@kici-dev/compiler 0.0.0 → 0.1.1

package/dist/lockfile/generator.js

@@ -0,0 +1,688 @@
+import "../chunk-gOLHoazu.js";
+import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "../types.js";
+import { computeContentHash } from "./hasher.js";
+import { resolveHashFiles } from "./hash-files.js";
+import { analyzePurity } from "./purity-analyzer.js";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { execSync } from "node:child_process";
+import { sha256 } from "@kici-dev/shared";
+import { getDynamicJobGroup, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject } from "@kici-dev/sdk";
+import { validateResourceRequest } from "@kici-dev/engine";
+//#region src/lockfile/generator.ts
+/**
+* Detect git repository root by running `git rev-parse --show-toplevel`.
+* Falls back to cwd if not in a git repo.
+*
+* @returns Absolute path to git root, or cwd if not in git repo
+*/
+function detectGitRoot() {
+	try {
+		return execSync("git rev-parse --show-toplevel", {
+			encoding: "utf-8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim();
+	} catch {
+		return process.cwd();
+	}
+}
+/**
+* Compute SHA-256 hash of the .kici/package-lock.json lockfile.
+* Used as part of the dependency cache key.
+*
+* @param gitRoot - Absolute path to git repository root
+* @returns Hex SHA-256 hash string, or null if no lockfile found in .kici/
+*/
+function computeLockfileHash(gitRoot) {
+	for (const candidate of ["package-lock.json"]) try {
+		return sha256(readFileSync(path.join(gitRoot, ".kici", candidate), "utf-8"));
+	} catch {
+		continue;
+	}
+	return null;
+}
+/**
+* Format export reference with hash syntax.
+* Examples:
+* - #build (named export)
+* - #default (single default export)
+* - #default[0] (first item in default array)
+*
+* @param source - Workflow source info
+* @returns Export reference string with hash prefix
+*/
+function formatExportRef(source) {
+	if (source.arrayIndex !== void 0) return `#${source.exportName}[${source.arrayIndex}]`;
+	return `#${source.exportName}`;
+}
+/**
+* Generate a lock file from validated workflows with source tracking.
+*
+* @param workflowsWithSource - Validated workflows with source info
+* @returns Lock file ready for JSON serialization
+*/
+function generateLockFile(workflowsWithSource) {
+	const gitRoot = detectGitRoot();
+	const lockfileHash = computeLockfileHash(gitRoot);
+	const firstSource = workflowsWithSource[0]?.source;
+	const topLevelSource = firstSource ? {
+		file: path.relative(gitRoot, firstSource.file).replaceAll("\\", "/"),
+		export: formatExportRef(firstSource)
+	} : {
+		file: ".kici/workflows",
+		export: "#default"
+	};
+	const workflows = workflowsWithSource.map(({ workflow, source, bundleSource }) => {
+		return transformWorkflow(workflow, path.relative(gitRoot, source.file).replaceAll("\\", "/"), formatExportRef(source), bundleSource, gitRoot);
+	});
+	return {
+		schemaVersion: SCHEMA_VERSION$1,
+		source: topLevelSource,
+		contentHash: sha256(JSON.stringify({
+			schemaVersion: SCHEMA_VERSION$1,
+			source: topLevelSource,
+			workflows
+		})),
+		...lockfileHash && { lockfileHash },
+		workflows
+	};
+}
+/**
+* Transform SDK Workflow to lock file format.
