@kici-dev/engine 0.0.0 → 0.1.1

package/dist/protocol/messages/source-registration.d.ts

@@ -0,0 +1,103 @@
+import { z } from 'zod';
+/**
+ * Fine-grained source subtype, used by the dashboard (and any future filtering /
+ * grouping logic) to render an icon and friendly label for each source.
+ *
+ * Distinct from `provider` (which collapses universal-git, generic_webhook, and
+ * internal into the single value `'generic'`): subtype keeps the "what kind of
+ * orchestrator-side wiring is this?" distinction visible all the way through
+ * the API and UI.
+ *
+ * - `github_app`     — orchestrator-side `sources` row with `provider='github'`
+ *                      (a GitHub App registration).
+ * - `generic_webhook` — `generic_webhook_sources` row with `provider_type='generic'`.
+ * - `universal_git`   — `generic_webhook_sources` row with a non-null `git_config`
+ *                      (universal-git provider — gitea, gitlab, forgejo, etc.).
+ * - `internal`        — `generic_webhook_sources` row with `provider_type='internal'`
+ *                      (E2E / staging stg-ha smoke-test plumbing).
+ */
+export declare const SourceSubtype: z.ZodEnum<{
+    github_app: "github_app";
+    generic_webhook: "generic_webhook";
+    universal_git: "universal_git";
+    internal: "internal";
+}>;
+export type SourceSubtype = z.infer<typeof SourceSubtype>;
+/**
+ * Source provider family used by Platform's webhook router. Coarser-grained
+ * than `SourceSubtype` — every universal-git / generic_webhook / internal row
+ * collapses to `'generic'` here because Platform routes them through the same
+ * generic webhook ingress.
+ */
+export declare const SourceProvider: z.ZodEnum<{
+    github: "github";
+    gitlab: "gitlab";
+    bitbucket: "bitbucket";
+    generic: "generic";
+}>;
+export type SourceProvider = z.infer<typeof SourceProvider>;
+/** Source registration sent by orchestrator to Platform after auth.success. */
+export declare const sourceRegistrationSchema: z.ZodObject<{
+    type: z.ZodLiteral<"source.register">;
+    messageId: z.ZodString;
+    sources: z.ZodArray<z.ZodObject<{
+        provider: z.ZodEnum<{
+            github: "github";
+            gitlab: "gitlab";
+            bitbucket: "bitbucket";
+            generic: "generic";
+        }>;
+        routingKey: z.ZodString;
+        name: z.ZodString;
+        subtype: z.ZodEnum<{
+            github_app: "github_app";
+            generic_webhook: "generic_webhook";
+            universal_git: "universal_git";
+            internal: "internal";
+        }>;
+    }, z.core.$strip>>;
+    instanceId: z.ZodOptional<z.ZodString>;
+    address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    version: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        platform: "platform";
+        hybrid: "hybrid";
+        independent: "independent";
+    }>>;
+    scalerBackends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    s3LogAccess: z.ZodOptional<z.ZodBoolean>;
+    queueTimeoutMs: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+/** Platform acknowledgment of source registration. */
+export declare const sourceRegistrationAckSchema: z.ZodObject<{
+    type: z.ZodLiteral<"source.register.ack">;
+    messageId: z.ZodString;
+    accepted: z.ZodArray<z.ZodString>;
+    rejected: z.ZodArray<z.ZodObject<{
+        routingKey: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>>;
+    peers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        instanceId: z.ZodOptional<z.ZodString>;
+        address: z.ZodNullable<z.ZodString>;
+        routingKeys: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/** Source deregistration sent by orchestrator to Platform at runtime (e.g., after config reload removes an app). */
+export declare const sourceDeregisterSchema: z.ZodObject<{
+    type: z.ZodLiteral<"source.deregister">;
+    messageId: z.ZodString;
+    routingKeys: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/** Platform acknowledgment of source deregistration. */
+export declare const sourceDeregisterAckSchema: z.ZodObject<{
+    type: z.ZodLiteral<"source.deregister.ack">;
+    messageId: z.ZodString;
+    removed: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type SourceRegistration = z.infer<typeof sourceRegistrationSchema>;
+export type SourceRegistrationAck = z.infer<typeof sourceRegistrationAckSchema>;
+export type SourceDeregister = z.infer<typeof sourceDeregisterSchema>;
+export type SourceDeregisterAck = z.infer<typeof sourceDeregisterAckSchema>;
+//# sourceMappingURL=source-registration.d.ts.map

