@kici-dev/engine 0.15.0 → 0.16.0

package/dist/protocol/version.d.ts

@@ -1,21 +1,15 @@
 /**
  * Protocol version. Sent during WebSocket handshake.
  *
- * Increment when a message schema gains something an older peer cannot parse,
- * and pair the bump with a named floor so a sender can gate on the version a
- * peer negotiated instead of guessing.
+ * Increment when a message schema gains something an older peer cannot parse.
+ * The minimum equals the current version, so every bump is a breaking change:
+ * every tier upgrades in the same window.
  *
- * Version 3 records that a version-2 peer (every 0.8.x build) cannot parse the
- * 0.9.0 `trust_policy.update` policy, the peer heartbeat, or the
- * `artifacts.upload.complete` frame: the fields it requires were removed and
- * the schemas are strict, so a version-2 peer that was let through the
- * handshake would drop or refuse those frames silently.
+ * Version 4: fields every sender already set are required, and the capability
+ * flags every build advertised are gone. A version-3 peer (every release
+ * before it) may omit those fields, so it is refused at connect.
  */
-export declare const PROTOCOL_VERSION = 3;
-/**
- * Minimum protocol version accepted.
- * Connections below this are rejected.
- * Capabilities handle per-feature negotiation above this baseline.
- */
-export declare const MIN_PROTOCOL_VERSION = 3;
+export declare const PROTOCOL_VERSION = 4;
+/** Minimum protocol version accepted. Connections below this are rejected. */
+export declare const MIN_PROTOCOL_VERSION = 4;
 //# sourceMappingURL=version.d.ts.map

package/dist/protocol/version.js

@@ -3,23 +3,17 @@ import "../rolldown-runtime-ClRpJifh.js";
 /**
 * Protocol version. Sent during WebSocket handshake.
 *
-* Increment when a message schema gains something an older peer cannot parse,
-* and pair the bump with a named floor so a sender can gate on the version a
-* peer negotiated instead of guessing.
+* Increment when a message schema gains something an older peer cannot parse.
+* The minimum equals the current version, so every bump is a breaking change:
+* every tier upgrades in the same window.
 *
-* Version 3 records that a version-2 peer (every 0.8.x build) cannot parse the
-* 0.9.0 `trust_policy.update` policy, the peer heartbeat, or the
-* `artifacts.upload.complete` frame: the fields it requires were removed and
-* the schemas are strict, so a version-2 peer that was let through the
-* handshake would drop or refuse those frames silently.
+* Version 4: fields every sender already set are required, and the capability
+* flags every build advertised are gone. A version-3 peer (every release
+* before it) may omit those fields, so it is refused at connect.
 */
-const PROTOCOL_VERSION = 3;
-/**
-* Minimum protocol version accepted.
-* Connections below this are rejected.
-* Capabilities handle per-feature negotiation above this baseline.
-*/
-const MIN_PROTOCOL_VERSION = 3;
+const PROTOCOL_VERSION = 4;
+/** Minimum protocol version accepted. Connections below this are rejected. */
+const MIN_PROTOCOL_VERSION = 4;
 //#endregion
 export { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION };
 

package/dist/provenance/id-token-claim-names.d.ts

@@ -1,11 +1,9 @@
 /**
  * Every claim a KiCI provenance ID token carries, in a stable order.
  *
- * Both OIDC discovery documents render `claims_supported` from this list — the
- * orchestrator issuer that mints tokens today and the legacy Platform issuer
- * whose already-issued tokens carried the same shape — so a relying party
- * configuring a trust policy reads the same names under either `iss`. The
- * orchestrator binds the list to its `IdTokenClaims` type at compile time and
+ * The orchestrator's OIDC discovery document renders `claims_supported` from
+ * this list, so a relying party configuring a trust policy reads the names the
+ * tokens carry. The orchestrator binds the list to its `IdTokenClaims` type at compile time and
  * a drift test checks it against the claims its builder actually emits.
  */
 export declare const ID_TOKEN_CLAIM_NAMES: readonly ['iss', 'sub', 'aud', 'iat', 'nbf', 'exp', 'jti', 'kici_run_id', 'kici_job_id', 'repository', 'workflow_repository', 'ref', 'base_ref', 'head_ref', 'head_repository', 'is_fork', 'event_name', 'trust_tier', 'actor', 'sha', 'workflow_ref', 'orchestrator_id', 'org_id', 'source_origin', 'provider', 'statement_hash', 'attestation_origin'];