+*
+* @param workflow - The workflow definition
+* @param sourceFile - Relative path to source file (from git root)
+* @param exportRef - Export reference (e.g., #build, #default[0])
+* @param bundleSource - Compiled JS bundle for content hashing
+* @param gitRoot - Git repository root for resolving hashFiles
+*/
+function transformWorkflow(workflow, sourceFile, exportRef, bundleSource, gitRoot) {
+	let assetDigest;
+	let resolvedHashFiles;
+	if (workflow.hashFiles && workflow.hashFiles.length > 0) {
+		const resolved = resolveHashFiles(gitRoot, workflow.hashFiles);
+		if (resolved) {
+			assetDigest = resolved.assetDigest;
+			resolvedHashFiles = resolved.resolvedPaths;
+		}
+	}
+	const contentHash = bundleSource !== void 0 ? computeContentHash(bundleSource, 5, assetDigest) : "";
+	const compileSchemaVersion = bundleSource !== void 0 ? 5 : 0;
+	return {
+		name: workflow.name,
+		source: {
+			file: sourceFile,
+			export: exportRef
+		},
+		contentHash,
+		compileSchemaVersion,
+		triggers: transformTriggers(workflow.on),
+		jobs: transformJobs(workflow.jobs, sourceFile, gitRoot),
+		rules: workflow.rules ? transformRules(workflow.rules, sourceFile) : void 0,
+		description: workflow.description,
+		...workflow.hashFiles?.length && { hashFiles: workflow.hashFiles },
+		...resolvedHashFiles?.length && { resolvedHashFiles },
+		...workflow.registries?.length && { registries: workflow.registries.map((r) => ({
+			url: r.url,
+			...r.scope !== void 0 && { scope: r.scope },
+			tokenSecret: r.tokenSecret,
+			...r.alwaysAuth !== void 0 && { alwaysAuth: r.alwaysAuth }
+		})) },
+		...workflow.installEnv?.length && { installEnv: [...workflow.installEnv] },
+		...workflow.onCancel !== void 0 && { hasOnCancel: true },
+		...workflow.cleanup !== void 0 && { hasCleanup: true },
+		...workflow.onSuccess !== void 0 && { hasOnSuccess: true },
+		...workflow.onFailure !== void 0 && { hasOnFailure: true },
+		...workflow.concurrency && { concurrency: {
+			hasGroup: !!workflow.concurrency.group,
+			...workflow.concurrency.cancelInProgress !== void 0 && { cancelInProgress: workflow.concurrency.cancelInProgress },
+			...workflow.concurrency.max !== void 0 && { max: workflow.concurrency.max }
+		} }
+	};
+}
+/**
+* Spread fragment that adds a `repos` field only when the SDK trigger
+* actually carries cross-repo patterns. Identical pattern is required by
+* 14 of the 22 trigger transforms below.
+*/
+function reposField(trigger) {
+	return trigger.repos && trigger.repos.length > 0 ? { repos: transformBranchPatterns(trigger.repos) } : {};
+}
+function toLockPr(t) {
+	return {
+		_type: "pr",
+		events: t.events,
+		targetBranches: transformBranchPatterns(t.targetBranches),
+		sourceBranches: transformBranchPatterns(t.sourceBranches),
+		paths: t.paths,
+		...reposField(t)
+	};
+}
+function toLockPushAndTag(t) {
+	const results = [{
+		_type: "push",
+		branches: transformBranchPatterns(t.branches),
+		paths: t.paths,
+		...reposField(t)
+	}];
+	if (t.tags.length > 0) results.push({
+		_type: "tag",
+		patterns: transformBranchPatterns(t.tags)
+	});
+	return results;
+}
+function toLockTag(t) {
+	return {
+		_type: "tag",
+		patterns: transformBranchPatterns(t.patterns),
+		...reposField(t)
+	};
+}
+function toLockComment(t) {
+	return {
+		_type: "comment",
+		actions: t.actions,
+		source: t.source,
