@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/schema/audit.d.ts

@@ -1,71 +0,0 @@
-import { z } from "zod";
-export declare const RedactRuleSchema: z.ZodUnion<[z.ZodEffects<z.ZodObject<{
-    regex: z.ZodString;
-    replacement: z.ZodDefault<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    regex: string;
-    replacement: string;
-}, {
-    regex: string;
-    replacement?: string | undefined;
-}>, {
-    regex: string;
-    replacement: string;
-}, {
-    regex: string;
-    replacement?: string | undefined;
-}>, z.ZodObject<{
-    env_var: z.ZodString;
-    replacement: z.ZodDefault<z.ZodString>;
-}, "strict", z.ZodTypeAny, {
-    replacement: string;
-    env_var: string;
-}, {
-    env_var: string;
-    replacement?: string | undefined;
-}>]>;
-export declare const AuditSchema: z.ZodObject<{
-    redact: z.ZodDefault<z.ZodArray<z.ZodUnion<[z.ZodEffects<z.ZodObject<{
-        regex: z.ZodString;
-        replacement: z.ZodDefault<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        regex: string;
-        replacement: string;
-    }, {
-        regex: string;
-        replacement?: string | undefined;
-    }>, {
-        regex: string;
-        replacement: string;
-    }, {
-        regex: string;
-        replacement?: string | undefined;
-    }>, z.ZodObject<{
-        env_var: z.ZodString;
-        replacement: z.ZodDefault<z.ZodString>;
-    }, "strict", z.ZodTypeAny, {
-        replacement: string;
-        env_var: string;
-    }, {
-        env_var: string;
-        replacement?: string | undefined;
-    }>]>, "many">>;
-}, "strict", z.ZodTypeAny, {
-    redact: ({
-        regex: string;
-        replacement: string;
-    } | {
-        replacement: string;
-        env_var: string;
-    })[];
-}, {
-    redact?: ({
-        regex: string;
-        replacement?: string | undefined;
-    } | {
-        env_var: string;
-        replacement?: string | undefined;
-    })[] | undefined;
-}>;
-export type RedactRule = z.infer<typeof RedactRuleSchema>;
-export type AuditConfig = z.infer<typeof AuditSchema>;

package/dist/schema/audit.js

@@ -1,32 +0,0 @@
-import { z } from "zod";
-const RegexRedactRuleSchema = z
-    .object({
-    regex: z.string().min(1),
-    replacement: z.string().default("<REDACTED>"),
-})
-    .strict()
-    .superRefine((rule, ctx) => {
-    try {
-        new RegExp(rule.regex);
-    }
-    catch (err) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ["regex"],
-            message: `invalid regex: ${err.message}`,
-        });
-    }
-});
-const EnvVarRedactRuleSchema = z
-    .object({
-    env_var: z.string().min(1),
-    replacement: z.string().default("<REDACTED>"),
-})
-    .strict();
-export const RedactRuleSchema = z.union([RegexRedactRuleSchema, EnvVarRedactRuleSchema]);
-export const AuditSchema = z
-    .object({
-    redact: z.array(RedactRuleSchema).default([]),
-})
-    .strict();
-//# sourceMappingURL=audit.js.map

package/dist/schema/audit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/schema/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,qBAAqB,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schema/doctor.d.ts

@@ -1,25 +0,0 @@
-import { z } from "zod";
-/**
- * `doctor:` — operator-facing configuration for `harness doctor` checks.
- *
- * `ignore_template_drift` is the deliberate-opt-out channel for the
- * template-policy-drift check (task adf037c1): each entry is a shipped
- * policy NAME the operator has consciously chosen NOT to carry in this
- * installed manifest, so doctor must not report it as drift.
- *
- * This is deliberately NOT a per-policy `enabled: false` flag. A
- * `policies[].enabled` field would be read by the drift check but IGNORED
- * by the runtime policy engine (which has no such concept), so an operator
- * setting it would believe a policy disabled while it still fired — a
- * security footgun. This list only ever suppresses a doctor REPORT line;
- * it changes no enforcement semantics, so its meaning is honest at a
- * glance. (Operator decision 2026-08-08.)
- */
-export declare const DoctorSchema: z.ZodObject<{
-    ignore_template_drift: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
-}, "strict", z.ZodTypeAny, {
-    ignore_template_drift: string[];
-}, {
-    ignore_template_drift?: string[] | undefined;
-}>;
-export type DoctorConfig = z.infer<typeof DoctorSchema>;

