@kici-dev/sdk 0.1.16 → 0.1.17

package/dist/api-types.d.ts

@@ -8,6 +8,8 @@
  * 1. Add the typed method here (with param + return types)
  * 2. Register the handler in the orchestrator's AgentApiRegistry
  */
+import { type OidcTokenResult } from '@kici-dev/engine/protocol/messages/oidc-token-relay';
+export type { OidcTokenResult };
 export interface InfrastructureListResult {
     scalers: Array<{
         name: string;
@@ -28,9 +30,23 @@ export interface InfrastructureApi {
     /** List available scalers and connected agents. */
     list(): Promise<InfrastructureListResult>;
 }
+export interface OidcApi {
+    /**
+     * Request a short-lived OIDC ID token for the current job, bound to
+     * `audience`. The token's identity claims (repository, ref, sha, run/job id)
+     * are derived server-side from the build context and cannot be spoofed by the
+     * workflow. The token is automatically masked in step logs. Only available
+     * inside a running job step (throws otherwise).
+     */
+    token(opts: {
+        audience: string;
+    }): Promise<OidcTokenResult>;
+}
 export interface KiciApi {
     /** Query orchestrator infrastructure (scalers, agents). */
     infrastructure: InfrastructureApi;
+    /** Request short-lived OIDC ID tokens for the current job (build provenance). */
+    oidc: OidcApi;
 }
 /**
  * Low-level transport function used to implement KiciApi.
@@ -42,6 +58,14 @@ export type KiciApiTransport = (method: string, params?: Record<string, unknown>
  *
  * This is the bridge between the typed SDK interface and the untyped WS/IPC
  * transport. Each method call is mapped to { method: 'namespace.method', params }.
+ *
+ * `jobCtx` carries the per-job execution context (the job the step is running
+ * in). It is supplied by the agent's sandbox step context so `oidc.token()` can
+ * bind its request to that job; the workflow author never supplies it. It is
+ * omitted for contexts with no running job (e.g. DynamicJobFn re-evaluation),
+ * where `oidc.token()` throws rather than silently misattributing a token.
  */
-export declare function buildKiciApi(transport: KiciApiTransport): KiciApi;
+export declare function buildKiciApi(transport: KiciApiTransport, jobCtx?: {
+    jobId: string;
+}): KiciApi;
 //# sourceMappingURL=api-types.d.ts.map

package/dist/api-types.js

@@ -1,13 +1,39 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
+import { OIDC_TOKEN_REQUEST_METHOD } from "@kici-dev/engine/protocol/messages/oidc-token-relay";
 //#region src/api-types.ts
 /**
+* Typed KiCI API available to workflows via ctx.kici.
+*
+* Each namespace groups related methods. Under the hood, calls are serialized
+* to { method: 'namespace.method', params } and sent over the agent's WS
+* connection to the orchestrator. Adding a new API method:
+*
+* 1. Add the typed method here (with param + return types)
+* 2. Register the handler in the orchestrator's AgentApiRegistry
+*/
+/**
 * Build a typed KiciApi proxy from a raw transport function.
 *
 * This is the bridge between the typed SDK interface and the untyped WS/IPC
 * transport. Each method call is mapped to { method: 'namespace.method', params }.
+*
+* `jobCtx` carries the per-job execution context (the job the step is running
+* in). It is supplied by the agent's sandbox step context so `oidc.token()` can
+* bind its request to that job; the workflow author never supplies it. It is
+* omitted for contexts with no running job (e.g. DynamicJobFn re-evaluation),
+* where `oidc.token()` throws rather than silently misattributing a token.
 */
-function buildKiciApi(transport) {
-	return { infrastructure: { list: () => transport("infrastructure.list", {}) } };
+function buildKiciApi(transport, jobCtx) {
+	return {
+		infrastructure: { list: () => transport("infrastructure.list", {}) },
+		oidc: { token: (opts) => {
+			if (!jobCtx) return Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is only available inside a running job step"));
+			return transport(OIDC_TOKEN_REQUEST_METHOD, {
+				jobId: jobCtx.jobId,
+				audience: opts.audience
+			});
+		} }
+	};
 }
 //#endregion
 export { buildKiciApi };

package/dist/approval.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/approval.ts
 /** Normalize any `RequireApproval` form into `{ clauses, reason?, timeoutSeconds? }`. */
 function normalizeRequireApproval(r) {

package/dist/cache-types.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { z } from "zod";
 //#region src/cache-types.ts
 /** Zod schema validating a CacheSpec at compile/serialize time. */

