@kici-dev/engine 0.4.0 → 0.6.0

package/dist/trigger/types.js

@@ -34,13 +34,22 @@ import { z } from "zod";
 * Schema version 30 (BREAKING): renames job-level `environments` to `contexts`.
 * Schema version 31 (additive): adds the workflows_failed_batch lock trigger.
 * Schema version 32 (additive): adds LockJob.sandbox (per-job escape-hatch request).
+* Schema version 33 (additive): adds `requires` (declarative static content filter) to the push/pr/tag git-event triggers.
+* Schema version 34 (additive): adds LockWorkflow.hasFilter (workflow-level pre-dispatch filter predicate).
+* Schema version 35 (additive): adds `commitMessage` (LockTextMatch) to the push/pr/tag
+*   git-event triggers, and contains/notContains/notMatches to LockContentRequirement.
+* Schema version 36 (additive): adds LockJob.invoke (invokeSource gate, incl. optional).
+* Schema version 37 (additive): adds LockJob.gitCredentials (named git credential refs).
+* Schema version 38 (additive): adds container.auth (private-registry credentials for the job image).
+* Schema version 39 (additive): adds container.dockerfile/context/target/args (build the
+*   job's image from a Dockerfile in the repo) and container.auth.registry.
 */
 /**
 * Schema version the compiler emits into every lock file. Incremented on ANY
 * schema change (additive or breaking); the bump-history comment above records
 * which. See `BREAKING_FLOOR` for the compatibility-window semantics.
 */
-const SCHEMA_VERSION = 32;
+const SCHEMA_VERSION = 39;
 /**
 * Oldest lock schema version this codebase can still read correctly — the lower
 * bound of the acceptance window.
@@ -53,15 +62,38 @@ const SCHEMA_VERSION = 32;
 * Bump rule: move this to the current `SCHEMA_VERSION` ONLY in the commit that
 * lands a `BREAKING` schema change (see the bump-history convention above). It
 * currently sits at 30 because v30 (`environments`→`contexts`) was the most
-* recent breaking bump; v31 and v32 were additive, so a v30 lock still reads
-* correctly.
+* recent breaking bump; v31 through v35 were additive, so a v30 lock still
+* reads correctly.
 */
 const BREAKING_FLOOR = 30;
+/**
+* Resolve a content requirement's parse format to a concrete value. An explicit
+* non-`auto` format is returned as-is; `auto` (or unset) is resolved by the file
+* extension: `.json` → json, `.yaml`/`.yml` → yaml, everything else text.
+*
+* Yaml-free (pure string logic) so it lives in the browser-safe barrel and is
+* the single source of truth for both the compiler's compile-time serializer and
+* the orchestrator's eval-time matcher — the two can never disagree about how a
+* file's format is picked.
+*/
+function resolveContentFormat(file, format) {
+	if (format && format !== "auto") return format;
+	const lower = file.toLowerCase();
+	if (lower.endsWith(".json")) return "json";
+	if (lower.endsWith(".yaml") || lower.endsWith(".yml")) return "yaml";
+	return "text";
+}
 /** Type guard distinguishing a parallel group from an ordinary lock step. */
 function isLockParallelStep(entry) {
 	return entry.kind === "parallel";
 }
-/** Type guard for inline expression values */
+/**
+* Type guard for inline expression values.
+*
+* @deprecated See {@link LockInlineValue}. Retained only so a reader can
+* recognize an old lock's inline field and defer it to the eval agent's
+* init-runner. Removed at the next major (v1.0.0).
+*/
 function isLockInlineValue(value) {
 	return typeof value === "object" && value !== null && value._type === "inline";
 }
@@ -178,6 +210,6 @@ const changedFilesStatusSchema = z.enum([
 	"skipped"
 ]);
 //#endregion
-export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveWhenToRunOn };
+export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
 