package/dist/schema/doctor.js

@@ -1,23 +0,0 @@
-import { z } from "zod";
-/**
- * `doctor:` — operator-facing configuration for `harness doctor` checks.
- *
- * `ignore_template_drift` is the deliberate-opt-out channel for the
- * template-policy-drift check (task adf037c1): each entry is a shipped
- * policy NAME the operator has consciously chosen NOT to carry in this
- * installed manifest, so doctor must not report it as drift.
- *
- * This is deliberately NOT a per-policy `enabled: false` flag. A
- * `policies[].enabled` field would be read by the drift check but IGNORED
- * by the runtime policy engine (which has no such concept), so an operator
- * setting it would believe a policy disabled while it still fired — a
- * security footgun. This list only ever suppresses a doctor REPORT line;
- * it changes no enforcement semantics, so its meaning is honest at a
- * glance. (Operator decision 2026-08-08.)
- */
-export const DoctorSchema = z
-    .object({
-    ignore_template_drift: z.array(z.string().min(1)).default([]),
-})
-    .strict();
-//# sourceMappingURL=doctor.js.map

package/dist/schema/doctor.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/schema/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schema/environments.d.ts

@@ -1,215 +0,0 @@
-import { z } from "zod";
-export declare const EnvironmentNameSchema: z.ZodEnum<["production", "staging", "dev", "local"]>;
-export declare const MatchableEnvironmentSchema: z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>;
-export declare const EnvironmentResolverSchema: z.ZodObject<{
-    name: z.ZodString;
-    environment: z.ZodEnum<["production", "staging", "dev", "local"]>;
-    signals: z.ZodEffects<z.ZodObject<{
-        branch_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        env_var_patterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
-            var: z.ZodString;
-            patterns: z.ZodArray<z.ZodString, "many">;
-        }, "strict", z.ZodTypeAny, {
-            var: string;
-            patterns: string[];
-        }, {
-            var: string;
-            patterns: string[];
-        }>, "many">>;
-        kube_context_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        kube_namespace_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-    }, "strict", z.ZodTypeAny, {
-        branch_patterns?: string[] | undefined;
-        env_var_patterns?: {
-            var: string;
-            patterns: string[];
-        }[] | undefined;
-        kube_context_patterns?: string[] | undefined;
-        kube_namespace_patterns?: string[] | undefined;
-    }, {
-        branch_patterns?: string[] | undefined;
-        env_var_patterns?: {
-            var: string;
-            patterns: string[];
-        }[] | undefined;
-        kube_context_patterns?: string[] | undefined;
-        kube_namespace_patterns?: string[] | undefined;
-    }>, {
-        branch_patterns?: string[] | undefined;
-        env_var_patterns?: {
-            var: string;
-            patterns: string[];
-        }[] | undefined;
-        kube_context_patterns?: string[] | undefined;
-        kube_namespace_patterns?: string[] | undefined;
-    }, {
-        branch_patterns?: string[] | undefined;
-        env_var_patterns?: {
-            var: string;
-            patterns: string[];
-        }[] | undefined;
-        kube_context_patterns?: string[] | undefined;
-        kube_namespace_patterns?: string[] | undefined;
-    }>;
-}, "strict", z.ZodTypeAny, {
-    name: string;
-    environment: "production" | "staging" | "dev" | "local";
-    signals: {
-        branch_patterns?: string[] | undefined;
-        env_var_patterns?: {
-            var: string;
-            patterns: string[];
-        }[] | undefined;
-        kube_context_patterns?: string[] | undefined;
-        kube_namespace_patterns?: string[] | undefined;
-    };
-}, {
-    name: string;
-    environment: "production" | "staging" | "dev" | "local";
-    signals: {
-        branch_patterns?: string[] | undefined;
-        env_var_patterns?: {
-            var: string;
-            patterns: string[];
-        }[] | undefined;
-        kube_context_patterns?: string[] | undefined;
-        kube_namespace_patterns?: string[] | undefined;
-    };
-}>;
-export declare const EnvironmentsSchema: z.ZodEffects<z.ZodObject<{
-    resolvers: z.ZodDefault<z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        environment: z.ZodEnum<["production", "staging", "dev", "local"]>;
-        signals: z.ZodEffects<z.ZodObject<{
-            branch_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-            env_var_patterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
-                var: z.ZodString;
-                patterns: z.ZodArray<z.ZodString, "many">;
-            }, "strict", z.ZodTypeAny, {
-                var: string;
-                patterns: string[];
-            }, {
-                var: string;
-                patterns: string[];
-            }>, "many">>;
-            kube_context_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-            kube_namespace_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
-        }, "strict", z.ZodTypeAny, {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        }, {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        }>, {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        }, {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        }>;
-    }, "strict", z.ZodTypeAny, {
-        name: string;
-        environment: "production" | "staging" | "dev" | "local";
-        signals: {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        };
-    }, {
-        name: string;
-        environment: "production" | "staging" | "dev" | "local";
-        signals: {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        };
-    }>, "many">>;
-}, "strict", z.ZodTypeAny, {
-    resolvers: {
-        name: string;
-        environment: "production" | "staging" | "dev" | "local";
-        signals: {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        };
-    }[];
-}, {
-    resolvers?: {
-        name: string;
-        environment: "production" | "staging" | "dev" | "local";
-        signals: {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        };
-    }[] | undefined;
-}>, {
-    resolvers: {
-        name: string;
-        environment: "production" | "staging" | "dev" | "local";
-        signals: {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        };
-    }[];
-}, {
-    resolvers?: {
-        name: string;
-        environment: "production" | "staging" | "dev" | "local";
-        signals: {
-            branch_patterns?: string[] | undefined;
-            env_var_patterns?: {
-                var: string;
-                patterns: string[];
-            }[] | undefined;
-            kube_context_patterns?: string[] | undefined;
-            kube_namespace_patterns?: string[] | undefined;
-        };
-    }[] | undefined;
-}>;
-export type EnvironmentName = z.infer<typeof EnvironmentNameSchema>;
-export type MatchableEnvironment = z.infer<typeof MatchableEnvironmentSchema>;
-export type EnvironmentResolver = z.infer<typeof EnvironmentResolverSchema>;
-export type EnvironmentsConfig = z.infer<typeof EnvironmentsSchema>;

