@kici-dev/engine 0.0.0 → 0.1.1

package/dist/webhook/signature.js

@@ -0,0 +1,32 @@
+import "../chunk-gOLHoazu.js";
+import { createHmac, timingSafeEqual } from "node:crypto";
+//#region src/webhook/signature.ts
+/**
+* Verify GitHub webhook signature using HMAC-SHA256.
+*
+* @param body - Raw webhook payload body (as string)
+* @param signature - Signature from X-Hub-Signature-256 header
+* @param secret - Webhook secret configured on GitHub
+* @returns true if signature is valid, false otherwise
+*
+* Security:
+* - Uses crypto.timingSafeEqual to prevent timing attacks
+* - Validates signature format before comparison
+* - Handles length mismatches before timingSafeEqual (which throws on length mismatch)
+*/
+function verifySignature(body, signature, secret) {
+	if (!signature.startsWith("sha256=")) return false;
+	const providedHex = signature.slice(7);
+	const hmac = createHmac("sha256", secret);
+	hmac.update(body, "utf8");
+	const expectedHex = hmac.digest("hex");
+	if (providedHex.length !== expectedHex.length) return false;
+	const providedBuffer = Buffer.from(providedHex, "hex");
+	const expectedBuffer = Buffer.from(expectedHex, "hex");
+	if (providedBuffer.length !== expectedBuffer.length) return false;
+	return timingSafeEqual(providedBuffer, expectedBuffer);
+}
+//#endregion
+export { verifySignature };
+
+//# sourceMappingURL=signature.js.map

package/dist/ws/close-codes.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Unified WebSocket close codes for KiCI connections.
+ * Single source of truth — replaces duplicate definitions in other KiCI packages.
+ *
+ * Standard codes (1000-1015) are defined by RFC 6455.
+ * Custom codes (4000-4999) are reserved for application use.
+ */
+/** The endpoint is going away (e.g., server shutdown or browser navigating away). */
+export declare const WS_CLOSE_GOING_AWAY = 1001;
+/** The connection was closed because the client failed authentication. */
+export declare const WS_CLOSE_UNAUTHORIZED = 4001;
+/** The connection was closed because the auth timeout expired. */
+export declare const WS_CLOSE_AUTH_TIMEOUT = 4002;
+/** The connection was closed due to an invalid or unparseable message. */
+export declare const WS_CLOSE_INVALID_MESSAGE = 4003;
+/** The connection was closed because the heartbeat timed out. */
+export declare const WS_CLOSE_HEARTBEAT_TIMEOUT = 4004;
+/** The connection was closed due to a protocol-level error. */
+export declare const WS_CLOSE_PROTOCOL_ERROR = 4005;
+/** The connection was closed due to an unexpected internal server error. */
+export declare const WS_CLOSE_INTERNAL_ERROR = 4006;
+/** The connection was closed because the agent token authentication failed. */
+export declare const WS_CLOSE_AGENT_AUTH_FAILED = 4010;
+/** The connection was closed because the organization has reached its plan limit. */
+export declare const WS_CLOSE_PLAN_LIMIT = 4020;
+/** The connection was closed because the requested run was not found. */
+export declare const WS_CLOSE_RUN_NOT_FOUND = 4030;
+//# sourceMappingURL=close-codes.d.ts.map