package/dist/protocol/messages/source-registration.js

@@ -0,0 +1,109 @@
+import "../../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/protocol/messages/source-registration.ts
+/**
+* Fine-grained source subtype, used by the dashboard (and any future filtering /
+* grouping logic) to render an icon and friendly label for each source.
+*
+* Distinct from `provider` (which collapses universal-git, generic_webhook, and
+* internal into the single value `'generic'`): subtype keeps the "what kind of
+* orchestrator-side wiring is this?" distinction visible all the way through
+* the API and UI.
+*
+* - `github_app`     — orchestrator-side `sources` row with `provider='github'`
+*                      (a GitHub App registration).
+* - `generic_webhook` — `generic_webhook_sources` row with `provider_type='generic'`.
+* - `universal_git`   — `generic_webhook_sources` row with a non-null `git_config`
+*                      (universal-git provider — gitea, gitlab, forgejo, etc.).
+* - `internal`        — `generic_webhook_sources` row with `provider_type='internal'`
+*                      (E2E / staging stg-ha smoke-test plumbing).
+*/
+const SourceSubtype = z.enum([
+	"github_app",
+	"generic_webhook",
+	"universal_git",
+	"internal"
+]);
+/**
+* Source provider family used by Platform's webhook router. Coarser-grained
+* than `SourceSubtype` — every universal-git / generic_webhook / internal row
+* collapses to `'generic'` here because Platform routes them through the same
+* generic webhook ingress.
+*/
+const SourceProvider = z.enum([
+	"github",
+	"gitlab",
+	"bitbucket",
+	"generic"
+]);
+/** Source registration sent by orchestrator to Platform after auth.success. */
+const sourceRegistrationSchema = z.object({
+	type: z.literal("source.register"),
+	messageId: z.string(),
+	sources: z.array(z.object({
+		provider: SourceProvider,
+		routingKey: z.string(),
+		/**
+		* Human-readable source name (e.g. "Production GitHub App",
+		* "Internal staging webhook"). Required — orchestrators always have a
+		* name in their local `sources` / `generic_webhook_sources` row.
+		*/
+		name: z.string(),
+		/**
+		* Fine-grained source subtype. See {@link SourceSubtype} for the full
+		* mapping. Required — pre-release, no backward-compat shims.
+		*/
+		subtype: SourceSubtype
+	})),
+	/** Orchestrator cluster instance ID for peer correlation. */
+	instanceId: z.string().optional(),
+	/** Reachable address for peer-to-peer connections (from KICI_CLUSTER_ADDRESS env var). */
+	address: z.string().nullable().optional(),
+	/** Orchestrator version (e.g. "0.0.1"). Optional for backward compatibility with older orchestrators. */
+	version: z.string().optional(),
+	/** Orchestrator config mode. Optional for backward compatibility. */
+	mode: z.enum([
+		"platform",
+		"hybrid",
+		"independent"
+	]).optional(),
+	/** Scaler backends configured on this orchestrator (e.g. ["container", "firecracker"]). */
+	scalerBackends: z.array(z.string()).optional(),
+	/** Whether this orchestrator has S3 log storage configured. Used for multi-orch pool validation. */
+	s3LogAccess: z.boolean().optional(),
+	/** Queue timeout in ms. Platform uses this (with margin) for safety-net GC of stale queued jobs. */
+	queueTimeoutMs: z.number().optional()
+});
+/** Platform acknowledgment of source registration. */
+const sourceRegistrationAckSchema = z.object({
+	type: z.literal("source.register.ack"),
+	messageId: z.string(),
+	accepted: z.array(z.string()),
+	rejected: z.array(z.object({
+		routingKey: z.string(),
+		reason: z.string()
+	})),
+	/** Other orchestrators sharing overlapping routing keys (peer discovery). */
+	peers: z.array(z.object({
+		connectionId: z.string(),
+		instanceId: z.string().optional(),
+		address: z.string().nullable(),
+		routingKeys: z.array(z.string())
+	})).optional()
+});
+/** Source deregistration sent by orchestrator to Platform at runtime (e.g., after config reload removes an app). */
+const sourceDeregisterSchema = z.object({
+	type: z.literal("source.deregister"),
+	messageId: z.string(),
+	routingKeys: z.array(z.string())
+});
+/** Platform acknowledgment of source deregistration. */
+const sourceDeregisterAckSchema = z.object({
+	type: z.literal("source.deregister.ack"),
+	messageId: z.string(),
+	removed: z.array(z.string())
+});
+//#endregion
+export { SourceProvider, SourceSubtype, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema };
+
+//# sourceMappingURL=source-registration.js.map

