@kici-dev/orchestrator 0.0.0 → 0.1.1

package/dist/providers/generic/normalizer.d.ts

@@ -0,0 +1,112 @@
+/**
+ * Generic webhook normalizer.
+ *
+ * Implements the WebhookNormalizer interface for non-GitHub webhook sources.
+ * Handles arbitrary HTTP payloads: JSON and URL-encoded form data.
+ * Extracts event type from configurable header or JSONPath in body.
+ * Filters sensitive headers per source configuration.
+ */
+import type { WebhookNormalizer, SimulatedEvent } from '@kici-dev/engine';
+import type { GenericSourceManager } from '../../webhook/generic-sources.js';
+/**
+ * Generic webhook normalizer implementing WebhookNormalizer from @kici-dev/engine.
+ *
+ * Transforms arbitrary HTTP webhook payloads into KiCI's universal SimulatedEvent format.
+ * Unlike Git providers, generic webhooks have no repo, ref, or SHA -- they carry
+ * event payloads from external services (Stripe, Slack, custom APIs, etc.).
+ */
+export declare class GenericWebhookNormalizer implements WebhookNormalizer {
+    private readonly sourceManager;
+    readonly provider: "generic";
+    constructor(sourceManager: GenericSourceManager);
+    /**
+     * Extract routing key from the X-KiCI-Source-ID header.
+     * The route handler sets this header based on the URL path parameter.
+     */
+    extractRoutingKey(headers: Record<string, string>, _payload: unknown): string | null;
+    /**
+     * Extract delivery ID from configurable header or generate one.
+     * Checks X-Request-ID, X-Delivery-ID, or X-Idempotency-Key headers.
+     */
+    extractDeliveryId(headers: Record<string, string>): string | null;
+    /**
+     * Extract event type from configurable header.
+     * Falls back to X-Event-Type header.
+     */
+    extractEventType(headers: Record<string, string>): string | null;
+    /**
+     * Verify signature -- delegates to the generic verification module.
+     * This method is part of the WebhookNormalizer interface but generic webhooks
+     * use the separate verifyGenericWebhook function with per-source config.
+     * Returns true here as a no-op; actual verification is handled upstream.
+     */
+    verifySignature(_body: string, _headers: Record<string, string>, _secret: string): boolean;
+    /**
+     * Normalize a generic webhook event into a SimulatedEvent.
+     *
+     * Generic webhooks produce events with:
+     * - type: the extracted event type or 'generic_webhook' fallback
+     * - action: undefined (no sub-action concept for generic sources)
+     * - targetBranch: '__generic__' (no branch concept)
+     * - payload: the raw parsed payload with filtered headers
+     * - provider: 'generic'
+     */
+    normalizeEvent(eventType: string, _action: string | null, payload: unknown): SimulatedEvent | null;
+    /**
+     * Extract repository identifier -- generic webhooks have no repo concept.
+     */
+    extractRepoIdentifier(_payload: unknown): string | null;
+    /**
+     * Extract ref -- generic webhooks have no ref concept.
+     */
+    extractRef(_eventType: string, _payload: unknown): string;
+    /**
+     * Extract credentials -- generic webhooks carry no provider credentials.
+     */
+    extractCredentials(_payload: unknown): Record<string, unknown>;
+    /**
+     * Parse and normalize a full generic webhook request.
+     *
+     * This is the main entry point for generic webhook processing:
+     * 1. Looks up source config by routing key
+     * 2. Parses body as JSON or URL-encoded form data
+     * 3. Extracts event type from configured header or JSONPath in body
+     * 4. Filters sensitive headers
+     * 5. Returns normalized WebhookData
+     *
+     * @param routingKey - The routing key for this source (from URL path)
+     * @param rawBody - Raw request body string
+     * @param headers - Request headers (lowercase keys)
+     * @returns Normalized data or null if source not found/disabled
+     */
+    normalizeGenericRequest(routingKey: string, rawBody: string, headers: Record<string, string>): Promise<{
+        event: string;
+        payload: Record<string, unknown>;
+        headers: Record<string, string>;
+        routingKey: string;
+    } | null>;
+}
+/**
+ * Parse request body as JSON or URL-encoded form data.
+ */
+export declare function parseBody(rawBody: string, contentType?: string): Record<string, unknown>;
+/**
+ * Extract event type from headers or payload path.
+ *
+ * Priority:
+ * 1. Source-configured header (event_type_header)
+ * 2. Source-configured JSONPath in body (event_type_path) -- simple dot notation
+ * 3. Fallback header X-Event-Type
+ * 4. Default: 'default'
+ */
+export declare function extractEventType(headers: Record<string, string>, payload: Record<string, unknown>, eventTypeHeader?: string | null, eventTypePath?: string | null): string;
+/**
+ * Get a nested value from an object using dot notation.
+ * e.g., getNestedValue({a: {b: 'c'}}, 'a.b') => 'c'
+ */
+export declare function getNestedValue(obj: Record<string, unknown>, path: string): unknown;
+/**
+ * Filter out sensitive headers.
+ */
+export declare function filterHeaders(headers: Record<string, string>, stripHeaders: string[]): Record<string, string>;
+//# sourceMappingURL=normalizer.d.ts.map

