@kici-dev/compiler 0.1.10 → 0.1.12

package/dist/cli-banner.d.ts

@@ -0,0 +1,11 @@
+import type { Command } from 'commander';
+/**
+ * Whether the version banner should be suppressed for the command about to run.
+ *
+ * Structured-output (`--json`) and quiet (`--quiet`) invocations must keep stdout
+ * free of human-facing chrome so callers can parse stdout directly. Uses
+ * `optsWithGlobals()` so the check stays correct if either flag is ever promoted
+ * to a global option.
+ */
+export declare function shouldSuppressBanner(actionCommand: Command): boolean;
+//# sourceMappingURL=cli-banner.d.ts.map

package/dist/cli-banner.js

@@ -0,0 +1,18 @@
+import "./chunk-gOLHoazu.js";
+//#region src/cli-banner.ts
+/**
+* Whether the version banner should be suppressed for the command about to run.
+*
+* Structured-output (`--json`) and quiet (`--quiet`) invocations must keep stdout
+* free of human-facing chrome so callers can parse stdout directly. Uses
+* `optsWithGlobals()` so the check stays correct if either flag is ever promoted
+* to a global option.
+*/
+function shouldSuppressBanner(actionCommand) {
+	const opts = actionCommand.optsWithGlobals();
+	return Boolean(opts.json) || Boolean(opts.quiet);
+}
+//#endregion
+export { shouldSuppressBanner };
+
+//# sourceMappingURL=cli-banner.js.map

package/dist/cli.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import "./chunk-gOLHoazu.js";
+import { shouldSuppressBanner } from "./cli-banner.js";
 import { compileCommand } from "./commands/compile.js";
 import { watchCommand } from "./commands/watch.js";
 import { fixtureCommand } from "./commands/fixture.js";
@@ -22,10 +23,11 @@ import "./commands/index.js";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.10";
+const version = "0.1.12";
 const program = new Command();
 program.name("kici").description("KiCI workflow compiler").version(version);
-program.hook("preAction", () => {
+program.hook("preAction", (_thisCommand, actionCommand) => {
+	if (shouldSuppressBanner(actionCommand)) return;
 	console.log(pc.gray(`kici v${version}`));
 });
 program.configureOutput({ outputError: (str, write) => {
@@ -90,7 +92,7 @@ program.command("test").argument("[event]", "Event type to preview (e.g., push,
 	const success = await testCommand(event, options);
 	process.exit(success ? 0 : 1);
 });
-program.command("init").description("Initialize .kici/ directory with default workflows").option("--force", "Overwrite existing .kici/ directory", false).option("--skip-install", "Create files without running npm install", false).option("--mjs", "JavaScript-only mode (no TypeScript, no dependencies)", false).option("--no-agents-md", "Skip writing .kici/AGENTS.md (LLM authoring context)").option("--private-registry <url>", "Scaffold a workflow registries: entry pointing at <url>").option("--private-registry-scope <scope>", "Optional npm package scope (e.g. @my-org) for the private registry").option("--private-registry-secret <ref>", "Qualified secret reference (env:NAME) the private registry token comes from", "production:NPM_TOKEN").addOption(new Option("--use-verdaccio-local").default(false).hideHelp()).action(async (options) => {
+program.command("init").description("Initialize .kici/ directory with default workflows").option("--force", "Overwrite existing .kici/ directory", false).option("--skip-install", "Create files without installing dependencies", false).option("--package-manager <npm|pnpm|yarn>", "Force a package manager for the install step (default: auto-detect)").option("--mjs", "JavaScript-only mode (no TypeScript, no dependencies)", false).option("--no-agents-md", "Skip writing .kici/AGENTS.md (LLM authoring context)").option("--private-registry <url>", "Scaffold a workflow registries: entry pointing at <url>").option("--private-registry-scope <scope>", "Optional npm package scope (e.g. @my-org) for the private registry").option("--private-registry-secret <ref>", "Qualified secret reference (env:NAME) the private registry token comes from", "production:NPM_TOKEN").addOption(new Option("--use-verdaccio-local").default(false).hideHelp()).action(async (options) => {
 	const success = await initCommand({
 		...options,
 		noAgentsMd: options.agentsMd === false