+		bodyMatch: t.bodyMatch,
+		...reposField(t)
+	};
+}
+function toLockReview(t) {
+	return {
+		_type: "review",
+		actions: t.actions,
+		states: t.states,
+		...reposField(t)
+	};
+}
+function toLockReviewComment(t) {
+	return {
+		_type: "review_comment",
+		actions: t.actions,
+		...reposField(t)
+	};
+}
+function toLockRelease(t) {
+	return {
+		_type: "release",
+		actions: t.actions,
+		...reposField(t)
+	};
+}
+function toLockDispatch(t) {
+	return {
+		_type: "dispatch",
+		types: t.types,
+		...reposField(t)
+	};
+}
+function toLockCreate(t) {
+	return {
+		_type: "create",
+		refTypes: t.refTypes,
+		patterns: transformBranchPatterns(t.patterns),
+		...reposField(t)
+	};
+}
+function toLockDelete(t) {
+	return {
+		_type: "delete",
+		refTypes: t.refTypes,
+		patterns: transformBranchPatterns(t.patterns),
+		...reposField(t)
+	};
+}
+function toLockStatus(t) {
+	return {
+		_type: "status",
+		contexts: t.contexts,
+		states: t.states,
+		...reposField(t)
+	};
+}
+function toLockWorkflowRun(t) {
+	return {
+		_type: "workflow_run",
+		actions: t.actions,
+		workflows: t.workflows,
+		conclusions: t.conclusions,
+		...reposField(t)
+	};
+}
+function toLockFork(t) {
+	return {
+		_type: "fork",
+		...reposField(t)
+	};
+}
+function toLockStar(t) {
+	return {
+		_type: "star",
+		actions: t.actions,
+		...reposField(t)
+	};
+}
+function toLockWatch(t) {
+	return {
+		_type: "watch",
+		actions: t.actions,
+		...reposField(t)
+	};
+}
+function toLockWebhook(t) {
+	return {
+		_type: "webhook",
+		events: t.events,
+		actions: t.actions,
+		...reposField(t)
+	};
+}
+function toLockKiciEvent(t) {
+	return {
+		_type: "kici_event",
+		eventName: t.name,
+		...t.match !== void 0 && { match: t.match },
+		...t.not !== void 0 && { not: t.not },
+		...t.source !== void 0 && { source: t.source }
+	};
+}
+function toLockWorkflowComplete(t) {
+	return {
+		_type: "workflow_complete",
+		...t.name !== void 0 && { name: t.name },
+		...t.status !== void 0 && { status: t.status },
+		...t.source !== void 0 && { source: t.source }
+	};
+}
+function toLockJobComplete(t) {
+	return {
+		_type: "job_complete",
+		...t.workflow !== void 0 && { workflow: t.workflow },
+		...t.job !== void 0 && { job: t.job },
+		...t.status !== void 0 && { status: t.status },
+		...t.source !== void 0 && { source: t.source }
+	};
+}
+function toLockGenericWebhookAuth(auth) {
+	return {
+		method: auth.method,
+		secret: auth.secret,
+		...auth.method === "hmac-sha256" && { signatureHeader: auth.signatureHeader },
+		...auth.method === "api-key" && auth.header && { header: auth.header }
+	};
+}
+function toLockGenericWebhook(t) {
+	return {
+		_type: "generic_webhook",
+		source: t.source,
+		...t.events !== void 0 && { events: t.events },
+		...t.match !== void 0 && { match: t.match },
+		...t.not !== void 0 && { not: t.not },
+		...t.auth !== void 0 && { auth: toLockGenericWebhookAuth(t.auth) },
+		...t.path !== void 0 && { path: t.path }
+	};
+}
+function toLockSchedule(t) {
+	return {
+		_type: "schedule",
+		cronExpression: t.cron,
+		timezone: t.timezone,
+		...t.description && { description: t.description }
+	};
+}
+function toLockLifecycle(t) {
+	return {
+		_type: "lifecycle",
+		events: [...t.events],
+		...t.sources && { sources: [...t.sources] },
+		...t.description && { description: t.description }
