@kici-dev/engine 0.6.0 → 0.7.0

package/dist/regex-flags.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The one definition of which regex flags may survive into a compiled matcher.
+ *
+ * `g` and `y` make a `RegExp` stateful: the instance carries `lastIndex` across
+ * `.test()` calls, so a memoized one returns alternating verdicts for the same
+ * input, and a loop over a set of candidates resumes mid-string on the second
+ * element. Every matcher this repo compiles is either memoized
+ * (`trigger/compiled-matchers.ts`, `labels-match.ts`) or applied to a set
+ * (`matcherSatisfiedBy`), and none of them wants sticky or global semantics —
+ * they all ask a single yes/no question about one whole string.
+ *
+ * So the two stateful flags are dropped at every boundary: the SDK producers
+ * that read an author's `RegExp`, the compiler that serializes one into the
+ * lock file, and the two readers that compile one back. Stripping at the
+ * readers too is what makes a lock written by an older compiler safe, since the
+ * lock-file format is compat-protected and a `flags: 'g'` entry keeps arriving
+ * for the whole 0.x line.
+ *
+ * Pure string logic with no imports, so it is safe for the browser barrel.
+ */
+/**
+ * Drop `g` and `y` from a flag string. Every other ECMAScript flag —
+ * `d` (hasIndices), `i`, `m`, `s`, `u`, `v` — is meaningful to a single
+ * `.test()` and is preserved.
+ */
+export declare function stripStatefulRegexFlags(flags: string | undefined): string;
+/**
+ * Same, but collapsing an empty result to `undefined` — the shape the SDK's
+ * pattern types and the lock file use for "no flags".
+ */
+export declare function normalizeRegexFlags(flags: string | undefined): string | undefined;
+//# sourceMappingURL=regex-flags.d.ts.map

package/dist/regex-flags.js

@@ -0,0 +1,43 @@
+import "./rolldown-runtime-ClRpJifh.js";
+//#region src/regex-flags.ts
+/**
+* The one definition of which regex flags may survive into a compiled matcher.
+*
+* `g` and `y` make a `RegExp` stateful: the instance carries `lastIndex` across
+* `.test()` calls, so a memoized one returns alternating verdicts for the same
+* input, and a loop over a set of candidates resumes mid-string on the second
+* element. Every matcher this repo compiles is either memoized
+* (`trigger/compiled-matchers.ts`, `labels-match.ts`) or applied to a set
+* (`matcherSatisfiedBy`), and none of them wants sticky or global semantics —
+* they all ask a single yes/no question about one whole string.
+*
+* So the two stateful flags are dropped at every boundary: the SDK producers
+* that read an author's `RegExp`, the compiler that serializes one into the
+* lock file, and the two readers that compile one back. Stripping at the
+* readers too is what makes a lock written by an older compiler safe, since the
+* lock-file format is compat-protected and a `flags: 'g'` entry keeps arriving
+* for the whole 0.x line.
+*
+* Pure string logic with no imports, so it is safe for the browser barrel.
+*/
+/** Flags that make a `RegExp` carry `lastIndex` between calls. */
+const STATEFUL_FLAGS = /[gy]/g;
+/**
+* Drop `g` and `y` from a flag string. Every other ECMAScript flag —
+* `d` (hasIndices), `i`, `m`, `s`, `u`, `v` — is meaningful to a single
+* `.test()` and is preserved.
+*/
+function stripStatefulRegexFlags(flags) {
+	return (flags ?? "").replace(STATEFUL_FLAGS, "");
+}
+/**
+* Same, but collapsing an empty result to `undefined` — the shape the SDK's
+* pattern types and the lock file use for "no flags".
+*/
+function normalizeRegexFlags(flags) {
+	return stripStatefulRegexFlags(flags) || void 0;
+}
+//#endregion
+export { normalizeRegexFlags, stripStatefulRegexFlags };
+
+//# sourceMappingURL=regex-flags.js.map

package/dist/trigger/compiled-matchers.d.ts

@@ -1,8 +1,15 @@
 /**
  * Return a memoized RegExp for the given pattern + flags. The key encodes the
  * flags first with a space separator; regex flags are restricted to
- * `[gimsuydv]`, so the separator can never collide with a pattern that starts
- * with a space.
+ * `[dimsuv]` once the stateful ones are stripped, so the separator can never
+ * collide with a pattern that starts with a space.
+ *
+ * `g` and `y` are dropped before compiling AND before building the memo key
+ * (`stripStatefulRegexFlags`): they make the instance carry `lastIndex` between
+ * calls, which turns a memoized `.test()` into alternating verdicts. Stripping
+ * here rather than only at the producers is what makes a lock file written by an
+ * older compiler safe — that format is compat-protected, so `flags: 'g'` entries
+ * keep arriving for the whole 0.x line.
  *
  * Every pattern reaching here is author-supplied (branch/tag/repo patterns and
  * comment `bodyMatch`), so it is ReDoS-checked before compiling. The guard runs

