@kici-dev/engine 0.0.0 → 0.1.0

package/dist/trigger/trigger-event-type.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Canonical trigger event types with human-readable metadata.
+ *
+ * These correspond to SimulatedEvent.type values produced by normalizers,
+ * plus 'rerun' for re-run events. Adding a new event type here forces
+ * compile-time failures in any exhaustive Record<TriggerEventType, ...>
+ * (e.g., the dashboard icon map).
+ */
+export declare const TRIGGER_EVENT_TYPES: readonly ["pull_request", "push", "tag", "comment", "review", "review_comment", "release", "dispatch", "create", "delete", "status", "workflow_run", "fork", "star", "watch", "webhook", "kici_event", "workflow_complete", "job_complete", "generic_webhook", "schedule", "lifecycle", "rerun", "manual_schedule"];
+export type TriggerEventType = (typeof TRIGGER_EVENT_TYPES)[number];
+export declare const TRIGGER_EVENT_META: Record<TriggerEventType, {
+    label: string;
+}>;
+//# sourceMappingURL=trigger-event-type.d.ts.map

package/dist/trigger/trigger-event-type.js

@@ -0,0 +1,66 @@
+import "../chunk-gOLHoazu.js";
+//#region src/trigger/trigger-event-type.ts
+/**
+* Canonical trigger event types with human-readable metadata.
+*
+* These correspond to SimulatedEvent.type values produced by normalizers,
+* plus 'rerun' for re-run events. Adding a new event type here forces
+* compile-time failures in any exhaustive Record<TriggerEventType, ...>
+* (e.g., the dashboard icon map).
+*/
+const TRIGGER_EVENT_TYPES = [
+	"pull_request",
+	"push",
+	"tag",
+	"comment",
+	"review",
+	"review_comment",
+	"release",
+	"dispatch",
+	"create",
+	"delete",
+	"status",
+	"workflow_run",
+	"fork",
+	"star",
+	"watch",
+	"webhook",
+	"kici_event",
+	"workflow_complete",
+	"job_complete",
+	"generic_webhook",
+	"schedule",
+	"lifecycle",
+	"rerun",
+	"manual_schedule"
+];
+const TRIGGER_EVENT_META = {
+	pull_request: { label: "Pull request" },
+	push: { label: "Push" },
+	tag: { label: "Tag" },
+	comment: { label: "Comment" },
+	review: { label: "Review" },
+	review_comment: { label: "Review comment" },
+	release: { label: "Release" },
+	dispatch: { label: "Dispatch" },
+	create: { label: "Create" },
+	delete: { label: "Delete" },
+	status: { label: "Status" },
+	workflow_run: { label: "Workflow run" },
+	fork: { label: "Fork" },
+	star: { label: "Star" },
+	watch: { label: "Watch" },
+	webhook: { label: "Webhook" },
+	kici_event: { label: "KiCI event" },
+	workflow_complete: { label: "Workflow complete" },
+	job_complete: { label: "Job complete" },
+	generic_webhook: { label: "Generic webhook" },
+	schedule: { label: "Schedule" },
+	lifecycle: { label: "Lifecycle" },
+	rerun: { label: "Re-run" },
+	manual_schedule: { label: "Manual schedule" }
+};
+//#endregion
+export { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES };
+
+//# sourceMappingURL=trigger-event-type.js.map

package/dist/trigger/types.d.ts

@@ -0,0 +1,524 @@
+/**
+ * Lock file types for the trigger matching engine.
+ * Single source of truth -- replaces local copies in @kici-dev/compiler and @kici-dev/orchestrator.
+ * Schema version 4: adds 4 internal event routing trigger types (kici_event, workflow_complete,
+ * job_complete, generic_webhook).
+ * Schema version 6: replaces job-level contexts with environment/env/concurrencyGroup.
+ * Schema version 8: adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
+ * Schema version 9: adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
+ * Schema version 10: removes notRepos/notPaths fields, negative patterns use ! prefix in repos/paths arrays.
+ * Schema version 11: adds LockInlineValue type for pure function inline evaluation.
+ */
+import { z } from 'zod';
+import type { ProviderType } from '../provider/types.js';
+/** Schema version - increment on breaking changes */
+export declare const SCHEMA_VERSION: 12;
+/**
+ * Source file reference with meaningful path.