+	};
+}
+function transformOneTrigger(trigger) {
+	switch (trigger._tag) {
+		case "PrTrigger": return [toLockPr(trigger)];
+		case "PushTrigger": return toLockPushAndTag(trigger);
+		case "TagTrigger": return [toLockTag(trigger)];
+		case "CommentTrigger": return [toLockComment(trigger)];
+		case "ReviewTrigger": return [toLockReview(trigger)];
+		case "ReviewCommentTrigger": return [toLockReviewComment(trigger)];
+		case "ReleaseTrigger": return [toLockRelease(trigger)];
+		case "DispatchTrigger": return [toLockDispatch(trigger)];
+		case "CreateTrigger": return [toLockCreate(trigger)];
+		case "DeleteTrigger": return [toLockDelete(trigger)];
+		case "StatusTrigger": return [toLockStatus(trigger)];
+		case "WorkflowRunTrigger": return [toLockWorkflowRun(trigger)];
+		case "ForkTrigger": return [toLockFork(trigger)];
+		case "StarTrigger": return [toLockStar(trigger)];
+		case "WatchTrigger": return [toLockWatch(trigger)];
+		case "WebhookTrigger": return [toLockWebhook(trigger)];
+		case "KiciEventTrigger": return [toLockKiciEvent(trigger)];
+		case "WorkflowCompleteTrigger": return [toLockWorkflowComplete(trigger)];
+		case "JobCompleteTrigger": return [toLockJobComplete(trigger)];
+		case "GenericWebhookTrigger": return [toLockGenericWebhook(trigger)];
+		case "ScheduleTrigger": return [toLockSchedule(trigger)];
+		case "LifecycleTrigger": return [toLockLifecycle(trigger)];
+	}
+}
+/**
+* Transform trigger configs to lock file format.
+* Uses flatMap because push triggers with tags generate two lock triggers.
+* Exported for reuse in the test runner's in-memory lock format conversion.
+*/
+function transformTriggers(triggers) {
+	if (!triggers) return [];
+	return triggers.flatMap(transformOneTrigger);
+}
+/**
+* Transform branch patterns to lock file format.
+*/
+function transformBranchPatterns(patterns) {
+	return patterns.map((p) => ({
+		type: p.type,
+		pattern: p.pattern,
+		flags: p.flags
+	}));
+}
+/** UUID v4 pattern: 8-4-4-4-12 hex chars */
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+* Transform jobs array (may contain static jobs and dynamic generators).
+* Assigns counter-based IDs to UUID-named jobs (created by id-less job() factory).
+* Counter only increments for unnamed entries; named jobs keep their names.
+*
+* Builds a UUID-to-renamed-name mapping in a pre-pass so that `needs` references
+* to other UUID-named jobs resolve to their lock file names (job-N), not the UUIDs.
+*/
+function transformJobs(jobs, configPath, gitRoot) {
+	let preCounter = 0;
+	const uuidToName = /* @__PURE__ */ new Map();
+	for (const jobOrFactory of jobs) {
+		if (isDynamicJobFn(jobOrFactory)) continue;
+		const j = jobOrFactory;
+		if (UUID_PATTERN.test(j.name)) uuidToName.set(j.name, `job-${++preCounter}`);
+	}
+	let jobCounter = 0;
+	return jobs.map((jobOrFactory, index) => {
+		if (isDynamicJobFn(jobOrFactory)) {
+			const groupName = getDynamicJobGroup(jobOrFactory);
+			return {
+				_type: "dynamic",
+				source: {
+					file: configPath,
+					index
+				},
+				...groupName && { group: groupName }
+			};
+		}
+		const j = jobOrFactory;
+		const name = UUID_PATTERN.test(j.name) ? `job-${++jobCounter}` : j.name;
+		return transformJob({
+			...j,
+			name
+		}, configPath, index, gitRoot, uuidToName);
+	});
+}
+/**
+* Normalize SDK runsOn into lock file representation.