package/dist/providers/generic/verification.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Generic webhook verification module.
+ *
+ * Supports multiple verification methods for non-GitHub webhook sources:
+ * - HMAC-SHA256 signature verification (reuses engine's verifySignature)
+ * - Bearer token comparison (constant-time)
+ * - IP allowlist (exact match)
+ * - None (no verification, always passes)
+ */
+/** Supported verification methods */
+export type VerificationMethod = 'hmac_sha256' | 'bearer_token' | 'ip_allowlist' | 'none';
+/** HMAC-SHA256 verification config */
+export interface HmacVerificationConfig {
+    method: 'hmac_sha256';
+    secret: string;
+    /** Header containing the signature (default: x-signature-256) */
+    headerName?: string;
+}
+/** Bearer token verification config */
+export interface BearerVerificationConfig {
+    method: 'bearer_token';
+    token: string;
+    /** Header containing the token (default: authorization) */
+    headerName?: string;
+}
+/** IP allowlist verification config */
+export interface IpAllowlistVerificationConfig {
+    method: 'ip_allowlist';
+    allowlist: string[];
+}
+/** No verification config */
+export interface NoneVerificationConfig {
+    method: 'none';
+}
+/** Discriminated union of all verification configs */
+export type VerificationConfig = HmacVerificationConfig | BearerVerificationConfig | IpAllowlistVerificationConfig | NoneVerificationConfig;
+/**
+ * Verify a generic webhook request.
+ *
+ * @param body - Raw request body as string
+ * @param headers - Request headers (lowercase keys)
+ * @param config - Verification configuration for this source
+ * @param clientIp - Client IP address (required for ip_allowlist method)
+ * @returns true if verification passes
+ */
+export declare function verifyGenericWebhook(body: string, headers: Record<string, string>, config: VerificationConfig, clientIp?: string): boolean;
+//# sourceMappingURL=verification.d.ts.map

package/dist/providers/github/auth.d.ts

@@ -0,0 +1,60 @@
+/**
+ * GitHub clone token provider and authentication utilities.
+ *
+ * Implements the CloneTokenProvider interface from @kici-dev/engine for GitHub.
+ * Uses GitHub App installation tokens for repository access.
+ */
+import { Octokit } from '@octokit/rest';
+import type { CloneTokenProvider } from '@kici-dev/engine';
+/**
+ * Configuration required for GitHub App authentication.
+ */
+export interface GitHubAppConfig {
+    /** GitHub App ID (numeric string) */
+    appId: string;
+    /** GitHub App private key (PEM format) */
+    privateKey: string;
+}
+/**
+ * Credentials for GitHub operations requiring installation-level access.
+ */
+export interface GitHubCredentials {
+    installationId: number;
+}
+/**
+ * Create an Octokit instance authenticated as a GitHub App installation.
+ *
+ * Uses @octokit/auth-app to handle:
+ * - JWT generation for app-level authentication
+ * - Installation token creation and automatic refresh
+ *
+ * Each call creates a new Octokit instance scoped to the specific installation.
+ * The auth-app strategy handles token caching internally per Octokit instance.
+ *
+ * @param config - GitHub App credentials (appId + privateKey)
+ * @param installationId - GitHub App installation ID for the target account/org
+ * @returns Octokit instance with auto-refreshing installation tokens
+ */
+export declare function createInstallationOctokit(config: GitHubAppConfig, installationId: number): Octokit;
+/**
+ * GitHub-specific implementation of CloneTokenProvider.
+ *
+ * Creates short-lived installation access tokens for agent repo clone operations.
+ * Uses the GitHub App credentials to generate tokens scoped to a specific installation.
+ */
+export declare class GitHubCloneTokenProvider implements CloneTokenProvider {
+    private readonly config;
+    readonly provider: "github";
+    constructor(config: GitHubAppConfig);
+    /** Get the GitHub App config for this provider instance. */
+    getAppConfig(): GitHubAppConfig;
+    /**
+     * Create a short-lived installation access token for cloning a repo.
+     *
+     * @param _repoIdentifier - "owner/repo" format (not used for GitHub token creation)
+     * @param credentials - Must be GitHubCredentials with installationId
+     * @returns Installation access token string
+     */
+    createCloneToken(_repoIdentifier: string, credentials: unknown): Promise<string | null>;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/providers/github/changed-files.d.ts

