@kici-dev/engine 0.1.16 → 0.1.17

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -352,6 +352,28 @@ export declare const cacheUserSaveCompleteSchema: z.ZodObject<{
     tarHash: z.ZodString;
     sizeBytes: z.ZodNumber;
 }, z.core.$strip>;
+/** Agent -> Orchestrator: request a presigned PUT URL for a provenance bundle. */
+export declare const provenanceUploadRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.request">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectDigest: z.ZodString;
+}, z.core.$strip>;
+/** Orchestrator -> Agent: presigned PUT URL for the provenance bundle. */
+export declare const provenanceUploadResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.response">;
+    requestId: z.ZodString;
+    uploadUrl: z.ZodString;
+}, z.core.$strip>;
+/** Agent -> Orchestrator: confirm a provenance bundle upload (records an attestations row). */
+export declare const provenanceUploadCompleteSchema: z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.complete">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    mediaType: z.ZodString;
+}, z.core.$strip>;
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 export declare const eventEmitSchema: z.ZodObject<{
     type: z.ZodLiteral<"event.emit">;
@@ -601,6 +623,10 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     requestId: z.ZodString;
     uploadUrl: z.ZodOptional<z.ZodString>;
     skip: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.response">;
+    requestId: z.ZodString;
+    uploadUrl: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"event.emit.response">;
     requestId: z.ZodString;
@@ -804,6 +830,18 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     key: z.ZodString;
     tarHash: z.ZodString;
     sizeBytes: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.request">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectDigest: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.complete">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    mediaType: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"event.emit">;
     jobId: z.ZodString;
@@ -882,6 +920,9 @@ export type CacheUserRestoreResponse = z.infer<typeof cacheUserRestoreResponseSc
 export type CacheUserSaveRequest = z.infer<typeof cacheUserSaveRequestSchema>;
 export type CacheUserSaveResponse = z.infer<typeof cacheUserSaveResponseSchema>;
 export type CacheUserSaveComplete = z.infer<typeof cacheUserSaveCompleteSchema>;
+export type ProvenanceUploadRequest = z.infer<typeof provenanceUploadRequestSchema>;
+export type ProvenanceUploadResponse = z.infer<typeof provenanceUploadResponseSchema>;
+export type ProvenanceUploadComplete = z.infer<typeof provenanceUploadCompleteSchema>;
 export type FleetLogsRequest = z.infer<typeof fleetLogsRequestSchema>;
 export type FleetBundleChunk = z.infer<typeof fleetBundleChunkSchema>;
 export type FleetBundleError = z.infer<typeof fleetBundleErrorSchema>;

package/dist/protocol/messages/orchestrator-agent.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { ExecutionJobStatus, ExecutionStepStatus } from "./execution-status.js";
 import { approverClauseSchema } from "../../approval/types.js";
 import { z } from "zod";
@@ -471,6 +471,34 @@ const cacheUserSaveCompleteSchema = z.object({
 	/** Tarball size in bytes (drives quota accounting). */
 	sizeBytes: z.number().int().nonnegative()
 });
+/** Agent -> Orchestrator: request a presigned PUT URL for a provenance bundle. */
+const provenanceUploadRequestSchema = z.object({
+	type: z.literal("provenance.upload.request"),
+	messageId: z.string(),
+	/** Job producing the attestation (ownership-checked; runId resolved server-side). */
+	jobId: z.string(),
+	/** Primary subject digest (lowercase hex) — the storage-key discriminator. */
+	subjectDigest: z.string()
+});
+/** Orchestrator -> Agent: presigned PUT URL for the provenance bundle. */
+const provenanceUploadResponseSchema = z.object({
+	type: z.literal("provenance.upload.response"),
+	requestId: z.string(),
+	/** Presigned PUT URL, or '' when storage is unavailable. */
+	uploadUrl: z.string()
+});
+/** Agent -> Orchestrator: confirm a provenance bundle upload (records an attestations row). */
+const provenanceUploadCompleteSchema = z.object({
+	type: z.literal("provenance.upload.complete"),
+	messageId: z.string(),
+	jobId: z.string(),
+	/** Caller-supplied artifact name. */
+	subjectName: z.string(),
+	/** Primary subject digest (lowercase hex). */
+	subjectDigest: z.string(),
+	/** Bundle media type. */
+	mediaType: z.string()
+});
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 const eventEmitSchema = z.object({
 	type: z.literal("event.emit"),
@@ -640,6 +668,7 @@ const orchestratorToAgentMessageSchema = z.discriminatedUnion("type", [
 	cacheUploadResponseSchema,
 	cacheUserRestoreResponseSchema,
 	cacheUserSaveResponseSchema,
+	provenanceUploadResponseSchema,
 	eventEmitResponseSchema,
 	agentApiResponseSchema,
 	agentAuthSuccessSchema,
@@ -665,6 +694,8 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	cacheUserRestoreRequestSchema,
 	cacheUserSaveRequestSchema,
 	cacheUserSaveCompleteSchema,
+	provenanceUploadRequestSchema,
+	provenanceUploadCompleteSchema,
 	eventEmitSchema,
 	agentApiRequestSchema,
 	agentMetricsSchema,
@@ -674,6 +705,6 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	stepApprovalRequestSchema
 ]);
 //#endregion
-export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema };
+export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/peer.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { ExecutionJobStatus } from "./execution-status.js";
 import { ScalerEventType } from "./scaler-event.js";
 import { z } from "zod";