+* - String passthrough: `'linux'` -> `{ runsOn: 'linux' }`
+* - Array passthrough: `['linux', 'docker']` -> `{ runsOn: ['linux', 'docker'] }`
+* - Object form: `{ labels: ['linux'], exclude: ['gpu'] }` -> `{ runsOn: ['linux'], excludeLabels: ['gpu'] }`
+*/
+function normalizeRunsOnForLock(runsOn) {
+	if (typeof runsOn === "string") return { runsOn };
+	if (Array.isArray(runsOn)) return { runsOn };
+	const labels = Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels];
+	const exclude = runsOn.exclude ? Array.isArray(runsOn.exclude) ? runsOn.exclude : [runsOn.exclude] : void 0;
+	return {
+		runsOn: labels.length === 1 ? labels[0] : labels,
+		...exclude && exclude.length > 0 ? { excludeLabels: exclude } : {}
+	};
+}
+/**
+* Validate runsOn labels:
+* 1. Reject kici:* reserved prefix in user-supplied labels.
+* 2. Reject overlap between required and excluded labels.
+*/
+function validateRunsOn(runsOn, jobName) {
+	const labels = typeof runsOn === "string" ? [runsOn] : Array.isArray(runsOn) ? runsOn : Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels];
+	const reservedLabels = labels.filter((l) => l.toLowerCase().startsWith("kici:"));
+	if (reservedLabels.length > 0) throw new Error(`Job "${jobName}": labels with 'kici:' prefix are reserved and cannot be used in runsOn: ${reservedLabels.join(", ")}`);
+	if (typeof runsOn === "string" || Array.isArray(runsOn)) return;
+	const exclude = runsOn.exclude ? Array.isArray(runsOn.exclude) ? runsOn.exclude : [runsOn.exclude] : [];
+	const overlap = labels.filter((l) => exclude.includes(l));
+	if (overlap.length > 0) throw new Error(`Job "${jobName}": labels and exclude overlap on [${overlap.join(", ")}]. A label cannot be both required and excluded.`);
+}
+/**
+* Transform a static job to lock file format.
+*/
+function transformJob(job, configPath, index, gitRoot, uuidToName) {
+	validateRunsOn(job.runsOn, job.name);
+	const environmentFields = {};
+	if (job.environment !== void 0) {
+		if (typeof job.environment === "function") {
+			const fnSource = job.environment.toString();
+			const purity = analyzePurity(fnSource);
+			environmentFields.dynamicEnvironment = true;
+			if (purity.pure) environmentFields.environment = {
+				_type: "inline",
+				expression: fnSource
+			};
+			else console.warn(`[kici] Job "${job.name}": environment function is not pure (${purity.reason}). An init job will be required, adding ~5-10s delay.`);
+		} else if (typeof job.environment === "string") environmentFields.environment = job.environment;
+	}
+	const envFields = {};
+	if (job.env !== void 0) {
+		if (typeof job.env === "function") {
+			const fnSource = job.env.toString();
+			const purity = analyzePurity(fnSource);
+			envFields.dynamicEnv = true;
+			if (purity.pure) envFields.env = {
+				_type: "inline",
+				expression: fnSource
+			};
+			else console.warn(`[kici] Job "${job.name}": env function is not pure (${purity.reason}). An init job will be required, adding ~5-10s delay.`);
+		} else if (typeof job.env === "object") envFields.env = { ...job.env };
+	}
+	if (job.resources !== void 0) try {
+		validateResourceRequest(job.resources);
+	} catch (err) {
+		const reason = err instanceof Error ? err.message : String(err);
+		throw new Error(`Job "${job.name}": invalid resources -- ${reason}`);
+	}
+	const concurrencyFields = {};
+	if (job.concurrencyGroup !== void 0) {
+		if (typeof job.concurrencyGroup === "function") {
+			const fnSource = job.concurrencyGroup.toString();
+			const purity = analyzePurity(fnSource);
+			concurrencyFields.dynamicConcurrencyGroup = true;
+			if (purity.pure) concurrencyFields.concurrencyGroup = {
+				_type: "inline",
+				expression: fnSource
+			};
+			else console.warn(`[kici] Job "${job.name}": concurrencyGroup function is not pure (${purity.reason}). An init job will be required, adding ~5-10s delay.`);
