@kici-dev/orchestrator 0.1.23 → 0.1.24

package/dist/storage/loopback-guard.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Startup guard: an orchestrator that runs non-co-located agents (any scaler
+ * backend) must not hand them a loopback storage URL. Loopback is only
+ * reachable by a co-located process, so a scaled agent would fail with an
+ * opaque ECONNREFUSED. This module detects the misconfiguration so the
+ * orchestrator can refuse to start with a clear, actionable error.
+ */
+import { ScalerBackendType } from '@kici-dev/engine';
+import type { AppConfig } from '../config.js';
+import type { ScalerConfig } from '../scaler/types.js';
+/**
+ * Every current scaler backend places the agent outside the orchestrator's
+ * loopback (separate netns, microVM, or host). Only a future co-located/"local"
+ * backend would be absent from this set. `kubernetes` is included defensively
+ * even though `ScalerEntry.type` excludes it today.
+ */
+export declare const NON_COLOCATED_BACKENDS: ReadonlySet<ScalerBackendType>;
+/** True for any host an agent in another netns/VM/host cannot reach. */
+export declare function isLoopbackHost(hostname: string): boolean;
+/**
+ * Decide whether an agent-facing storage URL is a loopback address that a
+ * non-co-located agent could not reach. Returns a remediation message, or null
+ * when the configuration is safe.
+ */
+export declare function checkLoopbackAgentEndpoint(input: {
+    agentFacingUrl: string | null;
+    endpointSource: string;
+    fixEnvVar: string;
+    scalerBackends: ScalerBackendType[];
+}): {
+    message: string;
+} | null;
+/**
+ * Resolve the URL an AGENT would use to reach storage, plus the env var an
+ * operator would set to fix a loopback misconfiguration. Returns null when the
+ * storage backend has no agent-facing URL to validate.
+ */
+export declare function resolveAgentFacingStorage(config: AppConfig): {
+    url: string | null;
+    source: string;
+    fixEnvVar: string;
+} | null;
+/**
+ * Refuse to start when this orchestrator runs non-co-located agents (any scaler
+ * configured) and the agent-facing storage URL is a loopback address. Logs the
+ * remediation (so it reaches `kici-admin orchestrator logs`) then throws.
+ */
+export declare function assertAgentReachableStorage(config: AppConfig, scalerConfig: ScalerConfig | null): void;
+//# sourceMappingURL=loopback-guard.d.ts.map

package/dist/ws/agent-handler.d.ts

@@ -16,7 +16,8 @@
  * When agentAuthMode === 'none', the auth phase is skipped (legacy behavior).
  */
 import type { WSEvents } from 'hono/ws';
-import type { RateLimiterConfig } from '@kici-dev/engine';
+import type { RateLimiterConfig, AttestationVerifyStatus } from '@kici-dev/engine';
+import type { ProvenanceTrustRoot } from '../provenance/trust-root.js';
 import type { AgentRegistry } from '../agent/registry.js';
 import type { Dispatcher } from '../agent/dispatcher.js';
 import type { AgentTokenStore } from '../agent/token-store.js';
@@ -98,6 +99,10 @@ export interface AgentWsHandlerDeps {
         timestamp: number;
         data?: Record<string, unknown>;
         secretsAccessed?: string[];
+        /** Parallel step-group concurrency role (`sequential` | `parallel-child` | `parallel-group`). */
+        concurrencyKind?: string;
+        /** Parallel-group correlation id shared by a group's children. */
+        groupId?: string;
         /** Raw log bytes accumulated by this step's LogStreamer at terminal time. */
         logBytesStreamed?: number;
     }) => void;
@@ -187,9 +192,15 @@ export interface AgentWsHandlerDeps {
      * dep so a deployment can decide whether attestations share the cache bucket.
      */
     provenanceStorage?: CacheStorage;
+    /**
+     * Provenance trust root used to verify each bundle at ingest. When absent (or
+     * its issuer is null) the verdict is recorded as `unverifiable`.
+     */
+    provenanceTrustRoot?: ProvenanceTrustRoot;
     /**
      * Record a completed provenance-bundle upload (writes an attestations row).
      * `runId` is resolved server-side from the job's dispatch ref, never the wire.
+     * The verdict fields are computed at ingest (verify-at-ingest).
      */
     onProvenanceUpload?: (record: {
         runId: string;
@@ -198,6 +209,9 @@ export interface AgentWsHandlerDeps {
         subjectDigest: string;
         storageKey: string;
         mediaType: string;
+        verifyStatus: AttestationVerifyStatus;
+        verifyReason: string | null;
+        verifiedAt: Date | null;
     }) => Promise<void>;
     /** Optional rate limiter configuration. */
     rateLimiterConfig?: RateLimiterConfig;

