@stacksjs/ts-cloud 0.7.56 → 0.7.57

package/dist/security/index.d.ts

@@ -0,0 +1,8 @@
+export * from './types';
+export * from './posture-store';
+export * from './scanners';
+export * from './artifacts';
+export * from './integration';
+export * from './container-release';
+export { PreDeployScanner, SECRET_PATTERNS, formatScanResults, scanForSecrets } from './pre-deploy-scanner';
+export type { ScanOptions, ScanResult, SecretPattern, SecurityFinding as SecretScanFinding } from './pre-deploy-scanner';

package/dist/security/integration.d.ts

@@ -0,0 +1,41 @@
+import type { ControlPlaneEnvironment, ControlPlaneOrganization, ControlPlaneProject, ControlPlaneStore, JsonValue } from '../control-plane';
+import type { ScanResult } from './pre-deploy-scanner';
+import type { SecurityDeployDecision, SecurityPolicy, SecurityPostureFinding, SecurityScanRun, SecurityScope } from './types';
+import { SecurityPostureStore } from './posture-store';
+export interface SecurityControlPlaneContext {
+    store: ControlPlaneStore;
+    organization: ControlPlaneOrganization;
+    project: ControlPlaneProject;
+    environments: Map<string, ControlPlaneEnvironment>;
+}
+export declare function securityScope(context: SecurityControlPlaneContext, environment: string): SecurityScope & {
+    projectId: string;
+    environmentId: string;
+};
+export declare function ensureDefaultSecurityPolicies(context: SecurityControlPlaneContext, actorId?: string): SecurityPolicy[];
+export declare function recordPreDeploySecretScan(posture: SecurityPostureStore, scope: SecurityScope, result: ScanResult, options?: {
+    scannerVersion?: string;
+    skipped?: boolean;
+}): {
+    run: SecurityScanRun;
+    findings: SecurityPostureFinding[];
+};
+export declare function recordSkippedSecretScan(posture: SecurityPostureStore, scope: SecurityScope, reason?: string): {
+    run: SecurityScanRun;
+    findings: SecurityPostureFinding[];
+};
+export declare function recordDashboardHostPosture(posture: SecurityPostureStore, scope: SecurityScope, data: Record<string, any>): {
+    run: SecurityScanRun;
+    findings: SecurityPostureFinding[];
+};
+export declare function productionChangeReview(posture: SecurityPostureStore, input: {
+    scope: SecurityScope & {
+        projectId: string;
+        environmentId: string;
+    };
+    operationId?: string;
+    desiredConfigHash?: string;
+}): {
+    decision: SecurityDeployDecision;
+    summary: JsonValue;
+};

package/dist/security/integration.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/posture-store.d.ts

