@kici-dev/engine 0.8.0 → 0.9.0

package/dist/protocol/messages/peer.js

@@ -15,16 +15,12 @@ const peerAgentSummarySchema = z.object({
 	arch: z.string(),
 	/**
 	* Kubernetes-taint-style mandatory labels inherited from the spawning
-	* scaler (empty / omitted for static agents and warm-pool replenishment
-	* spawns). Cross-peer routing applies the same gate the local label
-	* matcher does: a connected-agent entry only matches when every
-	* mandatory label appears in the required label set.
-	*
-	* Optional + default `[]` for legacy peers — older orchestrators that
-	* predate the gate omit the field, and the coordinator falls back to
-	* "no gate" routing for those agents (matching pre-gate behavior).
+	* scaler. Always sent: a static agent and a warm-pool replenishment spawn
+	* carry `[]`, which is "no gate". Cross-peer routing applies the same gate
+	* the local label matcher does: a connected-agent entry only matches when
+	* every mandatory label appears in the required label set.
 	*/
-	mandatoryLabels: z.array(z.string()).optional().default([]),
+	mandatoryLabels: z.array(z.string()),
 	/**
 	* Name of the scaler backend that spawned this agent, or null/omitted for
 	* static (stateful) agents not bound to any scaler. Carried so the dashboard
@@ -38,7 +34,12 @@ const peerCapabilitiesSchema = z.object({
 	s3LogAccess: z.boolean(),
 	logRoutingOverride: z.enum(["direct", "coordinator"]).optional()
 });
-/** Scaler capacity summary included in peer heartbeat and auth response for routing decisions. */
+/**
+* Scaler capacity summary included in peer heartbeat and auth response for
+* routing decisions. `.strict()`: the entry once carried a scaler-wide taint
+* union a peer on this protocol floor never sends, so a stray field is a
+* version-skew signal rather than something to ignore.
+*/
 const scalerCapacitySummarySchema = z.object({
 	/** Scaler backend name (e.g. "stg-worker-bare-metal") */
 	name: z.string().optional(),
@@ -57,31 +58,15 @@ const scalerCapacitySummarySchema = z.object({
 	*/
 	spawnsOnLocalHost: z.boolean().optional(),
 	/**
-	* Labels a job MUST declare in `runsOn` to be allowed on this backend
-	* (Kubernetes-taint-style opt-in gate). When omitted (legacy peer) or
-	* empty the backend has no gate. Cross-peer routing applies the same
-	* rule as the local label matcher: a scaler-capacity entry only
-	* matches when every mandatory label appears in the required label set.
-	*
-	* @deprecated Use {@link labelSetMandatoryLabels}, which carries one gate
-	* per label set. This field is the union across every label set, so a
-	* scaler mixing `[linux, gpu]` with `[macos, xcode]` advertises a gate that
-	* makes its linux set unroutable. It stays populated for peers that predate
-	* the per-label-set field and is removed in v1.0.0.
-	*/
-	mandatoryLabels: z.array(z.string()).optional().default([]),
-	/**
-	* Per-label-set taint gate, index-aligned with `labelSets`: entry `i` is the
-	* gate a job must satisfy to route to `labelSets[i]`.
-	*
-	* Deliberately `.optional()` with no default. `undefined` is the only value
-	* that can mean "this peer predates the field — fall back to the scaler-wide
-	* `mandatoryLabels`"; an empty array would read as "every label set is
-	* ungated". A consumer also falls back when the length does not equal
+	* Per-label-set taint gate (Kubernetes-taint-style opt-in), index-aligned
+	* with `labelSets`: entry `i` is the set of labels a job MUST declare in
+	* `runsOn` to route to `labelSets[i]`; an empty entry means that set has no
+	* gate. Cross-peer routing applies the same rule as the local label matcher.
+	* A consumer refuses to route through an entry whose length does not equal
 	* `labelSets.length`, so a malformed advertisement is never indexed into.
 	*/
-	labelSetMandatoryLabels: z.array(z.array(z.string())).optional()
-});
+	labelSetMandatoryLabels: z.array(z.array(z.string()))
+}).strict();
 /** Peer hello: initiator sends ephemeral X25519 public key and nonce. */
 const peerHelloSchema = z.object({
 	type: z.literal("peer.hello"),
@@ -210,11 +195,6 @@ const jobRerouteSchema = z.object({
 	providerContext: z.record(z.string(), z.unknown()).optional(),
 	/** Pre-signed source tarball download URL (cache hit). */
 	sourceTarUrl: z.string().optional(),
-	/**
-	* @deprecated Use `sourceTarDigest` — this carries the workflow
-	* `contentHash`, not a hash of the tarball bytes.
-	*/
-	sourceTarHash: z.string().optional(),
 	/** SHA-256 of the source tarball's own bytes, for integrity verification. */
 	sourceTarDigest: z.string().optional(),
 	/** Pre-signed dependency tarball download URL (cache hit). */

