@kici-dev/engine 0.4.0 → 0.5.0

package/dist/protocol/messages/dashboard.d.ts

@@ -299,6 +299,7 @@ export declare const dashboardRunStateResponseSchema: z.ZodObject<{
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;
@@ -6616,7 +6617,6 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
-    enabled: z.ZodOptional<z.ZodBoolean>;
     allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
@@ -6629,7 +6629,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.access-log.list">;
     requestId: z.ZodString;
     actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -7296,6 +7296,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;
@@ -8821,6 +8822,7 @@ export declare const runListItemSchema: z.ZodObject<{
     workflowName: z.ZodString;
     status: z.ZodString;
     repoIdentifier: z.ZodNullable<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     sha: z.ZodNullable<z.ZodString>;
     ref: z.ZodNullable<z.ZodString>;
     triggerEvent: z.ZodNullable<z.ZodString>;
@@ -8878,6 +8880,7 @@ export declare const runListResponseSchema: z.ZodObject<{
         workflowName: z.ZodString;
         status: z.ZodString;
         repoIdentifier: z.ZodNullable<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         sha: z.ZodNullable<z.ZodString>;
         ref: z.ZodNullable<z.ZodString>;
         triggerEvent: z.ZodNullable<z.ZodString>;

package/dist/protocol/messages/dashboard.js

@@ -2203,6 +2203,13 @@ const runListItemSchema = z.object({
 	workflowName: z.string(),
 	status: z.string(),
 	repoIdentifier: z.string().nullable(),
+	/**
+	* The repository that DEFINES this run's workflow. Non-null only when it
+	* differs from `repoIdentifier` — i.e. this is an organization-wide global
+	* run, whose workflow file lives in another repo entirely. Optional so a
+	* client parsing a response from an older Platform still validates.
+	*/
+	workflowRepoIdentifier: z.string().nullable().optional(),
 	sha: z.string().nullable(),
 	ref: z.string().nullable(),
 	triggerEvent: z.string().nullable(),

package/dist/protocol/messages/execution-status.d.ts

@@ -264,6 +264,7 @@ export declare const executionStatusSchema: z.ZodObject<{
     }>;
     routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
     repoProvider: z.ZodOptional<z.ZodString>;
     localWorkingTree: z.ZodOptional<z.ZodBoolean>;
     sha: z.ZodOptional<z.ZodString>;
@@ -417,6 +418,7 @@ export declare const stateReplayRunSchema: z.ZodObject<{
     }>;
     routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
     sha: z.ZodOptional<z.ZodString>;
     ref: z.ZodOptional<z.ZodString>;
     triggerEvent: z.ZodOptional<z.ZodString>;
@@ -468,6 +470,7 @@ export declare const stateReplaySchema: z.ZodObject<{
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/execution-status.js

@@ -239,6 +239,15 @@ const executionStatusSchema = z.object({
 	routingKey: z.string().max(128).optional(),
 	repoIdentifier: z.string().max(256).optional(),
 	/**
+	* The repository that DEFINES the workflow, when that is not
+	* `repoIdentifier` — a global workflow authored in one repository and
+	* dispatched against another. Absent for every per-repository run, where the
+	* two are the same repository, so "present" is a precise marker for a
+	* cross-repository global run. Optional for backward compatibility with an
+	* older orchestrator that never sends it.
+	*/
+	workflowRepoIdentifier: z.string().max(256).optional(),
+	/**
 	* Run-level repo provider (origin host: `github` / `gitlab` / `bitbucket` /
 	* `local`). Distinct from the routing-key-derived source provider; drives the
 	* dashboard's provider-aware repo links.
@@ -359,6 +368,13 @@ const stateReplayRunSchema = z.object({
 	status: ExecutionRunStatus,
 	routingKey: z.string().max(128).optional(),
 	repoIdentifier: z.string().max(256).optional(),
+	/**
+	* The repository that DEFINES the workflow, when that is not
+	* `repoIdentifier`. Same meaning and same absent-for-per-repository-runs
+	* contract as on `execution.status`; carried here so a run that reaches the
+	* Platform only through the reconnect replay keeps its attribution.
+	*/
+	workflowRepoIdentifier: z.string().max(256).optional(),
 	sha: z.string().max(128).optional(),
 	ref: z.string().max(128).optional(),
 	triggerEvent: z.string().max(128).optional(),