package/dist/context.d.ts

@@ -19,6 +19,19 @@ export interface JobInfo {
     name: string;
     runsOn: string;
 }
+/**
+ * Outputs of a matrix job as seen by a downstream `needs:` consumer.
+ * A downstream that consumes a matrix upstream receives this envelope instead of
+ * a flat outputs object, identically under `kici run local` and the remote path.
+ */
+export interface MatrixJobOutputs<T = Record<string, unknown>> {
+    /** Keyed by the combination suffix (the text inside `(...)` of the child name). */
+    byMatrix: Record<string, T>;
+    /** Last-write-wins flat merge across children, in child (name) order. */
+    merged: T;
+}
+/** Runtime discriminator: true when `ctx.jobOutputs(ref)` returned a matrix envelope. */
+export declare function isMatrixJobOutputs(value: Record<string, unknown> | MatrixJobOutputs): value is MatrixJobOutputs;
 /**
  * Augmentable interface for known secret keys.
  * When augmented via `kici types` (.d.ts generation), narrows get/expose key parameter.
@@ -158,14 +171,22 @@ export interface StepContext<TInputs = Record<string, unknown>> {
     } | ((...args: any[]) => any)): T;
     /**
      * Resolve outputs from a preceding job by reference.
-     * Returns the job's collected outputs (step-keyed for multi-step, flat for run shorthand).
+     *
+     * For a plain upstream this returns the job's collected outputs (step-keyed
+     * for multi-step, flat for run shorthand). For a **matrix** upstream it returns
+     * a {@link MatrixJobOutputs} envelope `{ byMatrix, merged }` keyed by the
+     * combination suffix — identical under `kici run local` and the remote path.
+     * Use {@link isMatrixJobOutputs} (or `'byMatrix' in result`) to discriminate.
      *
      * @example
      * const setupOutputs = ctx.jobOutputs(setupJob);
+     * @example
+     * const m = ctx.jobOutputs(buildMatrixJob);
+     * if (isMatrixJobOutputs(m)) console.log(m.byMatrix['linux, arm64']);
      */
     jobOutputs(ref: {
         name: string;
-    }): Record<string, unknown>;
+    }): Record<string, unknown> | MatrixJobOutputs;
     /**
      * Publish a secret output value from this job.
      * Secret outputs are encrypted before leaving the agent and can be consumed
@@ -188,6 +209,14 @@ export interface StepContext<TInputs = Record<string, unknown>> {
      * under `spec.key` (immutable — first save wins). Scoped per org + ref.
      */
     cache: import('./cache-types.js').CacheApi;
+    /**
+     * Build, sign, and persist a KiCI build-provenance attestation for a produced
+     * artifact. The in-toto statement's identity is derived from a Platform-minted
+     * identity token (unforgeable); the bundle is signed with an ephemeral key and
+     * is offline-verifiable. Pass the artifact via a precomputed digest or a path
+     * the agent digests with SHA-256.
+     */
+    attestProvenance(opts: import('./provenance-types.js').AttestProvenanceOptions): Promise<import('./provenance-types.js').AttestProvenanceResult>;
 }
 export {};
 //# sourceMappingURL=context.d.ts.map

package/dist/context.js

@@ -1,2 +1,10 @@
-import "./chunk-gOLHoazu.js";
-export {};
+import "./chunk-BTugEXQM.js";
+//#region src/context.ts
+/** Runtime discriminator: true when `ctx.jobOutputs(ref)` returned a matrix envelope. */
+function isMatrixJobOutputs(value) {
+	return typeof value === "object" && value !== null && "byMatrix" in value && "merged" in value && typeof value.byMatrix === "object";
+}
+//#endregion
+export { isMatrixJobOutputs };
+
+//# sourceMappingURL=context.js.map

package/dist/dynamic-group.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/dynamic-group.ts
 /**
 * Dynamic group helpers for cross-domain needs.

package/dist/errors.js

@@ -1,9 +1,11 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/errors.ts
 /**
 * Thrown when accessing a secret key that does not exist in the flat secrets proxy.
 */
 var SecretNotFoundError = class extends Error {
+	key;
+	availableKeys;
 	constructor(key, availableKeys) {
 		super(`Secret "${key}" not found. Available keys: ${availableKeys.join(", ") || "(none)"}. Use ctx.secrets.has('${key}') to check existence, or await ctx.secrets.get('${key}') in a try/catch.`);
 		this.key = key;

package/dist/events/define-event.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/events/define-event.ts
 /**
 * Create a typed event definition with a Zod schema.

package/dist/events/event-payloads.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/events/event-payloads.ts
 /**
 * Narrow an EventPayload to a specific event type.

package/dist/events/event-payloads.test-d.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { describe, expectTypeOf, it } from "vitest";
 //#region src/events/event-payloads.test-d.ts
 describe("EventPayload narrowing", () => {

package/dist/events/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { isEventType } from "./event-payloads.js";
 import { defineEvent } from "./define-event.js";
 export { defineEvent, isEventType };

package/dist/events/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/fixture.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/fixture.ts
 /**
 * Create a test fixture definition.