package/dist/provenance/id-token-claim-names.js

@@ -3,11 +3,9 @@ import "../rolldown-runtime-ClRpJifh.js";
 /**
 * Every claim a KiCI provenance ID token carries, in a stable order.
 *
-* Both OIDC discovery documents render `claims_supported` from this list — the
-* orchestrator issuer that mints tokens today and the legacy Platform issuer
-* whose already-issued tokens carried the same shape — so a relying party
-* configuring a trust policy reads the same names under either `iss`. The
-* orchestrator binds the list to its `IdTokenClaims` type at compile time and
+* The orchestrator's OIDC discovery document renders `claims_supported` from
+* this list, so a relying party configuring a trust policy reads the names the
+* tokens carry. The orchestrator binds the list to its `IdTokenClaims` type at compile time and
 * a drift test checks it against the claims its builder actually emits.
 */
 const ID_TOKEN_CLAIM_NAMES = [

package/dist/status/presentation.d.ts

@@ -1,6 +1,6 @@
 /**
  * Shared execution-status presentation vocabulary: the canonical status union,
- * a total precedence order for roll-up aggregates, legacy-spelling resolution,
+ * a total precedence order for roll-up aggregates, canonical-status resolution,
  * and a per-status failure classification.
  *
  * Pure Zod (browser-safe): the engine barrel re-exports this module and the
@@ -23,21 +23,9 @@ export type CanonicalStatus = ExecutionRunStatus | ExecutionJobStatus;
 export declare const CANONICAL_STATUSES: readonly CanonicalStatus[];
 /** Canonical statuses ordered worst-first. Derived from `STATUS_RANK`. */
 export declare const STATUS_PRECEDENCE: readonly CanonicalStatus[];
-/**
- * Legacy status spellings that map onto a canonical status. An alias always
- * resolves like the status it aliases, so a consumer never needs a second
- * hand-written copy of the mapping.
- */
-export declare const LEGACY_STATUS_ALIASES: Readonly<Record<string, CanonicalStatus>>;
 /**
  * Resolve a status string onto its canonical status, or `undefined` when it is
- * neither canonical nor a known legacy alias. Callers that accept mixed case
- * lowercase their input first.
- *
- * `Object.hasOwn`, not a bare index: an object literal inherits
- * `Object.prototype`, so indexing it with `toString` / `constructor` /
- * `valueOf` would yield a function rather than `undefined` and the caller's
- * fallback would never fire.
+ * not canonical. Callers that accept mixed case lowercase their input first.
  */
 export declare function toCanonicalStatus(status: string): CanonicalStatus | undefined;
 /**

package/dist/status/presentation.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 //#region src/status/presentation.ts
 /**
 * Shared execution-status presentation vocabulary: the canonical status union,
-* a total precedence order for roll-up aggregates, legacy-spelling resolution,
+* a total precedence order for roll-up aggregates, canonical-status resolution,
 * and a per-status failure classification.
 *
 * Pure Zod (browser-safe): the engine barrel re-exports this module and the
@@ -61,30 +61,10 @@ const STATUS_RANK = Object.freeze({
 /** Canonical statuses ordered worst-first. Derived from `STATUS_RANK`. */
 const STATUS_PRECEDENCE = Object.freeze([...CANONICAL_STATUSES].sort((a, b) => STATUS_RANK[a] - STATUS_RANK[b]));
 /**
-* Legacy status spellings that map onto a canonical status. An alias always
-* resolves like the status it aliases, so a consumer never needs a second
-* hand-written copy of the mapping.
-*/
-const LEGACY_STATUS_ALIASES = Object.freeze({
-	passed: ExecutionRunStatus.enum.success,
-	completed: ExecutionRunStatus.enum.success,
-	in_progress: ExecutionRunStatus.enum.running,
-	error: ExecutionRunStatus.enum.failed,
-	canceled: ExecutionRunStatus.enum.cancelled,
-	waiting: ExecutionRunStatus.enum.pending
-});
-/**
 * Resolve a status string onto its canonical status, or `undefined` when it is
-* neither canonical nor a known legacy alias. Callers that accept mixed case
-* lowercase their input first.
-*
-* `Object.hasOwn`, not a bare index: an object literal inherits
-* `Object.prototype`, so indexing it with `toString` / `constructor` /
-* `valueOf` would yield a function rather than `undefined` and the caller's
-* fallback would never fire.
+* not canonical. Callers that accept mixed case lowercase their input first.
 */
 function toCanonicalStatus(status) {
-	if (Object.hasOwn(LEGACY_STATUS_ALIASES, status)) return LEGACY_STATUS_ALIASES[status];
 	return CANONICAL_SET.has(status) ? status : void 0;
 }
 /**
@@ -158,6 +138,6 @@ function isFailureStatus(status) {
 	return canonical !== void 0 && STATUS_FAILURE_CLASS[canonical] === StatusFailureClass.enum.failure;
 }
 //#endregion
-export { CANONICAL_STATUSES, LEGACY_STATUS_ALIASES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus };
+export { CANONICAL_STATUSES, STATUS_FAILURE_CLASS, STATUS_PRECEDENCE, StatusFailureClass, isFailureStatus, toCanonicalStatus, worstStatus };
 
