@kici-dev/engine 0.1.24 → 0.1.25

package/dist/protocol/messages/platform-orchestrator.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { heartbeatSchema } from "./common.js";
 import { executionStatusSchema, jobStatusForwardSchema, stateReplaySchema, stepStatusForwardSchema } from "./execution-status.js";
 import { jobContextMessageSchema, runEventMessageSchema } from "./run-events.js";
@@ -6,6 +6,7 @@ import { sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAc
 import { dashboardPlatformToOrchSchema } from "./dashboard.js";
 import { orchCapabilitiesSchema } from "./capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./auth.js";
+import { oidcMintRequestSchema, oidcMintResponseSchema } from "./oidc-mint.js";
 import { z } from "zod";
 //#region src/protocol/messages/platform-orchestrator.ts
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
@@ -338,6 +339,7 @@ const platformToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	peerDiscoverSchema,
 	peerUpdateSchema,
 	staleCheckrunCleanupSchema,
+	oidcMintResponseSchema,
 	...dashboardPlatformToOrchSchema.options
 ]);
 /** All messages that flow from Orchestrator to Platform.
@@ -363,7 +365,8 @@ const orchestratorToPlatformMessageSchema = z.discriminatedUnion("type", [
 	heartbeatSchema,
 	runEventMessageSchema,
 	jobContextMessageSchema,
-	orchMetricsSchema
+	orchMetricsSchema,
+	oidcMintRequestSchema
 ]);
 //#endregion
 export { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchCapabilitiesUpdateSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/protocol/messages/run-events.d.ts

@@ -133,6 +133,9 @@ export declare const dashboardOrchLogsRequestSchema: z.ZodObject<{
         type: z.ZodLiteral<"api_key">;
         keyId: z.ZodString;
         ownerSub: z.ZodString;
+        agent: z.ZodOptional<z.ZodObject<{
+            label: z.ZodString;
+        }, z.core.$strip>>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"service_account">;
         id: z.ZodString;

package/dist/protocol/messages/run-events.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { actorPrincipalSchema } from "./actor.js";
 import { z } from "zod";
 //#region src/protocol/messages/run-events.ts

package/dist/protocol/messages/scaler-event.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/scaler-event.ts
 /**

package/dist/protocol/messages/source-registration.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DeploymentIdentitySchema } from "./deployment-identity.js";
 import { z } from "zod";
 //#region src/protocol/messages/source-registration.ts

package/dist/protocol/source-origin.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+/**
+ * How a run was initiated, as branded into provenance attestations.
+ *
+ * `triggered` — a webhook event that resolved to a cloned commit; the
+ * repository/ref/sha coordinates come from a real VCS event.
+ * `run-remote` — a developer's local working-tree overlay (`kici run remote`):
+ * the source coordinates are caller-supplied, not a triggered VCS event.
+ *
+ * The brand is org-asserted (derived from the orchestrator-reported
+ * `local_working_tree` flag on the run). The one un-forgeable trust anchor is
+ * the origin org id; the brand and the repo/ref/sha are scoped to that org's
+ * infrastructure.
+ */
+export declare const SourceOrigin: z.ZodEnum<{
+    triggered: "triggered";
+    "run-remote": "run-remote";
+}>;
+export type SourceOrigin = z.infer<typeof SourceOrigin>;
+//# sourceMappingURL=source-origin.d.ts.map

package/dist/protocol/source-origin.js

@@ -0,0 +1,21 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/protocol/source-origin.ts
+/**
+* How a run was initiated, as branded into provenance attestations.
+*
+* `triggered` — a webhook event that resolved to a cloned commit; the
+* repository/ref/sha coordinates come from a real VCS event.
+* `run-remote` — a developer's local working-tree overlay (`kici run remote`):
+* the source coordinates are caller-supplied, not a triggered VCS event.
+*
+* The brand is org-asserted (derived from the orchestrator-reported
+* `local_working_tree` flag on the run). The one un-forgeable trust anchor is
+* the origin org id; the brand and the repo/ref/sha are scoped to that org's
+* infrastructure.
+*/
+const SourceOrigin = z.enum(["triggered", "run-remote"]);
+//#endregion
+export { SourceOrigin };
+
+//# sourceMappingURL=source-origin.js.map

package/dist/protocol/version.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/protocol/version.ts
 /**
 * Protocol version. Sent during WebSocket handshake.

