@kici-dev/sdk 0.1.15 → 0.1.17

package/dist/api-types.d.ts

@@ -8,6 +8,8 @@
  * 1. Add the typed method here (with param + return types)
  * 2. Register the handler in the orchestrator's AgentApiRegistry
  */
+import { type OidcTokenResult } from '@kici-dev/engine/protocol/messages/oidc-token-relay';
+export type { OidcTokenResult };
 export interface InfrastructureListResult {
     scalers: Array<{
         name: string;
@@ -28,9 +30,23 @@ export interface InfrastructureApi {
     /** List available scalers and connected agents. */
     list(): Promise<InfrastructureListResult>;
 }
+export interface OidcApi {
+    /**
+     * Request a short-lived OIDC ID token for the current job, bound to
+     * `audience`. The token's identity claims (repository, ref, sha, run/job id)
+     * are derived server-side from the build context and cannot be spoofed by the
+     * workflow. The token is automatically masked in step logs. Only available
+     * inside a running job step (throws otherwise).
+     */
+    token(opts: {
+        audience: string;
+    }): Promise<OidcTokenResult>;
+}
 export interface KiciApi {
     /** Query orchestrator infrastructure (scalers, agents). */
     infrastructure: InfrastructureApi;
+    /** Request short-lived OIDC ID tokens for the current job (build provenance). */
+    oidc: OidcApi;
 }
 /**
  * Low-level transport function used to implement KiciApi.
@@ -42,6 +58,14 @@ export type KiciApiTransport = (method: string, params?: Record<string, unknown>
  *
  * This is the bridge between the typed SDK interface and the untyped WS/IPC
  * transport. Each method call is mapped to { method: 'namespace.method', params }.
+ *
+ * `jobCtx` carries the per-job execution context (the job the step is running
+ * in). It is supplied by the agent's sandbox step context so `oidc.token()` can
+ * bind its request to that job; the workflow author never supplies it. It is
+ * omitted for contexts with no running job (e.g. DynamicJobFn re-evaluation),
+ * where `oidc.token()` throws rather than silently misattributing a token.
  */
-export declare function buildKiciApi(transport: KiciApiTransport): KiciApi;
+export declare function buildKiciApi(transport: KiciApiTransport, jobCtx?: {
+    jobId: string;
+}): KiciApi;
 //# sourceMappingURL=api-types.d.ts.map

package/dist/api-types.js

@@ -1,13 +1,39 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
+import { OIDC_TOKEN_REQUEST_METHOD } from "@kici-dev/engine/protocol/messages/oidc-token-relay";
 //#region src/api-types.ts
 /**
+* Typed KiCI API available to workflows via ctx.kici.
+*
+* Each namespace groups related methods. Under the hood, calls are serialized
+* to { method: 'namespace.method', params } and sent over the agent's WS
+* connection to the orchestrator. Adding a new API method:
+*
+* 1. Add the typed method here (with param + return types)
+* 2. Register the handler in the orchestrator's AgentApiRegistry
+*/
+/**
 * Build a typed KiciApi proxy from a raw transport function.
 *
 * This is the bridge between the typed SDK interface and the untyped WS/IPC
 * transport. Each method call is mapped to { method: 'namespace.method', params }.
+*
+* `jobCtx` carries the per-job execution context (the job the step is running
+* in). It is supplied by the agent's sandbox step context so `oidc.token()` can
+* bind its request to that job; the workflow author never supplies it. It is
+* omitted for contexts with no running job (e.g. DynamicJobFn re-evaluation),
+* where `oidc.token()` throws rather than silently misattributing a token.
 */
-function buildKiciApi(transport) {
-	return { infrastructure: { list: () => transport("infrastructure.list", {}) } };
+function buildKiciApi(transport, jobCtx) {
+	return {
+		infrastructure: { list: () => transport("infrastructure.list", {}) },
+		oidc: { token: (opts) => {
+			if (!jobCtx) return Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is only available inside a running job step"));
+			return transport(OIDC_TOKEN_REQUEST_METHOD, {
+				jobId: jobCtx.jobId,
+				audience: opts.audience
+			});
+		} }
+	};
 }
 //#endregion
 export { buildKiciApi };