package/dist/commands/detect-package-manager.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Package-manager detection for `kici init`.
+ *
+ * Determines which package manager (npm / pnpm / yarn) to use for the
+ * dependency install step in a freshly initialized `.kici/` project, so the
+ * generated lockfile matches the rest of the user's repository instead of
+ * always producing an npm `package-lock.json`.
+ */
+/** Supported package managers for the `kici init` dependency install step. */
+export declare enum PackageManager {
+    Npm = "npm",
+    Pnpm = "pnpm",
+    Yarn = "yarn"
+}
+/** All package-manager identifiers, for flag validation. */
+export declare const PACKAGE_MANAGERS: readonly PackageManager[];
+/**
+ * Parse a raw string into a {@link PackageManager}, or `null` when it does not
+ * name a supported manager. Accepts bare names (`pnpm`) used by the flag and
+ * the env-var tiers.
+ */
+export declare function parsePackageManager(value: string): PackageManager | null;
+/** Map a detected manager to its install command argv (binary + args). */
+export declare function installCommand(pm: PackageManager): [string, 'install'];
+/**
+ * Detect the package manager the user's project relies on.
+ *
+ * Priority order (first match wins):
+ *   1. `packageManager` field in `<projectDir>/package.json` (Corepack
+ *      convention, e.g. `"packageManager": "pnpm@9.x"`). Only the name before
+ *      `@` is parsed; an unrecognized name falls through.
+ *   2. A lockfile in the project root (`pnpm-lock.yaml` > `yarn.lock` >
+ *      `package-lock.json`).
+ *   3. The `npm_config_user_agent` env var (set by `pnpm dlx` / `yarn dlx` /
+ *      `npx`); the leading `<name>/` segment names the manager.
+ *   4. Default to npm when nothing matches, so we never guess wrong and emit a
+ *      lockfile the user did not ask for.
+ *
+ * @param projectDir - The project root to inspect (the cwd `kici init` runs in).
+ */
+export declare function detectPackageManager(projectDir: string): Promise<PackageManager>;
+//# sourceMappingURL=detect-package-manager.d.ts.map

package/dist/commands/init.d.ts

@@ -10,8 +10,13 @@
 export interface InitOptions {
     /** Overwrite existing .kici/ directory */
     force?: boolean;
-    /** Skip npm install step */
+    /** Skip the dependency install step */
     skipInstall?: boolean;
+    /**
+     * Force a specific package manager for the install step, bypassing detection.
+     * One of `npm` / `pnpm` / `yarn`.
+     */
+    packageManager?: string;
     /** JavaScript-only mode (no TypeScript, no dependencies) */
     mjs?: boolean;
     /** Write .npmrc pointing @kici-dev scope to local Verdaccio */

package/dist/commands/init.js

@@ -11,6 +11,7 @@ import pc from "picocolors";
 import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { initZx, logger, toErrorMessage } from "@kici-dev/shared";
+import { detectPackageManager, installCommand, parsePackageManager } from "@kici-dev/shared/package-manager";
 import { $ } from "zx";
 import { checkbox, confirm, select } from "@inquirer/prompts";
 //#region src/commands/init.ts
@@ -93,8 +94,9 @@ async function initCommand(options = {}) {
 			await mkdir(path.join(kiciDir, "types"), { recursive: true });
 			logger.info(pc.gray("Created .kici/types/ for generated type declarations"));
 			if (!options.skipInstall) {
-				logger.info(pc.gray("Running npm install..."));
-				await $`cd ${kiciDir} && npm install`;
+				const [bin, action] = installCommand(await resolvePackageManager(options.packageManager));
+				logger.info(pc.gray(`Running ${bin} ${action}...`));
+				await $`cd ${kiciDir} && ${bin} ${action}`;
 			}
 		}
 		if (options.privateRegistry) await writePrivateRegistryScaffold(kiciDir, {
@@ -112,7 +114,7 @@ async function initCommand(options = {}) {
 		logger.info(pc.gray("Next steps:"));
 		logger.info(pc.gray("  1. Edit workflows in .kici/workflows/"));
 		if (options.mjs || options.skipInstall) {
-			logger.info(pc.gray("  2. Run npm install in .kici/ to generate a lockfile"));
+			logger.info(pc.gray("  2. Run your package manager install in .kici/ to generate a lockfile"));
 			logger.info(pc.gray("  3. Test locally: kici test push"));
 			logger.info(pc.gray("  4. Commit .kici/ to your repository\n"));
 		} else {
@@ -204,6 +206,24 @@ async function detectDevelopmentMode() {
 	}
 }
 /**
+* Resolve which package manager to use for the dependency install step.
+*
+* An explicit `--package-manager <name>` flag wins and short-circuits
+* detection; an invalid value throws so the user sees a clear error. With no
+* flag, fall back to {@link detectPackageManager} over the current working
+* directory (npm / pnpm / yarn signals, defaulting to npm).
+*
+* @param override - The raw `--package-manager` flag value, if provided.
+*/
+async function resolvePackageManager(override) {
+	if (override) {
+		const parsed = parsePackageManager(override);
+		if (!parsed) throw new Error(`Invalid --package-manager value '${override}'. Expected one of: npm, pnpm, yarn.`);
+		return parsed;
+	}
+	return detectPackageManager(process.cwd());
+}
+/**
 * Generate tsconfig.json content with optional TypeScript path mappings.
 *
 * If sdkPath is configured in .kici/package.json, adds path mapping