package/dist/ws/platform-client.d.ts

@@ -1,4 +1,4 @@
-import { type OrchestratorToPlatformMessage, type WebhookRelay, type WebhookRelayResult, type TrustPolicyUpdate, type StaleCheckrunCleanup, type DashboardRunDetailRequest, type DashboardRunsListRequest, type DashboardRunsFiltersRequest, type DashboardSourcesListRequest, type DashboardStepLogsRequest, type DashboardAttestationsListRequest, type DashboardOrchLogsRequest, type RunRerunRequest, type ManualScheduleRequest, type RunCancelRequest, type DashboardPayloadRequest, type DashboardPlatformToOrchMessage, type TestRelayRequest, type DashboardDiagnosticsRequest, type DashboardScalerCapacityRequest, type DashboardScalerAgentsRequest, type DashboardFleetHostsRequest, type DashboardFleetHostRequest, type DashboardFleetPreviewRequest, type DashboardFleetWorkflowsForHostRequest, type JoinRequest, type JoinResponse, type DeploymentIdentity, type OrchCapabilities, type OrchRole } from '@kici-dev/engine';
+import { type OrchestratorToPlatformMessage, type WebhookRelay, type WebhookRelayResult, type TrustPolicyUpdate, type StaleCheckrunCleanup, type DashboardRunDetailRequest, type DashboardRunStructuredRequest, type DashboardRunsListRequest, type DashboardRunsFiltersRequest, type DashboardSourcesListRequest, type DashboardStepLogsRequest, type DashboardAttestationsListRequest, type DashboardAttestationsListAllRequest, type DashboardAttestationGetRequest, type DashboardOrchLogsRequest, type RunRerunRequest, type ManualScheduleRequest, type RunCancelRequest, type DashboardPayloadRequest, type DashboardPlatformToOrchMessage, type TestRelayRequest, type DashboardDiagnosticsRequest, type DashboardScalerCapacityRequest, type DashboardScalerAgentsRequest, type DashboardFleetHostsRequest, type DashboardFleetHostRequest, type DashboardFleetPreviewRequest, type DashboardFleetWorkflowsForHostRequest, type JoinRequest, type JoinResponse, type DeploymentIdentity, type OrchCapabilities, type OrchRole } from '@kici-dev/engine';
 import { RelayBufferRegistry, type RelayStartMeta } from '../webhook/relay-buffer.js';
 /**
  * Verification + processing outcome returned by the chunked relay path's
@@ -100,8 +100,16 @@ export interface PlatformClientOptions {
         orgId: string;
         clusterId: string | null;
     }) => void;
+    /**
+     * Optional callback fired with the provenance trust root (OIDC issuer) the
+     * Platform supplies on `auth.success`. The orchestrator uses it to verify
+     * provenance bundles at ingest. `null` means provenance is not configured.
+     */
+    onProvenanceIssuer?: (issuer: string | null) => void;
     /** Optional callback for dashboard run detail requests from Platform. */
     onDashboardRunDetail?: (msg: DashboardRunDetailRequest) => void;
+    /** Optional callback for dashboard structured run-result requests from Platform. */
+    onDashboardRunStructured?: (msg: DashboardRunStructuredRequest) => void;
     /** Optional callback for dashboard runs.list (operator console) requests from Platform. */
     onDashboardRunsList?: (msg: DashboardRunsListRequest) => void;
     /** Optional callback for dashboard runs.filters (operator console) requests from Platform. */
@@ -112,6 +120,10 @@ export interface PlatformClientOptions {
     onDashboardStepLogs?: (msg: DashboardStepLogsRequest) => void;
     /** Optional callback for dashboard attestations-list requests from Platform. */
     onDashboardAttestationsList?: (msg: DashboardAttestationsListRequest) => void;
+    /** Optional callback for org-wide attestations list (browser) requests from Platform. */
+    onDashboardAttestationsListAll?: (msg: DashboardAttestationsListAllRequest) => void;
+    /** Optional callback for single-attestation detail requests from Platform. */
+    onDashboardAttestationGet?: (msg: DashboardAttestationGetRequest) => void;
     /** Optional callback for run re-run requests from Platform (dashboard action). */
     onRunRerun?: (msg: RunRerunRequest) => void;
     /** Optional callback for manual schedule trigger requests from Platform (dashboard action). */
@@ -167,6 +179,25 @@ export interface PlatformClientOptions {
      */
     relayBuffer?: RelayBufferRegistry;
 }
+/** Error `*.response` frame shape for a dashboard request that failed validation. */
+export interface DashboardRequestErrorFrame {
+    type: string;
+    requestId: string;
+    error: string;
+    code: string;
+    orchVersion?: string;
+    requestType: string;
+}
+/**
+ * Build the error `*.response` frame for a dashboard request that failed schema
+ * validation, distinguishing a request type this build has never heard of
+ * (version mismatch → upgrade the orchestrator) from a known type with a
+ * malformed body (genuine client error).
+ */
+export declare function classifyDashboardRequestError(raw: {
+    type: string;
+    requestId: string;
+}, knownTypes: ReadonlySet<string>, orchVersion: string | undefined): DashboardRequestErrorFrame;
 /**
  * WebSocket client that connects the orchestrator to the Platform relay.
  *
@@ -211,12 +242,16 @@ export declare class PlatformClient {
     private readonly onPeerDiscover?;
     private readonly onAuthenticated?;
     private readonly onOrgIdentified?;
+    private readonly onProvenanceIssuer?;
     private readonly onDashboardRunDetail?;
+    private readonly onDashboardRunStructured?;
     private readonly onDashboardRunsList?;
     private readonly onDashboardRunsFilters?;
     private readonly onDashboardSourcesList?;
     private readonly onDashboardStepLogs?;
     private readonly onDashboardAttestationsList?;
+    private readonly onDashboardAttestationsListAll?;
+    private readonly onDashboardAttestationGet?;
     private readonly onRunRerun?;
     private readonly onManualSchedule?;
     private readonly onRunCancel?;

