@shipfox/expression 1.2.1 → 2.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (53) hide show
  1. package/README.md +25 -12
  2. package/dist/evaluator/errors.d.ts.map +1 -1
  3. package/dist/evaluator/index.d.ts +1 -0
  4. package/dist/evaluator/index.d.ts.map +1 -1
  5. package/dist/evaluator/index.js +1 -0
  6. package/dist/evaluator/index.js.map +1 -1
  7. package/dist/evaluator/rehydrate-json-expression.d.ts +4 -0
  8. package/dist/evaluator/rehydrate-json-expression.d.ts.map +1 -0
  9. package/dist/evaluator/rehydrate-json-expression.js +44 -0
  10. package/dist/evaluator/rehydrate-json-expression.js.map +1 -0
  11. package/dist/expression/create-workflow-expression.d.ts.map +1 -1
  12. package/dist/expression/create-workflow-expression.js +23 -1
  13. package/dist/expression/create-workflow-expression.js.map +1 -1
  14. package/dist/expression/errors.d.ts.map +1 -1
  15. package/dist/index.d.ts +5 -3
  16. package/dist/index.d.ts.map +1 -1
  17. package/dist/index.js +4 -2
  18. package/dist/index.js.map +1 -1
  19. package/dist/plan/context-key-access.d.ts +2 -0
  20. package/dist/plan/context-key-access.d.ts.map +1 -1
  21. package/dist/plan/context-key-access.js +10 -4
  22. package/dist/plan/context-key-access.js.map +1 -1
  23. package/dist/plan/evaluate-planned-predicate.d.ts.map +1 -1
  24. package/dist/plan/evaluate-planned-predicate.js +2 -2
  25. package/dist/plan/evaluate-planned-predicate.js.map +1 -1
  26. package/dist/resolver/errors.d.ts.map +1 -1
  27. package/dist/run/hoist-run-command.d.ts +8 -0
  28. package/dist/run/hoist-run-command.d.ts.map +1 -1
  29. package/dist/run/hoist-run-command.js +28 -3
  30. package/dist/run/hoist-run-command.js.map +1 -1
  31. package/dist/run/shell-code-position.d.ts +21 -0
  32. package/dist/run/shell-code-position.d.ts.map +1 -0
  33. package/dist/run/shell-code-position.js +623 -0
  34. package/dist/run/shell-code-position.js.map +1 -0
  35. package/dist/run/shell-quoting.d.ts +5 -1
  36. package/dist/run/shell-quoting.d.ts.map +1 -1
  37. package/dist/run/shell-quoting.js +37 -6
  38. package/dist/run/shell-quoting.js.map +1 -1
  39. package/dist/template/errors.d.ts.map +1 -1
  40. package/dist/tsconfig.test.tsbuildinfo +1 -1
  41. package/dist/workflow-context/workflow-context-docs.d.ts +185 -0
  42. package/dist/workflow-context/workflow-context-docs.d.ts.map +1 -0
  43. package/dist/workflow-context/workflow-context-docs.js +168 -0
  44. package/dist/workflow-context/workflow-context-docs.js.map +1 -0
  45. package/dist/workflow-context/workflow-context.d.ts +234 -249
  46. package/dist/workflow-context/workflow-context.d.ts.map +1 -1
  47. package/dist/workflow-context/workflow-context.js +201 -85
  48. package/dist/workflow-context/workflow-context.js.map +1 -1
  49. package/package.json +2 -2
  50. package/dist/template/extract-cel-untrusted-path-accesses.d.ts +0 -5
  51. package/dist/template/extract-cel-untrusted-path-accesses.d.ts.map +0 -1
  52. package/dist/template/extract-cel-untrusted-path-accesses.js +0 -140
  53. package/dist/template/extract-cel-untrusted-path-accesses.js.map +0 -1
@@ -1,14 +1,15 @@
1
+ import type { WorkflowExpressionEvaluationContext } from '../evaluator/evaluate-workflow-expression.js';
1
2
  import type { ExpressionType, ExpressionTypeEnvironment } from '../expression/workflow-expression.js';
2
3
  import { type OutputDeclarations } from '../outputs/output-declarations.js';
3
- export declare const workflowContextNames: readonly ["run", "trigger", "event", "inputs", "job", "executions", "execution", "jobs", "needs", "steps", "step", "vars", "secrets"];
4
+ export declare const workflowContextNames: readonly ['workflow', 'run', 'trigger', 'event', 'inputs', 'job', 'executions', 'execution', 'jobs', 'needs', 'steps', 'step', 'vars', 'secrets'];
