@kici-dev/engine 0.7.0 → 0.9.0

package/dist/provenance/id-token-claim-names.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Every claim a KiCI provenance ID token carries, in a stable order.
+ *
+ * Both OIDC discovery documents render `claims_supported` from this list — the
+ * orchestrator issuer that mints tokens today and the legacy Platform issuer
+ * whose already-issued tokens carried the same shape — so a relying party
+ * configuring a trust policy reads the same names under either `iss`. The
+ * orchestrator binds the list to its `IdTokenClaims` type at compile time and
+ * a drift test checks it against the claims its builder actually emits.
+ */
+export declare const ID_TOKEN_CLAIM_NAMES: readonly ['iss', 'sub', 'aud', 'iat', 'nbf', 'exp', 'jti', 'kici_run_id', 'kici_job_id', 'repository', 'ref', 'base_ref', 'head_ref', 'head_repository', 'is_fork', 'event_name', 'trust_tier', 'actor', 'sha', 'workflow_ref', 'orchestrator_id', 'org_id', 'source_origin', 'provider', 'statement_hash', 'attestation_origin'];
+export type IdTokenClaimName = (typeof ID_TOKEN_CLAIM_NAMES)[number];
+//# sourceMappingURL=id-token-claim-names.d.ts.map

package/dist/provenance/id-token-claim-names.js

@@ -0,0 +1,44 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/provenance/id-token-claim-names.ts
+/**
+* Every claim a KiCI provenance ID token carries, in a stable order.
+*
+* Both OIDC discovery documents render `claims_supported` from this list — the
+* orchestrator issuer that mints tokens today and the legacy Platform issuer
+* whose already-issued tokens carried the same shape — so a relying party
+* configuring a trust policy reads the same names under either `iss`. The
+* orchestrator binds the list to its `IdTokenClaims` type at compile time and
+* a drift test checks it against the claims its builder actually emits.
+*/
+const ID_TOKEN_CLAIM_NAMES = [
+	"iss",
+	"sub",
+	"aud",
+	"iat",
+	"nbf",
+	"exp",
+	"jti",
+	"kici_run_id",
+	"kici_job_id",
+	"repository",
+	"ref",
+	"base_ref",
+	"head_ref",
+	"head_repository",
+	"is_fork",
+	"event_name",
+	"trust_tier",
+	"actor",
+	"sha",
+	"workflow_ref",
+	"orchestrator_id",
+	"org_id",
+	"source_origin",
+	"provider",
+	"statement_hash",
+	"attestation_origin"
+];
+//#endregion
+export { ID_TOKEN_CLAIM_NAMES };
+
+//# sourceMappingURL=id-token-claim-names.js.map

package/dist/provenance/id-token-event-claims.d.ts

@@ -104,15 +104,8 @@ export declare function buildEventClaims(run: EventClaimSource): EventClaims;
  * `trigger_event` itself is left alone because two other readers depend on it:
  * the dashboard's trigger-type filter and the git credential relay's
  * `triggerTypeFilters`, both of which must keep seeing `'rerun'`.
- *
- * `legacyPullRequestSubject` restores the old, colliding form for one release —
- * see `KICI_OIDC_LEGACY_PR_SUB`. It is deprecated on arrival.
- *
- * @deprecated `legacyPullRequestSubject` is removed at v1.0.0.
  */
-export declare function buildIdTokenSubject(run: Pick<EventClaimSource, 'repo_identifier' | 'ref' | 'workflow_name' | 'trigger_event' | 'subject_trigger_event'>, opts?: {
-    legacyPullRequestSubject?: boolean;
-}): string;
+export declare function buildIdTokenSubject(run: Pick<EventClaimSource, 'repo_identifier' | 'ref' | 'workflow_name' | 'trigger_event' | 'subject_trigger_event'>): string;
 /**
  * The orchestrator's own view of a build, sent with the job so the agent can
  * freeze a provenance statement that matches what a live mint would say.

