@kici-dev/engine 0.8.0 → 0.9.0

package/dist/provider/webhook-normalizer.d.ts

@@ -7,35 +7,6 @@
  */
 import type { SimulatedEvent } from '../trigger/types.js';
 import type { ProviderType } from './types.js';
-/**
- * Discriminated union describing which cached provider-permission entries a
- * webhook event invalidates. Returned by
- * `WebhookNormalizer.getAccessCacheInvalidations`.
- *
- * @deprecated Trust is derived from the git ref, so the orchestrator holds no
- * contributor-permission cache and nothing consumes these entries. Removed at
- * v1.0.0.
- *
- * Three scopes:
- * - `repo-user`: a single `{repo, user}` permission changed (e.g. GitHub
- *   `member` event on a specific collaborator).
- * - `repo`: every contributor's effective permission on a repo may have
- *   shifted (e.g. a team was added/removed from the repo).
- * - `user-in-org`: a user's org membership changed, so any repo under that
- *   org may now return a different permission for them.
- */
-export type AccessCacheInvalidation = {
-    kind: 'repo-user';
-    repoFullName: string;
-    username: string;
-} | {
-    kind: 'repo';
-    repoFullName: string;
-} | {
-    kind: 'user-in-org';
-    orgLogin: string;
-    username: string;
-};
 export interface WebhookNormalizer {
     readonly provider: ProviderType;
     /**
@@ -146,18 +117,5 @@ export interface WebhookNormalizer {
      * Returns null when the field is missing or cannot be resolved.
      */
     extractDefaultBranch?(payload: unknown): string | null;
-    /**
-     * Map a webhook event to the cached provider-permission entries it implies a
-     * shift in. Events that do not imply a permission shift (most events,
-     * including `push` / `pull_request` / etc.) return `[]`.
-     *
-     * @deprecated Trust is derived from the git ref, so the orchestrator holds no
-     * contributor-permission cache and never calls this. Removed at v1.0.0.
-     *
-     * @param eventType Provider-specific event type (from extractEventType).
-     * @param action Event action/sub-type, if applicable.
-     * @param payload Raw webhook payload.
-     */
-    getAccessCacheInvalidations?(eventType: string, action: string | null, payload: unknown): AccessCacheInvalidation[];
 }
 //# sourceMappingURL=webhook-normalizer.d.ts.map

