@kici-dev/engine 0.1.16 → 0.1.18

package/dist/provenance/bundle.d.ts

@@ -0,0 +1,54 @@
+/**
+ * KiCI provenance bundle: the Mode-A (KiCI-signed) attestation package.
+ *
+ * A KiCI bundle is the Sigstore model with the KiCI identity JWT standing in
+ * for the Fulcio certificate and no transparency log: it carries the DSSE
+ * envelope over the in-toto statement, the ephemeral public key that signed it,
+ * and the identity JWT that anchors the statement's build context to a
+ * KiCI-minted identity (verified offline against the Platform JWKS).
+ *
+ * Pure schema + constants, browser-safe — the agent producer and the verifier
+ * both import it. Exported at `@kici-dev/engine/provenance/bundle`.
+ */
+import { z } from 'zod';
+/** Versioned media type for the KiCI-custom Mode-A bundle (verifier dispatches on it). */
+export declare const KICI_PROVENANCE_BUNDLE_MEDIA_TYPE = "application/vnd.kici.provenance.bundle+json;version=0.1";
+/** OIDC audience the agent requests for the identity token bound into a bundle. */
+export declare const KICI_PROVENANCE_AUDIENCE = "kici-provenance";
+/** in-toto DSSE payload type for the signed statement. */
+export declare const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+/** Signing mode of a stored attestation. Mode A = KiCI-signed (the only mode today). */
+export declare const AttestationMode: z.ZodEnum<{
+    kici: "kici";
+}>;
+export type AttestationMode = z.infer<typeof AttestationMode>;
+/** Object-storage prefix for provenance bundles. */
+export declare const PROVENANCE_STORAGE_PREFIX = "provenance";
+/**
+ * Storage key for a provenance bundle:
+ * `provenance/{runId}/{jobId}/{subjectDigest}.kici.json`. Shared by the agent
+ * producer and the orchestrator persistence path so the two never drift.
+ */
+export declare function provenanceStorageKey(runId: string, jobId: string, subjectDigest: string): string;
+/**
+ * Mode-A (KiCI-signed) bundle: the DSSE envelope over the statement plus the
+ * verification material (the ephemeral signing public key as a JWK + the
+ * identity JWT).
+ */
+export declare const kiciBundleSchema: z.ZodObject<{
+    mediaType: z.ZodLiteral<"application/vnd.kici.provenance.bundle+json;version=0.1">;
+    dsseEnvelope: z.ZodObject<{
+        payloadType: z.ZodString;
+        payload: z.ZodString;
+        signatures: z.ZodArray<z.ZodObject<{
+            keyid: z.ZodString;
+            sig: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    verificationMaterial: z.ZodObject<{
+        publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        identityToken: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type KiciBundle = z.infer<typeof kiciBundleSchema>;
+//# sourceMappingURL=bundle.d.ts.map