4
5
  export type WorkflowContextName = (typeof workflowContextNames)[number];
5
- export declare const availabilitySites: readonly ["ingest", "run-creation", "execution-creation", "job-activation", "step-dispatch", "step-report", "execution-resolution", "job-resolution"];
6
+ export declare const availabilitySites: readonly ['ingest', 'run-creation', 'execution-creation', 'job-activation', 'step-dispatch', 'step-report', 'execution-resolution', 'job-resolution'];
6
7
  export type AvailabilitySite = (typeof availabilitySites)[number];
7
8
  export declare const runnerFillTarget = "runner-fill";
8
9
  export type FillTarget = AvailabilitySite | typeof runnerFillTarget;
9
- export declare const workflowContextSensitivities: readonly ["persistable", "ephemeral"];
10
+ export declare const workflowContextSensitivities: readonly ['persistable', 'ephemeral'];
10
11
  export type WorkflowContextSensitivity = (typeof workflowContextSensitivities)[number];
11
- export declare const workflowContextHosts: readonly ["server", "runner"];
12
+ export declare const workflowContextHosts: readonly ['server', 'runner'];
12
13
  export type WorkflowContextHost = (typeof workflowContextHosts)[number];
13
14
  export type ReservedRootDefinition = {
14
15
  readonly host: 'server';
@@ -18,30 +19,25 @@ export type ReservedRootDefinition = {
18
19
  };
19
20
  export declare const workflowContextReservedRoots: {
20
21
  readonly matrix: {
21
- readonly host: "server";
22
- readonly availability: "job-activation";
22
+ readonly host: 'server';
23
+ readonly availability: 'job-activation';
23
24
  };
24
25
  readonly runner: {
25
- readonly host: "runner";
26
+ readonly host: 'runner';
26
27
  };
27
28
  };
28
29
  export type WorkflowContextReservedRoot = keyof typeof workflowContextReservedRoots;
29
- export declare const workflowContextTrustTiers: readonly ["trusted", "untrusted"];
30
- export type WorkflowContextTrustTier = (typeof workflowContextTrustTiers)[number];
31
30
  export type WorkflowContextShape = 'known' | 'open';
32
31
  export interface TypedWorkflowContextDefinition {
33
32
  readonly availability: AvailabilitySite;
34
- readonly trustTier: WorkflowContextTrustTier;
35
33
  readonly sensitivity: WorkflowContextSensitivity;
36
34
  readonly host: 'server';
37
35
  readonly shape: 'known';
38
36
  readonly checkMode: 'typed';
39
37
  readonly typeEnvironment: ExpressionTypeEnvironment;
40
- readonly untrustedPaths?: readonly string[];
41
38
  }
42
39
  export interface OpenWorkflowContextDefinition {
43
40
  readonly availability: AvailabilitySite;
44
- readonly trustTier: WorkflowContextTrustTier;
45
41
  readonly sensitivity: WorkflowContextSensitivity;
46
42
  readonly host: 'server';
47
43
  readonly shape: 'open';
@@ -49,7 +45,6 @@ export interface OpenWorkflowContextDefinition {
49
45
  readonly literalKeyOnly?: boolean;
50
46
  }
51
47
  export interface RunnerWorkflowContextDefinition {
52
- readonly trustTier: WorkflowContextTrustTier;
53
48
  readonly sensitivity: 'ephemeral';
54
49
  readonly host: 'runner';
55
50
  readonly shape: 'open';
@@ -72,364 +67,342 @@ export declare function buildTypedRootsEnvironment(params: {
72
67
  readonly needs?: readonly WorkflowJobTypeOverlay[];
73
68
  }): ExpressionTypeEnvironment;
74
69
  export declare const workflowContextDefinitions: {
70
+ readonly workflow: {
71
+ readonly availability: 'run-creation';
72
+ readonly sensitivity: 'persistable';
73
+ readonly host: 'server';
74
+ readonly shape: 'known';
75
+ readonly checkMode: 'typed';
76
+ readonly typeEnvironment: {
77
+ readonly workflow: {
78
+ readonly kind: 'object';
79
+ readonly fields: {
80
+ readonly id: 'string';
81
+ readonly name: 'string';
