@kici-dev/engine 0.1.23 → 0.1.25

package/dist/secrets/types.d.ts

@@ -69,30 +69,6 @@ export interface AddBackendParams {
     scopeFilter?: string;
     syncIntervalMs?: number;
 }
-/**
- * Backend lifecycle manager interface.
- * Provides CRUD, health checks, and connection testing for secret backends.
- */
-export interface BackendManager {
-    /** Check backend connectivity. Returns health status. */
-    checkHealth(name: string): Promise<BackendHealthStatus>;
-    /** Trigger scope discovery sync for a backend (or all if name omitted). */
-    syncScopes(name?: string): Promise<void>;
-    /** List all registered backends (no credentials). */
-    listBackends(): Promise<BackendDescriptor[]>;
-    /** Get a single backend by name. */
-    getBackend(name: string): Promise<BackendDescriptor | null>;
-    /** Register a new backend. Returns the descriptor. */
-    addBackend(params: AddBackendParams): Promise<BackendDescriptor>;
-    /** Remove a backend by name. Returns true if removed. */
-    removeBackend(name: string): Promise<boolean>;
-    /** Test connectivity without persisting. */
-    testConnection(params: AddBackendParams): Promise<{
-        ok: boolean;
-        error?: string;
-        latencyMs: number;
-    }>;
-}
 /**
  * Periodic scope sync manager for secret backends.
  */

package/dist/secrets/types.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/state-machine/index.js

@@ -1,3 +1,3 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { isTerminal, transition } from "./machine.js";
 export { isTerminal, transition };

package/dist/state-machine/machine.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { TERMINAL_STATES } from "./types.js";
 //#region src/state-machine/machine.ts
 /**

package/dist/state-machine/types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/state-machine/types.ts
 /**
 * States from which no further transitions are possible.

package/dist/trigger/decision-trace.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/trigger/decision-trace.ts
 /**
 * Create a new trace entry.

package/dist/trigger/jsonpath-matcher.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { JSONPath } from "jsonpath-plus";
 //#region src/trigger/jsonpath-matcher.ts
 /**

package/dist/trigger/matcher.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { createTraceEntry, createWorkflowDecision } from "./decision-trace.js";
 import { matchJsonPath, matchJsonPathNot } from "./jsonpath-matcher.js";
 import picomatch from "picomatch";

package/dist/trigger/trigger-event-type.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/trigger/trigger-event-type.ts
 /**
 * Canonical trigger event types with human-readable metadata.

