@kici-dev/orchestrator 0.4.0 → 0.6.0

package/dist/approvals/team-membership-lookup.d.ts

@@ -1,13 +0,0 @@
-/**
- * Read-only lookup over the team memberships pushed from the Platform via
- * `trust_policy.update`. The orchestrator has no identity store, so this is the
- * only source of "who is in team X" — the approval resolver uses it to satisfy
- * `{team}` approver clauses.
- */
-export interface TeamMembershipLookup {
-    /** Returns the set of member user ids for a team name (empty if unknown). */
-    getTeamMembers(name: string): Set<string>;
-}
-/** A lookup backed by no teams — the default before any push arrives. */
-export declare const EMPTY_TEAM_MEMBERSHIP_LOOKUP: TeamMembershipLookup;
-//# sourceMappingURL=team-membership-lookup.d.ts.map

package/dist/pipeline/inline-eval.d.ts

@@ -1,44 +0,0 @@
-/**
- * Inline expression evaluator for pure dynamic functions.
- *
- * Evaluates serialized arrow functions from the lockfile (LockInlineValue)
- * in a sandboxed VM context at dispatch time, eliminating the init-job
- * round-trip for pure functions.
- */
-import type { LockJob } from '@kici-dev/engine';
-/**
- * Evaluate an inline expression that returns a string.
- *
- * @param expression - Serialized arrow function, e.g. '(event) => event.ref.split("/").pop()'
- * @param event - Normalized event envelope (SimulatedEvent shape; raw provider payload at event.payload)
- * @returns The string result
- * @throws TypeError if result is not a string
- * @throws Error on timeout or sandbox violation
- */
-export declare function evaluateInlineString(expression: string, event: object): string;
-/**
- * Evaluate an inline expression that returns a Record<string, string>.
- *
- * @param expression - Serialized arrow function, e.g. '(event) => ({ NODE_ENV: event.env })'
- * @param event - Normalized event envelope (SimulatedEvent shape; raw provider payload at event.payload)
- * @returns The record result
- * @throws TypeError if result is not a plain object
- * @throws Error on timeout or sandbox violation
- */
-export declare function evaluateInlineRecord(expression: string, event: object): Record<string, string>;
-/**
- * Evaluate a lock job's inline (pure-function) dynamic fields against the
- * normalized event envelope (SimulatedEvent shape: { type, action,
- * targetBranch, sourceBranch, payload, … }). The raw provider webhook body is
- * nested at `event.payload` — the same shape rules and step contexts see.
- *
- * Throws a job-attributed Error when any expression throws; inline evaluation
- * failures are immediate dispatch failures (no init-job fallback).
- */
-export declare function evaluateInlineFields(lockJob: LockJob, event: object): {
-    /** Resolved name per `contexts` element, aligned by index; undefined for static or impure-dynamic elements. */
-    inlineContextNames: Array<string | undefined>;
-    inlineEnv: Record<string, string> | undefined;
-    inlineConcurrencyGroup: string | undefined;
-};
-//# sourceMappingURL=inline-eval.d.ts.map

package/dist/providers/github/contributor-resolver.d.ts

@@ -1,30 +0,0 @@
-/**
- * GitHub ContributorResolver implementation.
- *
- * Resolves contributor permissions by querying the GitHub API for
- * collaborator permission levels on a repository.
- */
-import type { ContributorResolver, ContributorInfo } from '@kici-dev/engine';
-import { type GitHubAppConfig } from './auth.js';
-/**
- * GitHub-specific implementation of ContributorResolver.
- *
- * Uses the GitHub API to check a user's permission level on a repository.
- * Handles 403 (insufficient app permissions) and 404 (not a collaborator)
- * gracefully by returning 'none' permission.
- */
-export declare class GitHubContributorResolver implements ContributorResolver {
-    private readonly config;
-    readonly provider: 'github';
-    constructor(config: GitHubAppConfig);
-    /**
-     * Resolve a contributor's permission level on a GitHub repository.
-     *
-     * @param repoIdentifier - "owner/repo" format
-     * @param username - GitHub username
-     * @param credentials - GitHubCredentials with installationId
-     * @returns ContributorInfo with mapped permission level
-     */
-    resolveContributor(repoIdentifier: string, username: string, credentials: unknown): Promise<ContributorInfo>;
-}
-//# sourceMappingURL=contributor-resolver.d.ts.map