package/dist/ws/close-codes.js

@@ -0,0 +1,33 @@
+import "../chunk-gOLHoazu.js";
+//#region src/ws/close-codes.ts
+/**
+* Unified WebSocket close codes for KiCI connections.
+* Single source of truth — replaces duplicate definitions in other KiCI packages.
+*
+* Standard codes (1000-1015) are defined by RFC 6455.
+* Custom codes (4000-4999) are reserved for application use.
+*/
+/** The endpoint is going away (e.g., server shutdown or browser navigating away). */
+const WS_CLOSE_GOING_AWAY = 1001;
+/** The connection was closed because the client failed authentication. */
+const WS_CLOSE_UNAUTHORIZED = 4001;
+/** The connection was closed because the auth timeout expired. */
+const WS_CLOSE_AUTH_TIMEOUT = 4002;
+/** The connection was closed due to an invalid or unparseable message. */
+const WS_CLOSE_INVALID_MESSAGE = 4003;
+/** The connection was closed because the heartbeat timed out. */
+const WS_CLOSE_HEARTBEAT_TIMEOUT = 4004;
+/** The connection was closed due to a protocol-level error. */
+const WS_CLOSE_PROTOCOL_ERROR = 4005;
+/** The connection was closed due to an unexpected internal server error. */
+const WS_CLOSE_INTERNAL_ERROR = 4006;
+/** The connection was closed because the agent token authentication failed. */
+const WS_CLOSE_AGENT_AUTH_FAILED = 4010;
+/** The connection was closed because the organization has reached its plan limit. */
+const WS_CLOSE_PLAN_LIMIT = 4020;
+/** The connection was closed because the requested run was not found. */
+const WS_CLOSE_RUN_NOT_FOUND = 4030;
+//#endregion
+export { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED };
+
+//# sourceMappingURL=close-codes.js.map

package/dist/ws/rate-limiter.d.ts

@@ -0,0 +1,86 @@
+/**
+ * WebSocket rate limiter with two-tier token bucket (messages + bytes).
+ *
+ * Provides defense-in-depth against DoS by limiting:
+ * - Message count per second (burst capacity + refill)
+ * - Byte throughput per second (burst capacity + refill)
+ * - Hard message size limit (4MB default)
+ *
+ * Heartbeats are exempt from rate limiting.
+ * Sustained violations (>5s default) result in disconnect.
+ */
+/**
+ * Token bucket algorithm for rate limiting.
+ *
+ * Supports burst up to `capacity` tokens, refilling at `refillRate` tokens/second.
+ * When tokens are exhausted, returns a retryAfterMs estimate.
+ */
+export declare class TokenBucket {
+    private readonly capacity;
+    private readonly refillRate;
+    private tokens;
+    private lastRefill;
+    constructor(capacity: number, refillRate: number);
+    /**
+     * Try to consume `amount` tokens.
+     * @returns `{ allowed: true }` if tokens available, or `{ allowed: false, retryAfterMs }`.
+     */
+    consume(amount?: number): {
+        allowed: boolean;
+        retryAfterMs?: number;
+    };
+    /**
+     * Check if `amount` tokens are available without consuming them.
+     * @returns `{ allowed: true }` if tokens available, or `{ allowed: false, retryAfterMs }`.
+     */
+    peek(amount?: number): {
+        allowed: boolean;
+        retryAfterMs?: number;
+    };
+    private refill;
+}
+export interface RateLimiterConfig {
+    /** Maximum burst of messages. Default: 200 */
+    messageCapacity?: number;
+    /** Message refill rate per second. Default: 100 */
+    messageRefillRate?: number;
+    /** Maximum burst of bytes. Default: 2MB */
+    bytesCapacity?: number;
+    /** Bytes refill rate per second. Default: 500KB */
+    bytesRefillRate?: number;
+    /** Hard message size limit in bytes. Default: 4MB */
+    maxMessageSize?: number;
+    /** Time in ms of sustained violation before disconnect. Default: 5000 */
+    disconnectAfterMs?: number;
+}
+export interface RateLimitResult {
+    allowed: boolean;
+    action: 'allow' | 'warn' | 'disconnect';
+    retryAfterMs?: number;
+    reason?: string;
+}
+/**
+ * Two-tier WebSocket rate limiter.
+ *
+ * Checks both message count and byte throughput independently.
+ * Heartbeats are exempt. Oversized messages trigger immediate disconnect.
+ * Sustained violations (exceeding `disconnectAfterMs`) trigger disconnect.
+ */
+export declare class WsRateLimiter {
+    private readonly messages;
+    private readonly bytes;
+    private violationStart;
+    private readonly maxMessageSize;
+    private readonly bytesCapacity;
+    private readonly disconnectAfterMs;
+    constructor(config?: RateLimiterConfig);
+    /**
+     * Check if a message is allowed through.
+     *
+     * @param messageSize - Size of the message in bytes
+     * @param isHeartbeat - Whether this is a heartbeat message (exempt from limiting)
+     * @returns Rate limit decision with action and optional retryAfterMs
+     */
+    check(messageSize: number, isHeartbeat: boolean): RateLimitResult;
+}
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/ws/rate-limiter.js