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -410,6 +410,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     type: z.ZodLiteral<"auth.success">;
     connectionId: z.ZodString;
     orgPublicAlias: z.ZodOptional<z.ZodString>;
+    orgId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"auth.failure">;
     reason: z.ZodString;
@@ -492,6 +493,29 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     runId: z.ZodString;
     jobId: z.ZodString;
     stepIndex: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"dashboard.attestations.list">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.runs.list">;
     requestId: z.ZodString;
@@ -702,6 +726,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         type: z.ZodLiteral<"system">;
         component: z.ZodString;
     }, z.core.$strip>], "type">;
+    includeSecrets: z.ZodOptional<z.ZodBoolean>;
+    orgId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.environments.get">;
     requestId: z.ZodString;
@@ -749,8 +775,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     }, z.core.$strip>], "type">;
     name: z.ZodString;
     envType: z.ZodEnum<{
-        fixed: "fixed";
         glob: "glob";
+        fixed: "fixed";
     }>;
     globPattern: z.ZodOptional<z.ZodString>;
     branchRestrictions: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -789,8 +815,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     updates: z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
         envType: z.ZodOptional<z.ZodEnum<{
-            fixed: "fixed";
             glob: "glob";
+            fixed: "fixed";
         }>>;
         globPattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         branchRestrictions: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
@@ -1830,9 +1856,11 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "run.payload.read": "run.payload.read";
         "run.orch_logs.read": "run.orch_logs.read";
         "step.logs.read": "step.logs.read";
+        "attestations.read": "attestations.read";
         "run.cancel": "run.cancel";
         "run.rerun": "run.rerun";
         "run.manual_schedule": "run.manual_schedule";
+        "run.trigger": "run.trigger";
         "job.cancel": "job.cancel";
         "event_log.list.read": "event_log.list.read";
         "event_log.detail.read": "event_log.detail.read";
@@ -1893,8 +1921,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     targetType: z.ZodOptional<z.ZodEnum<{
         run: "run";
         job: "job";
-        step: "step";
         payload: "payload";
+        step: "step";
         event_log: "event_log";
         event_log_payload: "event_log_payload";
         secret_scope: "secret_scope";
@@ -1915,6 +1943,143 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     q: z.ZodOptional<z.ZodString>;
     limit: z.ZodOptional<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.uploads.init">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    routingKey: z.ZodString;
+    sha: z.ZodOptional<z.ZodString>;
+    fileCount: z.ZodOptional<z.ZodNumber>;
+    compressedSize: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.trigger">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    routingKey: z.ZodString;
+    fixtureId: z.ZodString;
+    event: z.ZodObject<{
+        type: z.ZodString;
+        action: z.ZodOptional<z.ZodString>;
+        targetBranch: z.ZodString;
+        sourceBranch: z.ZodOptional<z.ZodString>;
+        payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        changedFiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    workflowName: z.ZodOptional<z.ZodString>;
+    uploadId: z.ZodOptional<z.ZodString>;
+    cliPublicKey: z.ZodOptional<z.ZodString>;
+    inlineLockFile: z.ZodOptional<z.ZodString>;
+    fullRepo: z.ZodOptional<z.ZodBoolean>;
+    secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptedSecrets: z.ZodOptional<z.ZodString>;
+    encryptedSecretsKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.status">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.run.logs">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodString;
+    cursor: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"test.relay.cancel">;
+    requestId: z.ZodString;
+    actor: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"user">;
+        sub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"api_key">;
+        keyId: z.ZodString;
+        ownerSub: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"service_account">;
+        id: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"platform_operator">;
+        sub: z.ZodString;
+        reason: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"system">;
+        component: z.ZodString;
+    }, z.core.$strip>], "type">;
+    runId: z.ZodOptional<z.ZodString>;
+    branch: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>], "type">;
 /** All messages that flow from Orchestrator to Platform.
  *
@@ -1966,6 +2131,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        held: "held";
     }>;
     repoIdentifier: z.ZodOptional<z.ZodString>;
     sha: z.ZodOptional<z.ZodString>;
@@ -2077,6 +2243,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             failed: "failed";
             cancelled: "cancelled";
             cancelling: "cancelling";
+            held: "held";
         }>;
         routingKey: z.ZodOptional<z.ZodString>;
         repoIdentifier: z.ZodOptional<z.ZodString>;
@@ -2155,7 +2322,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             github_app: "github_app";
             generic_webhook: "generic_webhook";
             universal_git: "universal_git";
-            internal: "internal";
+            local: "local";
         }>;
     }, z.core.$strip>>;
     instanceId: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/platform-orchestrator.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { heartbeatSchema } from "./common.js";
 import { orchCapabilitiesSchema } from "./capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./auth.js";