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -68,13 +68,11 @@ export declare function approvalExpiryHoursOf(seconds: number): number;
  *   bounds how long that approval stays open.
  * - `allow` — the operator permits fork pull requests to run with reduced
  *   privilege.
- * - `reject` — deprecated in favour of `ignore`; removed at v1.0.0.
  */
 export declare const ForkPolicy: z.ZodEnum<{
     allow: "allow";
     hold: "hold";
     ignore: "ignore";
-    reject: "reject";
 }>;
 export type ForkPolicy = z.infer<typeof ForkPolicy>;
 /**
@@ -93,25 +91,20 @@ export declare const CiTrustLevel: z.ZodEnum<{
     write: "write";
 }>;
 export type CiTrustLevel = z.infer<typeof CiTrustLevel>;
+/**
+ * `.strict()`: the policy object once carried per-arm fields the gate never
+ * read, so a sender still emitting one is on a build this protocol floor
+ * refuses — a stray field is a version-skew signal, not something to ignore.
+ */
 export declare const trustPolicySchema: z.ZodObject<{
     forkPolicy: z.ZodEnum<{
         allow: "allow";
         hold: "hold";
         ignore: "ignore";
-        reject: "reject";
-    }>;
-    unknownContributorPolicy: z.ZodEnum<{
-        hold: "hold";
-        reject: "reject";
-    }>;
-    workflowChangePolicy: z.ZodEnum<{
-        allow: "allow";
-        hold: "hold";
-        reject: "reject";
     }>;
     approvalExpiryHours: z.ZodNumber;
     approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strip>;
+}, z.core.$strict>;
 export type TrustPolicy = z.infer<typeof trustPolicySchema>;
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
 export declare const trustPolicyUpdateSchema: z.ZodObject<{
@@ -122,20 +115,10 @@ export declare const trustPolicyUpdateSchema: z.ZodObject<{
             allow: "allow";
             hold: "hold";
             ignore: "ignore";
-            reject: "reject";
-        }>;
-        unknownContributorPolicy: z.ZodEnum<{
-            hold: "hold";
-            reject: "reject";
-        }>;
-        workflowChangePolicy: z.ZodEnum<{
-            allow: "allow";
-            hold: "hold";
-            reject: "reject";
         }>;
         approvalExpiryHours: z.ZodNumber;
         approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
     identityLinks: z.ZodArray<z.ZodObject<{
         userId: z.ZodString;
         provider: z.ZodString;
@@ -317,7 +300,6 @@ export declare const platformCapabilitiesMessageSchema: z.ZodObject<{
     type: z.ZodLiteral<"platform.capabilities">;
     capabilities: z.ZodObject<{
         orchMetrics: z.ZodOptional<z.ZodBoolean>;
-        oidcMint: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>;
 }, z.core.$strip>;
 export type PlatformCapabilitiesMessage = z.infer<typeof platformCapabilitiesMessageSchema>;
@@ -520,7 +502,7 @@ export declare const orchCapabilitiesUpdateSchema: z.ZodObject<{
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        dashboardWrites: z.ZodOptional<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
+        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
             "backends.sync_one": "backends.sync_one";
@@ -548,11 +530,11 @@ export declare const orchCapabilitiesUpdateSchema: z.ZodObject<{
             "secrets.set": "secrets.set";
             "variables.delete": "variables.delete";
             "variables.set": "variables.set";
-        }> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+        }> & z.core.$partial, z.ZodEnum<{
             disabled: "disabled";
             encrypted: "encrypted";
             permissive: "permissive";
-        }>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
+        }>>>;
         supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;
@@ -604,20 +586,10 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
             allow: "allow";
             hold: "hold";
             ignore: "ignore";
-            reject: "reject";
-        }>;
-        unknownContributorPolicy: z.ZodEnum<{
-            hold: "hold";
-            reject: "reject";
-        }>;
-        workflowChangePolicy: z.ZodEnum<{
-            allow: "allow";
-            hold: "hold";
-            reject: "reject";
         }>;
         approvalExpiryHours: z.ZodNumber;
         approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
     identityLinks: z.ZodArray<z.ZodObject<{
         userId: z.ZodString;
         provider: z.ZodString;
@@ -696,27 +668,10 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         workflowRepoIdentifier: z.ZodOptional<z.ZodString>;