package/dist/provenance/bundle.js

@@ -0,0 +1,53 @@
+import "../chunk-BTugEXQM.js";
+import { dsseEnvelopeSchema } from "./dsse.js";
+import { z } from "zod";
+//#region src/provenance/bundle.ts
+/**
+* KiCI provenance bundle: the Mode-A (KiCI-signed) attestation package.
+*
+* A KiCI bundle is the Sigstore model with the KiCI identity JWT standing in
+* for the Fulcio certificate and no transparency log: it carries the DSSE
+* envelope over the in-toto statement, the ephemeral public key that signed it,
+* and the identity JWT that anchors the statement's build context to a
+* KiCI-minted identity (verified offline against the Platform JWKS).
+*
+* Pure schema + constants, browser-safe — the agent producer and the verifier
+* both import it. Exported at `@kici-dev/engine/provenance/bundle`.
+*/
+/** Versioned media type for the KiCI-custom Mode-A bundle (verifier dispatches on it). */
+const KICI_PROVENANCE_BUNDLE_MEDIA_TYPE = "application/vnd.kici.provenance.bundle+json;version=0.1";
+/** OIDC audience the agent requests for the identity token bound into a bundle. */
+const KICI_PROVENANCE_AUDIENCE = "kici-provenance";
+/** in-toto DSSE payload type for the signed statement. */
+const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+/** Signing mode of a stored attestation. Mode A = KiCI-signed (the only mode today). */
+const AttestationMode = z.enum(["kici"]);
+/** Object-storage prefix for provenance bundles. */
+const PROVENANCE_STORAGE_PREFIX = "provenance";
+/**
+* Storage key for a provenance bundle:
+* `provenance/{runId}/{jobId}/{subjectDigest}.kici.json`. Shared by the agent
+* producer and the orchestrator persistence path so the two never drift.
+*/
+function provenanceStorageKey(runId, jobId, subjectDigest) {
+	return `${PROVENANCE_STORAGE_PREFIX}/${runId}/${jobId}/${subjectDigest}.kici.json`;
+}
+/**
+* Mode-A (KiCI-signed) bundle: the DSSE envelope over the statement plus the
+* verification material (the ephemeral signing public key as a JWK + the
+* identity JWT).
+*/
+const kiciBundleSchema = z.object({
+	mediaType: z.literal(KICI_PROVENANCE_BUNDLE_MEDIA_TYPE),
+	dsseEnvelope: dsseEnvelopeSchema,
+	verificationMaterial: z.object({
+		/** JWK of the ephemeral ES256 key that signed the DSSE envelope. */
+		publicKey: z.record(z.string(), z.unknown()),
+		/** The KiCI ID token (verified against the Platform JWKS). */
+		identityToken: z.string()
+	})
+});
+//#endregion
+export { AttestationMode, IN_TOTO_PAYLOAD_TYPE, KICI_PROVENANCE_AUDIENCE, KICI_PROVENANCE_BUNDLE_MEDIA_TYPE, PROVENANCE_STORAGE_PREFIX, kiciBundleSchema, provenanceStorageKey };
+
+//# sourceMappingURL=bundle.js.map

package/dist/provenance/dsse.d.ts

@@ -0,0 +1,39 @@
+/**
+ * DSSE (Dead Simple Signing Envelope) helpers for KiCI provenance.
+ *
+ * Provides the in-toto pre-authentication encoding (PAE) and the envelope
+ * assembly used by the agent producer and the verifier. Pure byte / base64
+ * assembly with no Node-only crypto, so this module stays browser-safe and is
+ * exported at the subpath `@kici-dev/engine/provenance/dsse`.
+ *
+ * Spec reference: https://github.com/secure-systems-lab/dsse/blob/master/protocol.md
+ */
+import { z } from 'zod';
+/** A single DSSE signature: a key id plus the base64 signature bytes. */
+export declare const dsseSignatureSchema: z.ZodObject<{
+    keyid: z.ZodString;
+    sig: z.ZodString;
+}, z.core.$strip>;
+export type DsseSignature = z.infer<typeof dsseSignatureSchema>;
+/** A DSSE envelope: the payload type, the base64 payload, and ≥1 signature. */
+export declare const dsseEnvelopeSchema: z.ZodObject<{
+    payloadType: z.ZodString;
+    payload: z.ZodString;
+    signatures: z.ZodArray<z.ZodObject<{
+        keyid: z.ZodString;
+        sig: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DsseEnvelope = z.infer<typeof dsseEnvelopeSchema>;
+/**
+ * DSSE pre-authentication encoding: `"DSSEv1 <lenType> <type> <lenBody> <body>"`.
+ * The length fields count bytes (UTF-8 for the type, raw bytes for the payload).
+ * This is the exact byte sequence that gets signed and verified.
+ */
+export declare function dssePae(payloadType: string, payload: Uint8Array): Uint8Array;
+/** Assemble a {@link DsseEnvelope} from the payload bytes + raw signature bytes. */
+export declare function buildDsseEnvelope(payloadType: string, payloadBytes: Uint8Array, signatures: {
+    keyid: string;
+    sig: Uint8Array;
+}[]): DsseEnvelope;
+//# sourceMappingURL=dsse.d.ts.map