package/dist/commands/status.d.ts

@@ -27,4 +27,8 @@ export interface StatusOptions {
  * @returns true on success, false on error
  */
 export declare function statusCommand(runId: string, options?: StatusOptions): Promise<boolean>;
+/**
+ * Display a run summary from remote status (+ local context).
+ */
+export declare function displayRunSummary(remote: import('../remote/client.js').RunStatusResponse, local?: import('../remote/history.js').HistoryEntry): void;
 //# sourceMappingURL=status.d.ts.map

package/dist/commands/status.js

@@ -15,7 +15,7 @@ import { formatDuration, logger, toErrorMessage } from "@kici-dev/shared";
 * Looks up local history first, then fetches from the orchestrator for
 * up-to-date status and logs.
 */
-const CLI_VERSION = "0.1.10";
+const CLI_VERSION = "0.1.12";
 /**
 * Show status and details of a test run.
 *
@@ -100,6 +100,7 @@ function displayRunSummary(remote, local) {
 	const statusColor = remote.status === "success" ? pc.green : remote.status === "failed" ? pc.red : remote.status === "cancelled" ? pc.yellow : pc.blue;
 	logger.info(pc.bold(`\nRun: ${remote.runId}`));
 	logger.info(`Status: ${statusColor(remote.status)}`);
+	if (remote.status === "failed" && remote.failureReason) logger.info(`Reason: ${pc.red(remote.failureReason)}`);
 	if (local?.fixtureId) logger.info(`Fixture: ${pc.cyan(local.fixtureId)}`);
 	if (local?.endpoint) logger.info(`Endpoint: ${pc.gray(local.endpoint)}`);
 	if (local?.startedAt) logger.info(`Started: ${pc.gray(local.startedAt)}`);
@@ -114,6 +115,7 @@ function displayRunSummary(remote, local) {
 				const jobColor = job.status === "success" ? pc.green : job.status === "failed" ? pc.red : job.status === "cancelled" ? pc.yellow : pc.blue;
 				const duration = job.durationMs ? formatDuration(job.durationMs) : "-";
 				logger.info(`  ${jobColor(job.status.padEnd(12))} ${job.name.padEnd(nameWidth)} ${pc.gray(duration)}`);
+				if (job.status === "failed" && job.errorMessage) logger.info(`    ${pc.red("↳")} ${pc.gray(job.errorMessage)}`);
 			}
 		}
 	}
@@ -205,6 +207,6 @@ function displayAuthInfo(config) {
 	logger.info("");
 }
 //#endregion
-export { statusCommand };
+export { displayRunSummary, statusCommand };
 
 //# sourceMappingURL=status.js.map

package/dist/llm-context/llms-full.txt

@@ -111,17 +111,20 @@ This will:
 1. Create `.kici/` directory with `workflows/`, `tests/`, `types/`, `package.json`, and `tsconfig.json`
 2. Create a `.kiciignore` file with sensible defaults
 3. Let you choose from starter workflow templates (hello-world, pr-checks)
-4. Run `npm install` to set up dependencies
+4. Install dependencies using the package manager detected for your repo (npm, pnpm, or yarn)
 5. Update `.gitignore` to exclude `.kici/node_modules/`
 6. Optionally install a pre-commit hook to auto-compile workflows
 
+The package manager is detected from your repo's `packageManager` field, lockfile, or the manager that invoked `kici`, defaulting to npm. Pass `--package-manager <npm|pnpm|yarn>` to override it.
+
 ### Options
 