package/dist/approval.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Workflow-author API for declaring a manual approval gate at step, job, or
+ * workflow level. The author writes `requireApproval`; the compiler normalizes
+ * it into the lock file's `approval` block, and the orchestrator turns it into
+ * a held element at dispatch time.
+ */
+/** A single approver clause: any member of a team, or a specific user. */
+export type ApproverClause = {
+    team: string;
+} | {
+    user: string;
+};
+/**
+ * Declarative approval requirement.
+ *
+ * - `true` — pause for ANY org member with the approval permission.
+ * - `ApproverClause[]` — a flat AND list (all clauses must be satisfied).
+ * - object form — clauses plus an optional human `reason` and a per-gate
+ *   `timeout` (seconds) that overrides the org-default expiry.
+ */
+export type RequireApproval = true | ApproverClause[] | {
+    approvers: ApproverClause[];
+    reason?: string;
+    timeout?: number;
+};
+/** The normalized shape written into the lock file. */
+export interface NormalizedRequireApproval {
+    clauses: ApproverClause[];
+    reason?: string;
+    timeoutSeconds?: number;
+}
+/** Normalize any `RequireApproval` form into `{ clauses, reason?, timeoutSeconds? }`. */
+export declare function normalizeRequireApproval(r: RequireApproval): NormalizedRequireApproval;
+//# sourceMappingURL=approval.d.ts.map

package/dist/approval.js

@@ -0,0 +1,16 @@
+import "./chunk-BTugEXQM.js";
+//#region src/approval.ts
+/** Normalize any `RequireApproval` form into `{ clauses, reason?, timeoutSeconds? }`. */
+function normalizeRequireApproval(r) {
+	if (r === true) return { clauses: [] };
+	if (Array.isArray(r)) return { clauses: r };
+	return {
+		clauses: r.approvers,
+		reason: r.reason,
+		timeoutSeconds: r.timeout
+	};
+}
+//#endregion
+export { normalizeRequireApproval };
+
+//# sourceMappingURL=approval.js.map

package/dist/cache-types.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/cache-types.ts
 /** Zod schema validating a CacheSpec at compile/serialize time. */

package/dist/context.d.ts

@@ -19,6 +19,19 @@ export interface JobInfo {
     name: string;
     runsOn: string;
 }
+/**
+ * Outputs of a matrix job as seen by a downstream `needs:` consumer.
+ * A downstream that consumes a matrix upstream receives this envelope instead of
+ * a flat outputs object, identically under `kici run local` and the remote path.
+ */
+export interface MatrixJobOutputs<T = Record<string, unknown>> {
+    /** Keyed by the combination suffix (the text inside `(...)` of the child name). */
+    byMatrix: Record<string, T>;
+    /** Last-write-wins flat merge across children, in child (name) order. */
+    merged: T;
+}
+/** Runtime discriminator: true when `ctx.jobOutputs(ref)` returned a matrix envelope. */
+export declare function isMatrixJobOutputs(value: Record<string, unknown> | MatrixJobOutputs): value is MatrixJobOutputs;
 /**
  * Augmentable interface for known secret keys.
  * When augmented via `kici types` (.d.ts generation), narrows get/expose key parameter.
@@ -158,14 +171,22 @@ export interface StepContext<TInputs = Record<string, unknown>> {
     } | ((...args: any[]) => any)): T;
     /**
      * Resolve outputs from a preceding job by reference.
-     * Returns the job's collected outputs (step-keyed for multi-step, flat for run shorthand).
+     *
+     * For a plain upstream this returns the job's collected outputs (step-keyed
+     * for multi-step, flat for run shorthand). For a **matrix** upstream it returns
+     * a {@link MatrixJobOutputs} envelope `{ byMatrix, merged }` keyed by the
+     * combination suffix — identical under `kici run local` and the remote path.
+     * Use {@link isMatrixJobOutputs} (or `'byMatrix' in result`) to discriminate.
      *
      * @example
      * const setupOutputs = ctx.jobOutputs(setupJob);
+     * @example
+     * const m = ctx.jobOutputs(buildMatrixJob);
+     * if (isMatrixJobOutputs(m)) console.log(m.byMatrix['linux, arm64']);
      */
     jobOutputs(ref: {
         name: string;
-    }): Record<string, unknown>;
+    }): Record<string, unknown> | MatrixJobOutputs;
     /**
      * Publish a secret output value from this job.
      * Secret outputs are encrypted before leaving the agent and can be consumed
@@ -188,6 +209,14 @@ export interface StepContext<TInputs = Record<string, unknown>> {
      * under `spec.key` (immutable — first save wins). Scoped per org + ref.
      */
     cache: import('./cache-types.js').CacheApi;
+    /**
+     * Build, sign, and persist a KiCI build-provenance attestation for a produced
+     * artifact. The in-toto statement's identity is derived from a Platform-minted
+     * identity token (unforgeable); the bundle is signed with an ephemeral key and
+     * is offline-verifiable. Pass the artifact via a precomputed digest or a path
+     * the agent digests with SHA-256.
+     */
+    attestProvenance(opts: import('./provenance-types.js').AttestProvenanceOptions): Promise<import('./provenance-types.js').AttestProvenanceResult>;
 }
 export {};
 //# sourceMappingURL=context.d.ts.map

