@zapier/policy-schema 0.7.0 → 0.8.0

package/dist/index.cjs

@@ -3,6 +3,21 @@
 var zod = require('zod');
 
 // src/schema.ts
+var VALID_VERSIONS = [1, 2];
+var VALID_EFFECTS = ["allow", "ask", "deny"];
+var VALID_OPERATOR_LIST = [
+  "equals",
+  "exists",
+  "in",
+  "keys_in",
+  "matches",
+  "matches_host",
+  "matches_path",
+  "matches_url",
+  "range",
+  "size",
+  "values_in"
+];
 var ScalarSchema = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]);
 var PathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()])).min(1);
 var JsonValueSchema = zod.z.lazy(
@@ -125,16 +140,100 @@ var OperatorSchema = zod.z.enum([
   "size"
 ]);
 var ConditionValueSchema = JsonValueSchema;
-var StatementSchema = zod.z.object({
+var V1StatementSchema = zod.z.object({
+  id: zod.z.string().optional(),
+  effect: zod.z.enum(["allow", "deny"]),
+  permissions: zod.z.array(zod.z.string()).min(1),
+  resources: zod.z.array(zod.z.string()).min(1),
+  conditions: zod.z.array(ConditionSchema).optional()
+}).strict();
+var V2StatementSchema = zod.z.object({
+  id: zod.z.string().optional(),
   effect: zod.z.enum(["allow", "ask", "deny"]),
   permissions: zod.z.array(zod.z.string()).min(1),
   resources: zod.z.array(zod.z.string()).min(1),
   conditions: zod.z.array(ConditionSchema).optional()
 }).strict();
-var PolicySchema = zod.z.object({
+var StatementSchema = V2StatementSchema;
+var V1PolicySchema = zod.z.object({
+  version: zod.z.literal(1),
+  statements: zod.z.array(V1StatementSchema)
+}).strict();
+var V2PolicySchema = zod.z.object({
   version: zod.z.literal(2),
-  statements: zod.z.array(StatementSchema)
+  statements: zod.z.array(V2StatementSchema)
 }).strict();
+var PolicySchema = zod.z.union([V1PolicySchema, V2PolicySchema]);
+function getOpenApiSchema() {
+  return {
+    type: "object",
+    required: ["version", "statements"],
+    properties: {
+      version: {
+        type: "integer",
+        enum: [...VALID_VERSIONS],
+        description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
+      },
+      statements: {
+        type: "array",
+        description: "List of policy statements defining permissions.",
+        items: {
+          type: "object",
+          required: ["effect", "permissions", "resources"],
+          properties: {
+            id: {
+              type: "string",
+              description: "Optional identifier for debugging and provenance. Included in canonical hash."
+            },
+            effect: {
+              type: "string",
+              enum: [...VALID_EFFECTS].sort(),
+              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
+            },
+            permissions: {
+              type: "array",
+              minItems: 1,
+              items: { type: "string" },
+              description: "List of permission identifiers."
+            },
+            resources: {
+              type: "array",
+              minItems: 1,
+              items: { type: "string" },
+              description: "List of resource identifiers the statement applies to."
+            },
+            conditions: {
+              type: "array",
+              description: "Optional conditions that must be met for the statement to apply.",
+              items: {
+                type: "object",
+                required: ["path", "operator"],
+                properties: {
+                  path: {
+                    type: "array",
+                    minItems: 1,
+                    description: "Path to the value to evaluate in the request context.",
+                    items: {
+                      anyOf: [{ type: "string" }, { type: "integer" }]
+                    }
+                  },
+                  operator: {
+                    type: "string",
+                    enum: [...VALID_OPERATOR_LIST],
+                    description: "Comparison operator used to evaluate the condition."
+                  },
+                  value: {
+                    description: "Value to compare against using the operator."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  };
+}
 
 exports.ArrayOperatorSchema = ArrayOperatorSchema;
 exports.ConditionSchema = ConditionSchema;
@@ -147,3 +246,7 @@ exports.ScalarOperatorSchema = ScalarOperatorSchema;
 exports.SizeValueSchema = SizeValueSchema;
 exports.StatementSchema = StatementSchema;
 exports.UrlOperatorSchema = UrlOperatorSchema;
+exports.VALID_EFFECTS = VALID_EFFECTS;
+exports.VALID_OPERATOR_LIST = VALID_OPERATOR_LIST;
+exports.VALID_VERSIONS = VALID_VERSIONS;
+exports.getOpenApiSchema = getOpenApiSchema;