82
+ };
83
+ };
84
+ };
85
+ };
75
86
  readonly run: {
76
- readonly availability: "run-creation";
77
- readonly trustTier: "trusted";
78
- readonly sensitivity: "persistable";
79
- readonly host: "server";
80
- readonly shape: "known";
81
- readonly checkMode: "typed";
87
+ readonly availability: 'run-creation';
88
+ readonly sensitivity: 'persistable';
89
+ readonly host: 'server';
90
+ readonly shape: 'known';
91
+ readonly checkMode: 'typed';
82
92
  readonly typeEnvironment: {
83
93
  readonly run: {
84
- readonly kind: "object";
94
+ readonly kind: 'object';
85
95
  readonly fields: {
86
- readonly id: "string";
87
- readonly name: "string";
88
- readonly definition_id: "string";
89
- readonly project_id: "string";
90
- readonly workspace_id: "string";
91
- readonly created_at: "timestamp";
96
+ readonly id: 'string';
97
+ readonly number: 'int';
98
+ readonly name: 'string';
99
+ readonly project_id: 'string';
100
+ readonly workspace_id: 'string';
101
+ readonly created_at: 'timestamp';
92
102
  };
93
103
  };
94
104
  };
95
105
  };
96
106
  readonly trigger: {
97
- readonly availability: "ingest";
98
- readonly trustTier: "trusted";
99
- readonly sensitivity: "persistable";
100
- readonly host: "server";
101
- readonly shape: "known";
102
- readonly checkMode: "typed";
107
+ readonly availability: 'ingest';
108
+ readonly sensitivity: 'persistable';
109
+ readonly host: 'server';
110
+ readonly shape: 'known';
111
+ readonly checkMode: 'typed';
103
112
  readonly typeEnvironment: {
104
113
  readonly trigger: {
105
- readonly kind: "object";
114
+ readonly kind: 'object';
106
115
  readonly fields: {
107
- readonly source: "string";
108
- readonly event: "string";
116
+ readonly project: {
117
+ readonly kind: 'object';
118
+ readonly fields: {
119
+ readonly id: 'string';
120
+ };
121
+ };
122
+ readonly repository: 'string';
123
+ readonly ref: 'string';
124
+ readonly commit: 'string';
125
+ readonly source: 'string';
126
+ readonly event: 'string';
109
127
  };
110
128
  };
111
129
  };
112
130
  };
113
131
  readonly event: {
114
- readonly availability: "ingest";
115
- readonly trustTier: "untrusted";
116
- readonly sensitivity: "persistable";
117
- readonly host: "server";
118
- readonly shape: "open";
119
- readonly checkMode: "syntax";
132
+ readonly availability: 'ingest';
133
+ readonly sensitivity: 'persistable';
134
+ readonly host: 'server';
135
+ readonly shape: 'open';
136
+ readonly checkMode: 'syntax';
120
137
  };
121
138
  readonly inputs: {
122
- readonly availability: "run-creation";
123
- readonly trustTier: "untrusted";
124
- readonly sensitivity: "persistable";
125
- readonly host: "server";
126
- readonly shape: "open";
127
- readonly checkMode: "syntax";
139
+ readonly availability: 'run-creation';
140
+ readonly sensitivity: 'persistable';
141
+ readonly host: 'server';
142
+ readonly shape: 'open';
143
+ readonly checkMode: 'syntax';
128
144
  };
129
145
  readonly job: {
130
- readonly availability: "run-creation";
131
- readonly trustTier: "trusted";
132
- readonly sensitivity: "persistable";
133
- readonly host: "server";
134
- readonly shape: "known";
135
- readonly checkMode: "typed";
146
+ readonly availability: 'run-creation';
147
+ readonly sensitivity: 'persistable';
148
+ readonly host: 'server';
149
+ readonly shape: 'known';
150
+ readonly checkMode: 'typed';
136
151
  readonly typeEnvironment: {
137
152
  readonly job: {
138
- readonly kind: "object";
153
+ readonly kind: 'object';
139
154
  readonly fields: {
140
- readonly key: "string";
155
+ readonly key: 'string';
156
+ readonly name: 'string';
141
157
  };
142
158
  };
143
159
  };
144
160
  };
145
161
  readonly executions: {
146
- readonly availability: "execution-creation";
