@shipfox/expression 1.2.1 → 2.0.0

package/dist/workflow-context/workflow-context.js

@@ -1,5 +1,6 @@
 import { outputDeclarationsToExpressionFields } from '../outputs/output-declarations.js';
 export const workflowContextNames = [
+    'workflow',
     'run',
     'trigger',
     'event',
@@ -50,29 +51,48 @@ export const workflowContextReservedRoots = {
         host: 'runner'
     }
 };
-export const workflowContextTrustTiers = [
-    'trusted',
-    'untrusted'
-];
+// `workflow` holds definition facts and `run` holds instance facts, mirroring
+// the `job` and `execution` pair one level down.
+const workflowTypeEnvironment = {
+    workflow: {
+        kind: 'object',
+        fields: {
+            id: 'string',
+            name: 'string'
+        }
+    }
+};
 const runTypeEnvironment = {
     run: {
         kind: 'object',
         fields: {
             id: 'string',
+            number: 'int',
             name: 'string',
-            definition_id: 'string',
             project_id: 'string',
             workspace_id: 'string',
             created_at: 'timestamp'
         }
     }
 };
+const triggerReferenceFields = {
+    project: {
+        kind: 'object',
+        fields: {
+            id: 'string'
+        }
+    },
+    repository: 'string',
+    ref: 'string',
+    commit: 'string'
+};
 const triggerTypeEnvironment = {
     trigger: {
         kind: 'object',
         fields: {
             source: 'string',
-            event: 'string'
+            event: 'string',
+            ...triggerReferenceFields
         }
     }
 };
@@ -80,7 +100,8 @@ const jobTypeEnvironment = {
     job: {
         kind: 'object',
         fields: {
-            key: 'string'
+            key: 'string',
+            name: 'string'
         }
     }
 };
@@ -91,6 +112,7 @@ const executionEventType = {
         event: 'string',
         delivery_id: 'string',
         received_at: 'timestamp',
+        ...triggerReferenceFields,
         data: {
             kind: 'object',
             fields: {}
@@ -103,7 +125,6 @@ const executionType = {
         index: 'int',
         name: 'string',
         status: 'string',
-        failed: 'bool',
         started_at: 'timestamp',
         finished_at: 'timestamp',
         events: {
@@ -122,7 +143,13 @@ const executionsTypeEnvironment = {
     }
 };
 const executionTypeEnvironment = {
-    execution: executionType
+    execution: {
+        kind: 'object',
+        fields: {
+            ...executionType.fields,
+            failed: 'bool'
+        }
+    }
 };
 const stepGateType = {
     kind: 'object',
@@ -155,7 +182,7 @@ const stepEntityType = {
         }
     }
 };
-const stepTypeEnvironment = {
+const stepDispatchTypeEnvironment = {
     step: {
         kind: 'object',
         fields: {
@@ -167,7 +194,14 @@ const stepTypeEnvironment = {
                     from: stepEntityType,
                     feedback: 'string'
                 }
-            },
+            }
+        }
+    }
+};
+const stepReportTypeEnvironment = {
+    step: {
+        kind: 'object',
+        fields: {
             exit_code: 'int',
             status: 'string',
             outputs: {
@@ -176,6 +210,15 @@ const stepTypeEnvironment = {
         }
     }
 };
+const stepTypeEnvironment = {
+    step: {
+        kind: 'object',
+        fields: {
+            ...stepDispatchTypeEnvironment.step.fields,
+            ...stepReportTypeEnvironment.step.fields
+        }
+    }
+};
 export function buildTypedRootsEnvironment(params) {
     return {
         ...params.steps === undefined ? {} : {
@@ -193,9 +236,16 @@ export function buildTypedRootsEnvironment(params) {
     };
 }
 export const workflowContextDefinitions = {
+    workflow: {
+        availability: 'run-creation',
+        sensitivity: 'persistable',
