@kici-dev/agent 0.1.19 → 0.1.21

package/dist/config.d.ts

@@ -10,6 +10,7 @@ declare const configSchema: z.ZodObject<{
     orchestratorUrl: z.ZodString;
     agentId: z.ZodOptional<z.ZodString>;
     labels: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<string[], string>>;
+    properties: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<Record<string, string | number | boolean>, string>>;
     roles: z.ZodPipe<z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string[] | undefined, string | undefined>>, z.ZodTransform<string[] | undefined, string[] | undefined>>;
     port: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     logLevel: z.ZodDefault<z.ZodEnum<{
@@ -59,6 +60,7 @@ export type AppConfig = z.infer<typeof configSchema> & {
 export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     orchestratorUrl: string;
     labels: string[];
+    properties: Record<string, string | number | boolean>;
     roles: string[] | undefined;
     port: number;
     logLevel: "error" | "debug" | "info" | "warn";
@@ -86,6 +88,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
  * - KICI_ORCHESTRATOR_URL (required)
  * - KICI_AGENT_ID (optional, auto-generated from hostname-uuid8)
  * - KICI_LABELS (comma-separated, e.g. "linux,docker"). Labels with 'kici-' prefix are reserved.
+ * - KICI_PROPERTIES (comma-separated key=value host-vars, e.g. "region=eu,cores=8,gpu=true"). Typed (bool/number/string), reported into the host roster.
  * - KICI_ROLES (comma-separated agent roles, e.g. "builder,init-runner". undefined=all, empty=execution-only)
  * - KICI_PORT (default: 8080)
  * - KICI_LOG_LEVEL (default: info)
@@ -120,6 +123,7 @@ export declare function agentClientConnectionOptions(config: AppConfig): {
     url: string;
     agentId: string;
     labels: string[];
+    properties: Record<string, string | number | boolean>;
     scalerManaged: boolean;
     token: string | undefined;
 };

package/dist/execution/sandbox/ipc-protocol.d.ts

@@ -1,3 +1,4 @@
+import type { CheckMode, CheckStepOutcome } from '@kici-dev/engine';
 import type { SandboxStepResult } from './types.js';
 /**
  * Structured clone auth. Wire-compatible with `gitAuthSchema` on the
@@ -24,11 +25,11 @@ interface StepStartMessage {
     /** Distinguishes regular steps from hook executions (e.g., 'hook:onCancel', 'hook:cleanup'). Defaults to 'step'. */
     step_type?: string;
 }
-/** A step has completed (success or failure). */
+/** A step has completed (success, failure, or a check-mode skip). */
 interface StepCompleteMessage {
     type: 'step.complete';
     stepIndex: number;
-    status: 'success' | 'failed';
+    status: 'success' | 'failed' | 'skipped';
     durationMs: number;
     error?: {
         message: string;
@@ -47,6 +48,16 @@ interface StepCompleteMessage {
      * pseudo-steps carry `{ cacheOutcome, key, matchedKey?, bytes? }` here.
      */
     data?: Record<string, unknown>;
+    /**
+     * Idempotent per-step outcome (`CheckStepOutcome`). Present only when the run
+     * carried a check mode and the step has a `check` facet (or was a plain step
+     * skipped under check mode). Orthogonal to `status`.
+     */
+    checkOutcome?: CheckStepOutcome;
+    /** Human-readable drift summary (`summarize(drift)`). Present when drift was detected. */
+    driftSummary?: string;
+    /** Structured drift value returned by `check()`. Present when drift was detected. */
+    drift?: unknown;
 }
 /** A single log line from step execution. */
 interface LogLineMessage {
@@ -426,6 +437,13 @@ export interface JobExecutionRequest {
     checkout?: boolean;
     /** Whether this job is part of a test run triggered by `kici test`. */
     isTestRun?: boolean;
+    /**
+     * Run mode for idempotent steps (`apply` | `check` | `check-fail-on-drift`).
+     * Threaded from the dispatch event. In check / check-fail-on-drift mode the
+     * runner previews drift and never invokes a checked step's apply (`run`).
+     * Defaults to `apply` when unset.
+     */
+    checkMode?: CheckMode;
     /** When true, skip git clone -- use overlay tarball as complete workspace. */
     fullRepo?: boolean;
     /** URL to download the encrypted overlay tarball (test runs with uncommitted changes). */