         jobNames: z.ZodArray<z.ZodString>;
     }, z.core.$strip>>;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"oidc.mint.response">;
-    requestId: z.ZodString;
-    result: z.ZodOptional<z.ZodObject<{
-        token: z.ZodString;
-        expiresIn: z.ZodNumber;
-        jti: z.ZodString;
-    }, z.core.$strip>>;
-    error: z.ZodOptional<z.ZodObject<{
-        code: z.ZodEnum<{
-            failed: "failed";
-            rejected: "rejected";
-            unavailable: "unavailable";
-        }>;
-        message: z.ZodString;
-    }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"platform.capabilities">;
     capabilities: z.ZodObject<{
         orchMetrics: z.ZodOptional<z.ZodBoolean>;
-        oidcMint: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"plan.headroom">;
@@ -2938,10 +2893,6 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-    elevatedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
-        routingKey: z.ZodOptional<z.ZodString>;
-        pattern: z.ZodString;
-    }, z.core.$strip>>>>;
 }, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.access-log.list">;
     requestId: z.ZodString;
@@ -3568,7 +3519,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        dashboardWrites: z.ZodOptional<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
+        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
             "backends.sync_one": "backends.sync_one";
@@ -3596,11 +3547,11 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             "secrets.set": "secrets.set";
             "variables.delete": "variables.delete";
             "variables.set": "variables.set";
-        }> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+        }> & z.core.$partial, z.ZodEnum<{
             disabled: "disabled";
             encrypted: "encrypted";
             permissive: "permissive";
-        }>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
+        }>>>;
         supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;
@@ -3686,7 +3637,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             coordinator: "coordinator";
             worker: "worker";
         }>>;
-        dashboardWrites: z.ZodOptional<z.ZodPipe<z.ZodRecord<z.ZodEnum<{
+        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
             "backends.sync_one": "backends.sync_one";
@@ -3714,11 +3665,11 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             "secrets.set": "secrets.set";
             "variables.delete": "variables.delete";
             "variables.set": "variables.set";
-        }> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodEnum<{
+        }> & z.core.$partial, z.ZodEnum<{
             disabled: "disabled";
             encrypted: "encrypted";
             permissive: "permissive";
-        }>]>>, z.ZodTransform<Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive">>, Partial<Record<"attestations.retry" | "backends.sync" | "backends.sync_one" | "backends.test" | "contexts.bindings.set" | "contexts.create" | "contexts.delete" | "contexts.source_overrides.delete" | "contexts.source_overrides.set" | "contexts.test_access.set" | "contexts.update" | "event_dlq.discard" | "event_dlq.retry" | "fleet.host.declare" | "fleet.host.remove" | "global_workflows.update" | "held_runs.approve" | "held_runs.reject" | "registration.delete" | "registration.disable" | "secrets.delete" | "secrets.scope.create" | "secrets.scope.delete" | "secrets.scope.rename" | "secrets.set" | "variables.delete" | "variables.set", "disabled" | "encrypted" | "permissive" | boolean>>>>>;
+        }>>>;
         supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;
@@ -3803,19 +3754,6 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         sum: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
     timestamp: z.ZodNumber;
-}, z.core.$strip>, z.ZodObject<{
-    type: z.ZodLiteral<"oidc.mint.request">;
-    requestId: z.ZodString;
-    orchestratorId: z.ZodString;
-    runId: z.ZodString;
-    jobId: z.ZodString;
-    audience: z.ZodString;
-    deferred: z.ZodOptional<z.ZodLiteral<true>>;
-    statementHash: z.ZodOptional<z.ZodString>;
-    origin: z.ZodOptional<z.ZodEnum<{
-        deferred: "deferred";
-        "offline-backfill": "offline-backfill";
-    }>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"cluster.membership">;
     workers: z.ZodArray<z.ZodObject<{