+		} else if (typeof job.concurrencyGroup === "string") concurrencyFields.concurrencyGroup = job.concurrencyGroup;
+	}
+	return {
+		_type: "static",
+		name: job.name,
+		...normalizeRunsOnForLock(job.runsOn),
+		...resolveNeedsForLock(job.needs, uuidToName),
+		steps: transformSteps(job.steps, gitRoot),
+		matrix: job.matrix ? transformMatrix(job.matrix, job.name, configPath) : void 0,
+		include: job.include?.map((inc) => ({ ...inc })),
+		exclude: job.exclude?.map((exc) => ({ ...exc })),
+		rules: job.rules ? transformRules(job.rules, configPath, index) : void 0,
+		description: job.description,
+		...job.checkout !== void 0 && { checkout: job.checkout },
+		...job.container !== void 0 && { container: job.container },
+		...environmentFields,
+		...envFields,
+		...concurrencyFields,
+		...job.onCancel !== void 0 && { hasOnCancel: true },
+		...job.cleanup !== void 0 && { hasCleanup: true },
+		...job.onSuccess !== void 0 && { hasOnSuccess: true },
+		...job.onFailure !== void 0 && { hasOnFailure: true },
+		...job.beforeStep !== void 0 && { hasBeforeStep: true },
+		...job.afterStep !== void 0 && { hasAfterStep: true },
+		...job.gracePeriod !== void 0 && { gracePeriod: job.gracePeriod },
+		...job.resources !== void 0 && { resources: job.resources }
+	};
+}
+/**
+* Resolve needs to lock file format.
+* Handles strings, Job objects, DynamicGroupRef, and object forms with ifFailed policy.
+* Uses the UUID-to-renamed-name mapping so that references to id-less jobs
+* resolve to their lock file names (job-N) instead of the original UUIDs.
+*/
+function resolveNeedsForLock(needs, uuidToName) {
+	if (!needs) return { needs: [] };
+	const resolvedNeeds = [];
+	const groups = [];
+	for (const need of needs) if (typeof need === "string") resolvedNeeds.push(uuidToName?.get(need) ?? need);
+	else if (isDynamicGroupRef(need)) {
+		resolvedNeeds.push({
+			group: need.group,
+			ifFailed: need.ifFailed ?? "skip"
+		});
+		groups.push(need.group);
+	} else if ("group" in need && typeof need.group === "string") {
+		const g = need;
+		resolvedNeeds.push({
+			group: g.group,
+			ifFailed: g.ifFailed ?? "skip"
+		});
+		groups.push(g.group);
+	} else if ("ifFailed" in need && "name" in need) {
+		const n = need;
+		const name = uuidToName?.get(n.name) ?? n.name;
+		resolvedNeeds.push({
+			name,
+			ifFailed: n.ifFailed
+		});
+	} else {
+		const name = need.name;
+		resolvedNeeds.push(uuidToName?.get(name) ?? name);
+	}
+	return {
+		needs: resolvedNeeds,
+		...groups.length > 0 && { dependsOnGroups: groups }
+	};
+}
+/**
+* Transform steps to lock file format.
+* Assigns counter-based IDs to unnamed steps (bare functions and id-less steps).
+* Counter only increments for unnamed entries; named steps keep their names.
+*/
+function transformSteps(steps, gitRoot) {
+	let stepCounter = 0;
+	return steps.map((stepOrFn) => {
+		if (typeof stepOrFn === "function") {
+			stepCounter++;
+			return {
+				name: `step-${stepCounter}`,
+				hasOutputs: false
+			};
+		}
+		const step = stepOrFn;
+		return {
+			name: step.name || `step-${++stepCounter}`,
+			hasOutputs: !!step.outputs && Object.keys(step.outputs).length > 0,
+			...step.continueOnError !== void 0 && { continueOnError: step.continueOnError },
+			...step.timeout !== void 0 && { timeout: step.timeout },
+			...step._sourceLocation && { sourceLocation: {
+				file: makeRelativePath(step._sourceLocation.file, gitRoot),
+				line: step._sourceLocation.line,
+				column: step._sourceLocation.column
+			} },
+			...step.rules && step.rules.length > 0 && {
+				hasRules: true,
+				rules: transformRules(step.rules, makeRelativePath(step._sourceLocation?.file ?? "", gitRoot))
+			},
+			...step.onCancel !== void 0 && { hasOnCancel: true },
+			...step.cleanup !== void 0 && { hasCleanup: true }
+		};
+	});
+}
+/**
+* Strip the `?t=...` query suffix added by cache-busting `import()` calls.