+        host: 'server',
+        shape: 'known',
+        checkMode: 'typed',
+        typeEnvironment: workflowTypeEnvironment
+    },
     run: {
         availability: 'run-creation',
-        trustTier: 'trusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'known',
@@ -204,7 +254,6 @@ export const workflowContextDefinitions = {
     },
     trigger: {
         availability: 'ingest',
-        trustTier: 'trusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'known',
@@ -213,7 +262,6 @@ export const workflowContextDefinitions = {
     },
     event: {
         availability: 'ingest',
-        trustTier: 'untrusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'open',
@@ -221,7 +269,6 @@ export const workflowContextDefinitions = {
     },
     inputs: {
         availability: 'run-creation',
-        trustTier: 'untrusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'open',
@@ -229,7 +276,6 @@ export const workflowContextDefinitions = {
     },
     job: {
         availability: 'run-creation',
-        trustTier: 'trusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'known',
@@ -238,31 +284,22 @@ export const workflowContextDefinitions = {
     },
     executions: {
         availability: 'execution-creation',
-        trustTier: 'trusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'known',
         checkMode: 'typed',
-        typeEnvironment: executionsTypeEnvironment,
-        untrustedPaths: [
-            'events'
-        ]
+        typeEnvironment: executionsTypeEnvironment
     },
     execution: {
         availability: 'execution-creation',
-        trustTier: 'trusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'known',
         checkMode: 'typed',
-        typeEnvironment: executionTypeEnvironment,
-        untrustedPaths: [
-            'events'
-        ]
+        typeEnvironment: executionTypeEnvironment
     },
     jobs: {
         availability: 'job-activation',
-        trustTier: 'untrusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'open',
@@ -270,7 +307,6 @@ export const workflowContextDefinitions = {
     },
     needs: {
         availability: 'job-activation',
-        trustTier: 'untrusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'known',
@@ -286,7 +322,6 @@ export const workflowContextDefinitions = {
     },
     steps: {
         availability: 'step-dispatch',
-        trustTier: 'trusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'open',
@@ -294,19 +329,14 @@ export const workflowContextDefinitions = {
     },
     step: {
         availability: 'step-dispatch',
-        trustTier: 'trusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'known',
         checkMode: 'typed',
-        typeEnvironment: stepTypeEnvironment,
-        untrustedPaths: [
-            'outputs'
-        ]
+        typeEnvironment: stepTypeEnvironment
     },
     vars: {
         availability: 'run-creation',
-        trustTier: 'trusted',
         sensitivity: 'persistable',
         host: 'server',
         shape: 'open',
@@ -314,7 +344,6 @@ export const workflowContextDefinitions = {
         literalKeyOnly: true
     },
     secrets: {
-        trustTier: 'trusted',
         sensitivity: 'ephemeral',
         host: 'runner',
         shape: 'open',
@@ -327,13 +356,6 @@ export const workflowFieldFailurePolicies = [
     'degrade',
     'fail-closed'
 ];
-const trustedOnlyTrustTiers = [
-    'trusted'
-];
-const anyTrustTier = [
-    'trusted',
-    'untrusted'
-];
 const serverOnlyHosts = [
     'server'
 ];
@@ -343,71 +365,87 @@ const anyHost = [
 ];
 export const workflowInterpolationFieldPolicies = {
     run: {
-        acceptedTrustTiers: trustedOnlyTrustTiers,
         acceptedHosts: anyHost,
-        failurePolicy: 'fail',
-        renderSanitize: false
