperatorSchema — the schema is the single source of truth. */
+type Operator = z.infer<typeof OperatorSchema>;
+declare const ConditionValueSchema: z.ZodJSONSchema;
 /** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
 declare const StatementSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -229,7 +128,7 @@ declare const StatementSchema: z.ZodObject<{
     conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
         path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
         operator: z.ZodLiteral<"equals">;
-        value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        value: z.ZodJSONSchema;
     }, z.core.$strict>, z.ZodObject<{
         path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
         operator: z.ZodLiteral<"in">;
@@ -277,6 +176,8 @@ declare const StatementSchema: z.ZodObject<{
         }, z.core.$strict>]>;
     }, z.core.$strict>]>>>;
 }, z.core.$strict>;
+/** Derived from StatementSchema — the schema is the single source of truth. */
+type Statement = z.infer<typeof StatementSchema>;
 declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
     version: z.ZodLiteral<1>;
     statements: z.ZodArray<z.ZodObject<{
@@ -290,7 +191,7 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
         conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
             path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             operator: z.ZodLiteral<"equals">;
-            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+            value: z.ZodJSONSchema;
         }, z.core.$strict>, z.ZodObject<{
             path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             operator: z.ZodLiteral<"in">;
@@ -352,7 +253,7 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
         conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
             path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             operator: z.ZodLiteral<"equals">;
-            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+            value: z.ZodJSONSchema;
         }, z.core.$strict>, z.ZodObject<{
             path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
             operator: z.ZodLiteral<"in">;
@@ -401,6 +302,82 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
         }, z.core.$strict>]>>>;
     }, z.core.$strict>>;
 }, z.core.$strict>]>;
+/** Derived from PolicySchema — the schema is the single source of truth. */
+type Policy = z.infer<typeof PolicySchema>;
+/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
+declare const CanonicalHashSchema: z.ZodCustom<CanonicalHash, CanonicalHash>;
+/**
+ * Runtime schema for the Override type. `.strict()` keeps the variants
+ * mutually exclusive (an object carrying two variant fields fails all
+ * branches).
+ */
+declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>]>;
+/** Derived from OverrideSchema — the schema is the single source of truth. */
+type Override = z.infer<typeof OverrideSchema>;
 /**
  * Returns an OpenAPI-compatible JSON Schema object for a policy document.
  *
@@ -409,4 +386,83 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
  */
 declare function getOpenApiSchema(): OpenApiSchema;
 
-export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, JsonValueSchema, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+type ConditionValue = JsonValue | RangeValue | SizeValue;
+interface PolicyRequest {
+    permission: string;
+    resource: string;
+    context?: Record<string, unknown>;
+}
+/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
+type CanonicalHash = string & {
+    readonly __brand: "CanonicalHash";
+};
+interface ConditionTrace {
+    condition: Condition;
+    resolved: unknown;
+    passed: boolean;
+}
+interface OverrideTrace {
+    override: Override;
+    matched: boolean;
+    conditionResults?: ConditionTrace[];
+}
+interface StatementTrace {
+    statement: Statement;
+    permissionMatched: boolean;
+    resourceMatched: boolean;
+    conditionResults?: ConditionTrace[];
+    passed: boolean;
+    overrides?: OverrideTrace[];
+}
+interface EvaluatePolicyOptions {
+    policy: Policy;
+    request: PolicyRequest;
+    overrides?: Override[];
+    trace?: boolean;
+}
+type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
+interface PolicyResult {
+    effect: Effect;
+    explicit: boolean;
+    reason: PolicyReason;
+    statements: StatementTrace[];
+}
+interface ParsedUrl {
+    scheme: string;
+    host: string;
+    port: number;
+    path: string;
+    query: Record<string, string[]>;
+}
+interface PolicyHttpRequest {
+    method: string;
+    url: ParsedUrl;
+    headers: Record<string, string | string[]>;
+    body: string | null;
+    body_json: unknown;
+    connection_id?: string;
+}
+interface PolicyActionRequest {
+    connection_id?: string;
+    selected_api?: string;
+    action_type?: string;
+    action_key?: string;
+    inputs?: Record<string, unknown>;
+}
+/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
+interface OpenApiSchema {
+    type?: string;
+    required?: string[];
+    properties?: Record<string, OpenApiSchema>;
+    items?: OpenApiSchema;
+    enum?: (string | number)[];
+    description?: string;
+    minItems?: number;
+    oneOf?: OpenApiSchema[];
+    anyOf?: OpenApiSchema[];
+}
+
+export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/dist/index.mjs

@@ -18,20 +18,10 @@ var VALID_OPERATOR_LIST = [
 ];
 var ScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
 var PathSchema = z.array(z.union([z.string(), z.number()])).min(1);
-var JsonValueSchema = z.lazy(
-  () => z.union([
-    z.string(),
-    z.number(),
-    z.boolean(),
-    z.null(),
-    z.array(JsonValueSchema),
-    z.record(z.string(), JsonValueSchema)
-  ])
-);
 var EqualsConditionSchema = z.object({
   path: PathSchema,
   operator: z.literal("equals"),
-  value: JsonValueSchema
+  value: z.json()
 }).strict();
 var InConditionSchema = z.object({
   path: PathSchema,
@@ -137,7 +127,7 @@ var OperatorSchema = z.enum([
   "keys_in",
   "size"
 ]);
-var ConditionValueSchema = JsonValueSchema;
+var ConditionValueSchema = z.json();
 var V1StatementSchema = z.object({
   id: z.string().optional(),
   effect: z.enum(["allow", "deny"]),
@@ -162,6 +152,26 @@ var V2PolicySchema = z.object({
   statements: z.array(V2StatementSchema)
 }).strict();
 var PolicySchema = z.union([V1PolicySchema, V2PolicySchema]);
+var CanonicalHashSchema = z.custom(
+  (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value),
+  { error: "Expected a 64-character lowercase hex SHA-256 digest" }
+);
+var OverrideBaseShape = {
+  id: z.string().optional(),
+  statementHash: CanonicalHashSchema,
+  effect: z.literal("allow")
+};
+var OverrideSchema = z.union([
+  z.object({ ...OverrideBaseShape, match: z.literal("any") }).strict(),
+  z.object({ ...OverrideBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // Empty conditionals is intentional (the "blank check"): the override
+  // applies whenever the targeted ask statement fires, with no extra
+  // conditions. Do not add .min(1) here.
+  z.object({
+    ...OverrideBaseShape,
+    conditionals: z.array(ConditionSchema)
+  }).strict()
+]);
 function getOpenApiSchema() {
   return {
     type: "object",
@@ -233,4 +243,4 @@ function getOpenApiSchema() {
   };
 }
 
-export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, JsonValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
+export { ArrayOperatorSchema, CanonicalHashSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, OverrideSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/policy-schema",
-  "version": "0.11.1",
+  "version": "0.13.0",
   "description": "Zod schemas and TypeScript types for the Zapier policy engine",
   "type": "module",
   "main": "dist/index.cjs",