package/dist/hooks/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/hooks/index.ts
 /**
 * Normalize HookInput to extract run function and optional timeout.

package/dist/hooks/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/idempotent.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { step } from "./step.js";
 import { runIdempotentStep } from "@kici-dev/core/idempotency";
 //#region src/idempotent.ts

package/dist/index.d.ts

@@ -13,15 +13,18 @@ export { isEventType } from './rules/index.js';
 export type { Rule, RuleContext, RuleCheckFn, RuleResult, EventPayload, RuleEvaluationResult, EventBase, PullRequestEventPayload, PushEventPayload, TagEventPayload, CommentEventPayload, ReviewEventPayload, ReviewCommentEventPayload, ReleaseEventPayload, DispatchEventPayload, CreateEventPayload, DeleteEventPayload, StatusEventPayload, WorkflowRunEventPayload, ForkEventPayload, StarEventPayload, WatchEventPayload, WebhookEventPayload, KiciEventPayload, WorkflowCompleteEventPayload, JobCompleteEventPayload, GenericWebhookEventPayload, ScheduleEventPayload, LifecycleEventPayload, GitHubRepository, GitHubUser, GitHubPullRequest, GitHubCommit, GitHubComment, GitHubReview, GitHubRelease, } from './rules/index.js';
 export { validateDag } from './validation/index.js';
 export type { DagNode, DagValidationResult } from './validation/index.js';
-export type { SourceLocation, OutputProxy, Step, StepOptions, StepRunFn, BareStepFn, StepInput, OutputSchema, InferOutputs, Job, JobOptions, GenericInitConfig, ContainerConfig, RunsOnSelector, RunsOn, Workflow, WorkflowOptions, Registry, Trigger, DynamicJobFn, DynamicJobContext, JobOrFactory, } from './types.js';
+export type { SourceLocation, OutputProxy, Step, StepOptions, StepRunFn, BareStepFn, StepInput, OutputSchema, InferOutputs, Job, JobOptions, GenericInitConfig, MiseInitConfig, InitPreset, InitItem, InitConfig, ContainerConfig, RunsOnSelector, RunsOn, Workflow, WorkflowOptions, Registry, Trigger, DynamicJobFn, DynamicJobContext, JobOrFactory, } from './types.js';
 export { isDynamicJobFn, dynamicJob, getDynamicJobGroup, DYNAMIC_JOB_GROUP_TAG } from './types.js';
 export type { TaggedDynamicJobFn } from './types.js';
 export { CacheSpecSchema, normalizeCacheSpecs } from './cache-types.js';
 export type { CacheSpec, CacheInput } from './cache-types.js';
 export type { CacheRestoreResult, CacheApi } from './cache-types.js';
+export { provenanceSubjectIsPath } from './provenance-types.js';
+export type { AttestProvenanceOptions, AttestProvenanceResult, ProvenanceSubjectInput, } from './provenance-types.js';
 export { dynamicGroup, isDynamicGroupRef, DYNAMIC_GROUP_TAG } from './dynamic-group.js';
 export type { DynamicGroupRef } from './dynamic-group.js';
-export type { StepContext, Logger, WorkflowInfo, JobInfo, RepoInfo, StepSecretsTyped, KnownSecretKeys, } from './context.js';
+export type { StepContext, Logger, WorkflowInfo, JobInfo, MatrixJobOutputs, RepoInfo, StepSecretsTyped, KnownSecretKeys, } from './context.js';
+export { isMatrixJobOutputs } from './context.js';
 export { buildKiciApi } from './api-types.js';
 export type { KiciApi, KiciApiTransport, InfrastructureApi, InfrastructureListResult, } from './api-types.js';
 export { SecretNotFoundError } from './errors.js';