package/installer-image-digests.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.1.23",
+  "version": "0.1.24",
   "images": {
-    "kici-agent": "sha256:f3b4628262e2ec10d9f0a5b8eed54a1361e4a917728b38a0165a144d1f885653",
-    "kici-orchestrator": "sha256:240790924ee73e4b1230deb989d3db6c05141ca4db6376baeb88f5e0aeed19ee"
+    "kici-agent": "sha256:1e02f0cda7f398d72b2e95dd74f9c67fb5a8b041307886ef85a6eae3024c7a4e",
+    "kici-orchestrator": "sha256:9aa83c19f39b3f80d62f328af57a38a681670766ed2ec7f46dabecd11e82538b"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "ci",
@@ -39,9 +39,6 @@
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
-  "bin": {
-    "kici-admin": "./dist/cli.js"
-  },
   "exports": {
     ".": {
       "import": "./dist/index.js",
@@ -63,7 +60,7 @@
     "@aws-sdk/client-s3": "^3.1064.0",
     "@aws-sdk/lib-storage": "^3.1064.0",
     "@aws-sdk/s3-request-presigner": "^3.1064.0",
-    "@hono/node-server": "^2.0.4",
+    "@hono/node-server": "^1.19.14",
     "@hono/node-ws": "^1.3.1",
     "@inquirer/prompts": "^8.5.2",
     "@octokit/auth-app": "^8.2.0",
@@ -86,8 +83,8 @@
     "ws": "^8.21.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@kici-dev/engine": "0.1.23",
-    "@kici-dev/shared": "0.1.23"
+    "@kici-dev/engine": "0.1.24",
+    "@kici-dev/shared": "0.1.24"
   },
   "kici": {
     "metrics": {
@@ -100,8 +97,9 @@
   "devDependencies": {
     "@types/archiver": "^8.0.0",
     "@types/dockerode": "^4.0.1",
+    "jose": "^6.1.0",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/agent": "0.1.23"
+    "@kici-dev/agent": "0.1.24"
   },
   "scripts": {
     "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.1.23",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.23/261def5e-2309-4ba2-a52c-5dc631179d1a",
+  "name": "@kici-dev/orchestrator@0.1.24",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.24/5d84c2e2-c2ae-4133-963c-274d1c6cb791",
   "creationInfo": {
-    "created": "2026-06-25T11:13:00Z",
+    "created": "2026-06-28T16:24:42Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -754,10 +754,10 @@
       "homepage": "https://grpc.io/"
     },
     {
-      "SPDXID": "SPDXRef-Package--hono-node-server-2.0.4",
+      "SPDXID": "SPDXRef-Package--hono-node-server-1.19.14",
       "name": "@hono/node-server",
-      "versionInfo": "2.0.4",
-      "downloadLocation": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.0.4.tgz",
+      "versionInfo": "1.19.14",
+      "downloadLocation": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -767,7 +767,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40hono/node-server@2.0.4"
+          "referenceLocator": "pkg:npm/%40hono/node-server@1.19.14"
         }
       ],
       "description": "Node.js Adapter for Hono",
@@ -1190,9 +1190,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.24",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1203,16 +1203,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.24"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1223,7 +1223,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.24"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1232,7 +1232,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1243,16 +1243,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.24"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.23",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1263,7 +1263,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.23"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.24"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -7866,13 +7866,13 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--hono-node-server-2.0.4",
+      "spdxElementId": "SPDXRef-Package--hono-node-server-1.19.14",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.25",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-Package--hono-node-ws-1.3.1",
-      "relatedSpdxElement": "SPDXRef-Package--hono-node-server-2.0.4",
+      "relatedSpdxElement": "SPDXRef-Package--hono-node-server-1.19.14",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8201,57 +8201,57 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
@@ -8272,7 +8272,7 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--hono-node-server-2.0.4",
+      "relatedSpdxElement": "SPDXRef-Package--hono-node-server-1.19.14",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8287,12 +8287,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.23",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8396,112 +8396,112 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1064.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.31.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.41.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-archiver-8.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-diff-9.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.25",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.2",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.21.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.23",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },

package/dist/secrets/crypto.d.ts

@@ -1,49 +0,0 @@
-/**
- * Encrypted value with key version tracking.
- * The data field contains base64-encoded IV || AuthTag || Ciphertext.
- */
-export interface EncryptedValue {
-    /** Base64-encoded IV + auth tag + ciphertext. */
-    data: string;
-    /** Version of the encryption key used. */
-    keyVersion: number;
-}
-/**
- * Encrypt a plaintext string using AES-256-GCM with AAD.
- *
- * @param plaintext - The string to encrypt
- * @param key - 32-byte encryption key
- * @param keyVersion - Version number for key rotation tracking
- * @param aad - Additional authenticated data (e.g., "contextId:keyName")
- * @returns Encrypted value with key version
- */
-export declare function encrypt(plaintext: string, key: Buffer, keyVersion: number, aad: string): EncryptedValue;
-/**
- * Decrypt an encrypted value using AES-256-GCM with AAD verification.
- *
- * @param encrypted - The encrypted value to decrypt
- * @param key - 32-byte encryption key (must match the key used for encryption)
- * @param aad - Additional authenticated data (must match the AAD used for encryption)
- * @returns Decrypted plaintext string
- * @throws If decryption fails (wrong key, wrong AAD, tampered data)
- */
-export declare function decrypt(encrypted: EncryptedValue, key: Buffer, aad: string): string;
-/**
- * Derive a 32-byte encryption key from a string input.
- *
- * Accepts two formats:
- * - 64-character hex string (e.g., from generateMasterKey())
- * - Base64-encoded 32-byte key
- *
- * @param input - Hex or base64 encoded key material
- * @returns 32-byte Buffer suitable for use with encrypt/decrypt
- * @throws If the derived key is not exactly 32 bytes
- */
-export declare function deriveKey(input: string): Buffer;
-/**
- * Generate a new random 32-byte master key as a hex string.
- *
- * @returns 64-character hex string suitable for KICI_SECRET_KEY env var
- */
-export declare function generateMasterKey(): string;
-//# sourceMappingURL=crypto.d.ts.map