+        failurePolicy: 'fail'
     },
     'env.value': {
-        acceptedTrustTiers: anyTrustTier,
         acceptedHosts: anyHost,
-        failurePolicy: 'fail',
-        renderSanitize: false
+        failurePolicy: 'fail'
     },
     'agent.prompt': {
-        acceptedTrustTiers: anyTrustTier,
         acceptedHosts: serverOnlyHosts,
-        failurePolicy: 'fail',
-        renderSanitize: false
+        failurePolicy: 'fail'
     },
     'agent.model': {
-        acceptedTrustTiers: trustedOnlyTrustTiers,
         acceptedHosts: serverOnlyHosts,
-        failurePolicy: 'fail',
-        renderSanitize: false
+        failurePolicy: 'fail'
     },
     'agent.provider': {
-        acceptedTrustTiers: trustedOnlyTrustTiers,
         acceptedHosts: serverOnlyHosts,
-        failurePolicy: 'fail',
-        renderSanitize: false
+        failurePolicy: 'fail'
     },
     'agent.thinking': {
-        acceptedTrustTiers: trustedOnlyTrustTiers,
         acceptedHosts: serverOnlyHosts,
-        failurePolicy: 'fail',
-        renderSanitize: false
+        failurePolicy: 'fail'
     },
     'job.runner': {
-        acceptedTrustTiers: anyTrustTier,
         acceptedHosts: serverOnlyHosts,
-        failurePolicy: 'fail',
-        renderSanitize: false
+        failurePolicy: 'fail'
     },
     'job.outputs': {
-        acceptedTrustTiers: anyTrustTier,
         acceptedHosts: serverOnlyHosts,
         failurePolicy: 'fail',
-        renderSanitize: false,
         minimumFillTarget: 'execution-resolution'
     },
-    'job.name': {
-        acceptedTrustTiers: anyTrustTier,
+    'workflow.run_name': {
         acceptedHosts: serverOnlyHosts,
         failurePolicy: 'degrade',
-        renderSanitize: true
+        minimumFillTarget: 'run-creation',
+        selfReference: {
+            root: 'run',
+            key: 'name'
+        }
     },
-    'step.name': {
-        acceptedTrustTiers: anyTrustTier,
+    'job.execution_name': {
         acceptedHosts: serverOnlyHosts,
         failurePolicy: 'degrade',
-        renderSanitize: true
+        minimumFillTarget: 'execution-creation',
+        selfReference: {
+            root: 'execution',
+            key: 'name'
+        }
+    },
+    'step.name': {
+        acceptedHosts: serverOnlyHosts,
+        failurePolicy: 'degrade'
+    },
+    'step.working_directory': {
+        acceptedHosts: serverOnlyHosts,
+        failurePolicy: 'fail'
     },
     'step.feedback': {
-        acceptedTrustTiers: anyTrustTier,
         acceptedHosts: serverOnlyHosts,
-        failurePolicy: 'fail',
-        renderSanitize: false
+        failurePolicy: 'fail'
+    },
+    'checkout.project': {
+        acceptedHosts: serverOnlyHosts,
+        failurePolicy: 'fail'
+    },
+    'checkout.connection': {
+        acceptedHosts: serverOnlyHosts,
+        failurePolicy: 'fail'
+    },
+    'checkout.repository': {
+        acceptedHosts: serverOnlyHosts,
+        failurePolicy: 'fail'
+    },
+    'checkout.ref': {
+        acceptedHosts: serverOnlyHosts,
+        failurePolicy: 'fail'
+    },
+    'checkout.path': {
+        acceptedHosts: serverOnlyHosts,
+        failurePolicy: 'fail'
     }
 };
 export const workflowInterpolationFields = Object.keys(workflowInterpolationFieldPolicies);
@@ -420,6 +458,56 @@ export const workflowPredicateFields = [
     'job.if',
     'step.if'
 ];
+const listenerPredicateContextRoots = [
+    'event',
+    'workflow',
+    'run',
+    'trigger',
+    'inputs',
+    'vars',
+    'job',
+    'jobs'
+];
+/**
+ * The roots that the runtime passes to each server-evaluated predicate.
+ *
+ * This is intentionally narrower than lifecycle availability. A root can
+ * exist by the time a predicate runs and still not belong to that predicate's
+ * evaluation context.