-| Flag             | Description                                   |
-| ---------------- | --------------------------------------------- |
-| `--force`        | Overwrite existing `.kici/` directory         |
-| `--skip-install` | Create files without running npm install      |
-| `--mjs`          | JavaScript-only mode (no TypeScript, no deps) |
+| Flag                                  | Description                                                  |
+| ------------------------------------- | ------------------------------------------------------------ |
+| `--force`                             | Overwrite existing `.kici/` directory                        |
+| `--skip-install`                      | Create files without installing dependencies                 |
+| `--package-manager <npm\|pnpm\|yarn>` | Force a package manager for the install step (default: auto) |
+| `--mjs`                               | JavaScript-only mode (no TypeScript, no deps)                |
 
 ### MJS mode
 
@@ -146,6 +149,20 @@ pnpm add @kici-dev/sdk
 pnpm add -D @kici-dev/compiler
 ```
 
+The examples use pnpm, but npm and yarn work too. With npm:
+
+```bash
+npm install @kici-dev/sdk
+npm install -D @kici-dev/compiler
+```
+
+With yarn:
+
+```bash
+yarn add @kici-dev/sdk
+yarn add -D @kici-dev/compiler
+```
+
 ### Create the workflow directory
 
 KiCI looks for workflows in `.kici/workflows/`:
@@ -291,6 +308,17 @@ npm install lodash
 
 This updates `.kici/package.json` and generates (or updates) `package-lock.json`.
 
+### Dependency resolution contract
+
+Every `.kici/` dependency must be resolvable from the **single cloned repository**. When a job runs, the agent clones only this repository and installs `.kici/` dependencies with your repo's package manager (npm or pnpm — yarn is not yet supported and is rejected with an actionable error). A dependency that points outside the cloned repo cannot be resolved.
+
+In practice:
+
+- **From a registry** — the common case. Pin a published version (a private registry works — see [Private registries](./private-registries.md)). Available for any package manager.
+- **From an in-repo workspace sibling** — if your `.kici/` is a member of a **pnpm workspace**, it can depend on a sibling package in the same repo via `workspace:*`. The whole repo is cloned, so the sibling is present and resolves; the agent also builds your `.kici/` dependency closure after install, so a sibling's build output exists before the workflow that imports it loads. A `file:`/`link:`/`portal:` path is allowed only when it stays inside the repository.
+
+What fails fast (with an actionable error naming the dependency, not a raw package-manager error): a `workspace:` dependency in an **npm** project (npm has no workspace protocol — pin a published version or switch to pnpm), and any `file:`/`link:`/`portal:` path that points outside the cloned repo.
+
 Then use the package in your workflow:
 
 ```typescript
@@ -317,9 +345,9 @@ export default workflow('deploy', {
 
 When the KiCI agent runs your workflow, dependencies are handled automatically:
 
-1. **First run (cache miss):** A build agent installs dependencies from `.kici/package.json`, packs `node_modules` into a tarball, and uploads it to cache storage.
-2. **Subsequent runs (cache hit):** The execution agent downloads the cached tarball and extracts it -- no `npm install` needed.
-3. **Lockfile changes:** When `.kici/package-lock.json` changes, the cache is invalidated and a fresh build runs.
+1. **First run (cache miss):** A build agent installs dependencies from `.kici/package.json`, packs the resolved dependency tree into a tarball, and uploads it to cache storage. For a pnpm workspace this closure includes the shared store and any in-repo workspace siblings `.kici` resolves.
+2. **Subsequent runs (cache hit):** The execution agent downloads the cached tarball and extracts it -- no install needed.
+3. **Lockfile changes:** When your lockfile changes (`.kici/package-lock.json` for npm, or the repo-root `pnpm-lock.yaml` for a pnpm workspace), the cache is invalidated and a fresh build runs.
 
 This means the first run after a dependency change is slower (build + execution), but all subsequent runs are fast.
 
@@ -418,6 +446,7 @@ The compiler watches `.kici/workflows/*.ts` and recompiles on every save.
 
 ## Next steps
 
+- **[5-minute quickstart](quickstart.md)** -- ready to run your workflow on real infrastructure? Stand up an orchestrator + agent (Docker / Podman or bare metal)
 - **[SDK reference](sdk-reference.md)** -- complete API for workflows, jobs, steps, triggers, rules, and matrix
 - **[CLI reference](cli-reference.md)** -- all CLI commands with options and examples
 - **[Workflow patterns](workflow-patterns.md)** -- common patterns for real-world CI/CD workflows
@@ -4169,6 +4198,8 @@ The `@kici-dev/compiler` package provides the `kici` CLI for compiling, testing,
 pnpm add -D @kici-dev/compiler
 ```
 
+The examples use pnpm, but npm and yarn work too — `npm install -D @kici-dev/compiler` or `yarn add -D @kici-dev/compiler`.
+
 Run commands with `npx kici` or add scripts to your `package.json`:
 
 ```json
@@ -4646,6 +4677,8 @@ Show details for a specific test run. Fetches from the orchestrator with fallbac
 
 The status output includes an **auth section** showing login state, active organization, and PAT expiry. A warning appears when the PAT expires within 7 days.
 