+ * Format: file is relative path from git root, export uses hash syntax.
+ */
+export interface LockSource {
+    /** Relative path from repo root: .kici/workflows/ci.ts */
+    readonly file: string;
+    /** Export name with hash syntax: #build or #default or #default[0] */
+    readonly export: string;
+}
+/** Branch pattern in lock file */
+export interface LockBranchPattern {
+    readonly type: 'glob' | 'regex';
+    readonly pattern: string;
+    readonly flags?: string;
+}
+/**
+ * PR trigger in lock file.
+ * Optimized for orchestrator event matching - flat structure with all filters accessible.
+ */
+export interface LockPrTrigger {
+    readonly _type: 'pr';
+    readonly events: readonly string[];
+    readonly targetBranches: readonly LockBranchPattern[];
+    readonly sourceBranches: readonly LockBranchPattern[];
+    readonly paths: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Push trigger in lock file.
+ * Optimized for orchestrator event matching - flat structure with all filters accessible.
+ */
+export interface LockPushTrigger {
+    readonly _type: 'push';
+    readonly branches: readonly LockBranchPattern[];
+    readonly paths: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Tag trigger in lock file.
+ * Matches tag push events. Reuses LockBranchPattern for tag name patterns.
+ */
+export interface LockTagTrigger {
+    readonly _type: 'tag';
+    readonly patterns: readonly LockBranchPattern[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Comment trigger in lock file.
+ * Matches issue_comment and pull_request_review_comment events.
+ */
+export interface LockCommentTrigger {
+    readonly _type: 'comment';
+    readonly actions: readonly string[];
+    readonly source?: 'issue' | 'pr';
+    readonly bodyMatch?: {
+        readonly pattern: string;
+        readonly type: 'glob' | 'regex';
+        readonly flags?: string;
+    };
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Review trigger in lock file.
+ * Matches pull_request_review events.
+ */
+export interface LockReviewTrigger {
+    readonly _type: 'review';
+    readonly actions: readonly string[];
+    readonly states: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Review comment trigger in lock file.
+ * Matches pull_request_review_comment events.
+ */
+export interface LockReviewCommentTrigger {
+    readonly _type: 'review_comment';
+    readonly actions: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Release trigger in lock file.
+ * Matches release events (published, created, etc.).
+ */
+export interface LockReleaseTrigger {
+    readonly _type: 'release';
+    readonly actions: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Dispatch trigger in lock file.
+ * Matches repository_dispatch events by type.
+ */
+export interface LockDispatchTrigger {
+    readonly _type: 'dispatch';
+    readonly types: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Create trigger in lock file.
+ * Matches create events (branch or tag creation).
+ */
+export interface LockCreateTrigger {
+    readonly _type: 'create';
+    readonly refTypes: readonly ('branch' | 'tag')[];
+    readonly patterns: readonly LockBranchPattern[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Delete trigger in lock file.
+ * Matches delete events (branch or tag deletion).
+ */
+export interface LockDeleteTrigger {
+    readonly _type: 'delete';
+    readonly refTypes: readonly ('branch' | 'tag')[];
+    readonly patterns: readonly LockBranchPattern[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Status trigger in lock file.
+ * Matches status events (commit status updates).
+ */
+export interface LockStatusTrigger {
+    readonly _type: 'status';
+    readonly contexts: readonly string[];
+    readonly states: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Workflow run trigger in lock file.
+ * Matches workflow_run events.
+ */
+export interface LockWorkflowRunTrigger {
+    readonly _type: 'workflow_run';
+    readonly actions: readonly string[];
+    readonly workflows: readonly string[];
+    readonly conclusions: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Fork trigger in lock file.
+ * Matches fork events. No filter fields.
+ */
+export interface LockForkTrigger {
+    readonly _type: 'fork';
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Star trigger in lock file.
+ * Matches star (watch) events.
+ */
+export interface LockStarTrigger {
+    readonly _type: 'star';
+    readonly actions: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Watch trigger in lock file.
+ * Matches watch events (GitHub "started watching" activity).
+ */
+export interface LockWatchTrigger {
+    readonly _type: 'watch';
+    readonly actions: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * Generic webhook trigger in lock file.
+ * Matches arbitrary webhook events not covered by specific trigger types.
