@kici-dev/compiler 0.1.5 → 0.1.7

package/dist/cli.js

@@ -22,7 +22,7 @@ import "./commands/index.js";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.5";
+const version = "0.1.7";
 const program = new Command();
 program.name("kici").description("KiCI workflow compiler").version(version);
 program.hook("preAction", () => {

package/dist/commands/status.js

@@ -15,7 +15,7 @@ import { formatDuration, logger, toErrorMessage } from "@kici-dev/shared";
 * Looks up local history first, then fetches from the orchestrator for
 * up-to-date status and logs.
 */
-const CLI_VERSION = "0.1.5";
+const CLI_VERSION = "0.1.7";
 /**
 * Show status and details of a test run.
 *

package/dist/llm-context/llms-full.txt

@@ -1372,7 +1372,7 @@ export default workflow('on-github-repo-push', {
 - No auto-clone — `packages/agent/src/checkout/git-clone.ts` uses GitHub App installation tokens to fetch the repo; a generic source has none. Either set `checkout: false` and clone yourself with a PAT/Deploy Key secret (same pattern as the Forgejo manual-clone example above), or keep the workflow self-contained.
 - No lock-file fetch — the orchestrator cannot fetch `.kici/kici.lock.json` at the pushed SHA via the GitHub API. The workflow must be pre-registered via the [registration model](../events.md#the-registration-model); ad-hoc per-commit workflow discovery that a GitHub App push gives you is not available.
 - No changed-files enrichment — `event.changedFiles` is empty. Use JSONPath `match` on `rawPayload.commits[*].added/modified/removed` if you need path filters.
-- No check-run integration — KiCI cannot post commit statuses or Check Run results back to GitHub.
+- No check-run integration — KiCI cannot post Check Run results back to GitHub.
 - Workflow authors must use `genericWebhook()`, not `push()` / `pr()` / `webhook()` — the latter three only match events delivered through the native GitHub App provider.
 
 **When to use it anyway:** trigger-only workflows that don't need the cloned repo — posting Slack messages, kicking off external deploys, forwarding to downstream systems, or exposing GitHub repo events as `genericWebhook` for same-org [cross-source fan-out](../../architecture/webhooks/webhook-delivery.md#cross-source-delivery). For anything that compiles, tests, or checks code, install the GitHub App instead.
@@ -8593,11 +8593,14 @@ repos where you can't install an App.
    https://<platform-host>/webhook/<orgId>/github
    ```
 
-   For self-hosted independent / hybrid orchestrators the same path
-   serves directly on the orchestrator's public hostname. The `<orgId>`
-   segment is the KiCI organization ID the source belongs to; the
-   `<appId>` is discovered from `X-GitHub-Hook-Installation-Target-ID`
-   at request time and is _not_ part of the URL.
+   GitHub App webhooks are always delivered to this Platform endpoint and
+   relayed to your orchestrator over its outbound connection — platform and
+   hybrid orchestrators both receive GitHub events this way. Independent-mode
+   orchestrators have no Platform connection and therefore no GitHub-App
+   ingress; use a generic webhook source instead. The `<orgId>` segment is
+   the KiCI organization ID the source belongs to; the `<appId>` is
+   discovered from `X-GitHub-Hook-Installation-Target-ID` at request time and
+   is _not_ part of the URL.
 
 4. **Set the webhook secret.** Generate a random hex string (e.g.
    `openssl rand -hex 32`) and save it for step 4 of the orchestrator
@@ -8606,18 +8609,38 @@ repos where you can't install an App.
 
 5. **Pick permissions.** Minimum required:
 
-   | Scope                         | Access       | Why                                     |
-   | ----------------------------- | ------------ | --------------------------------------- |
-   | Repository -> Contents        | Read         | Clone the repo to read the lock file    |
-   | Repository -> Metadata        | Read (auto)  | Default for every App                   |
-   | Repository -> Pull requests   | Read         | Match `pull_request` triggers           |
-   | Repository -> Checks          | Read & write | Post KiCI's enriched Check runs         |
-   | Repository -> Commit statuses | Read & write | (optional) Legacy commit-status posting |
+   | Scope                       | Access       | Why                                                                                                                                                       |
+   | --------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+   | Repository -> Contents      | Read         | Clone the repo to read the lock file                                                                                                                      |
+   | Repository -> Metadata      | Read (auto)  | Default for every App; also lets KiCI look up a pull-request author's repository access level for CI trust                                                |
+   | Repository -> Pull requests | Read         | Match `pull_request` triggers                                                                                                                             |
+   | Repository -> Checks        | Read & write | Post KiCI's enriched Check runs                                                                                                                           |
+   | Organization -> Members     | Read         | (optional, org installs) Receive `organization` / `membership` / `team` events so KiCI's CI-trust permission cache invalidates promptly on access changes |
+
+   The first four rows cover the core flow (clone, trigger matching,
+   Check runs). The **Organization -> Members** row is only relevant if
+   you use [CI trust tiers](../../architecture/security/ci-security.md)
+   on an org-level install — see the event note below.
 