+For a failed run, the output prints a `Reason:` line with the run's failure reason and shows the failed job's error inline, so you can see why a run failed without opening the dashboard. When provisioning an agent failed before any step ran, this reason is the captured scaler error (for example a missing binary or an unpullable image) rather than a generic "no agents available" message.
+
 ```bash
 kici status <run-id> [options]
 ```
@@ -4680,6 +4713,11 @@ kici status abc123 --logs --job build
 kici status abc123 --json
 ```
 
+When `--json` is set, `kici` emits only the JSON document on stdout — the
+`kici v<version>` banner is suppressed — so the output is safe to pipe into
+`jq` or `JSON.parse`. The same holds for the other `--json` commands (`kici run
+remote --json`, `kici workflows list --json`) and for `--quiet`.
+
 ### kici cancel
 
 Cancel a running workflow or all runs on a branch.
@@ -4832,15 +4870,16 @@ kici init [options]
 
 **Options:**
 
-| Option                             | Default                | Description                                                                                             |
-| ---------------------------------- | ---------------------- | ------------------------------------------------------------------------------------------------------- |
-| `--force`                          | `false`                | Overwrite existing `.kici/` directory                                                                   |
-| `--skip-install`                   | `false`                | Create files without running npm install                                                                |
-| `--mjs`                            | `false`                | JavaScript-only mode (no TypeScript, no deps)                                                           |
-| `--no-agents-md`                   | writes `AGENTS.md`     | Skip writing `.kici/AGENTS.md` (the LLM authoring context file)                                         |
-| `--private-registry <url>`         | none                   | Scaffold a workflow `registries:` entry pointing at `<url>` (e.g. CodeArtifact, GH Packages, Verdaccio) |
-| `--private-registry-scope <scope>` | none                   | Optional npm package scope (e.g. `@my-org`) for the private registry                                    |
-| `--private-registry-secret <ref>`  | `production:NPM_TOKEN` | Qualified secret reference (`env:NAME`) the private registry token comes from                           |
+| Option                                | Default                | Description                                                                                             |
+| ------------------------------------- | ---------------------- | ------------------------------------------------------------------------------------------------------- |
+| `--force`                             | `false`                | Overwrite existing `.kici/` directory                                                                   |
+| `--skip-install`                      | `false`                | Create files without installing dependencies                                                            |
+| `--package-manager <npm\|pnpm\|yarn>` | auto-detect            | Force a package manager for the install step (default: detect from your repo)                           |
+| `--mjs`                               | `false`                | JavaScript-only mode (no TypeScript, no deps)                                                           |
+| `--no-agents-md`                      | writes `AGENTS.md`     | Skip writing `.kici/AGENTS.md` (the LLM authoring context file)                                         |
+| `--private-registry <url>`            | none                   | Scaffold a workflow `registries:` entry pointing at `<url>` (e.g. CodeArtifact, GH Packages, Verdaccio) |
+| `--private-registry-scope <scope>`    | none                   | Optional npm package scope (e.g. `@my-org`) for the private registry                                    |
+| `--private-registry-secret <ref>`     | `production:NPM_TOKEN` | Qualified secret reference (`env:NAME`) the private registry token comes from                           |
 
 **Examples:**
 
@@ -4851,9 +4890,12 @@ kici init
 # Overwrite existing setup
 kici init --force
 
-# Skip npm install (faster, install manually later)
+# Skip dependency install (faster, install manually later)
 kici init --skip-install
 
+# Force a specific package manager (default: detect from your repo)
+kici init --package-manager pnpm
+
 # JavaScript mode (no TypeScript)
 kici init --mjs
 
@@ -4886,6 +4928,8 @@ In interactive mode (TTY), `kici init` prompts you to:
 1. Select which workflow templates to include
 2. Optionally install a pre-commit hook
 
+**Package manager:** the dependency install step uses the package manager detected for your repo — the `packageManager` field in the nearest `package.json` (Corepack convention), then a lockfile in the project root (`pnpm-lock.yaml` → pnpm, `yarn.lock` → yarn, `package-lock.json` → npm), then the package manager that invoked `kici` (`pnpm dlx` / `yarn dlx` / `npx`), defaulting to npm. Pass `--package-manager <npm|pnpm|yarn>` to override detection, or `--skip-install` to set up the files and install later yourself.