package/dist/provenance/id-token-event-claims.js

@@ -57,16 +57,11 @@ function buildEventClaims(run) {
 * `trigger_event` itself is left alone because two other readers depend on it:
 * the dashboard's trigger-type filter and the git credential relay's
 * `triggerTypeFilters`, both of which must keep seeing `'rerun'`.
-*
-* `legacyPullRequestSubject` restores the old, colliding form for one release —
-* see `KICI_OIDC_LEGACY_PR_SUB`. It is deprecated on arrival.
-*
-* @deprecated `legacyPullRequestSubject` is removed at v1.0.0.
 */
-function buildIdTokenSubject(run, opts) {
+function buildIdTokenSubject(run) {
 	const repository = run.repo_identifier ?? "unknown";
 	const subjectEvent = run.subject_trigger_event ?? run.trigger_event;
-	if (!opts?.legacyPullRequestSubject && isPullRequestFamilyTriggerEvent(subjectEvent)) return `repo:${repository}:pull_request`;
+	if (isPullRequestFamilyTriggerEvent(subjectEvent)) return `repo:${repository}:pull_request`;
 	return `repo:${repository}:ref:${run.ref ?? "unknown"}:workflow:${run.workflow_name ?? "unknown"}`;
 }
 /**

package/dist/provider/index.d.ts

@@ -13,7 +13,7 @@
  * - RepoUrlBuilder: Provider-specific URL construction
  */
 export type { ProviderType } from './types.js';
-export type { WebhookNormalizer, AccessCacheInvalidation } from './webhook-normalizer.js';
+export type { WebhookNormalizer } from './webhook-normalizer.js';
 export type { LockFileFetcher } from './lock-file-fetcher.js';
 export { LockFileParseError } from './lock-file-parse-error.js';
 export type { ChangedFilesFetcher, ChangedFilesResult } from './changed-files-fetcher.js';
@@ -22,7 +22,6 @@ export type { CloneTokenProvider, ProviderGitAuth } from './clone-token-provider
 export type { ForgeName, Sourced, GitCredentialRef, GitCredentialGrant, GitCredentialRequest, GitCredentialResult, } from './git-credential.js';
 export { isMintedRef } from './git-credential.js';
 export type { RepoUrlBuilder } from './repo-url-builder.js';
-export type { ContributorResolver, ContributorInfo, ContributorPermission, } from './contributor-resolver.js';
 export type { CheckStatusPoster, CheckStatus, WorkflowModificationInfo, } from './check-status-poster.js';
 export * from './check-run-conclusion.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/provider/index.test-d.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test-d.d.ts.map

package/dist/provider/index.test-d.js

@@ -0,0 +1,31 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { describe, expectTypeOf, it } from "vitest";
+//#region src/provider/index.test-d.ts
+/**
+* The contributor-resolution surface is gone from the provider abstraction.
+* `ContributorResolver` and its companions were type-only, so no runtime probe
+* can see them return; only the compiler can.
+*/
+describe("provider barrel", () => {
+	it("exports no ContributorResolver", () => {
+		expectTypeOf().toBeObject();
+	});
+	it("exports none of the contributor-resolution companions from the root", () => {
+		expectTypeOf().toBeObject();
+		expectTypeOf().toBeString();
+		expectTypeOf().toBeObject();
+	});
+	it("gives WebhookNormalizer no access-cache invalidation hook", () => {
+		expectTypeOf().not.toHaveProperty("getAccessCacheInvalidations");
+	});
+	it("keeps the live normalizer contract", () => {
+		expectTypeOf().toHaveProperty("provider");
+		expectTypeOf().toHaveProperty("normalizeEvent");
+		expectTypeOf().toHaveProperty("verifySignature");
+		expectTypeOf().toEqualTypeOf();
+	});
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=index.test-d.js.map

package/dist/provider/lock-file-fetcher.d.ts

@@ -8,6 +8,14 @@ import type { LockFile } from '../trigger/types.js';
 import type { ProviderType } from './types.js';
 export interface LockFileFetcher {
     readonly provider: ProviderType;
+    /**
+     * Whether a fetched lock file may be cached under `{repoIdentifier}:{ref}`.
+     * Omitted means yes. A fetcher whose backing store can change under a fixed
+     * ref — a local working tree read straight from disk, where `ref` carries no
+     * information about the file's content — sets this to `false`, so every
+     * lookup reads the current file instead of the first one cached.
+     */
+    readonly cacheable?: boolean;
     /**
      * Fetch the lock file content for a repo at a specific ref.
      *