package/dist/context.js

@@ -1,2 +1,10 @@
-import "./chunk-gOLHoazu.js";
-export {};
+import "./chunk-BTugEXQM.js";
+//#region src/context.ts
+/** Runtime discriminator: true when `ctx.jobOutputs(ref)` returned a matrix envelope. */
+function isMatrixJobOutputs(value) {
+	return typeof value === "object" && value !== null && "byMatrix" in value && "merged" in value && typeof value.byMatrix === "object";
+}
+//#endregion
+export { isMatrixJobOutputs };
+
+//# sourceMappingURL=context.js.map

package/dist/dynamic-group.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/dynamic-group.ts
 /**
 * Dynamic group helpers for cross-domain needs.

package/dist/errors.js

@@ -1,9 +1,11 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/errors.ts
 /**
 * Thrown when accessing a secret key that does not exist in the flat secrets proxy.
 */
 var SecretNotFoundError = class extends Error {
+	key;
+	availableKeys;
 	constructor(key, availableKeys) {
 		super(`Secret "${key}" not found. Available keys: ${availableKeys.join(", ") || "(none)"}. Use ctx.secrets.has('${key}') to check existence, or await ctx.secrets.get('${key}') in a try/catch.`);
 		this.key = key;

package/dist/events/define-event.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/events/define-event.ts
 /**
 * Create a typed event definition with a Zod schema.

package/dist/events/event-payloads.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/events/event-payloads.ts
 /**
 * Narrow an EventPayload to a specific event type.

package/dist/events/event-payloads.test-d.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { describe, expectTypeOf, it } from "vitest";
 //#region src/events/event-payloads.test-d.ts
 describe("EventPayload narrowing", () => {

package/dist/events/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { isEventType } from "./event-payloads.js";
 import { defineEvent } from "./define-event.js";
 export { defineEvent, isEventType };

package/dist/events/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/fixture.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/fixture.ts
 /**
 * Create a test fixture definition.

package/dist/hooks/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/hooks/index.ts
 /**
 * Normalize HookInput to extract run function and optional timeout.