package/dist/protocol/messages/test-run.d.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+/** Simulated event shape embedded in test trigger messages. */
+export declare const testEventSchema: z.ZodObject<{
+    type: z.ZodString;
+    action: z.ZodOptional<z.ZodString>;
+    targetBranch: z.ZodString;
+    sourceBranch: z.ZodOptional<z.ZodString>;
+    payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    changedFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** Test trigger sent by CLI to orchestrator to initiate a test run. */
+export declare const testTriggerSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.trigger">;
+    messageId: z.ZodString;
+    fixtureId: z.ZodString;
+    event: z.ZodObject<{
+        type: z.ZodString;
+        action: z.ZodOptional<z.ZodString>;
+        targetBranch: z.ZodString;
+        sourceBranch: z.ZodOptional<z.ZodString>;
+        payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        changedFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    uploadId: z.ZodOptional<z.ZodString>;
+    routingKey: z.ZodString;
+    secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    workflowName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Test trigger response from orchestrator to CLI. */
+export declare const testTriggerResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.trigger.response">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+    observeUrl: z.ZodString;
+    status: z.ZodEnum<{
+        accepted: "accepted";
+        rejected: "rejected";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Test cancel request sent by CLI to orchestrator. */
+export declare const testCancelSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.cancel">;
+    messageId: z.ZodString;
+    runId: z.ZodString;
+}, z.core.$strip>;
+/** Test cancel response from orchestrator to CLI. */
+export declare const testCancelResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"test.cancel.response">;
+    messageId: z.ZodString;
+    status: z.ZodEnum<{
+        cancelled: "cancelled";
+        not_found: "not_found";
+        already_complete: "already_complete";
+    }>;
+}, z.core.$strip>;
+export type TestTriggerResponse = z.infer<typeof testTriggerResponseSchema>;
+export type TestCancelResponse = z.infer<typeof testCancelResponseSchema>;
+//# sourceMappingURL=test-run.d.ts.map

package/dist/protocol/messages/test-run.js

@@ -0,0 +1,52 @@
+import "../../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/protocol/messages/test-run.ts
+/** Simulated event shape embedded in test trigger messages. */
+const testEventSchema = z.object({
+	type: z.string(),
+	action: z.string().optional(),
+	targetBranch: z.string(),
+	sourceBranch: z.string().optional(),
+	payload: z.record(z.string(), z.unknown()),
+	changedFiles: z.array(z.string()).optional()
+});
+/** Test trigger sent by CLI to orchestrator to initiate a test run. */
+const testTriggerSchema = z.object({
+	type: z.literal("test.trigger"),
+	messageId: z.string(),
+	fixtureId: z.string(),
+	event: testEventSchema,
+	uploadId: z.string().optional(),
+	routingKey: z.string(),
+	secrets: z.record(z.string(), z.string()).optional(),
+	workflowName: z.string().optional()
+});
+/** Test trigger response from orchestrator to CLI. */
+const testTriggerResponseSchema = z.object({
+	type: z.literal("test.trigger.response"),
+	messageId: z.string(),
+	runId: z.string(),
+	observeUrl: z.string(),
+	status: z.enum(["accepted", "rejected"]),
+	reason: z.string().optional()
+});
+/** Test cancel request sent by CLI to orchestrator. */
+const testCancelSchema = z.object({
+	type: z.literal("test.cancel"),
+	messageId: z.string(),
+	runId: z.string()
+});
+/** Test cancel response from orchestrator to CLI. */
+const testCancelResponseSchema = z.object({
+	type: z.literal("test.cancel.response"),
+	messageId: z.string(),
+	status: z.enum([
+		"cancelled",
+		"not_found",
+		"already_complete"
+	])
+});
+//#endregion
+export { testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema };
+
+//# sourceMappingURL=test-run.js.map