package/dist/provenance/attestation-origin.d.ts

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+/**
+ * When the Platform identity token bound into a provenance bundle was minted,
+ * relative to the build. Orthogonal to the run's `SourceOrigin` brand.
+ * `live` — minted synchronously during the build (no deferral).
+ * `deferred` — the build's mint failed transiently; the token was minted later
+ *   against run/job rows the Platform already had (transient-blip recovery).
+ * `offline-backfill` — the run was ingested while the Platform was fully down;
+ *   the run/job rows were backfilled before the deferred mint. The temporal gap
+ *   is disclosed, never hidden.
+ */
+export declare const AttestationOrigin: z.ZodEnum<{
+    live: "live";
+    deferred: "deferred";
+    "offline-backfill": "offline-backfill";
+}>;
+export type AttestationOrigin = z.infer<typeof AttestationOrigin>;
+//# sourceMappingURL=attestation-origin.d.ts.map

package/dist/provenance/attestation-origin.js

@@ -0,0 +1,22 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/provenance/attestation-origin.ts
+/**
+* When the Platform identity token bound into a provenance bundle was minted,
+* relative to the build. Orthogonal to the run's `SourceOrigin` brand.
+* `live` — minted synchronously during the build (no deferral).
+* `deferred` — the build's mint failed transiently; the token was minted later
+*   against run/job rows the Platform already had (transient-blip recovery).
+* `offline-backfill` — the run was ingested while the Platform was fully down;
+*   the run/job rows were backfilled before the deferred mint. The temporal gap
+*   is disclosed, never hidden.
+*/
+const AttestationOrigin = z.enum([
+	"live",
+	"deferred",
+	"offline-backfill"
+]);
+//#endregion
+export { AttestationOrigin };
+
+//# sourceMappingURL=attestation-origin.js.map

package/dist/provenance/bundle.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { dsseEnvelopeSchema } from "./dsse.js";
 import { z } from "zod";
 //#region src/provenance/bundle.ts

package/dist/provenance/dsse.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/provenance/dsse.ts
 /**