 6. **Subscribe to events.** At minimum: `push`, `pull_request`,
    `check_run`, `check_suite`. Add others (`issues`, `release`, ...) if
    your workflows use those triggers.
 
+   **For CI trust (optional but recommended on org installs):** also
+   subscribe to `member`, `organization`, `membership`, and `team`.
+   KiCI caches each pull-request author's repository access level (used
+   to decide whether workflow changes take effect immediately or are
+   held for approval — see
+   [CI security](../../architecture/security/ci-security.md)). These
+   events let the orchestrator drop stale cache entries the moment a
+   contributor's access changes. They are not required for correctness:
+   without them the cache simply ages out on its own 15-minute TTL, so a
+   permission change can take up to 15 minutes to take effect. The
+   `organization` / `membership` / `team` events require the
+   **Organization -> Members** read permission and an org-level
+   installation; `member` is a repository event covered by the default
+   Metadata permission.
+
 7. **Generate a private key.** Scroll to the bottom of the App settings
    and click _Generate a private key_. A `.pem` file downloads —
    store it safely; you cannot redownload it.
@@ -8643,10 +8666,21 @@ kici-admin --url http://<orchestrator-host>:4000 --token $KICI_BOOTSTRAP_ADMIN_T
   --webhook-secret <the-webhook-secret-from-step-4>
 ```
 
-The command returns the routing key (always `github:<appId>`). The
-private key and webhook secret are stored encrypted in the orchestrator
-database under `KICI_SECRET_KEY`; no restart needed — the orchestrator
-accepts webhooks from this App immediately.
+The command prints the routing key (always `github:<appId>`) and the public
+webhook URL to paste into the GitHub App's "Webhook URL" field:
+
+```
+Source added: github:<appId> (my-org)
+Webhook URL:  https://<platform-host>/webhook/<orgId>/github
+  ↳ Paste this into your GitHub App's "Webhook URL" field.
+```
+
+When the orchestrator runs in independent mode (no Platform connection) the
+URL line reads `(unavailable — this orchestrator runs in independent mode)`,
+because GitHub-App ingress is Platform-relayed. The private key and webhook
+secret are stored encrypted in the orchestrator database under
+`KICI_SECRET_KEY`; no restart needed — the orchestrator accepts webhooks from
+this App immediately.
 
 **Secret input modes** (for `--private-key` and `--webhook-secret`):
 
@@ -9887,7 +9921,7 @@ Per-source secrets enable multi-tenant Platform with proper isolation. Each cust
 
 **Decision:** Webhooks are routed by provider-scoped routing key (e.g., `github:12345`) derived from the `X-GitHub-Hook-Installation-Target-ID` header. One routing key maps to one orchestrator connection.
 
-App ID routing provides a clean 1:1 mapping between a customer's GitHub App and their orchestrator. The orchestrator extracts the `installation_id` from the webhook payload body for GitHub API calls (fetching lock files, setting commit statuses).
+App ID routing provides a clean 1:1 mapping between a customer's GitHub App and their orchestrator. The orchestrator extracts the `installation_id` from the webhook payload body for GitHub API calls (fetching lock files, posting check runs).
 
 **Alternative:** Route by Installation ID (more granular, one App can have many installations). Rejected because it adds complexity without clear benefit -- most customers use one App with one or a few installations, and the orchestrator can handle multiple installations internally.
 

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.5";
+const sdkVersion = "0.1.7";
 /**
 * Generate package.json content for .kici/ directory
 *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "kici",
@@ -58,11 +58,11 @@
     "ws": "^8.20.0",
     "yaml": "^2.8.3",
     "zx": "^8.8.5",
-    "@kici-dev/engine": "0.1.5",
-    "@kici-dev/shared": "0.1.5"
+    "@kici-dev/engine": "0.1.7",
+    "@kici-dev/shared": "0.1.7"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.1.5"
+    "@kici-dev/sdk": "0.1.7"
   },
   "devDependencies": {
     "@types/proper-lockfile": "^4.1.4"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/compiler@0.1.5",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.5/4f44ccf4-74b0-411c-b1be-c9a0e132055f",
+  "name": "@kici-dev/compiler@0.1.7",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.7/7e850940-123b-4ccc-9ddd-e15090694cfc",
   "creationInfo": {
-    "created": "2026-05-25T13:20:44Z",
+    "created": "2026-05-26T14:00:34Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1323,7 +1323,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/compiler",
-      "versionInfo": "0.1.5",
+      "versionInfo": "0.1.7",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1334,16 +1334,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.5"
+          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.7"
         }
       ],
       "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.5",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.7",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.5",
+      "versionInfo": "0.1.7",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1354,16 +1354,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.5"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.7"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.5",
+      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.7",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.5",
+      "versionInfo": "0.1.7",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1374,16 +1374,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.5"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.7"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.5",
+      "versionInfo": "0.1.7",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1394,7 +1394,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.5"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.7"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -8290,17 +8290,17 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.5",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.5",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8364,147 +8364,147 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.5",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.7",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.5",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.7",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-fast-cartesian-9.0.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-micromatch-4.0.8",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1038.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.28.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.40.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-diff-7.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.18",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },