@kici-dev/engine 0.1.24 → 0.1.25

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -426,6 +426,32 @@ export declare const provenanceUploadCompleteSchema: z.ZodObject<{
     subjectDigest: z.ZodString;
     mediaType: z.ZodString;
 }, z.core.$strip>;
+/**
+ * Agent -> Orchestrator: capture a frozen, DSSE-signed provenance statement for
+ * later minting (the transient mint-failure path). No upload happens; the
+ * orchestrator persists the envelope in its deferred-attestation outbox and the
+ * job completes green. The identity token is minted later and bound to the
+ * frozen statement by `statementHash`.
+ */
+export declare const provenanceUploadDeferSchema: z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.defer">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    audience: z.ZodString;
+    mediaType: z.ZodString;
+    statementHash: z.ZodString;
+    dsseEnvelope: z.ZodObject<{
+        payloadType: z.ZodString;
+        payload: z.ZodString;
+        signatures: z.ZodArray<z.ZodObject<{
+            keyid: z.ZodString;
+            sig: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 export declare const eventEmitSchema: z.ZodObject<{
     type: z.ZodLiteral<"event.emit">;
@@ -933,6 +959,24 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     subjectName: z.ZodString;
     subjectDigest: z.ZodString;
     mediaType: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"provenance.upload.defer">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    subjectName: z.ZodString;
+    subjectDigest: z.ZodString;
+    audience: z.ZodString;
+    mediaType: z.ZodString;
+    statementHash: z.ZodString;
+    dsseEnvelope: z.ZodObject<{
+        payloadType: z.ZodString;
+        payload: z.ZodString;
+        signatures: z.ZodArray<z.ZodObject<{
+            keyid: z.ZodString;
+            sig: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    publicKey: z.ZodRecord<z.ZodString, z.ZodUnknown>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"event.emit">;
     jobId: z.ZodString;
@@ -1018,6 +1062,7 @@ export type CacheUserSaveComplete = z.infer<typeof cacheUserSaveCompleteSchema>;
 export type ProvenanceUploadRequest = z.infer<typeof provenanceUploadRequestSchema>;
 export type ProvenanceUploadResponse = z.infer<typeof provenanceUploadResponseSchema>;
 export type ProvenanceUploadComplete = z.infer<typeof provenanceUploadCompleteSchema>;
+export type ProvenanceUploadDefer = z.infer<typeof provenanceUploadDeferSchema>;
 export type FleetLogsRequest = z.infer<typeof fleetLogsRequestSchema>;
 export type FleetBundleChunk = z.infer<typeof fleetBundleChunkSchema>;
 export type FleetBundleError = z.infer<typeof fleetBundleErrorSchema>;

package/dist/protocol/messages/orchestrator-agent.js

@@ -1,5 +1,6 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { ExecutionJobStatus, ExecutionStepStatus, StepConcurrencyKind } from "./execution-status.js";
+import { dsseEnvelopeSchema } from "../../provenance/dsse.js";
 import { approverClauseSchema } from "../../approval/types.js";
 import { z } from "zod";
 //#region src/protocol/messages/orchestrator-agent.ts
@@ -532,6 +533,32 @@ const provenanceUploadCompleteSchema = z.object({
 	/** Bundle media type. */
 	mediaType: z.string()
 });
+/**
+* Agent -> Orchestrator: capture a frozen, DSSE-signed provenance statement for
+* later minting (the transient mint-failure path). No upload happens; the
+* orchestrator persists the envelope in its deferred-attestation outbox and the
+* job completes green. The identity token is minted later and bound to the
+* frozen statement by `statementHash`.
+*/
+const provenanceUploadDeferSchema = z.object({
+	type: z.literal("provenance.upload.defer"),
+	messageId: z.string(),
+	jobId: z.string(),
+	/** Caller-supplied artifact name. */
+	subjectName: z.string(),
+	/** Primary subject digest (lowercase hex). */
+	subjectDigest: z.string(),
+	/** Requested token audience for the later mint. */
+	audience: z.string(),
+	/** Bundle media type. */
+	mediaType: z.string(),
+	/** SHA-256 of the frozen DSSE statement payload — the later-mint binding. */
+	statementHash: z.string(),
+	/** The frozen, DSSE-signed statement envelope. */
+	dsseEnvelope: dsseEnvelopeSchema,
+	/** Ephemeral public key JWK the envelope was signed with. */
+	publicKey: z.record(z.string(), z.unknown())
+});
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 const eventEmitSchema = z.object({
 	type: z.literal("event.emit"),
@@ -743,6 +770,7 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	cacheUserSaveCompleteSchema,
 	provenanceUploadRequestSchema,
 	provenanceUploadCompleteSchema,
+	provenanceUploadDeferSchema,
 	eventEmitSchema,
 	agentApiRequestSchema,
 	agentMetricsSchema,
@@ -752,6 +780,6 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	stepApprovalRequestSchema
 ]);
 //#endregion
-export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
+export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/pat-kind.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/pat-kind.ts
 /**

package/dist/protocol/messages/peer.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { ExecutionJobStatus } from "./execution-status.js";
 import { LabelMatcher } from "../../labels-match.js";
 import { ScalerEventType } from "./scaler-event.js";