package/dist/security/contributor-cache.d.ts

@@ -1,83 +0,0 @@
-/**
- * LRU cache wrapper for ContributorResolver.
- *
- * Caches contributor permission lookups to prevent redundant API calls.
- * Uses a 15-minute TTL and 10,000 max entries.
- */
-import type { ContributorResolver, ContributorInfo } from '@kici-dev/engine';
-import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
-/**
- * Caches ContributorResolver results in an LRU cache.
- *
- * Cache key format: `{provider}:{repoFullName}:{username}`
- * TTL: cluster-configurable (`cluster_settings.contributor_cache_ttl_ms`,
- * default 15 minutes). The TTL is resolved at each `set()` and applied
- * per-entry, so a live override affects newly-cached entries without a restart.
- */
-export declare class ContributorCache {
-    private readonly cache;
-    private readonly clusterSettings?;
-    private readonly defaultTtlMs;
-    constructor(options?: {
-        ttlMs?: number;
-        maxEntries?: number;
-        clusterSettings?: ClusterSettingsReader;
-    });
-    /** Resolve the fleet-wide contributor-cache TTL (ms), falling back to the config default. */
-    private ttlMs;
-    /**
-     * Build the cache key from provider, repo, and username.
-     */
-    private buildKey;
-    /**
-     * Resolve contributor info, using cache when available.
-     *
-     * @param provider - Provider identifier (e.g. 'github')
-     * @param repoFullName - Full repo identifier (e.g. 'owner/repo')
-     * @param username - Contributor username
-     * @param resolver - ContributorResolver to call on cache miss
-     * @param credentials - Provider credentials for API calls
-     * @returns Cached or freshly resolved ContributorInfo
-     */
-    resolve(provider: string, repoFullName: string, username: string, resolver: ContributorResolver, credentials: unknown): Promise<ContributorInfo>;
-    /**
-     * Explicitly invalidate a cached entry.
-     *
-     * @returns 1 if an entry was present and deleted, 0 otherwise. Symmetric
-     * with the bulk invalidators so callers can accumulate a total.
-     */
-    invalidate(provider: string, repoFullName: string, username: string): number;
-    /**
-     * Invalidate every cached entry for a specific repository.
-     *
-     * Scans the LRU (bounded to `maxEntries`) and deletes entries whose key
-     * prefix matches `{provider}:{repoFullName}:`. Used when a webhook event
-     * signals a repo-wide permission change (e.g. GitHub `team.added_to_repository`
-     * / `team.removed_from_repository`) where every contributor's effective
-     * permission on that repo may have shifted.
-     *
-     * @returns Number of entries deleted.
-     */
-    invalidateByRepo(provider: string, repoFullName: string): number;
-    /**
-     * Invalidate every cached entry for a user across all repositories in an org.
-     *
-     * Scans the LRU and deletes entries whose key matches
-     * `{provider}:{orgLogin}/*:{username}`. Used when a webhook event signals
-     * that a user's membership in an org changed (e.g. GitHub `organization`,
-     * `membership` events), since any repo under that org could now return a
-     * different permission for the user.
-     *
-     * @returns Number of entries deleted.
-     */
-    invalidateByUserInOrg(provider: string, orgLogin: string, username: string): number;
-    /**
-     * Clear all cached entries. Useful for testing.
-     */
-    clear(): void;
-    /**
-     * Get the current number of cached entries.
-     */
-    get size(): number;
-}
-//# sourceMappingURL=contributor-cache.d.ts.map