+ */
+export interface LockWebhookTrigger {
+    readonly _type: 'webhook';
+    readonly events: readonly string[];
+    readonly actions: readonly string[];
+    readonly repos?: readonly LockBranchPattern[];
+}
+/**
+ * KiCI internal event trigger in lock file.
+ * Matches custom named events emitted via ctx.emit() from within steps.
+ * Supports JSONPath payload matching via match/not expressions.
+ */
+export interface LockKiciEventTrigger {
+    readonly _type: 'kici_event';
+    readonly eventName: string;
+    readonly match?: Record<string, unknown>;
+    readonly not?: Record<string, unknown>;
+    readonly source?: string;
+}
+/**
+ * Workflow completion trigger in lock file.
+ * Matches when a workflow finishes execution (success, failed, cancelled).
+ */
+export interface LockWorkflowCompleteTrigger {
+    readonly _type: 'workflow_complete';
+    readonly name?: string;
+    readonly status?: readonly string[];
+    readonly source?: string;
+}
+/**
+ * Job completion trigger in lock file.
+ * Matches when a specific job within a workflow finishes execution.
+ */
+export interface LockJobCompleteTrigger {
+    readonly _type: 'job_complete';
+    readonly workflow?: string;
+    readonly job?: string;
+    readonly status?: readonly string[];
+    readonly source?: string;
+}
+/**
+ * Auth configuration for generic webhook verification in lock file.
+ */
+export interface LockGenericWebhookAuth {
+    readonly method: 'hmac-sha256' | 'api-key';
+    readonly secret: string;
+    /** For HMAC: header containing signature */
+    readonly signatureHeader?: string;
+    /** For API key: header to check (default 'authorization') */
+    readonly header?: string;
+}
+/**
+ * Generic webhook ingestion trigger in lock file.
+ * Matches webhooks from non-Git sources (external services, APIs, etc.).
+ * Supports JSONPath payload matching via match/not expressions.
+ */
+export interface LockGenericWebhookTrigger {
+    readonly _type: 'generic_webhook';
+    readonly source: string;
+    readonly events?: readonly string[];
+    readonly match?: Record<string, unknown>;
+    readonly not?: Record<string, unknown>;
+    readonly auth?: LockGenericWebhookAuth;
+    /** URL path pattern for routing */
+    readonly path?: string;
+}
+/**
+ * Schedule trigger in lock file.
+ * Matches cron-based events fired by the scheduler.
+ */
+export interface LockScheduleTrigger {
+    readonly _type: 'schedule';
+    readonly cronExpression: string;
+    readonly timezone: string;
+    readonly description?: string;
+}
+/**
+ * Lifecycle trigger in lock file.
+ * Matches cross-workflow lifecycle events (workflow_complete, job_complete, etc.).
+ */
+export interface LockLifecycleTrigger {
+    readonly _type: 'lifecycle';
+    readonly events: readonly string[];
+    readonly sources?: readonly string[];
+    readonly description?: string;
+}
+/** Union of all trigger types */
+export type LockTrigger = LockPrTrigger | LockPushTrigger | LockTagTrigger | LockCommentTrigger | LockReviewTrigger | LockReviewCommentTrigger | LockReleaseTrigger | LockDispatchTrigger | LockCreateTrigger | LockDeleteTrigger | LockStatusTrigger | LockWorkflowRunTrigger | LockForkTrigger | LockStarTrigger | LockWatchTrigger | LockWebhookTrigger | LockKiciEventTrigger | LockWorkflowCompleteTrigger | LockJobCompleteTrigger | LockGenericWebhookTrigger | LockScheduleTrigger | LockLifecycleTrigger;
+/**
+ * Matrix configuration in lock file.
+ * Static matrices are expanded at orchestrator, dynamic at agent runtime.
+ */
+export interface LockMatrix {
+    readonly _type: 'static' | 'dynamic';
+    /** Static values (only when _type is 'static') */
+    readonly values?: Record<string, readonly string[]> | readonly string[];
+    /** Source reference for dynamic matrices */
+    readonly source?: {
+        readonly file: string;
+        readonly jobName: string;
+    };
+}
+/**
+ * Rule reference in lock file.
+ * Rules are always dynamic - they contain check functions evaluated at agent runtime.