package/dist/index.js

@@ -1,7 +1,8 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { buildKiciApi } from "./api-types.js";
 import { normalizeRequireApproval } from "./approval.js";
 import { CacheSpecSchema, normalizeCacheSpecs } from "./cache-types.js";
+import { isMatrixJobOutputs } from "./context.js";
 import { DYNAMIC_GROUP_TAG, dynamicGroup, isDynamicGroupRef } from "./dynamic-group.js";
 import { SecretNotFoundError } from "./errors.js";
 import { fixture } from "./fixture.js";
@@ -41,6 +42,7 @@ import "./rules/index.js";
 import { validateDag } from "./validation/dag.js";
 import "./validation/index.js";
 import { DYNAMIC_JOB_GROUP_TAG, dynamicJob, getDynamicJobGroup, isDynamicJobFn } from "./types.js";
+import { provenanceSubjectIsPath } from "./provenance-types.js";
 import { createStepSecrets } from "./secrets.js";
 import { isDynamicFunction, isStaticArray, isStaticObject } from "./matrix/types.js";
 import { applyIncludeExclude, expandMatrix } from "./matrix/expand.js";
@@ -49,4 +51,4 @@ import { defineEvent } from "./events/define-event.js";
 import "./events/index.js";
 import { WaitForTimeoutError, waitFor, waitForStep } from "./wait-for.js";
 import { z } from "zod";
-export { CacheSpecSchema, DYNAMIC_GROUP_TAG, DYNAMIC_JOB_GROUP_TAG, SecretNotFoundError, WaitForTimeoutError, afterStep, applyIncludeExclude, beforeStep, buildKiciApi, cleanup, comment, create, createJobOutputProxy, createStepOutputProxy, createStepSecrets, defineEvent, del as delete, dispatch, dynamicGroup, dynamicJob, evaluateRules, expandMatrix, fixture, fork, genericWebhook, getDynamicJobGroup, getJobOutputsMap, getStepOutputsMap, getStepRefMap, idempotent, idempotentStep, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isEventType, isStaticArray, isStaticObject, job, jobComplete, kiciEvent, lifecycle, normalizeCacheSpecs, normalizeRequireApproval, onCancel, onFailure, onSuccess, pr, push, release, resolveJobOutputs, resolveStepOutputs, review, reviewComment, rule, schedule, setJobOutputsMap, setStepOutputsMap, setStepRefMap, skip, star, status, step, tag, validateDag, waitFor, waitForStep, watch, webhook, workflow, workflowComplete, workflowRun, z };
+export { CacheSpecSchema, DYNAMIC_GROUP_TAG, DYNAMIC_JOB_GROUP_TAG, SecretNotFoundError, WaitForTimeoutError, afterStep, applyIncludeExclude, beforeStep, buildKiciApi, cleanup, comment, create, createJobOutputProxy, createStepOutputProxy, createStepSecrets, defineEvent, del as delete, dispatch, dynamicGroup, dynamicJob, evaluateRules, expandMatrix, fixture, fork, genericWebhook, getDynamicJobGroup, getJobOutputsMap, getStepOutputsMap, getStepRefMap, idempotent, idempotentStep, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isEventType, isMatrixJobOutputs, isStaticArray, isStaticObject, job, jobComplete, kiciEvent, lifecycle, normalizeCacheSpecs, normalizeRequireApproval, onCancel, onFailure, onSuccess, pr, provenanceSubjectIsPath, push, release, resolveJobOutputs, resolveStepOutputs, review, reviewComment, rule, schedule, setJobOutputsMap, setStepOutputsMap, setStepRefMap, skip, star, status, step, tag, validateDag, waitFor, waitForStep, watch, webhook, workflow, workflowComplete, workflowRun, z };

package/dist/job.js

@@ -1,15 +1,22 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { createJobOutputProxy } from "./outputs.js";
 import { randomUUID } from "node:crypto";
 //#region src/job.ts
+/** A typed preset is a `'mise'` string or a `{ mise }` object — neither carries `run`. */
+function isPreset(item) {
+	return item === "mise" || typeof item === "object" && item !== null && "mise" in item;
+}
 /**
-* Validate a job's `init` config. `undefined` / `false` are no-ops; every
-* remaining spec (one, or each element of an array) must carry a non-empty
-* `run` command. Throws with the offending index when validation fails.
+* Validate a job's `init` config. `undefined` / `false` / `'auto'` are no-ops;
+* typed presets (`'mise'` / `{ mise }`) carry no `run`, so they need no check.
+* Every remaining generic spec (one, or each element of an array) must carry a
+* non-empty `run` command. Throws with the offending index when validation fails.
 */
 function validateInit(init, jobName) {
-	if (init === void 0 || init === false) return;
-	(Array.isArray(init) ? init : [init]).forEach((spec, i) => {
+	if (init === void 0 || init === false || init === "auto") return;
+	(Array.isArray(init) ? init : [init]).forEach((item, i) => {
+		if (isPreset(item)) return;
+		const spec = item;
 		if (typeof spec.run !== "string" || spec.run.trim().length === 0) throw new Error(`job('${jobName}'): init[${i}].run must be a non-empty command`);
 	});
 }