package/dist/protocol/version.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Protocol version. Sent during WebSocket handshake.
+ * Increment on breaking changes to message schemas.
+ */
+export declare const PROTOCOL_VERSION = 1;
+/**
+ * Minimum protocol version accepted.
+ * Connections below this are rejected.
+ * Capabilities handle per-feature negotiation above this baseline.
+ */
+export declare const MIN_PROTOCOL_VERSION = 1;
+//# sourceMappingURL=version.d.ts.map

package/dist/protocol/version.js

@@ -0,0 +1,17 @@
+import "../chunk-gOLHoazu.js";
+//#region src/protocol/version.ts
+/**
+* Protocol version. Sent during WebSocket handshake.
+* Increment on breaking changes to message schemas.
+*/
+const PROTOCOL_VERSION = 1;
+/**
+* Minimum protocol version accepted.
+* Connections below this are rejected.
+* Capabilities handle per-feature negotiation above this baseline.
+*/
+const MIN_PROTOCOL_VERSION = 1;
+//#endregion
+export { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION };
+
+//# sourceMappingURL=version.js.map

package/dist/provider/changed-files-fetcher.d.ts

@@ -0,0 +1,24 @@
+/**
+ * ChangedFilesFetcher interface.
+ *
+ * Retrieves the list of files changed in a webhook event from the provider's API.
+ * Used by the orchestrator for path-based trigger filtering.
+ */
+import type { ProviderType } from './types.js';
+export interface ChangedFilesFetcher {
+    readonly provider: ProviderType;
+    /**
+     * Get changed files for a webhook event.
+     *
+     * For PRs: files changed in the pull/merge request.
+     * For pushes: files changed across the pushed commits.
+     *
+     * @param repoIdentifier - Provider-specific repo identifier (e.g., "owner/repo" for GitHub)
+     * @param eventType - Normalized event type ("pull_request" or "push")
+     * @param payload - Raw webhook payload (provider-specific)
+     * @param credentials - Provider-specific auth credentials
+     * @returns Array of changed file paths (relative to repo root)
+     */
+    getChangedFiles(repoIdentifier: string, eventType: string, payload: unknown, credentials: unknown): Promise<string[]>;
+}
+//# sourceMappingURL=changed-files-fetcher.d.ts.map

package/dist/provider/changed-files-fetcher.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};

package/dist/provider/check-run-conclusion.d.ts

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+/**
+ * GitHub check run conclusion values.
+ *
+ * Used when posting commit status / check-run results back to the provider.
+ * Access values: CheckRunConclusion.enum.success, CheckRunConclusion.enum.failure, etc.
+ */
+export declare const CheckRunConclusion: z.ZodEnum<{
+    success: "success";
+    cancelled: "cancelled";
+    failure: "failure";
+    timed_out: "timed_out";
+}>;
+export type CheckRunConclusion = z.infer<typeof CheckRunConclusion>;
+//# sourceMappingURL=check-run-conclusion.d.ts.map

package/dist/provider/check-run-conclusion.js

@@ -0,0 +1,19 @@
+import "../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/provider/check-run-conclusion.ts
+/**
+* GitHub check run conclusion values.
+*
+* Used when posting commit status / check-run results back to the provider.
+* Access values: CheckRunConclusion.enum.success, CheckRunConclusion.enum.failure, etc.
+*/
+const CheckRunConclusion = z.enum([
+	"success",
+	"failure",
+	"cancelled",
+	"timed_out"
+]);
+//#endregion
+export { CheckRunConclusion };
+
+//# sourceMappingURL=check-run-conclusion.js.map

package/dist/provider/check-status-poster.d.ts

@@ -0,0 +1,15 @@
+/**
+ * CheckStatusPoster interface for posting check statuses to git providers.
+ *
+ * Used by the CI security system to post approval/hold status checks
+ * on PRs, enabling visibility into trust-tier gating decisions.
+ */
+import type { ProviderType } from './types.js';
+/** Status values for a check run. */
+export type CheckStatus = 'pending' | 'success' | 'failure' | 'neutral';
+/** Posts check statuses to a git hosting provider. */
+export interface CheckStatusPoster {
+    readonly provider: ProviderType;
+    postCheckStatus(repoIdentifier: string, commitSha: string, status: CheckStatus, title: string, summary: string, credentials: unknown): Promise<void>;
+}
+//# sourceMappingURL=check-status-poster.d.ts.map

package/dist/provider/check-status-poster.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};