package/dist/trigger/types.d.ts

@@ -19,6 +19,7 @@
  * Schema version 24: adds LockJob.runsOnPick (deterministic single-host selection).
  * Schema version 25: adds LockStep.retry (step retry policy data subset; retryIf is execution-only).
  * Schema version 26: adds LockJob.includeUninitialized (runsOnAll fans out to declared-but-un-agented hosts, bringing up a temporary init-runner per fresh box).
+ * Schema version 27: adds LockScheduleTrigger.inputs (defaults-only schedule dispatch inputs).
  */
 import { z } from 'zod';
 import type { ProviderType } from '../provider/types.js';
@@ -27,7 +28,7 @@ import type { InputsDescriptorMap } from '../inputs/descriptor.js';
 import { LabelMatcher } from '../labels-match.js';
 import { ExecutionJobStatus } from '../protocol/messages/execution-status.js';
 /** Schema version - increment on breaking changes */
-export declare const SCHEMA_VERSION: 26;
+export declare const SCHEMA_VERSION: 29;
 /**
  * Normalized approval config carried in the lock file. Produced by the compiler
  * from an SDK `approval` at any of the three levels; consumed by the
@@ -292,6 +293,8 @@ export interface LockScheduleTrigger {
     readonly cronExpression: string;
     readonly timezone: string;
     readonly description?: string;
+    /** Typed schedule-input descriptors (from `schedule({ inputs })`); defaults-only. */
+    readonly inputs?: InputsDescriptorMap;
 }
 /**
  * Lifecycle trigger in lock file.
@@ -336,6 +339,8 @@ export interface LockRule {
  * Minimal representation - agents load full step functions from source.
  */
 export interface LockStep {
+    /** Discriminator for the step union; absent/`'sequential'` is an ordinary step. */
+    readonly kind?: 'sequential';
     readonly name: string;
     readonly hasOutputs: boolean;
     /** When true, job proceeds even if this step fails. */
@@ -358,6 +363,24 @@ export interface LockStep {
     /** Normalized approval gate; when set the step pauses for a human approval. */
     readonly approval?: LockApproval;
 }
+/**
+ * A concurrent group of sequential steps in the lock file. Children run
+ * concurrently behind a join barrier; the group wrapper itself consumes no
+ * flat step index (its children carry the indices). No nesting is allowed.
+ */
+export interface LockParallelStep {
+    readonly kind: 'parallel';
+    readonly name: string;
+    /** Cancel in-flight siblings when the first child fails (default true). */
+    readonly failFast: boolean;
+    /** Maximum children running at once; queued children report `pending`. */
+    readonly maxParallel?: number;
+    readonly children: readonly LockStep[];
+}
+/** A lock-file entry in a job's `steps` array: an ordinary step or a parallel group. */
+export type LockStepEntry = LockStep | LockParallelStep;
+/** Type guard distinguishing a parallel group from an ordinary lock step. */
+export declare function isLockParallelStep(entry: LockStepEntry): entry is LockParallelStep;
 /**
  * Inline expression value for pure dynamic functions.
  * The compiler serializes pure functions as { _type: 'inline', expression: '(event) => ...' }
@@ -483,9 +506,9 @@ export type RunsOnAllInput = string | RegExp | readonly (string | RegExp)[] | {
  * never return), independent of this policy.
  */
 export declare const OnUnreachableMode: z.ZodEnum<{
+    hold: "hold";
     skip: "skip";
     fail: "fail";
-    hold: "hold";
 }>;
 export type OnUnreachableMode = z.infer<typeof OnUnreachableMode>;
 /**
@@ -538,16 +561,21 @@ export interface LockJob {
     readonly needs: readonly (string | NeedsEntry | NeedsGroupEntry)[];
     /** Group names this job depends on (populated by compiler from dynamicGroup refs). */
     readonly dependsOnGroups?: readonly string[];
-    readonly steps: readonly LockStep[];
+    readonly steps: readonly LockStepEntry[];
     readonly matrix?: LockMatrix;
     readonly include?: readonly Record<string, string>[];
     readonly exclude?: readonly Record<string, string>[];
     readonly rules?: readonly LockRule[];
     readonly description?: string;
-    /** Deployment environment name (static string) or inline expression (pure function). */
-    readonly environment?: string | LockInlineValue;
-    /** When true, environment is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */
-    readonly dynamicEnvironment?: boolean;
+    /**
+     * Deployment environments in merge order. Each entry is a static name or inline
+     * expression (pure function); `dynamic` is set when it is a function resolved at
+     * two-phase eval. Later entries override earlier ones on name collisions.
+     */
+    readonly environments?: ReadonlyArray<{
+        value: string | LockInlineValue;
+        dynamic: boolean;
+    }>;
     /** Static environment variables or inline expression (pure function). */
     readonly env?: Record<string, string> | LockInlineValue;
     /** When true, env is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */

package/dist/trigger/types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { ExecutionJobStatus, TERMINAL_JOB_STATES } from "../protocol/messages/execution-status.js";
 import { z } from "zod";
 //#region src/trigger/types.ts
@@ -23,9 +23,14 @@ import { z } from "zod";
 * Schema version 24: adds LockJob.runsOnPick (deterministic single-host selection).
 * Schema version 25: adds LockStep.retry (step retry policy data subset; retryIf is execution-only).
 * Schema version 26: adds LockJob.includeUninitialized (runsOnAll fans out to declared-but-un-agented hosts, bringing up a temporary init-runner per fresh box).
+* Schema version 27: adds LockScheduleTrigger.inputs (defaults-only schedule dispatch inputs).
 */
 /** Schema version - increment on breaking changes */
-const SCHEMA_VERSION = 26;
+const SCHEMA_VERSION = 29;
+/** Type guard distinguishing a parallel group from an ordinary lock step. */
+function isLockParallelStep(entry) {
+	return entry.kind === "parallel";
+}
 /** Type guard for inline expression values */
 function isLockInlineValue(value) {
 	return typeof value === "object" && value !== null && value._type === "inline";
@@ -115,6 +120,6 @@ function isLockDynamicJobFn(job) {
 	return job._type === "dynamic";
 }
 //#endregion
-export { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, resolveWhenToRunOn };
+export { NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn };
 
 //# sourceMappingURL=types.js.map

package/dist/webhook/signature.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/webhook/signature.ts
 /**

package/dist/webhook/webhook-url-format.d.ts

@@ -6,4 +6,11 @@
  * pre-flight so the two never drift.
  */
 export declare function githubWebhookPath(orgId: string): string;
+/**
+ * Route shape for a direct GitHub-App webhook delivered straight to the
+ * orchestrator (bypassing the Platform relay). Per-source: the `:sourceId`
+ * segment identifies the local GitHub source. Shared by the orchestrator's
+ * ingress route handler and its local URL resolver so the two never drift.
+ */
+export declare function githubIngressPath(orgId: string, sourceId: string): string;
 //# sourceMappingURL=webhook-url-format.d.ts.map