package/dist/provenance/schema.d.ts

@@ -204,6 +204,7 @@ export declare const kiciWorkflowExternalParametersSchema: z.ZodObject<{
         ref: z.ZodString;
         path: z.ZodString;
     }, z.core.$strip>;
+    provider: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export type KiciWorkflowExternalParameters = z.infer<typeof kiciWorkflowExternalParametersSchema>;
 /** KiCI workflow internal parameters: run-scoped build context. */
@@ -211,6 +212,17 @@ export declare const kiciWorkflowInternalParametersSchema: z.ZodObject<{
     commit: z.ZodOptional<z.ZodString>;
     runId: z.ZodOptional<z.ZodString>;
     jobId: z.ZodOptional<z.ZodString>;
+    orgId: z.ZodOptional<z.ZodString>;
+    sourceOrigin: z.ZodOptional<z.ZodEnum<{
+        triggered: "triggered";
+        "run-remote": "run-remote";
+    }>>;
+    attestationOrigin: z.ZodOptional<z.ZodEnum<{
+        live: "live";
+        deferred: "deferred";
+        "offline-backfill": "offline-backfill";
+    }>>;
+    statementHash: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export type KiciWorkflowInternalParameters = z.infer<typeof kiciWorkflowInternalParametersSchema>;
 /** KiCI build definition: pins the buildType and types the workflow params. */
@@ -231,11 +243,23 @@ export declare const kiciBuildDefinitionSchema: z.ZodObject<{
             ref: z.ZodString;
             path: z.ZodString;
         }, z.core.$strip>;
+        provider: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>;
     internalParameters: z.ZodOptional<z.ZodObject<{
         commit: z.ZodOptional<z.ZodString>;
         runId: z.ZodOptional<z.ZodString>;
         jobId: z.ZodOptional<z.ZodString>;
+        orgId: z.ZodOptional<z.ZodString>;
+        sourceOrigin: z.ZodOptional<z.ZodEnum<{
+            triggered: "triggered";
+            "run-remote": "run-remote";
+        }>>;
+        attestationOrigin: z.ZodOptional<z.ZodEnum<{
+            live: "live";
+            deferred: "deferred";
+            "offline-backfill": "offline-backfill";
+        }>>;
+        statementHash: z.ZodOptional<z.ZodString>;
     }, z.core.$loose>>;
 }, z.core.$strip>;
 export type KiciBuildDefinition = z.infer<typeof kiciBuildDefinitionSchema>;
@@ -292,11 +316,23 @@ export declare const kiciProvenancePredicateSchema: z.ZodObject<{
                 ref: z.ZodString;
                 path: z.ZodString;
             }, z.core.$strip>;
+            provider: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>;
         internalParameters: z.ZodOptional<z.ZodObject<{
             commit: z.ZodOptional<z.ZodString>;
             runId: z.ZodOptional<z.ZodString>;
             jobId: z.ZodOptional<z.ZodString>;
+            orgId: z.ZodOptional<z.ZodString>;
+            sourceOrigin: z.ZodOptional<z.ZodEnum<{
+                triggered: "triggered";
+                "run-remote": "run-remote";
+            }>>;
+            attestationOrigin: z.ZodOptional<z.ZodEnum<{
+                live: "live";
+                deferred: "deferred";
+                "offline-backfill": "offline-backfill";
+            }>>;
+            statementHash: z.ZodOptional<z.ZodString>;
         }, z.core.$loose>>;
     }, z.core.$strip>;
     runDetails: z.ZodObject<{
@@ -362,11 +398,23 @@ export declare const kiciProvenanceStatementSchema: z.ZodObject<{
                     ref: z.ZodString;
                     path: z.ZodString;
                 }, z.core.$strip>;
+                provider: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>;
             internalParameters: z.ZodOptional<z.ZodObject<{
                 commit: z.ZodOptional<z.ZodString>;
                 runId: z.ZodOptional<z.ZodString>;
                 jobId: z.ZodOptional<z.ZodString>;
+                orgId: z.ZodOptional<z.ZodString>;
+                sourceOrigin: z.ZodOptional<z.ZodEnum<{
+                    triggered: "triggered";
+                    "run-remote": "run-remote";
+                }>>;
+                attestationOrigin: z.ZodOptional<z.ZodEnum<{
+                    live: "live";
+                    deferred: "deferred";
+                    "offline-backfill": "offline-backfill";
+                }>>;
+                statementHash: z.ZodOptional<z.ZodString>;
             }, z.core.$loose>>;
         }, z.core.$strip>;
         runDetails: z.ZodObject<{

package/dist/provenance/schema.js

@@ -1,4 +1,6 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
+import { SourceOrigin } from "../protocol/source-origin.js";
+import { AttestationOrigin } from "./attestation-origin.js";
 import { z } from "zod";
 //#region src/provenance/schema.ts
 /**
@@ -105,16 +107,28 @@ const inTotoStatementSchema = z.object({
 	predicate: z.record(z.string(), z.unknown())
 });
 /** KiCI workflow external parameters: the workflow source coordinates. */
-const kiciWorkflowExternalParametersSchema = z.object({ workflow: z.object({
-	repository: z.string(),
-	ref: z.string(),
-	path: z.string()
-}) }).passthrough();
+const kiciWorkflowExternalParametersSchema = z.object({
+	workflow: z.object({
+		repository: z.string(),
+		ref: z.string(),
+		path: z.string()
+	}),
+	/** Informational source provider (github / gitlab / bitbucket / local). Not a trust signal. */
+	provider: z.string().optional()
+}).passthrough();
 /** KiCI workflow internal parameters: run-scoped build context. */
 const kiciWorkflowInternalParametersSchema = z.object({
 	commit: z.string().optional(),
 	runId: z.string().optional(),
-	jobId: z.string().optional()
+	jobId: z.string().optional(),
+	/** Authoritative origin: the customer's public org id (Platform-asserted). */
+	orgId: z.string().optional(),
+	/** Source-origin brand: triggered vs kici run remote (local working-tree overlay). */
+	sourceOrigin: SourceOrigin.optional(),
+	/** Mint-timing marker frozen into a deferred statement at build time. */
+	attestationOrigin: AttestationOrigin.optional(),
+	/** SHA-256 of this statement's payload — the deferred-mint binding. */
+	statementHash: z.string().optional()
 }).passthrough();
 /** KiCI build definition: pins the buildType and types the workflow params. */
 const kiciBuildDefinitionSchema = buildDefinitionSchema.extend({

