@kici-dev/engine 0.1.15 → 0.1.17

package/dist/provenance/verify.js

@@ -0,0 +1,135 @@
+import "../chunk-BTugEXQM.js";
+import { dssePae } from "./dsse.js";
+import { kiciBundleSchema } from "./bundle.js";
+import { kiciProvenanceStatementSchema } from "./schema.js";
+import { calculateJwkThumbprint, createLocalJWKSet, importJWK, jwtVerify } from "jose";
+//#region src/provenance/verify.ts
+/**
+* Shared, browser-safe verification core for KiCI provenance bundles (Mode A).
+*
+* Given a KiCI-signed bundle, the Platform JWKS, and an out-of-band trusted
+* issuer, `verifyKiciBundle` establishes the full Mode-A chain offline:
+*
+*  - the identity JWT verifies against the supplied JWKS with `iss` PINNED to
+*    the caller-supplied `expectedIssuer` (never the token's own `iss`) and the
+*    audience checked;
+*  - the DSSE envelope verifies against the ephemeral public key carried in the
+*    bundle, whose `keyid` must equal its RFC 7638 JWK thumbprint;
+*  - the in-toto statement's build context must equal the (server-truth) JWT
+*    claims — a mismatch is a HARD FAIL, the check that makes the agent-built
+*    statement sound;
+*  - when an artifact digest is supplied, a subject digest must match it.
+*
+* The core uses only `jose` (isomorphic) and `crypto.subtle`/`atob`/`TextDecoder`
+* (present in modern browsers and Node 24) — no `node:fs`, no `fetch`, no
+* `Buffer` — so the exact same function runs in the `kici verify-attestation`
+* CLI and the dashboard's verified badge. Exported at the subpath
+* `@kici-dev/engine/provenance/verify`; it is deliberately NOT re-exported from
+* the engine barrel (the barrel must stay free of the `jose` dependency).
+*/
+/** Browser-safe base64 → bytes (no Buffer — this module is imported by the dashboard). */
+function b64ToBytes(b64) {
+	return Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+}
+/**
+* Verify a KiCI provenance bundle offline. Returns a structured result; throws
+* only on a programming-level error, never for a verification failure (a failed
+* verification is `verified:false` with populated `failures`).
+*/
+async function verifyKiciBundle(opts) {
+	const checks = {
+		schema: "skipped",
+		jwt: "skipped",
+		dsse: "skipped",
+		buildContext: "skipped",
+		digest: "skipped"
+	};
+	const failures = [];
+	if (opts.bundle?.mediaType !== "application/vnd.kici.provenance.bundle+json;version=0.1") return {
+		verified: false,
+		mode: "sigstore",
+		checks,
+		failures: ["mode_b_unsupported"]
+	};
+	const parsed = kiciBundleSchema.safeParse(opts.bundle);
+	if (!parsed.success) {
+		checks.schema = "fail";
+		return {
+			verified: false,
+			mode: "kici",
+			checks,
+			failures: ["bundle_schema_invalid"]
+		};
+	}
+	const bundle = parsed.data;
+	checks.schema = "pass";
+	const statementBytes = b64ToBytes(bundle.dsseEnvelope.payload);
+	let statement;
+	const stmt = kiciProvenanceStatementSchema.safeParse(JSON.parse(new TextDecoder().decode(statementBytes)));
+	if (!stmt.success) {
+		checks.schema = "fail";
+		failures.push("statement_schema_invalid");
+	} else statement = stmt.data;
+	let claims;
+	try {
+		const { payload } = await jwtVerify(bundle.verificationMaterial.identityToken, createLocalJWKSet(opts.jwks), {
+			issuer: opts.expectedIssuer,
+			audience: opts.expectedAudience
+		});
+		claims = payload;
+		checks.jwt = "pass";
+	} catch {
+		checks.jwt = "fail";
+		failures.push("identity_token_invalid");
+	}
+	try {
+		const pubJwk = bundle.verificationMaterial.publicKey;
+		const thumbprint = await calculateJwkThumbprint(pubJwk, "sha256");
+		if (bundle.dsseEnvelope.signatures[0].keyid !== thumbprint) throw new Error("keyid does not match public-key thumbprint");
+		const key = await importJWK(pubJwk, "ES256");
+		if (!await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, key, b64ToBytes(bundle.dsseEnvelope.signatures[0].sig), dssePae(bundle.dsseEnvelope.payloadType, statementBytes))) throw new Error("bad signature");
+		checks.dsse = "pass";
+	} catch {
+		checks.dsse = "fail";
+		failures.push("dsse_signature_invalid");
+	}
+	if (statement && claims) {
+		const ok = crossCheckBuildContext(statement, claims);
+		checks.buildContext = ok ? "pass" : "fail";
+		if (!ok) failures.push("build_context_mismatch");
+	} else {
+		checks.buildContext = "fail";
+		failures.push("build_context_uncheckable");
+	}
+	if (opts.expectedDigest && statement) {
+		const ok = checkSubjectDigest(statement, opts.expectedDigest);
+		checks.digest = ok ? "pass" : "fail";
+		if (!ok) failures.push("subject_digest_mismatch");
+	}
+	return {
+		verified: checks.schema === "pass" && checks.jwt === "pass" && checks.dsse === "pass" && checks.buildContext === "pass" && checks.digest !== "fail",
+		mode: "kici",
+		checks,
+		claims,
+		statement,
+		failures
+	};
+}
+/** The statement's build context must equal the (server-truth) JWT claims. */
+function crossCheckBuildContext(statement, claims) {
+	const bd = statement.predicate.buildDefinition;
+	const wf = bd.externalParameters.workflow;
+	const ip = bd.internalParameters ?? {};
+	return wf.repository === claims.repository && wf.ref === claims.ref && wf.path === claims.workflow_ref && ip.commit === claims.sha && ip.runId === claims.kici_run_id && ip.jobId === claims.kici_job_id;
+}
+/** At least one subject must carry a digest matching the supplied artifact digest. */
+function checkSubjectDigest(statement, expected) {
+	return statement.subject.some((s) => s.digest[expected.alg] === expected.hex);
+}
+//#endregion
+export { verifyKiciBundle };
+
+//# sourceMappingURL=verify.js.map