package/dist/hooks/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/idempotent.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { step } from "./step.js";
 import { runIdempotentStep } from "@kici-dev/core/idempotency";
 //#region src/idempotent.ts

package/dist/index.d.ts

@@ -1,6 +1,8 @@
 export { step } from './step.js';
 export { job } from './job.js';
 export { workflow } from './workflow.js';
+export { normalizeRequireApproval } from './approval.js';
+export type { RequireApproval, ApproverClause, NormalizedRequireApproval } from './approval.js';
 export { pr, push, tag, comment, review, reviewComment, release, dispatch, create, delete as delete, status, workflowRun, fork, star, watch, webhook, kiciEvent, workflowComplete, jobComplete, genericWebhook, schedule, lifecycle, } from './triggers/index.js';
 export type { TriggerConfig, PrTriggerConfig, PushTriggerConfig, TagTriggerConfig, CommentTriggerConfig, ReviewTriggerConfig, ReviewCommentTriggerConfig, ReleaseTriggerConfig, DispatchTriggerConfig, CreateTriggerConfig, DeleteTriggerConfig, StatusTriggerConfig, WorkflowRunTriggerConfig, ForkTriggerConfig, StarTriggerConfig, WatchTriggerConfig, WebhookTriggerConfig, BranchPattern, BodyMatchPattern, PrEvent, PushEvent, PrConfigInput, PushConfigInput, TagConfigInput, CommentConfigInput, CommentAction, CommentSource, ReviewConfigInput, ReviewAction, ReviewState, ReviewCommentConfigInput, ReviewCommentAction, ReleaseConfigInput, ReleaseAction, DispatchConfigInput, CreateConfigInput, DeleteConfigInput, RefType, StatusConfigInput, StatusState, WorkflowRunConfigInput, WorkflowRunAction, ForkConfigInput, StarConfigInput, StarAction, WatchConfigInput, WatchAction, WebhookConfigInput, KiciEventConfigInput, KiciEventTriggerConfig, WorkflowCompleteConfigInput, WorkflowCompleteTriggerConfig, WorkflowCompleteStatus, JobCompleteConfigInput, JobCompleteTriggerConfig, JobCompleteStatus, GenericWebhookConfigInput, GenericWebhookTriggerConfig, GenericWebhookAuthMethod, GenericWebhookHmacAuth, GenericWebhookApiKeyAuth, GenericWebhookAuth, ScheduleConfigInput, ScheduleTriggerConfig, LifecycleEvent, LifecycleConfigInput, LifecycleTriggerConfig, } from './triggers/index.js';
 export { onCancel, cleanup, onSuccess, onFailure, beforeStep, afterStep } from './hooks/index.js';
@@ -11,15 +13,18 @@ export { isEventType } from './rules/index.js';
 export type { Rule, RuleContext, RuleCheckFn, RuleResult, EventPayload, RuleEvaluationResult, EventBase, PullRequestEventPayload, PushEventPayload, TagEventPayload, CommentEventPayload, ReviewEventPayload, ReviewCommentEventPayload, ReleaseEventPayload, DispatchEventPayload, CreateEventPayload, DeleteEventPayload, StatusEventPayload, WorkflowRunEventPayload, ForkEventPayload, StarEventPayload, WatchEventPayload, WebhookEventPayload, KiciEventPayload, WorkflowCompleteEventPayload, JobCompleteEventPayload, GenericWebhookEventPayload, ScheduleEventPayload, LifecycleEventPayload, GitHubRepository, GitHubUser, GitHubPullRequest, GitHubCommit, GitHubComment, GitHubReview, GitHubRelease, } from './rules/index.js';
 export { validateDag } from './validation/index.js';
 export type { DagNode, DagValidationResult } from './validation/index.js';
-export type { SourceLocation, OutputProxy, Step, StepOptions, StepRunFn, BareStepFn, StepInput, OutputSchema, InferOutputs, Job, JobOptions, GenericInitConfig, ContainerConfig, RunsOnSelector, RunsOn, Workflow, WorkflowOptions, Registry, Trigger, DynamicJobFn, DynamicJobContext, JobOrFactory, } from './types.js';
+export type { SourceLocation, OutputProxy, Step, StepOptions, StepRunFn, BareStepFn, StepInput, OutputSchema, InferOutputs, Job, JobOptions, GenericInitConfig, MiseInitConfig, InitPreset, InitItem, InitConfig, ContainerConfig, RunsOnSelector, RunsOn, Workflow, WorkflowOptions, Registry, Trigger, DynamicJobFn, DynamicJobContext, JobOrFactory, } from './types.js';
 export { isDynamicJobFn, dynamicJob, getDynamicJobGroup, DYNAMIC_JOB_GROUP_TAG } from './types.js';
 export type { TaggedDynamicJobFn } from './types.js';
 export { CacheSpecSchema, normalizeCacheSpecs } from './cache-types.js';
 export type { CacheSpec, CacheInput } from './cache-types.js';
 export type { CacheRestoreResult, CacheApi } from './cache-types.js';
+export { provenanceSubjectIsPath } from './provenance-types.js';
+export type { AttestProvenanceOptions, AttestProvenanceResult, ProvenanceSubjectInput, } from './provenance-types.js';
 export { dynamicGroup, isDynamicGroupRef, DYNAMIC_GROUP_TAG } from './dynamic-group.js';
 export type { DynamicGroupRef } from './dynamic-group.js';
-export type { StepContext, Logger, WorkflowInfo, JobInfo, RepoInfo, StepSecretsTyped, KnownSecretKeys, } from './context.js';
+export type { StepContext, Logger, WorkflowInfo, JobInfo, MatrixJobOutputs, RepoInfo, StepSecretsTyped, KnownSecretKeys, } from './context.js';
+export { isMatrixJobOutputs } from './context.js';
 export { buildKiciApi } from './api-types.js';
 export type { KiciApi, KiciApiTransport, InfrastructureApi, InfrastructureListResult, } from './api-types.js';
 export { SecretNotFoundError } from './errors.js';