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type { LockJob } from '../../trigger/types.js';
 /**
  * Cache write scope for a job's user-facing cache.
  *
@@ -232,6 +233,54 @@ export declare const jobStatusSchema: z.ZodObject<{
         encrypted: z.ZodString;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
+/**
+ * One candidate workflow's verdict from the pre-run global eval round — the
+ * job the agent runs once per (event × workflow repo) before any run row
+ * exists, evaluating each candidate's `filter` and then its `DynamicJobFn`s on
+ * a single dual checkout.
+ *
+ * `jobs` carries `LockJob[]` as an unvalidated pass-through, the same shape and
+ * for the same reason as `jobDispatchSchema.jobConfig`: the lock-file job shape
+ * has no Zod mirror anywhere in this package, its single source of truth is the
+ * `LockJob` interface in `trigger/types.ts`, and a hand-written Zod copy would
+ * drift and start rejecting legitimate generated jobs.
+ *
+ * Every field beyond the verdict itself is `.optional()` so an older peer
+ * tolerates the message unchanged.
+ */
+export declare const globalEvalCandidateResultSchema: z.ZodObject<{
+    workflowName: z.ZodString;
+    run: z.ZodBoolean;
+    jobs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    indeterminate: z.ZodOptional<z.ZodBoolean>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Every candidate's verdict from one global eval round, in candidate order. */
+export declare const globalEvalRoundResultSchema: z.ZodObject<{
+    candidates: z.ZodArray<z.ZodObject<{
+        workflowName: z.ZodString;
+        run: z.ZodBoolean;
+        jobs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        indeterminate: z.ZodOptional<z.ZodBoolean>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Typed view of {@link globalEvalCandidateResultSchema}. Declared rather than
+ * inferred so `jobs` is the real `LockJob[]` on both sides of the wire; the Zod
+ * schema stays the loose validator (see its doc comment).
+ */
+export interface GlobalEvalCandidateResult {
+    workflowName: string;
+    run: boolean;
+    jobs?: LockJob[];
+    indeterminate?: boolean;
+    reason?: string;
+}
+/** Typed view of {@link globalEvalRoundResultSchema}. */
+export interface GlobalEvalRoundResult {
+    candidates: GlobalEvalCandidateResult[];
+}
 /** Reasons an agent can refuse a job.dispatch. */
 export declare const JobRejectReason: z.ZodEnum<{
     busy: "busy";

package/dist/protocol/messages/orchestrator-agent.js

@@ -288,6 +288,39 @@ const jobStatusSchema = z.object({
 		encrypted: z.string()
 	})).optional()
 });
+/**
+* One candidate workflow's verdict from the pre-run global eval round — the
+* job the agent runs once per (event × workflow repo) before any run row
+* exists, evaluating each candidate's `filter` and then its `DynamicJobFn`s on
+* a single dual checkout.
+*
+* `jobs` carries `LockJob[]` as an unvalidated pass-through, the same shape and
+* for the same reason as `jobDispatchSchema.jobConfig`: the lock-file job shape
+* has no Zod mirror anywhere in this package, its single source of truth is the
+* `LockJob` interface in `trigger/types.ts`, and a hand-written Zod copy would
+* drift and start rejecting legitimate generated jobs.
+*
+* Every field beyond the verdict itself is `.optional()` so an older peer
+* tolerates the message unchanged.
+*/
+const globalEvalCandidateResultSchema = z.object({
+	/** The candidate workflow's name, as it appears in the lock file. */
+	workflowName: z.string(),
+	/** Whether this workflow applies to the source repo that triggered the round. */
+	run: z.boolean(),
+	jobs: z.array(z.record(z.string(), z.unknown())).optional().describe("Jobs generated by the workflow DynamicJobFns (LockJob[])"),
+	/**
+	* Set when the verdict could not be established — the filter or a generator
+	* threw, or blew the per-candidate budget. `run` is `false` alongside it, but
+	* that is a "could not decide", not a clean "does not apply": one bad
+	* candidate never fails the round, so its siblings still carry real verdicts.
+	*/
+	indeterminate: z.boolean().optional(),
+	/** Human-readable cause, present when `indeterminate` is set. */
+	reason: z.string().optional()
+});
+/** Every candidate's verdict from one global eval round, in candidate order. */
+const globalEvalRoundResultSchema = z.object({ candidates: z.array(globalEvalCandidateResultSchema) });
 /** Reasons an agent can refuse a job.dispatch. */
 const JobRejectReason = z.enum(["busy", "draining"]);
 /**
@@ -945,6 +978,6 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	stepApprovalRequestSchema
 ]);
 //#endregion
-export { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
+export { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -215,6 +215,7 @@ export declare const staleCheckrunCleanupSchema: z.ZodObject<{
         repoIdentifier: z.ZodString;
         sha: z.ZodString;
         workflowName: z.ZodString;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         jobNames: z.ZodArray<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -562,6 +563,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         repoIdentifier: z.ZodString;
         sha: z.ZodString;
         workflowName: z.ZodString;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         jobNames: z.ZodArray<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -2762,7 +2764,6 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
-    enabled: z.ZodOptional<z.ZodBoolean>;
     allowedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
@@ -2775,7 +2776,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.access-log.list">;
     requestId: z.ZodString;
     actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -3207,6 +3208,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     }>;
     routingKey: z.ZodOptional<z.ZodString>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
+    workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
     repoProvider: z.ZodOptional<z.ZodString>;
     localWorkingTree: z.ZodOptional<z.ZodBoolean>;
     sha: z.ZodOptional<z.ZodString>;
@@ -3349,6 +3351,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
+        workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         sha: z.ZodOptional<z.ZodString>;
         ref: z.ZodOptional<z.ZodString>;
         triggerEvent: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/platform-orchestrator.js

@@ -239,6 +239,20 @@ const staleCheckrunCleanupSchema = z.object({
 		repoIdentifier: z.string(),
 		sha: z.string(),
 		workflowName: z.string(),
+		/**
+		* The repository that DEFINES the workflow, when that is not the
+		* repository the run acted on — an organization-wide workflow dispatched
+		* against another repository. The orchestrator qualifies the check-run
+		* names it looks for with it, so a cleanup cannot time out the acted-on
+		* repository's own same-named check; see the orchestrator's
+		* `workflowLabel`.
+		*
+		* Additive and optional. The Platform sends it on exactly the condition
+		* that writes the mirror column — only when the two repositories differ —
+		* so an absent field and a value equal to `repoIdentifier` mean the same
+		* thing and both name the unqualified check.
+		*/
+		workflowRepoIdentifier: z.string().max(256).optional(),
 		jobNames: z.array(z.string())
 	}))
 });

package/dist/provider/check-status-poster.d.ts

@@ -34,5 +34,19 @@ export interface CheckStatusPoster {
      * unblocking a branch protection rule that requires the security check.
      */
     postGlobalWorkflowsSkippedCheck(repoIdentifier: string, commitSha: string, summary: string, credentials: unknown): Promise<void>;
+    /**
+     * Post a failing check recording that the pre-run evaluation of the
+     * organization's global workflows could not be completed, so none of the
+     * workflows it was deciding on ran for this commit.
+     *
+     * Its own check name, for the same reason as the two notices above: the
+     * security-hold check is a single named run per commit, so posting this
+     * through `postCheckStatus` would UPDATE that run and replace a pending
+     * "Held for approval" state with a completed conclusion.
+     *
+     * Optional so a provider bundle that has no notion of commit checks — or a
+     * hand-built one — is simply silent rather than failing the delivery.
+     */
+    postGlobalEvalFailedCheck?(repoIdentifier: string, commitSha: string, summary: string, credentials: unknown): Promise<void>;
 }
 //# sourceMappingURL=check-status-poster.d.ts.map