@@ -0,0 +1,51 @@
+/**
+ * GitHub changed files fetcher.
+ *
+ * Implements the ChangedFilesFetcher interface from @kici-dev/engine for GitHub.
+ * Retrieves changed files for PR and push events via the GitHub API.
+ */
+import type { ChangedFilesFetcher } from '@kici-dev/engine';
+import { type GitHubAppConfig } from './auth.js';
+/**
+ * Check if an error is a GitHub 429 rate limit response.
+ * Octokit throws RequestError with a numeric `status` property.
+ */
+export declare function isRateLimitError(err: unknown): boolean;
+/**
+ * Execute a function with retry on 429 rate limit errors.
+ * Uses exponential backoff: 1s, 2s, 4s.
+ * Non-429 errors are rethrown immediately.
+ */
+export declare function withRateLimitRetry<T>(fn: () => Promise<T>, context: string): Promise<T>;
+/**
+ * GitHub-specific implementation of ChangedFilesFetcher.
+ *
+ * For PRs: uses paginated pulls.listFiles API (handles up to 3000 files).
+ * For pushes: uses repos.compareCommits API (logs warning at 300+ files).
+ * For initial pushes (zero SHA): returns empty array.
+ * For unknown events: returns empty array.
+ */
+export declare class GitHubChangedFilesFetcher implements ChangedFilesFetcher {
+    private readonly config;
+    readonly provider: "github";
+    constructor(config: GitHubAppConfig);
+    /**
+     * Get changed files for a GitHub webhook event.
+     *
+     * @param repoIdentifier - "owner/repo" format
+     * @param eventType - GitHub event type ("pull_request" or "push")
+     * @param payload - Raw GitHub webhook payload
+     * @param credentials - Must be GitHubCredentials with installationId
+     * @returns Array of changed file paths
+     */
+    getChangedFiles(repoIdentifier: string, eventType: string, payload: unknown, credentials: unknown): Promise<string[]>;
+    /**
+     * Get changed files for a pull request event using paginated listFiles API.
+     */
+    private getPrChangedFiles;
+    /**
+     * Get changed files for a push event using compareCommits API.
+     */
+    private getPushChangedFiles;
+}
+//# sourceMappingURL=changed-files.d.ts.map

package/dist/providers/github/check-status-poster.d.ts

@@ -0,0 +1,35 @@
+/**
+ * GitHub implementation of the CheckStatusPoster interface.
+ *
+ * Posts check statuses to GitHub PRs using the Checks API for:
+ * - Security holds (pending): "KiCI Security: Held for approval"
+ * - Workflow modifications (neutral): "KiCI: Workflow changes detected"
+ * - Approved runs (success) / Rejected/expired runs (failure)
+ *
+ * Reuses the Octokit infrastructure from auth.ts via createInstallationOctokit.
+ * Uses a fixed check name per category so that subsequent updates (approve/reject)
+ * can find and update the existing check run.
+ */
+import type { CheckStatusPoster, CheckStatus } from '@kici-dev/engine';
+import type { Octokit } from '@octokit/rest';
+import type { WorkflowModification } from '../../security/workflow-diff.js';
+/**
+ * GitHub CheckStatusPoster using the Checks API.
+ *
+ * Creates or updates check runs for security events. The check name
+ * is fixed so that updates (approve/reject) modify the same check.
+ */
+export declare class GitHubCheckStatusPoster implements CheckStatusPoster {
+    private readonly getOctokit;
+    readonly provider: "github";
+    constructor(getOctokit: (credentials: unknown) => Octokit);
+    postCheckStatus(repoIdentifier: string, commitSha: string, status: CheckStatus, title: string, summary: string, credentials: unknown): Promise<void>;
+    /**
+     * Post an informational check for workflow modifications detected in a PR.
+     *
+     * Uses a separate check name ("KiCI: Workflow changes") so it doesn't
+     * conflict with the security hold check. Always posted as neutral/completed.
+     */
+    postWorkflowModificationCheck(repoIdentifier: string, commitSha: string, modifications: WorkflowModification[], credentials: unknown): Promise<void>;
+}
+//# sourceMappingURL=check-status-poster.d.ts.map