package/dist/index.d.cts

@@ -21,13 +21,14 @@ interface Condition {
 }
 type Effect = "allow" | "ask" | "deny";
 interface Statement {
+    id?: string;
     effect: Effect;
     permissions: string[];
     resources: string[];
     conditions?: Condition[];
 }
 interface Policy {
-    version: 2;
+    version: 1 | 2;
     statements: Statement[];
 }
 interface PolicyRequest {
@@ -35,9 +36,52 @@ interface PolicyRequest {
     resource: string;
     context?: Record<string, unknown>;
 }
+/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
+type CanonicalHash = string & {
+    readonly __brand: "CanonicalHash";
+};
+interface OverrideBase {
+    id?: string;
+    statementHash: CanonicalHash;
+    effect: "allow";
+}
+type Override = (OverrideBase & {
+    match: "any";
+}) | (OverrideBase & {
+    contextHash: CanonicalHash;
+}) | (OverrideBase & {
+    conditionals: Condition[];
+});
+interface ConditionTrace {
+    condition: Condition;
+    resolved: unknown;
+    passed: boolean;
+}
+interface OverrideTrace {
+    override: Override;
+    matched: boolean;
+    conditionResults?: ConditionTrace[];
+}
+interface StatementTrace {
+    statement: Statement;
+    permissionMatched: boolean;
+    resourceMatched: boolean;
+    conditionResults?: ConditionTrace[];
+    passed: boolean;
+    overrides?: OverrideTrace[];
+}
+interface EvaluatePolicyOptions {
+    policy: Policy;
+    request: PolicyRequest;
+    overrides?: Override[];
+    trace?: boolean;
+}
+type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
 interface PolicyResult {
     effect: Effect;
-    matchedStatement?: Statement;
+    explicit: boolean;
+    reason: PolicyReason;
+    statements: StatementTrace[];
 }
 interface ParsedUrl {
     scheme: string;
@@ -52,8 +96,34 @@ interface PolicyHttpRequest {
     headers: Record<string, string | string[]>;
     body: string | null;
     body_json: unknown;
+    connection_id?: string;
+}
+interface PolicyActionRequest {
+    connection_id?: string;
+    selected_api?: string;
+    action_type?: string;
+    action_key?: string;
+    inputs?: Record<string, unknown>;
+}
+/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
+interface OpenApiSchema {
+    type?: string;
+    required?: string[];
+    properties?: Record<string, OpenApiSchema>;
+    items?: OpenApiSchema;
+    enum?: (string | number)[];
+    description?: string;
+    minItems?: number;
+    oneOf?: OpenApiSchema[];
+    anyOf?: OpenApiSchema[];
 }
 
+/** Current policy document version. */
+declare const VALID_VERSIONS: readonly [1, 2];
+/** Valid policy effects. */
+declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
+/** Valid condition operators. */
+declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
 declare const RangeValueSchema: z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
@@ -145,7 +215,9 @@ declare const OperatorSchema: z.ZodEnum<{
     matches_url: "matches_url";
 }>;
 declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
 declare const StatementSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
     effect: z.ZodEnum<{
         allow: "allow";
         ask: "ask";
@@ -204,9 +276,71 @@ declare const StatementSchema: z.ZodObject<{
         }, z.core.$strict>]>;
     }, z.core.$strict>]>>>;
 }, z.core.$strict>;
-declare const PolicySchema: z.ZodObject<{
+declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    statements: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>;
+        permissions: z.ZodArray<z.ZodString>;
+        resources: z.ZodArray<z.ZodString>;
+        conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"equals">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_host">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_path">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"range">;
+            value: z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_url">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"values_in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"exists">;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"keys_in">;
+            value: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"size">;
+            value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>]>;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
     version: z.ZodLiteral<2>;
     statements: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
         effect: z.ZodEnum<{
             allow: "allow";
             ask: "ask";
@@ -265,6 +399,13 @@ declare const PolicySchema: z.ZodObject<{
             }, z.core.$strict>]>;
         }, z.core.$strict>]>>>;
     }, z.core.$strict>>;
-}, z.core.$strict>;
+}, z.core.$strict>]>;
+/**
+ * Returns an OpenAPI-compatible JSON Schema object for a policy document.
+ *
+ * Derived from the same constants used by the Zod schemas so the
+ * documentation schema and runtime validation always stay in sync.
+ */
+declare function getOpenApiSchema(): OpenApiSchema;
 