package/dist/provenance/statement-hash.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Lowercase-hex SHA-256 of the DSSE statement payload bytes. This is the binding
+ * a deferred OIDC mint commits to (truth-contract property 2): the later token
+ * carries this hash as a claim so the Platform identity cannot be re-bound to a
+ * different frozen statement at retry time. Browser-safe: `crypto.subtle` only,
+ * so the verifier (dashboard + CLI) can recompute it.
+ */
+export declare function computeStatementHash(payload: Uint8Array): Promise<string>;
+//# sourceMappingURL=statement-hash.d.ts.map

package/dist/provenance/statement-hash.js

@@ -0,0 +1,17 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/provenance/statement-hash.ts
+/**
+* Lowercase-hex SHA-256 of the DSSE statement payload bytes. This is the binding
+* a deferred OIDC mint commits to (truth-contract property 2): the later token
+* carries this hash as a claim so the Platform identity cannot be re-bound to a
+* different frozen statement at retry time. Browser-safe: `crypto.subtle` only,
+* so the verifier (dashboard + CLI) can recompute it.
+*/
+async function computeStatementHash(payload) {
+	const digest = await crypto.subtle.digest("SHA-256", payload);
+	return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+//#endregion
+export { computeStatementHash };
+
+//# sourceMappingURL=statement-hash.js.map

package/dist/provenance/verify.d.ts

@@ -23,6 +23,7 @@
  */
 import { type JSONWebKeySet } from 'jose';
 import { type KiciProvenanceStatement } from './schema.js';
+import { AttestationOrigin } from './attestation-origin.js';
 /** Tri-state outcome of a single verification check. */
 export type CheckStatus = 'pass' | 'fail' | 'skipped';
 /** Per-check verification outcomes. */
@@ -46,6 +47,12 @@ export interface VerifyResult {
     claims?: Record<string, unknown>;
     statement?: KiciProvenanceStatement;
     failures: string[];
+    /**
+     * Mint-timing origin of the identity token: `live` (minted during the build,
+     * cross-checked field-by-field), or `deferred` / `offline-backfill` (minted
+     * later, bound to the frozen statement by hash — the temporal gap is disclosed).
+     */
+    attestationOrigin?: AttestationOrigin;
 }
 export interface VerifyKiciBundleOptions {
     /** The bundle to verify (validated against `kiciBundleSchema`). */