package/dist/protocol/messages/run-events.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { actorPrincipalSchema } from "./actor.js";
 import { z } from "zod";
 //#region src/protocol/messages/run-events.ts

package/dist/protocol/messages/scaler-event.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/scaler-event.ts
 /**

package/dist/protocol/messages/source-registration.d.ts

@@ -4,7 +4,7 @@ import { z } from 'zod';
  * grouping logic) to render an icon and friendly label for each source.
  *
  * Distinct from `provider` (which collapses universal-git, generic_webhook, and
- * internal into the single value `'generic'`): subtype keeps the "what kind of
+ * local into the single value `'generic'`): subtype keeps the "what kind of
  * orchestrator-side wiring is this?" distinction visible all the way through
  * the API and UI.
  *
@@ -13,19 +13,20 @@ import { z } from 'zod';
  * - `generic_webhook` — `generic_webhook_sources` row with `provider_type='generic'`.
  * - `universal_git`   — `generic_webhook_sources` row with a non-null `git_config`
  *                      (universal-git provider — gitea, gitlab, forgejo, etc.).
- * - `internal`        — `generic_webhook_sources` row with `provider_type='internal'`
- *                      (E2E / staging stg-ha smoke-test plumbing).
+ * - `local`           — `generic_webhook_sources` row with `provider_type='local'`
+ *                      (a git repository present on the agent's filesystem,
+ *                      cloned via `file://`).
  */
 export declare const SourceSubtype: z.ZodEnum<{
     github_app: "github_app";
     generic_webhook: "generic_webhook";
     universal_git: "universal_git";
-    internal: "internal";
+    local: "local";
 }>;
 export type SourceSubtype = z.infer<typeof SourceSubtype>;
 /**
  * Source provider family used by Platform's webhook router. Coarser-grained
- * than `SourceSubtype` — every universal-git / generic_webhook / internal row
+ * than `SourceSubtype` — every universal-git / generic_webhook / local row
  * collapses to `'generic'` here because Platform routes them through the same
  * generic webhook ingress.
  */
@@ -53,7 +54,7 @@ export declare const sourceRegistrationSchema: z.ZodObject<{
             github_app: "github_app";
             generic_webhook: "generic_webhook";
             universal_git: "universal_git";
-            internal: "internal";
+            local: "local";
         }>;
     }, z.core.$strip>>;
     instanceId: z.ZodOptional<z.ZodString>;