package/dist/provider/file-contents-fetcher.d.ts

@@ -0,0 +1,39 @@
+/**
+ * FileContentsFetcher interface.
+ *
+ * Fetches the contents of an arbitrary repository file at a specific ref via a
+ * provider's repository API. Used by the orchestrator to evaluate content-match
+ * triggers without cloning the repo.
+ */
+import type { ProviderType } from './types.js';
+export interface FileContentsFetcher {
+    readonly provider: ProviderType;
+    /**
+     * Fetch the contents of a file in a repository at a specific ref.
+     *
+     * Result shape:
+     * - `{ present: false }` -- the file does not exist (a 404 from the provider,
+     *   or the path resolves to a directory rather than a file).
+     * - `{ present: true, bytes }` -- the file exists and the provider returned
+     *   its inline content, decoded to a string.
+     * - `{ present: true }` (no `bytes`) -- the file exists but the provider did
+     *   not return inline content (e.g. GitHub's Contents API omits content for
+     *   files larger than 1 MiB). A caller MUST NOT read a missing `bytes` as an
+     *   absent file.
+     *
+     * Implementations do not cap the returned content -- any size limit is the
+     * caller's concern (the orchestrator's content matcher enforces a
+     * post-materialization cap). Implementations MUST NOT fall back to a raw
+     * blob download to defeat a provider's inline-content size limit.
+     *
+     * @param owner - Repository owner (e.g. "my-org")
+     * @param repo - Repository name (e.g. "my-app")
+     * @param path - Repo-relative file path (e.g. ".kici/workflows/ci.ts")
+     * @param ref - Git ref (branch name, tag, or SHA)
+     */
+    getFileContents(owner: string, repo: string, path: string, ref: string): Promise<{
+        present: boolean;
+        bytes?: string;
+    }>;
+}
+//# sourceMappingURL=file-contents-fetcher.d.ts.map

package/dist/provider/file-contents-fetcher.js

@@ -0,0 +1,2 @@
+import "../rolldown-runtime-ClRpJifh.js";
+export {};

package/dist/provider/index.d.ts

@@ -8,6 +8,7 @@
  * - WebhookNormalizer: Webhook ingestion and event normalization
  * - LockFileFetcher: Repository API access for lock files
  * - ChangedFilesFetcher: Repository API access for changed files
+ * - FileContentsFetcher: Repository API access for arbitrary file contents
  * - CloneTokenProvider: Auth token generation for agent clone
  * - RepoUrlBuilder: Provider-specific URL construction
  */
@@ -16,6 +17,7 @@ export type { WebhookNormalizer, AccessCacheInvalidation } from './webhook-norma
 export type { LockFileFetcher } from './lock-file-fetcher.js';
 export { LockFileParseError } from './lock-file-parse-error.js';
 export type { ChangedFilesFetcher, ChangedFilesResult } from './changed-files-fetcher.js';
+export type { FileContentsFetcher } from './file-contents-fetcher.js';
 export type { CloneTokenProvider, ProviderGitAuth } from './clone-token-provider.js';
 export type { RepoUrlBuilder } from './repo-url-builder.js';
 export type { ContributorResolver, ContributorInfo, ContributorPermission, } from './contributor-resolver.js';

package/dist/safe-regex.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Reject a ReDoS-prone author-supplied regex before it is compiled.
+ *
+ * `safe-regex` is a star-height heuristic. The orchestrator is single-tenant, so
+ * a slipped-through pattern only stalls the author's own orchestrator — but every
+ * author regex the orchestrator compiles from lock-file data on the webhook path
+ * (label selectors, branch/tag/repo patterns, embedded JSONPath `/re/flags`,
+ * comment `bodyMatch`) must be checked so a catastrophic pattern is rejected at
+ * compile/registration time rather than silently compiled. Globs are linear by
+ * construction but pass through here for uniformity.
+ *
+ * `ctx` is a human label (e.g. "branch pattern", "job 'web' runsOn") woven into
+ * the thrown error so an operator can identify the offending pattern.
+ */
+export declare function assertSafeRegex(source: string, flags: string, ctx: string): void;
+//# sourceMappingURL=safe-regex.d.ts.map