package/dist/execution/sandbox/step-loop.d.ts

@@ -6,6 +6,7 @@
  * module loading, and calls this loop for step execution with hooks.
  */
 import type { Step, StepContext, HookInput, OutputsMap, StepSecretMountRecord } from '@kici-dev/sdk';
+import { CheckMode } from '@kici-dev/engine';
 import type { RunnerToAgentMessage } from './ipc-protocol.js';
 import type { SandboxStepResult } from './types.js';
 import { type CachePhaseDeps } from '../cache/index.js';
@@ -21,6 +22,11 @@ export interface JobHooks {
 /** Options for the step execution loop. */
 export interface StepLoopOptions {
     steps: Step[];
+    /**
+     * Run mode for idempotent steps. `apply` (default) converges; `check` /
+     * `check-fail-on-drift` preview drift and never invoke a checked step's apply.
+     */
+    checkMode?: CheckMode;
     /** Factory that creates a StepContext for a given step index and name. */
     createStepContext: (stepIndex: number, stepName: string) => StepContext;
     sendIpc: (msg: RunnerToAgentMessage) => void;

package/dist/index.js

@@ -3,7 +3,7 @@ import { homedir, hostname, tmpdir } from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
-import { KNOWN_ROLES, validateNoReservedLabels } from "@kici-dev/engine";
+import { KNOWN_ROLES, parseHostPropertyAssignments, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile } from "node:child_process";
 import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -50,6 +50,7 @@ const envDef = defineEnv({
 		orchestratorUrl: z.string().url().min(1, "KICI_ORCHESTRATOR_URL is required"),
 		agentId: z.string().optional(),
 		labels: z.string().default("").transform((s) => s.split(",").filter(Boolean)),
+		properties: z.string().default("").transform((s) => parseHostPropertyAssignments(s.split(",").filter(Boolean))),
 		roles: z.string().optional().transform((s) => {
 			if (s === void 0) return void 0;
 			if (s === "") return [];
@@ -91,6 +92,7 @@ const envDef = defineEnv({
 		orchestratorUrl: "KICI_ORCHESTRATOR_URL",
 		agentId: "KICI_AGENT_ID",
 		labels: "KICI_LABELS",
+		properties: "KICI_PROPERTIES",
 		roles: "KICI_ROLES",
 		port: "KICI_PORT",
 		logLevel: "KICI_LOG_LEVEL",
@@ -118,6 +120,7 @@ const envDef = defineEnv({
 * - KICI_ORCHESTRATOR_URL (required)
 * - KICI_AGENT_ID (optional, auto-generated from hostname-uuid8)
 * - KICI_LABELS (comma-separated, e.g. "linux,docker"). Labels with 'kici-' prefix are reserved.
+* - KICI_PROPERTIES (comma-separated key=value host-vars, e.g. "region=eu,cores=8,gpu=true"). Typed (bool/number/string), reported into the host roster.
 * - KICI_ROLES (comma-separated agent roles, e.g. "builder,init-runner". undefined=all, empty=execution-only)
 * - KICI_PORT (default: 8080)
 * - KICI_LOG_LEVEL (default: info)