package/dist/protocol/messages/source-registration.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/protocol/messages/source-registration.ts
 /**
@@ -6,7 +6,7 @@ import { z } from "zod";
 * grouping logic) to render an icon and friendly label for each source.
 *
 * Distinct from `provider` (which collapses universal-git, generic_webhook, and
-* internal into the single value `'generic'`): subtype keeps the "what kind of
+* local into the single value `'generic'`): subtype keeps the "what kind of
 * orchestrator-side wiring is this?" distinction visible all the way through
 * the API and UI.
 *
@@ -15,18 +15,19 @@ import { z } from "zod";
 * - `generic_webhook` — `generic_webhook_sources` row with `provider_type='generic'`.
 * - `universal_git`   — `generic_webhook_sources` row with a non-null `git_config`
 *                      (universal-git provider — gitea, gitlab, forgejo, etc.).
-* - `internal`        — `generic_webhook_sources` row with `provider_type='internal'`
-*                      (E2E / staging stg-ha smoke-test plumbing).
+* - `local`           — `generic_webhook_sources` row with `provider_type='local'`
+*                      (a git repository present on the agent's filesystem,
+*                      cloned via `file://`).
 */
 const SourceSubtype = z.enum([
 	"github_app",
 	"generic_webhook",
 	"universal_git",
-	"internal"
+	"local"
 ]);
 /**
 * Source provider family used by Platform's webhook router. Coarser-grained
-* than `SourceSubtype` — every universal-git / generic_webhook / internal row
+* than `SourceSubtype` — every universal-git / generic_webhook / local row
 * collapses to `'generic'` here because Platform routes them through the same
 * generic webhook ingress.
 */

package/dist/protocol/version.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/protocol/version.ts
 /**
 * Protocol version. Sent during WebSocket handshake.

package/dist/provenance/bundle.d.ts

@@ -0,0 +1,54 @@
+/**
+ * KiCI provenance bundle: the Mode-A (KiCI-signed) attestation package.
+ *
+ * A KiCI bundle is the Sigstore model with the KiCI identity JWT standing in
+ * for the Fulcio certificate and no transparency log: it carries the DSSE
+ * envelope over the in-toto statement, the ephemeral public key that signed it,
+ * and the identity JWT that anchors the statement's build context to a
+ * KiCI-minted identity (verified offline against the Platform JWKS).
+ *
+ * Pure schema + constants, browser-safe — the agent producer and the verifier
+ * both import it. Exported at `@kici-dev/engine/provenance/bundle`.
+ */
+import { z } from 'zod';
+/** Versioned media type for the KiCI-custom Mode-A bundle (verifier dispatches on it). */
+export declare const KICI_PROVENANCE_BUNDLE_MEDIA_TYPE = "application/vnd.kici.provenance.bundle+json;version=0.1";
+/** OIDC audience the agent requests for the identity token bound into a bundle. */
+export declare const KICI_PROVENANCE_AUDIENCE = "kici-provenance";
+/** in-toto DSSE payload type for the signed statement. */
+export declare const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+/** Signing mode of a stored attestation. Mode A = KiCI-signed (the only mode today). */
+export declare const AttestationMode: z.ZodEnum<{
+    kici: "kici";
+}>;
+export type AttestationMode = z.infer<typeof AttestationMode>;
+/** Object-storage prefix for provenance bundles. */
+export declare const PROVENANCE_STORAGE_PREFIX = "provenance";
+/**
+ * Storage key for a provenance bundle:
+ * `provenance/{runId}/{jobId}/{subjectDigest}.kici.json`. Shared by the agent
+ * producer and the orchestrator persistence path so the two never drift.
+ */
+export declare function provenanceStorageKey(runId: string, jobId: string, subjectDigest: string): string;
+/**
+ * Mode-A (KiCI-signed) bundle: the DSSE envelope over the statement plus the
+ * verification material (the ephemeral signing public key as a JWK + the
+ * identity JWT).
+ */
+export declare const kiciBundleSchema: z.ZodObject<{
+    mediaType: z.ZodLiteral<"application/vnd.kici.provenance.bundle+json;version=0.1">;
+    dsseEnvelope: z.ZodObject<{
+        payloadType: z.ZodString;
+        payload: z.ZodString;
+        signatures: z.ZodArray<z.ZodObject<{
+            keyid: z.ZodString;
+            sig: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    verificationMaterial: z.ZodObject<{
+        publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        identityToken: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type KiciBundle = z.infer<typeof kiciBundleSchema>;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/provenance/bundle.js