package/dist/trigger/types.d.ts

@@ -13,7 +13,7 @@
  * Schema version 8 (additive): adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
  * Schema version 9 (additive): adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
  * Schema version 10 (BREAKING): removes notRepos/notPaths fields, negative patterns use ! prefix in repos/paths arrays.
- * Schema version 11 (additive): adds LockInlineValue type for pure function inline evaluation.
+ * Schema version 11 (additive): added an inline-expression value shape for dynamic fields, which is no longer parsed.
  * Schema version 14 (additive): adds declarative cache specs to LockJob and LockStep.
  * Schema version 15 (additive): adds per-job init config(s) to LockJob.
  * Schema version 16 (additive): adds normalized approval config to LockWorkflow/LockJob/LockStep.
@@ -565,29 +565,6 @@ export interface LockParallelStep {
 export type LockStepEntry = LockStep | LockParallelStep;
 /** Type guard distinguishing a parallel group from an ordinary lock step. */
 export declare function isLockParallelStep(entry: LockStepEntry): entry is LockParallelStep;
-/**
- * Serialized inline expression for a dynamic env/context/concurrencyGroup
- * field, shaped as `{ _type: 'inline', expression: '(event) => ...' }`
- * alongside the existing 'static' and 'dynamic' discriminants.
- *
- * @deprecated Schema v11 inline expressions are no longer evaluated in the
- * orchestrator. Dynamic env/context/concurrencyGroup fields are resolved on the
- * eval agent's init-runner. The compiler no longer emits this type; readers keep
- * recognizing it only to defer an old lock's field to the init round. Removed at
- * the next major (v1.0.0).
- */
-export interface LockInlineValue {
-    readonly _type: 'inline';
-    readonly expression: string;
-}
-/**
- * Type guard for inline expression values.
- *
- * @deprecated See {@link LockInlineValue}. Retained only so a reader can
- * recognize an old lock's inline field and defer it to the eval agent's
- * init-runner. Removed at the next major (v1.0.0).
- */
-export declare function isLockInlineValue(value: unknown): value is LockInlineValue;
 /**
  * Author-facing keyword sugar for a `needs` edge's run condition. Each keyword
  * resolves (at compile time) to a set of upstream terminal statuses; the
@@ -832,25 +809,18 @@ export interface LockJob {
     /**
      * Bound contexts in merge order. Each entry is a static name; `dynamic` is set
      * when it is a function resolved on the eval agent's init-runner. Later entries
-     * override earlier ones on name collisions. The `LockInlineValue` shape is a
-     * deprecated form still accepted from old locks (see {@link LockInlineValue}).
+     * override earlier ones on name collisions.
      */
     readonly contexts?: ReadonlyArray<{
-        value: string | LockInlineValue;
+        value: string;
         dynamic: boolean;
     }>;
-    /**
-     * Static environment variables. A deprecated `LockInlineValue` shape is still
-     * accepted from old locks (see {@link LockInlineValue}).
-     */
-    readonly env?: Record<string, string> | LockInlineValue;
+    /** Static environment variables. */
+    readonly env?: Record<string, string>;
     /** When true, env is dynamic (function) -- resolved on the eval agent's init-runner. */
     readonly dynamicEnv?: boolean;
-    /**
-     * Concurrency group name (static string). A deprecated `LockInlineValue` shape
-     * is still accepted from old locks (see {@link LockInlineValue}).
-     */
-    readonly concurrencyGroup?: string | LockInlineValue;
+    /** Concurrency group name (static string). */
+    readonly concurrencyGroup?: string;
     /** When true, concurrencyGroup is dynamic (function) -- resolved on the eval agent's init-runner. */
     readonly dynamicConcurrencyGroup?: boolean;
     /** Total job wall-clock timeout in milliseconds (init + all steps + hooks). Threaded to the agent via jobConfig. */
@@ -1039,7 +1009,7 @@ export interface LockWorkflow {
  * v8 adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
  * v9 adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
  * v10 removes notRepos/notPaths fields; negative patterns use ! prefix in repos/paths arrays.
- * v11 adds the LockInlineValue type (deprecated; inline dynamic fields are resolved on the eval agent).
+ * v11 added an inline-expression value shape for dynamic fields, which is no longer parsed.
  * v12 adds workflow-level registries and installEnv for private npm registry auth.
  * v13 adds job-level and workflow-level timeout.
  * v40 adds siblingsDigest — the in-repo `workspace:` sibling closure the deps

package/dist/trigger/types.js

@@ -18,7 +18,7 @@ import { z } from "zod";
 * Schema version 8 (additive): adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
 * Schema version 9 (additive): adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
 * Schema version 10 (BREAKING): removes notRepos/notPaths fields, negative patterns use ! prefix in repos/paths arrays.
-* Schema version 11 (additive): adds LockInlineValue type for pure function inline evaluation.
+* Schema version 11 (additive): added an inline-expression value shape for dynamic fields, which is no longer parsed.
 * Schema version 14 (additive): adds declarative cache specs to LockJob and LockStep.
 * Schema version 15 (additive): adds per-job init config(s) to LockJob.
 * Schema version 16 (additive): adds normalized approval config to LockWorkflow/LockJob/LockStep.
@@ -92,16 +92,6 @@ function isLockParallelStep(entry) {
 	return entry.kind === "parallel";
 }
 /**
-* Type guard for inline expression values.
-*
-* @deprecated See {@link LockInlineValue}. Retained only so a reader can
-* recognize an old lock's inline field and defer it to the eval agent's
-* init-runner. Removed at the next major (v1.0.0).
-*/
-function isLockInlineValue(value) {
-	return typeof value === "object" && value !== null && value._type === "inline";
-}
-/**
 * Author-facing keyword sugar for a `needs` edge's run condition. Each keyword
 * resolves (at compile time) to a set of upstream terminal statuses; the
 * downstream edge is dispatch-satisfied when the upstream's terminal status is
@@ -214,6 +204,6 @@ const changedFilesStatusSchema = z.enum([
 	"skipped"
 ]);
 //#endregion
-export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
+export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
 