+ */
+export interface LockRule {
+    readonly _type: 'dynamic';
+    readonly label: string;
+    readonly source: {
+        readonly file: string;
+        readonly index: number;
+    };
+}
+/**
+ * Step in lock file.
+ * Minimal representation - agents load full step functions from source.
+ */
+export interface LockStep {
+    readonly name: string;
+    readonly hasOutputs: boolean;
+    /** When true, job proceeds even if this step fails. */
+    readonly continueOnError?: boolean;
+    /** Step-level timeout in milliseconds. */
+    readonly timeout?: number;
+    /** Source location of the step() call in the original TypeScript file (for annotations). */
+    readonly sourceLocation?: {
+        readonly file: string;
+        readonly line: number;
+        readonly column: number;
+    };
+}
+/**
+ * Inline expression value for pure dynamic functions.
+ * The compiler serializes pure functions as { _type: 'inline', expression: '(event) => ...' }
+ * and the orchestrator evaluates them via vm.runInNewContext at dispatch time.
+ * struct with discriminant and expression field.
+ * _type: 'inline' alongside existing 'static' and 'dynamic' discriminants.
+ */
+export interface LockInlineValue {
+    readonly _type: 'inline';
+    readonly expression: string;
+}
+/** Type guard for inline expression values */
+export declare function isLockInlineValue(value: unknown): value is LockInlineValue;
+/**
+ * Needs entry with per-edge failure policy.
+ * Used in lock file needs arrays for explicit ifFailed override.
+ */
+export declare const NeedsEntrySchema: z.ZodObject<{
+    name: z.ZodString;
+    ifFailed: z.ZodDefault<z.ZodEnum<{
+        run: "run";
+        skip: "skip";
+    }>>;
+}, z.core.$strip>;
+export type NeedsEntry = z.infer<typeof NeedsEntrySchema>;
+/**
+ * Needs group entry with per-edge failure policy.
+ * Used in lock file needs arrays for dynamic group dependencies.
+ */
+export declare const NeedsGroupEntrySchema: z.ZodObject<{
+    group: z.ZodString;
+    ifFailed: z.ZodDefault<z.ZodEnum<{
+        run: "run";
+        skip: "skip";
+    }>>;
+}, z.core.$strip>;
+export type NeedsGroupEntry = z.infer<typeof NeedsGroupEntrySchema>;
+/**
+ * Static job in lock file.
+ * Contains all orchestrator-readable information for scheduling.
+ */
+export interface LockJob {
+    readonly _type: 'static';
+    readonly name: string;
+    readonly runsOn: string | readonly string[];
+    readonly excludeLabels?: readonly string[];
+    readonly needs: readonly (string | NeedsEntry | NeedsGroupEntry)[];
+    /** Group names this job depends on (populated by compiler from dynamicGroup refs). */
+    readonly dependsOnGroups?: readonly string[];
+    readonly steps: readonly LockStep[];
+    readonly matrix?: LockMatrix;
+    readonly include?: readonly Record<string, string>[];
+    readonly exclude?: readonly Record<string, string>[];
+    readonly rules?: readonly LockRule[];
+    readonly description?: string;
+    /** Deployment environment name (static string) or inline expression (pure function). */
+    readonly environment?: string | LockInlineValue;
+    /** When true, environment is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */
+    readonly dynamicEnvironment?: boolean;
+    /** Static environment variables or inline expression (pure function). */
+    readonly env?: Record<string, string> | LockInlineValue;
+    /** When true, env is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */
+    readonly dynamicEnv?: boolean;
+    /** Concurrency group name (static string) or inline expression (pure function). */
+    readonly concurrencyGroup?: string | LockInlineValue;
+    /** When true, concurrencyGroup is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */
+    readonly dynamicConcurrencyGroup?: boolean;
+    /**
+     * Resource request and limit for this job.
+     * Threaded from SDK `Job.resources` to the orchestrator scaler for cap accounting
+     * (`requests`) and kernel-side enforcement (`limits`) on the spawned agent.
+     */
+    readonly resources?: import('../scaler/resource-types.js').ResourceRequest;
+}
+/**
+ * Dynamic job generator reference.
+ * Points to async function that generates jobs at agent runtime.