@@ -0,0 +1,53 @@
+import "../chunk-BTugEXQM.js";
+import { dsseEnvelopeSchema } from "./dsse.js";
+import { z } from "zod";
+//#region src/provenance/bundle.ts
+/**
+* KiCI provenance bundle: the Mode-A (KiCI-signed) attestation package.
+*
+* A KiCI bundle is the Sigstore model with the KiCI identity JWT standing in
+* for the Fulcio certificate and no transparency log: it carries the DSSE
+* envelope over the in-toto statement, the ephemeral public key that signed it,
+* and the identity JWT that anchors the statement's build context to a
+* KiCI-minted identity (verified offline against the Platform JWKS).
+*
+* Pure schema + constants, browser-safe — the agent producer and the verifier
+* both import it. Exported at `@kici-dev/engine/provenance/bundle`.
+*/
+/** Versioned media type for the KiCI-custom Mode-A bundle (verifier dispatches on it). */
+const KICI_PROVENANCE_BUNDLE_MEDIA_TYPE = "application/vnd.kici.provenance.bundle+json;version=0.1";
+/** OIDC audience the agent requests for the identity token bound into a bundle. */
+const KICI_PROVENANCE_AUDIENCE = "kici-provenance";
+/** in-toto DSSE payload type for the signed statement. */
+const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+/** Signing mode of a stored attestation. Mode A = KiCI-signed (the only mode today). */
+const AttestationMode = z.enum(["kici"]);
+/** Object-storage prefix for provenance bundles. */
+const PROVENANCE_STORAGE_PREFIX = "provenance";
+/**
+* Storage key for a provenance bundle:
+* `provenance/{runId}/{jobId}/{subjectDigest}.kici.json`. Shared by the agent
+* producer and the orchestrator persistence path so the two never drift.
+*/
+function provenanceStorageKey(runId, jobId, subjectDigest) {
+	return `${PROVENANCE_STORAGE_PREFIX}/${runId}/${jobId}/${subjectDigest}.kici.json`;
+}
+/**
+* Mode-A (KiCI-signed) bundle: the DSSE envelope over the statement plus the
+* verification material (the ephemeral signing public key as a JWK + the
+* identity JWT).
+*/
+const kiciBundleSchema = z.object({
+	mediaType: z.literal(KICI_PROVENANCE_BUNDLE_MEDIA_TYPE),
+	dsseEnvelope: dsseEnvelopeSchema,
+	verificationMaterial: z.object({
+		/** JWK of the ephemeral ES256 key that signed the DSSE envelope. */
+		publicKey: z.record(z.string(), z.unknown()),
+		/** The KiCI ID token (verified against the Platform JWKS). */
+		identityToken: z.string()
+	})
+});
+//#endregion
+export { AttestationMode, IN_TOTO_PAYLOAD_TYPE, KICI_PROVENANCE_AUDIENCE, KICI_PROVENANCE_BUNDLE_MEDIA_TYPE, PROVENANCE_STORAGE_PREFIX, kiciBundleSchema, provenanceStorageKey };
+
+//# sourceMappingURL=bundle.js.map

package/dist/provenance/dsse.d.ts

@@ -0,0 +1,39 @@
+/**
+ * DSSE (Dead Simple Signing Envelope) helpers for KiCI provenance.
+ *
+ * Provides the in-toto pre-authentication encoding (PAE) and the envelope
+ * assembly used by the agent producer and the verifier. Pure byte / base64
+ * assembly with no Node-only crypto, so this module stays browser-safe and is
+ * exported at the subpath `@kici-dev/engine/provenance/dsse`.
+ *
+ * Spec reference: https://github.com/secure-systems-lab/dsse/blob/master/protocol.md
+ */
+import { z } from 'zod';
+/** A single DSSE signature: a key id plus the base64 signature bytes. */
+export declare const dsseSignatureSchema: z.ZodObject<{
+    keyid: z.ZodString;
+    sig: z.ZodString;
+}, z.core.$strip>;
+export type DsseSignature = z.infer<typeof dsseSignatureSchema>;
+/** A DSSE envelope: the payload type, the base64 payload, and ≥1 signature. */
+export declare const dsseEnvelopeSchema: z.ZodObject<{
+    payloadType: z.ZodString;
+    payload: z.ZodString;
+    signatures: z.ZodArray<z.ZodObject<{
+        keyid: z.ZodString;
+        sig: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DsseEnvelope = z.infer<typeof dsseEnvelopeSchema>;
+/**
+ * DSSE pre-authentication encoding: `"DSSEv1 <lenType> <type> <lenBody> <body>"`.
+ * The length fields count bytes (UTF-8 for the type, raw bytes for the payload).
+ * This is the exact byte sequence that gets signed and verified.
+ */
+export declare function dssePae(payloadType: string, payload: Uint8Array): Uint8Array;
+/** Assemble a {@link DsseEnvelope} from the payload bytes + raw signature bytes. */
+export declare function buildDsseEnvelope(payloadType: string, payloadBytes: Uint8Array, signatures: {
+    keyid: string;
+    sig: Uint8Array;
+}[]): DsseEnvelope;
+//# sourceMappingURL=dsse.d.ts.map