 //# sourceMappingURL=presentation.js.map

package/dist/trigger/types.d.ts

@@ -42,11 +42,9 @@
  *   sibling closure the deps tarball carries, which no package-manager lock file moves).
  * Schema version 41 (additive): adds LockDynamicJobFn.gitCredentials (named git credential
  *   refs declared by a dynamicJob generator and inherited by every job it generates).
- * Schema version 42 (additive, conditional reader floor): approval enforced on
- *   organization-wide workflows. The lock shape is unchanged, but a v41 reader dispatches a
- *   global workflow without consulting its `approval`, so a lock whose global workflow (or
- *   one of its static jobs) declares `approval` stamps `minReaderVersion` =
- *   `GLOBAL_APPROVAL_MIN_READER`. Every other lock keeps `minReaderVersion` = `BREAKING_FLOOR`.
+ * Schema version 42 (BREAKING): approval enforced on organization-wide workflows (a v41
+ *   reader dispatches a global workflow without consulting its `approval`), and
+ *   `minReaderVersion` is required. The floor moves to 42.
  */
 import { z } from 'zod';
 import type { ProviderType } from '../provider/types.js';
@@ -66,26 +64,13 @@ export declare const SCHEMA_VERSION: 42;
  *
  * A lock at `schemaVersion >= BREAKING_FLOOR` parses correctly here even if it
  * is newer than `SCHEMA_VERSION` (additive bumps add fields this reader ignores).
- * A lock below the floor was produced by an SDK whose breaking change this
- * reader predates and must be rejected (it would mis-parse silently otherwise).
+ * A lock below the floor must be recompiled with a current SDK and is rejected.
  *
- * Bump rule: move this to the current `SCHEMA_VERSION` ONLY in the commit that
- * lands a `BREAKING` schema change (see the bump-history convention above). It
- * currently sits at 30 because v30 (`environments`→`contexts`) was the most
- * recent breaking bump; v31 through v35 were additive, so a v30 lock still
- * reads correctly.
+ * Bump rule: move this to the current `SCHEMA_VERSION` in the commit that lands
+ * a `BREAKING` schema change (see the bump-history convention above). An
+ * additive bump leaves it in place, so locks compiled at the floor stay readable.
  */
-export declare const BREAKING_FLOOR: 30;
-/**
- * Reader version a lock must require when an organization-wide workflow in it
- * (a workflow with a trigger carrying `repos:`), or one of that workflow's
- * static jobs, declares `approval`. Readers below this version run a global
- * workflow's jobs without holding them for approval, so they must refuse such a
- * lock rather than dispatch it ungated. Not a `BREAKING_FLOOR` move: the lock
- * shape is unchanged, and locks without a gated global workflow stay readable by
- * every orchestrator down to the floor.
- */
-export declare const GLOBAL_APPROVAL_MIN_READER: 42;
+export declare const BREAKING_FLOOR: 42;
 /**
  * Normalized approval config carried in the lock file. Produced by the compiler
  * from an SDK `approval` at any of the three levels; consumed by the
@@ -533,6 +518,39 @@ export interface LockRule {
         readonly index: number;
     };
 }
+/**
+ * A declarative cache spec as serialized into the lock file. Mirrors the SDK
+ * `CacheSpec`; the engine cannot import the SDK, so the shape is inlined here.
+ */
+export interface LockCacheSpec {
+    readonly key: string;
+    readonly paths: readonly string[];
+    readonly restoreKeys?: readonly string[];
+}
+/** Lock-file form of the SDK `GenericInitConfig`. */
+interface LockGenericInitConfig {
+    readonly run: string;
+    readonly shell?: string;
+    readonly cache?: LockCacheSpec;
+    readonly timeout?: number;
+    readonly env?: Record<string, string>;
+}
+/** Lock-file form of the SDK `MiseInitConfig`. */
+interface LockMiseInitConfig {
+    readonly cache?: LockCacheSpec | false;
+    readonly timeout?: number;
+    readonly env?: Record<string, string>;
+    readonly shell?: string;
+}
+type LockInitItem = LockGenericInitConfig | 'mise' | {
+    readonly mise: LockMiseInitConfig;
+};
+/**
+ * Per-job init config as serialized into the lock file. Mirrors the SDK
+ * `InitConfig` (a generic config, a typed preset, an ordered array, `'auto'`,
+ * or `false`); the engine cannot import the SDK, so the shape is inlined here.
+ */
+export type LockInitConfig = LockInitItem | readonly LockInitItem[] | 'auto' | false;
 /**
  * Step in lock file.
  * Minimal representation - agents load full step functions from source.