 //# sourceMappingURL=types.js.map

package/dist/ws/rate-limiter.js

@@ -79,10 +79,10 @@ var WsRateLimiter = class {
 	bytesCapacity;
 	disconnectAfterMs;
 	constructor(config) {
-		const bytesCapacity = config?.bytesCapacity ?? 2 * 1024 * 1024;
+		const bytesCapacity = config?.bytesCapacity ?? 2097152;
 		this.messages = new TokenBucket(config?.messageCapacity ?? 200, config?.messageRefillRate ?? 100);
-		this.bytes = new TokenBucket(bytesCapacity, config?.bytesRefillRate ?? 500 * 1024);
-		this.maxMessageSize = config?.maxMessageSize ?? 4 * 1024 * 1024;
+		this.bytes = new TokenBucket(bytesCapacity, config?.bytesRefillRate ?? 512e3);
+		this.maxMessageSize = config?.maxMessageSize ?? 4194304;
 		this.bytesCapacity = bytesCapacity;
 		this.disconnectAfterMs = config?.disconnectAfterMs ?? 5e3;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",
@@ -45,10 +45,22 @@
       "import": "./dist/trigger/trigger-event-type.js",
       "types": "./dist/trigger/trigger-event-type.d.ts"
     },
+    "./trigger/content-requirements": {
+      "import": "./dist/trigger/content-requirements.js",
+      "types": "./dist/trigger/content-requirements.d.ts"
+    },
     "./webhook/signature": {
       "import": "./dist/webhook/signature.js",
       "types": "./dist/webhook/signature.d.ts"
     },
+    "./scaler/registry-auth": {
+      "import": "./dist/scaler/registry-auth.js",
+      "types": "./dist/scaler/registry-auth.d.ts"
+    },
+    "./safe-regex": {
+      "import": "./dist/safe-regex.js",
+      "types": "./dist/safe-regex.d.ts"
+    },
     "./labels/compile": {
       "import": "./dist/labels/compile.js",
       "types": "./dist/labels/compile.d.ts"
@@ -97,6 +109,10 @@
       "import": "./dist/protocol/messages/oidc-mint.js",
       "types": "./dist/protocol/messages/oidc-mint.d.ts"
     },
+    "./protocol/messages/git-credential-relay": {
+      "import": "./dist/protocol/messages/git-credential-relay.js",
+      "types": "./dist/protocol/messages/git-credential-relay.d.ts"
+    },
     "./provenance/schema": {
       "import": "./dist/provenance/schema.js",
       "types": "./dist/provenance/schema.d.ts"
@@ -131,10 +147,11 @@
     }
   },
   "dependencies": {
-    "jose": "^6.1.0",
+    "jose": "^6.2.10",
     "jsonpath-plus": "^10.4.0",
-    "picomatch": "^4.0.5",
+    "picomatch": "^4.0.7",
     "safe-regex": "^2.1.1",
+    "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.4.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.4.0/9e27a29f-2dd8-4cc5-9c0f-4e6591fd02e7",
+  "name": "@kici-dev/engine@0.6.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.6.0/257d679c-2415-4ce3-b560-a0cc82187192",
   "creationInfo": {
-    "created": "2026-08-09T16:02:43Z",
+    "created": "2026-09-01T13:57:11Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.4.0",
+      "versionInfo": "0.6.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,17 +65,17 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.4.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.6.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package-jose-6.2.3",
+      "SPDXID": "SPDXRef-Package-jose-6.2.10",
       "name": "jose",
-      "versionInfo": "6.2.3",
-      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
+      "versionInfo": "6.2.10",
+      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.10.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -85,7 +85,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/jose@6.2.3"
+          "referenceLocator": "pkg:npm/jose@6.2.10"
         }
       ],
       "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
@@ -132,10 +132,10 @@
       "homepage": "https://github.com/s3u/JSONPath"
     },
     {
-      "SPDXID": "SPDXRef-Package-picomatch-4.0.5",
+      "SPDXID": "SPDXRef-Package-picomatch-4.0.7",
       "name": "picomatch",
-      "versionInfo": "4.0.5",
-      "downloadLocation": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "versionInfo": "4.0.7",
+      "downloadLocation": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -145,7 +145,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/picomatch@4.0.5"
+          "referenceLocator": "pkg:npm/picomatch@4.0.7"
         }
       ],
       "description": "Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.",
@@ -191,6 +191,26 @@
       "description": "detect possibly catastrophic, exponential-time regular expressions",
       "homepage": "https://github.com/davisjam/safe-regex"
     },
+    {
+      "SPDXID": "SPDXRef-Package-yaml-2.9.0",
+      "name": "yaml",
+      "versionInfo": "2.9.0",
+      "downloadLocation": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "ISC",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/yaml@2.9.0"
+        }
+      ],
+      "description": "JavaScript parser and stringifier for YAML",
+      "homepage": "https://eemeli.org/yaml/"
+    },
     {
       "SPDXID": "SPDXRef-Package-zod-4.4.3",
       "name": "zod",
@@ -230,7 +250,7 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
+      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.10",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -240,7 +260,7 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.5",
+      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -248,6 +268,11 @@
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
+    {
+      "spdxElementId": "SPDXRef-RootPackage",
+      "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
+      "relationshipType": "DEPENDS_ON"
+    },
     {
       "spdxElementId": "SPDXRef-RootPackage",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",