package/dist/provider/webhook-normalizer.d.ts

@@ -7,35 +7,6 @@
  */
 import type { SimulatedEvent } from '../trigger/types.js';
 import type { ProviderType } from './types.js';
-/**
- * Discriminated union describing which cached provider-permission entries a
- * webhook event invalidates. Returned by
- * `WebhookNormalizer.getAccessCacheInvalidations`.
- *
- * @deprecated Trust is derived from the git ref, so the orchestrator holds no
- * contributor-permission cache and nothing consumes these entries. Removed at
- * v1.0.0.
- *
- * Three scopes:
- * - `repo-user`: a single `{repo, user}` permission changed (e.g. GitHub
- *   `member` event on a specific collaborator).
- * - `repo`: every contributor's effective permission on a repo may have
- *   shifted (e.g. a team was added/removed from the repo).
- * - `user-in-org`: a user's org membership changed, so any repo under that
- *   org may now return a different permission for them.
- */
-export type AccessCacheInvalidation = {
-    kind: 'repo-user';
-    repoFullName: string;
-    username: string;
-} | {
-    kind: 'repo';
-    repoFullName: string;
-} | {
-    kind: 'user-in-org';
-    orgLogin: string;
-    username: string;
-};
 export interface WebhookNormalizer {
     readonly provider: ProviderType;
     /**
@@ -146,18 +117,5 @@ export interface WebhookNormalizer {
      * Returns null when the field is missing or cannot be resolved.
      */
     extractDefaultBranch?(payload: unknown): string | null;
-    /**
-     * Map a webhook event to the cached provider-permission entries it implies a
-     * shift in. Events that do not imply a permission shift (most events,
-     * including `push` / `pull_request` / etc.) return `[]`.
-     *
-     * @deprecated Trust is derived from the git ref, so the orchestrator holds no
-     * contributor-permission cache and never calls this. Removed at v1.0.0.
-     *
-     * @param eventType Provider-specific event type (from extractEventType).
-     * @param action Event action/sub-type, if applicable.
-     * @param payload Raw webhook payload.
-     */
-    getAccessCacheInvalidations?(eventType: string, action: string | null, payload: unknown): AccessCacheInvalidation[];
 }
 //# sourceMappingURL=webhook-normalizer.d.ts.map