+ */
+export interface LockDynamicJobFn {
+    readonly _type: 'dynamic';
+    readonly source: {
+        readonly file: string;
+        readonly index: number;
+    };
+    /** Group name for cross-domain needs (set when dynamicJob('name', fn) is used). */
+    readonly group?: string;
+}
+/** Job or dynamic job generator */
+export type LockJobOrFactory = LockJob | LockDynamicJobFn;
+/**
+ * Private npm registry declaration in the lock file.
+ * Carries the URL/scope/secret-reference but NOT the resolved token —
+ * the orchestrator resolves the token at dispatch time via the per-environment
+ * secretResolver.resolveForJob path.
+ */
+export interface LockRegistry {
+    readonly url: string;
+    readonly scope?: string;
+    /** Qualified secret reference: `<environment>:<secret-name>`. */
+    readonly tokenSecret: string;
+    readonly alwaysAuth?: boolean;
+}
+/**
+ * Workflow in lock file.
+ * Complete workflow definition ready for orchestrator consumption.
+ */
+export interface LockWorkflow {
+    readonly name: string;
+    /** Per-workflow source file reference. Required when workflows span multiple files. */
+    readonly source?: LockSource;
+    /** SHA-256 content hash of the compiled bundle (and optional hashFiles contents) mixed with compileSchemaVersion */
+    readonly contentHash: string;
+    /** Compile schema version used when computing the content hash */
+    readonly compileSchemaVersion: number;
+    readonly triggers: readonly LockTrigger[];
+    readonly jobs: readonly LockJobOrFactory[];
+    readonly rules?: readonly LockRule[];
+    readonly description?: string;
+    /** Declared hashFiles patterns from the workflow (paths/globs relative to repo root). Optional. */
+    readonly hashFiles?: string[];
+    /** Resolved paths (relative to repo root) used to compute contentHash. Enables agent to verify hash without re-discovering workflow. Optional. */
+    readonly resolvedHashFiles?: string[];
+    /** Secret contexts declared by the workflow. Orchestrator validates access before dispatch. Optional. */
+    readonly contexts?: readonly string[];
+    /**
+     * Private npm registries the agent should authenticate against before `npm install`.
+     * Resolved-token bytes never appear in the lock file; only the secret reference does.
+     */
+    readonly registries?: readonly LockRegistry[];
+    /**
+     * Extra qualified secret refs (`<environment>:<secret-name>`) to project as
+     * env vars on the install subprocess for use with a customer-committed `.kici/.npmrc`.
+     */
+    readonly installEnv?: readonly string[];
+    /** Workflow-level concurrency configuration. */
+    readonly concurrency?: {
+        readonly hasGroup: boolean;
+        readonly cancelInProgress?: boolean;
+        readonly max?: number;
+    };
+}
+/**
+ * Complete lock file structure.
+ * Schema version 11 - designed for fast orchestrator event matching.
+ * v2 adds per-workflow contentHash and compileSchemaVersion.
+ * v3 adds 13 new trigger types (tag, comment, review, release, dispatch, etc.).
+ * v4 adds 4 internal event routing trigger types (kici_event, workflow_complete,
+ * job_complete, generic_webhook).
+ * v5 adds schedule, lifecycle triggers, generic webhook auth, and job-level contexts.
+ * v6 replaces job-level contexts with environment/env/concurrencyGroup.
+ * v7 adds hook flags, step rules, gracePeriod, and workflow concurrency config.
+ * v8 adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
+ * v9 adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
+ * v10 removes notRepos/notPaths fields; negative patterns use ! prefix in repos/paths arrays.
+ * v11 adds LockInlineValue type for pure function inline evaluation.
+ * v12 adds workflow-level registries and installEnv for private npm registry auth.
+ */
+export interface LockFile {
+    readonly schemaVersion: typeof SCHEMA_VERSION;
+    readonly source: LockSource;
+    /** SHA-256 hash of the serialized lock file content (excluding this field). Changes only when workflows, triggers, jobs, or bundle hashes change. */
+    readonly contentHash: string;
+    /** SHA-256 hash of .kici/ lockfile (pnpm-lock.yaml or package-lock.json). Used for dependency cache keying. */
+    readonly lockfileHash?: string;
+    readonly workflows: readonly LockWorkflow[];
+}
+/** Type guard for static jobs */
+export declare function isLockStaticJob(job: LockJobOrFactory): job is LockJob;
+/** Type guard for dynamic job generators */
+export declare function isLockDynamicJobFn(job: LockJobOrFactory): job is LockDynamicJobFn;
+/**
+ * Simulated event payload structure for trigger matching.