package/dist/trigger/compiled-matchers.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { stripStatefulRegexFlags } from "../regex-flags.js";
 import { assertSafeRegex } from "../safe-regex.js";
 import picomatch from "picomatch";
 //#region src/trigger/compiled-matchers.ts
@@ -27,8 +28,15 @@ const repoGlobCache = /* @__PURE__ */ new Map();
 /**
 * Return a memoized RegExp for the given pattern + flags. The key encodes the
 * flags first with a space separator; regex flags are restricted to
-* `[gimsuydv]`, so the separator can never collide with a pattern that starts
-* with a space.
+* `[dimsuv]` once the stateful ones are stripped, so the separator can never
+* collide with a pattern that starts with a space.
+*
+* `g` and `y` are dropped before compiling AND before building the memo key
+* (`stripStatefulRegexFlags`): they make the instance carry `lastIndex` between
+* calls, which turns a memoized `.test()` into alternating verdicts. Stripping
+* here rather than only at the producers is what makes a lock file written by an
+* older compiler safe — that format is compat-protected, so `flags: 'g'` entries
+* keep arriving for the whole 0.x line.
 *
 * Every pattern reaching here is author-supplied (branch/tag/repo patterns and
 * comment `bodyMatch`), so it is ReDoS-checked before compiling. The guard runs
@@ -37,9 +45,10 @@ const repoGlobCache = /* @__PURE__ */ new Map();
 * it is rejected on every attempt. `ctx` names the dialect in the thrown error.
 */
 function getCompiledRegex(pattern, flags, ctx = "trigger pattern") {
-	return boundedGet(regexCache, `${flags ?? ""} ${pattern}`, () => {
-		assertSafeRegex(pattern, flags ?? "", ctx);
-		return new RegExp(pattern, flags);
+	const safeFlags = stripStatefulRegexFlags(flags);
+	return boundedGet(regexCache, `${safeFlags} ${pattern}`, () => {
+		assertSafeRegex(pattern, safeFlags, ctx);
+		return new RegExp(pattern, safeFlags);
 	});
 }
 /**

package/dist/trigger/decision-trace.d.ts

@@ -108,7 +108,7 @@ export declare function createContentRequirementsTraceEntry(args: {
  * Record the Tier-2 `filter` predicate's verdict for one workflow.
  *
  * Without this entry a `filter` exclusion is invisible: the predicate runs on an
- * agent, returns `false`, and the workflow simply never appears — leaving its
+ * agent, returns `false`, and the workflow never appears — leaving its
  * author nothing to inspect. The entry is the answer to "why did nothing run?".
  */
 export declare function createGlobalFilterTraceEntry(args: {

package/dist/trigger/decision-trace.js

@@ -91,7 +91,7 @@ function createContentRequirementsTraceEntry(args) {
 * Record the Tier-2 `filter` predicate's verdict for one workflow.
 *
 * Without this entry a `filter` exclusion is invisible: the predicate runs on an
-* agent, returns `false`, and the workflow simply never appears — leaving its
+* agent, returns `false`, and the workflow never appears — leaving its
 * author nothing to inspect. The entry is the answer to "why did nothing run?".
 */
 function createGlobalFilterTraceEntry(args) {

package/dist/trigger/text-match.d.ts

@@ -10,9 +10,14 @@ export interface TextMatchResult {
  * pattern. Returns `null` when the pattern is syntactically invalid or fails the
  * `safe-regex` star-height heuristic — callers treat `null` as indeterminate.
  *
- * Always compiles a FRESH RegExp. A `g`-flagged instance carries `lastIndex`
- * across `.test()` calls, so a cached one would return alternating verdicts for
- * the same input.
+ * The flag class names every ECMAScript flag. When it read `[gimsuy]`, a `d`-
+ * or `v`-flagged pattern failed to unwrap and the whole `/pattern/flags` string
+ * became the pattern — a regex matching literal slashes, which compiles green
+ * and never matches what the author wrote.
+ *
+ * `g` and `y` are then stripped: they make the instance carry `lastIndex`
+ * between `.test()` calls, which is meaningless for the single yes/no question
+ * this asks and actively wrong for any caller that reuses the instance.
  */
 export declare function compileSafeRegex(source: string): RegExp | null;
 /** True when the matcher carries at least one populated query key. */