package/dist/safe-regex.js

@@ -0,0 +1,24 @@
+import "./rolldown-runtime-ClRpJifh.js";
+import safeRegex from "safe-regex";
+//#region src/safe-regex.ts
+/**
+* Reject a ReDoS-prone author-supplied regex before it is compiled.
+*
+* `safe-regex` is a star-height heuristic. The orchestrator is single-tenant, so
+* a slipped-through pattern only stalls the author's own orchestrator — but every
+* author regex the orchestrator compiles from lock-file data on the webhook path
+* (label selectors, branch/tag/repo patterns, embedded JSONPath `/re/flags`,
+* comment `bodyMatch`) must be checked so a catastrophic pattern is rejected at
+* compile/registration time rather than silently compiled. Globs are linear by
+* construction but pass through here for uniformity.
+*
+* `ctx` is a human label (e.g. "branch pattern", "job 'web' runsOn") woven into
+* the thrown error so an operator can identify the offending pattern.
+*/
+function assertSafeRegex(source, flags, ctx) {
+	if (!safeRegex(new RegExp(source, flags))) throw new Error(`${ctx}: regex /${source}/${flags} is ReDoS-prone — rejected`);
+}
+//#endregion
+export { assertSafeRegex };
+
+//# sourceMappingURL=safe-regex.js.map

package/dist/trigger/compiled-matchers.d.ts

@@ -3,11 +3,31 @@
  * flags first with a space separator; regex flags are restricted to
  * `[gimsuydv]`, so the separator can never collide with a pattern that starts
  * with a space.
+ *
+ * Every pattern reaching here is author-supplied (branch/tag/repo patterns and
+ * comment `bodyMatch`), so it is ReDoS-checked before compiling. The guard runs
+ * inside the memo factory, so a benign pattern pays the check once (on cache
+ * miss) and a catastrophic one throws — and, being unsafe, is never cached, so
+ * it is rejected on every attempt. `ctx` names the dialect in the thrown error.
  */
-export declare function getCompiledRegex(pattern: string, flags?: string): RegExp;
+export declare function getCompiledRegex(pattern: string, flags?: string, ctx?: string): RegExp;
 /**
  * Return a memoized picomatch matcher function for the given glob pattern.
  * `getGlobMatcher(pattern)(str)` is equivalent to `picomatch.isMatch(str, pattern)`.
  */
 export declare function getGlobMatcher(pattern: string): (s: string) => boolean;
+/**
+ * Repo-identifier matcher. Identical to {@link getGlobMatcher} except it sets
+ * picomatch's `dot: true`, so a dot-prefixed identifier (`.hidden/repo`) is
+ * matched by `**` — `repos: ['**']` is documented as "every repo in the org",
+ * and silently excluding a whole class of identifier contradicts that.
+ *
+ * Deliberately NOT the shared matcher: `dot: true` on path globs would make
+ * `paths: ['**']` start matching `.github/**` for every existing workflow, a
+ * semantics change this does not intend.
+ *
+ * Note a bare `.` still does not match, in either mode — picomatch will not
+ * match a lone `.`. That is upstream behavior, not something this option fixes.
+ */
+export declare function getRepoGlobMatcher(pattern: string): (s: string) => boolean;
 //# sourceMappingURL=compiled-matchers.d.ts.map