 //# sourceMappingURL=types.js.map

package/dist/trigger/types.test-d.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.test-d.d.ts.map

package/dist/trigger/types.test-d.js

@@ -0,0 +1,63 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { describe, expectTypeOf, it } from "vitest";
+//#region src/trigger/types.test-d.ts
+/**
+* The lock-file dynamic fields no longer admit the schema-v11 inline
+* expression `{ _type: 'inline', expression }`. That object is itself a
+* `Record<string, string>`, so the `env` axis is pinned by type identity rather
+* than by an assignment the compiler would accept either way; the two string
+* fields refuse the object outright.
+*/
+describe("LockJob dynamic fields", () => {
+	it("refuses an inline expression as the concurrency group", () => {
+		expectTypeOf({
+			_type: "static",
+			name: "build",
+			steps: [],
+			needs: [],
+			concurrencyGroup: {
+				_type: "inline",
+				expression: "() => \"deploy\""
+			}
+		}).toBeObject();
+	});
+	it("refuses an inline expression as a context name", () => {
+		expectTypeOf({
+			_type: "static",
+			name: "build",
+			steps: [],
+			needs: [],
+			contexts: [{
+				value: {
+					_type: "inline",
+					expression: "() => \"prod\""
+				},
+				dynamic: false
+			}]
+		}).toBeObject();
+	});
+	it("types env as exactly a plain record", () => {
+		expectTypeOf().toEqualTypeOf();
+	});
+	it("accepts the static shapes", () => {
+		const job = {
+			_type: "static",
+			name: "build",
+			steps: [],
+			needs: [],
+			env: { NODE_ENV: "test" },
+			dynamicEnv: true,
+			concurrencyGroup: "deploy",
+			contexts: [{
+				value: "production",
+				dynamic: false
+			}]
+		};
+		expectTypeOf(job.env).toEqualTypeOf();
+		expectTypeOf(job.concurrencyGroup).toEqualTypeOf();
+	});
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=types.test-d.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",
@@ -105,10 +105,6 @@
       "import": "./dist/protocol/messages/dashboard-sealed-write.js",
       "types": "./dist/protocol/messages/dashboard-sealed-write.d.ts"
     },
-    "./protocol/messages/oidc-mint": {
-      "import": "./dist/protocol/messages/oidc-mint.js",
-      "types": "./dist/protocol/messages/oidc-mint.d.ts"
-    },
     "./protocol/messages/git-credential-relay": {
       "import": "./dist/protocol/messages/git-credential-relay.js",
       "types": "./dist/protocol/messages/git-credential-relay.d.ts"
@@ -147,20 +143,20 @@
     }
   },
   "dependencies": {
-    "jose": "^6.2.10",
+    "jose": "^6.2.12",
     "jsonpath-plus": "^10.4.0",
     "picomatch": "^4.0.7",
     "safe-regex": "^2.1.1",
-    "yaml": "^2.9.0",
-    "zod": "^4.4.3"
+    "yaml": "^2.9.1",
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@types/node": "^24.12.0",
+    "@types/node": "^24.13.4",
     "@types/safe-regex": "^1.1.6"
   },
   "scripts": {
-    "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",
-    "typecheck": "tsgo --noEmit",
+    "build": "node ../../scripts/build-ts.mjs && tsc --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run"
   }
 }