package/dist/matrix/expand.d.ts

@@ -1,25 +1,2 @@
-import type { StaticMatrixArray, StaticMatrixObject, MatrixInclude, MatrixExclude, MatrixValues } from './types.js';
-/**
- * Expand single-dimension matrix (array form) to MatrixValues array.
- * Each value becomes {value: string}.
- */
-export declare function expandSingleDimension(matrix: StaticMatrixArray): MatrixValues[];
-/**
- * Expand multi-dimensional matrix (object form) to MatrixValues array.
- * Uses fast-cartesian to compute cartesian product of all dimensions.
- * Dimension names are sorted for deterministic output.
- */
-export declare function expandMultiDimension(matrix: StaticMatrixObject): MatrixValues[];
-/**
- * Unified expand function that dispatches to single or multi-dimensional expansion.
- */
-export declare function expandMatrix(matrix: StaticMatrixArray | StaticMatrixObject): MatrixValues[];
-/**
- * Apply include/exclude modifications to expanded matrix combinations.
- * Per CONTEXT.md: exclude first (remove matching), then include (add new).
- *
- * Exclude matches if ALL specified dimensions match.
- * Include adds new combinations if they don't already exist.
- */
-export declare function applyIncludeExclude(expanded: MatrixValues[], include?: MatrixInclude[], exclude?: MatrixExclude[]): MatrixValues[];
+export { expandSingleDimension, expandMultiDimension, expandMatrix, applyIncludeExclude, } from '@kici-dev/engine';
 //# sourceMappingURL=expand.d.ts.map

package/dist/matrix/expand.js

@@ -1,66 +1,3 @@
-import "../chunk-gOLHoazu.js";
-import fastCartesian from "fast-cartesian";
-//#region src/matrix/expand.ts
-/**
-* Expand single-dimension matrix (array form) to MatrixValues array.
-* Each value becomes {value: string}.
-*/
-function expandSingleDimension(matrix) {
-	return matrix.map((value) => ({ value }));
-}
-/**
-* Expand multi-dimensional matrix (object form) to MatrixValues array.
-* Uses fast-cartesian to compute cartesian product of all dimensions.
-* Dimension names are sorted for deterministic output.
-*/
-function expandMultiDimension(matrix) {
-	const dimensions = Object.entries(matrix);
-	if (dimensions.length === 0) return [];
-	dimensions.sort((a, b) => a[0].localeCompare(b[0]));
-	const names = dimensions.map(([name]) => name);
-	return fastCartesian(dimensions.map(([, values]) => values)).map((combo) => {
-		const result = {};
-		names.forEach((name, idx) => {
-			result[name] = combo[idx];
-		});
-		return result;
-	});
-}
-/**
-* Unified expand function that dispatches to single or multi-dimensional expansion.
-*/
-function expandMatrix(matrix) {
-	if (Array.isArray(matrix)) return expandSingleDimension(matrix);
-	return expandMultiDimension(matrix);
-}
-/**
-* Apply include/exclude modifications to expanded matrix combinations.
-* Per CONTEXT.md: exclude first (remove matching), then include (add new).
-*
-* Exclude matches if ALL specified dimensions match.
-* Include adds new combinations if they don't already exist.
-*/
-function applyIncludeExclude(expanded, include, exclude) {
-	let result = [...expanded];
-	if (exclude && exclude.length > 0) result = result.filter((combo) => {
-		return !exclude.some((excl) => {
-			const exclEntries = Object.entries(excl);
-			if (exclEntries.length === 0) return false;
-			return exclEntries.every(([key, value]) => combo[key] === value);
-		});
-	});
-	if (include && include.length > 0) for (const incl of include) {
-		const inclKeys = Object.keys(incl);
-		if (inclKeys.length === 0) continue;
-		if (!result.some((combo) => {
-			const comboKeys = Object.keys(combo);
-			if (inclKeys.length !== comboKeys.length) return false;
-			return inclKeys.every((key) => combo[key] === incl[key]);
-		})) result.push(incl);
-	}
-	return result;
-}
-//#endregion
+import "../chunk-BTugEXQM.js";
+import { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension } from "@kici-dev/engine";
 export { applyIncludeExclude, expandMatrix, expandMultiDimension, expandSingleDimension };
-
-//# sourceMappingURL=expand.js.map

package/dist/matrix/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { isDynamicFunction, isStaticArray, isStaticObject } from "./types.js";
 import { applyIncludeExclude, expandMatrix } from "./expand.js";
 export { applyIncludeExclude, expandMatrix, isDynamicFunction, isStaticArray, isStaticObject };