package/dist/server.js

@@ -12,7 +12,7 @@ import winston from "winston";
 import { RingBuffer, addLogsToArchive, chunkBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, logger, normalizeLineEndings, redactConfig, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
-import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, deriveOsArchLabels, expandMatrix, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, resolveRoleLabels, validateNoReservedLabels } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, PROTOCOL_VERSION, SANDBOX_DEFAULT_VARS, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, deriveOsArchLabels, expandMatrix, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
 import WebSocket from "ws";
 import * as fs$2 from "node:fs";
@@ -66,6 +66,7 @@ const envDef = defineEnv({
 		orchestratorUrl: z.string().url().min(1, "KICI_ORCHESTRATOR_URL is required"),
 		agentId: z.string().optional(),
 		labels: z.string().default("").transform((s) => s.split(",").filter(Boolean)),
+		properties: z.string().default("").transform((s) => parseHostPropertyAssignments(s.split(",").filter(Boolean))),
 		roles: z.string().optional().transform((s) => {
 			if (s === void 0) return void 0;
 			if (s === "") return [];
@@ -107,6 +108,7 @@ const envDef = defineEnv({
 		orchestratorUrl: "KICI_ORCHESTRATOR_URL",
 		agentId: "KICI_AGENT_ID",
 		labels: "KICI_LABELS",
+		properties: "KICI_PROPERTIES",
 		roles: "KICI_ROLES",
 		port: "KICI_PORT",
 		logLevel: "KICI_LOG_LEVEL",
@@ -134,6 +136,7 @@ const envDef = defineEnv({
 * - KICI_ORCHESTRATOR_URL (required)
 * - KICI_AGENT_ID (optional, auto-generated from hostname-uuid8)
 * - KICI_LABELS (comma-separated, e.g. "linux,docker"). Labels with 'kici-' prefix are reserved.
+* - KICI_PROPERTIES (comma-separated key=value host-vars, e.g. "region=eu,cores=8,gpu=true"). Typed (bool/number/string), reported into the host roster.
 * - KICI_ROLES (comma-separated agent roles, e.g. "builder,init-runner". undefined=all, empty=execution-only)
 * - KICI_PORT (default: 8080)
 * - KICI_LOG_LEVEL (default: info)
@@ -177,6 +180,7 @@ function agentClientConnectionOptions(config) {
 		url: config.orchestratorUrl,
 		agentId: config.agentId,
 		labels: config.labels,
+		properties: config.properties,
 		scalerManaged: config.scalerManaged,
 		token: config.agentToken
 	};
@@ -329,6 +333,7 @@ var OrchestratorClient = class OrchestratorClient {
 	url;
 	agentId;
 	labels;
+	properties;
 	onJobDispatch;
 	onJobCancel;
 	token;
@@ -356,6 +361,7 @@ var OrchestratorClient = class OrchestratorClient {
 		this.url = options.url;
 		this.agentId = options.agentId;
 		this.labels = options.labels;
+		this.properties = options.properties ?? {};
 		this.onJobDispatch = options.onJobDispatch;
 		this.onJobCancel = options.onJobCancel;
 		this.token = options.token;
@@ -1205,6 +1211,7 @@ var OrchestratorClient = class OrchestratorClient {
 			})()
 		};
 		if (inFlightJobs.length > 0) msg.inFlightJobs = inFlightJobs;
+		if (Object.keys(this.properties).length > 0) msg.properties = this.properties;
 		this.ws.send(JSON.stringify(msg));
 	}
 	scheduleReconnect() {
@@ -1300,14 +1307,14 @@ var init_console_capture = __esmMin((() => {
 init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.1.19";
-		case "buildCommit": return "1590f5e99";
-		case "sdkVersion": return "0.1.19";
+		case "version": return "0.1.21";
+		case "buildCommit": return "8aeccc2c4";
+		case "sdkVersion": return "0.1.21";
 		case "sdkBundleHash": return "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
-		case "sharedVersion": return "0.1.19";
-		case "sharedBundleHash": return "5f2c220f24d166b0f13d0620a2e80d19689ac8b683a12154daef44e938fd46a7";
-		case "engineVersion": return "0.1.19";
-		case "engineBundleHash": return "79ce14640d1798eaaa7cb3aa6c4bc325da3bff1e9f4716936e19614eabb1d858";
+		case "sharedVersion": return "0.1.21";
+		case "sharedBundleHash": return "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
+		case "engineVersion": return "0.1.21";