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.8.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.8.0/d8d0338d-8ea5-46df-a0ab-7373b6ab0df1",
+  "name": "@kici-dev/engine@0.9.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.9.0/f3f7d339-811b-47f4-b915-f74a4aa03eb0",
   "creationInfo": {
-    "created": "2026-09-13T12:24:34Z",
+    "created": "2026-09-21T08:49:21Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.8.0",
+      "versionInfo": "0.9.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,17 +65,17 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.8.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.9.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package-jose-6.2.10",
+      "SPDXID": "SPDXRef-Package-jose-6.2.12",
       "name": "jose",
-      "versionInfo": "6.2.10",
-      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.10.tgz",
+      "versionInfo": "6.2.12",
+      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -85,7 +85,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/jose@6.2.10"
+          "referenceLocator": "pkg:npm/jose@6.2.12"
         }
       ],
       "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
@@ -192,10 +192,10 @@
       "homepage": "https://github.com/davisjam/safe-regex"
     },
     {
-      "SPDXID": "SPDXRef-Package-yaml-2.9.0",
+      "SPDXID": "SPDXRef-Package-yaml-2.9.1",
       "name": "yaml",
-      "versionInfo": "2.9.0",
-      "downloadLocation": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "versionInfo": "2.9.1",
+      "downloadLocation": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "ISC",
@@ -205,17 +205,17 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/yaml@2.9.0"
+          "referenceLocator": "pkg:npm/yaml@2.9.1"
         }
       ],
       "description": "JavaScript parser and stringifier for YAML",
       "homepage": "https://eemeli.org/yaml/"
     },
     {
-      "SPDXID": "SPDXRef-Package-zod-4.4.3",
+      "SPDXID": "SPDXRef-Package-zod-4.6.5",
       "name": "zod",
-      "versionInfo": "4.4.3",
-      "downloadLocation": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "versionInfo": "4.6.5",
+      "downloadLocation": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -225,7 +225,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/zod@4.4.3"
+          "referenceLocator": "pkg:npm/zod@4.6.5"
         }
       ],
       "description": "TypeScript-first schema declaration and validation library with static type inference",
@@ -250,7 +250,7 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.10",
+      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -270,12 +270,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
+      "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
+      "relatedSpdxElement": "SPDXRef-Package-zod-4.6.5",
       "relationshipType": "DEPENDS_ON"
     },
     {

package/dist/protocol/messages/oidc-mint.d.ts

@@ -1,58 +0,0 @@
-import { z } from 'zod';
-/**
- * @deprecated The `oidc.mint.*` RPC pair (Platform-rooted identity mint) is
- * hard-deprecated in favor of orchestrator-owned signing. It is kept
- * wire-compatible for the mixed-version rollout window and removed at v1.0; a
- * fresh orchestrator with its own signer never sends it. See
- * docs/user/deprecations.md.
- */
-/**
- * Error discriminator for a failed provenance mint, carried on
- * `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error
- * classes that consume it:
- *   rejected    -> run/job missing or job terminal (MintRejectedError)
- *   unavailable -> the Platform signer/issuer is not configured (MintUnavailableError)
- *   failed      -> any other Platform-side failure (MintRelayError)
- */
-export declare const OidcMintErrorCode: z.ZodEnum<{
-    failed: "failed";
-    rejected: "rejected";
-    unavailable: "unavailable";
-}>;
-export type OidcMintErrorCode = z.infer<typeof OidcMintErrorCode>;
-/** orchestrator -> Platform: request a short-lived OIDC ID token for a job. */
-export declare const oidcMintRequestSchema: z.ZodObject<{
-    type: z.ZodLiteral<"oidc.mint.request">;
-    requestId: z.ZodString;
-    orchestratorId: z.ZodString;
-    runId: z.ZodString;
-    jobId: z.ZodString;
-    audience: z.ZodString;
-    deferred: z.ZodOptional<z.ZodLiteral<true>>;
-    statementHash: z.ZodOptional<z.ZodString>;
-    origin: z.ZodOptional<z.ZodEnum<{
-        deferred: "deferred";
-        "offline-backfill": "offline-backfill";
-    }>>;
-}, z.core.$strip>;
-export type OidcMintRequest = z.infer<typeof oidcMintRequestSchema>;
-/** Platform -> orchestrator: the minted token or a typed error (exactly one). */
-export declare const oidcMintResponseSchema: z.ZodObject<{
-    type: z.ZodLiteral<"oidc.mint.response">;
-    requestId: z.ZodString;
-    result: z.ZodOptional<z.ZodObject<{
-        token: z.ZodString;
-        expiresIn: z.ZodNumber;
-        jti: z.ZodString;
-    }, z.core.$strip>>;
-    error: z.ZodOptional<z.ZodObject<{
-        code: z.ZodEnum<{
-            failed: "failed";
-            rejected: "rejected";
-            unavailable: "unavailable";
-        }>;
-        message: z.ZodString;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type OidcMintResponse = z.infer<typeof oidcMintResponseSchema>;
-//# sourceMappingURL=oidc-mint.d.ts.map