@@ -553,12 +571,31 @@ export interface LockStep {
         readonly backoff: 'fixed' | 'exponential';
         readonly maxDelayMs: number;
     };
+    /** Declarative cache specs (normalized to an array). Restored before / saved after the step. */
+    readonly cache?: readonly LockCacheSpec[];
     /** Source location of the step() call in the original TypeScript file (for annotations). */
     readonly sourceLocation?: {
         readonly file: string;
         readonly line: number;
         readonly column: number;
     };
+    /** Whether this step has conditional rules (evaluated agent-side). */
+    readonly hasRules?: boolean;
+    /** Step-level rules (same format as job rules). */
+    readonly rules?: readonly LockRule[];
+    /** Whether this step has an onCancel hook. */
+    readonly hasOnCancel?: boolean;
+    /** Whether this step has a cleanup hook. */
+    readonly hasCleanup?: boolean;
+    /**
+     * Whether this step declares an idempotent `check` facet. When true the
+     * orchestrator knows the step is check-capable and a run can be dispatched in
+     * check mode. The check/apply closures themselves are never serialized — the
+     * agent re-evaluates the real workflow TypeScript.
+     */
+    readonly hasCheck?: boolean;
+    /** Whether this step declares a `whenInSync` facet (produces outputs when in sync). */
+    readonly hasWhenInSync?: boolean;
     /** Normalized approval gate; when set the step pauses for a human approval. */
     readonly approval?: LockApproval;
 }
@@ -670,9 +707,19 @@ export declare const NeedsGroupEntrySchema: z.ZodObject<{
 }, z.core.$strip>;
 export type NeedsGroupEntry = z.infer<typeof NeedsGroupEntrySchema>;
 /**
- * Static job in lock file.
- * Contains all orchestrator-readable information for scheduling.
+ * A `needs` entry as the compiler writes it into the lock file. `runOn` is the
+ * resolved status-set; it is a plain array because a raw status-set an author
+ * passes is copied through as is, so a reader must not assume it is non-empty.
  */
+export interface LockNeedsEntry {
+    readonly name: string;
+    readonly runOn: ExecutionJobStatus[];
+}
+/** A dynamic-group `needs` entry as the compiler writes it into the lock file. */
+export interface LockNeedsGroupEntry {
+    readonly group: string;
+    readonly runOn: ExecutionJobStatus[];
+}
 /** Normalized runsOnAll predicate: OR of AND-groups (include), minus exclude matchers. */
 export interface RunsOnAllPredicate {
     /** OR across groups; AND within a group. */
@@ -761,6 +808,14 @@ export interface LockInvoke {
      */
     readonly optional?: boolean;
 }
+/**
+ * Static job in lock file.
+ * Contains all orchestrator-readable information for scheduling.
+ *
+ * `runsOn` contains user-supplied labels only. The `kici:role:*` labels
+ * (e.g., `kici:role:builder`, `kici:role:init-runner`) are injected by the
+ * orchestrator for internal job types (build/init) and are not user-settable.
+ */
 export interface LockJob {
     readonly _type: 'static';
     readonly name: string;
@@ -818,7 +873,7 @@ export interface LockJob {
     readonly maxParallel?: number;
     /** Halt the fan-out on first child failure, skipping the held remainder. Default `false`. */
     readonly failFast?: boolean;
-    readonly needs: readonly (string | NeedsEntry | NeedsGroupEntry)[];
+    readonly needs: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
     /** Group names this job depends on (populated by compiler from dynamicGroup refs). */
     readonly dependsOnGroups?: readonly string[];
     readonly steps: readonly LockStepEntry[];
@@ -827,6 +882,10 @@ export interface LockJob {
     readonly exclude?: readonly Record<string, string>[];
     readonly rules?: readonly LockRule[];
     readonly description?: string;
+    /** When false, agent skips git clone (default: true). */
+    readonly checkout?: boolean;
+    /** Declarative cache specs (normalized to an array). Restored before steps / saved after the job. */
+    readonly cache?: readonly LockCacheSpec[];
     /**
      * Bound contexts in merge order. Each entry is a static name; `dynamic` is set
      * when it is a function resolved on the eval agent's init-runner. Later entries
@@ -844,6 +903,20 @@ export interface LockJob {
     readonly concurrencyGroup?: string;
     /** When true, concurrencyGroup is dynamic (function) -- resolved on the eval agent's init-runner. */
     readonly dynamicConcurrencyGroup?: boolean;