package/dist/provider/clone-token-provider.d.ts

@@ -0,0 +1,58 @@
+/**
+ * CloneTokenProvider interface.
+ *
+ * Creates short-lived authentication tokens for agent repo clone operations.
+ * Each provider has its own auth model for generating temporary access.
+ */
+import type { ProviderType } from './types.js';
+/**
+ * Structured auth material returned by `issueGitAuth()`.
+ *
+ * Mirrors the shape of `gitAuthSchema` on the orchestrator-agent protocol —
+ * declared here in a browser-safe form (no Zod import) so provider modules
+ * can stay on the barrel export. The protocol module validates dispatch
+ * messages using the Zod version.
+ */
+export interface ProviderGitAuth {
+    kind: 'basic' | 'ssh';
+    /** Basic-auth username. Omit for SSH. */
+    user?: string;
+    /** Basic-auth password/PAT, or PEM-encoded SSH private key. */
+    secret: string;
+    /** SSH-only. `accept-new` (default) or `pinned`. */
+    sshHostKeyPolicy?: 'accept-new' | 'pinned';
+    /** SSH-only, required when `sshHostKeyPolicy === 'pinned'`. */
+    sshKnownHostsPem?: string;
+}
+export interface CloneTokenProvider {
+    readonly provider: ProviderType;
+    /**
+     * Create a short-lived token for cloning a repo.
+     *
+     * The token is passed to the agent for git clone authentication.
+     * Token format and lifetime are provider-specific:
+     * - GitHub: installation access token (1 hour)
+     * - GitLab: project/group access token or OAuth token
+     * - Bitbucket: app password or OAuth token
+     *
+     * @param repoIdentifier - Provider-specific repo identifier
+     * @param credentials - Provider-specific credentials (e.g., GitHub App key + installation ID)
+     * @returns Token string for git clone auth, or null if public repo / no auth needed
+     */
+    createCloneToken(repoIdentifier: string, credentials: unknown): Promise<string | null>;
+    /**
+     * Issue structured clone auth for the dispatch protocol's `sourceAuth` /
+     * `workflowAuth` fields. Optional — when a provider implements it, the
+     * orchestrator prefers this over `createCloneToken` so it can carry the
+     * auth `kind` (basic vs ssh) and username alongside the secret material.
+     *
+     * Providers that only support HTTPS Basic auth (e.g. GitHub App install
+     * tokens) can safely omit this — the orchestrator synthesizes
+     * `{ kind: 'basic', user: 'x-access-token', secret: <token> }` from
+     * `createCloneToken`'s return value as a fallback.
+     *
+     * @returns Structured auth, or null when the provider has no credential.
+     */
+    issueGitAuth?(repoIdentifier: string, credentials: unknown): Promise<ProviderGitAuth | null>;
+}
+//# sourceMappingURL=clone-token-provider.d.ts.map

package/dist/provider/clone-token-provider.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};

package/dist/provider/contributor-resolver.d.ts

@@ -0,0 +1,22 @@
+/**
+ * ContributorResolver interface for determining contributor permissions.
+ *
+ * Used by the CI security system to check a contributor's permission level
+ * on a repository, enabling trust-tier decisions for PR execution gating.
+ */
+import type { ProviderType } from './types.js';
+/** Contributor's permission level on a repository. */
+export type ContributorPermission = 'admin' | 'write' | 'read' | 'none';
+/** Information about a contributor and their relationship to a PR. */
+export interface ContributorInfo {
+    username: string;
+    permission: ContributorPermission;
+    /** Whether the PR comes from a fork */
+    isForkPR: boolean;
+}
+/** Resolves contributor information from a git hosting provider. */
+export interface ContributorResolver {
+    readonly provider: ProviderType;
+    resolveContributor(repoIdentifier: string, username: string, credentials: unknown): Promise<ContributorInfo>;
+}
+//# sourceMappingURL=contributor-resolver.d.ts.map

package/dist/provider/contributor-resolver.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};