-export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema };
+export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/dist/index.d.ts

@@ -21,13 +21,14 @@ interface Condition {
 }
 type Effect = "allow" | "ask" | "deny";
 interface Statement {
+    id?: string;
     effect: Effect;
     permissions: string[];
     resources: string[];
     conditions?: Condition[];
 }
 interface Policy {
-    version: 2;
+    version: 1 | 2;
     statements: Statement[];
 }
 interface PolicyRequest {
@@ -35,9 +36,52 @@ interface PolicyRequest {
     resource: string;
     context?: Record<string, unknown>;
 }
+/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
+type CanonicalHash = string & {
+    readonly __brand: "CanonicalHash";
+};
+interface OverrideBase {
+    id?: string;
+    statementHash: CanonicalHash;
+    effect: "allow";
+}
+type Override = (OverrideBase & {
+    match: "any";
+}) | (OverrideBase & {
+    contextHash: CanonicalHash;
+}) | (OverrideBase & {
+    conditionals: Condition[];
+});
+interface ConditionTrace {
+    condition: Condition;
+    resolved: unknown;
+    passed: boolean;
+}
+interface OverrideTrace {
+    override: Override;
+    matched: boolean;
+    conditionResults?: ConditionTrace[];
+}
+interface StatementTrace {
+    statement: Statement;
+    permissionMatched: boolean;
+    resourceMatched: boolean;
+    conditionResults?: ConditionTrace[];
+    passed: boolean;
+    overrides?: OverrideTrace[];
+}
+interface EvaluatePolicyOptions {
+    policy: Policy;
+    request: PolicyRequest;
+    overrides?: Override[];
+    trace?: boolean;
+}
+type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
 interface PolicyResult {
     effect: Effect;
-    matchedStatement?: Statement;
+    explicit: boolean;
+    reason: PolicyReason;
+    statements: StatementTrace[];
 }
 interface ParsedUrl {
     scheme: string;
@@ -52,8 +96,34 @@ interface PolicyHttpRequest {
     headers: Record<string, string | string[]>;
     body: string | null;
     body_json: unknown;
+    connection_id?: string;
+}
+interface PolicyActionRequest {
+    connection_id?: string;
+    selected_api?: string;
+    action_type?: string;
+    action_key?: string;
+    inputs?: Record<string, unknown>;
+}
+/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
+interface OpenApiSchema {
+    type?: string;
+    required?: string[];
+    properties?: Record<string, OpenApiSchema>;
+    items?: OpenApiSchema;
+    enum?: (string | number)[];
+    description?: string;
+    minItems?: number;
+    oneOf?: OpenApiSchema[];
+    anyOf?: OpenApiSchema[];
 }
 
+/** Current policy document version. */
+declare const VALID_VERSIONS: readonly [1, 2];
+/** Valid policy effects. */
+declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
+/** Valid condition operators. */
+declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
 declare const RangeValueSchema: z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
@@ -145,7 +215,9 @@ declare const OperatorSchema: z.ZodEnum<{
     matches_url: "matches_url";
 }>;
 declare const ConditionValueSchema: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+/** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
 declare const StatementSchema: z.ZodObject<{
+    id: z.ZodOptional<z.ZodString>;
     effect: z.ZodEnum<{
         allow: "allow";
         ask: "ask";
@@ -204,9 +276,71 @@ declare const StatementSchema: z.ZodObject<{
         }, z.core.$strict>]>;
     }, z.core.$strict>]>>>;
 }, z.core.$strict>;
-declare const PolicySchema: z.ZodObject<{
+declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    statements: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+        }>;
+        permissions: z.ZodArray<z.ZodString>;
+        resources: z.ZodArray<z.ZodString>;
+        conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"equals">;
+            value: z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_host">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_path">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"range">;
+            value: z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_url">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"values_in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"exists">;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"keys_in">;
+            value: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"size">;
+            value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>]>;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
     version: z.ZodLiteral<2>;
     statements: z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
         effect: z.ZodEnum<{
             allow: "allow";
             ask: "ask";
@@ -265,6 +399,13 @@ declare const PolicySchema: z.ZodObject<{
             }, z.core.$strict>]>;
         }, z.core.$strict>]>>>;
     }, z.core.$strict>>;
-}, z.core.$strict>;
+}, z.core.$strict>]>;
+/**
+ * Returns an OpenAPI-compatible JSON Schema object for a policy document.
+ *
+ * Derived from the same constants used by the Zod schemas so the
+ * documentation schema and runtime validation always stay in sync.
+ */
+declare function getOpenApiSchema(): OpenApiSchema;
 