+    /** Whether this job has an onCancel hook. */
+    readonly hasOnCancel?: boolean;
+    /** Whether this job has a cleanup hook. */
+    readonly hasCleanup?: boolean;
+    /** Whether this job has an onSuccess hook. */
+    readonly hasOnSuccess?: boolean;
+    /** Whether this job has an onFailure hook. */
+    readonly hasOnFailure?: boolean;
+    /** Whether this job has a beforeStep hook. */
+    readonly hasBeforeStep?: boolean;
+    /** Whether this job has an afterStep hook. */
+    readonly hasAfterStep?: boolean;
+    /** Seconds before SIGKILL after SIGTERM during cancellation. */
+    readonly gracePeriod?: number;
     /** Total job wall-clock timeout in milliseconds (init + all steps + hooks). Threaded to the agent via jobConfig. */
     readonly timeout?: number;
     /**
@@ -852,6 +925,12 @@ export interface LockJob {
      * (`requests`) and kernel-side enforcement (`limits`) on the spawned agent.
      */
     readonly resources?: import('../scaler/resource-types.js').ResourceRequest;
+    /**
+     * Per-job init config(s) run after clone, before steps. Threaded verbatim from
+     * the SDK `Job.init`. The agent reads it from the loaded module; the lock copy
+     * is for orchestrator/dashboard visibility.
+     */
+    readonly init?: LockInitConfig;
     /**
      * Container image selecting the container execution backend on the agent. A
      * bare image string, or an object naming exactly one image source: a
@@ -936,7 +1015,7 @@ export interface LockDynamicJobFn {
      * with their frozen outputs available as ctx.needs. Same normalized shape as
      * a static job's `needs`.
      */
-    readonly needs?: readonly (string | NeedsEntry | NeedsGroupEntry)[];
+    readonly needs?: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
     /** True when this dynamic entry was authored as dynamicJob(group, { needs, generate }). */
     readonly resultAware?: boolean;
     /**
@@ -1003,6 +1082,14 @@ export interface LockWorkflow {
      * env vars on the install subprocess for use with a customer-committed `.kici/.npmrc`.
      */
     readonly installEnv?: readonly string[];
+    /** Whether this workflow has an onCancel hook. */
+    readonly hasOnCancel?: boolean;
+    /** Whether this workflow has a cleanup hook. */
+    readonly hasCleanup?: boolean;
+    /** Whether this workflow has an onSuccess hook. */
+    readonly hasOnSuccess?: boolean;
+    /** Whether this workflow has an onFailure hook. */
+    readonly hasOnFailure?: boolean;
     /** Workflow-level concurrency configuration. */
     readonly concurrency?: {
         readonly hasGroup: boolean;
@@ -1044,18 +1131,21 @@ export interface LockFile {
     readonly schemaVersion: typeof SCHEMA_VERSION;
     /**
      * The oldest reader schema version that handles this lock correctly. The
-     * compiler stamps `BREAKING_FLOOR`, or `GLOBAL_APPROVAL_MIN_READER` when an
-     * organization-wide workflow in the lock declares `approval`. A reader whose
+     * compiler stamps `BREAKING_FLOOR`. A reader whose
      * own `SCHEMA_VERSION` is below this value would mis-handle the lock and must
-     * reject it. Absent on
-     * pre-window locks, in which case the reader falls back to exact-match
-     * strictness (see `assertLockFileSchemaCompatible`).
+     * reject it. Required: a lock without it fails the reader's compatibility check.
      */
-    readonly minReaderVersion?: number;
+    readonly minReaderVersion: number;
     readonly source: LockSource;
     /** SHA-256 hash of the serialized lock file content (excluding this field). Changes only when workflows, triggers, jobs, or bundle hashes change. */
     readonly contentHash: string;
-    /** SHA-256 hash of .kici/ lockfile (pnpm-lock.yaml or package-lock.json). Used for dependency cache keying. */
+    /**
+     * SHA-256 hash of the repo's lockfile, used as the dependency cache key. The
+     * lockfile is the one the detected package manager produces — `.kici/`'s
+     * `package-lock.json` for npm, or the repo-root `pnpm-lock.yaml` /
+     * `yarn.lock` for a pnpm/yarn workspace. The hash input is prefixed with the
+     * manager name so a manager change is a guaranteed cache miss.
+     */
     readonly lockfileHash?: string;
     /**
      * SHA-256 over the git-tracked source of every in-repo `workspace:` /
@@ -1169,4 +1259,5 @@ export interface SimulatedEvent {
      */
     headRepo?: string;
 }
+export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/trigger/types.js