147
- readonly trustTier: "trusted";
148
- readonly sensitivity: "persistable";
149
- readonly host: "server";
150
- readonly shape: "known";
151
- readonly checkMode: "typed";
162
+ readonly availability: 'execution-creation';
163
+ readonly sensitivity: 'persistable';
164
+ readonly host: 'server';
165
+ readonly shape: 'known';
166
+ readonly checkMode: 'typed';
152
167
  readonly typeEnvironment: {
153
168
  readonly executions: {
154
- readonly kind: "list";
169
+ readonly kind: 'list';
155
170
  readonly element: {
156
- readonly kind: "object";
171
+ readonly kind: 'object';
157
172
  readonly fields: {
158
- readonly index: "int";
159
- readonly name: "string";
160
- readonly status: "string";
161
- readonly failed: "bool";
162
- readonly started_at: "timestamp";
163
- readonly finished_at: "timestamp";
173
+ readonly index: 'int';
174
+ readonly name: 'string';
175
+ readonly status: 'string';
176
+ readonly started_at: 'timestamp';
177
+ readonly finished_at: 'timestamp';
164
178
  readonly events: {
165
- readonly kind: "list";
179
+ readonly kind: 'list';
166
180
  readonly element: {
167
- readonly kind: "object";
181
+ readonly kind: 'object';
168
182
  readonly fields: {
169
- readonly source: "string";
170
- readonly event: "string";
171
- readonly delivery_id: "string";
172
- readonly received_at: "timestamp";
183
+ readonly project: {
184
+ readonly kind: 'object';
185
+ readonly fields: {
186
+ readonly id: 'string';
187
+ };
188
+ };
189
+ readonly repository: 'string';
190
+ readonly ref: 'string';
191
+ readonly commit: 'string';
192
+ readonly source: 'string';
193
+ readonly event: 'string';
194
+ readonly delivery_id: 'string';
195
+ readonly received_at: 'timestamp';
173
196
  readonly data: {
174
- readonly kind: "object";
197
+ readonly kind: 'object';
175
198
  readonly fields: {};
176
199
  };
177
200
  };
178
201
  };
179
202
  };
180
203
  readonly outputs: {
181
- readonly kind: "map";
204
+ readonly kind: 'map';
182
205
  };
183
206
  };
184
207
  };
185
208
  };
186
209
  };
187
- readonly untrustedPaths: readonly ["events"];
188
210
  };
189
211
  readonly execution: {
190
- readonly availability: "execution-creation";
191
- readonly trustTier: "trusted";
192
- readonly sensitivity: "persistable";
193
- readonly host: "server";
194
- readonly shape: "known";
195
- readonly checkMode: "typed";
212
+ readonly availability: 'execution-creation';
213
+ readonly sensitivity: 'persistable';
214
+ readonly host: 'server';
215
+ readonly shape: 'known';
216
+ readonly checkMode: 'typed';
196
217
  readonly typeEnvironment: {
197
218
  readonly execution: {
198
- readonly kind: "object";
219
+ readonly kind: 'object';
199
220
  readonly fields: {
200
- readonly index: "int";
201
- readonly name: "string";
202
- readonly status: "string";
203
- readonly failed: "bool";
204
- readonly started_at: "timestamp";
205
- readonly finished_at: "timestamp";
221
+ readonly index: 'int';
222
+ readonly name: 'string';
223
+ readonly status: 'string';
224
+ readonly started_at: 'timestamp';
225
+ readonly finished_at: 'timestamp';
206
226
  readonly events: {
207
- readonly kind: "list";
227
+ readonly kind: 'list';
208
228
  readonly element: {
209
- readonly kind: "object";
229
+ readonly kind: 'object';
210
230
  readonly fields: {
211
- readonly source: "string";
212
- readonly event: "string";
213
- readonly delivery_id: "string";
214
- readonly received_at: "timestamp";
231
+ readonly project: {
232
+ readonly kind: 'object';
233
+ readonly fields: {
234
+ readonly id: 'string';
235
+ };
236
+ };
237
+ readonly repository: 'string';
238
+ readonly ref: 'string';
239
+ readonly commit: 'string';
240
+ readonly source: 'string';
241
+ readonly event: 'string';
242