package/dist/webhook/webhook-url-format.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/webhook/webhook-url-format.ts
 /**
 * Route shape for a GitHub App webhook. Org-scoped, NOT app-scoped — the app
@@ -10,7 +10,16 @@ import "../chunk-BTugEXQM.js";
 function githubWebhookPath(orgId) {
 	return `/webhook/${orgId}/github`;
 }
+/**
+* Route shape for a direct GitHub-App webhook delivered straight to the
+* orchestrator (bypassing the Platform relay). Per-source: the `:sourceId`
+* segment identifies the local GitHub source. Shared by the orchestrator's
+* ingress route handler and its local URL resolver so the two never drift.
+*/
+function githubIngressPath(orgId, sourceId) {
+	return `/webhook/${orgId}/github/${sourceId}`;
+}
 //#endregion
-export { githubWebhookPath };
+export { githubIngressPath, githubWebhookPath };
 
 //# sourceMappingURL=webhook-url-format.js.map

package/dist/ws/close-codes.d.ts

@@ -29,8 +29,14 @@ export declare const WS_CLOSE_PLAN_LIMIT = 4020;
  * via `kici-admin cluster-name set <name>` before reconnecting.
  */
 export declare const WS_CLOSE_CLUSTER_NAME_CONFLICT = 4011;
-/** The connection was closed because the requested run was not found. */
-export declare const WS_CLOSE_RUN_NOT_FOUND = 4030;
+/**
+ * The connection was closed to rebalance load across Platform instances. A
+ * newly-joined Platform instance asks peers holding excess connections to shed
+ * some; the affected orchestrators reconnect immediately and redistribute
+ * evenly. Not an error — the orchestrator treats it as a transient close and
+ * reconnects.
+ */
+export declare const WS_CLOSE_REBALANCE = 4030;
 /**
  * The connection was closed because a job dispatch went unacknowledged past
  * its deadline. The orchestrator treats the dispatch as lost, requeues the

package/dist/ws/close-codes.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/ws/close-codes.ts
 /**
 * Unified WebSocket close codes for KiCI connections.
@@ -31,8 +31,14 @@ const WS_CLOSE_PLAN_LIMIT = 4020;
 * via `kici-admin cluster-name set <name>` before reconnecting.
 */
 const WS_CLOSE_CLUSTER_NAME_CONFLICT = 4011;
-/** The connection was closed because the requested run was not found. */
-const WS_CLOSE_RUN_NOT_FOUND = 4030;
+/**
+* The connection was closed to rebalance load across Platform instances. A
+* newly-joined Platform instance asks peers holding excess connections to shed
+* some; the affected orchestrators reconnect immediately and redistribute
+* evenly. Not an error — the orchestrator treats it as a transient close and
+* reconnects.
+*/
+const WS_CLOSE_REBALANCE = 4030;
 /**
 * The connection was closed because a job dispatch went unacknowledged past
 * its deadline. The orchestrator treats the dispatch as lost, requeues the
@@ -41,6 +47,6 @@ const WS_CLOSE_RUN_NOT_FOUND = 4030;
 */
 const WS_CLOSE_DISPATCH_ACK_TIMEOUT = 4031;
 //#endregion
-export { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED };
+export { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED };
 
 //# sourceMappingURL=close-codes.js.map

package/dist/ws/rate-limiter.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/ws/rate-limiter.ts
 /**
 * WebSocket rate limiter with two-tier token bucket (messages + bytes).

package/dist/ws/ws-like.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",
@@ -81,6 +81,10 @@
       "import": "./dist/protocol/messages/oidc-token-relay.js",
       "types": "./dist/protocol/messages/oidc-token-relay.d.ts"
     },
+    "./protocol/messages/oidc-mint": {
+      "import": "./dist/protocol/messages/oidc-mint.js",
+      "types": "./dist/protocol/messages/oidc-mint.d.ts"
+    },
     "./provenance/schema": {
       "import": "./dist/provenance/schema.js",
       "types": "./dist/provenance/schema.d.ts"
@@ -97,6 +101,10 @@
       "import": "./dist/provenance/verify.js",
       "types": "./dist/provenance/verify.d.ts"
     },
+    "./provenance/statement-hash": {
+      "import": "./dist/provenance/statement-hash.js",
+      "types": "./dist/provenance/statement-hash.d.ts"
+    },
     "./metrics/catalog": {
       "import": "./dist/metrics/metric-catalog.generated.js",
       "types": "./dist/metrics/metric-catalog.generated.d.ts"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.1.23",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.23/8d393c8b-11ae-4191-987e-130f8fca7033",
+  "name": "@kici-dev/engine@0.1.25",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.25/1d119a82-cc7a-45cf-b310-0eab61d7151e",
   "creationInfo": {
-    "created": "2026-06-25T11:12:41Z",
+    "created": "2026-07-05T08:32:25Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.25",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.25"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",