package/dist/matrix/types.d.ts

@@ -1,9 +1,7 @@
 import type { $ as Shell } from 'zx';
 import type { Logger } from '../context.js';
-/** Single-dimension static matrix: array of values */
-export type StaticMatrixArray = string[];
-/** Multi-dimensional static matrix: named dimensions with values */
-export type StaticMatrixObject = Record<string, string[]>;
+export type { StaticMatrixArray, StaticMatrixObject, MatrixInclude, MatrixExclude, MatrixValues, } from '@kici-dev/engine';
+import type { StaticMatrixArray, StaticMatrixObject } from '@kici-dev/engine';
 /**
  * Context passed to dynamic matrix functions.
  * Uses destructured form: async ({$, ctx, log, env}) => values
@@ -36,21 +34,6 @@ export interface DynamicMatrixContext {
 export type DynamicMatrixFn = (context: DynamicMatrixContext) => Promise<StaticMatrixArray | StaticMatrixObject>;
 /** Union type for all matrix forms */
 export type Matrix = StaticMatrixArray | StaticMatrixObject | DynamicMatrixFn;
-/** Include entries for adding specific matrix combinations */
-export type MatrixInclude = Record<string, string>;
-/** Exclude entries for removing specific matrix combinations */
-export type MatrixExclude = Record<string, string>;
-/**
- * Matrix values as exposed to steps.
- * Single-dimension: {value: 'linux'}
- * Multi-dimensional: {os: 'linux', node: '18'}
- */
-export interface MatrixValues {
-    /** Single-dimension: the value */
-    value?: string;
-    /** Multi-dimensional: named properties */
-    [dimension: string]: string | undefined;
-}
 /** Type guard for static array matrices */
 export declare function isStaticArray(m: Matrix): m is StaticMatrixArray;
 /** Type guard for static object matrices */

package/dist/matrix/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/matrix/types.ts
 /** Type guard for static array matrices */
 function isStaticArray(m) {

package/dist/outputs.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/outputs.ts
 /**
 * Well-known string property names that should delegate to Reflect rather than throwing.

package/dist/provenance-types.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Types for `ctx.attestProvenance()` — the imperative step helper that builds,
+ * signs, and persists a KiCI build-provenance attestation for a produced
+ * artifact.
+ */
+/**
+ * The artifact being attested. Either supply a precomputed digest, or a path
+ * (relative to the step working directory) the agent will digest with SHA-256.
+ */
+export type ProvenanceSubjectInput = {
+    name: string;
+    digest: {
+        sha256?: string;
+        sha512?: string;
+    };
+} | {
+    name: string;
+    path: string;
+};
+export interface AttestProvenanceOptions {
+    subject: ProvenanceSubjectInput;
+    /** OIDC audience for the identity token (defaults to 'kici-provenance'). */
+    audience?: string;
+}
+export interface AttestProvenanceResult {
+    /** Object-storage key the signed bundle was written to. */
+    storageKey: string;
+    /** Primary subject digest (lowercase hex). */
+    subjectDigest: string;
+    /** Media type of the persisted bundle. */
+    bundleMediaType: string;
+}
+/** Discriminate a path subject from a precomputed-digest subject. */
+export declare function provenanceSubjectIsPath(s: ProvenanceSubjectInput): s is {
+    name: string;
+    path: string;
+};
+//# sourceMappingURL=provenance-types.d.ts.map

package/dist/provenance-types.js

@@ -0,0 +1,10 @@
+import "./chunk-BTugEXQM.js";
+//#region src/provenance-types.ts
+/** Discriminate a path subject from a precomputed-digest subject. */
+function provenanceSubjectIsPath(s) {
+	return "path" in s;
+}
+//#endregion
+export { provenanceSubjectIsPath };
+
+//# sourceMappingURL=provenance-types.js.map

package/dist/rules/evaluator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/rules/evaluator.ts
 /**

package/dist/rules/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { rule, skip } from "./rule.js";
 import { evaluateRules } from "./evaluator.js";
 import { isEventType } from "../events/event-payloads.js";

package/dist/rules/rule.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/rules/rule.ts
 /**
 * Implementation of rule() factory.

package/dist/rules/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/secrets.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { SecretNotFoundError } from "./errors.js";
 //#region src/secrets.ts
 /**

package/dist/step.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { createStepOutputProxy } from "./outputs.js";
 //#region src/step.ts
 /**

package/dist/triggers/comment.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/comment.ts
 /**

package/dist/triggers/create.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/create.ts
 /**

package/dist/triggers/delete.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/delete.ts
 /**

package/dist/triggers/dispatch.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/dispatch.ts
 /**

package/dist/triggers/fork.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/fork.ts
 /**

package/dist/triggers/generic-webhook.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/generic-webhook.ts
 /**
 * Create a generic webhook trigger configuration.

package/dist/triggers/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { DEFAULT_PR_EVENTS, toBranchPattern } from "./types.js";
 import { pr } from "./pr.js";
 import { push } from "./push.js";

package/dist/triggers/job-complete.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/job-complete.ts
 /**
 * Create a job completion trigger configuration.

package/dist/triggers/kici-event.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/kici-event.ts
 /**
 * Create a KiCI custom event trigger configuration.

package/dist/triggers/lifecycle.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/lifecycle.ts
 /**
 * Create a lifecycle trigger configuration.