package/dist/protocol/messages/platform-orchestrator.js

@@ -7,7 +7,6 @@ import { dashboardPlatformToOrchSchema } from "./dashboard.js";
 import { OrchRole, orchCapabilitiesSchema, platformCapabilitiesSchema } from "./capabilities.js";
 import { authFailureSchema, authRequestSchema, authSuccessSchema } from "./auth.js";
 import { LogStream } from "./log-stream.js";
-import { oidcMintRequestSchema, oidcMintResponseSchema } from "./oidc-mint.js";
 import { z } from "zod";
 //#region src/protocol/messages/platform-orchestrator.ts
 /**
@@ -82,12 +81,10 @@ function approvalExpiryHoursOf(seconds) {
 *   bounds how long that approval stays open.
 * - `allow` — the operator permits fork pull requests to run with reduced
 *   privilege.
-* - `reject` — deprecated in favour of `ignore`; removed at v1.0.0.
 */
 const ForkPolicy = z.enum([
 	"ignore",
 	"hold",
-	"reject",
 	"allow"
 ]);
 /**
@@ -105,27 +102,14 @@ const CiTrustLevel = z.enum([
 	"write",
 	"admin"
 ]);
+/**
+* `.strict()`: the policy object once carried per-arm fields the gate never
+* read, so a sender still emitting one is on a build this protocol floor
+* refuses — a stray field is a version-skew signal, not something to ignore.
+*/
 const trustPolicySchema = z.object({
 	forkPolicy: ForkPolicy,
 	/**
-	* @deprecated Accepted for wire compatibility and still stored and echoed
-	* back, so an orchestrator or CLI on an older build keeps seeing the value it
-	* expects. The orchestrator's trust-policy gate does not read it, so it
-	* changes no dispatch outcome. Removed at v1.0.0.
-	*/
-	unknownContributorPolicy: z.enum(["hold", "reject"]),
-	/**
-	* @deprecated Accepted for wire compatibility and still stored and echoed
-	* back, so an orchestrator or CLI on an older build keeps seeing the value it
-	* expects. The orchestrator's trust-policy gate does not read it, so it
-	* changes no dispatch outcome. Removed at v1.0.0.
-	*/
-	workflowChangePolicy: z.enum([
-		"hold",
-		"reject",
-		"allow"
-	]),
-	/**
 	* Hours a security hold stays open — the coarse spelling of
 	* `approvalExpirySeconds`, kept required so an orchestrator or CLI on an
 	* older build still receives a window it can read. Not deprecated: it is read,
@@ -151,7 +135,7 @@ const trustPolicySchema = z.object({
 	* mints an already-expired hold.
 	*/
 	approvalExpirySeconds: z.number().int().min(1).optional()
-});
+}).strict();
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
 const trustPolicyUpdateSchema = z.object({
 	type: z.literal("trust_policy.update"),
@@ -576,7 +560,6 @@ const platformToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	peerDiscoverSchema,
 	peerUpdateSchema,
 	staleCheckrunCleanupSchema,
-	oidcMintResponseSchema,
 	platformCapabilitiesMessageSchema,
 	planHeadroomSchema,
 	nackSchema,
@@ -607,7 +590,6 @@ const orchestratorToPlatformMessageSchema = z.discriminatedUnion("type", [
 	runEventMessageSchema,
 	jobContextMessageSchema,
 	orchMetricsSchema,
-	oidcMintRequestSchema,
 	clusterMembershipSchema,
 	nackSchema
 ]);

