@lannguyensi/harness 0.25.1 → 0.26.0

package/dist/schema/environments.d.ts

@@ -0,0 +1,215 @@
+import { z } from "zod";
+export declare const EnvironmentNameSchema: z.ZodEnum<["production", "staging", "dev", "local"]>;
+export declare const MatchableEnvironmentSchema: z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>;
+export declare const EnvironmentResolverSchema: z.ZodObject<{
+    name: z.ZodString;
+    environment: z.ZodEnum<["production", "staging", "dev", "local"]>;
+    signals: z.ZodEffects<z.ZodObject<{
+        branch_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env_var_patterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            var: z.ZodString;
+            patterns: z.ZodArray<z.ZodString, "many">;
+        }, "strict", z.ZodTypeAny, {
+            var: string;
+            patterns: string[];
+        }, {
+            var: string;
+            patterns: string[];
+        }>, "many">>;
+        kube_context_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        kube_namespace_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        branch_patterns?: string[] | undefined;
+        env_var_patterns?: {
+            var: string;
+            patterns: string[];
+        }[] | undefined;
+        kube_context_patterns?: string[] | undefined;
+        kube_namespace_patterns?: string[] | undefined;
+    }, {
+        branch_patterns?: string[] | undefined;
+        env_var_patterns?: {
+            var: string;
+            patterns: string[];
+        }[] | undefined;
+        kube_context_patterns?: string[] | undefined;
+        kube_namespace_patterns?: string[] | undefined;
+    }>, {
+        branch_patterns?: string[] | undefined;
+        env_var_patterns?: {
+            var: string;
+            patterns: string[];
+        }[] | undefined;
+        kube_context_patterns?: string[] | undefined;
+        kube_namespace_patterns?: string[] | undefined;
+    }, {
+        branch_patterns?: string[] | undefined;
+        env_var_patterns?: {
+            var: string;
+            patterns: string[];
+        }[] | undefined;
+        kube_context_patterns?: string[] | undefined;
+        kube_namespace_patterns?: string[] | undefined;
+    }>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    environment: "production" | "staging" | "dev" | "local";
+    signals: {
+        branch_patterns?: string[] | undefined;
+        env_var_patterns?: {
+            var: string;
+            patterns: string[];
+        }[] | undefined;
+        kube_context_patterns?: string[] | undefined;
+        kube_namespace_patterns?: string[] | undefined;
+    };
+}, {
+    name: string;
+    environment: "production" | "staging" | "dev" | "local";
+    signals: {
+        branch_patterns?: string[] | undefined;
+        env_var_patterns?: {
+            var: string;
+            patterns: string[];
+        }[] | undefined;
+        kube_context_patterns?: string[] | undefined;
+        kube_namespace_patterns?: string[] | undefined;
+    };
+}>;
+export declare const EnvironmentsSchema: z.ZodEffects<z.ZodObject<{
+    resolvers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        environment: z.ZodEnum<["production", "staging", "dev", "local"]>;
+        signals: z.ZodEffects<z.ZodObject<{
+            branch_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            env_var_patterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                var: z.ZodString;
+                patterns: z.ZodArray<z.ZodString, "many">;
+            }, "strict", z.ZodTypeAny, {
+                var: string;
+                patterns: string[];
+            }, {
+                var: string;
+                patterns: string[];
+            }>, "many">>;
+            kube_context_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            kube_namespace_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        }, "strict", z.ZodTypeAny, {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        }, {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        }>, {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        }, {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        environment: "production" | "staging" | "dev" | "local";
+        signals: {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        };
+    }, {
+        name: string;
+        environment: "production" | "staging" | "dev" | "local";
+        signals: {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        };
+    }>, "many">>;
+}, "strict", z.ZodTypeAny, {
+    resolvers: {
+        name: string;
+        environment: "production" | "staging" | "dev" | "local";
+        signals: {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        };
+    }[];
+}, {
+    resolvers?: {
+        name: string;
+        environment: "production" | "staging" | "dev" | "local";
+        signals: {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        };
+    }[] | undefined;
+}>, {
+    resolvers: {
+        name: string;
+        environment: "production" | "staging" | "dev" | "local";
+        signals: {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        };
+    }[];
+}, {
+    resolvers?: {
+        name: string;
+        environment: "production" | "staging" | "dev" | "local";
+        signals: {
+            branch_patterns?: string[] | undefined;
+            env_var_patterns?: {
+                var: string;
+                patterns: string[];
+            }[] | undefined;
+            kube_context_patterns?: string[] | undefined;
+            kube_namespace_patterns?: string[] | undefined;
+        };
+    }[] | undefined;
+}>;
+export type EnvironmentName = z.infer<typeof EnvironmentNameSchema>;
+export type MatchableEnvironment = z.infer<typeof MatchableEnvironmentSchema>;
+export type EnvironmentResolver = z.infer<typeof EnvironmentResolverSchema>;
+export type EnvironmentsConfig = z.infer<typeof EnvironmentsSchema>;