@@ -0,0 +1,80 @@
+import type { ControlPlaneStore, JsonValue } from '../control-plane';
+import type { EvaluateSecurityGateInput, RecordSecurityScanInput, ReleaseSecurityArtifact, SecurityDeployDecision, SecurityFindingComment, SecurityPolicy, SecurityPolicyRule, SecurityPostureFinding, SecurityPostureSummary, SecurityScanRun, SecuritySeverity, SecurityWaiver } from './types';
+export declare class SecurityPostureStore {
+    private readonly controlPlane;
+    private readonly nowFn;
+    private readonly idFn;
+    constructor(controlPlane: ControlPlaneStore, options?: {
+        now?: () => Date;
+        id?: () => string;
+    });
+    private now;
+    private run;
+    recordScan(input: RecordSecurityScanInput): {
+        run: SecurityScanRun;
+        findings: SecurityPostureFinding[];
+    };
+    getScanRun(id: string): SecurityScanRun | undefined;
+    listScanRuns(scope: {
+        organizationId: string;
+        projectId?: string;
+        environmentId?: string;
+        limit?: number;
+    }): SecurityScanRun[];
+    getFinding(id: string): SecurityPostureFinding | undefined;
+    listFindings(options: {
+        organizationId: string;
+        projectId?: string;
+        environmentId?: string;
+        status?: SecurityPostureFinding['status'];
+        severity?: SecuritySeverity;
+        limit?: number;
+    }): SecurityPostureFinding[];
+    assignFinding(findingId: string, ownerActorId: string | undefined, actorId?: string): SecurityPostureFinding;
+    acknowledgeFinding(findingId: string, actorId?: string): SecurityPostureFinding;
+    addComment(input: {
+        findingId: string;
+        actorId: string;
+        body: string;
+        referenceUrl?: string;
+    }): SecurityFindingComment;
+    listComments(findingId: string): SecurityFindingComment[];
+    createWaiver(input: {
+        findingId: string;
+        policyId?: string;
+        reason: string;
+        referenceUrl?: string;
+        expiresAt: string;
+        actorId: string;
+    }): SecurityWaiver;
+    revokeWaiver(id: string, actorId: string): SecurityWaiver;
+    getWaiver(id: string): SecurityWaiver | undefined;
+    listWaivers(findingId?: string): SecurityWaiver[];
+    expireWaivers(): number;
+    createPolicy(input: {
+        organizationId: string;
+        environmentId?: string;
+        name: string;
+        rules: SecurityPolicyRule[];
+        requiredScanners?: string[];
+        scannerFailMode: 'open' | 'closed';
+        actorId?: string;
+    }): SecurityPolicy;
+    updatePolicy(id: string, expectedVersion: number, input: {
+        name?: string;
+        rules?: SecurityPolicyRule[];
+        requiredScanners?: string[];
+        scannerFailMode?: 'open' | 'closed';
+        enabled?: boolean;
+        actorId?: string;
+    }): SecurityPolicy;
+    getPolicy(id: string): SecurityPolicy | undefined;
+    listPolicies(organizationId: string): SecurityPolicy[];
+    evaluateGate(input: EvaluateSecurityGateInput): SecurityDeployDecision;
+    getDecision(id: string): SecurityDeployDecision | undefined;
+    listDecisions(environmentId: string, limit?: number): SecurityDeployDecision[];
+    addReleaseArtifact(input: Omit<ReleaseSecurityArtifact, 'id' | 'createdAt'>): ReleaseSecurityArtifact;
+    listReleaseArtifacts(releaseId: string, includeSensitiveContent?: boolean): ReleaseSecurityArtifact[];
+    summary(organizationId: string, projectId?: string, environmentId?: string): SecurityPostureSummary;
+    exportPosture(organizationId: string): JsonValue;
+}

package/dist/security/posture-store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/pre-deploy-scanner.d.ts

@@ -1,7 +1,3 @@
-/**
- * Pre-Deployment Security Scanner
- * Scans source code for leaked secrets, credentials, and sensitive data before deployment
- */
 export interface SecretPattern {
     name: string;
     pattern: RegExp;