@@ -0,0 +1,136 @@
+import "../chunk-gOLHoazu.js";
+//#region src/ws/rate-limiter.ts
+/**
+* WebSocket rate limiter with two-tier token bucket (messages + bytes).
+*
+* Provides defense-in-depth against DoS by limiting:
+* - Message count per second (burst capacity + refill)
+* - Byte throughput per second (burst capacity + refill)
+* - Hard message size limit (4MB default)
+*
+* Heartbeats are exempt from rate limiting.
+* Sustained violations (>5s default) result in disconnect.
+*/
+/**
+* Token bucket algorithm for rate limiting.
+*
+* Supports burst up to `capacity` tokens, refilling at `refillRate` tokens/second.
+* When tokens are exhausted, returns a retryAfterMs estimate.
+*/
+var TokenBucket = class {
+	tokens;
+	lastRefill;
+	constructor(capacity, refillRate) {
+		this.capacity = capacity;
+		this.refillRate = refillRate;
+		this.tokens = capacity;
+		this.lastRefill = Date.now();
+	}
+	/**
+	* Try to consume `amount` tokens.
+	* @returns `{ allowed: true }` if tokens available, or `{ allowed: false, retryAfterMs }`.
+	*/
+	consume(amount = 1) {
+		this.refill();
+		if (this.tokens >= amount) {
+			this.tokens -= amount;
+			return { allowed: true };
+		}
+		const deficit = amount - this.tokens;
+		return {
+			allowed: false,
+			retryAfterMs: Math.ceil(deficit / this.refillRate * 1e3)
+		};
+	}
+	/**
+	* Check if `amount` tokens are available without consuming them.
+	* @returns `{ allowed: true }` if tokens available, or `{ allowed: false, retryAfterMs }`.
+	*/
+	peek(amount = 1) {
+		this.refill();
+		if (this.tokens >= amount) return { allowed: true };
+		const deficit = amount - this.tokens;
+		return {
+			allowed: false,
+			retryAfterMs: Math.ceil(deficit / this.refillRate * 1e3)
+		};
+	}
+	refill() {
+		const now = Date.now();
+		const elapsed = (now - this.lastRefill) / 1e3;
+		this.tokens = Math.min(this.capacity, this.tokens + elapsed * this.refillRate);
+		this.lastRefill = now;
+	}
+};
+/**
+* Two-tier WebSocket rate limiter.
+*
+* Checks both message count and byte throughput independently.
+* Heartbeats are exempt. Oversized messages trigger immediate disconnect.
+* Sustained violations (exceeding `disconnectAfterMs`) trigger disconnect.
+*/
+var WsRateLimiter = class {
+	messages;
+	bytes;
+	violationStart = null;
+	maxMessageSize;
+	bytesCapacity;
+	disconnectAfterMs;
+	constructor(config) {
+		const bytesCapacity = config?.bytesCapacity ?? 2 * 1024 * 1024;
+		this.messages = new TokenBucket(config?.messageCapacity ?? 200, config?.messageRefillRate ?? 100);
+		this.bytes = new TokenBucket(bytesCapacity, config?.bytesRefillRate ?? 500 * 1024);
+		this.maxMessageSize = config?.maxMessageSize ?? 4 * 1024 * 1024;
+		this.bytesCapacity = bytesCapacity;
+		this.disconnectAfterMs = config?.disconnectAfterMs ?? 5e3;
+	}
+	/**
+	* Check if a message is allowed through.
+	*
+	* @param messageSize - Size of the message in bytes
+	* @param isHeartbeat - Whether this is a heartbeat message (exempt from limiting)
+	* @returns Rate limit decision with action and optional retryAfterMs
+	*/
+	check(messageSize, isHeartbeat) {
+		if (isHeartbeat) return {
+			allowed: true,
+			action: "allow"
+		};
+		if (messageSize > this.maxMessageSize) return {
+			allowed: false,
+			action: "disconnect",
+			reason: "Message too large"
+		};
+		if (messageSize > this.bytesCapacity) return {
+			allowed: false,
+			action: "disconnect",
+			reason: "Message exceeds byte burst capacity"
+		};
+		const msgResult = this.messages.peek(1);
+		const byteResult = this.bytes.peek(messageSize);
+		if (msgResult.allowed && byteResult.allowed) {
+			this.messages.consume(1);
+			this.bytes.consume(messageSize);
+			this.violationStart = null;
+			return {
+				allowed: true,
+				action: "allow"
+			};
+		}
+		if (this.violationStart === null) this.violationStart = Date.now();
+		if (Date.now() - this.violationStart > this.disconnectAfterMs) return {
+			allowed: false,
+			action: "disconnect",
+			reason: "Sustained rate limit violation"
+		};
+		return {
+			allowed: false,
+			action: "warn",
+			retryAfterMs: Math.max(msgResult.retryAfterMs ?? 0, byteResult.retryAfterMs ?? 0)
+		};
+	}
+};
+//#endregion
+export { TokenBucket, WsRateLimiter };
+
+//# sourceMappingURL=rate-limiter.js.map