+ */ export const workflowPredicateContextRoots = {
+    'step.success': [
+        'step',
+        'vars'
+    ],
+    'job.success': [
+        'executions',
+        'jobs',
+        'vars'
+    ],
+    'trigger.filter': [
+        'event',
+        'trigger'
+    ],
+    'listener.on': listenerPredicateContextRoots,
+    'listener.until': listenerPredicateContextRoots,
+    'job.if': [
+        'workflow',
+        'run',
+        'trigger',
+        'event',
+        'inputs',
+        'vars',
+        'jobs',
+        'needs'
+    ],
+    'step.if': [
+        'vars',
+        'jobs',
+        'execution',
+        'step',
+        'steps'
+    ]
+};
 export const workflowPredicateFieldFailurePolicy = 'fail-closed';
 const workflowPredicateFieldMinimumFillTargets = {
     'step.success': 'step-report',
@@ -430,6 +518,10 @@ const workflowPredicateFieldMinimumFillTargets = {
     'job.if': 'job-activation',
     'step.if': 'step-dispatch'
 };
+const workflowPredicateFieldTypeEnvironments = {
+    'step.success': stepReportTypeEnvironment,
+    'step.if': stepDispatchTypeEnvironment
+};
 export function getWorkflowContextDefinition(name) {
     return workflowContextDefinitions[name];
 }
@@ -472,19 +564,9 @@ export function getWorkflowContextTypeEnvironment(name) {
     const context = getWorkflowContextDefinition(name);
     return context.shape === 'known' ? context.typeEnvironment : undefined;
 }
-export function getWorkflowContextUntrustedPaths(name) {
-    const context = getWorkflowContextDefinition(name);
-    return context.shape === 'known' ? context.untrustedPaths : undefined;
-}
-export function workflowInterpolationFieldAcceptsTrustTier(field, trustTier) {
-    return workflowInterpolationFieldPolicies[field].acceptedTrustTiers.includes(trustTier);
-}
 export function workflowInterpolationFieldAcceptsHost(field, host) {
     return workflowInterpolationFieldPolicies[field].acceptedHosts.includes(host);
 }
-export function workflowInterpolationFieldAcceptsContext(field, context) {
-    return workflowInterpolationFieldAcceptsTrustTier(field, workflowContextDefinitions[context].trustTier);
-}
 export function workflowContextRootRequiresLiteralKey(root) {
     if (!isWorkflowContextName(root)) return false;
     const definition = workflowContextDefinitions[root];
@@ -493,6 +575,9 @@ export function workflowContextRootRequiresLiteralKey(root) {
 export function getWorkflowInterpolationFieldFailurePolicy(field) {
     return workflowInterpolationFieldPolicies[field].failurePolicy;
 }
+export function getWorkflowInterpolationFieldSelfReference(field) {
+    return workflowInterpolationFieldPolicies[field].selfReference;
+}
 export function getWorkflowInterpolationFieldMinimumFillTarget(field) {
     const policy = workflowInterpolationFieldPolicies[field];
     return 'minimumFillTarget' in policy ? policy.minimumFillTarget : undefined;
@@ -500,6 +585,37 @@ export function getWorkflowInterpolationFieldMinimumFillTarget(field) {
 export function getWorkflowPredicateFieldMinimumFillTarget(field) {
     return workflowPredicateFieldMinimumFillTargets[field];
 }
+export function getWorkflowPredicateFieldTypeEnvironment(field, root) {
+    const typeEnvironment = workflowPredicateFieldTypeEnvironments[field];
+    if (typeEnvironment === undefined) return getWorkflowContextTypeEnvironment(root);
+    const rootType = typeEnvironment[root];
+    return rootType === undefined ? getWorkflowContextTypeEnvironment(root) : {
+        [root]: rootType
+    };
+}
+export function getWorkflowPredicateContextRoots(field) {
+    return workflowPredicateContextRoots[field];
+}
+/**
+ * The roots a field can read, whichever kind of field it is.
+ *
+ * A predicate has an enumerated contract because the runtime assembles one
+ * context for it. A template has no single context: each reference is filled
+ * where its data arrives, so its only field-level constraint is which host can
+ * resolve it. Callers that document or check fields should use this instead of
+ * choosing a mechanism themselves.
+ */ export function contextRootsForField(field) {
+    if (isWorkflowPredicateField(field)) return workflowPredicateContextRoots[field];
+    const { acceptedHosts } = workflowInterpolationFieldPolicies[field];
+    return workflowContextNames.filter((name)=>acceptedHosts.includes(workflowContextDefinitions[name].host));
+}
+export function isWorkflowPredicateField(field) {
+    return workflowPredicateFields.includes(field);
+}
+export function projectWorkflowPredicateContext(field, context) {
+    const roots = new Set(getWorkflowPredicateContextRoots(field));
+    return Object.fromEntries(Object.entries(context).filter(([root])=>roots.has(root)));
+}
 export function workflowContextAvailabilityReference() {
     return [
         ...workflowContextNames.map((root)=>{