-export { type ArrayOperator, ArrayOperatorSchema, type Condition, ConditionSchema, type ConditionValue, ConditionValueSchema, type Effect, type JsonValue, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type ParsedUrl, type Policy, type PolicyHttpRequest, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type UrlOperator, UrlOperatorSchema };
+export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/dist/index.mjs

@@ -1,6 +1,21 @@
 import { z } from 'zod';
 
 // src/schema.ts
+var VALID_VERSIONS = [1, 2];
+var VALID_EFFECTS = ["allow", "ask", "deny"];
+var VALID_OPERATOR_LIST = [
+  "equals",
+  "exists",
+  "in",
+  "keys_in",
+  "matches",
+  "matches_host",
+  "matches_path",
+  "matches_url",
+  "range",
+  "size",
+  "values_in"
+];
 var ScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
 var PathSchema = z.array(z.union([z.string(), z.number()])).min(1);
 var JsonValueSchema = z.lazy(
@@ -123,15 +138,99 @@ var OperatorSchema = z.enum([
   "size"
 ]);
 var ConditionValueSchema = JsonValueSchema;
-var StatementSchema = z.object({
+var V1StatementSchema = z.object({
+  id: z.string().optional(),
+  effect: z.enum(["allow", "deny"]),
+  permissions: z.array(z.string()).min(1),
+  resources: z.array(z.string()).min(1),
+  conditions: z.array(ConditionSchema).optional()
+}).strict();
+var V2StatementSchema = z.object({
+  id: z.string().optional(),
   effect: z.enum(["allow", "ask", "deny"]),
   permissions: z.array(z.string()).min(1),
   resources: z.array(z.string()).min(1),
   conditions: z.array(ConditionSchema).optional()
 }).strict();
-var PolicySchema = z.object({
+var StatementSchema = V2StatementSchema;
+var V1PolicySchema = z.object({
+  version: z.literal(1),
+  statements: z.array(V1StatementSchema)
+}).strict();
+var V2PolicySchema = z.object({
   version: z.literal(2),
-  statements: z.array(StatementSchema)
+  statements: z.array(V2StatementSchema)
 }).strict();
+var PolicySchema = z.union([V1PolicySchema, V2PolicySchema]);
+function getOpenApiSchema() {
+  return {
+    type: "object",
+    required: ["version", "statements"],
+    properties: {
+      version: {
+        type: "integer",
+        enum: [...VALID_VERSIONS],
+        description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
+      },
+      statements: {
+        type: "array",
+        description: "List of policy statements defining permissions.",
+        items: {
+          type: "object",
+          required: ["effect", "permissions", "resources"],
+          properties: {
+            id: {
+              type: "string",
+              description: "Optional identifier for debugging and provenance. Included in canonical hash."
+            },
+            effect: {
+              type: "string",
+              enum: [...VALID_EFFECTS].sort(),
+              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
+            },
+            permissions: {
+              type: "array",
+              minItems: 1,
+              items: { type: "string" },
+              description: "List of permission identifiers."
+            },
+            resources: {
+              type: "array",
+              minItems: 1,
+              items: { type: "string" },
+              description: "List of resource identifiers the statement applies to."
+            },
+            conditions: {
+              type: "array",
+              description: "Optional conditions that must be met for the statement to apply.",
+              items: {
+                type: "object",
+                required: ["path", "operator"],
+                properties: {
+                  path: {
+                    type: "array",
+                    minItems: 1,
+                    description: "Path to the value to evaluate in the request context.",
+                    items: {
+                      anyOf: [{ type: "string" }, { type: "integer" }]
+                    }
+                  },
+                  operator: {
+                    type: "string",
+                    enum: [...VALID_OPERATOR_LIST],
+                    description: "Comparison operator used to evaluate the condition."
+                  },
+                  value: {
+                    description: "Value to compare against using the operator."
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  };
+}
 
-export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema };
+export { ArrayOperatorSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/policy-schema",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Zod schemas and TypeScript types for the Zapier policy engine",
   "type": "module",
   "main": "dist/index.cjs",