package/dist/schema/environments.js

@@ -1,101 +0,0 @@
-import { z } from "zod";
-// Environment-resolution vocabulary — Phase 7 #1 anchor.
-//
-// STATUS: schema vocabulary only. `harness validate` parses and
-// validates an `environments:` block, but no runtime surface reads it
-// yet. The Context Resolver that consumes `environments.resolvers[]` to
-// classify an Action Envelope as production / staging / dev / local /
-// unknown lands in Phase 7 #4 (see docs/ROADMAP.md and
-// docs/risk-gate.md). Until then an `environments:` block is inert,
-// validated config.
-//
-// "Unknown is not safe": when no resolver matches, the resolved
-// environment is `unknown`. Policy `when.environment.name` clauses are
-// expected to treat `unknown` as approval-worthy, not allow-by-default.
-// That enforcement semantic lives with the Phase 7 #4/#5 runtime; the
-// anchor only fixes the config shape.
-//
-// Design source: lava-ice-logs/2026-04-30/harness-risk-gate-extension.md.
-// The environment names a resolver may assert. `unknown` is the
-// implicit fallback when nothing matches and is deliberately NOT in
-// this set: a resolver that "asserts unknown" is a contradiction.
-export const EnvironmentNameSchema = z.enum([
-    "production",
-    "staging",
-    "dev",
-    "local",
-]);
-// The environment names a policy `when.environment.name` clause may
-// test. Identical to the resolver set plus `unknown`, so a policy can
-// gate the no-resolver-matched case ("unknown is not safe").
-export const MatchableEnvironmentSchema = z.enum([
-    "production",
-    "staging",
-    "dev",
-    "local",
-    "unknown",
-]);
-// A signal that fires when a named environment variable's value
-// contains any of the listed substrings. Substring, not regex — kept
-// deliberately blunt for v1; see docs/risk-gate.md.
-const EnvVarSignalSchema = z
-    .object({
-    var: z.string().min(1),
-    patterns: z.array(z.string().min(1)).min(1),
-})
-    .strict();
-// The four signal kinds a resolver can combine. Every field is
-// optional, but at least one must be present — a resolver with no
-// signals can never fire and is a config error. Pattern match
-// semantics (glob vs substring vs regex per kind) are defined by the
-// Phase 7 #4 resolver runtime and documented in docs/risk-gate.md; the
-// anchor stores them as plain non-empty strings.
-const EnvironmentSignalsSchema = z
-    .object({
-    branch_patterns: z.array(z.string().min(1)).min(1).optional(),
-    env_var_patterns: z.array(EnvVarSignalSchema).min(1).optional(),
-    kube_context_patterns: z.array(z.string().min(1)).min(1).optional(),
-    kube_namespace_patterns: z.array(z.string().min(1)).min(1).optional(),
-})
-    .strict()
-    .superRefine((signals, ctx) => {
-    const hasSignal = signals.branch_patterns !== undefined ||
-        signals.env_var_patterns !== undefined ||
-        signals.kube_context_patterns !== undefined ||
-        signals.kube_namespace_patterns !== undefined;
-    if (!hasSignal) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: [],
-            message: "resolver signals must declare at least one of: branch_patterns, env_var_patterns, kube_context_patterns, kube_namespace_patterns",
-        });
-    }
-});
-export const EnvironmentResolverSchema = z
-    .object({
-    name: z.string().min(1),
-    // The environment this resolver asserts when any of its signals
-    // match.
-    environment: EnvironmentNameSchema,
-    signals: EnvironmentSignalsSchema,
-})
-    .strict();
-export const EnvironmentsSchema = z
-    .object({
-    resolvers: z.array(EnvironmentResolverSchema).default([]),
-})
-    .strict()
-    .superRefine((envs, ctx) => {
-    const seen = new Set();
-    envs.resolvers.forEach((r, i) => {
-        if (seen.has(r.name)) {
-            ctx.addIssue({
-                code: z.ZodIssueCode.custom,
-                path: ["resolvers", i, "name"],
-                message: `duplicate environment resolver name: ${r.name}`,
-            });
-        }
-        seen.add(r.name);
-    });
-});
-//# sourceMappingURL=environments.js.map