package/dist/trigger/text-match.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { stripStatefulRegexFlags } from "../regex-flags.js";
 import safeRegex from "safe-regex";
 //#region src/trigger/text-match.ts
 /**
@@ -18,14 +19,19 @@ import safeRegex from "safe-regex";
 * pattern. Returns `null` when the pattern is syntactically invalid or fails the
 * `safe-regex` star-height heuristic — callers treat `null` as indeterminate.
 *
-* Always compiles a FRESH RegExp. A `g`-flagged instance carries `lastIndex`
-* across `.test()` calls, so a cached one would return alternating verdicts for
-* the same input.
+* The flag class names every ECMAScript flag. When it read `[gimsuy]`, a `d`-
+* or `v`-flagged pattern failed to unwrap and the whole `/pattern/flags` string
+* became the pattern — a regex matching literal slashes, which compiles green
+* and never matches what the author wrote.
+*
+* `g` and `y` are then stripped: they make the instance carry `lastIndex`
+* between `.test()` calls, which is meaningless for the single yes/no question
+* this asks and actively wrong for any caller that reuses the instance.
 */
 function compileSafeRegex(source) {
-	const wrapped = /^\/(.+)\/([gimsuy]*)$/.exec(source);
+	const wrapped = /^\/(.+)\/([dgimsuvy]*)$/.exec(source);
 	const pattern = wrapped ? wrapped[1] : source;
-	const flags = wrapped ? wrapped[2] : "";
+	const flags = stripStatefulRegexFlags(wrapped ? wrapped[2] : "");
 	let re;
 	try {
 		re = new RegExp(pattern, flags);

package/dist/trigger/trigger-event-type.d.ts

@@ -11,4 +11,20 @@ export type TriggerEventType = (typeof TRIGGER_EVENT_TYPES)[number];
 export declare const TRIGGER_EVENT_META: Record<TriggerEventType, {
     label: string;
 }>;
+/**
+ * The event types that carry a pull request: the PR itself plus the two review
+ * events that hang off one. Each has a HEAD that a contributor controls and a
+ * BASE that the repository owner does, so an identity derived from the base
+ * alone cannot tell one from a push to that same base branch.
+ */
+export declare const PULL_REQUEST_FAMILY_TRIGGER_EVENTS: readonly ["pull_request", "review", "review_comment"];
+/**
+ * True when a persisted `trigger_event` names a pull-request-family event.
+ *
+ * The stored value is `<type>` or `<type>:<action>` (`buildTriggerEvent`), so
+ * the action is stripped before the comparison. A null or unrecognised value
+ * reads as NOT PR-family, which is the conservative direction: it keeps the
+ * branch-shaped identity, which a trust policy can still constrain by ref.
+ */
+export declare function isPullRequestFamilyTriggerEvent(triggerEvent: string | null | undefined): boolean;
 //# sourceMappingURL=trigger-event-type.d.ts.map

package/dist/trigger/trigger-event-type.js

@@ -62,7 +62,31 @@ const TRIGGER_EVENT_META = {
 	rerun: { label: "Re-run" },
 	manual_schedule: { label: "Manual schedule" }
 };
+/**
+* The event types that carry a pull request: the PR itself plus the two review
+* events that hang off one. Each has a HEAD that a contributor controls and a
+* BASE that the repository owner does, so an identity derived from the base
+* alone cannot tell one from a push to that same base branch.
+*/
+const PULL_REQUEST_FAMILY_TRIGGER_EVENTS = [
+	"pull_request",
+	"review",
+	"review_comment"
+];
+/**
+* True when a persisted `trigger_event` names a pull-request-family event.
+*
+* The stored value is `<type>` or `<type>:<action>` (`buildTriggerEvent`), so
+* the action is stripped before the comparison. A null or unrecognised value
+* reads as NOT PR-family, which is the conservative direction: it keeps the
+* branch-shaped identity, which a trust policy can still constrain by ref.
+*/
+function isPullRequestFamilyTriggerEvent(triggerEvent) {
+	if (!triggerEvent) return false;
+	const type = triggerEvent.split(":", 1)[0];
+	return PULL_REQUEST_FAMILY_TRIGGER_EVENTS.includes(type);
+}
 //#endregion
-export { TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES };
+export { PULL_REQUEST_FAMILY_TRIGGER_EVENTS, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, isPullRequestFamilyTriggerEvent };
 