package/dist/triggers/pr.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { DEFAULT_PR_EVENTS, asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/pr.ts
 /**

package/dist/triggers/push.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/push.ts
 /**

package/dist/triggers/release.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/release.ts
 /**

package/dist/triggers/review-comment.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/review-comment.ts
 /**

package/dist/triggers/review.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/review.ts
 /**

package/dist/triggers/schedule.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/schedule.ts
 /**
 * Create a schedule trigger configuration.

package/dist/triggers/star.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/star.ts
 /**

package/dist/triggers/status.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/status.ts
 /**

package/dist/triggers/tag.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/tag.ts
 /**

package/dist/triggers/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/types.ts
 /**
 * Default PR events when pr() is called without explicit events.

package/dist/triggers/watch.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/watch.ts
 /**

package/dist/triggers/webhook.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/webhook.ts
 /**

package/dist/triggers/workflow-complete.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/workflow-complete.ts
 /**
 * Create a workflow completion trigger configuration.

package/dist/triggers/workflow-run.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/workflow-run.ts
 /**

package/dist/types.d.ts

@@ -210,13 +210,48 @@ export interface GenericInitConfig {
     /** Static environment variables available to the command. */
     env?: Record<string, string>;
 }
+/**
+ * Overrides for the `mise` init preset. The preset supplies the `run` command;
+ * these tune the same fields a hand-written {@link GenericInitConfig} exposes,
+ * minus `run`.
+ */
+export interface MiseInitConfig {
+    /** Cache spec for mise's data dir. Omit -> content-derived default; `false` -> no cache. */
+    cache?: import('./cache-types.js').CacheSpec | false;
+    /** Max wall-clock for the mise init command in ms. Defaults to 600000. */
+    timeout?: number;
+    /** Static environment variables available to the mise command. */
+    env?: Record<string, string>;
+    /** Shell used to run the mise command. Defaults to the OS template's shell. */
+    shell?: string;
+}
+/** A typed toolchain preset: zero-config string or an object with overrides. */
+export type InitPreset = 'mise' | {
+    mise: MiseInitConfig;
+};
+/** One init directive: a hand-written generic config or a typed preset. */
+export type InitItem = GenericInitConfig | InitPreset;
+/**
+ * Per-job init configuration:
+ * - a single {@link InitItem} (generic config or preset),
+ * - an ordered array of items (run in order),
+ * - `'auto'` — detect the toolchain from committed files (mise.toml / .tool-versions),
+ * - `false` — explicit opt-out.
+ *
+ * An unset `init` is also "no init". `'auto'` is a scalar only — never an array element.
+ */
+export type InitConfig = InitItem | InitItem[] | 'auto' | false;
 /**
  * Structured runsOn selector with required and excluded labels.
  * Used when jobs need to target specific agents while excluding others.
  *
- * **Reserved namespace:** Labels with the `kici:` prefix are reserved for internal use
- * (e.g., `kici:role:builder`, `kici:role:init-runner`). User-supplied labels starting with
- * `kici:` will be rejected at compile time and agent startup.
+ * **Targeting `kici:` labels:** `runsOn` may target any agent label, including the
+ * `kici:`-namespaced auto-labels (e.g. `kici:os:linux`, `kici:arch:arm64`,
+ * `kici:host:<name>`). Targeting is a requirement on candidate agents, never a grant.
+ * Note that `kici:scaler:<name>` / `kici:agent:<backend>` are deployment-specific names,
+ * so targeting them couples a workflow to one orchestrator's configuration. Users still
+ * cannot *set* `kici:` labels on agents — that namespace is reserved for the scaler and
+ * the agent's self-reported platform facts.
  */
 export interface RunsOnSelector {
     labels: string | string[];
@@ -224,13 +259,15 @@ export interface RunsOnSelector {
 }
 /**
  * Polymorphic runsOn type: string shorthand, array shorthand, or full selector object.
- * - `'linux'` — single label shorthand
- * - `['linux', 'docker']` — multi-label shorthand
- * - `{ labels: ['linux', 'docker'], exclude: ['gpu'] }` — full selector with exclusions
+ * - `'kici:os:linux'` — single label shorthand (targets any linux agent)
+ * - `['kici:os:linux', 'gpu']` — multi-label shorthand (all must match)
+ * - `{ labels: ['kici:os:linux'], exclude: ['kici:host:box-01'] }` — full selector
  *
- * **Reserved namespace:** Labels with the `kici:` prefix are reserved for internal use
- * (e.g., `kici:role:builder`, `kici:role:init-runner`). User-supplied labels starting with
- * `kici:` will be rejected at compile time and agent startup.
+ * **Targeting `kici:` labels:** `runsOn` may target any agent label, including the
+ * `kici:`-namespaced auto-labels (`kici:os:`, `kici:arch:`, `kici:host:`, `kici:agent:`,
+ * `kici:scaler:`, `kici:role:`). Targeting is a requirement on candidate agents, never a
+ * grant. `kici:scaler:` / `kici:agent:` are deployment-specific, so prefer custom labels
+ * for portable pool targeting. Users still cannot *set* `kici:` labels on agents.
  */
 export type RunsOn = string | string[] | RunsOnSelector;
 /** Job definition returned by job() factory */
@@ -298,10 +335,12 @@ export interface Job {
     readonly resources?: ResourceRequest;
     /**
      * Per-job initialization. Runs after clone, before steps.
-     * - A `GenericInitConfig` (or array, run in order) provisions a toolchain.
-     * - `false` is an explicit opt-out (reserved for the future auto-detect layer).
+     * - A `GenericInitConfig` or typed preset (`'mise'` / `{ mise }`), single or
+     *   in an ordered array, provisions a toolchain.
+     * - `'auto'` detects the toolchain from committed files (mise.toml / .tool-versions).
+     * - `false` is an explicit opt-out (an unset `init` is also "no init").
      */
-    readonly init?: GenericInitConfig | GenericInitConfig[] | false;
+    readonly init?: InitConfig;
     /** Declarative cache: restored before steps, saved after the job on key miss. */
     readonly cache?: import('./cache-types.js').CacheInput;
     /** Pause for a manual human approval before this job dispatches. */
@@ -401,10 +440,12 @@ export interface JobOptions {
     resources?: ResourceRequest;
     /**
      * Per-job initialization. Runs after clone, before steps.
-     * - A `GenericInitConfig` (or array, run in order) provisions a toolchain.
-     * - `false` is an explicit opt-out (reserved for the future auto-detect layer).
+     * - A `GenericInitConfig` or typed preset (`'mise'` / `{ mise }`), single or
+     *   in an ordered array, provisions a toolchain.
+     * - `'auto'` detects the toolchain from committed files (mise.toml / .tool-versions).
+     * - `false` is an explicit opt-out (an unset `init` is also "no init").
      */
-    init?: GenericInitConfig | GenericInitConfig[] | false;
+    init?: InitConfig;
     /** Declarative cache: restored before steps, saved after the job on key miss. */
     cache?: import('./cache-types.js').CacheInput;
     /** Pause for a manual human approval before this job dispatches. */