package/dist/schema/environments.js

@@ -0,0 +1,101 @@
+import { z } from "zod";
+// Environment-resolution vocabulary — Phase 7 #1 anchor.
+//
+// STATUS: schema vocabulary only. `harness validate` parses and
+// validates an `environments:` block, but no runtime surface reads it
+// yet. The Context Resolver that consumes `environments.resolvers[]` to
+// classify an Action Envelope as production / staging / dev / local /
+// unknown lands in Phase 7 #4 (see docs/ROADMAP.md and
+// docs/risk-gate.md). Until then an `environments:` block is inert,
+// validated config.
+//
+// "Unknown is not safe": when no resolver matches, the resolved
+// environment is `unknown`. Policy `when.environment.name` clauses are
+// expected to treat `unknown` as approval-worthy, not allow-by-default.
+// That enforcement semantic lives with the Phase 7 #4/#5 runtime; the
+// anchor only fixes the config shape.
+//
+// Design source: lava-ice-logs/2026-04-30/harness-risk-gate-extension.md.
+// The environment names a resolver may assert. `unknown` is the
+// implicit fallback when nothing matches and is deliberately NOT in
+// this set: a resolver that "asserts unknown" is a contradiction.
+export const EnvironmentNameSchema = z.enum([
+    "production",
+    "staging",
+    "dev",
+    "local",
+]);
+// The environment names a policy `when.environment.name` clause may
+// test. Identical to the resolver set plus `unknown`, so a policy can
+// gate the no-resolver-matched case ("unknown is not safe").
+export const MatchableEnvironmentSchema = z.enum([
+    "production",
+    "staging",
+    "dev",
+    "local",
+    "unknown",
+]);
+// A signal that fires when a named environment variable's value
+// contains any of the listed substrings. Substring, not regex — kept
+// deliberately blunt for v1; see docs/risk-gate.md.
+const EnvVarSignalSchema = z
+    .object({
+    var: z.string().min(1),
+    patterns: z.array(z.string().min(1)).min(1),
+})
+    .strict();
+// The four signal kinds a resolver can combine. Every field is
+// optional, but at least one must be present — a resolver with no
+// signals can never fire and is a config error. Pattern match
+// semantics (glob vs substring vs regex per kind) are defined by the
+// Phase 7 #4 resolver runtime and documented in docs/risk-gate.md; the
+// anchor stores them as plain non-empty strings.
+const EnvironmentSignalsSchema = z
+    .object({
+    branch_patterns: z.array(z.string().min(1)).min(1).optional(),
+    env_var_patterns: z.array(EnvVarSignalSchema).min(1).optional(),
+    kube_context_patterns: z.array(z.string().min(1)).min(1).optional(),
+    kube_namespace_patterns: z.array(z.string().min(1)).min(1).optional(),
+})
+    .strict()
+    .superRefine((signals, ctx) => {
+    const hasSignal = signals.branch_patterns !== undefined ||
+        signals.env_var_patterns !== undefined ||
+        signals.kube_context_patterns !== undefined ||
+        signals.kube_namespace_patterns !== undefined;
+    if (!hasSignal) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: [],
+            message: "resolver signals must declare at least one of: branch_patterns, env_var_patterns, kube_context_patterns, kube_namespace_patterns",
+        });
+    }
+});
+export const EnvironmentResolverSchema = z
+    .object({
+    name: z.string().min(1),
+    // The environment this resolver asserts when any of its signals
+    // match.
+    environment: EnvironmentNameSchema,
+    signals: EnvironmentSignalsSchema,
+})
+    .strict();
+export const EnvironmentsSchema = z
+    .object({
+    resolvers: z.array(EnvironmentResolverSchema).default([]),
+})
+    .strict()
+    .superRefine((envs, ctx) => {
+    const seen = new Set();
+    envs.resolvers.forEach((r, i) => {
+        if (seen.has(r.name)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["resolvers", i, "name"],
+                message: `duplicate environment resolver name: ${r.name}`,
+            });
+        }
+        seen.add(r.name);
+    });
+});
+//# sourceMappingURL=environments.js.map

package/dist/schema/environments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../src/schema/environments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,uDAAuD;AACvD,oEAAoE;AACpE,oBAAoB;AACpB,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,sCAAsC;AACtC,EAAE;AACF,0EAA0E;AAE1E,gEAAgE;AAChE,oEAAoE;AACpE,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,YAAY;IACZ,SAAS;IACT,KAAK;IACL,OAAO;CACR,CAAC,CAAC;AAEH,oEAAoE;AACpE,sEAAsE;AACtE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,YAAY;IACZ,SAAS;IACT,KAAK;IACL,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,gEAAgE;AAChE,qEAAqE;AACrE,oDAAoD;AACpD,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+DAA+D;AAC/D,kEAAkE;AAClE,8DAA8D;AAC9D,qEAAqE;AACrE,uEAAuE;AACvE,iDAAiD;AACjD,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnE,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,SAAS,GACb,OAAO,CAAC,eAAe,KAAK,SAAS;QACrC,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACtC,OAAO,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,CAAC,uBAAuB,KAAK,SAAS,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,EAAE;YACR,OAAO,EACL,kIAAkI;SACrI,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,gEAAgE;IAChE,SAAS;IACT,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,wBAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC9B,OAAO,EAAE,wCAAwC,CAAC,CAAC,IAAI,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}