 //# sourceMappingURL=trigger-event-type.js.map

package/dist/trigger/types.d.ts

@@ -38,6 +38,10 @@
  * Schema version 38 (additive): adds container.auth (private-registry credentials for the job image).
  * Schema version 39 (additive): adds container.dockerfile/context/target/args (build the
  *   job's image from a Dockerfile in the repo) and container.auth.registry.
+ * Schema version 40 (additive): adds LockFile.siblingsDigest (the in-repo `workspace:`
+ *   sibling closure the deps tarball carries, which no package-manager lock file moves).
+ * Schema version 41 (additive): adds LockDynamicJobFn.gitCredentials (named git credential
+ *   refs declared by a dynamicJob generator and inherited by every job it generates).
  */
 import { z } from 'zod';
 import type { ProviderType } from '../provider/types.js';
@@ -50,7 +54,7 @@ import { ExecutionJobStatus } from '../protocol/messages/execution-status.js';
  * schema change (additive or breaking); the bump-history comment above records
  * which. See `BREAKING_FLOOR` for the compatibility-window semantics.
  */
-export declare const SCHEMA_VERSION: 39;
+export declare const SCHEMA_VERSION: 41;
 /**
  * Oldest lock schema version this codebase can still read correctly — the lower
  * bound of the acceptance window.
@@ -779,12 +783,17 @@ export interface LockJob {
      */
     readonly runsOnPick?: RunsOnPick;
     /**
-     * Named git credentials for this job, as SECRET NAMES in qualified
-     * `<context>:<secret-name>` form — never credential material.
+     * Named git credentials for this job.
+     *
+     * A `<name>Secret` field is a SECRET NAME in qualified
+     * `<context>:<secret-name>` form. Its sibling `<name>Value` carries the
+     * material itself, for a credential that has no secret-store entry to name;
+     * the SDK accepts it deliberately and the compiler copies it through, so a
+     * lock CAN carry material and a reader must not assume otherwise.
      *
      * `default` is used when a call names no credential; any other key is
      * referenced by name. Additive: an older orchestrator that does not
-     * understand it simply passes it through in `jobConfig`, and an older agent
+     * understand it passes it through in `jobConfig`, and an older agent
      * ignores it (git falls back to its own mechanisms, exactly as before).
      */
     readonly gitCredentials?: Readonly<Record<string, Readonly<Record<string, string>>>>;
@@ -939,6 +948,18 @@ export interface LockDynamicJobFn {
     readonly needs?: readonly (string | NeedsEntry | NeedsGroupEntry)[];
     /** True when this dynamic entry was authored as dynamicJob(group, { needs, generate }). */
     readonly resultAware?: boolean;
+    /**
+     * Named git credentials the generator declares, inherited by every job it
+     * generates. Same shape and same rules as `LockJob.gitCredentials`.
+     *
+     * A generated job has no lock entry of its own, so this IS its declaration:
+     * the credential relay authorizes each generated child's requests against
+     * this map. It lives on the generator because the generator lives in the
+     * committed, content-hashed lock file, whereas the generated job definitions
+     * arrive from the agent's dynamic-eval reply — a map read from there would
+     * let job code declare its own authorization.
+     */
+    readonly gitCredentials?: Readonly<Record<string, Readonly<Record<string, string>>>>;
 }
 /** Job or dynamic job generator */
 export type LockJobOrFactory = LockJob | LockDynamicJobFn;
@@ -1021,6 +1042,8 @@ export interface LockWorkflow {
  * v11 adds the LockInlineValue type (deprecated; inline dynamic fields are resolved on the eval agent).
  * v12 adds workflow-level registries and installEnv for private npm registry auth.
  * v13 adds job-level and workflow-level timeout.
+ * v40 adds siblingsDigest — the in-repo `workspace:` sibling closure the deps
+ * tarball carries, which no package-manager lock file moves. Additive.
  */
 export interface LockFile {
     readonly schemaVersion: typeof SCHEMA_VERSION;
@@ -1037,6 +1060,23 @@ export interface LockFile {
     readonly contentHash: string;
     /** SHA-256 hash of .kici/ lockfile (pnpm-lock.yaml or package-lock.json). Used for dependency cache keying. */
     readonly lockfileHash?: string;
+    /**
+     * SHA-256 over the git-tracked source of every in-repo `workspace:` /
+     * `file:` / `link:` / `portal:` sibling package `.kici` depends on,
+     * transitively.
+     *
+     * The deps tarball carries those sibling directories WITH their built output,
+     * and `lockfileHash` alone names it — but editing a sibling's source moves no
+     * package-manager lock file, so a warm dep cache restored the sibling's STALE
+     * build over the fresh clone on every run. This enters the dep POINTER key
+     * only; the immutable `{depsHash}.tar.gz` object keeps its own content
+     * addressing, and `contentHash` is untouched (siblings ship in the deps
+     * tarball, not the source one, so folding them in would make the source
+     * digest unverifiable against the extracted tree).
+     *
+     * Absent when `.kici` depends on no in-repo sibling, which is the common case.
+     */
+    readonly siblingsDigest?: string;
     readonly workflows: readonly LockWorkflow[];
 }
 /** Type guard for static jobs */
@@ -1114,5 +1154,16 @@ export interface SimulatedEvent {
     /** Repository identifier where the event occurred (e.g., "owner/repo").
      *  Used by global workflow repo pattern matching. */
     sourceRepo?: string;
+    /**
+     * `owner/repo` of the pull-request HEAD — where a contributor's code actually
+     * lives. Set only for PR-family events; equals the base repository for a
+     * same-repo PR and names the fork for a fork PR.
+     *
+     * Distinct from {@link SimulatedEvent.sourceRepo}, which is the repository the
+     * event OCCURRED in (the base repository for a PR) and drives global-workflow
+     * repo pattern matching. Conflating the two is what let a fork PR present as
+     * a same-repo one.
+     */
+    headRepo?: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/trigger/types.js