package/dist/protocol/version.d.ts

@@ -2,28 +2,20 @@
  * Protocol version. Sent during WebSocket handshake.
  *
  * Increment when a message schema gains something an older peer cannot parse,
- * and pair the bump with a named floor (below) so a sender can gate on the
- * version a peer negotiated instead of guessing.
+ * and pair the bump with a named floor so a sender can gate on the version a
+ * peer negotiated instead of guessing.
+ *
+ * Version 3 records that a version-2 peer (every 0.8.x build) cannot parse the
+ * 0.9.0 `trust_policy.update` policy, the peer heartbeat, or the
+ * `artifacts.upload.complete` frame: the fields it requires were removed and
+ * the schemas are strict, so a version-2 peer that was let through the
+ * handshake would drop or refuse those frames silently.
  */
-export declare const PROTOCOL_VERSION = 2;
+export declare const PROTOCOL_VERSION = 3;
 /**
  * Minimum protocol version accepted.
  * Connections below this are rejected.
  * Capabilities handle per-feature negotiation above this baseline.
  */
-export declare const MIN_PROTOCOL_VERSION = 1;
-/**
- * First protocol version whose `trust_policy.update` reader accepts
- * `forkPolicy: 'ignore'`.
- *
- * A peer below this version may validate the pushed policy against a
- * `forkPolicy` enum with no `ignore` member. `trust_policy.update` is a member
- * of a discriminated union, so that value fails the WHOLE frame rather than one
- * field: the org's identity links, member CI trust levels and team memberships
- * are dropped with it. The Platform therefore rewrites `ignore` to the
- * deprecated `reject` before sending to such a peer — the value that peer's
- * enum does carry, that denies dispatch the same way, and that this build's own
- * fork switch already resolves through the same arm as `ignore`.
- */
-export declare const FORK_POLICY_IGNORE_MIN_PROTOCOL_VERSION = 2;
+export declare const MIN_PROTOCOL_VERSION = 3;
 //# sourceMappingURL=version.d.ts.map

package/dist/protocol/version.js

@@ -4,31 +4,23 @@ import "../rolldown-runtime-ClRpJifh.js";
 * Protocol version. Sent during WebSocket handshake.
 *
 * Increment when a message schema gains something an older peer cannot parse,
-* and pair the bump with a named floor (below) so a sender can gate on the
-* version a peer negotiated instead of guessing.
+* and pair the bump with a named floor so a sender can gate on the version a
+* peer negotiated instead of guessing.
+*
+* Version 3 records that a version-2 peer (every 0.8.x build) cannot parse the
+* 0.9.0 `trust_policy.update` policy, the peer heartbeat, or the
+* `artifacts.upload.complete` frame: the fields it requires were removed and
+* the schemas are strict, so a version-2 peer that was let through the
+* handshake would drop or refuse those frames silently.
 */
-const PROTOCOL_VERSION = 2;
+const PROTOCOL_VERSION = 3;
 /**
 * Minimum protocol version accepted.
 * Connections below this are rejected.
 * Capabilities handle per-feature negotiation above this baseline.
 */
-const MIN_PROTOCOL_VERSION = 1;
-/**
-* First protocol version whose `trust_policy.update` reader accepts
-* `forkPolicy: 'ignore'`.
-*
-* A peer below this version may validate the pushed policy against a
-* `forkPolicy` enum with no `ignore` member. `trust_policy.update` is a member
-* of a discriminated union, so that value fails the WHOLE frame rather than one
-* field: the org's identity links, member CI trust levels and team memberships
-* are dropped with it. The Platform therefore rewrites `ignore` to the
-* deprecated `reject` before sending to such a peer — the value that peer's
-* enum does carry, that denies dispatch the same way, and that this build's own
-* fork switch already resolves through the same arm as `ignore`.
-*/
-const FORK_POLICY_IGNORE_MIN_PROTOCOL_VERSION = 2;
+const MIN_PROTOCOL_VERSION = 3;
 //#endregion
-export { FORK_POLICY_IGNORE_MIN_PROTOCOL_VERSION, MIN_PROTOCOL_VERSION, PROTOCOL_VERSION };
+export { MIN_PROTOCOL_VERSION, PROTOCOL_VERSION };
 
 //# sourceMappingURL=version.js.map

package/dist/provenance/id-token-claim-names.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Every claim a KiCI provenance ID token carries, in a stable order.
+ *
+ * Both OIDC discovery documents render `claims_supported` from this list — the
+ * orchestrator issuer that mints tokens today and the legacy Platform issuer
+ * whose already-issued tokens carried the same shape — so a relying party
+ * configuring a trust policy reads the same names under either `iss`. The
+ * orchestrator binds the list to its `IdTokenClaims` type at compile time and
+ * a drift test checks it against the claims its builder actually emits.
+ */
+export declare const ID_TOKEN_CLAIM_NAMES: readonly ['iss', 'sub', 'aud', 'iat', 'nbf', 'exp', 'jti', 'kici_run_id', 'kici_job_id', 'repository', 'ref', 'base_ref', 'head_ref', 'head_repository', 'is_fork', 'event_name', 'trust_tier', 'actor', 'sha', 'workflow_ref', 'orchestrator_id', 'org_id', 'source_origin', 'provider', 'statement_hash', 'attestation_origin'];
+export type IdTokenClaimName = (typeof ID_TOKEN_CLAIM_NAMES)[number];
+//# sourceMappingURL=id-token-claim-names.d.ts.map

package/dist/provenance/id-token-claim-names.js

@@ -0,0 +1,44 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/provenance/id-token-claim-names.ts
+/**
+* Every claim a KiCI provenance ID token carries, in a stable order.
+*
+* Both OIDC discovery documents render `claims_supported` from this list — the
+* orchestrator issuer that mints tokens today and the legacy Platform issuer
+* whose already-issued tokens carried the same shape — so a relying party
+* configuring a trust policy reads the same names under either `iss`. The
+* orchestrator binds the list to its `IdTokenClaims` type at compile time and
+* a drift test checks it against the claims its builder actually emits.
+*/
+const ID_TOKEN_CLAIM_NAMES = [
+	"iss",
+	"sub",
+	"aud",
+	"iat",
+	"nbf",
+	"exp",
+	"jti",
+	"kici_run_id",
+	"kici_job_id",
+	"repository",
+	"ref",
+	"base_ref",
+	"head_ref",
+	"head_repository",
+	"is_fork",
+	"event_name",
+	"trust_tier",
+	"actor",
+	"sha",
+	"workflow_ref",
+	"orchestrator_id",
+	"org_id",
+	"source_origin",
+	"provider",
+	"statement_hash",
+	"attestation_origin"
+];
+//#endregion
+export { ID_TOKEN_CLAIM_NAMES };
+
+//# sourceMappingURL=id-token-claim-names.js.map

package/dist/provenance/id-token-event-claims.d.ts

@@ -104,15 +104,8 @@ export declare function buildEventClaims(run: EventClaimSource): EventClaims;
  * `trigger_event` itself is left alone because two other readers depend on it:
  * the dashboard's trigger-type filter and the git credential relay's
  * `triggerTypeFilters`, both of which must keep seeing `'rerun'`.
- *
- * `legacyPullRequestSubject` restores the old, colliding form for one release —
- * see `KICI_OIDC_LEGACY_PR_SUB`. It is deprecated on arrival.
- *
- * @deprecated `legacyPullRequestSubject` is removed at v1.0.0.
  */
-export declare function buildIdTokenSubject(run: Pick<EventClaimSource, 'repo_identifier' | 'ref' | 'workflow_name' | 'trigger_event' | 'subject_trigger_event'>, opts?: {
-    legacyPullRequestSubject?: boolean;
-}): string;
+export declare function buildIdTokenSubject(run: Pick<EventClaimSource, 'repo_identifier' | 'ref' | 'workflow_name' | 'trigger_event' | 'subject_trigger_event'>): string;
 /**
  * The orchestrator's own view of a build, sent with the job so the agent can
  * freeze a provenance statement that matches what a live mint would say.

package/dist/provenance/id-token-event-claims.js

@@ -57,16 +57,11 @@ function buildEventClaims(run) {
 * `trigger_event` itself is left alone because two other readers depend on it:
 * the dashboard's trigger-type filter and the git credential relay's
 * `triggerTypeFilters`, both of which must keep seeing `'rerun'`.
-*
-* `legacyPullRequestSubject` restores the old, colliding form for one release —
-* see `KICI_OIDC_LEGACY_PR_SUB`. It is deprecated on arrival.
-*
-* @deprecated `legacyPullRequestSubject` is removed at v1.0.0.
 */
-function buildIdTokenSubject(run, opts) {
+function buildIdTokenSubject(run) {
 	const repository = run.repo_identifier ?? "unknown";
 	const subjectEvent = run.subject_trigger_event ?? run.trigger_event;
-	if (!opts?.legacyPullRequestSubject && isPullRequestFamilyTriggerEvent(subjectEvent)) return `repo:${repository}:pull_request`;
+	if (isPullRequestFamilyTriggerEvent(subjectEvent)) return `repo:${repository}:pull_request`;
 	return `repo:${repository}:ref:${run.ref ?? "unknown"}:workflow:${run.workflow_name ?? "unknown"}`;
 }
 /**

package/dist/provider/index.d.ts

@@ -13,7 +13,7 @@
  * - RepoUrlBuilder: Provider-specific URL construction
  */
 export type { ProviderType } from './types.js';
-export type { WebhookNormalizer, AccessCacheInvalidation } from './webhook-normalizer.js';
+export type { WebhookNormalizer } from './webhook-normalizer.js';
 export type { LockFileFetcher } from './lock-file-fetcher.js';
 export { LockFileParseError } from './lock-file-parse-error.js';
 export type { ChangedFilesFetcher, ChangedFilesResult } from './changed-files-fetcher.js';
@@ -22,7 +22,6 @@ export type { CloneTokenProvider, ProviderGitAuth } from './clone-token-provider
 export type { ForgeName, Sourced, GitCredentialRef, GitCredentialGrant, GitCredentialRequest, GitCredentialResult, } from './git-credential.js';
 export { isMintedRef } from './git-credential.js';
 export type { RepoUrlBuilder } from './repo-url-builder.js';
-export type { ContributorResolver, ContributorInfo, ContributorPermission, } from './contributor-resolver.js';
 export type { CheckStatusPoster, CheckStatus, WorkflowModificationInfo, } from './check-status-poster.js';
 export * from './check-run-conclusion.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/provider/index.test-d.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.test-d.d.ts.map

package/dist/provider/index.test-d.js

@@ -0,0 +1,31 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { describe, expectTypeOf, it } from "vitest";
+//#region src/provider/index.test-d.ts
+/**
+* The contributor-resolution surface is gone from the provider abstraction.
+* `ContributorResolver` and its companions were type-only, so no runtime probe
+* can see them return; only the compiler can.
+*/
+describe("provider barrel", () => {
+	it("exports no ContributorResolver", () => {
+		expectTypeOf().toBeObject();
+	});
+	it("exports none of the contributor-resolution companions from the root", () => {
+		expectTypeOf().toBeObject();
+		expectTypeOf().toBeString();
+		expectTypeOf().toBeObject();
+	});
+	it("gives WebhookNormalizer no access-cache invalidation hook", () => {
+		expectTypeOf().not.toHaveProperty("getAccessCacheInvalidations");
+	});
+	it("keeps the live normalizer contract", () => {
+		expectTypeOf().toHaveProperty("provider");
+		expectTypeOf().toHaveProperty("normalizeEvent");
+		expectTypeOf().toHaveProperty("verifySignature");
+		expectTypeOf().toEqualTypeOf();
+	});
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=index.test-d.js.map