package/dist/provider/changed-files-fetcher.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/check-run-conclusion.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/provider/check-run-conclusion.ts
 /**

package/dist/provider/check-status-poster.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/clone-token-provider.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/contributor-resolver.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { LockFileParseError } from "./lock-file-parse-error.js";
 import { CheckRunConclusion } from "./check-run-conclusion.js";
 export { CheckRunConclusion, LockFileParseError };

package/dist/provider/lock-file-fetcher.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/lock-file-parse-error.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/provider/lock-file-parse-error.ts
 /**
 * Thrown by a LockFileFetcher when a lock file is present at the repo ref but
@@ -8,6 +8,8 @@ import "../chunk-gOLHoazu.js";
 * `lock_resolution` init-failure run.
 */
 var LockFileParseError = class LockFileParseError extends Error {
+	repoIdentifier;
+	ref;
 	name = "LockFileParseError";
 	constructor(repoIdentifier, ref, message) {
 		super(message);

package/dist/provider/repo-url-builder.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/types.d.ts

@@ -4,6 +4,6 @@
  * These types are the foundation for all provider interfaces.
  * Keep this minimal -- only types needed by multiple interfaces belong here.
  */
-/** Identifies a git hosting provider, generic webhook source, or internal test provider. */
-export type ProviderType = 'github' | 'gitlab' | 'bitbucket' | 'generic' | 'internal';
+/** Identifies a git hosting provider, generic webhook source, or local filesystem (`file://`) source. */
+export type ProviderType = 'github' | 'gitlab' | 'bitbucket' | 'generic' | 'local';
 //# sourceMappingURL=types.d.ts.map

package/dist/provider/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/webhook-normalizer.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/registration/registerable-trigger-type.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/registration/registerable-trigger-type.ts
 /**

package/dist/scaler/resource-types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/scaler/resource-types.ts
 /**

package/dist/scaler/scaler-backend-type.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/scaler/scaler-backend-type.ts
 /**

package/dist/secrets/index.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/secrets/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/state-machine/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { isTerminal, transition } from "./machine.js";
 export { isTerminal, transition };

package/dist/state-machine/machine.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { TERMINAL_STATES } from "./types.js";
 //#region src/state-machine/machine.ts
 /**

package/dist/state-machine/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/state-machine/types.ts
 /**
 * States from which no further transitions are possible.

package/dist/trigger/decision-trace.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/trigger/decision-trace.ts
 /**
 * Create a new trace entry.

package/dist/trigger/jsonpath-matcher.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { JSONPath } from "jsonpath-plus";
 //#region src/trigger/jsonpath-matcher.ts
 /**

package/dist/trigger/matcher.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { createTraceEntry, createWorkflowDecision } from "./decision-trace.js";
 import { matchJsonPath, matchJsonPathNot } from "./jsonpath-matcher.js";
 import picomatch from "picomatch";

package/dist/trigger/trigger-event-type.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/trigger/trigger-event-type.ts
 /**
 * Canonical trigger event types with human-readable metadata.