package/dist/trigger/types.d.ts

@@ -13,7 +13,7 @@
  * Schema version 8 (additive): adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
  * Schema version 9 (additive): adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
  * Schema version 10 (BREAKING): removes notRepos/notPaths fields, negative patterns use ! prefix in repos/paths arrays.
- * Schema version 11 (additive): adds LockInlineValue type for pure function inline evaluation.
+ * Schema version 11 (additive): added an inline-expression value shape for dynamic fields, which is no longer parsed.
  * Schema version 14 (additive): adds declarative cache specs to LockJob and LockStep.
  * Schema version 15 (additive): adds per-job init config(s) to LockJob.
  * Schema version 16 (additive): adds normalized approval config to LockWorkflow/LockJob/LockStep.
@@ -565,29 +565,6 @@ export interface LockParallelStep {
 export type LockStepEntry = LockStep | LockParallelStep;
 /** Type guard distinguishing a parallel group from an ordinary lock step. */
 export declare function isLockParallelStep(entry: LockStepEntry): entry is LockParallelStep;
-/**
- * Serialized inline expression for a dynamic env/context/concurrencyGroup
- * field, shaped as `{ _type: 'inline', expression: '(event) => ...' }`
- * alongside the existing 'static' and 'dynamic' discriminants.
- *
- * @deprecated Schema v11 inline expressions are no longer evaluated in the
- * orchestrator. Dynamic env/context/concurrencyGroup fields are resolved on the
- * eval agent's init-runner. The compiler no longer emits this type; readers keep
- * recognizing it only to defer an old lock's field to the init round. Removed at
- * the next major (v1.0.0).
- */
-export interface LockInlineValue {
-    readonly _type: 'inline';
-    readonly expression: string;
-}
-/**
- * Type guard for inline expression values.
- *
- * @deprecated See {@link LockInlineValue}. Retained only so a reader can
- * recognize an old lock's inline field and defer it to the eval agent's
- * init-runner. Removed at the next major (v1.0.0).
- */
-export declare function isLockInlineValue(value: unknown): value is LockInlineValue;
 /**
  * Author-facing keyword sugar for a `needs` edge's run condition. Each keyword
  * resolves (at compile time) to a set of upstream terminal statuses; the
@@ -832,25 +809,18 @@ export interface LockJob {
     /**
      * Bound contexts in merge order. Each entry is a static name; `dynamic` is set
      * when it is a function resolved on the eval agent's init-runner. Later entries
-     * override earlier ones on name collisions. The `LockInlineValue` shape is a
-     * deprecated form still accepted from old locks (see {@link LockInlineValue}).
+     * override earlier ones on name collisions.
      */
     readonly contexts?: ReadonlyArray<{
-        value: string | LockInlineValue;
+        value: string;
         dynamic: boolean;
     }>;
-    /**
-     * Static environment variables. A deprecated `LockInlineValue` shape is still
-     * accepted from old locks (see {@link LockInlineValue}).
-     */
-    readonly env?: Record<string, string> | LockInlineValue;
+    /** Static environment variables. */
+    readonly env?: Record<string, string>;
     /** When true, env is dynamic (function) -- resolved on the eval agent's init-runner. */
     readonly dynamicEnv?: boolean;
-    /**
-     * Concurrency group name (static string). A deprecated `LockInlineValue` shape
-     * is still accepted from old locks (see {@link LockInlineValue}).
-     */
-    readonly concurrencyGroup?: string | LockInlineValue;
+    /** Concurrency group name (static string). */
+    readonly concurrencyGroup?: string;
     /** When true, concurrencyGroup is dynamic (function) -- resolved on the eval agent's init-runner. */
     readonly dynamicConcurrencyGroup?: boolean;
     /** Total job wall-clock timeout in milliseconds (init + all steps + hooks). Threaded to the agent via jobConfig. */
@@ -1039,7 +1009,7 @@ export interface LockWorkflow {
  * v8 adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
  * v9 adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
  * v10 removes notRepos/notPaths fields; negative patterns use ! prefix in repos/paths arrays.
- * v11 adds the LockInlineValue type (deprecated; inline dynamic fields are resolved on the eval agent).
+ * v11 added an inline-expression value shape for dynamic fields, which is no longer parsed.
  * v12 adds workflow-level registries and installEnv for private npm registry auth.
  * v13 adds job-level and workflow-level timeout.
  * v40 adds siblingsDigest — the in-repo `workspace:` sibling closure the deps

package/dist/trigger/types.js

@@ -18,7 +18,7 @@ import { z } from "zod";
 * Schema version 8 (additive): adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
 * Schema version 9 (additive): adds repos/notRepos repo pattern fields to git-event triggers for global workflow matching.
 * Schema version 10 (BREAKING): removes notRepos/notPaths fields, negative patterns use ! prefix in repos/paths arrays.
-* Schema version 11 (additive): adds LockInlineValue type for pure function inline evaluation.
+* Schema version 11 (additive): added an inline-expression value shape for dynamic fields, which is no longer parsed.
 * Schema version 14 (additive): adds declarative cache specs to LockJob and LockStep.
 * Schema version 15 (additive): adds per-job init config(s) to LockJob.
 * Schema version 16 (additive): adds normalized approval config to LockWorkflow/LockJob/LockStep.
@@ -92,16 +92,6 @@ function isLockParallelStep(entry) {
 	return entry.kind === "parallel";
 }
 /**
-* Type guard for inline expression values.
-*
-* @deprecated See {@link LockInlineValue}. Retained only so a reader can
-* recognize an old lock's inline field and defer it to the eval agent's
-* init-runner. Removed at the next major (v1.0.0).
-*/
-function isLockInlineValue(value) {
-	return typeof value === "object" && value !== null && value._type === "inline";
-}
-/**
 * Author-facing keyword sugar for a `needs` edge's run condition. Each keyword
 * resolves (at compile time) to a set of upstream terminal statuses; the
 * downstream edge is dispatch-satisfied when the upstream's terminal status is
@@ -214,6 +204,6 @@ const changedFilesStatusSchema = z.enum([
 	"skipped"
 ]);
 //#endregion
-export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
+export { BREAKING_FLOOR, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, OnUnreachableMode, RunsOnPick, SANDBOX_NETWORK_MODES, SCHEMA_VERSION, changedFilesStatusSchema, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, resolveContentFormat, resolveWhenToRunOn };
 