package/dist/index.js

@@ -1,6 +1,8 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { buildKiciApi } from "./api-types.js";
+import { normalizeRequireApproval } from "./approval.js";
 import { CacheSpecSchema, normalizeCacheSpecs } from "./cache-types.js";
+import { isMatrixJobOutputs } from "./context.js";
 import { DYNAMIC_GROUP_TAG, dynamicGroup, isDynamicGroupRef } from "./dynamic-group.js";
 import { SecretNotFoundError } from "./errors.js";
 import { fixture } from "./fixture.js";
@@ -40,6 +42,7 @@ import "./rules/index.js";
 import { validateDag } from "./validation/dag.js";
 import "./validation/index.js";
 import { DYNAMIC_JOB_GROUP_TAG, dynamicJob, getDynamicJobGroup, isDynamicJobFn } from "./types.js";
+import { provenanceSubjectIsPath } from "./provenance-types.js";
 import { createStepSecrets } from "./secrets.js";
 import { isDynamicFunction, isStaticArray, isStaticObject } from "./matrix/types.js";
 import { applyIncludeExclude, expandMatrix } from "./matrix/expand.js";
@@ -48,4 +51,4 @@ import { defineEvent } from "./events/define-event.js";
 import "./events/index.js";
 import { WaitForTimeoutError, waitFor, waitForStep } from "./wait-for.js";
 import { z } from "zod";
-export { CacheSpecSchema, DYNAMIC_GROUP_TAG, DYNAMIC_JOB_GROUP_TAG, SecretNotFoundError, WaitForTimeoutError, afterStep, applyIncludeExclude, beforeStep, buildKiciApi, cleanup, comment, create, createJobOutputProxy, createStepOutputProxy, createStepSecrets, defineEvent, del as delete, dispatch, dynamicGroup, dynamicJob, evaluateRules, expandMatrix, fixture, fork, genericWebhook, getDynamicJobGroup, getJobOutputsMap, getStepOutputsMap, getStepRefMap, idempotent, idempotentStep, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isEventType, isStaticArray, isStaticObject, job, jobComplete, kiciEvent, lifecycle, normalizeCacheSpecs, onCancel, onFailure, onSuccess, pr, push, release, resolveJobOutputs, resolveStepOutputs, review, reviewComment, rule, schedule, setJobOutputsMap, setStepOutputsMap, setStepRefMap, skip, star, status, step, tag, validateDag, waitFor, waitForStep, watch, webhook, workflow, workflowComplete, workflowRun, z };
+export { CacheSpecSchema, DYNAMIC_GROUP_TAG, DYNAMIC_JOB_GROUP_TAG, SecretNotFoundError, WaitForTimeoutError, afterStep, applyIncludeExclude, beforeStep, buildKiciApi, cleanup, comment, create, createJobOutputProxy, createStepOutputProxy, createStepSecrets, defineEvent, del as delete, dispatch, dynamicGroup, dynamicJob, evaluateRules, expandMatrix, fixture, fork, genericWebhook, getDynamicJobGroup, getJobOutputsMap, getStepOutputsMap, getStepRefMap, idempotent, idempotentStep, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isEventType, isMatrixJobOutputs, isStaticArray, isStaticObject, job, jobComplete, kiciEvent, lifecycle, normalizeCacheSpecs, normalizeRequireApproval, onCancel, onFailure, onSuccess, pr, provenanceSubjectIsPath, push, release, resolveJobOutputs, resolveStepOutputs, review, reviewComment, rule, schedule, setJobOutputsMap, setStepOutputsMap, setStepRefMap, skip, star, status, step, tag, validateDag, waitFor, waitForStep, watch, webhook, workflow, workflowComplete, workflowRun, z };