+		case "engineBundleHash": return "1b1f49acbbb66f045cfa8284406fce48de8975d9ec3a5685aff70313cd8232cc";
 		default: return fallback;
 	}
 }
@@ -1993,7 +2000,7 @@ async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event
 }
 var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
 var init_workflow_loader = __esmMin((() => {
-	AGENT_SDK_VERSION = "0.1.19";
+	AGENT_SDK_VERSION = "0.1.21";
 	AGENT_SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
 	hookRegistered = false;
 }));
@@ -4188,6 +4195,7 @@ function buildRequest(dispatch, workDir) {
 		checkout: jobConfig.checkout ?? true,
 		isTestRun: jobConfig.isTestRun ?? false,
 		fullRepo: jobConfig.fullRepo ?? false,
+		checkMode: jobConfig.checkMode,
 		tarballUrl: jobConfig.tarballUrl,
 		cliPublicKey: jobConfig.cliPublicKey,
 		orchestratorPrivateKey: jobConfig.orchestratorPrivateKey,
@@ -4525,6 +4533,9 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 				...msg.error && { error: msg.error },
 				...msg.secretsAccessed && { secretsAccessed: msg.secretsAccessed },
 				...msg.step_type && { step_type: msg.step_type },
+				...msg.checkOutcome !== void 0 && { checkOutcome: msg.checkOutcome },
+				...msg.driftSummary !== void 0 && { driftSummary: msg.driftSummary },
+				...msg.drift !== void 0 && { drift: msg.drift },
 				...msg.data && msg.data
 			});
 			return;
@@ -5249,6 +5260,9 @@ var init_container_sandbox = __esmMin((() => {
 						...msg.error && { error: msg.error },
 						...msg.secretsAccessed && { secretsAccessed: msg.secretsAccessed },
 						...msg.step_type && { step_type: msg.step_type },
+						...msg.checkOutcome !== void 0 && { checkOutcome: msg.checkOutcome },
+						...msg.driftSummary !== void 0 && { driftSummary: msg.driftSummary },
+						...msg.drift !== void 0 && { drift: msg.drift },
 						...msg.data && msg.data
 					});
 					stepResults.push({
@@ -5764,12 +5778,17 @@ var init_job_runner = __esmMin((() => {
 				stepsTotal.add(1, { status: stepResult.status });
 				if (stepResult.durationMs > 0) stepDurationSeconds.record(stepResult.durationMs / 1e3);
 			}
-			if (result.status === ExecutionJobStatus.enum.failed) logger$2.error("Sandbox returned failed result", {
-				durationMs: result.durationMs,
-				stepCount: result.stepResults.length,
-				steps: result.stepResults.map((r) => `${r.name}:${r.status}`).join(","),
-				logStreamerKeys: [...logStreamers.keys()].join(",")
-			});
+			if (result.status === ExecutionJobStatus.enum.failed) {
+				const stepErrors = result.stepResults.filter((r) => r.error).map((r) => `${r.name}: ${r.error.message}`).join(" | ");
+				logger$2.error("Sandbox returned failed result", {
+					durationMs: result.durationMs,
+					stepCount: result.stepResults.length,
+					steps: result.stepResults.map((r) => `${r.name}:${r.status}`).join(","),
+					logStreamerKeys: [...logStreamers.keys()].join(","),
+					...result.error && { error: result.error },
+					...stepErrors && { stepErrors }
+				});
+			}
 			this.sendJobStatus(dispatch, result.status, {
 				durationMs: result.durationMs,
 				...result.error && { error: result.error },
@@ -6406,14 +6425,14 @@ var init_job_runner = __esmMin((() => {
 */
 init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.1.19";
-const BUILD_COMMIT = "1590f5e99";
-const SDK_VERSION = "0.1.19";
+const AGENT_VERSION = "0.1.21";
+const BUILD_COMMIT = "8aeccc2c4";
+const SDK_VERSION = "0.1.21";
 const SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
-const SHARED_VERSION = "0.1.19";
-const SHARED_BUNDLE_HASH = "5f2c220f24d166b0f13d0620a2e80d19689ac8b683a12154daef44e938fd46a7";
-const ENGINE_VERSION = "0.1.19";
-const ENGINE_BUNDLE_HASH = "79ce14640d1798eaaa7cb3aa6c4bc325da3bff1e9f4716936e19614eabb1d858";
+const SHARED_VERSION = "0.1.21";
+const SHARED_BUNDLE_HASH = "991385c024392c395d3eb8a68946ef8ed3fcba96f2652f21c3164a54eafa1b1b";
+const ENGINE_VERSION = "0.1.21";
+const ENGINE_BUNDLE_HASH = "1b1f49acbbb66f045cfa8284406fce48de8975d9ec3a5685aff70313cd8232cc";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT

package/dist/workflow-runner.js

@@ -7,7 +7,7 @@ import os, { homedir, tmpdir } from "node:os";
 import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { $ } from "zx";
 import { createLogger, deriveSharedSecret, initZx, normalizeLineEndings, sha256, sha256File, toErrorMessage } from "@kici-dev/shared";
-import { CacheOutcome, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, TimeoutReason } from "@kici-dev/engine";
+import { CacheOutcome, CacheStepType, CheckMode, CheckStepOutcome, ExecutionJobStatus, ExecutionStepStatus, TimeoutReason } from "@kici-dev/engine";
 import { buildKiciApi, createStepSecrets, evaluateRules, isDynamicJobFn, normalizeCacheSpecs, normalizeRequireApproval, provenanceSubjectIsPath, resolveJobOutputs, resolveStepOutputs, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
 import { OIDC_TOKEN_REQUEST_METHOD } from "@kici-dev/engine/protocol/messages/oidc-token-relay";
 import { sha256File as sha256File$1 } from "@kici-dev/core";
@@ -22,6 +22,7 @@ import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { c, x } from "tar";
+import { runIdempotentStep } from "@kici-dev/core/idempotency";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { PNPM_IGNORE_BUILD_GATE_ARG, PackageManager, YarnFlavor, detectPackageManagerFromManifests, detectYarnFlavor } from "@kici-dev/shared/package-manager";
@@ -1117,11 +1118,59 @@ function createRuleContext(event, changedFiles = [], env = {}) {
 //#endregion
 //#region src/execution/sandbox/step-loop.ts
 /**
+* Run one step honoring the run-level {@link CheckMode}, reusing the
+* `runIdempotentStep` primitive for checked steps (never hand-rolled branching).
+*
+* - Plain step (no `check`): in apply mode, runs as today; in any check mode it
+*   is skipped with `no_check` (a side-effecting step can't be safely previewed).
+* - Checked step: adapted into an `IdempotentStep` and driven by the primitive
+*   with `dryRun` set in check mode (so `apply`/`run` never fires) and `yes: true`
+*   (v0 has no mid-run confirm). On drift the summary is emitted as a log line.
+*/
+async function runStepWithCheckMode(step, stepIndex, ctx, checkMode, sendFn) {
+	if (!step.check) {
+		if (checkMode !== CheckMode.enum.apply) return {
+			checkOutcome: CheckStepOutcome.enum.no_check,
+			status: "skipped",
+			outputs: void 0
+		};
+		return {
+			status: "success",
+			outputs: await step.run(ctx)
+		};
+	}
+	const res = await runIdempotentStep({
+		name: step.name,
+		check: () => step.check(ctx),
+		summarize: step.summarize,
+		apply: (drift) => step.run(ctx, drift),
+		whenInSync: step.whenInSync ? () => step.whenInSync(ctx) : void 0
+	}, {
+		dryRun: checkMode !== CheckMode.enum.apply,
+		yes: true,
+		log: (line) => sendFn({
+			type: "log.line",
+			stepIndex,
+			line
+		})
+	});
+	const driftSummary = res.drift != null ? step.summarize(res.drift) : void 0;
+	const status = res.outcome === CheckStepOutcome.enum.applied ? "success" : "skipped";
+	const mappedStatus = res.outcome === CheckStepOutcome.enum["dry-run"] ? "success" : status;
+	return {
+		checkOutcome: res.outcome,
+		status: mappedStatus,
+		outputs: res.result,
+		...driftSummary !== void 0 && { driftSummary },
+		...res.drift != null && { drift: res.drift }
+	};
+}
+/**
 * Execute a single step with timeout enforcement.
 *
 * Timeout pattern using Promise.race + AbortController, with IPC status reporting.
 */
-async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, outputsMap, getSecretsAccessLog, getSecretMountRecords, jobDeadlineSignal) {
+async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, outputsMap, getSecretsAccessLog, getSecretMountRecords, jobDeadlineSignal, checkMode = CheckMode.enum.apply) {