package/dist/types.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/types.ts
 /**
 * Type guard to check if a JobOrFactory is a dynamic job generator.

package/dist/validation/dag.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/validation/dag.ts
 /**
 * Validate a DAG for common issues: self-references, missing dependencies, and cycles.

package/dist/validation/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { validateDag } from "./dag.js";
 export { validateDag };

package/dist/wait-for.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { step } from "./step.js";
 //#region src/wait-for.ts
 /**

package/dist/workflow.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/workflow.ts
 /**
 * Normalize triggers to array.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/sdk",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
   "keywords": [
     "ci",
@@ -46,12 +46,11 @@
     }
   },
   "dependencies": {
-    "fast-cartesian": "^9.0.1",
     "micromatch": "^4.0.8",
     "zod": "^4.3.6",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.16",
-    "@kici-dev/engine": "0.1.16"
+    "@kici-dev/core": "0.1.17",
+    "@kici-dev/engine": "0.1.17"
   },
   "devDependencies": {
     "@types/micromatch": "^4.0.10"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/sdk@0.1.16",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fsdk/0.1.16/49f54029-d7dc-48b9-ad51-af6b845b321f",
+  "name": "@kici-dev/sdk@0.1.17",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fsdk/0.1.17/3fe04364-30c3-435e-8804-37ebcd2fee4b",
   "creationInfo": {
-    "created": "2026-06-12T09:41:41Z",
+    "created": "2026-06-14T12:30:22Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -146,9 +146,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.17",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.16",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -159,16 +159,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.16"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.17"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.16",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.16",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -179,7 +179,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.16"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.17"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -188,7 +188,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.16",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -199,7 +199,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.16"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.17"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
@@ -936,6 +936,26 @@
       ],
       "description": "Check if something is a Node.js stream"
     },
+    {
+      "SPDXID": "SPDXRef-Package-jose-6.2.3",
+      "name": "jose",
+      "versionInfo": "6.2.3",
+      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/jose@6.2.3"
+        }
+      ],
+      "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
+      "homepage": "https://github.com/panva/jose"
+    },
     {
       "SPDXID": "SPDXRef-Package-jsep-1.4.0",
       "name": "jsep",
@@ -1544,63 +1564,68 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
-      "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-fast-cartesian-9.0.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
-      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
-      "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.16",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.16",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-fast-cartesian-9.0.1",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "relationshipType": "DEPENDS_ON"
     },
     {