package/dist/ws/ws-like.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Minimal WebSocket interface for testability.
+ *
+ * Avoids importing framework-specific types so registries and handlers
+ * can be unit-tested with plain mock objects.
+ */
+export interface WsLike {
+    send(data: string | ArrayBuffer): void;
+    close(code?: number, reason?: string): void;
+    readyState: number;
+}
+//# sourceMappingURL=ws-like.d.ts.map

package/dist/ws/ws-like.js

@@ -0,0 +1,2 @@
+import "../chunk-gOLHoazu.js";
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.0.0",
+  "version": "0.1.1",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "kici",
@@ -9,17 +9,65 @@
     "ci-cd",
     "typescript",
     "workflows",
-    "devops"
+    "devops",
+    "engine",
+    "protocol"
   ],
   "homepage": "https://kici.dev",
   "author": {
     "name": "KiCI",
     "email": "hello@kici.dev"
   },
-  "license": "Apache-2.0",
-  "main": "index.js",
+  "license": "AGPL-3.0-only",
+  "engines": {
+    "node": ">=24"
+  },
+  "type": "module",
+  "files": [
+    "dist",
+    "!dist/**/*.map",
+    "sbom.spdx.json"
+  ],
   "publishConfig": {
-    "access": "public",
-    "registry": "https://registry.npmjs.org/"
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./trigger/trigger-event-type": {
+      "import": "./dist/trigger/trigger-event-type.js",
+      "types": "./dist/trigger/trigger-event-type.d.ts"
+    },
+    "./webhook/signature": {
+      "import": "./dist/webhook/signature.js",
+      "types": "./dist/webhook/signature.d.ts"
+    },
+    "./protocol/dashboard-global-workflows": {
+      "import": "./dist/protocol/dashboard-global-workflows.js",
+      "types": "./dist/protocol/dashboard-global-workflows.d.ts"
+    },
+    "./metrics/catalog": {
+      "import": "./dist/metrics/metric-catalog.generated.js",
+      "types": "./dist/metrics/metric-catalog.generated.d.ts"
+    }
+  },
+  "scripts": {
+    "build": "node ../../scripts/build-ts.mjs && tsc --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npx tsx ../../hack/generate-sbom.ts --package packages/engine --name @kici-dev/engine"
+  },
+  "dependencies": {
+    "jsonpath-plus": "^10.4.0",
+    "picomatch": "^4.0.4",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@types/node": "^24.12.0"
   }
 }