 	sendFn({
 		type: "step.start",
 		stepIndex,
@@ -1131,8 +1180,8 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 	const abortController = new AbortController();
 	const timeoutId = setTimeout(() => abortController.abort(), timeoutMs);
 	try {
-		const result = await Promise.race([
-			step.run(ctx),
+		const phase = await Promise.race([
+			runStepWithCheckMode(step, stepIndex, ctx, checkMode, sendFn),
 			new Promise((_, reject) => {
 				abortController.signal.addEventListener("abort", () => {
 					reject(/* @__PURE__ */ new Error(`Step '${step.name}' timed out after ${timeoutMs}ms`));
@@ -1151,22 +1200,26 @@ async function executeStepInLoop(step, stepIndex, ctx, timeoutMs, sendFn, output
 		]);
 		clearTimeout(timeoutId);
 		const durationMs = Date.now() - startTime;
-		const outputsPayload = result != null ? result : void 0;
+		const outputsPayload = phase.outputs != null ? phase.outputs : void 0;
 		if (outputsPayload) outputsMap.set(step.name, outputsPayload);
 		const secretsAccessed = getSecretsAccessLog?.();
 		emitSecretMountEvents(getSecretMountRecords?.(), stepIndex, sendFn);
+		const stepStatus = phase.status === "skipped" ? ExecutionStepStatus.enum.skipped : ExecutionStepStatus.enum.success;
 		sendFn({
 			type: "step.complete",
 			stepIndex,
-			status: ExecutionStepStatus.enum.success,
+			status: stepStatus,
 			durationMs,
 			...outputsPayload && { outputs: outputsPayload },
-			...secretsAccessed !== void 0 && { secretsAccessed }
+			...secretsAccessed !== void 0 && { secretsAccessed },
+			...phase.checkOutcome !== void 0 && { checkOutcome: phase.checkOutcome },
+			...phase.driftSummary !== void 0 && { driftSummary: phase.driftSummary },
+			...phase.drift !== void 0 && { drift: phase.drift }
 		});
 		return {
 			name: step.name,
 			stepIndex,
-			status: ExecutionStepStatus.enum.success,
+			status: stepStatus,
 			durationMs,
 			...outputsPayload && { outputs: outputsPayload }
 		};
@@ -1381,7 +1434,7 @@ async function runStepIteration(step, stepIndex, opts) {
 		const timeoutMs = step.timeout ?? opts.defaultTimeoutMs;
 		let result;
 		try {
-			result = await executeStepInLoop(step, stepIndex, ctx, timeoutMs, opts.sendIpc, opts.outputsMap, opts.getSecretsAccessLog, opts.getSecretMountRecords, opts.jobDeadlineSignal);
+			result = await executeStepInLoop(step, stepIndex, ctx, timeoutMs, opts.sendIpc, opts.outputsMap, opts.getSecretsAccessLog, opts.getSecretMountRecords, opts.jobDeadlineSignal, opts.checkMode ?? CheckMode.enum.apply);
 		} finally {
 			await opts.afterStepApplyEnvFiles?.();
 		}
@@ -3023,7 +3076,7 @@ function logSubprocessStreams(e, tokens) {
 * no Rolldown step at runtime. `@kici-dev/sdk` and host-repo deps resolve via
 * Node's normal ESM lookup against `.kici/node_modules/`.
 */
-const AGENT_SDK_VERSION = "0.1.19";
+const AGENT_SDK_VERSION = "0.1.21";
 const AGENT_SDK_BUNDLE_HASH = "8308089347c304e41b457d3867b17bbff11d6b5cd9706b6823e7abdbd849f33f";
 /**
 * Register the `@kici-dev/core/ts-loader-hook` oxc-transform ESM loader hook so
@@ -3386,7 +3439,7 @@ async function applyOverlay(config) {
 */
 init_download();
 init_dep_restore();
-const AGENT_VERSION = "0.1.19";
+const AGENT_VERSION = "0.1.21";
 process.on("uncaughtException", (err) => {
 	process.stderr.write(`[workflow-runner] UNCAUGHT EXCEPTION: ${err.message}\n`);
 	if (err.stack) process.stderr.write(`[workflow-runner] Stack: ${err.stack}\n`);
@@ -5099,6 +5152,7 @@ async function main() {
 	const jobStartTime = Date.now();
 	const loopResult = await executeStepLoop({
 		steps: normalizedSteps,
+		checkMode: request.checkMode,
 		createStepContext: createStepCtxWithCapture,
 		sendIpc: maskedSend,
 		defaultTimeoutMs,