@@ -47,11 +47,9 @@ import { z } from "zod";
 *   sibling closure the deps tarball carries, which no package-manager lock file moves).
 * Schema version 41 (additive): adds LockDynamicJobFn.gitCredentials (named git credential
 *   refs declared by a dynamicJob generator and inherited by every job it generates).
-* Schema version 42 (additive, conditional reader floor): approval enforced on
-*   organization-wide workflows. The lock shape is unchanged, but a v41 reader dispatches a
-*   global workflow without consulting its `approval`, so a lock whose global workflow (or
-*   one of its static jobs) declares `approval` stamps `minReaderVersion` =
-*   `GLOBAL_APPROVAL_MIN_READER`. Every other lock keeps `minReaderVersion` = `BREAKING_FLOOR`.
+* Schema version 42 (BREAKING): approval enforced on organization-wide workflows (a v41
+*   reader dispatches a global workflow without consulting its `approval`), and
+*   `minReaderVersion` is required. The floor moves to 42.
 */
 /**
 * Schema version the compiler emits into every lock file. Incremented on ANY
@@ -65,26 +63,13 @@ const SCHEMA_VERSION = 42;
 *
 * A lock at `schemaVersion >= BREAKING_FLOOR` parses correctly here even if it
 * is newer than `SCHEMA_VERSION` (additive bumps add fields this reader ignores).
-* A lock below the floor was produced by an SDK whose breaking change this
-* reader predates and must be rejected (it would mis-parse silently otherwise).
+* A lock below the floor must be recompiled with a current SDK and is rejected.
 *
-* Bump rule: move this to the current `SCHEMA_VERSION` ONLY in the commit that
-* lands a `BREAKING` schema change (see the bump-history convention above). It
-* currently sits at 30 because v30 (`environments`→`contexts`) was the most
-* recent breaking bump; v31 through v35 were additive, so a v30 lock still
-* reads correctly.
+* Bump rule: move this to the current `SCHEMA_VERSION` in the commit that lands
+* a `BREAKING` schema change (see the bump-history convention above). An
+* additive bump leaves it in place, so locks compiled at the floor stay readable.
 */
-const BREAKING_FLOOR = 30;
-/**
-* Reader version a lock must require when an organization-wide workflow in it
-* (a workflow with a trigger carrying `repos:`), or one of that workflow's
-* static jobs, declares `approval`. Readers below this version run a global
-* workflow's jobs without holding them for approval, so they must refuse such a
-* lock rather than dispatch it ungated. Not a `BREAKING_FLOOR` move: the lock
-* shape is unchanged, and locks without a gated global workflow stay readable by
-* every orchestrator down to the floor.
-*/
-const GLOBAL_APPROVAL_MIN_READER = 42;
+const BREAKING_FLOOR = 42;
 /**
 * Resolve a content requirement's parse format to a concrete value. An explicit
 * non-`auto` format is returned as-is; `auto` (or unset) is resolved by the file
@@ -219,6 +204,6 @@ const changedFilesStatusSchema = z.enum([
 	"skipped"
 ]);
 //#endregion
-export { BREAKING_FLOOR, GLOBAL_APPROVAL_MIN_READER, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
+export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
 