+ readonly delivery_id: 'string';
243
+ readonly received_at: 'timestamp';
215
244
  readonly data: {
216
- readonly kind: "object";
245
+ readonly kind: 'object';
217
246
  readonly fields: {};
218
247
  };
219
248
  };
220
249
  };
221
250
  };
222
251
  readonly outputs: {
223
- readonly kind: "map";
252
+ readonly kind: 'map';
224
253
  };
254
+ readonly failed: 'bool';
225
255
  };
226
256
  };
227
257
  };
228
- readonly untrustedPaths: readonly ["events"];
229
258
  };
230
259
  readonly jobs: {
231
- readonly availability: "job-activation";
232
- readonly trustTier: "untrusted";
233
- readonly sensitivity: "persistable";
234
- readonly host: "server";
235
- readonly shape: "open";
236
- readonly checkMode: "syntax";
260
+ readonly availability: 'job-activation';
261
+ readonly sensitivity: 'persistable';
262
+ readonly host: 'server';
263
+ readonly shape: 'open';
264
+ readonly checkMode: 'syntax';
237
265
  };
238
266
  readonly needs: {
239
- readonly availability: "job-activation";
240
- readonly trustTier: "untrusted";
241
- readonly sensitivity: "persistable";
242
- readonly host: "server";
243
- readonly shape: "known";
244
- readonly checkMode: "typed";
267
+ readonly availability: 'job-activation';
268
+ readonly sensitivity: 'persistable';
269
+ readonly host: 'server';
270
+ readonly shape: 'known';
271
+ readonly checkMode: 'typed';
245
272
  readonly typeEnvironment: {
246
273
  readonly needs: {
247
- readonly kind: "list";
274
+ readonly kind: 'list';
248
275
  readonly element: ExpressionType;
249
276
  };
250
277
  };
251
278
  };
252
279
  readonly steps: {
253
- readonly availability: "step-dispatch";
254
- readonly trustTier: "trusted";
255
- readonly sensitivity: "persistable";
256
- readonly host: "server";
257
- readonly shape: "open";
258
- readonly checkMode: "syntax";
280
+ readonly availability: 'step-dispatch';
281
+ readonly sensitivity: 'persistable';
282
+ readonly host: 'server';
283
+ readonly shape: 'open';
284
+ readonly checkMode: 'syntax';
259
285
  };
260
286
  readonly step: {
261
- readonly availability: "step-dispatch";
262
- readonly trustTier: "trusted";
263
- readonly sensitivity: "persistable";
264
- readonly host: "server";
265
- readonly shape: "known";
266
- readonly checkMode: "typed";
287
+ readonly availability: 'step-dispatch';
288
+ readonly sensitivity: 'persistable';
289
+ readonly host: 'server';
290
+ readonly shape: 'known';
291
+ readonly checkMode: 'typed';
267
292
  readonly typeEnvironment: {
268
293
  readonly step: {
269
- readonly kind: "object";
294
+ readonly kind: 'object';
270
295
  readonly fields: {
271
- readonly attempt: "int";
272
- readonly is_retry: "bool";
296
+ readonly attempt: 'int';
297
+ readonly is_retry: 'bool';
273
298
  readonly restart: {
274
- readonly kind: "object";
299
+ readonly kind: 'object';
275
300
  readonly fields: {
276
301
  readonly from: {
277
- readonly kind: "object";
302
+ readonly kind: 'object';
278
303
  readonly fields: {
304
+ readonly status: 'string';
305
+ readonly exit_code: 'int';
306
+ readonly outputs: {
307
+ readonly kind: 'map';
308
+ };
309
+ readonly response: 'string';
310
+ readonly gate: {
311
+ readonly kind: 'object';
312
+ readonly fields: {
313
+ readonly passed: 'bool';
314
+ readonly source: 'string';
315
+ readonly reason: 'string';
316
+ readonly exit_code: 'int';
317
+ };
318
+ };
279
319
  readonly attempts: {
280
- readonly kind: "list";
320
+ readonly kind: 'list';
281
321
  readonly element: {
282
- readonly kind: "object";
322
+ readonly kind: 'object';
283
323
  readonly fields: {
284
- readonly status: "string";
285
- readonly exit_code: "int";
324
+ readonly status: 'string';
325
+ readonly exit_code: 'int';
286
326
  readonly outputs: {
287
- readonly kind: "map";