package/dist/provenance/dsse.js

@@ -0,0 +1,53 @@
+import "../chunk-BTugEXQM.js";
+import { z } from "zod";
+//#region src/provenance/dsse.ts
+/**
+* DSSE (Dead Simple Signing Envelope) helpers for KiCI provenance.
+*
+* Provides the in-toto pre-authentication encoding (PAE) and the envelope
+* assembly used by the agent producer and the verifier. Pure byte / base64
+* assembly with no Node-only crypto, so this module stays browser-safe and is
+* exported at the subpath `@kici-dev/engine/provenance/dsse`.
+*
+* Spec reference: https://github.com/secure-systems-lab/dsse/blob/master/protocol.md
+*/
+/** A single DSSE signature: a key id plus the base64 signature bytes. */
+const dsseSignatureSchema = z.object({
+	keyid: z.string(),
+	sig: z.string()
+});
+/** A DSSE envelope: the payload type, the base64 payload, and ≥1 signature. */
+const dsseEnvelopeSchema = z.object({
+	payloadType: z.string(),
+	payload: z.string(),
+	signatures: z.array(dsseSignatureSchema).min(1)
+});
+/**
+* DSSE pre-authentication encoding: `"DSSEv1 <lenType> <type> <lenBody> <body>"`.
+* The length fields count bytes (UTF-8 for the type, raw bytes for the payload).
+* This is the exact byte sequence that gets signed and verified.
+*/
+function dssePae(payloadType, payload) {
+	const enc = new TextEncoder();
+	const typeBytes = enc.encode(payloadType);
+	const prefix = enc.encode(`DSSEv1 ${typeBytes.length} ${payloadType} ${payload.length} `);
+	const out = new Uint8Array(prefix.length + payload.length);
+	out.set(prefix, 0);
+	out.set(payload, prefix.length);
+	return out;
+}
+/** Assemble a {@link DsseEnvelope} from the payload bytes + raw signature bytes. */
+function buildDsseEnvelope(payloadType, payloadBytes, signatures) {
+	return {
+		payloadType,
+		payload: Buffer.from(payloadBytes).toString("base64"),
+		signatures: signatures.map((s) => ({
+			keyid: s.keyid,
+			sig: Buffer.from(s.sig).toString("base64")
+		}))
+	};
+}
+//#endregion
+export { buildDsseEnvelope, dsseEnvelopeSchema, dssePae, dsseSignatureSchema };
+
+//# sourceMappingURL=dsse.js.map

package/dist/provenance/schema.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/provenance/schema.ts
 /**