package/dist/providers/github/contributor-resolver.d.ts

@@ -0,0 +1,30 @@
+/**
+ * GitHub ContributorResolver implementation.
+ *
+ * Resolves contributor permissions by querying the GitHub API for
+ * collaborator permission levels on a repository.
+ */
+import type { ContributorResolver, ContributorInfo } from '@kici-dev/engine';
+import { type GitHubAppConfig } from './auth.js';
+/**
+ * GitHub-specific implementation of ContributorResolver.
+ *
+ * Uses the GitHub API to check a user's permission level on a repository.
+ * Handles 403 (insufficient app permissions) and 404 (not a collaborator)
+ * gracefully by returning 'none' permission.
+ */
+export declare class GitHubContributorResolver implements ContributorResolver {
+    private readonly config;
+    readonly provider: "github";
+    constructor(config: GitHubAppConfig);
+    /**
+     * Resolve a contributor's permission level on a GitHub repository.
+     *
+     * @param repoIdentifier - "owner/repo" format
+     * @param username - GitHub username
+     * @param credentials - GitHubCredentials with installationId
+     * @returns ContributorInfo with mapped permission level
+     */
+    resolveContributor(repoIdentifier: string, username: string, credentials: unknown): Promise<ContributorInfo>;
+}
+//# sourceMappingURL=contributor-resolver.d.ts.map

package/dist/providers/github/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * GitHub provider implementations for KiCI.
+ *
+ * Each class implements a corresponding interface from @kici-dev/engine:
+ * - GitHubWebhookNormalizer -> WebhookNormalizer
+ * - GitHubLockFileFetcher -> LockFileFetcher
+ * - GitHubChangedFilesFetcher -> ChangedFilesFetcher
+ * - GitHubCloneTokenProvider -> CloneTokenProvider
+ * - GitHubRepoUrlBuilder -> RepoUrlBuilder
+ * - GitHubContributorResolver -> ContributorResolver
+ */
+export { GitHubWebhookNormalizer } from './normalizer.js';
+export { GitHubLockFileFetcher } from './lock-file.js';
+export { GitHubChangedFilesFetcher } from './changed-files.js';
+export { GitHubCloneTokenProvider, createInstallationOctokit } from './auth.js';
+export type { GitHubAppConfig, GitHubCredentials } from './auth.js';
+export { GitHubRepoUrlBuilder } from './repo-url.js';
+export { GitHubContributorResolver } from './contributor-resolver.js';
+export { GitHubCheckStatusPoster } from './check-status-poster.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/github/lock-file.d.ts

@@ -0,0 +1,32 @@
+/**
+ * GitHub lock file fetcher.
+ *
+ * Implements the LockFileFetcher interface from @kici-dev/engine for GitHub.
+ * Fetches kici.lock.json from a GitHub repository via the Contents API.
+ *
+ * NOTE: This is the raw fetcher without caching. The orchestrator wraps
+ * this with an LRU cache (LockFileCache) for production use.
+ */
+import type { LockFileFetcher, LockFile } from '@kici-dev/engine';
+import { type GitHubAppConfig } from './auth.js';
+/**
+ * GitHub-specific implementation of LockFileFetcher.
+ *
+ * Fetches .kici/kici.lock.json from a GitHub repository using the Contents API.
+ * Does NOT include caching -- the orchestrator wraps this fetcher with an LRU cache.
+ */
+export declare class GitHubLockFileFetcher implements LockFileFetcher {
+    private readonly config;
+    readonly provider: "github";
+    constructor(config: GitHubAppConfig);
+    /**
+     * Fetch the lock file from a GitHub repository at a specific ref.
+     *
+     * @param repoIdentifier - "owner/repo" format
+     * @param ref - Git ref (branch, tag, SHA)
+     * @param credentials - Must be GitHubCredentials with installationId
+     * @returns Parsed LockFile, or null if not found
+     */
+    fetchLockFile(repoIdentifier: string, ref: string, credentials: unknown): Promise<LockFile | null>;
+}
+//# sourceMappingURL=lock-file.d.ts.map