327
+ readonly kind: 'map';
288
328
  };
289
- readonly response: "string";
329
+ readonly response: 'string';
290
330
  readonly gate: {
291
- readonly kind: "object";
331
+ readonly kind: 'object';
292
332
  readonly fields: {
293
- readonly passed: "bool";
294
- readonly source: "string";
295
- readonly reason: "string";
296
- readonly exit_code: "int";
333
+ readonly passed: 'bool';
334
+ readonly source: 'string';
335
+ readonly reason: 'string';
336
+ readonly exit_code: 'int';
297
337
  };
298
338
  };
299
339
  };
300
340
  };
301
341
  };
302
- readonly status: "string";
303
- readonly exit_code: "int";
304
- readonly outputs: {
305
- readonly kind: "map";
306
- };
307
- readonly response: "string";
308
- readonly gate: {
309
- readonly kind: "object";
310
- readonly fields: {
311
- readonly passed: "bool";
312
- readonly source: "string";
313
- readonly reason: "string";
314
- readonly exit_code: "int";
315
- };
316
- };
317
342
  };
318
343
  };
319
- readonly feedback: "string";
344
+ readonly feedback: 'string';
320
345
  };
321
346
  };
322
- readonly exit_code: "int";
323
- readonly status: "string";
347
+ readonly exit_code: 'int';
348
+ readonly status: 'string';
324
349
  readonly outputs: {
325
- readonly kind: "map";
350
+ readonly kind: 'map';
326
351
  };
327
352
  };
328
353
  };
329
354
  };
330
- readonly untrustedPaths: readonly ["outputs"];
331
355
  };
332
356
  readonly vars: {
333
- readonly availability: "run-creation";
334
- readonly trustTier: "trusted";
335
- readonly sensitivity: "persistable";
336
- readonly host: "server";
337
- readonly shape: "open";
338
- readonly checkMode: "syntax";
357
+ readonly availability: 'run-creation';
358
+ readonly sensitivity: 'persistable';
359
+ readonly host: 'server';
360
+ readonly shape: 'open';
361
+ readonly checkMode: 'syntax';
339
362
  readonly literalKeyOnly: true;
340
363
  };
341
364
  readonly secrets: {
342
- readonly trustTier: "trusted";
343
- readonly sensitivity: "ephemeral";
344
- readonly host: "runner";
345
- readonly shape: "open";
346
- readonly checkMode: "syntax";
365
+ readonly sensitivity: 'ephemeral';
366
+ readonly host: 'runner';
367
+ readonly shape: 'open';
368
+ readonly checkMode: 'syntax';
347
369
  readonly literalKeyOnly: true;
348
370
  };
349
371
  };
350
- export type WorkflowInterpolationField = 'run' | 'env.value' | 'agent.prompt' | 'agent.model' | 'agent.provider' | 'agent.thinking' | 'job.runner' | 'job.outputs' | 'job.name' | 'step.name' | 'step.feedback';
351
- export declare const workflowFieldFailurePolicies: readonly ["fail", "degrade", "fail-closed"];
372
+ export type WorkflowInterpolationField = 'run' | 'env.value' | 'agent.prompt' | 'agent.model' | 'agent.provider' | 'agent.thinking' | 'job.runner' | 'job.outputs' | 'workflow.run_name' | 'job.execution_name' | 'step.name' | 'step.working_directory' | 'step.feedback' | 'checkout.project' | 'checkout.connection' | 'checkout.repository' | 'checkout.ref' | 'checkout.path';
373
+ export declare const workflowFieldFailurePolicies: readonly ['fail', 'degrade', 'fail-closed'];
352
374
  export type WorkflowFieldFailurePolicy = (typeof workflowFieldFailurePolicies)[number];
353
375
  export type WorkflowInterpolationFailurePolicy = Exclude<WorkflowFieldFailurePolicy, 'fail-closed'>;
354
376
  export interface WorkflowInterpolationFieldPolicy {
355
- readonly acceptedTrustTiers: readonly WorkflowContextTrustTier[];
356
377
  readonly acceptedHosts: readonly WorkflowContextHost[];
357
378
  readonly failurePolicy: WorkflowInterpolationFailurePolicy;
358
- readonly renderSanitize: boolean;
359
379
  readonly minimumFillTarget?: AvailabilitySite;
360
- }
361
- export declare const workflowInterpolationFieldPolicies: {
362