package/dist/trigger/types.d.ts

@@ -10,11 +10,27 @@
  * Schema version 11: adds LockInlineValue type for pure function inline evaluation.
  * Schema version 14: adds declarative cache specs to LockJob and LockStep.
  * Schema version 15: adds per-job init config(s) to LockJob.
+ * Schema version 16: adds normalized approval config to LockWorkflow/LockJob/LockStep.
+ * Schema version 17: widens LockJob.init to typed presets ('mise' / { mise }) and 'auto' detection.
  */
 import { z } from 'zod';
 import type { ProviderType } from '../provider/types.js';
+import type { ApproverClause } from '../approval/types.js';
 /** Schema version - increment on breaking changes */
-export declare const SCHEMA_VERSION: 15;
+export declare const SCHEMA_VERSION: 17;
+/**
+ * Normalized approval config carried in the lock file. Produced by the compiler
+ * from an SDK `requireApproval` at any of the three levels; consumed by the
+ * orchestrator dispatch gate (and the agent step round-trip for step scope).
+ */
+export interface LockApproval {
+    /** AND list of approver clauses; empty means "any approval-capable member". */
+    readonly clauses: ApproverClause[];
+    /** Human label for the gate. */
+    readonly reason?: string;
+    /** Per-gate expiry override (seconds); falls back to the org default. */
+    readonly timeoutSeconds?: number;
+}
 /**
  * Source file reference with meaningful path.
  * Format: file is relative path from git root, export uses hash syntax.
@@ -315,6 +331,8 @@ export interface LockStep {
         readonly line: number;
         readonly column: number;
     };
+    /** Normalized approval gate; when set the step pauses for a human approval. */
+    readonly approval?: LockApproval;
 }
 /**
  * Inline expression value for pure dynamic functions.
@@ -329,6 +347,17 @@ export interface LockInlineValue {
 }
 /** Type guard for inline expression values */
 export declare function isLockInlineValue(value: unknown): value is LockInlineValue;
+/**
+ * Per-edge failure policy for a `needs` dependency: `skip` propagates an
+ * upstream failure to the downstream job (default), `run` runs the downstream
+ * job regardless of the upstream outcome. Single source of truth for this
+ * value across lock-file schemas and protocol messages.
+ */
+export declare const IfFailedPolicy: z.ZodEnum<{
+    run: "run";
+    skip: "skip";
+}>;
+export type IfFailedPolicy = z.infer<typeof IfFailedPolicy>;
 /**
  * Needs entry with per-edge failure policy.
  * Used in lock file needs arrays for explicit ifFailed override.
@@ -391,6 +420,8 @@ export interface LockJob {
      * (`requests`) and kernel-side enforcement (`limits`) on the spawned agent.
      */
     readonly resources?: import('../scaler/resource-types.js').ResourceRequest;
+    /** Normalized approval gate; when set the job is held before dispatch. */
+    readonly approval?: LockApproval;
 }
 /**
  * Dynamic job generator reference.
@@ -460,6 +491,8 @@ export interface LockWorkflow {
     };
     /** Whole-run wall-clock timeout in milliseconds. Read by the orchestrator at run creation to set the run deadline. */
     readonly timeout?: number;
+    /** Normalized approval gate; when set the whole run is held before any job dispatches. */
+    readonly approval?: LockApproval;
 }
 /**
  * Complete lock file structure.

package/dist/trigger/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/trigger/types.ts
 /**
@@ -13,20 +13,29 @@ import { z } from "zod";
 * Schema version 11: adds LockInlineValue type for pure function inline evaluation.
 * Schema version 14: adds declarative cache specs to LockJob and LockStep.
 * Schema version 15: adds per-job init config(s) to LockJob.
+* Schema version 16: adds normalized approval config to LockWorkflow/LockJob/LockStep.
+* Schema version 17: widens LockJob.init to typed presets ('mise' / { mise }) and 'auto' detection.
 */
 /** Schema version - increment on breaking changes */
-const SCHEMA_VERSION = 15;
+const SCHEMA_VERSION = 17;
 /** Type guard for inline expression values */
 function isLockInlineValue(value) {
 	return typeof value === "object" && value !== null && value._type === "inline";
 }
 /**
+* Per-edge failure policy for a `needs` dependency: `skip` propagates an
+* upstream failure to the downstream job (default), `run` runs the downstream
+* job regardless of the upstream outcome. Single source of truth for this
+* value across lock-file schemas and protocol messages.
+*/
+const IfFailedPolicy = z.enum(["skip", "run"]);
+/**
 * Needs entry with per-edge failure policy.
 * Used in lock file needs arrays for explicit ifFailed override.
 */
 const NeedsEntrySchema = z.object({
 	name: z.string(),
-	ifFailed: z.enum(["skip", "run"]).default("skip")
+	ifFailed: IfFailedPolicy.default(IfFailedPolicy.enum.skip)
 });
 /**
 * Needs group entry with per-edge failure policy.
@@ -34,7 +43,7 @@ const NeedsEntrySchema = z.object({
 */
 const NeedsGroupEntrySchema = z.object({
 	group: z.string(),
-	ifFailed: z.enum(["skip", "run"]).default("skip")
+	ifFailed: IfFailedPolicy.default(IfFailedPolicy.enum.skip)
 });
 /** Type guard for static jobs */
 function isLockStaticJob(job) {
@@ -45,6 +54,6 @@ function isLockDynamicJobFn(job) {
 	return job._type === "dynamic";
 }
 //#endregion
-export { NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob };
+export { IfFailedPolicy, NeedsEntrySchema, NeedsGroupEntrySchema, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob };
 