package/dist/providers/github/normalizer.d.ts

@@ -0,0 +1,103 @@
+/**
+ * GitHub webhook normalizer.
+ *
+ * Implements the WebhookNormalizer interface from @kici-dev/engine for GitHub webhooks.
+ * Handles header extraction, HMAC-SHA256 signature verification, and event normalization.
+ */
+import type { WebhookNormalizer, SimulatedEvent, AccessCacheInvalidation } from '@kici-dev/engine';
+/**
+ * GitHub-specific implementation of WebhookNormalizer.
+ *
+ * Maps GitHub webhook headers and payloads to KiCI's universal format.
+ * Headers are expected lowercase (Hono normalizes them).
+ */
+export declare class GitHubWebhookNormalizer implements WebhookNormalizer {
+    readonly provider: "github";
+    /**
+     * Extract routing key from GitHub webhook headers.
+     *
+     * Uses the X-GitHub-Hook-Installation-Target-ID header which identifies
+     * the GitHub App receiving the webhook.
+     *
+     * @returns "github:{appId}" or null if header is missing
+     */
+    extractRoutingKey(headers: Record<string, string>, _payload: unknown): string | null;
+    /**
+     * Extract delivery ID from X-GitHub-Delivery header.
+     *
+     * GitHub sends a UUID as the delivery identifier for deduplication.
+     */
+    extractDeliveryId(headers: Record<string, string>): string | null;
+    /**
+     * Extract event type from X-GitHub-Event header.
+     *
+     * Returns the raw GitHub event type (e.g., "push", "pull_request").
+     */
+    extractEventType(headers: Record<string, string>): string | null;
+    /**
+     * Verify webhook signature using HMAC-SHA256.
+     *
+     * GitHub signs webhooks with the X-Hub-Signature-256 header using
+     * the shared webhook secret configured on the GitHub App.
+     */
+    verifySignature(body: string, headers: Record<string, string>, secret: string): boolean;
+    /**
+     * Normalize a GitHub webhook event into a SimulatedEvent.
+     *
+     * Handles all 15 supported GitHub event types:
+     * - pull_request, push, issue_comment, pull_request_review,
+     *   pull_request_review_comment, repository_dispatch, release,
+     *   create, delete, status, workflow_run, fork, star, watch
+     * - push events with refs/tags/ prefix return type: 'tag'
+     *
+     * Returns null for events not in the supported list.
+     */
+    normalizeEvent(eventType: string, action: string | null, payload: unknown): SimulatedEvent | null;
+    /**
+     * Extract repository identifier from a GitHub webhook payload.
+     *
+     * Prefers repository.full_name, falls back to owner.login/name.
+     */
+    extractRepoIdentifier(payload: unknown): string | null;
+    /**
+     * Extract commit SHA or ref from a GitHub webhook payload.
+     *
+     * Maps each GitHub event type to the appropriate payload field
+     * for lock file fetching.
+     */
+    extractRef(eventType: string, payload: unknown): string;
+    /**
+     * Extract GitHub-specific credentials from a webhook payload.
+     *
+     * Extracts installationId from payload.installation.id, needed for
+     * generating installation tokens for repo access.
+     */
+    extractCredentials(payload: unknown): Record<string, unknown>;
+    /**
+     * Map GitHub membership-related webhook events to ContributorCache
+     * invalidations. See WebhookNormalizer.getAccessCacheInvalidations.
+     *
+     * Covered event types:
+     *
+     * - `member` (`added` / `removed` / `edited`): a collaborator's repo
+     *   permission changed -> `repo-user` invalidation for the exact
+     *   `{repo, user}` pair.
+     * - `organization` (`member_added` / `member_removed`): a user was added
+     *   to or removed from the org. The user's effective permission on every
+     *   repo under the org may have shifted -> `user-in-org`.
+     * - `membership` (`added` / `removed`, usually team scope): same reasoning
+     *   as `organization`. Slightly broader than strictly required, but the
+     *   cache refills cheaply and over-invalidation is safe.
+     * - `team` (`added_to_repository` / `removed_from_repository`): every
+     *   member of the team gained or lost repo access -> `repo`.
+     *
+     * Any other event type (including other `team` actions like `created` /
+     * `deleted` / `edited` which carry no repo context) returns `[]`.
+     *
+     * Payload fields are probed defensively; a missing field returns `[]`
+     * rather than throwing — this is best-effort and we do not want a
+     * malformed payload to crash webhook processing.
+     */
+    getAccessCacheInvalidations(eventType: string, _action: string | null, payload: unknown): AccessCacheInvalidation[];
+}
+//# sourceMappingURL=normalizer.d.ts.map