- readonly run: {
363
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
364
- readonly acceptedHosts: readonly ("server" | "runner")[];
365
- readonly failurePolicy: "fail";
366
- readonly renderSanitize: false;
367
- };
368
- readonly 'env.value': {
369
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
370
- readonly acceptedHosts: readonly ("server" | "runner")[];
371
- readonly failurePolicy: "fail";
372
- readonly renderSanitize: false;
373
- };
374
- readonly 'agent.prompt': {
375
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
376
- readonly acceptedHosts: readonly ("server" | "runner")[];
377
- readonly failurePolicy: "fail";
378
- readonly renderSanitize: false;
379
- };
380
- readonly 'agent.model': {
381
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
382
- readonly acceptedHosts: readonly ("server" | "runner")[];
383
- readonly failurePolicy: "fail";
384
- readonly renderSanitize: false;
380
+ readonly selfReference?: {
381
+ readonly root: WorkflowContextName;
382
+ readonly key: string;
385
383
  };
386
- readonly 'agent.provider': {
387
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
388
- readonly acceptedHosts: readonly ("server" | "runner")[];
389
- readonly failurePolicy: "fail";
390
- readonly renderSanitize: false;
391
- };
392
- readonly 'agent.thinking': {
393
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
394
- readonly acceptedHosts: readonly ("server" | "runner")[];
395
- readonly failurePolicy: "fail";
396
- readonly renderSanitize: false;
397
- };
398
- readonly 'job.runner': {
399
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
400
- readonly acceptedHosts: readonly ("server" | "runner")[];
401
- readonly failurePolicy: "fail";
402
- readonly renderSanitize: false;
403
- };
404
- readonly 'job.outputs': {
405
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
406
- readonly acceptedHosts: readonly ("server" | "runner")[];
407
- readonly failurePolicy: "fail";
408
- readonly renderSanitize: false;
409
- readonly minimumFillTarget: "execution-resolution";
410
- };
411
- readonly 'job.name': {
412
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
413
- readonly acceptedHosts: readonly ("server" | "runner")[];
414
- readonly failurePolicy: "degrade";
415
- readonly renderSanitize: true;
416
- };
417
- readonly 'step.name': {
418
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
419
- readonly acceptedHosts: readonly ("server" | "runner")[];
420
- readonly failurePolicy: "degrade";
421
- readonly renderSanitize: true;
422
- };
423
- readonly 'step.feedback': {
424
- readonly acceptedTrustTiers: readonly ("trusted" | "untrusted")[];
425
- readonly acceptedHosts: readonly ("server" | "runner")[];
426
- readonly failurePolicy: "fail";
427
- readonly renderSanitize: false;
428
- };
429
- };
384
+ }
385
+ export declare const workflowInterpolationFieldPolicies: Readonly<Record<WorkflowInterpolationField, WorkflowInterpolationFieldPolicy>>;
430
386
  export declare const workflowInterpolationFields: readonly WorkflowInterpolationField[];
431
- export declare const workflowPredicateFields: readonly ["step.success", "job.success", "trigger.filter", "listener.on", "listener.until", "job.if", "step.if"];
387
+ export declare const workflowPredicateFields: readonly ['step.success', 'job.success', 'trigger.filter', 'listener.on', 'listener.until', 'job.if', 'step.if'];
432
388
  export type WorkflowPredicateField = (typeof workflowPredicateFields)[number];
389
+ /**
390
+ * The roots that the runtime passes to each server-evaluated predicate.
391
+ *
392
+ * This is intentionally narrower than lifecycle availability. A root can
393
+ * exist by the time a predicate runs and still not belong to that predicate's
394
+ * evaluation context.