package/dist/provenance/verify.js

@@ -1,7 +1,9 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
+import { AttestationOrigin } from "./attestation-origin.js";
 import { dssePae } from "./dsse.js";
 import { kiciBundleSchema } from "./bundle.js";
 import { kiciProvenanceStatementSchema } from "./schema.js";
+import { computeStatementHash } from "./statement-hash.js";
 import { calculateJwkThumbprint, createLocalJWKSet, importJWK, jwtVerify } from "jose";
 //#region src/provenance/verify.ts
 /**
@@ -63,13 +65,19 @@ async function verifyKiciBundle(opts) {
 	}
 	const bundle = parsed.data;
 	checks.schema = "pass";
-	const statementBytes = b64ToBytes(bundle.dsseEnvelope.payload);
 	let statement;
-	const stmt = kiciProvenanceStatementSchema.safeParse(JSON.parse(new TextDecoder().decode(statementBytes)));
-	if (!stmt.success) {
+	let statementBytes;
+	try {
+		statementBytes = b64ToBytes(bundle.dsseEnvelope.payload);
+		const stmt = kiciProvenanceStatementSchema.safeParse(JSON.parse(new TextDecoder().decode(statementBytes)));
+		if (!stmt.success) {
+			checks.schema = "fail";
+			failures.push("statement_schema_invalid");
+		} else statement = stmt.data;
+	} catch {
 		checks.schema = "fail";
-		failures.push("statement_schema_invalid");
-	} else statement = stmt.data;
+		failures.push("statement_payload_invalid");
+	}
 	let claims;
 	try {
 		const { payload } = await jwtVerify(bundle.verificationMaterial.identityToken, createLocalJWKSet(opts.jwks), {
@@ -83,6 +91,7 @@ async function verifyKiciBundle(opts) {
 		failures.push("identity_token_invalid");
 	}
 	try {
+		if (!statementBytes) throw new Error("no statement bytes");
 		const pubJwk = bundle.verificationMaterial.publicKey;
 		const thumbprint = await calculateJwkThumbprint(pubJwk, "sha256");
 		if (bundle.dsseEnvelope.signatures[0].keyid !== thumbprint) throw new Error("keyid does not match public-key thumbprint");
@@ -96,11 +105,18 @@ async function verifyKiciBundle(opts) {
 		checks.dsse = "fail";
 		failures.push("dsse_signature_invalid");
 	}
-	if (statement && claims) {
+	const attestationOrigin = resolveAttestationOrigin(claims, statement);
+	if (statement && claims && statementBytes) if (attestationOrigin === AttestationOrigin.enum.live) {
 		const ok = crossCheckBuildContext(statement, claims);
 		checks.buildContext = ok ? "pass" : "fail";
 		if (!ok) failures.push("build_context_mismatch");
 	} else {
+		const actual = await computeStatementHash(statementBytes);
+		const ok = typeof claims.statement_hash === "string" && claims.statement_hash === actual;
+		checks.buildContext = ok ? "pass" : "fail";
+		if (!ok) failures.push("statement_hash_mismatch");
+	}
+	else {
 		checks.buildContext = "fail";
 		failures.push("build_context_uncheckable");
 	}
@@ -115,15 +131,38 @@ async function verifyKiciBundle(opts) {
 		checks,
 		claims,
 		statement,
-		failures
+		failures,
+		attestationOrigin
 	};
 }
-/** The statement's build context must equal the (server-truth) JWT claims. */
+/** Derive the mint-timing origin from the token claim, then the frozen statement. */
+function resolveAttestationOrigin(claims, statement) {
+	const fromClaim = AttestationOrigin.safeParse(claims?.attestation_origin);
+	if (fromClaim.success) return fromClaim.data;
+	const internal = statement?.predicate.buildDefinition.internalParameters;
+	const fromStatement = AttestationOrigin.safeParse(internal?.attestationOrigin);
+	return fromStatement.success ? fromStatement.data : AttestationOrigin.enum.live;
+}
+/**
+* The statement's build context must equal the (server-truth) JWT claims.
+*
+* Only the **claims** side is normalized (`?? ''`): the producer coerces a
+* null/absent `repository` / `ref` / `workflow_ref` claim into the
+* schema-required empty string and omits `commit` entirely when `sha` is
+* falsy, so a null/absent claim is compared against that coerced `''` /
+* omitted-commit. The **statement** side stays strict — a non-empty
+* attacker-controlled statement field never matches a null claim
+* (`'evil/repo' === (null ?? '')` → `'evil/repo' === ''` → false), and an
+* empty statement field never matches a non-null claim — so this relaxation
+* is forgery-safe in exactly one direction: empty/absent statement ⇔
+* null/absent claim, and nothing else. `runId` / `jobId` are always minted,
+* so they stay strict.
+*/
 function crossCheckBuildContext(statement, claims) {
 	const bd = statement.predicate.buildDefinition;
 	const wf = bd.externalParameters.workflow;
 	const ip = bd.internalParameters ?? {};
-	return wf.repository === claims.repository && wf.ref === claims.ref && wf.path === claims.workflow_ref && ip.commit === claims.sha && ip.runId === claims.kici_run_id && ip.jobId === claims.kici_job_id;
+	return wf.repository === (claims.repository ?? "") && wf.ref === (claims.ref ?? "") && wf.path === (claims.workflow_ref ?? "") && (ip.commit ?? "") === (claims.sha ?? "") && ip.runId === claims.kici_run_id && ip.jobId === claims.kici_job_id;
 }
 /** At least one subject must carry a digest matching the supplied artifact digest. */
 function checkSubjectDigest(statement, expected) {