package/sbom.spdx.json

@@ -0,0 +1,202 @@
+{
+  "spdxVersion": "SPDX-2.3",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "name": "@kici-dev/engine@0.1.1",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.1/65f9a13a-ac0d-4133-8799-a7d4789d528d",
+  "creationInfo": {
+    "created": "2026-05-15T10:53:18Z",
+    "creators": [
+      "Tool: kici-sbom-generator"
+    ]
+  },
+  "packages": [
+    {
+      "SPDXID": "SPDXRef-Package--jsep-plugin-assignment-1.3.0",
+      "name": "@jsep-plugin/assignment",
+      "versionInfo": "1.3.0",
+      "downloadLocation": "https://registry.npmjs.org/@jsep-plugin/assignment/-/assignment-1.3.0.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/%40jsep-plugin/assignment@1.3.0"
+        }
+      ],
+      "description": "Adds assignment expression support",
+      "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/assignment#readme"
+    },
+    {
+      "SPDXID": "SPDXRef-Package--jsep-plugin-regex-1.0.4",
+      "name": "@jsep-plugin/regex",
+      "versionInfo": "1.0.4",
+      "downloadLocation": "https://registry.npmjs.org/@jsep-plugin/regex/-/regex-1.0.4.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/%40jsep-plugin/regex@1.0.4"
+        }
+      ],
+      "description": "Adds regex expression support",
+      "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
+    },
+    {
+      "SPDXID": "SPDXRef-RootPackage",
+      "name": "@kici-dev/engine",
+      "versionInfo": "0.1.1",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "AGPL-3.0-only",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.1"
+        }
+      ],
+      "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
+      "homepage": "https://kici.dev"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-jsep-1.4.0",
+      "name": "jsep",
+      "versionInfo": "1.4.0",
+      "downloadLocation": "https://registry.npmjs.org/jsep/-/jsep-1.4.0.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/jsep@1.4.0"
+        }
+      ],
+      "description": "a tiny JavaScript expression parser",
+      "homepage": "https://ericsmekens.github.io/jsep/"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-jsonpath-plus-10.4.0",
+      "name": "jsonpath-plus",
+      "versionInfo": "10.4.0",
+      "downloadLocation": "https://registry.npmjs.org/jsonpath-plus/-/jsonpath-plus-10.4.0.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/jsonpath-plus@10.4.0"
+        }
+      ],
+      "description": "A JS implementation of JSONPath with some additional operators",
+      "homepage": "https://github.com/s3u/JSONPath"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-picomatch-4.0.4",
+      "name": "picomatch",
+      "versionInfo": "4.0.4",
+      "downloadLocation": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/picomatch@4.0.4"
+        }
+      ],
+      "description": "Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.",
+      "homepage": "https://github.com/micromatch/picomatch"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-zod-4.3.6",
+      "name": "zod",
+      "versionInfo": "4.3.6",
+      "downloadLocation": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/zod@4.3.6"
+        }
+      ],
+      "description": "TypeScript-first schema declaration and validation library with static type inference",
+      "homepage": "https://zod.dev"
+    }
+  ],
+  "relationships": [
+    {
+      "spdxElementId": "SPDXRef-DOCUMENT",
+      "relatedSpdxElement": "SPDXRef-RootPackage",
+      "relationshipType": "DESCRIBES"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--jsep-plugin-assignment-1.3.0",
+      "relatedSpdxElement": "SPDXRef-Package-jsep-1.4.0",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--jsep-plugin-regex-1.0.4",
+      "relatedSpdxElement": "SPDXRef-Package-jsep-1.4.0",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-RootPackage",
+      "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-RootPackage",
+      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-RootPackage",
+      "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-jsonpath-plus-10.4.0",
+      "relatedSpdxElement": "SPDXRef-Package--jsep-plugin-assignment-1.3.0",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-jsonpath-plus-10.4.0",
+      "relatedSpdxElement": "SPDXRef-Package--jsep-plugin-regex-1.0.4",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package-jsonpath-plus-10.4.0",
+      "relatedSpdxElement": "SPDXRef-Package-jsep-1.4.0",
+      "relationshipType": "DEPENDS_ON"
+    }
+  ]
+}

package/index.js

@@ -1,3 +0,0 @@
-// Stub for @kici-dev/engine@0.0.0. Reserved name on npmjs.org.
-// Real implementation ships at v0.1.0+ — see https://kici.dev
-module.exports = {};