+
 **Development mode:** When `KICI_DEV=true` or `package.json` has `"kici": { "development": true }`, the generated `package.json` uses prerelease-compatible version ranges (`>=0.0.1-0`) so npm resolves Verdaccio's prerelease builds.
 
 ### kici hook install
@@ -6395,7 +6439,7 @@ The content area has the following tabs:
 
 - **Logs** (default) -- shows log output for the selected job or step
 - **Payload** -- webhook payload viewer showing the raw event payload that triggered the run
-- **Timeline** -- CSS Gantt chart showing the execution timeline of all jobs, with percentage-based bars and striped animation for running jobs
+- **Timeline** -- CSS Gantt chart showing the execution timeline of all jobs, with percentage-based bars and striped animation for running jobs. A **Provisioning** milestones section between the dispatch and execution phases plots scaler lifecycle events for the run — including a **Provisioning failed** marker when the scaler could not bring an agent up
 - **Summary** -- contextual overview scoped to the current selection (run-level trigger/repo/timing info, or job-level execution context with environment variables, runtime info, and sandbox details)
 
 On wide desktop (>= 1200px), Metadata is shown in a dedicated sidebar panel instead of as a tab.
@@ -6478,6 +6522,12 @@ When viewing a running job, logs appear in real time as the agent executes steps
 - If the WS connection drops, the dashboard reconnects automatically and refetches all cached data to catch up on missed updates.
 - Log lines received during streaming are held in memory. For very long-running steps with massive output, the REST endpoint is the authoritative source for complete logs.
 
+### Provisioning logs
+
+Above the step logs, a collapsible **Provisioning logs** section shows the orchestrator-side lifecycle of the agent that ran the job — the scaler lifecycle events emitted while bringing an agent up. It starts expanded while provisioning is in progress (no step logs yet) and collapses once steps begin producing output.
+
+When the scaler **fails** to provision an agent (for example a missing binary, an unpullable container image, or a microVM that fails to boot), the failure appears here along with a bounded tail of the agent process's own stdout/stderr captured by the scaler. This is the surface to check for a run that fails with no step logs at all — the agent never started, so the cause lives in the provisioning lifecycle rather than in any step's output.
+
 ### Performance
 
 The log viewer uses virtualized scrolling to handle large outputs. Only the visible lines plus a small buffer are rendered in the DOM, keeping performance smooth even for logs with 10,000+ lines.
@@ -7170,13 +7220,12 @@ The KiCI CLI reads the following environment variables to customize its behavior
 
 ## Authentication
 
-| Variable               | Description                                                 | Default            |
-| ---------------------- | ----------------------------------------------------------- | ------------------ |
-| `KICI_OIDC_ISSUER`     | OIDC issuer URL for authentication (required for OAuth)     | none — must be set |
-| `KICI_OIDC_CLIENT_ID`  | OIDC client ID for the CLI application (required for OAuth) | none — must be set |
-| `KICI_OIDC_PROJECT_ID` | OIDC project ID (adds audience scope for JWT access tokens) | unset              |
-| `KICI_PLATFORM_URL`    | Platform API base URL (required for OAuth)                  | none — must be set |
-| `KICI_CONFIG_DIR`      | Override the KiCI config directory                          | `~/.kici`          |
+| Variable              | Description                                                 | Default            |
+| --------------------- | ----------------------------------------------------------- | ------------------ |
+| `KICI_OIDC_ISSUER`    | OIDC issuer URL for authentication (required for OAuth)     | none — must be set |
+| `KICI_OIDC_CLIENT_ID` | OIDC client ID for the CLI application (required for OAuth) | none — must be set |
+| `KICI_PLATFORM_URL`   | Platform API base URL (required for OAuth)                  | none — must be set |
+| `KICI_CONFIG_DIR`     | Override the KiCI config directory                          | `~/.kici`          |
 
 ## Browser behavior
 
@@ -7209,7 +7258,6 @@ Point the CLI to a self-hosted or testing OIDC provider:
 ```bash
 export KICI_OIDC_ISSUER=https://your-idp.example.com
 export KICI_OIDC_CLIENT_ID=your-client-id
-export KICI_OIDC_PROJECT_ID=your-project-id
 export KICI_PLATFORM_URL=https://your-platform.example.com
 kici login
 ```
@@ -8247,7 +8295,7 @@ registries: [
 