package/dist/schema/environments.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../src/schema/environments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,wEAAwE;AACxE,sEAAsE;AACtE,uDAAuD;AACvD,oEAAoE;AACpE,oBAAoB;AACpB,EAAE;AACF,gEAAgE;AAChE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,sCAAsC;AACtC,EAAE;AACF,0EAA0E;AAE1E,gEAAgE;AAChE,oEAAoE;AACpE,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,YAAY;IACZ,SAAS;IACT,KAAK;IACL,OAAO;CACR,CAAC,CAAC;AAEH,oEAAoE;AACpE,sEAAsE;AACtE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,YAAY;IACZ,SAAS;IACT,KAAK;IACL,OAAO;IACP,SAAS;CACV,CAAC,CAAC;AAEH,gEAAgE;AAChE,qEAAqE;AACrE,oDAAoD;AACpD,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+DAA+D;AAC/D,kEAAkE;AAClE,8DAA8D;AAC9D,qEAAqE;AACrE,uEAAuE;AACvE,iDAAiD;AACjD,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7D,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,qBAAqB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnE,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,SAAS,GACb,OAAO,CAAC,eAAe,KAAK,SAAS;QACrC,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACtC,OAAO,CAAC,qBAAqB,KAAK,SAAS;QAC3C,OAAO,CAAC,uBAAuB,KAAK,SAAS,CAAC;IAChD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,EAAE;YACR,OAAO,EACL,kIAAkI;SACrI,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,gEAAgE;IAChE,SAAS;IACT,WAAW,EAAE,qBAAqB;IAClC,OAAO,EAAE,wBAAwB;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1D,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC9B,OAAO,EAAE,wCAAwC,CAAC,CAAC,IAAI,EAAE;aAC1D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/schema/extract.d.ts

@@ -1,9 +0,0 @@
-import { z } from "zod";
-export declare const ExtractExpressionSchema: z.ZodEffects<z.ZodString, string, string>;
-export type ExtractExpression = z.infer<typeof ExtractExpressionSchema>;
-export declare const ExtractMapSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>;
-export type ExtractMap = z.infer<typeof ExtractMapSchema>;
-export declare const ToolArgsExtractExpressionSchema: z.ZodEffects<z.ZodString, string, string>;
-export declare const InputMatchLiteralSchema: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>;
-export declare const InputMatchMapSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>;
-export type InputMatchMap = z.infer<typeof InputMatchMapSchema>;