package/dist/security/scanners.d.ts

@@ -0,0 +1,81 @@
+import type { EvaluationResult } from '../aws/iam';
+import type { CallerIdentity } from '../aws/sts';
+import type { JsonValue } from '../control-plane';
+import type { SecurityPostureStore } from './posture-store';
+import type { PreDeployScanner } from './pre-deploy-scanner';
+import type { SecurityCheckStatus, SecurityFindingInput, SecurityScope } from './types';
+export interface SecurityScannerContext extends SecurityScope {
+    artifactRoot?: string;
+    imageRef?: string;
+    signal: AbortSignal;
+}
+export interface SecurityScannerResult {
+    status: SecurityCheckStatus;
+    findings: SecurityFindingInput[];
+    metadata?: JsonValue;
+    error?: string;
+}
+export interface SecurityScanner {
+    id: string;
+    version: string;
+    timeoutMs?: number;
+    scan: (context: SecurityScannerContext) => Promise<SecurityScannerResult>;
+}
+export interface SecurityScannerRunnerOptions {
+    defaultTimeoutMs?: number;
+    now?: () => Date;
+}
+export declare class SecurityScannerRunner {
+    private readonly posture;
+    private readonly defaultTimeoutMs;
+    private readonly nowFn;
+    constructor(posture: SecurityPostureStore, options?: SecurityScannerRunnerOptions);
+    run(scanner: SecurityScanner, scope: Omit<SecurityScannerContext, 'signal'>): Promise<ReturnType<SecurityPostureStore['recordScan']>>;
+    runAll(scanners: SecurityScanner[], scope: Omit<SecurityScannerContext, 'signal'>): Promise<Array<ReturnType<SecurityPostureStore['recordScan']>>>;
+}
+export declare class SecretFindingScanner implements SecurityScanner {
+    private readonly scanner;
+    readonly id = "source-secrets";
+    readonly version = "1.0.0";
+    readonly timeoutMs = 30000;
+    constructor(scanner?: PreDeployScanner);
+    scan(context: SecurityScannerContext): Promise<SecurityScannerResult>;
+}
+/** Runs Trivy locally with a deliberately minimal environment and never uploads source or reports. */
+export declare class TrivyImageScanner implements SecurityScanner {
+    readonly id = "trivy-image";
+    readonly version: string;
+    readonly timeoutMs: number;
+    constructor(options?: {
+        version?: string;
+        timeoutMs?: number;
+        executable?: string;
+    });
+    private readonly executable;
+    scan(context: SecurityScannerContext): Promise<SecurityScannerResult>;
+}
+export interface AwsCapabilityClient {
+    getCallerIdentity: () => Promise<CallerIdentity>;
+    simulatePrincipalPolicy: (input: {
+        PolicySourceArn: string;
+        ActionNames: string[];
+        ResourceArns?: string[];
+    }) => Promise<{
+        EvaluationResults: EvaluationResult[];
+    }>;
+}
+/** Validates the actual caller and required IAM actions instead of treating configured credentials as sufficient. */
+export declare class AwsIamCapabilityScanner implements SecurityScanner {
+    private readonly actions;
+    readonly id = "aws-iam-capabilities";
+    readonly version = "1.0.0";
+    readonly timeoutMs = 30000;
+    private readonly client;
+    constructor(actions: string[], options?: {
+        region?: string;
+        client?: AwsCapabilityClient;
+        resourceArns?: string[];
+    });
+    private readonly resourceArns;
+    scan(context: SecurityScannerContext): Promise<SecurityScannerResult>;
+}

package/dist/security/scanners.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/security/types.d.ts