 - **Per-environment scoping.** Every `tokenSecret` and `installEnv` entry is qualified with an environment name. The orchestrator runs the same protection-rule pipeline (branch / trust / concurrency / reviewer / wait-timer) against each named environment **before** resolving any secret, so a workflow that wants a `production` token from a feature branch is rejected exactly like a job that tries to deploy to `production` from a feature branch.
 - **Untrusted contributors get no tokens.** When a fork PR is dispatched and the contributor-trust resolution returns anything other than `trusted`, the orchestrator strips both `npmRegistries` and `installEnvSecrets` out of the dispatch. The install runs without auth and fails naturally on the first private dep — fork PRs cannot ever observe a registry token, even if a misconfigured environment lacks an explicit `requiredTrustTier`.
-- **`--ignore-scripts` always.** Whenever a private registry is in scope, the agent runs `npm install --ignore-scripts`. A malicious `preinstall` / `postinstall` hook in committed `package.json` cannot read the synthesized token env vars, even though they exist in the install subprocess.
+- **Lifecycle scripts disabled.** Whenever a private registry is in scope, the agent runs the install with `--ignore-scripts` (npm or pnpm alike). A malicious `preinstall` / `postinstall` hook in committed `package.json` cannot read the synthesized token env vars, even though they exist in the install subprocess. For a pnpm workspace, the agent builds your in-repo dependency closure as a separate step **after** the install's auth is torn down, so build scripts never see the tokens either.
 - **Stderr is redacted.** If the install fails, the agent masks every token literal out of the surfaced stderr / stdout chunks before logging.
 - **Job-scoped env-var names.** The synthesized auth env var is `KICI_NPM_TOKEN_<jobIdShort>_<i>` where `jobIdShort` is the first 8 chars of the dispatched job id. The name is unguessable from outside the install subprocess and not reused across jobs.
 - **`.npmrc` restored.** Whatever the agent appended for one install is stripped (or the file unlinked) on cleanup, so the workspace is never permanently modified.

package/dist/lockfile/generator.d.ts

@@ -8,11 +8,19 @@ import { type LockFile, type LockTrigger, type WorkflowWithSource } from '../typ
  */
 export declare function detectGitRoot(): string;
 /**
- * Compute SHA-256 hash of the .kici/package-lock.json lockfile.
- * Used as part of the dependency cache key.
+ * Compute the dependency-cache key: a SHA-256 hash of the repo's lockfile,
+ * scoped to the detected package manager.
+ *
+ * The authoritative lockfile differs by manager: `.kici/package-lock.json` for
+ * npm, the repo-root `pnpm-lock.yaml` for a pnpm workspace, the repo-root
+ * `yarn.lock` for yarn. A pnpm/yarn `.kici/` member resolves against the root
+ * lockfile, so keying on `.kici/package-lock.json` alone would miss the
+ * authoritative graph. The hash input is prefixed with the manager name so two
+ * managers can never collide on identical lockfile bytes (and a restored tree
+ * can never be the wrong layout for the agent's manager).
  *
  * @param gitRoot - Absolute path to git repository root
- * @returns Hex SHA-256 hash string, or null if no lockfile found in .kici/
+ * @returns Hex SHA-256 hash string, or null if no lockfile is found
  */
 export declare function computeLockfileHash(gitRoot: string): string | null;
 /**

package/dist/lockfile/generator.js

@@ -8,6 +8,7 @@ import path from "node:path";
 import { execSync } from "node:child_process";
 import { sha256 } from "@kici-dev/shared";
 import { getDynamicJobGroup, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject } from "@kici-dev/sdk";
+import { PackageManager, detectPackageManagerSync } from "@kici-dev/shared/package-manager";
 import { validateResourceRequest } from "@kici-dev/engine";
 //#region src/lockfile/generator.ts
 /**
@@ -31,19 +32,28 @@ function detectGitRoot() {
 	}
 }
 /**
-* Compute SHA-256 hash of the .kici/package-lock.json lockfile.
-* Used as part of the dependency cache key.
+* Compute the dependency-cache key: a SHA-256 hash of the repo's lockfile,
+* scoped to the detected package manager.
+*
+* The authoritative lockfile differs by manager: `.kici/package-lock.json` for
+* npm, the repo-root `pnpm-lock.yaml` for a pnpm workspace, the repo-root
+* `yarn.lock` for yarn. A pnpm/yarn `.kici/` member resolves against the root
+* lockfile, so keying on `.kici/package-lock.json` alone would miss the
+* authoritative graph. The hash input is prefixed with the manager name so two
+* managers can never collide on identical lockfile bytes (and a restored tree
+* can never be the wrong layout for the agent's manager).
 *
 * @param gitRoot - Absolute path to git repository root
-* @returns Hex SHA-256 hash string, or null if no lockfile found in .kici/
+* @returns Hex SHA-256 hash string, or null if no lockfile is found
 */
 function computeLockfileHash(gitRoot) {
-	for (const candidate of ["package-lock.json"]) try {
-		return sha256(readFileSync(path.join(gitRoot, ".kici", candidate), "utf-8"));
+	const pm = detectPackageManagerSync(gitRoot);
