@kici-dev/engine 0.1.14 → 0.1.16

package/dist/protocol/messages/platform-orchestrator.js

@@ -4,10 +4,8 @@ import { orchCapabilitiesSchema } from "./capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./auth.js";
 import { executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./execution-status.js";
 import { sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema } from "./source-registration.js";
-import { dashboardAccessLogListRequestSchema } from "./access-log.js";
-import { dashboardOrchLogsRequestSchema, jobContextMessageSchema, runEventMessageSchema } from "./run-events.js";
-import { globalWorkflowsGetRequestSchema, globalWorkflowsUpdateRequestSchema } from "./dashboard-global-workflows.js";
-import { backendGetRequestSchema, backendSyncRequestSchema, backendTestRequestSchema, backendsListRequestSchema, backendsSyncAllRequestSchema, dashboardDiagnosticsRequestSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardPayloadRequestSchema, dashboardRunDetailRequestSchema, dashboardScalerAgentsRequestSchema, dashboardScalerCapacityRequestSchema, dashboardStepLogsRequestSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, manualScheduleRequestSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationsListRequestSchema, runCancelRequestSchema, runRerunRequestSchema } from "./dashboard.js";
+import { jobContextMessageSchema, runEventMessageSchema } from "./run-events.js";
+import { dashboardPlatformToOrchSchema } from "./dashboard.js";
 import { z } from "zod";
 //#region src/protocol/messages/platform-orchestrator.ts
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
@@ -46,7 +44,18 @@ const trustPolicyUpdateSchema = z.object({
 		"read",
 		"write",
 		"admin"
-	]))
+	])),
+	/**
+	* Operator-defined teams and their member user ids. The orchestrator has no
+	* identity store, so team membership is delivered here (next to
+	* `identityLinks`) and cached in-memory. The approval resolver matches a
+	* `{team}` clause by looking up the team's members in this list.
+	* `.default([])` keeps an older Platform that doesn't send it valid.
+	*/
+	teamMemberships: z.array(z.object({
+		teamName: z.string(),
+		memberUserIds: z.array(z.string())
+	})).default([])
 });
 /**
 * Internal shape of a fully-reassembled, HMAC-verified webhook relay handed
@@ -329,57 +338,7 @@ const platformToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	peerDiscoverSchema,
 	peerUpdateSchema,
 	staleCheckrunCleanupSchema,
-	dashboardRunDetailRequestSchema,
-	dashboardStepLogsRequestSchema,
-	runRerunRequestSchema,
-	manualScheduleRequestSchema,
-	runCancelRequestSchema,
-	dashboardPayloadRequestSchema,
-	dashboardOrchLogsRequestSchema,
-	envListRequestSchema,
-	envGetRequestSchema,
-	envCreateRequestSchema,
-	envUpdateRequestSchema,
-	envDeleteRequestSchema,
-	envVarsListRequestSchema,
-	envVarSetRequestSchema,
-	envVarDeleteRequestSchema,
-	envSourceOverridesListRequestSchema,
-	envSourceOverrideSetRequestSchema,
-	envSourceOverrideDeleteRequestSchema,
-	envBindingsListRequestSchema,
-	envBindingsSetRequestSchema,
-	envSecretsListRequestSchema,
-	envSecretSetRequestSchema,
-	envSecretDeleteRequestSchema,
-	envSecretScopeCreateRequestSchema,
-	envSecretScopeRenameRequestSchema,
-	envSecretScopeDeleteRequestSchema,
-	envHistoryRequestSchema,
-	heldRunsListRequestSchema,
-	heldRunApproveRequestSchema,
-	heldRunRejectRequestSchema,
-	registrationsListRequestSchema,
-	registrationDisableRequestSchema,
-	registrationDeleteRequestSchema,
-	dashboardDiagnosticsRequestSchema,
-	dashboardScalerCapacityRequestSchema,
-	dashboardScalerAgentsRequestSchema,
-	backendsListRequestSchema,
-	backendGetRequestSchema,
-	backendsSyncAllRequestSchema,
-	backendSyncRequestSchema,
-	backendTestRequestSchema,
-	dashboardEventLogListRequestSchema,
-	dashboardEventLogDetailRequestSchema,
-	dashboardEventLogPayloadStreamRequestSchema,
-	dashboardEventDlqListRequestSchema,
-	dashboardEventDlqCountRequestSchema,
-	dashboardEventDlqRetryRequestSchema,
-	dashboardEventDlqDiscardRequestSchema,
-	globalWorkflowsGetRequestSchema,
-	globalWorkflowsUpdateRequestSchema,
-	dashboardAccessLogListRequestSchema
+	...dashboardPlatformToOrchSchema.options
 ]);
 /** All messages that flow from Orchestrator to Platform.