@@ -0,0 +1,150 @@
+import type { JsonValue } from '../control-plane';
+export type SecuritySeverity = 'info' | 'low' | 'medium' | 'high' | 'critical';
+export type SecurityCheckStatus = 'passed' | 'failed' | 'skipped' | 'unavailable' | 'unsupported' | 'stale';
+export type SecurityFindingStatus = 'open' | 'acknowledged' | 'resolved' | 'waived';
+export type SecurityPolicyAction = 'block' | 'warn' | 'record';
+export interface SecurityScope {
+    organizationId: string;
+    projectId?: string;
+    environmentId?: string;
+    resourceId?: string;
+    releaseId?: string;
+}
+export interface SecurityFindingInput extends SecurityScope {
+    ruleId: string;
+    severity: SecuritySeverity;
+    title: string;
+    description: string;
+    evidence?: JsonValue;
+    remediation?: string;
+    subject: string;
+    fingerprint?: string;
+}
+export interface SecurityPostureFinding extends SecurityScope {
+    id: string;
+    fingerprint: string;
+    scanRunId: string;
+    scannerId: string;
+    scannerVersion: string;
+    ruleId: string;
+    severity: SecuritySeverity;
+    title: string;
+    description: string;
+    evidence: JsonValue;
+    remediation?: string;
+    subject: string;
+    status: SecurityFindingStatus;
+    ownerActorId?: string;
+    recurrenceCount: number;
+    firstSeenAt: string;
+    lastSeenAt: string;
+    resolvedAt?: string;
+    updatedAt: string;
+}
+export interface SecurityScanRun extends SecurityScope {
+    id: string;
+    scannerId: string;
+    scannerVersion: string;
+    status: SecurityCheckStatus;
+    error?: string;
+    metadata: JsonValue;
+    findingsCount: number;
+    startedAt: string;
+    completedAt: string;
+    durationMs: number;
+}
+export interface RecordSecurityScanInput extends SecurityScope {
+    scannerId: string;
+    scannerVersion: string;
+    status: SecurityCheckStatus;
+    findings?: SecurityFindingInput[];
+    error?: string;
+    metadata?: JsonValue;
+    startedAt?: string;
+    completedAt?: string;
+    durationMs?: number;
+}
+export interface SecurityPolicyRule {
+    minimumSeverity: SecuritySeverity;
+    action: SecurityPolicyAction;
+    scannerId?: string;
+}
+export interface SecurityPolicy {
+    id: string;
+    organizationId: string;
+    environmentId?: string;
+    name: string;
+    rules: SecurityPolicyRule[];
+    requiredScanners: string[];
+    scannerFailMode: 'open' | 'closed';
+    enabled: boolean;
+    version: number;
+    createdByActorId?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SecurityWaiver {
+    id: string;
+    findingId: string;
+    policyId?: string;
+    reason: string;
+    referenceUrl?: string;
+    createdByActorId: string;
+    expiresAt: string;
+    revokedAt?: string;
+    state: 'active' | 'expired' | 'revoked';
+    createdAt: string;
+    updatedAt: string;
+}
+export interface SecurityFindingComment {
+    id: string;
+    findingId: string;
+    actorId: string;
+    body: string;
+    referenceUrl?: string;
+    createdAt: string;
+}
+export interface ReleaseSecurityArtifact {
+    id: string;
+    organizationId: string;
+    projectId: string;
+    environmentId?: string;
+    releaseId: string;
+    kind: 'sbom' | 'vulnerability_summary' | 'signature' | 'provenance';
+    format: string;
+    digest: string;
+    summary: JsonValue;
+    content?: string;
+    sensitive: boolean;
+    createdAt: string;
+}
+export interface SecurityDeployDecision {
+    id: string;
+    organizationId: string;
+    projectId: string;
+    environmentId: string;
+    operationId?: string;
+    policyId: string;
+    policyVersion: number;
+    outcome: 'allow' | 'warn' | 'block';
+    scannerVersions: Record<string, string>;
+    findingIds: string[];
+    waiverIds: string[];
+    explanation: string;
+    createdAt: string;
+}
+export interface EvaluateSecurityGateInput {
+    organizationId: string;
+    projectId: string;
+    environmentId: string;
+    operationId?: string;
+    policyId?: string;
+    staleAfterMs?: number;
+}
+export interface SecurityPostureSummary {
+    open: Record<SecuritySeverity, number>;
+    waived: number;
+    resolved: number;
+    checks: Record<SecurityCheckStatus, number>;
+    lastScannedAt?: string;
+}

package/dist/source/git-workspace.d.ts

@@ -0,0 +1,26 @@
+import type { SourceBinding, SourceCredential, SourceDeployKey, SourceRef } from './types';
+export interface GitTransportOptions {
+    credential?: SourceCredential;
+    deployKey?: SourceDeployKey & {
+        privateKey: string;
+    };
+    executable?: string;
+    timeoutMs?: number;
+}
+export interface ClonedSource {
+    directory: string;
+    commitSha: string;
+}
+export declare function discoverGitRefs(remoteValue: string, options?: GitTransportOptions): Promise<{
+    branches: SourceRef[];
+    tags: SourceRef[];
+}>;
+/** Clone/fetch is argv-only, timeout-bounded, non-interactive, and never embeds credentials in the remote URL. */
+export declare function cloneSourceBinding(input: {
+    remote: string;
+    binding: SourceBinding;
+    destination: string;
+    ref?: string;
+    commitSha?: string;
+    sparsePaths?: string[];
+}, options?: GitTransportOptions): Promise<ClonedSource>;

package/dist/source/git-workspace.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/source/index.d.ts