package/dist/provider/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Provider abstraction interfaces for KiCI.
+ *
+ * Composable interfaces that define the contract between the engine
+ * and provider-specific implementations (GitHub, GitLab, Bitbucket).
+ *
+ * Each interface covers a distinct capability:
+ * - WebhookNormalizer: Webhook ingestion and event normalization
+ * - LockFileFetcher: Repository API access for lock files
+ * - ChangedFilesFetcher: Repository API access for changed files
+ * - CloneTokenProvider: Auth token generation for agent clone
+ * - RepoUrlBuilder: Provider-specific URL construction
+ */
+export type { ProviderType } from './types.js';
+export type { WebhookNormalizer, AccessCacheInvalidation } from './webhook-normalizer.js';
+export type { LockFileFetcher } from './lock-file-fetcher.js';
+export type { ChangedFilesFetcher } from './changed-files-fetcher.js';
+export type { CloneTokenProvider, ProviderGitAuth } from './clone-token-provider.js';
+export type { RepoUrlBuilder } from './repo-url-builder.js';
+export type { ContributorResolver, ContributorInfo, ContributorPermission, } from './contributor-resolver.js';
+export type { CheckStatusPoster, CheckStatus } from './check-status-poster.js';
+export * from './check-run-conclusion.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/provider/index.js

@@ -0,0 +1,3 @@
+import "../chunk-gOLHoazu.js";
+import { CheckRunConclusion } from "./check-run-conclusion.js";
+export { CheckRunConclusion };

package/dist/provider/lock-file-fetcher.d.ts

@@ -0,0 +1,24 @@
+/**
+ * LockFileFetcher interface.
+ *
+ * Fetches kici.lock.json from a provider's repository API.
+ * Used by the orchestrator to evaluate triggers without cloning the repo.
+ */
+import type { LockFile } from '../trigger/types.js';
+import type { ProviderType } from './types.js';
+export interface LockFileFetcher {
+    readonly provider: ProviderType;
+    /**
+     * Fetch the lock file content for a repo at a specific ref.
+     *
+     * Implementation details (API client, caching, auth) are internal
+     * to each provider. The interface only cares about the result.
+     *
+     * @param repoIdentifier - Provider-specific repo identifier (e.g., "owner/repo" for GitHub)
+     * @param ref - Git ref (branch name, tag, or SHA)
+     * @param credentials - Provider-specific auth credentials
+     * @returns Parsed lock file, or null if not found
+     */
+    fetchLockFile(repoIdentifier: string, ref: string, credentials: unknown): Promise<LockFile | null>;
+}
+//# sourceMappingURL=lock-file-fetcher.d.ts.map

package/dist/provider/lock-file-fetcher.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};

package/dist/provider/repo-url-builder.d.ts

@@ -0,0 +1,35 @@
+/**
+ * RepoUrlBuilder interface.
+ *
+ * Constructs provider-specific URLs for repository operations.
+ * Used for git clone URLs and raw file access URLs in job dispatch.
+ */
+import type { ProviderType } from './types.js';
+export interface RepoUrlBuilder {
+    readonly provider: ProviderType;
+    /**
+     * Build the HTTPS clone URL for a repo.
+     *
+     * Examples:
+     * - GitHub: https://github.com/owner/repo.git
+     * - GitLab: https://gitlab.com/namespace/project.git
+     * - Bitbucket: https://bitbucket.org/workspace/repo.git
+     *
+     * @param repoIdentifier - Provider-specific repo identifier
+     * @returns HTTPS clone URL
+     */
+    buildCloneUrl(repoIdentifier: string): string;
+    /**
+     * Build the raw file URL for a file at a specific ref.
+     *
+     * Used for lockFileUrl in job dispatch, allowing the agent to
+     * fetch the lock file without a full clone.
+     *
+     * @param repoIdentifier - Provider-specific repo identifier
+     * @param ref - Git ref (branch, tag, SHA)
+     * @param path - File path relative to repo root
+     * @returns Direct URL to the raw file content
+     */
+    buildRawFileUrl(repoIdentifier: string, ref: string, path: string): string;
+}
+//# sourceMappingURL=repo-url-builder.d.ts.map

package/dist/provider/repo-url-builder.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};

package/dist/provider/types.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Common provider types for the KiCI provider abstraction layer.
+ *
+ * These types are the foundation for all provider interfaces.
+ * Keep this minimal -- only types needed by multiple interfaces belong here.
+ */
+/** Identifies a git hosting provider, generic webhook source, or internal test provider. */
+export type ProviderType = 'github' | 'gitlab' | 'bitbucket' | 'generic' | 'internal';
+//# sourceMappingURL=types.d.ts.map

package/dist/provider/types.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};