 //# sourceMappingURL=types.js.map

package/dist/util/date.d.ts

@@ -0,0 +1,7 @@
+/**
+ * ISO-8601 for a timestamp column that a Postgres driver returns as a `Date`
+ * and a JSON round-trip or a mock returns as a string. A string passes through
+ * unchanged (never re-parsed).
+ */
+export declare function toIsoString(value: Date | string): string;
+//# sourceMappingURL=date.d.ts.map

package/dist/util/date.js

@@ -0,0 +1,14 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/util/date.ts
+/**
+* ISO-8601 for a timestamp column that a Postgres driver returns as a `Date`
+* and a JSON round-trip or a mock returns as a string. A string passes through
+* unchanged (never re-parsed).
+*/
+function toIsoString(value) {
+	return value instanceof Date ? value.toISOString() : String(value);
+}
+//#endregion
+export { toIsoString };
+
+//# sourceMappingURL=date.js.map

package/dist/util/parse-duration.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Parse a duration string like "30d", "7d", "24h" or "15m" into milliseconds.
+ * Returns null if the string is not a valid duration.
+ */
+export declare function parseDuration(duration: string): number | null;
+//# sourceMappingURL=parse-duration.d.ts.map

package/dist/util/parse-duration.js

@@ -0,0 +1,21 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/util/parse-duration.ts
+/**
+* Parse a duration string like "30d", "7d", "24h" or "15m" into milliseconds.
+* Returns null if the string is not a valid duration.
+*/
+function parseDuration(duration) {
+	const match = duration.match(/^(\d+)(d|h|m)$/);
+	if (!match) return null;
+	const value = parseInt(match[1], 10);
+	switch (match[2]) {
+		case "d": return value * 24 * 60 * 60 * 1e3;
+		case "h": return value * 60 * 60 * 1e3;
+		case "m": return value * 60 * 1e3;
+		default: return null;
+	}
+}
+//#endregion
+export { parseDuration };
+
+//# sourceMappingURL=parse-duration.js.map

package/dist/util/sleep.d.ts

@@ -0,0 +1,3 @@
+/** Resolve after `ms` milliseconds. */
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=sleep.d.ts.map

package/dist/util/sleep.js

@@ -0,0 +1,10 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/util/sleep.ts
+/** Resolve after `ms` milliseconds. */
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//#endregion
+export { sleep };
+
+//# sourceMappingURL=sleep.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.15.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.15.0/24481e55-dbc5-4970-be42-91b11ccfadb8",
+  "name": "@kici-dev/engine@0.16.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.16.0/daa1848d-44b4-4f16-8dc1-fb88a1f680f4",
   "creationInfo": {
-    "created": "2026-10-04T12:25:10Z",
+    "created": "2026-10-07T15:58:42Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.15.0",
+      "versionInfo": "0.16.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.15.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.16.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",