@@ -0,0 +1,6 @@
+export * from './types';
+export * from './store';
+export * from './providers';
+export * from './webhooks';
+export * from './git-workspace';
+export * from './service';

package/dist/source/providers.d.ts

@@ -0,0 +1,199 @@
+import type { SourceCapabilities, SourceCommitStatus, SourceConnection, SourceConnectionTest, SourceCredential, SourceProvider, SourceProviderAdapter, SourceRefPage, SourceRepositoryPage, SourceWebhookRegistration } from './types';
+export declare class SourceProviderError extends Error {
+    readonly status?: number | undefined;
+    readonly retryAfterSeconds?: number | undefined;
+    constructor(message: string, status?: number | undefined, retryAfterSeconds?: number | undefined);
+}
+export interface SourceAdapterOptions {
+    fetch?: SourceFetch;
+    timeoutMs?: number;
+    now?: () => Date;
+}
+export type SourceFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+declare abstract class HostedSourceAdapter implements SourceProviderAdapter {
+    protected readonly connection: SourceConnection;
+    protected readonly credential: SourceCredential | undefined;
+    abstract readonly provider: SourceProvider;
+    readonly capabilities: SourceCapabilities;
+    protected readonly fetchFn: SourceFetch;
+    protected readonly timeoutMs: number;
+    protected readonly nowFn: () => Date;
+    constructor(connection: SourceConnection, credential: SourceCredential | undefined, options?: SourceAdapterOptions);
+    protected abstract apiRoot(): string;
+    protected abstract authorization(): Promise<Record<string, string>>;
+    protected request<T>(path: string, init?: RequestInit): Promise<{
+        data: T;
+        headers: Headers;
+    }>;
+    abstract testConnection(): Promise<SourceConnectionTest>;
+    abstract listRepositories(input?: {
+        cursor?: string;
+        search?: string;
+        limit?: number;
+    }): Promise<SourceRepositoryPage>;
+    abstract listBranches(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    abstract listTags(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    abstract createWebhook(repository: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    abstract listWebhooks(repository: string): Promise<SourceWebhookRegistration[]>;
+    abstract updateWebhook(repository: string, webhookId: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    deleteWebhook(repository: string, webhookId: string): Promise<void>;
+    abstract setCommitStatus(repository: string, commitSha: string, status: SourceCommitStatus): Promise<void>;
+    protected abstract webhookPath(repository: string, webhookId?: string): string;
+}
+export declare class GithubSourceAdapter extends HostedSourceAdapter {
+    readonly provider: 'github';
+    private installationToken?;
+    protected apiRoot(): string;
+    protected authorization(): Promise<Record<string, string>>;
+    testConnection(): Promise<SourceConnectionTest>;
+    listRepositories(input?: {
+        cursor?: string;
+        search?: string;
+        limit?: number;
+    }): Promise<SourceRepositoryPage>;
+    private refs;
+    listBranches(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    listTags(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    protected webhookPath(repository: string, webhookId?: string): string;
+    private hook;
+    createWebhook(repository: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    listWebhooks(repository: string): Promise<SourceWebhookRegistration[]>;
+    updateWebhook(repository: string, webhookId: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    setCommitStatus(repository: string, commitSha: string, status: SourceCommitStatus): Promise<void>;
+}
+export declare class GitlabSourceAdapter extends HostedSourceAdapter {
+    readonly provider: 'gitlab';
+    protected apiRoot(): string;
+    protected authorization(): Promise<Record<string, string>>;
+    testConnection(): Promise<SourceConnectionTest>;
+    listRepositories(input?: {
+        cursor?: string;
+        search?: string;
+        limit?: number;
+    }): Promise<SourceRepositoryPage>;
+    private refs;