package/dist/protocol/messages/oidc-mint.js

@@ -1,62 +0,0 @@
-import "../../rolldown-runtime-ClRpJifh.js";
-import { AttestationOrigin } from "../../provenance/attestation-origin.js";
-import { z } from "zod";
-//#region src/protocol/messages/oidc-mint.ts
-/**
-* @deprecated The `oidc.mint.*` RPC pair (Platform-rooted identity mint) is
-* hard-deprecated in favor of orchestrator-owned signing. It is kept
-* wire-compatible for the mixed-version rollout window and removed at v1.0; a
-* fresh orchestrator with its own signer never sends it. See
-* docs/user/deprecations.md.
-*/
-/**
-* Error discriminator for a failed provenance mint, carried on
-* `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error
-* classes that consume it:
-*   rejected    -> run/job missing or job terminal (MintRejectedError)
-*   unavailable -> the Platform signer/issuer is not configured (MintUnavailableError)
-*   failed      -> any other Platform-side failure (MintRelayError)
-*/
-const OidcMintErrorCode = z.enum([
-	"rejected",
-	"unavailable",
-	"failed"
-]);
-/** orchestrator -> Platform: request a short-lived OIDC ID token for a job. */
-const oidcMintRequestSchema = z.object({
-	type: z.literal("oidc.mint.request"),
-	requestId: z.string().min(1),
-	orchestratorId: z.string().min(1),
-	runId: z.string().min(1),
-	jobId: z.string().min(1),
-	audience: z.string().min(1).max(255),
-	/**
-	* Deferred fulfilment (attest-later): when true, the mint knowingly targets a
-	* completed job and binds `statementHash` + `origin` into the token. Absent
-	* for the live agent path. `orgId` is never on the wire — the Platform derives
-	* it from the authenticated connection.
-	*/
-	deferred: z.literal(true).optional(),
-	/** SHA-256 of the frozen DSSE statement the deferred token binds to. */
-	statementHash: z.string().optional(),
-	/** Mint-timing origin for a deferred fulfilment (never `live` here). */
-	origin: AttestationOrigin.extract(["deferred", "offline-backfill"]).optional()
-});
-/** Platform -> orchestrator: the minted token or a typed error (exactly one). */
-const oidcMintResponseSchema = z.object({
-	type: z.literal("oidc.mint.response"),
-	requestId: z.string().min(1),
-	result: z.object({
-		token: z.string().min(1),
-		expiresIn: z.number().int().positive(),
-		jti: z.string().min(1)
-	}).optional(),
-	error: z.object({
-		code: OidcMintErrorCode,
-		message: z.string()
-	}).optional()
-}).refine((m) => m.result === void 0 !== (m.error === void 0), { message: "oidc.mint.response must carry exactly one of result | error" });
-//#endregion
-export { OidcMintErrorCode, oidcMintRequestSchema, oidcMintResponseSchema };
-
-//# sourceMappingURL=oidc-mint.js.map

package/dist/provider/contributor-resolver.d.ts

@@ -1,30 +0,0 @@
-/**
- * ContributorResolver interface for determining contributor permissions.
- *
- * Deprecated in favour of ref-based trust: the whole interface, including the
- * `ContributorPermission` / `ContributorInfo` shapes it carries, is retained
- * for compatibility and has no caller in this repo.
- */
-import type { ProviderType } from './types.js';
-/** Contributor's permission level on a repository. */
-export type ContributorPermission = 'admin' | 'write' | 'read' | 'none';
-/** Information about a contributor and their relationship to a PR. */
-export interface ContributorInfo {
-    username: string;
-    permission: ContributorPermission;
-    /** Whether the PR comes from a fork */
-    isForkPR: boolean;
-}
-/**
- * Resolves contributor information from a git hosting provider.
- *
- * @deprecated Trust is derived from the git ref, not from the contributor's
- * permission level, so nothing in the webhook pipeline calls a resolver. The
- * type stays exported for wire compatibility with external implementations and
- * is removed at v1.0.0.
- */
-export interface ContributorResolver {
-    readonly provider: ProviderType;
-    resolveContributor(repoIdentifier: string, username: string, credentials: unknown): Promise<ContributorInfo>;
-}
-//# sourceMappingURL=contributor-resolver.d.ts.map

package/dist/provider/contributor-resolver.js

@@ -1,2 +0,0 @@
-import "../rolldown-runtime-ClRpJifh.js";
-export {};