package/dist/providers/github/repo-url.d.ts

@@ -0,0 +1,35 @@
+/**
+ * GitHub repository URL builder.
+ *
+ * Implements the RepoUrlBuilder interface from @kici-dev/engine for GitHub.
+ * Constructs HTTPS clone URLs and raw file access URLs.
+ */
+import type { RepoUrlBuilder } from '@kici-dev/engine';
+/**
+ * GitHub-specific implementation of RepoUrlBuilder.
+ *
+ * Builds URLs for github.com repositories.
+ * repoIdentifier is expected in "owner/repo" format.
+ */
+export declare class GitHubRepoUrlBuilder implements RepoUrlBuilder {
+    readonly provider: "github";
+    /**
+     * Build the HTTPS clone URL for a GitHub repository.
+     *
+     * @param repoIdentifier - "owner/repo" format
+     * @returns https://github.com/owner/repo.git
+     */
+    buildCloneUrl(repoIdentifier: string): string;
+    /**
+     * Build the raw file URL for a file at a specific ref.
+     *
+     * Uses GitHub's raw endpoint for direct file access.
+     *
+     * @param repoIdentifier - "owner/repo" format
+     * @param ref - Git ref (branch, tag, SHA)
+     * @param path - File path relative to repo root
+     * @returns https://github.com/owner/repo/raw/ref/path
+     */
+    buildRawFileUrl(repoIdentifier: string, ref: string, path: string): string;
+}
+//# sourceMappingURL=repo-url.d.ts.map

package/dist/providers/internal/index.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Internal provider implementations for KiCI E2E tests.
+ *
+ * Provides a complete provider bundle for testing the webhook processing pipeline
+ * without GitHub dependencies. Uses file:// URLs for cloning and reads lock files
+ * directly from the filesystem.
+ *
+ * Classes:
+ * - InternalWebhookNormalizer -> WebhookNormalizer (extracts from custom headers)
+ * - InternalLockFileFetcher -> LockFileFetcher (reads from local filesystem)
+ * - InternalRepoUrlBuilder -> RepoUrlBuilder (returns file:// URLs)
+ */
+import type { ProviderBundle } from '../../provider-registry.js';
+export { InternalWebhookNormalizer } from './normalizer.js';
+export { InternalLockFileFetcher } from './lock-file-fetcher.js';
+export { InternalRepoUrlBuilder } from './repo-url-builder.js';
+/**
+ * Create a ProviderBundle for internal/test webhook sources.
+ *
+ * Provides normalizer, lock file fetcher, and repo URL builder.
+ * Clone token provider and changed files fetcher are null since
+ * file:// URLs need no auth and internal events don't track changed files.
+ *
+ * @param opts.repoBasePath - Base directory where test repos live on disk
+ * @param opts.cloneUrlBase - Optional URL base for clone operations (e.g. git://host/path)
+ * @returns Complete ProviderBundle for internal provider
+ */
+export declare function createInternalProviderBundle(opts: {
+    repoBasePath: string;
+    cloneUrlBase?: string;
+}): ProviderBundle;
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/internal/lock-file-fetcher.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Internal lock file fetcher for E2E tests.
+ *
+ * Implements the LockFileFetcher interface from @kici-dev/engine by reading
+ * kici.lock.json directly from the local filesystem. Used when the internal
+ * provider processes webhooks for repos accessible via file:// URLs.
+ */
+import type { LockFileFetcher, LockFile } from '@kici-dev/engine';
+/**
+ * Internal provider implementation of LockFileFetcher.
+ *
+ * Reads kici.lock.json from the local filesystem at the path derived from
+ * the repoIdentifier (which is expected to be a file:// URL or a local path).
+ */
+export declare class InternalLockFileFetcher implements LockFileFetcher {
+    private readonly repoBasePath;
+    readonly provider: "internal";
+    /**
+     * @param repoBasePath - Base directory for test repos. When repoIdentifier
+     *   starts with 'file://', it is stripped and used as-is. Otherwise
+     *   repoBasePath is used as the root.
+     */
+    constructor(repoBasePath: string);
+    /**
+     * Fetch the lock file from the local filesystem.
+     *
+     * @param repoIdentifier - Either a file:// URL or a relative path under repoBasePath
+     * @param _ref - Git ref (ignored for filesystem access -- always reads current state)
+     * @param _credentials - Not used (file:// access needs no auth)
+     * @returns Parsed LockFile, or null if not found
+     */
+    fetchLockFile(repoIdentifier: string, _ref: string, _credentials: unknown): Promise<LockFile | null>;
+}
+//# sourceMappingURL=lock-file-fetcher.d.ts.map