package/dist/job.js

@@ -1,15 +1,22 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { createJobOutputProxy } from "./outputs.js";
 import { randomUUID } from "node:crypto";
 //#region src/job.ts
+/** A typed preset is a `'mise'` string or a `{ mise }` object — neither carries `run`. */
+function isPreset(item) {
+	return item === "mise" || typeof item === "object" && item !== null && "mise" in item;
+}
 /**
-* Validate a job's `init` config. `undefined` / `false` are no-ops; every
-* remaining spec (one, or each element of an array) must carry a non-empty
-* `run` command. Throws with the offending index when validation fails.
+* Validate a job's `init` config. `undefined` / `false` / `'auto'` are no-ops;
+* typed presets (`'mise'` / `{ mise }`) carry no `run`, so they need no check.
+* Every remaining generic spec (one, or each element of an array) must carry a
+* non-empty `run` command. Throws with the offending index when validation fails.
 */
 function validateInit(init, jobName) {
-	if (init === void 0 || init === false) return;
-	(Array.isArray(init) ? init : [init]).forEach((spec, i) => {
+	if (init === void 0 || init === false || init === "auto") return;
+	(Array.isArray(init) ? init : [init]).forEach((item, i) => {
+		if (isPreset(item)) return;
+		const spec = item;
 		if (typeof spec.run !== "string" || spec.run.trim().length === 0) throw new Error(`job('${jobName}'): init[${i}].run must be a non-empty command`);
 	});
 }
@@ -52,6 +59,7 @@ function job(nameOrOptions, maybeOptions) {
 		resources: options.resources,
 		init: options.init,
 		...options.cache !== void 0 && { cache: options.cache },
+		...options.requireApproval !== void 0 && { requireApproval: options.requireApproval },
 		result: createJobOutputProxy(name)
 	};
 }