package/dist/provenance/verify.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Shared, browser-safe verification core for KiCI provenance bundles (Mode A).
+ *
+ * Given a KiCI-signed bundle, the Platform JWKS, and an out-of-band trusted
+ * issuer, `verifyKiciBundle` establishes the full Mode-A chain offline:
+ *
+ *  - the identity JWT verifies against the supplied JWKS with `iss` PINNED to
+ *    the caller-supplied `expectedIssuer` (never the token's own `iss`) and the
+ *    audience checked;
+ *  - the DSSE envelope verifies against the ephemeral public key carried in the
+ *    bundle, whose `keyid` must equal its RFC 7638 JWK thumbprint;
+ *  - the in-toto statement's build context must equal the (server-truth) JWT
+ *    claims — a mismatch is a HARD FAIL, the check that makes the agent-built
+ *    statement sound;
+ *  - when an artifact digest is supplied, a subject digest must match it.
+ *
+ * The core uses only `jose` (isomorphic) and `crypto.subtle`/`atob`/`TextDecoder`
+ * (present in modern browsers and Node 24) — no `node:fs`, no `fetch`, no
+ * `Buffer` — so the exact same function runs in the `kici verify-attestation`
+ * CLI and the dashboard's verified badge. Exported at the subpath
+ * `@kici-dev/engine/provenance/verify`; it is deliberately NOT re-exported from
+ * the engine barrel (the barrel must stay free of the `jose` dependency).
+ */
+import { type JSONWebKeySet } from 'jose';
+import { type KiciProvenanceStatement } from './schema.js';
+/** Tri-state outcome of a single verification check. */
+export type CheckStatus = 'pass' | 'fail' | 'skipped';
+/** Per-check verification outcomes. */
+export interface VerifyChecks {
+    /** Bundle + statement schema validation. */
+    schema: CheckStatus;
+    /** Identity-token signature, issuer-pin, and audience. */
+    jwt: CheckStatus;
+    /** DSSE envelope signature over the statement. */
+    dsse: CheckStatus;
+    /** Statement build context vs. server-truth JWT claims (hard fail on mismatch). */
+    buildContext: CheckStatus;
+    /** Subject digest vs. the supplied artifact digest (skipped when none given). */
+    digest: CheckStatus;
+}
+/** Structured verification result. Never thrown for a verification failure. */
+export interface VerifyResult {
+    verified: boolean;
+    mode: 'kici' | 'sigstore' | 'unknown';
+    checks: VerifyChecks;
+    claims?: Record<string, unknown>;
+    statement?: KiciProvenanceStatement;
+    failures: string[];
+}
+export interface VerifyKiciBundleOptions {
+    /** The bundle to verify (validated against `kiciBundleSchema`). */
+    bundle: unknown;
+    /** Trusted JWKS (already fetched by the caller). */
+    jwks: JSONWebKeySet;
+    /** Trusted issuer the token `iss` is pinned to (out-of-band, never the token's own). */
+    expectedIssuer: string;
+    /** Expected token audience, if any. */
+    expectedAudience?: string;
+    /** Artifact digest to match against a subject, if any. */
+    expectedDigest?: {
+        alg: string;
+        hex: string;
+    };
+}
+/**
+ * Verify a KiCI provenance bundle offline. Returns a structured result; throws
+ * only on a programming-level error, never for a verification failure (a failed
+ * verification is `verified:false` with populated `failures`).
+ */
+export declare function verifyKiciBundle(opts: VerifyKiciBundleOptions): Promise<VerifyResult>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/provenance/verify.js

@@ -0,0 +1,135 @@
+import "../chunk-BTugEXQM.js";
+import { dssePae } from "./dsse.js";
+import { kiciBundleSchema } from "./bundle.js";
+import { kiciProvenanceStatementSchema } from "./schema.js";
+import { calculateJwkThumbprint, createLocalJWKSet, importJWK, jwtVerify } from "jose";
+//#region src/provenance/verify.ts
+/**
+* Shared, browser-safe verification core for KiCI provenance bundles (Mode A).
+*
+* Given a KiCI-signed bundle, the Platform JWKS, and an out-of-band trusted
+* issuer, `verifyKiciBundle` establishes the full Mode-A chain offline:
+*
+*  - the identity JWT verifies against the supplied JWKS with `iss` PINNED to
+*    the caller-supplied `expectedIssuer` (never the token's own `iss`) and the
+*    audience checked;
+*  - the DSSE envelope verifies against the ephemeral public key carried in the
+*    bundle, whose `keyid` must equal its RFC 7638 JWK thumbprint;
+*  - the in-toto statement's build context must equal the (server-truth) JWT
+*    claims — a mismatch is a HARD FAIL, the check that makes the agent-built
+*    statement sound;
+*  - when an artifact digest is supplied, a subject digest must match it.
+*
+* The core uses only `jose` (isomorphic) and `crypto.subtle`/`atob`/`TextDecoder`
+* (present in modern browsers and Node 24) — no `node:fs`, no `fetch`, no
+* `Buffer` — so the exact same function runs in the `kici verify-attestation`
+* CLI and the dashboard's verified badge. Exported at the subpath
+* `@kici-dev/engine/provenance/verify`; it is deliberately NOT re-exported from
+* the engine barrel (the barrel must stay free of the `jose` dependency).
+*/
+/** Browser-safe base64 → bytes (no Buffer — this module is imported by the dashboard). */
+function b64ToBytes(b64) {
+	return Uint8Array.from(atob(b64), (c) => c.charCodeAt(0));
+}
+/**
+* Verify a KiCI provenance bundle offline. Returns a structured result; throws
+* only on a programming-level error, never for a verification failure (a failed
+* verification is `verified:false` with populated `failures`).
+*/
+async function verifyKiciBundle(opts) {
+	const checks = {
+		schema: "skipped",
+		jwt: "skipped",
+		dsse: "skipped",
+		buildContext: "skipped",
+		digest: "skipped"
+	};
+	const failures = [];
+	if (opts.bundle?.mediaType !== "application/vnd.kici.provenance.bundle+json;version=0.1") return {
+		verified: false,
+		mode: "sigstore",
+		checks,
+		failures: ["mode_b_unsupported"]
+	};
+	const parsed = kiciBundleSchema.safeParse(opts.bundle);
+	if (!parsed.success) {
+		checks.schema = "fail";
+		return {
+			verified: false,
+			mode: "kici",
+			checks,
+			failures: ["bundle_schema_invalid"]
+		};
+	}
+	const bundle = parsed.data;
+	checks.schema = "pass";
+	const statementBytes = b64ToBytes(bundle.dsseEnvelope.payload);
+	let statement;
+	const stmt = kiciProvenanceStatementSchema.safeParse(JSON.parse(new TextDecoder().decode(statementBytes)));
+	if (!stmt.success) {
+		checks.schema = "fail";
+		failures.push("statement_schema_invalid");
+	} else statement = stmt.data;
+	let claims;
+	try {
+		const { payload } = await jwtVerify(bundle.verificationMaterial.identityToken, createLocalJWKSet(opts.jwks), {
+			issuer: opts.expectedIssuer,
+			audience: opts.expectedAudience
+		});
+		claims = payload;
+		checks.jwt = "pass";
+	} catch {
+		checks.jwt = "fail";
+		failures.push("identity_token_invalid");
+	}
+	try {
+		const pubJwk = bundle.verificationMaterial.publicKey;
+		const thumbprint = await calculateJwkThumbprint(pubJwk, "sha256");
+		if (bundle.dsseEnvelope.signatures[0].keyid !== thumbprint) throw new Error("keyid does not match public-key thumbprint");
+		const key = await importJWK(pubJwk, "ES256");
+		if (!await crypto.subtle.verify({
+			name: "ECDSA",
+			hash: "SHA-256"
+		}, key, b64ToBytes(bundle.dsseEnvelope.signatures[0].sig), dssePae(bundle.dsseEnvelope.payloadType, statementBytes))) throw new Error("bad signature");
+		checks.dsse = "pass";
+	} catch {
+		checks.dsse = "fail";
+		failures.push("dsse_signature_invalid");
+	}
+	if (statement && claims) {
+		const ok = crossCheckBuildContext(statement, claims);
+		checks.buildContext = ok ? "pass" : "fail";
+		if (!ok) failures.push("build_context_mismatch");
+	} else {
+		checks.buildContext = "fail";
+		failures.push("build_context_uncheckable");
+	}
+	if (opts.expectedDigest && statement) {
+		const ok = checkSubjectDigest(statement, opts.expectedDigest);
+		checks.digest = ok ? "pass" : "fail";
+		if (!ok) failures.push("subject_digest_mismatch");
+	}
+	return {
+		verified: checks.schema === "pass" && checks.jwt === "pass" && checks.dsse === "pass" && checks.buildContext === "pass" && checks.digest !== "fail",
+		mode: "kici",
+		checks,
+		claims,
+		statement,
+		failures
+	};
+}
+/** The statement's build context must equal the (server-truth) JWT claims. */
+function crossCheckBuildContext(statement, claims) {
+	const bd = statement.predicate.buildDefinition;
+	const wf = bd.externalParameters.workflow;
+	const ip = bd.internalParameters ?? {};
+	return wf.repository === claims.repository && wf.ref === claims.ref && wf.path === claims.workflow_ref && ip.commit === claims.sha && ip.runId === claims.kici_run_id && ip.jobId === claims.kici_job_id;
+}
+/** At least one subject must carry a digest matching the supplied artifact digest. */
+function checkSubjectDigest(statement, expected) {
+	return statement.subject.some((s) => s.digest[expected.alg] === expected.hex);
+}
+//#endregion
+export { verifyKiciBundle };
+
+//# sourceMappingURL=verify.js.map

package/dist/provider/changed-files-fetcher.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/check-run-conclusion.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/provider/check-run-conclusion.ts
 /**

package/dist/provider/check-status-poster.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/clone-token-provider.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/contributor-resolver.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { LockFileParseError } from "./lock-file-parse-error.js";
 import { CheckRunConclusion } from "./check-run-conclusion.js";
 export { CheckRunConclusion, LockFileParseError };

package/dist/provider/lock-file-fetcher.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/lock-file-parse-error.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/provider/lock-file-parse-error.ts
 /**
 * Thrown by a LockFileFetcher when a lock file is present at the repo ref but
@@ -8,6 +8,8 @@ import "../chunk-gOLHoazu.js";
 * `lock_resolution` init-failure run.
 */
 var LockFileParseError = class LockFileParseError extends Error {
+	repoIdentifier;
+	ref;
 	name = "LockFileParseError";
 	constructor(repoIdentifier, ref, message) {
 		super(message);

package/dist/provider/repo-url-builder.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/types.d.ts

@@ -4,6 +4,6 @@
  * These types are the foundation for all provider interfaces.
  * Keep this minimal -- only types needed by multiple interfaces belong here.
  */
-/** Identifies a git hosting provider, generic webhook source, or internal test provider. */
-export type ProviderType = 'github' | 'gitlab' | 'bitbucket' | 'generic' | 'internal';
+/** Identifies a git hosting provider, generic webhook source, or local filesystem (`file://`) source. */
+export type ProviderType = 'github' | 'gitlab' | 'bitbucket' | 'generic' | 'local';
 //# sourceMappingURL=types.d.ts.map

package/dist/provider/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/provider/webhook-normalizer.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/registration/registerable-trigger-type.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/registration/registerable-trigger-type.ts
 /**

package/dist/scaler/resource-types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/scaler/resource-types.ts
 /**

package/dist/scaler/scaler-backend-type.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/scaler/scaler-backend-type.ts
 /**

package/dist/secrets/index.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/secrets/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/state-machine/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { isTerminal, transition } from "./machine.js";
 export { isTerminal, transition };

package/dist/state-machine/machine.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { TERMINAL_STATES } from "./types.js";
 //#region src/state-machine/machine.ts
 /**

package/dist/state-machine/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/state-machine/types.ts
 /**
 * States from which no further transitions are possible.

package/dist/trigger/decision-trace.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/trigger/decision-trace.ts
 /**
 * Create a new trace entry.

package/dist/trigger/jsonpath-matcher.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { JSONPath } from "jsonpath-plus";
 //#region src/trigger/jsonpath-matcher.ts
 /**

package/dist/trigger/matcher.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { createTraceEntry, createWorkflowDecision } from "./decision-trace.js";
 import { matchJsonPath, matchJsonPathNot } from "./jsonpath-matcher.js";
 import picomatch from "picomatch";

package/dist/trigger/trigger-event-type.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/trigger/trigger-event-type.ts
 /**
 * Canonical trigger event types with human-readable metadata.