+    listBranches(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    listTags(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    protected webhookPath(repository: string, webhookId?: string): string;
+    private hook;
+    private body;
+    createWebhook(repository: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    listWebhooks(repository: string): Promise<SourceWebhookRegistration[]>;
+    updateWebhook(repository: string, webhookId: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    setCommitStatus(repository: string, commitSha: string, status: SourceCommitStatus): Promise<void>;
+}
+export declare class BitbucketSourceAdapter extends HostedSourceAdapter {
+    readonly provider: 'bitbucket';
+    protected apiRoot(): string;
+    protected authorization(): Promise<Record<string, string>>;
+    testConnection(): Promise<SourceConnectionTest>;
+    listRepositories(input?: {
+        cursor?: string;
+        search?: string;
+        limit?: number;
+    }): Promise<SourceRepositoryPage>;
+    private refs;
+    listBranches(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    listTags(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    protected webhookPath(repository: string, webhookId?: string): string;
+    private hook;
+    private body;
+    createWebhook(repository: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    listWebhooks(repository: string): Promise<SourceWebhookRegistration[]>;
+    updateWebhook(repository: string, webhookId: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    setCommitStatus(repository: string, commitSha: string, status: SourceCommitStatus): Promise<void>;
+}
+export declare class GiteaSourceAdapter extends HostedSourceAdapter {
+    readonly provider: 'gitea';
+    readonly capabilities: SourceCapabilities;
+    protected apiRoot(): string;
+    protected authorization(): Promise<Record<string, string>>;
+    testConnection(): Promise<SourceConnectionTest>;
+    listRepositories(input?: {
+        cursor?: string;
+        search?: string;
+        limit?: number;
+    }): Promise<SourceRepositoryPage>;
+    private refs;
+    listBranches(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    listTags(repository: string, input?: {
+        cursor?: string;
+        limit?: number;
+    }): Promise<SourceRefPage>;
+    protected webhookPath(repository: string, webhookId?: string): string;
+    private hook;
+    private body;
+    createWebhook(repository: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    listWebhooks(repository: string): Promise<SourceWebhookRegistration[]>;
+    updateWebhook(repository: string, webhookId: string, input: {
+        url: string;
+        secret: string;
+        events: string[];
+    }): Promise<SourceWebhookRegistration>;
+    setCommitStatus(repository: string, commitSha: string, status: SourceCommitStatus): Promise<void>;
+}
+export declare function createSourceAdapter(connection: SourceConnection, credential?: SourceCredential, options?: SourceAdapterOptions): SourceProviderAdapter;
+export {};

package/dist/source/providers.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/source/service.d.ts

@@ -0,0 +1,18 @@
+import type { SourceConnectionStore } from './store';
+import type { SourceRefPage, SourceRepository, SourceWebhook } from './types';
+export declare function testSourceConnection(sources: SourceConnectionStore, connectionId: string, repositoryId?: string): Promise<ReturnType<SourceConnectionStore['updateHealth']>>;
+export declare function syncSourceRepositories(sources: SourceConnectionStore, connectionId: string, input?: {
+    search?: string;
+    maxPages?: number;
+}): Promise<SourceRepository[]>;
+export declare function listSourceReferences(sources: SourceConnectionStore, input: {
+    connectionId: string;
+    repository: string;
+    repositoryId?: string;
+    type: 'branches' | 'tags';
+    cursor?: string;
+    limit?: number;
+    deployKeyId?: string;
+}): Promise<SourceRefPage>;
+export declare function reconcileSourceWebhook(sources: SourceConnectionStore, webhookId: string, baseUrl: string): Promise<SourceWebhook>;
+export declare function removeSourceWebhook(sources: SourceConnectionStore, webhookId: string): Promise<SourceWebhook>;