@kici-dev/orchestrator 0.5.0 → 0.6.1

package/dist/approvals/team-membership-lookup.d.ts

@@ -1,13 +0,0 @@
-/**
- * Read-only lookup over the team memberships pushed from the Platform via
- * `trust_policy.update`. The orchestrator has no identity store, so this is the
- * only source of "who is in team X" — the approval resolver uses it to satisfy
- * `{team}` approver clauses.
- */
-export interface TeamMembershipLookup {
-    /** Returns the set of member user ids for a team name (empty if unknown). */
-    getTeamMembers(name: string): Set<string>;
-}
-/** A lookup backed by no teams — the default before any push arrives. */
-export declare const EMPTY_TEAM_MEMBERSHIP_LOOKUP: TeamMembershipLookup;
-//# sourceMappingURL=team-membership-lookup.d.ts.map

package/dist/providers/github/contributor-resolver.d.ts

@@ -1,30 +0,0 @@
-/**
- * GitHub ContributorResolver implementation.
- *
- * Resolves contributor permissions by querying the GitHub API for
- * collaborator permission levels on a repository.
- */
-import type { ContributorResolver, ContributorInfo } from '@kici-dev/engine';
-import { type GitHubAppConfig } from './auth.js';
-/**
- * GitHub-specific implementation of ContributorResolver.
- *
- * Uses the GitHub API to check a user's permission level on a repository.
- * Handles 403 (insufficient app permissions) and 404 (not a collaborator)
- * gracefully by returning 'none' permission.
- */
-export declare class GitHubContributorResolver implements ContributorResolver {
-    private readonly config;
-    readonly provider: 'github';
-    constructor(config: GitHubAppConfig);
-    /**
-     * Resolve a contributor's permission level on a GitHub repository.
-     *
-     * @param repoIdentifier - "owner/repo" format
-     * @param username - GitHub username
-     * @param credentials - GitHubCredentials with installationId
-     * @returns ContributorInfo with mapped permission level
-     */
-    resolveContributor(repoIdentifier: string, username: string, credentials: unknown): Promise<ContributorInfo>;
-}
-//# sourceMappingURL=contributor-resolver.d.ts.map

package/dist/security/contributor-cache.d.ts

@@ -1,83 +0,0 @@
-/**
- * LRU cache wrapper for ContributorResolver.
- *
- * Caches contributor permission lookups to prevent redundant API calls.
- * Uses a 15-minute TTL and 10,000 max entries.
- */
-import type { ContributorResolver, ContributorInfo } from '@kici-dev/engine';
-import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
-/**
- * Caches ContributorResolver results in an LRU cache.
- *
- * Cache key format: `{provider}:{repoFullName}:{username}`
- * TTL: cluster-configurable (`cluster_settings.contributor_cache_ttl_ms`,
- * default 15 minutes). The TTL is resolved at each `set()` and applied
- * per-entry, so a live override affects newly-cached entries without a restart.
- */
-export declare class ContributorCache {
-    private readonly cache;
-    private readonly clusterSettings?;
-    private readonly defaultTtlMs;
-    constructor(options?: {
-        ttlMs?: number;
-        maxEntries?: number;
-        clusterSettings?: ClusterSettingsReader;
-    });
-    /** Resolve the fleet-wide contributor-cache TTL (ms), falling back to the config default. */
-    private ttlMs;
-    /**
-     * Build the cache key from provider, repo, and username.
-     */
-    private buildKey;
-    /**
-     * Resolve contributor info, using cache when available.
-     *
-     * @param provider - Provider identifier (e.g. 'github')
-     * @param repoFullName - Full repo identifier (e.g. 'owner/repo')
-     * @param username - Contributor username
-     * @param resolver - ContributorResolver to call on cache miss
-     * @param credentials - Provider credentials for API calls
-     * @returns Cached or freshly resolved ContributorInfo
-     */
-    resolve(provider: string, repoFullName: string, username: string, resolver: ContributorResolver, credentials: unknown): Promise<ContributorInfo>;
-    /**
-     * Explicitly invalidate a cached entry.
-     *
-     * @returns 1 if an entry was present and deleted, 0 otherwise. Symmetric
-     * with the bulk invalidators so callers can accumulate a total.
-     */
-    invalidate(provider: string, repoFullName: string, username: string): number;
-    /**
-     * Invalidate every cached entry for a specific repository.
-     *
-     * Scans the LRU (bounded to `maxEntries`) and deletes entries whose key
-     * prefix matches `{provider}:{repoFullName}:`. Used when a webhook event
-     * signals a repo-wide permission change (e.g. GitHub `team.added_to_repository`
-     * / `team.removed_from_repository`) where every contributor's effective
-     * permission on that repo may have shifted.
-     *
-     * @returns Number of entries deleted.
-     */
-    invalidateByRepo(provider: string, repoFullName: string): number;
-    /**
-     * Invalidate every cached entry for a user across all repositories in an org.
-     *
-     * Scans the LRU and deletes entries whose key matches
-     * `{provider}:{orgLogin}/*:{username}`. Used when a webhook event signals
-     * that a user's membership in an org changed (e.g. GitHub `organization`,
-     * `membership` events), since any repo under that org could now return a
-     * different permission for the user.
-     *
-     * @returns Number of entries deleted.
-     */
-    invalidateByUserInOrg(provider: string, orgLogin: string, username: string): number;
-    /**
-     * Clear all cached entries. Useful for testing.
-     */
-    clear(): void;
-    /**
-     * Get the current number of cached entries.
-     */
-    get size(): number;
-}
-//# sourceMappingURL=contributor-cache.d.ts.map