+* The cache-buster is a `Date.now()` query parameter used to defeat Node's
+* module cache. It must not leak into the lock file — it poisons sourceLocation
+* determinism and the top-level contentHash. Handles both `.compiled.mjs?t=...`
+* (rolldown compile path) and `.ts?t=...` (direct TS import path).
+*/
+function stripCompiledSuffix(filePath) {
+	return filePath.replace(/(?:\.compiled\.mjs)?\?t=\d+$/, "");
+}
+/**
+* Convert an absolute file path to a git-root-relative path.
+* If already relative, returns as-is. Normalizes backslashes to forward slashes.
+* Also strips ephemeral `.compiled.mjs?t=...` suffixes from source locations.
+*/
+function makeRelativePath(filePath, gitRoot) {
+	const cleaned = stripCompiledSuffix(filePath);
+	if (!path.isAbsolute(cleaned)) return cleaned.replaceAll("\\", "/");
+	return path.relative(gitRoot, cleaned).replaceAll("\\", "/");
+}
+/**
+* Transform matrix configuration to lock file format.
+*/
+function transformMatrix(matrix, jobName, configPath) {
+	if (isDynamicFunction(matrix)) return {
+		_type: "dynamic",
+		source: {
+			file: configPath,
+			jobName
+		}
+	};
+	if (isStaticArray(matrix)) return {
+		_type: "static",
+		values: [...matrix]
+	};
+	if (isStaticObject(matrix)) {
+		const values = {};
+		for (const [key, arr] of Object.entries(matrix)) values[key] = [...arr];
+		return {
+			_type: "static",
+			values
+		};
+	}
+	return {
+		_type: "dynamic",
+		source: {
+			file: configPath,
+			jobName
+		}
+	};
+}
+/**
+* Transform rules to lock file format.
+* Rules contain functions and can't be serialized - store references.
+*/
+function transformRules(rules, configPath, parentIndex) {
+	return rules.map((rule, index) => ({
+		_type: "dynamic",
+		label: rule.label,
+		source: {
+			file: configPath,
+			index: parentIndex !== void 0 ? parentIndex * 100 + index : index
+		}
+	}));
+}
+/**
+* Serialize lock file to JSON string.
+*
+* @param lockFile - Lock file object
+* @param pretty - Whether to pretty-print (default: true)
+* @returns JSON string
+*/
+function serializeLockFile(lockFile, pretty = true) {
+	return JSON.stringify(lockFile, null, pretty ? 2 : void 0);
+}
+//#endregion
+export { computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile, transformTriggers };
+
+//# sourceMappingURL=generator.js.map

package/dist/lockfile/hash-files.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Resolve hashFiles patterns (paths and globs) relative to git root and build a deterministic
+ * digest string: sorted resolved paths, each followed by "\n" and file content.
+ * Used as input to the content hash so workflow cache invalidates when these files change.
+ *
+ * @param gitRoot - Absolute path to git repository root
+ * @param patterns - Paths or glob patterns relative to repo root (e.g. ["config.json", "scripts/*.sh"])
+ * @returns Object with digest string and list of resolved paths (relative to git root), or null if no patterns or resolution fails
+ */
+export declare function resolveHashFiles(gitRoot: string, patterns: string[]): {
+    assetDigest: string;
+    resolvedPaths: string[];
+} | null;
+//# sourceMappingURL=hash-files.d.ts.map