package/dist/trigger/compiled-matchers.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { assertSafeRegex } from "../safe-regex.js";
 import picomatch from "picomatch";
 //#region src/trigger/compiled-matchers.ts
 /**
@@ -22,14 +23,24 @@ function boundedGet(cache, key, make) {
 }
 const regexCache = /* @__PURE__ */ new Map();
 const globCache = /* @__PURE__ */ new Map();
+const repoGlobCache = /* @__PURE__ */ new Map();
 /**
 * Return a memoized RegExp for the given pattern + flags. The key encodes the
 * flags first with a space separator; regex flags are restricted to
 * `[gimsuydv]`, so the separator can never collide with a pattern that starts
 * with a space.
+*
+* Every pattern reaching here is author-supplied (branch/tag/repo patterns and
+* comment `bodyMatch`), so it is ReDoS-checked before compiling. The guard runs
+* inside the memo factory, so a benign pattern pays the check once (on cache
+* miss) and a catastrophic one throws — and, being unsafe, is never cached, so
+* it is rejected on every attempt. `ctx` names the dialect in the thrown error.
 */
-function getCompiledRegex(pattern, flags) {
-	return boundedGet(regexCache, `${flags ?? ""} ${pattern}`, () => new RegExp(pattern, flags));
+function getCompiledRegex(pattern, flags, ctx = "trigger pattern") {
+	return boundedGet(regexCache, `${flags ?? ""} ${pattern}`, () => {
+		assertSafeRegex(pattern, flags ?? "", ctx);
+		return new RegExp(pattern, flags);
+	});
 }
 /**
 * Return a memoized picomatch matcher function for the given glob pattern.
@@ -38,7 +49,23 @@ function getCompiledRegex(pattern, flags) {
 function getGlobMatcher(pattern) {
 	return boundedGet(globCache, pattern, () => picomatch(pattern));
 }
+/**
+* Repo-identifier matcher. Identical to {@link getGlobMatcher} except it sets
+* picomatch's `dot: true`, so a dot-prefixed identifier (`.hidden/repo`) is
+* matched by `**` — `repos: ['**']` is documented as "every repo in the org",
+* and silently excluding a whole class of identifier contradicts that.
+*
+* Deliberately NOT the shared matcher: `dot: true` on path globs would make
+* `paths: ['**']` start matching `.github/**` for every existing workflow, a
+* semantics change this does not intend.
+*
+* Note a bare `.` still does not match, in either mode — picomatch will not
+* match a lone `.`. That is upstream behavior, not something this option fixes.
+*/
+function getRepoGlobMatcher(pattern) {
+	return boundedGet(repoGlobCache, pattern, () => picomatch(pattern, { dot: true }));
+}
 //#endregion
-export { getCompiledRegex, getGlobMatcher };
+export { getCompiledRegex, getGlobMatcher, getRepoGlobMatcher };
 
 //# sourceMappingURL=compiled-matchers.js.map

package/dist/trigger/content-requirements.d.ts

@@ -0,0 +1,31 @@
+import type { LockContentRequirement } from './types.js';
+export type { ContentFormat, ContentRequirement, LockContentRequirement } from './types.js';
+/** Result of evaluating a `requires` list: a definite verdict, or fail-visible indeterminate. */
+export interface ContentRequirementResult {
+    readonly pass: boolean;
+    /** Set (with `pass:false`) when a file could not be evaluated — never a silent pass. */
+    readonly indeterminate?: string;
+}
+/**
+ * Parse `bytes` for the given concrete format. `text` returns the raw string;
+ * `json` uses `JSON.parse`; `yaml` uses a hardened `yaml.parse` with an explicit
+ * anchor/alias cap. Throws on a malformed document (the caller treats a throw as
+ * indeterminate).
+ */
+export declare function parseForFormat(bytes: string, format: 'json' | 'yaml' | 'text'): unknown;
+/**
+ * Evaluate an AND-ed list of content requirements against a resolved file map.
+ *
+ * Every entry must pass for the overall result to pass; an empty list passes.
+ * The first indeterminate entry short-circuits and is surfaced (fail-visible):
+ * an unevaluable file NEVER passes silently.
+ *
+ * @param reqs  The lock `requires` list (each entry AND-ed).
+ * @param files Resolved file contents keyed by repo-relative path. A missing key
+ *              or `{ present: false }` means the file does not exist at the ref.
+ */
+export declare function evaluateContentRequirements(reqs: readonly LockContentRequirement[], files: Map<string, {
+    present: boolean;
+    bytes?: string;
+}>): ContentRequirementResult;
+//# sourceMappingURL=content-requirements.d.ts.map