+ *
+ * Known event types: push, pull_request, tag, comment, review, review_comment,
+ * dispatch, release, create, delete, status, workflow_run, fork, star, watch,
+ * kici_event, workflow_complete, job_complete, generic_webhook, schedule, lifecycle
+ */
+export interface SimulatedEvent {
+    type: string;
+    action?: string;
+    payload: Record<string, unknown>;
+    /** Branch being pushed to or PR target */
+    targetBranch: string;
+    /** PR source branch (only for PRs) */
+    sourceBranch?: string;
+    /** Changed files (for path filtering) */
+    changedFiles?: string[];
+    /** Which provider originated this event. Optional for backward compatibility with compiler/test CLI. */
+    provider?: ProviderType;
+    /** Whether this PR comes from a fork (head repo != base repo). Only set for PR events. */
+    isForkPR?: boolean;
+    /** Base branch ref for PR events (the branch being merged into). */
+    baseBranch?: string;
+    /** Sender username from the webhook payload (e.g. GitHub login). */
+    senderUsername?: string;
+    /**
+     * Immutable IDP-side numeric id of the sender (e.g. GitHub's `sender.id`).
+     * Mirrors Platform's `identity_links.provider_user_id`. The orchestrator
+     * trust resolver prefers this over `senderUsername` because GitHub logins
+     * are mutable and a recycled login can otherwise inherit trust granted
+     * to the previous owner.
+     */
+    senderUserId?: string;
+    /** Repository identifier where the event occurred (e.g., "owner/repo").
+     *  Used by global workflow repo pattern matching. */
+    sourceRepo?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/trigger/types.js

@@ -0,0 +1,48 @@
+import "../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/trigger/types.ts
+/**
+* Lock file types for the trigger matching engine.
+* Single source of truth -- replaces local copies in @kici-dev/compiler and @kici-dev/orchestrator.
+* Schema version 4: adds 4 internal event routing trigger types (kici_event, workflow_complete,
+* job_complete, generic_webhook).
+* Schema version 6: replaces job-level contexts with environment/env/concurrencyGroup.
+* Schema version 8: adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
+* Schema version 9: adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
+* Schema version 10: removes notRepos/notPaths fields, negative patterns use ! prefix in repos/paths arrays.
+* Schema version 11: adds LockInlineValue type for pure function inline evaluation.
+*/
+/** Schema version - increment on breaking changes */
+const SCHEMA_VERSION = 12;
+/** Type guard for inline expression values */
+function isLockInlineValue(value) {
+	return typeof value === "object" && value !== null && value._type === "inline";
+}
+/**
+* Needs entry with per-edge failure policy.
+* Used in lock file needs arrays for explicit ifFailed override.
+*/
+const NeedsEntrySchema = z.object({
+	name: z.string(),
+	ifFailed: z.enum(["skip", "run"]).default("skip")
+});
+/**
+* Needs group entry with per-edge failure policy.
+* Used in lock file needs arrays for dynamic group dependencies.
+*/
+const NeedsGroupEntrySchema = z.object({
+	group: z.string(),
+	ifFailed: z.enum(["skip", "run"]).default("skip")
+});
+/** Type guard for static jobs */
+function isLockStaticJob(job) {
+	return job._type === "static";
+}
+/** Type guard for dynamic job generators */
+function isLockDynamicJobFn(job) {
+	return job._type === "dynamic";
+}
+//#endregion
+export { NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob };
+
+//# sourceMappingURL=types.js.map

package/dist/webhook/signature.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Verify GitHub webhook signature using HMAC-SHA256.
+ *
+ * @param body - Raw webhook payload body (as string)
+ * @param signature - Signature from X-Hub-Signature-256 header
+ * @param secret - Webhook secret configured on GitHub
+ * @returns true if signature is valid, false otherwise
+ *
+ * Security:
+ * - Uses crypto.timingSafeEqual to prevent timing attacks
+ * - Validates signature format before comparison
+ * - Handles length mismatches before timingSafeEqual (which throws on length mismatch)
+ */
+export declare function verifySignature(body: string, signature: string, secret: string): boolean;
+//# sourceMappingURL=signature.d.ts.map