395
+ */
396
+ export declare const workflowPredicateContextRoots: {
397
+ readonly 'step.success': readonly ["step", "vars"];
398
+ readonly 'job.success': readonly ["executions", "jobs", "vars"];
399
+ readonly 'trigger.filter': readonly ["event", "trigger"];
400
+ readonly 'listener.on': readonly ["event", "workflow", "run", "trigger", "inputs", "vars", "job", "jobs"];
401
+ readonly 'listener.until': readonly ["event", "workflow", "run", "trigger", "inputs", "vars", "job", "jobs"];
402
+ readonly 'job.if': readonly ["workflow", "run", "trigger", "event", "inputs", "vars", "jobs", "needs"];
403
+ readonly 'step.if': readonly ["vars", "jobs", "execution", "step", "steps"];
404
+ };
405
+ export type WorkflowPredicateContextRoot<Field extends WorkflowPredicateField = WorkflowPredicateField> = (typeof workflowPredicateContextRoots)[Field][number];
433
406
  export declare const workflowPredicateFieldFailurePolicy: "fail-closed";
434
407
  export declare function getWorkflowContextDefinition(name: WorkflowContextName): WorkflowContextDefinition;
435
408
  export declare function getWorkflowContextAvailability(name: WorkflowContextName): AvailabilitySite | undefined;
@@ -440,14 +413,26 @@ export declare function getWorkflowContextSensitivity(name: WorkflowContextName)
440
413
  export declare function rootsAvailableAt(site: AvailabilitySite): readonly WorkflowContextName[];
441
414
  export declare function unavailableRootsAt(roots: readonly WorkflowContextName[], site: AvailabilitySite): readonly WorkflowContextName[];
442
415
  export declare function getWorkflowContextTypeEnvironment(name: WorkflowContextName): ExpressionTypeEnvironment | undefined;
443
- export declare function getWorkflowContextUntrustedPaths(name: WorkflowContextName): readonly string[] | undefined;
444
- export declare function workflowInterpolationFieldAcceptsTrustTier(field: WorkflowInterpolationField, trustTier: WorkflowContextTrustTier): boolean;
445
416
  export declare function workflowInterpolationFieldAcceptsHost(field: WorkflowInterpolationField, host: WorkflowContextHost): boolean;
446
- export declare function workflowInterpolationFieldAcceptsContext(field: WorkflowInterpolationField, context: WorkflowContextName): boolean;
447
417
  export declare function workflowContextRootRequiresLiteralKey(root: string): boolean;
448
418
  export declare function getWorkflowInterpolationFieldFailurePolicy(field: WorkflowInterpolationField): WorkflowInterpolationFailurePolicy;
419
+ export declare function getWorkflowInterpolationFieldSelfReference(field: WorkflowInterpolationField): WorkflowInterpolationFieldPolicy['selfReference'];
449
420
  export declare function getWorkflowInterpolationFieldMinimumFillTarget(field: WorkflowInterpolationField): AvailabilitySite | undefined;
450
421
  export declare function getWorkflowPredicateFieldMinimumFillTarget(field: WorkflowPredicateField): AvailabilitySite;
422
+ export declare function getWorkflowPredicateFieldTypeEnvironment(field: WorkflowPredicateField, root: WorkflowContextName): ExpressionTypeEnvironment | undefined;
423
+ export declare function getWorkflowPredicateContextRoots<Field extends WorkflowPredicateField>(field: Field): readonly WorkflowPredicateContextRoot<Field>[];
424
+ /**
425
+ * The roots a field can read, whichever kind of field it is.
426
+ *
427
+ * A predicate has an enumerated contract because the runtime assembles one
428
+ * context for it. A template has no single context: each reference is filled
429
+ * where its data arrives, so its only field-level constraint is which host can
430
+ * resolve it. Callers that document or check fields should use this instead of
431
+ * choosing a mechanism themselves.
432
+ */
433
+ export declare function contextRootsForField(field: WorkflowPredicateField | WorkflowInterpolationField): readonly WorkflowContextName[];
434
+ export declare function isWorkflowPredicateField(field: string): field is WorkflowPredicateField;
435
+ export declare function projectWorkflowPredicateContext(field: WorkflowPredicateField, context: WorkflowExpressionEvaluationContext): WorkflowExpressionEvaluationContext;
451
436
  export interface WorkflowContextAvailabilityReferenceEntry {
452
437
  readonly root: WorkflowContextName | WorkflowContextReservedRoot;
453
438
  readonly availability?: AvailabilitySite;