 *

package/dist/protocol/messages/run-events.d.ts

@@ -136,6 +136,7 @@ export declare const dashboardOrchLogsRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"platform_operator">;
         sub: z.ZodString;
         reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"system">;
         component: z.ZodString;

package/dist/provenance/schema.d.ts

@@ -0,0 +1,407 @@
+/**
+ * SLSA v1.0 build-provenance schema for KiCI.
+ *
+ * Models the in-toto Statement v1 envelope and the SLSA v1.0 provenance
+ * predicate as Zod schemas, plus a KiCI-specialized statement schema that pins
+ * the KiCI literals and types the KiCI-owned build parameters. This is the
+ * single source of truth shared by the agent (produces attestations) and the
+ * `kici verify-attestation` CLI (consumes them).
+ *
+ * Pure schema + types — no Node-only dependencies, so the dashboard can import
+ * it for typed artifact rendering. Exported at the subpath
+ * `@kici-dev/engine/provenance/schema`.
+ *
+ * Spec references:
+ *  - in-toto Statement v1: https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md
+ *  - SLSA v1.0 provenance:  https://slsa.dev/spec/v1.0/provenance
+ */
+import { z } from 'zod';
+/** in-toto Statement `_type` value (pinned). */
+export declare const IN_TOTO_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+/** SLSA v1.0 provenance `predicateType` value (pinned). */
+export declare const SLSA_PROVENANCE_PREDICATE_TYPE = "https://slsa.dev/provenance/v1";
+/** KiCI workflow `buildType` URI (we own this namespace). */
+export declare const KICI_WORKFLOW_BUILD_TYPE = "https://kici.dev/buildtypes/workflow/v1";
+/**
+ * Known digest algorithms KiCI emits or tests reference. The digest map itself
+ * (`digestSetSchema`) keeps its keys open for forward-compatibility; this enum
+ * documents the common set so producer code and tests don't repeat literals.
+ */
+export declare const DigestAlgorithm: z.ZodEnum<{
+    sha256: "sha256";
+    sha512: "sha512";
+    sha1: "sha1";
+    gitCommit: "gitCommit";
+    dirHash: "dirHash";
+}>;
+export type DigestAlgorithm = z.infer<typeof DigestAlgorithm>;
+/**
+ * in-toto digest set: a map of algorithm name → lowercase-hex digest. Keys are
+ * open (forward-compat); at least one entry is required.
+ */
+export declare const digestSetSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+export type DigestSet = z.infer<typeof digestSetSchema>;
+/**
+ * in-toto ResourceDescriptor. Reused for `resolvedDependencies` and
+ * `byproducts`. Per spec, at least one of name / uri / digest must be present.
+ */
+export declare const resourceDescriptorSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    uri: z.ZodOptional<z.ZodString>;
+    digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    content: z.ZodOptional<z.ZodString>;
+    downloadLocation: z.ZodOptional<z.ZodString>;
+    mediaType: z.ZodOptional<z.ZodString>;
+    annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type ResourceDescriptor = z.infer<typeof resourceDescriptorSchema>;
+/**
+ * in-toto Statement subject entry: a resource descriptor that MUST carry a
+ * digest (the verifier matches the subject digest against the artifact).