+	const lockfilePath = pm === PackageManager.Pnpm ? path.join(gitRoot, "pnpm-lock.yaml") : pm === PackageManager.Yarn ? path.join(gitRoot, "yarn.lock") : path.join(gitRoot, ".kici", "package-lock.json");
+	try {
+		return sha256(`${pm}\n${readFileSync(lockfilePath, "utf-8")}`);
 	} catch {
-		continue;
+		return null;
 	}
-	return null;
 }
 /**
 * Format export reference with hash syntax.

package/dist/remote/client.d.ts

@@ -73,12 +73,14 @@ interface UploadStatusResponse {
 export interface RunStatusResponse {
     runId: string;
     status: string;
+    failureReason?: string;
     summary?: {
         totalDurationMs: number;
         jobs: Array<{
             name: string;
             status: string;
             durationMs?: number;
+            errorMessage?: string;
         }>;
     };
 }

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.10";
+const sdkVersion = "0.1.12";
 /**
 * Generate package.json content for .kici/ directory
 *

package/dist/types.d.ts

@@ -498,7 +498,13 @@ export interface LockFile {
     readonly source: LockSource;
     /** SHA-256 hash of the serialized lock file content (excluding this field). Changes only when workflows, triggers, jobs, or bundle hashes change. */
     readonly contentHash: string;
-    /** SHA-256 hash of .kici/package-lock.json. Used as dependency cache key. */
+    /**
+     * SHA-256 hash of the repo's lockfile, used as the dependency cache key. The
+     * lockfile is the one the detected package manager produces — `.kici/`'s
+     * `package-lock.json` for npm, or the repo-root `pnpm-lock.yaml` /
+     * `yarn.lock` for a pnpm/yarn workspace. The hash input is prefixed with the
+     * manager name so a manager change is a guaranteed cache miss.
+     */
     readonly lockfileHash?: string;
     readonly workflows: readonly LockWorkflow[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "kici",
@@ -58,11 +58,11 @@
     "ws": "^8.20.0",
     "yaml": "^2.8.3",
     "zx": "^8.8.5",
-    "@kici-dev/engine": "0.1.10",
-    "@kici-dev/shared": "0.1.10"
+    "@kici-dev/engine": "0.1.12",
+    "@kici-dev/shared": "0.1.12"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.1.10"
+    "@kici-dev/sdk": "0.1.12"
   },
   "devDependencies": {
     "@types/proper-lockfile": "^4.1.4"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/compiler@0.1.10",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.10/b023b6e4-5f2f-412e-afa3-f0acaaa659d3",
+  "name": "@kici-dev/compiler@0.1.12",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.12/62531134-3d1c-4447-9505-a6462b2c3b3a",
   "creationInfo": {
-    "created": "2026-05-26T17:26:28Z",
+    "created": "2026-05-27T16:57:43Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1323,7 +1323,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/compiler",
-      "versionInfo": "0.1.10",
+      "versionInfo": "0.1.12",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1334,16 +1334,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.10"
+          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.12"
         }
       ],
       "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.10",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.12",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.10",
+      "versionInfo": "0.1.12",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1354,16 +1354,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.10"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.12"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.10",
+      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.12",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.10",
+      "versionInfo": "0.1.12",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1374,16 +1374,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.10"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.12"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.10",
+      "versionInfo": "0.1.12",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1394,7 +1394,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.10"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.12"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -8290,17 +8290,17 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.10",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.10",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8364,147 +8364,147 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.10",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.12",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.10",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.12",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-fast-cartesian-9.0.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-micromatch-4.0.8",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1038.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.28.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.40.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-diff-7.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.18",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.12",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },