@kici-dev/engine 0.1.23 → 0.1.25

package/dist/protocol/messages/orchestrator-agent.js

@@ -1,5 +1,6 @@
-import "../../chunk-BTugEXQM.js";
-import { ExecutionJobStatus, ExecutionStepStatus } from "./execution-status.js";
+import "../../rolldown-runtime-ClRpJifh.js";
+import { ExecutionJobStatus, ExecutionStepStatus, StepConcurrencyKind } from "./execution-status.js";
+import { dsseEnvelopeSchema } from "../../provenance/dsse.js";
 import { approverClauseSchema } from "../../approval/types.js";
 import { z } from "zod";
 //#region src/protocol/messages/orchestrator-agent.ts
@@ -351,6 +352,10 @@ const agentStepStatusSchema = z.object({
 	]).optional(),
 	/** Secret key names accessed by this step via ctx.secrets.get()/expose(). Never contains values. */
 	secretsAccessed: z.array(z.string()).optional(),
+	/** Step concurrency role; absent means an ordinary sequential step. */
+	concurrencyKind: StepConcurrencyKind.optional(),
+	/** Parallel-group correlation id shared by a group's children (e.g. `g0`). */
+	groupId: z.string().optional(),
 	/**
 	* Total raw bytes streamed by this step's LogStreamer at terminal time.
 	* Counts agent-side raw bytes (the same count fed to the transient
@@ -528,6 +533,32 @@ const provenanceUploadCompleteSchema = z.object({
 	/** Bundle media type. */
 	mediaType: z.string()
 });
+/**
+* Agent -> Orchestrator: capture a frozen, DSSE-signed provenance statement for
+* later minting (the transient mint-failure path). No upload happens; the
+* orchestrator persists the envelope in its deferred-attestation outbox and the
+* job completes green. The identity token is minted later and bound to the
+* frozen statement by `statementHash`.
+*/
+const provenanceUploadDeferSchema = z.object({
+	type: z.literal("provenance.upload.defer"),
+	messageId: z.string(),
+	jobId: z.string(),
+	/** Caller-supplied artifact name. */
+	subjectName: z.string(),
+	/** Primary subject digest (lowercase hex). */
+	subjectDigest: z.string(),
+	/** Requested token audience for the later mint. */
+	audience: z.string(),
+	/** Bundle media type. */
+	mediaType: z.string(),
+	/** SHA-256 of the frozen DSSE statement payload — the later-mint binding. */
+	statementHash: z.string(),
+	/** The frozen, DSSE-signed statement envelope. */
+	dsseEnvelope: dsseEnvelopeSchema,
+	/** Ephemeral public key JWK the envelope was signed with. */
+	publicKey: z.record(z.string(), z.unknown())
+});
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 const eventEmitSchema = z.object({
 	type: z.literal("event.emit"),
@@ -739,6 +770,7 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	cacheUserSaveCompleteSchema,
 	provenanceUploadRequestSchema,
 	provenanceUploadCompleteSchema,
+	provenanceUploadDeferSchema,
 	eventEmitSchema,
 	agentApiRequestSchema,
 	agentMetricsSchema,
@@ -748,6 +780,6 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	stepApprovalRequestSchema
 ]);
 //#endregion
-export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
+export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/pat-kind.d.ts

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+/**
+ * Kind of personal access token.
+ *
+ * - `user` — an ordinary PAT acting as the human who minted it.
+ * - `agent` — a PAT minted for a coding agent. It still runs with the user's
+ *   permissions (no authority change), but its agent origin is carried into
+ *   every audit / access-log row via `actor.agent`, and it is the only
+ *   credential the developer MCP server accepts.
+ */
+export declare const PatKind: z.ZodEnum<{
+    user: "user";
+    agent: "agent";
+}>;
+export type PatKind = z.infer<typeof PatKind>;
+//# sourceMappingURL=pat-kind.d.ts.map

package/dist/protocol/messages/pat-kind.js

@@ -0,0 +1,17 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/protocol/messages/pat-kind.ts
+/**
+* Kind of personal access token.
+*
+* - `user` — an ordinary PAT acting as the human who minted it.
+* - `agent` — a PAT minted for a coding agent. It still runs with the user's
+*   permissions (no authority change), but its agent origin is carried into
+*   every audit / access-log row via `actor.agent`, and it is the only
+*   credential the developer MCP server accepts.
+*/
+const PatKind = z.enum(["user", "agent"]);
+//#endregion
+export { PatKind };
+
+//# sourceMappingURL=pat-kind.js.map

package/dist/protocol/messages/peer.d.ts

@@ -3,8 +3,8 @@ import { z } from 'zod';
 export declare const peerCapabilitiesSchema: z.ZodObject<{
     s3LogAccess: z.ZodBoolean;
     logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-        coordinator: "coordinator";
         direct: "direct";
+        coordinator: "coordinator";
     }>>;
 }, z.core.$strip>;
 /** Scaler capacity summary included in peer heartbeat and auth response for routing decisions. */
@@ -72,8 +72,8 @@ export declare const peerAuthResponseSchema: z.ZodObject<{
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -97,8 +97,8 @@ export declare const peerHeartbeatSchema: z.ZodObject<{
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -464,8 +464,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -487,8 +487,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -765,8 +765,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -788,8 +788,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
             direct: "direct";
+            coordinator: "coordinator";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{

package/dist/protocol/messages/peer.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { ExecutionJobStatus } from "./execution-status.js";
 import { LabelMatcher } from "../../labels-match.js";
 import { ScalerEventType } from "./scaler-event.js";