package/dist/ws/orchestrator-client.d.ts

@@ -8,6 +8,12 @@ export interface OrchestratorClientOptions {
     agentId: string;
     /** Agent's label set for job routing. */
     labels: string[];
+    /**
+     * Agent-reported typed host-vars (the `KICI_PROPERTIES` bag). Reported at
+     * registration and shallow-merged into the orchestrator's host roster.
+     * Omitted / empty ⇒ no properties reported.
+     */
+    properties?: Record<string, string | number | boolean>;
     /** Callback invoked when a job.dispatch message is received. */
     onJobDispatch: (dispatch: JobDispatch) => void;
     /** Callback invoked when a job.cancel message is received. */
@@ -94,6 +100,7 @@ export declare class OrchestratorClient {
     private readonly url;
     private readonly agentId;
     private readonly labels;
+    private readonly properties;
     private readonly onJobDispatch;
     private readonly onJobCancel;
     private readonly token?;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/agent",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Customer-deployable agent for the KiCI CI/CD stack. Connects to an orchestrator, clones the workflow repo, executes steps, and streams logs back.",
   "keywords": [
     "ci",
@@ -64,10 +64,10 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/engine": "0.1.19",
-    "@kici-dev/sdk": "0.1.19",
-    "@kici-dev/core": "0.1.19",
-    "@kici-dev/shared": "0.1.19"
+    "@kici-dev/core": "0.1.21",
+    "@kici-dev/engine": "0.1.21",
+    "@kici-dev/sdk": "0.1.21",
+    "@kici-dev/shared": "0.1.21"
   },
   "kici": {
     "metrics": {