 //# sourceMappingURL=types.js.map

package/dist/trigger/types.test-d.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.test-d.d.ts.map

package/dist/trigger/types.test-d.js

@@ -0,0 +1,63 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { describe, expectTypeOf, it } from "vitest";
+//#region src/trigger/types.test-d.ts
+/**
+* The lock-file dynamic fields no longer admit the schema-v11 inline
+* expression `{ _type: 'inline', expression }`. That object is itself a
+* `Record<string, string>`, so the `env` axis is pinned by type identity rather
+* than by an assignment the compiler would accept either way; the two string
+* fields refuse the object outright.
+*/
+describe("LockJob dynamic fields", () => {
+	it("refuses an inline expression as the concurrency group", () => {
+		expectTypeOf({
+			_type: "static",
+			name: "build",
+			steps: [],
+			needs: [],
+			concurrencyGroup: {
+				_type: "inline",
+				expression: "() => \"deploy\""
+			}
+		}).toBeObject();
+	});
+	it("refuses an inline expression as a context name", () => {
+		expectTypeOf({
+			_type: "static",
+			name: "build",
+			steps: [],
+			needs: [],
+			contexts: [{
+				value: {
+					_type: "inline",
+					expression: "() => \"prod\""
+				},
+				dynamic: false
+			}]
+		}).toBeObject();
+	});
+	it("types env as exactly a plain record", () => {
+		expectTypeOf().toEqualTypeOf();
+	});
+	it("accepts the static shapes", () => {
+		const job = {
+			_type: "static",
+			name: "build",
+			steps: [],
+			needs: [],
+			env: { NODE_ENV: "test" },
+			dynamicEnv: true,
+			concurrencyGroup: "deploy",
+			contexts: [{
+				value: "production",
+				dynamic: false
+			}]
+		};
+		expectTypeOf(job.env).toEqualTypeOf();
+		expectTypeOf(job.concurrencyGroup).toEqualTypeOf();
+	});
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=types.test-d.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",
@@ -105,10 +105,6 @@
       "import": "./dist/protocol/messages/dashboard-sealed-write.js",
       "types": "./dist/protocol/messages/dashboard-sealed-write.d.ts"
     },
-    "./protocol/messages/oidc-mint": {
-      "import": "./dist/protocol/messages/oidc-mint.js",
-      "types": "./dist/protocol/messages/oidc-mint.d.ts"
-    },
     "./protocol/messages/git-credential-relay": {
       "import": "./dist/protocol/messages/git-credential-relay.js",
       "types": "./dist/protocol/messages/git-credential-relay.d.ts"
@@ -147,20 +143,20 @@
     }
   },
   "dependencies": {
-    "jose": "^6.2.10",
+    "jose": "^6.2.12",
     "jsonpath-plus": "^10.4.0",
     "picomatch": "^4.0.7",
     "safe-regex": "^2.1.1",
-    "yaml": "^2.9.0",
-    "zod": "^4.4.3"
+    "yaml": "^2.9.1",
+    "zod": "^4.6.5"
   },
   "devDependencies": {
-    "@types/node": "^24.12.0",
+    "@types/node": "^24.13.4",
     "@types/safe-regex": "^1.1.6"
   },
   "scripts": {
-    "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",
-    "typecheck": "tsgo --noEmit",
+    "build": "node ../../scripts/build-ts.mjs && tsc --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run"
   }
 }