package/dist/schema/extract.js

@@ -1,86 +0,0 @@
-import { z } from "zod";
-import { ExtractGrammarError, parseExtractExpression, validateExtractGrammar, } from "../io/extract.js";
-export const ExtractExpressionSchema = z.string().min(1).superRefine((v, ctx) => {
-    try {
-        validateExtractGrammar(v);
-    }
-    catch (err) {
-        if (err instanceof ExtractGrammarError) {
-            // Strip the leading `extract expression "<expr>": ` prefix so the
-            // message reads naturally next to the zod path. The path already
-            // points at the offending field.
-            const msg = err.message.replace(/^extract expression "[^"]*": /, "");
-            ctx.addIssue({ code: z.ZodIssueCode.custom, message: msg });
-            return;
-        }
-        throw err;
-    }
-});
-const VAR_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
-export const ExtractMapSchema = z
-    .record(ExtractExpressionSchema)
-    .refine((m) => Object.keys(m).every((k) => VAR_NAME_RE.test(k)), { message: "extract variable names must be SCREAMING_SNAKE_CASE" });
-// ---------------------------------------------------------------------------
-// trigger.input_match (task 2699b476)
-// ---------------------------------------------------------------------------
-//
-// Same expression grammar as `trigger.extract`, but restricted to the
-// `toolArgs.` namespace: the predicate answers "did THIS tool call carry
-// this argument value?", and `event` / `session` / `git` are not tool
-// arguments. Rejecting the other three namespaces here (rather than
-// silently never matching them at runtime) is what makes a typo like
-// `event.autoMerge` a loud `harness validate` error instead of a gate
-// that quietly never fires.
-//
-// This is the same layer `bash_match` and `path_match` are declared at
-// (`PolicyTriggerSchema`), so every consumer that parses a manifest,
-// `harness validate`, `apply`, `doctor`, `loadManifest`, the intercept
-// entrypoint, refuses the bad shape, not just the two report verbs.
-export const ToolArgsExtractExpressionSchema = z
-    .string()
-    .min(1)
-    .superRefine((v, ctx) => {
-    let parsed;
-    try {
-        parsed = parseExtractExpression(v);
-    }
-    catch (err) {
-        if (err instanceof ExtractGrammarError) {
-            ctx.addIssue({
-                code: z.ZodIssueCode.custom,
-                message: err.message.replace(/^extract expression "[^"]*": /, ""),
-            });
-            return;
-        }
-        throw err;
-    }
-    if (parsed.namespace !== "toolArgs") {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: `input_match keys must read from the toolArgs namespace ` +
-                `(the tool call's own arguments); "${v}" reads from ${parsed.namespace}`,
-        });
-    }
-});
-export const InputMatchLiteralSchema = z.union([z.string(), z.number(), z.boolean()]);
-export const InputMatchMapSchema = z
-    .record(InputMatchLiteralSchema)
-    .superRefine((map, ctx) => {
-    const keys = Object.keys(map);
-    if (keys.length === 0) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "trigger.input_match must declare at least one entry; an empty map is a silent no-op",
-        });
-        return;
-    }
-    for (const key of keys) {
-        const result = ToolArgsExtractExpressionSchema.safeParse(key);
-        if (result.success)
-            continue;
-        for (const issue of result.error.issues) {
-            ctx.addIssue({ code: z.ZodIssueCode.custom, path: [key], message: issue.message });
-        }
-    }
-});
-//# sourceMappingURL=extract.js.map

package/dist/schema/extract.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"extract.js","sourceRoot":"","sources":["../../src/schema/extract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IAC9E,IAAI,CAAC;QACH,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,kEAAkE;YAClE,iEAAiE;YACjE,iCAAiC;YACjC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAC;YACrE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC,CAAC,CAAC;AAIH,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC,uBAAuB,CAAC;KAC/B,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EACvD,EAAE,OAAO,EAAE,qDAAqD,EAAE,CACnE,CAAC;AAIJ,8EAA8E;AAC9E,sCAAsC;AACtC,8EAA8E;AAC9E,EAAE;AACF,sEAAsE;AACtE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,sEAAsE;AACtE,4BAA4B;AAC5B,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,oEAAoE;AACpE,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;IACtB,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,CAAC;aAClE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,yDAAyD;gBACzD,qCAAqC,CAAC,gBAAgB,MAAM,CAAC,SAAS,EAAE;SAC3E,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAEtF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC,uBAAuB,CAAC;KAC/B,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,OAAO;YAAE,SAAS;QAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC"}