package/dist/matrix/expand.d.ts

@@ -1,25 +1,2 @@
-import type { StaticMatrixArray, StaticMatrixObject, MatrixInclude, MatrixExclude, MatrixValues } from './types.js';
-/**
- * Expand single-dimension matrix (array form) to MatrixValues array.
- * Each value becomes {value: string}.
- */
-export declare function expandSingleDimension(matrix: StaticMatrixArray): MatrixValues[];
-/**
- * Expand multi-dimensional matrix (object form) to MatrixValues array.
- * Uses fast-cartesian to compute cartesian product of all dimensions.
- * Dimension names are sorted for deterministic output.
- */
-export declare function expandMultiDimension(matrix: StaticMatrixObject): MatrixValues[];
-/**
- * Unified expand function that dispatches to single or multi-dimensional expansion.
- */
-export declare function expandMatrix(matrix: StaticMatrixArray | StaticMatrixObject): MatrixValues[];
-/**
- * Apply include/exclude modifications to expanded matrix combinations.
- * Per CONTEXT.md: exclude first (remove matching), then include (add new).
- *
- * Exclude matches if ALL specified dimensions match.
- * Include adds new combinations if they don't already exist.
- */
-export declare function applyIncludeExclude(expanded: MatrixValues[], include?: MatrixInclude[], exclude?: MatrixExclude[]): MatrixValues[];
+export { expandSingleDimension, expandMultiDimension, expandMatrix, applyIncludeExclude, } from '@kici-dev/engine';
 //# sourceMappingURL=expand.d.ts.map

package/dist/matrix/expand.js

@@ -1,66 +1,3 @@
-import "../chunk-gOLHoazu.js";
-import fastCartesian from "fast-cartesian";
-//#region src/matrix/expand.ts
-/**
-* Expand single-dimension matrix (array form) to MatrixValues array.
-* Each value becomes {value: string}.
-*/
-function expandSingleDimension(matrix) {
-	return matrix.map((value) => ({ value }));
-}
-/**
-* Expand multi-dimensional matrix (object form) to MatrixValues array.
-* Uses fast-cartesian to compute cartesian product of all dimensions.
-* Dimension names are sorted for deterministic output.
-*/
-function expandMultiDimension(matrix) {
-	const dimensions = Object.entries(matrix);
-	if (dimensions.length === 0) return [];
-	dimensions.sort((a, b) => a[0].localeCompare(b[0]));
-	const names = dimensions.map(([name]) => name);
-	return fastCartesian(dimensions.map(([, values]) => values)).map((combo) => {
-		const result = {};
-		names.forEach((name, idx) => {
-			result[name] = combo[idx];
-		});
-		return result;
-	});
-}
-/**
-* Unified expand function that dispatches to single or multi-dimensional expansion.
-*/
-function expandMatrix(matrix) {
-	if (Array.isArray(matrix)) return expandSingleDimension(matrix);
-	return expandMultiDimension(matrix);
-}
-/**
-* Apply include/exclude modifications to expanded matrix combinations.
-* Per CONTEXT.md: exclude first (remove matching), then include (add new).
-*
-* Exclude matches if ALL specified dimensions match.
-* Include adds new combinations if they don't already exist.
-*/
-function applyIncludeExclude(expanded, include, exclude) {
-	let result = [...expanded];
-	if (exclude && exclude.length > 0) result = result.filter((combo) => {
-		return !exclude.some((excl) => {
-			const exclEntries = Object.entries(excl);
-			if (exclEntries.length === 0) return false;
-			return exclEntries.every(([key, value]) => combo[key] === value);
-		});
-	});
-	if (include && include.length > 0) for (const incl of include) {
-		const inclKeys = Object.keys(incl);
-		if (inclKeys.length === 0) continue;
-		if (!result.some((combo) => {
-			const comboKeys = Object.keys(combo);
-			if (inclKeys.length !== comboKeys.length) return false;
-			return inclKeys.every((key) => combo[key] === incl[key]);
-		})) result.push(incl);
-	}
-	return result;
-}
-//#endregion
+import "../chunk-BTugEXQM.js";
+import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "@kici-dev/engine";
 export { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension };
-
-//# sourceMappingURL=expand.js.map

package/dist/matrix/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { isDynamicFunction, isStaticArray, isStaticObject } from "./types.js";
 import { applyIncludeExclude, expandMatrix } from "./expand.js";
 export { applyIncludeExclude, expandMatrix, isDynamicFunction, isStaticArray, isStaticObject };