@@ -43,13 +43,17 @@ import { z } from "zod";
 * Schema version 38 (additive): adds container.auth (private-registry credentials for the job image).
 * Schema version 39 (additive): adds container.dockerfile/context/target/args (build the
 *   job's image from a Dockerfile in the repo) and container.auth.registry.
+* Schema version 40 (additive): adds LockFile.siblingsDigest (the in-repo `workspace:`
+*   sibling closure the deps tarball carries, which no package-manager lock file moves).
+* Schema version 41 (additive): adds LockDynamicJobFn.gitCredentials (named git credential
+*   refs declared by a dynamicJob generator and inherited by every job it generates).
 */
 /**
 * Schema version the compiler emits into every lock file. Incremented on ANY
 * schema change (additive or breaking); the bump-history comment above records
 * which. See `BREAKING_FLOOR` for the compatibility-window semantics.
 */
-const SCHEMA_VERSION = 39;
+const SCHEMA_VERSION = 41;
 /**
 * Oldest lock schema version this codebase can still read correctly — the lower
 * bound of the acceptance window.

package/dist/ws/close-codes.d.ts

@@ -44,4 +44,12 @@ export declare const WS_CLOSE_REBALANCE = 4030;
  * destroyed by their normal lifecycle; static agents reconnect and re-sync).
  */
 export declare const WS_CLOSE_DISPATCH_ACK_TIMEOUT = 4031;
+/**
+ * The connection was replaced: the same agent registered on a newer socket, so
+ * this one is a ghost. It is closed at registration time rather than left to
+ * the OS or the WS ping, because a half-open socket that closes later carries
+ * the same agent id and would otherwise tear down the live registration. The
+ * agent is already connected on the newer socket and does not reconnect.
+ */
+export declare const WS_CLOSE_SUPERSEDED_BY_RECONNECT = 4032;
 //# sourceMappingURL=close-codes.d.ts.map

package/dist/ws/close-codes.js

@@ -46,7 +46,15 @@ const WS_CLOSE_REBALANCE = 4030;
 * destroyed by their normal lifecycle; static agents reconnect and re-sync).
 */
 const WS_CLOSE_DISPATCH_ACK_TIMEOUT = 4031;
+/**
+* The connection was replaced: the same agent registered on a newer socket, so
+* this one is a ghost. It is closed at registration time rather than left to
+* the OS or the WS ping, because a half-open socket that closes later carries
+* the same agent id and would otherwise tear down the live registration. The
+* agent is already connected on the newer socket and does not reconnect.
+*/
+const WS_CLOSE_SUPERSEDED_BY_RECONNECT = 4032;
 //#endregion
-export { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_UNAUTHORIZED };
+export { WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED };
 
 //# sourceMappingURL=close-codes.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.6.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.6.0/257d679c-2415-4ce3-b560-a0cc82187192",
+  "name": "@kici-dev/engine@0.7.0",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.7.0/503b5e34-6f3f-49dc-895a-92d03dba6006",
   "creationInfo": {
-    "created": "2026-09-01T13:57:11Z",
+    "created": "2026-09-11T07:37:30Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.6.0",
+      "versionInfo": "0.7.0",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.6.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.7.0"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",