+ */
+export declare const subjectSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    uri: z.ZodOptional<z.ZodString>;
+    digest: z.ZodRecord<z.ZodString, z.ZodString>;
+    mediaType: z.ZodOptional<z.ZodString>;
+    annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type Subject = z.infer<typeof subjectSchema>;
+/** SLSA `builder`: identity of the build platform. `id` is a required URI. */
+export declare const builderSchema: z.ZodObject<{
+    id: z.ZodString;
+    builderDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodOptional<z.ZodString>;
+        digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        downloadLocation: z.ZodOptional<z.ZodString>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    version: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type Builder = z.infer<typeof builderSchema>;
+/** SLSA `metadata`: build-invocation metadata. */
+export declare const buildMetadataSchema: z.ZodObject<{
+    invocationId: z.ZodOptional<z.ZodString>;
+    startedOn: z.ZodOptional<z.ZodString>;
+    finishedOn: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type BuildMetadata = z.infer<typeof buildMetadataSchema>;
+/** SLSA `buildDefinition`. `buildType` + `externalParameters` are required. */
+export declare const buildDefinitionSchema: z.ZodObject<{
+    buildType: z.ZodString;
+    externalParameters: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    internalParameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    resolvedDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodOptional<z.ZodString>;
+        digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        downloadLocation: z.ZodOptional<z.ZodString>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type BuildDefinition = z.infer<typeof buildDefinitionSchema>;
+/** SLSA `runDetails`. `builder` is required. */
+export declare const runDetailsSchema: z.ZodObject<{
+    builder: z.ZodObject<{
+        id: z.ZodString;
+        builderDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            uri: z.ZodOptional<z.ZodString>;
+            digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            content: z.ZodOptional<z.ZodString>;
+            downloadLocation: z.ZodOptional<z.ZodString>;
+            mediaType: z.ZodOptional<z.ZodString>;
+            annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+        version: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        invocationId: z.ZodOptional<z.ZodString>;
+        startedOn: z.ZodOptional<z.ZodString>;
+        finishedOn: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    byproducts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodOptional<z.ZodString>;
+        digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        downloadLocation: z.ZodOptional<z.ZodString>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type RunDetails = z.infer<typeof runDetailsSchema>;
+/** SLSA v1.0 provenance predicate. */
+export declare const slsaProvenancePredicateSchema: z.ZodObject<{
+    buildDefinition: z.ZodObject<{
+        buildType: z.ZodString;
+        externalParameters: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        internalParameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        resolvedDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            uri: z.ZodOptional<z.ZodString>;
+            digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            content: z.ZodOptional<z.ZodString>;
+            downloadLocation: z.ZodOptional<z.ZodString>;
+            mediaType: z.ZodOptional<z.ZodString>;
+            annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+    runDetails: z.ZodObject<{
+        builder: z.ZodObject<{
+            id: z.ZodString;
+            builderDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                uri: z.ZodOptional<z.ZodString>;
+                digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                content: z.ZodOptional<z.ZodString>;
+                downloadLocation: z.ZodOptional<z.ZodString>;
+                mediaType: z.ZodOptional<z.ZodString>;
+                annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strip>>>;
+            version: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>;
+        metadata: z.ZodOptional<z.ZodObject<{
+            invocationId: z.ZodOptional<z.ZodString>;
+            startedOn: z.ZodOptional<z.ZodString>;
+            finishedOn: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        byproducts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            uri: z.ZodOptional<z.ZodString>;
+            digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            content: z.ZodOptional<z.ZodString>;
+            downloadLocation: z.ZodOptional<z.ZodString>;
+            mediaType: z.ZodOptional<z.ZodString>;
+            annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SlsaProvenancePredicate = z.infer<typeof slsaProvenancePredicateSchema>;
+/** Predicate-agnostic in-toto Statement v1 envelope. */
+export declare const inTotoStatementSchema: z.ZodObject<{
+    _type: z.ZodLiteral<"https://in-toto.io/Statement/v1">;
+    subject: z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodOptional<z.ZodString>;
+        digest: z.ZodRecord<z.ZodString, z.ZodString>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>;
+    predicateType: z.ZodString;
+    predicate: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export type InTotoStatement = z.infer<typeof inTotoStatementSchema>;
+/** KiCI workflow external parameters: the workflow source coordinates. */
+export declare const kiciWorkflowExternalParametersSchema: z.ZodObject<{
+    workflow: z.ZodObject<{
+        repository: z.ZodString;
+        ref: z.ZodString;
+        path: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$loose>;
+export type KiciWorkflowExternalParameters = z.infer<typeof kiciWorkflowExternalParametersSchema>;
+/** KiCI workflow internal parameters: run-scoped build context. */
+export declare const kiciWorkflowInternalParametersSchema: z.ZodObject<{
+    commit: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+    jobId: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type KiciWorkflowInternalParameters = z.infer<typeof kiciWorkflowInternalParametersSchema>;
+/** KiCI build definition: pins the buildType and types the workflow params. */
+export declare const kiciBuildDefinitionSchema: z.ZodObject<{
+    resolvedDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodOptional<z.ZodString>;
+        digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        downloadLocation: z.ZodOptional<z.ZodString>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    buildType: z.ZodLiteral<"https://kici.dev/buildtypes/workflow/v1">;
+    externalParameters: z.ZodObject<{
+        workflow: z.ZodObject<{
+            repository: z.ZodString;
+            ref: z.ZodString;
+            path: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$loose>;
+    internalParameters: z.ZodOptional<z.ZodObject<{
+        commit: z.ZodOptional<z.ZodString>;
+        runId: z.ZodOptional<z.ZodString>;
+        jobId: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$strip>;
+export type KiciBuildDefinition = z.infer<typeof kiciBuildDefinitionSchema>;
+/** KiCI run details: types builder.version with the KiCI component versions. */
+export declare const kiciRunDetailsSchema: z.ZodObject<{
+    metadata: z.ZodOptional<z.ZodObject<{
+        invocationId: z.ZodOptional<z.ZodString>;
+        startedOn: z.ZodOptional<z.ZodString>;
+        finishedOn: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    byproducts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodOptional<z.ZodString>;
+        digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        content: z.ZodOptional<z.ZodString>;
+        downloadLocation: z.ZodOptional<z.ZodString>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    builder: z.ZodObject<{
+        id: z.ZodString;
+        builderDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            uri: z.ZodOptional<z.ZodString>;
+            digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            content: z.ZodOptional<z.ZodString>;
+            downloadLocation: z.ZodOptional<z.ZodString>;
+            mediaType: z.ZodOptional<z.ZodString>;
+            annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+        version: z.ZodOptional<z.ZodObject<{
+            'kici-orchestrator': z.ZodString;
+            'kici-agent': z.ZodString;
+        }, z.core.$loose>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type KiciRunDetails = z.infer<typeof kiciRunDetailsSchema>;
+/** KiCI SLSA provenance predicate. */
+export declare const kiciProvenancePredicateSchema: z.ZodObject<{
+    buildDefinition: z.ZodObject<{
+        resolvedDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            uri: z.ZodOptional<z.ZodString>;
+            digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            content: z.ZodOptional<z.ZodString>;
+            downloadLocation: z.ZodOptional<z.ZodString>;
+            mediaType: z.ZodOptional<z.ZodString>;
+            annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+        buildType: z.ZodLiteral<"https://kici.dev/buildtypes/workflow/v1">;
+        externalParameters: z.ZodObject<{
+            workflow: z.ZodObject<{
+                repository: z.ZodString;
+                ref: z.ZodString;
+                path: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$loose>;
+        internalParameters: z.ZodOptional<z.ZodObject<{
+            commit: z.ZodOptional<z.ZodString>;
+            runId: z.ZodOptional<z.ZodString>;
+            jobId: z.ZodOptional<z.ZodString>;
+        }, z.core.$loose>>;
+    }, z.core.$strip>;
+    runDetails: z.ZodObject<{
+        metadata: z.ZodOptional<z.ZodObject<{
+            invocationId: z.ZodOptional<z.ZodString>;
+            startedOn: z.ZodOptional<z.ZodString>;
+            finishedOn: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        byproducts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            uri: z.ZodOptional<z.ZodString>;
+            digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            content: z.ZodOptional<z.ZodString>;
+            downloadLocation: z.ZodOptional<z.ZodString>;
+            mediaType: z.ZodOptional<z.ZodString>;
+            annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+        builder: z.ZodObject<{
+            id: z.ZodString;
+            builderDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                uri: z.ZodOptional<z.ZodString>;
+                digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                content: z.ZodOptional<z.ZodString>;
+                downloadLocation: z.ZodOptional<z.ZodString>;
+                mediaType: z.ZodOptional<z.ZodString>;
+                annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strip>>>;
+            version: z.ZodOptional<z.ZodObject<{
+                'kici-orchestrator': z.ZodString;
+                'kici-agent': z.ZodString;
+            }, z.core.$loose>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type KiciProvenancePredicate = z.infer<typeof kiciProvenancePredicateSchema>;
+/** KiCI provenance Statement: pins `_type` + `predicateType` + KiCI predicate. */
+export declare const kiciProvenanceStatementSchema: z.ZodObject<{
+    _type: z.ZodLiteral<"https://in-toto.io/Statement/v1">;
+    subject: z.ZodArray<z.ZodObject<{
+        name: z.ZodOptional<z.ZodString>;
+        uri: z.ZodOptional<z.ZodString>;
+        digest: z.ZodRecord<z.ZodString, z.ZodString>;
+        mediaType: z.ZodOptional<z.ZodString>;
+        annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>;
+    predicateType: z.ZodLiteral<"https://slsa.dev/provenance/v1">;
+    predicate: z.ZodObject<{
+        buildDefinition: z.ZodObject<{
+            resolvedDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                uri: z.ZodOptional<z.ZodString>;
+                digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                content: z.ZodOptional<z.ZodString>;
+                downloadLocation: z.ZodOptional<z.ZodString>;
+                mediaType: z.ZodOptional<z.ZodString>;
+                annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strip>>>;
+            buildType: z.ZodLiteral<"https://kici.dev/buildtypes/workflow/v1">;
+            externalParameters: z.ZodObject<{
+                workflow: z.ZodObject<{
+                    repository: z.ZodString;
+                    ref: z.ZodString;
+                    path: z.ZodString;
+                }, z.core.$strip>;
+            }, z.core.$loose>;
+            internalParameters: z.ZodOptional<z.ZodObject<{
+                commit: z.ZodOptional<z.ZodString>;
+                runId: z.ZodOptional<z.ZodString>;
+                jobId: z.ZodOptional<z.ZodString>;
+            }, z.core.$loose>>;
+        }, z.core.$strip>;
+        runDetails: z.ZodObject<{
+            metadata: z.ZodOptional<z.ZodObject<{
+                invocationId: z.ZodOptional<z.ZodString>;
+                startedOn: z.ZodOptional<z.ZodString>;
+                finishedOn: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            byproducts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                name: z.ZodOptional<z.ZodString>;
+                uri: z.ZodOptional<z.ZodString>;
+                digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                content: z.ZodOptional<z.ZodString>;
+                downloadLocation: z.ZodOptional<z.ZodString>;
+                mediaType: z.ZodOptional<z.ZodString>;
+                annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strip>>>;
+            builder: z.ZodObject<{
+                id: z.ZodString;
+                builderDependencies: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    name: z.ZodOptional<z.ZodString>;
+                    uri: z.ZodOptional<z.ZodString>;
+                    digest: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                    content: z.ZodOptional<z.ZodString>;
+                    downloadLocation: z.ZodOptional<z.ZodString>;
+                    mediaType: z.ZodOptional<z.ZodString>;
+                    annotations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+                }, z.core.$strip>>>;
+                version: z.ZodOptional<z.ZodObject<{
+                    'kici-orchestrator': z.ZodString;
+                    'kici-agent': z.ZodString;
+                }, z.core.$loose>>;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type KiciProvenanceStatement = z.infer<typeof kiciProvenanceStatementSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/provenance/schema.js

@@ -0,0 +1,143 @@
+import "../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/provenance/schema.ts
+/**
+* SLSA v1.0 build-provenance schema for KiCI.
+*
+* Models the in-toto Statement v1 envelope and the SLSA v1.0 provenance
+* predicate as Zod schemas, plus a KiCI-specialized statement schema that pins
+* the KiCI literals and types the KiCI-owned build parameters. This is the
+* single source of truth shared by the agent (produces attestations) and the
+* `kici verify-attestation` CLI (consumes them).
+*
+* Pure schema + types — no Node-only dependencies, so the dashboard can import
+* it for typed artifact rendering. Exported at the subpath
+* `@kici-dev/engine/provenance/schema`.
+*
+* Spec references:
+*  - in-toto Statement v1: https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md
+*  - SLSA v1.0 provenance:  https://slsa.dev/spec/v1.0/provenance
+*/
+/** in-toto Statement `_type` value (pinned). */
+const IN_TOTO_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+/** SLSA v1.0 provenance `predicateType` value (pinned). */
+const SLSA_PROVENANCE_PREDICATE_TYPE = "https://slsa.dev/provenance/v1";
+/** KiCI workflow `buildType` URI (we own this namespace). */
+const KICI_WORKFLOW_BUILD_TYPE = "https://kici.dev/buildtypes/workflow/v1";
+/**
+* Known digest algorithms KiCI emits or tests reference. The digest map itself
+* (`digestSetSchema`) keeps its keys open for forward-compatibility; this enum
+* documents the common set so producer code and tests don't repeat literals.
+*/
+const DigestAlgorithm = z.enum([
+	"sha256",
+	"sha512",
+	"sha1",
+	"gitCommit",
+	"dirHash"
+]);
+/** Lowercase hex string (in-toto requires lowercase-hex digest encoding). */
+const lowercaseHex = z.string().regex(/^[0-9a-f]+$/, "digest value must be lowercase hex");
+/**
+* in-toto digest set: a map of algorithm name → lowercase-hex digest. Keys are
+* open (forward-compat); at least one entry is required.
+*/
+const digestSetSchema = z.record(z.string().min(1), lowercaseHex).refine((d) => Object.keys(d).length > 0, { message: "digest must contain at least one algorithm" });
+/**
+* in-toto ResourceDescriptor. Reused for `resolvedDependencies` and
+* `byproducts`. Per spec, at least one of name / uri / digest must be present.
+*/
+const resourceDescriptorSchema = z.object({
+	name: z.string().optional(),
+	uri: z.string().optional(),
+	digest: digestSetSchema.optional(),
+	content: z.string().optional(),
+	downloadLocation: z.string().optional(),
+	mediaType: z.string().optional(),
+	annotations: z.record(z.string(), z.unknown()).optional()
+}).refine((rd) => rd.name !== void 0 || rd.uri !== void 0 || rd.digest !== void 0, { message: "resource descriptor requires at least one of name, uri, or digest" });
+/**
+* in-toto Statement subject entry: a resource descriptor that MUST carry a
+* digest (the verifier matches the subject digest against the artifact).
+*/
+const subjectSchema = z.object({
+	name: z.string().optional(),
+	uri: z.string().optional(),
+	digest: digestSetSchema,
+	mediaType: z.string().optional(),
+	annotations: z.record(z.string(), z.unknown()).optional()
+});
+/** SLSA `builder`: identity of the build platform. `id` is a required URI. */
+const builderSchema = z.object({
+	id: z.string(),
+	builderDependencies: z.array(resourceDescriptorSchema).optional(),
+	version: z.record(z.string(), z.string()).optional()
+});
+/** SLSA `metadata`: build-invocation metadata. */
+const buildMetadataSchema = z.object({
+	invocationId: z.string().optional(),
+	startedOn: z.string().datetime({ offset: true }).optional(),
+	finishedOn: z.string().datetime({ offset: true }).optional()
+});
+/** SLSA `buildDefinition`. `buildType` + `externalParameters` are required. */
+const buildDefinitionSchema = z.object({
+	buildType: z.string(),
+	externalParameters: z.record(z.string(), z.unknown()),
+	internalParameters: z.record(z.string(), z.unknown()).optional(),
+	resolvedDependencies: z.array(resourceDescriptorSchema).optional()
+});
+/** SLSA `runDetails`. `builder` is required. */
+const runDetailsSchema = z.object({
+	builder: builderSchema,
+	metadata: buildMetadataSchema.optional(),
+	byproducts: z.array(resourceDescriptorSchema).optional()
+});
+/** SLSA v1.0 provenance predicate. */
+const slsaProvenancePredicateSchema = z.object({
+	buildDefinition: buildDefinitionSchema,
+	runDetails: runDetailsSchema
+});
+/** Predicate-agnostic in-toto Statement v1 envelope. */
+const inTotoStatementSchema = z.object({
+	_type: z.literal(IN_TOTO_STATEMENT_TYPE),
+	subject: z.array(subjectSchema).min(1),
+	predicateType: z.string(),
+	predicate: z.record(z.string(), z.unknown())
+});
+/** KiCI workflow external parameters: the workflow source coordinates. */
+const kiciWorkflowExternalParametersSchema = z.object({ workflow: z.object({
+	repository: z.string(),
+	ref: z.string(),
+	path: z.string()
+}) }).passthrough();
+/** KiCI workflow internal parameters: run-scoped build context. */
+const kiciWorkflowInternalParametersSchema = z.object({
+	commit: z.string().optional(),
+	runId: z.string().optional(),
+	jobId: z.string().optional()
+}).passthrough();
+/** KiCI build definition: pins the buildType and types the workflow params. */
+const kiciBuildDefinitionSchema = buildDefinitionSchema.extend({
+	buildType: z.literal(KICI_WORKFLOW_BUILD_TYPE),
+	externalParameters: kiciWorkflowExternalParametersSchema,
+	internalParameters: kiciWorkflowInternalParametersSchema.optional()
+});
+/** KiCI run details: types builder.version with the KiCI component versions. */
+const kiciRunDetailsSchema = runDetailsSchema.extend({ builder: builderSchema.extend({ version: z.object({
+	"kici-orchestrator": z.string(),
+	"kici-agent": z.string()
+}).passthrough().optional() }) });
+/** KiCI SLSA provenance predicate. */
+const kiciProvenancePredicateSchema = z.object({
+	buildDefinition: kiciBuildDefinitionSchema,
+	runDetails: kiciRunDetailsSchema
+});
+/** KiCI provenance Statement: pins `_type` + `predicateType` + KiCI predicate. */
+const kiciProvenanceStatementSchema = inTotoStatementSchema.extend({
+	predicateType: z.literal(SLSA_PROVENANCE_PREDICATE_TYPE),
+	predicate: kiciProvenancePredicateSchema
+});
+//#endregion
+export { DigestAlgorithm, IN_TOTO_STATEMENT_TYPE, KICI_WORKFLOW_BUILD_TYPE, SLSA_PROVENANCE_PREDICATE_TYPE, buildDefinitionSchema, buildMetadataSchema, builderSchema, digestSetSchema, inTotoStatementSchema, kiciBuildDefinitionSchema, kiciProvenancePredicateSchema, kiciProvenanceStatementSchema, kiciRunDetailsSchema, kiciWorkflowExternalParametersSchema, kiciWorkflowInternalParametersSchema, resourceDescriptorSchema, runDetailsSchema, slsaProvenancePredicateSchema, subjectSchema };
+
+//# sourceMappingURL=schema.js.map

package/dist/provider/index.d.ts

@@ -14,6 +14,7 @@
 export type { ProviderType } from './types.js';
 export type { WebhookNormalizer, AccessCacheInvalidation } from './webhook-normalizer.js';
 export type { LockFileFetcher } from './lock-file-fetcher.js';
+export { LockFileParseError } from './lock-file-parse-error.js';
 export type { ChangedFilesFetcher } from './changed-files-fetcher.js';
 export type { CloneTokenProvider, ProviderGitAuth } from './clone-token-provider.js';
 export type { RepoUrlBuilder } from './repo-url-builder.js';

package/dist/provider/index.js

@@ -1,3 +1,4 @@
 import "../chunk-gOLHoazu.js";
+import { LockFileParseError } from "./lock-file-parse-error.js";
 import { CheckRunConclusion } from "./check-run-conclusion.js";
-export { CheckRunConclusion };
+export { CheckRunConclusion, LockFileParseError };