 //# sourceMappingURL=types.js.map

package/dist/webhook/signature.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/webhook/signature.ts
 /**

package/dist/ws/close-codes.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/ws/close-codes.ts
 /**
 * Unified WebSocket close codes for KiCI connections.

package/dist/ws/rate-limiter.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/ws/rate-limiter.ts
 /**
 * WebSocket rate limiter with two-tier token bucket (messages + bytes).
@@ -18,6 +18,8 @@ import "../chunk-gOLHoazu.js";
 * When tokens are exhausted, returns a retryAfterMs estimate.
 */
 var TokenBucket = class {
+	capacity;
+	refillRate;
 	tokens;
 	lastRefill;
 	constructor(capacity, refillRate) {

package/dist/ws/ws-like.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",
@@ -65,6 +65,26 @@
       "import": "./dist/protocol/cluster-name.js",
       "types": "./dist/protocol/cluster-name.d.ts"
     },
+    "./protocol/messages/oidc-token-relay": {
+      "import": "./dist/protocol/messages/oidc-token-relay.js",
+      "types": "./dist/protocol/messages/oidc-token-relay.d.ts"
+    },
+    "./provenance/schema": {
+      "import": "./dist/provenance/schema.js",
+      "types": "./dist/provenance/schema.d.ts"
+    },
+    "./provenance/dsse": {
+      "import": "./dist/provenance/dsse.js",
+      "types": "./dist/provenance/dsse.d.ts"
+    },
+    "./provenance/bundle": {
+      "import": "./dist/provenance/bundle.js",
+      "types": "./dist/provenance/bundle.d.ts"
+    },
+    "./provenance/verify": {
+      "import": "./dist/provenance/verify.js",
+      "types": "./dist/provenance/verify.d.ts"
+    },
     "./metrics/catalog": {
       "import": "./dist/metrics/metric-catalog.generated.js",
       "types": "./dist/metrics/metric-catalog.generated.d.ts"
@@ -75,6 +95,8 @@
     }
   },
   "dependencies": {
+    "fast-cartesian": "^9.0.1",
+    "jose": "^6.1.0",
     "jsonpath-plus": "^10.4.0",
     "picomatch": "^4.0.4",
     "zod": "^4.3.6"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.1.15",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.15/f9f3b4dd-cddc-43ee-a94e-621967a6b013",
+  "name": "@kici-dev/engine@0.1.17",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.17/6284c0d2-b9a6-423e-bed6-92121170fef3",
   "creationInfo": {
-    "created": "2026-06-11T03:03:20Z",
+    "created": "2026-06-14T12:30:15Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.15",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,12 +65,52 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.15"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.17"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
+    {
+      "SPDXID": "SPDXRef-Package-fast-cartesian-9.0.1",
+      "name": "fast-cartesian",
+      "versionInfo": "9.0.1",
+      "downloadLocation": "https://registry.npmjs.org/fast-cartesian/-/fast-cartesian-9.0.1.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "Apache-2.0",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/fast-cartesian@9.0.1"
+        }
+      ],
+      "description": "Fast cartesian product",
+      "homepage": "https://www.github.com/ehmicky/fast-cartesian"
+    },
+    {
+      "SPDXID": "SPDXRef-Package-jose-6.2.3",
+      "name": "jose",
+      "versionInfo": "6.2.3",
+      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/jose@6.2.3"
+        }
+      ],
+      "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
+      "homepage": "https://github.com/panva/jose"
+    },
     {
       "SPDXID": "SPDXRef-Package-jsep-1.4.0",
       "name": "jsep",
@@ -168,6 +208,16 @@
       "relatedSpdxElement": "SPDXRef-Package-jsep-1.4.0",
       "relationshipType": "DEPENDS_ON"
     },
+    {
+      "spdxElementId": "SPDXRef-RootPackage",
+      "relatedSpdxElement": "SPDXRef-Package-fast-cartesian-9.0.1",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-RootPackage",
+      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
+      "relationshipType": "DEPENDS_ON"
+    },
     {
       "spdxElementId": "SPDXRef-RootPackage",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",