package/dist/provider/changed-files-fetcher.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/provider/check-run-conclusion.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/provider/check-run-conclusion.ts
 /**

package/dist/provider/check-status-poster.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/provider/clone-token-provider.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/provider/contributor-resolver.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/provider/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { LockFileParseError } from "./lock-file-parse-error.js";
 import { CheckRunConclusion } from "./check-run-conclusion.js";
 export { CheckRunConclusion, LockFileParseError };

package/dist/provider/lock-file-fetcher.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/provider/lock-file-parse-error.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/provider/lock-file-parse-error.ts
 /**
 * Thrown by a LockFileFetcher when a lock file is present at the repo ref but

package/dist/provider/repo-url-builder.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/provider/types.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/provider/webhook-normalizer.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/registration/registerable-trigger-type.d.ts

@@ -26,10 +26,10 @@ import { z } from 'zod';
  */
 export declare const RegisterableTriggerType: z.ZodEnum<{
     dispatch: "dispatch";
+    push: "push";
     status: "status";
     generic_webhook: "generic_webhook";
     pr: "pr";
-    push: "push";
     tag: "tag";
     comment: "comment";
     review: "review";

package/dist/registration/registerable-trigger-type.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/registration/registerable-trigger-type.ts
 /**

package/dist/{chunk-BTugEXQM.js → rolldown-runtime-ClRpJifh.js}

@@ -1,4 +1,3 @@
 import "node:module";
-import.meta.url;
 //#endregion
 export {};

package/dist/scaler/resource-types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/scaler/resource-types.ts
 /**

package/dist/scaler/scaler-backend-type.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/scaler/scaler-backend-type.ts
 /**

package/dist/secrets/index.d.ts

@@ -3,5 +3,5 @@
  *
  * Re-exports scope-based secret store types and audit entry.
  */
-export type { SecretStore, AuditEntry, BackendType, BackendHealthStatus, BackendDescriptor, AddBackendParams, BackendManager, BackendSyncManager, } from './types.js';
+export type { SecretStore, AuditEntry, BackendType, BackendHealthStatus, BackendDescriptor, AddBackendParams, BackendSyncManager, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/secrets/types.d.ts

@@ -69,30 +69,6 @@ export interface AddBackendParams {
     scopeFilter?: string;
     syncIntervalMs?: number;
 }
-/**
- * Backend lifecycle manager interface.
- * Provides CRUD, health checks, and connection testing for secret backends.
- */
-export interface BackendManager {
-    /** Check backend connectivity. Returns health status. */
-    checkHealth(name: string): Promise<BackendHealthStatus>;
-    /** Trigger scope discovery sync for a backend (or all if name omitted). */
-    syncScopes(name?: string): Promise<void>;
-    /** List all registered backends (no credentials). */
-    listBackends(): Promise<BackendDescriptor[]>;
-    /** Get a single backend by name. */
-    getBackend(name: string): Promise<BackendDescriptor | null>;
-    /** Register a new backend. Returns the descriptor. */
-    addBackend(params: AddBackendParams): Promise<BackendDescriptor>;
-    /** Remove a backend by name. Returns true if removed. */
-    removeBackend(name: string): Promise<boolean>;
-    /** Test connectivity without persisting. */
-    testConnection(params: AddBackendParams): Promise<{
-        ok: boolean;
-        error?: string;
-        latencyMs: number;
-    }>;
-}
 /**
  * Periodic scope sync manager for secret backends.
  */

package/dist/secrets/types.js

@@ -1,2 +1,2 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 export {};

package/dist/state-machine/index.js

@@ -1,3 +1,3 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { isTerminal, transition } from "./machine.js";
 export { isTerminal, transition };

package/dist/state-machine/machine.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { TERMINAL_STATES } from "./types.js";
 //#region src/state-machine/machine.ts
 /**