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/agent@0.1.19",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fagent/0.1.19/69353e40-6ba4-4597-af86-49d578ecda83",
+  "name": "@kici-dev/agent@0.1.21",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fagent/0.1.21/6530efba-4ce4-4daf-a61c-0e742670115a",
   "creationInfo": {
-    "created": "2026-06-19T05:11:29Z",
+    "created": "2026-06-23T05:10:35Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -816,7 +816,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/agent",
-      "versionInfo": "0.1.19",
+      "versionInfo": "0.1.21",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -827,16 +827,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/agent@0.1.19"
+          "referenceLocator": "pkg:npm/%40kici-dev/agent@0.1.21"
         }
       ],
       "description": "Customer-deployable agent for the KiCI CI/CD stack. Connects to an orchestrator, clones the workflow repo, executes steps, and streams logs back.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.21",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.19",
+      "versionInfo": "0.1.21",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -847,16 +847,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.19"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.21"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.19",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.21",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.19",
+      "versionInfo": "0.1.21",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -867,16 +867,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.19"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.21"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.19",
+      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.21",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.19",
+      "versionInfo": "0.1.21",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -887,16 +887,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.19"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.21"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.19",
+      "versionInfo": "0.1.21",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -907,7 +907,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.19"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.21"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -2127,26 +2127,6 @@
         }
       ]
     },
-    {
-      "SPDXID": "SPDXRef-Package--types-node-24.12.0",
-      "name": "@types/node",
-      "versionInfo": "24.12.0",
-      "downloadLocation": "https://registry.npmjs.org/@types/node/-/node-24.12.0.tgz",
-      "filesAnalyzed": false,
-      "licenseConcluded": "NOASSERTION",
-      "licenseDeclared": "MIT",
-      "copyrightText": "NOASSERTION",
-      "supplier": "NOASSERTION",
-      "externalRefs": [
-        {
-          "referenceCategory": "PACKAGE-MANAGER",
-          "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40types/node@24.12.0"
-        }
-      ],
-      "description": "TypeScript definitions for node",
-      "homepage": "https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node"
-    },
     {
       "SPDXID": "SPDXRef-Package--types-triple-beam-1.3.5",
       "name": "@types/triple-beam",
@@ -4337,10 +4317,10 @@
       "description": "process information for node.js and browsers"
     },
     {
-      "SPDXID": "SPDXRef-Package-protobufjs-8.0.3",
+      "SPDXID": "SPDXRef-Package-protobufjs-8.6.3",
       "name": "protobufjs",
-      "versionInfo": "8.0.3",
-      "downloadLocation": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.0.3.tgz",
+      "versionInfo": "8.6.3",
+      "downloadLocation": "https://registry.npmjs.org/protobufjs/-/protobufjs-8.6.3.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "BSD-3-Clause",
@@ -4350,11 +4330,10 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/protobufjs@8.0.3"
+          "referenceLocator": "pkg:npm/protobufjs@8.6.3"
         }
       ],
-      "description": "Protocol Buffers for JavaScript (& TypeScript).",
-      "homepage": "https://protobufjs.github.io/protobuf.js/"
+      "description": "Protocol Buffers for JavaScript & TypeScript."
     },
     {
       "SPDXID": "SPDXRef-Package-pump-3.0.4",
@@ -5026,26 +5005,6 @@
       "description": "Port of TweetNaCl cryptographic library to JavaScript",
       "homepage": "https://tweetnacl.js.org"
     },
-    {
-      "SPDXID": "SPDXRef-Package-undici-types-7.16.0",
-      "name": "undici-types",
-      "versionInfo": "7.16.0",
-      "downloadLocation": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "filesAnalyzed": false,
-      "licenseConcluded": "NOASSERTION",
-      "licenseDeclared": "MIT",
-      "copyrightText": "NOASSERTION",
-      "supplier": "NOASSERTION",
-      "externalRefs": [
-        {
-          "referenceCategory": "PACKAGE-MANAGER",
-          "referenceType": "purl",
-          "referenceLocator": "pkg:npm/undici-types@7.16.0"
-        }
-      ],
-      "description": "A stand-alone types package for Undici",
-      "homepage": "https://undici.nodejs.org"
-    },
     {
       "SPDXID": "SPDXRef-Package-util-deprecate-1.0.2",
       "name": "util-deprecate",
@@ -6195,7 +6154,7 @@
     },
     {
       "spdxElementId": "SPDXRef-Package--grpc-proto-loader-0.7.15",
-      "relatedSpdxElement": "SPDXRef-Package-protobufjs-8.0.3",
+      "relatedSpdxElement": "SPDXRef-Package-protobufjs-8.6.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -6215,7 +6174,7 @@
     },
     {
       "spdxElementId": "SPDXRef-Package--grpc-proto-loader-0.8.0",
-      "relatedSpdxElement": "SPDXRef-Package-protobufjs-8.0.3",
+      "relatedSpdxElement": "SPDXRef-Package-protobufjs-8.6.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -6250,22 +6209,22 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.19",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.21",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.19",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.21",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -6319,192 +6278,192 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.19",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.19",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.21",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-micromatch-4.0.8",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1064.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.21",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.31.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.41.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-archiver-8.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-diff-9.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.25",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.2",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.21.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.19",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.21",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
@@ -7418,11 +7377,6 @@
       "relatedSpdxElement": "SPDXRef-Package-tslib-2.8.1",
       "relationshipType": "DEPENDS_ON"
     },
-    {
-      "spdxElementId": "SPDXRef-Package--types-node-24.12.0",
-      "relatedSpdxElement": "SPDXRef-Package-undici-types-7.16.0",
-      "relationshipType": "DEPENDS_ON"
-    },
     {
       "spdxElementId": "SPDXRef-Package-abort-controller-3.0.0",
       "relatedSpdxElement": "SPDXRef-Package-event-target-shim-5.0.1",
@@ -7720,7 +7674,7 @@
     },
     {
       "spdxElementId": "SPDXRef-Package-dockerode-5.0.0",
-      "relatedSpdxElement": "SPDXRef-Package-protobufjs-8.0.3",
+      "relatedSpdxElement": "SPDXRef-Package-protobufjs-8.6.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8049,12 +8003,7 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package-protobufjs-8.0.3",
-      "relatedSpdxElement": "SPDXRef-Package--types-node-24.12.0",
-      "relationshipType": "DEPENDS_ON"
-    },
-    {
-      "spdxElementId": "SPDXRef-Package-protobufjs-8.0.3",
+      "spdxElementId": "SPDXRef-Package-protobufjs-8.6.3",
       "relatedSpdxElement": "SPDXRef-Package-long-5.3.2",
       "relationshipType": "DEPENDS_ON"
     },