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.7.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.7.0/503b5e34-6f3f-49dc-895a-92d03dba6006",
+  "name": "@kici-dev/engine@0.9.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.9.0/f3f7d339-811b-47f4-b915-f74a4aa03eb0",
   "creationInfo": {
-    "created": "2026-09-11T07:37:30Z",
+    "created": "2026-09-21T08:49:21Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.7.0",
+      "versionInfo": "0.9.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,17 +65,17 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.7.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.9.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package-jose-6.2.10",
+      "SPDXID": "SPDXRef-Package-jose-6.2.12",
       "name": "jose",
-      "versionInfo": "6.2.10",
-      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.10.tgz",
+      "versionInfo": "6.2.12",
+      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -85,7 +85,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/jose@6.2.10"
+          "referenceLocator": "pkg:npm/jose@6.2.12"
         }
       ],
       "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
@@ -192,10 +192,10 @@
       "homepage": "https://github.com/davisjam/safe-regex"
     },
     {
-      "SPDXID": "SPDXRef-Package-yaml-2.9.0",
+      "SPDXID": "SPDXRef-Package-yaml-2.9.1",
       "name": "yaml",
-      "versionInfo": "2.9.0",
-      "downloadLocation": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
+      "versionInfo": "2.9.1",
+      "downloadLocation": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "ISC",
@@ -205,17 +205,17 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/yaml@2.9.0"
+          "referenceLocator": "pkg:npm/yaml@2.9.1"
         }
       ],
       "description": "JavaScript parser and stringifier for YAML",
       "homepage": "https://eemeli.org/yaml/"
     },
     {
-      "SPDXID": "SPDXRef-Package-zod-4.4.3",
+      "SPDXID": "SPDXRef-Package-zod-4.6.5",
       "name": "zod",
-      "versionInfo": "4.4.3",
-      "downloadLocation": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "versionInfo": "4.6.5",
+      "downloadLocation": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -225,7 +225,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/zod@4.4.3"
+          "referenceLocator": "pkg:npm/zod@4.6.5"
         }
       ],
       "description": "TypeScript-first schema declaration and validation library with static type inference",
@@ -250,7 +250,7 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.10",
+      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -270,12 +270,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
+      "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
+      "relatedSpdxElement": "SPDXRef-Package-zod-4.6.5",
       "relationshipType": "DEPENDS_ON"
     },
     {

package/dist/protocol/messages/oidc-mint.d.ts

@@ -1,58 +0,0 @@
-import { z } from 'zod';
-/**
- * @deprecated The `oidc.mint.*` RPC pair (Platform-rooted identity mint) is
- * hard-deprecated in favor of orchestrator-owned signing. It is kept
- * wire-compatible for the mixed-version rollout window and removed at v1.0; a
- * fresh orchestrator with its own signer never sends it. See
- * docs/user/deprecations.md.
- */
-/**
- * Error discriminator for a failed provenance mint, carried on
- * `oidc.mint.response.error.code`. Mirrors the three orchestrator-side error
- * classes that consume it:
- *   rejected    -> run/job missing or job terminal (MintRejectedError)
- *   unavailable -> the Platform signer/issuer is not configured (MintUnavailableError)
- *   failed      -> any other Platform-side failure (MintRelayError)
- */
-export declare const OidcMintErrorCode: z.ZodEnum<{
-    failed: "failed";
-    rejected: "rejected";
-    unavailable: "unavailable";
-}>;
-export type OidcMintErrorCode = z.infer<typeof OidcMintErrorCode>;
-/** orchestrator -> Platform: request a short-lived OIDC ID token for a job. */
-export declare const oidcMintRequestSchema: z.ZodObject<{
-    type: z.ZodLiteral<"oidc.mint.request">;
-    requestId: z.ZodString;
-    orchestratorId: z.ZodString;
-    runId: z.ZodString;
-    jobId: z.ZodString;
-    audience: z.ZodString;
-    deferred: z.ZodOptional<z.ZodLiteral<true>>;
-    statementHash: z.ZodOptional<z.ZodString>;
-    origin: z.ZodOptional<z.ZodEnum<{
-        deferred: "deferred";
-        "offline-backfill": "offline-backfill";
-    }>>;
-}, z.core.$strip>;
-export type OidcMintRequest = z.infer<typeof oidcMintRequestSchema>;
-/** Platform -> orchestrator: the minted token or a typed error (exactly one). */
-export declare const oidcMintResponseSchema: z.ZodObject<{
-    type: z.ZodLiteral<"oidc.mint.response">;
-    requestId: z.ZodString;
-    result: z.ZodOptional<z.ZodObject<{
-        token: z.ZodString;
-        expiresIn: z.ZodNumber;
-        jti: z.ZodString;
-    }, z.core.$strip>>;
-    error: z.ZodOptional<z.ZodObject<{
-        code: z.ZodEnum<{
-            failed: "failed";
-            rejected: "rejected";
-            unavailable: "unavailable";
-        }>;
-        message: z.ZodString;
-    }, z.core.$strip>>;
-}, z.core.$strip>;
-export type OidcMintResponse = z.infer<typeof oidcMintResponseSchema>;
-//# sourceMappingURL=oidc-mint.d.ts.map