package/dist/matrix/types.d.ts

@@ -1,9 +1,7 @@
 import type { $ as Shell } from 'zx';
 import type { Logger } from '../context.js';
-/** Single-dimension static matrix: array of values */
-export type StaticMatrixArray = string[];
-/** Multi-dimensional static matrix: named dimensions with values */
-export type StaticMatrixObject = Record<string, string[]>;
+export type { StaticMatrixArray, StaticMatrixObject, MatrixInclude, MatrixExclude, MatrixValues, } from '@kici-dev/engine';
+import type { StaticMatrixArray, StaticMatrixObject } from '@kici-dev/engine';
 /**
  * Context passed to dynamic matrix functions.
  * Uses destructured form: async ({$, ctx, log, env}) => values
@@ -36,21 +34,6 @@ export interface DynamicMatrixContext {
 export type DynamicMatrixFn = (context: DynamicMatrixContext) => Promise<StaticMatrixArray | StaticMatrixObject>;
 /** Union type for all matrix forms */
 export type Matrix = StaticMatrixArray | StaticMatrixObject | DynamicMatrixFn;
-/** Include entries for adding specific matrix combinations */
-export type MatrixInclude = Record<string, string>;
-/** Exclude entries for removing specific matrix combinations */
-export type MatrixExclude = Record<string, string>;
-/**
- * Matrix values as exposed to steps.
- * Single-dimension: {value: 'linux'}
- * Multi-dimensional: {os: 'linux', node: '18'}
- */
-export interface MatrixValues {
-    /** Single-dimension: the value */
-    value?: string;
-    /** Multi-dimensional: named properties */
-    [dimension: string]: string | undefined;
-}
 /** Type guard for static array matrices */
 export declare function isStaticArray(m: Matrix): m is StaticMatrixArray;
 /** Type guard for static object matrices */

package/dist/matrix/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/matrix/types.ts
 /** Type guard for static array matrices */
 function isStaticArray(m) {

package/dist/outputs.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/outputs.ts
 /**
 * Well-known string property names that should delegate to Reflect rather than throwing.

package/dist/provenance-types.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Types for `ctx.attestProvenance()` — the imperative step helper that builds,
+ * signs, and persists a KiCI build-provenance attestation for a produced
+ * artifact.
+ */
+/**
+ * The artifact being attested. Either supply a precomputed digest, or a path
+ * (relative to the step working directory) the agent will digest with SHA-256.
+ */
+export type ProvenanceSubjectInput = {
+    name: string;
+    digest: {
+        sha256?: string;
+        sha512?: string;
+    };
+} | {
+    name: string;
+    path: string;
+};
+export interface AttestProvenanceOptions {
+    subject: ProvenanceSubjectInput;
+    /** OIDC audience for the identity token (defaults to 'kici-provenance'). */
+    audience?: string;
+}
+export interface AttestProvenanceResult {
+    /** Object-storage key the signed bundle was written to. */
+    storageKey: string;
+    /** Primary subject digest (lowercase hex). */
+    subjectDigest: string;
+    /** Media type of the persisted bundle. */
+    bundleMediaType: string;
+}
+/** Discriminate a path subject from a precomputed-digest subject. */
+export declare function provenanceSubjectIsPath(s: ProvenanceSubjectInput): s is {
+    name: string;
+    path: string;
+};
+//# sourceMappingURL=provenance-types.d.ts.map

package/dist/provenance-types.js

@@ -0,0 +1,10 @@
+import "./chunk-BTugEXQM.js";
+//#region src/provenance-types.ts
+/** Discriminate a path subject from a precomputed-digest subject. */
+function provenanceSubjectIsPath(s) {
+	return "path" in s;
+}
+//#endregion
+export { provenanceSubjectIsPath };
+
+//# sourceMappingURL=provenance-types.js.map

package/dist/rules/evaluator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/rules/evaluator.ts
 /**

package/dist/rules/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { rule, skip } from "./rule.js";
 import { evaluateRules } from "./evaluator.js";
 import { isEventType } from "../events/event-payloads.js";

package/dist/rules/rule.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/rules/rule.ts
 /**
 * Implementation of rule() factory.

package/dist/rules/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};