@kici-dev/orchestrator 0.1.15 → 0.1.16

package/dist/storage/filesystem.d.ts

@@ -13,7 +13,7 @@
  * data file is byte-identical to what the agent receives over HTTP. TTL is
  * enforced lazily on access — same model as the S3 backend.
  */
-import type { CacheStorage } from './types.js';
+import type { CacheMetadata, CacheStorage } from './types.js';
 export interface FilesystemCacheStorageOptions {
     /** Absolute path to the cache root directory. Created on first write if missing. */
     basePath: string;
@@ -55,6 +55,7 @@ export declare class FilesystemCacheStorage implements CacheStorage {
     getInternalUploadUrl(key: string): Promise<string>;
     initMeta(key: string): Promise<void>;
     list(subPrefix: string): Promise<string[]>;
+    getMetadata(key: string): Promise<CacheMetadata | null>;
     copy(srcKey: string, destKey: string): Promise<void>;
     /**
      * Recursively collect data files under `dir`, returning each as a cache key

package/dist/storage/s3.d.ts

@@ -11,7 +11,7 @@
  * TTL is enforced lazily: expired items are deleted on access.
  * Pre-signed URLs are generated for getUrl() with 15-minute expiry.
  */
-import type { CacheStorage } from './types.js';
+import type { CacheMetadata, CacheStorage } from './types.js';
 export interface S3CacheStorageOptions {
     bucket: string;
     prefix: string;
@@ -74,6 +74,7 @@ export declare class S3CacheStorage implements CacheStorage {
     getInternalUploadUrl(key: string): Promise<string>;
     initMeta(key: string): Promise<void>;
     list(subPrefix: string): Promise<string[]>;
+    getMetadata(key: string): Promise<CacheMetadata | null>;
     copy(srcKey: string, destKey: string): Promise<void>;
     /** Delete an S3 object. Idempotent (doesn't error if missing). */
     private deleteObject;

package/dist/storage/types.d.ts

@@ -79,6 +79,13 @@ export interface CacheStorage {
     list(subPrefix: string): Promise<string[]>;
     /** Server-side copy from one cache key to another (used for atomic temp -> final commit). */
     copy(srcKey: string, destKey: string): Promise<void>;
+    /**
+     * Read the stored metadata (createdAt + lastAccessedAt) for a key WITHOUT
+     * refreshing lastAccessedAt. Returns null when the key is missing or carries
+     * no metadata. A pure read (no TTL-expiry side effect) — used by quota
+     * eviction to order candidates by access recency.
+     */
+    getMetadata(key: string): Promise<CacheMetadata | null>;
 }
 import type { SharedS3Config } from '@kici-dev/shared';
 /**

package/dist/ws/agent-handler.d.ts

@@ -31,6 +31,7 @@ import type { PendingDynamicTracker } from '../cache/pending-dynamics.js';
 import type { CacheStorage } from '../storage/types.js';
 import type { AgentMetricsAggregator } from '../metrics/agent-metrics-aggregator.js';
 import type { AgentApiRegistry } from './agent-api-registry.js';
+import type { FleetAgentCollector } from './fleet-agent-collector.js';
 /**
  * Run the three token-bound authorization gates against a wire-supplied
  * `agent.register` payload. The gates are identical at first register
@@ -208,6 +209,30 @@ export interface AgentWsHandlerDeps {
         action: 'proceed' | 'wait' | 'cancel';
         reason?: string;
     }>;
+    /**
+     * Optional callback when an agent blocks a `requireApproval` step. The server
+     * creates a step-scoped hold from the carried clauses and returns a promise
+     * that resolves when the hold is approved, rejected, or expired. The handler
+     * relays the resolution back to the originating agent as a
+     * `step.approval-resolved` message. The `agentId` lets the server drop the
+     * pending resolver when the agent disconnects.
+     */
+    onStepApproval?: (agentId: string, msg: {
+        runId: string;
+        jobId: string;
+        stepIndex: number;
+        stepName: string;
+        clauses: Array<{
+            team: string;
+        } | {
+            user: string;
+        }>;
+        reason: string;
+        timeoutSeconds?: number;
+    }) => Promise<{
+        outcome: 'approved' | 'rejected' | 'expired';
+        reason?: string;
+    }>;
     /**
      * Optional callback fired when an agent's WS connection closes, after the
      * dispatcher's own cleanup has run. Used by the long-poll concurrency
@@ -217,6 +242,13 @@ export interface AgentWsHandlerDeps {
     onConcurrencyAgentDisconnect?: (agentId: string) => void | Promise<void>;
     /** Agent private API registry for handling agent.api.request messages. */
     agentApiRegistry?: AgentApiRegistry;
+    /**
+     * Orchestrator-scoped collector that correlates fleet.logs.request with the
+     * agent's chunked fleet.bundle.chunk / fleet.bundle.error response. Routed to
+     * from the incoming-message switch; pending requests for a given agent are
+     * rejected when that agent's WS closes.
+     */
+    fleetAgentCollector?: FleetAgentCollector;
 }
 export declare function createAgentWsHandler(deps: AgentWsHandlerDeps): WSEvents;
 //# sourceMappingURL=agent-handler.d.ts.map

package/dist/ws/dashboard-env-handler.d.ts

@@ -11,6 +11,8 @@
  * 3. Returns a response message with requestId and data (or error)
  */
 import { type Kysely } from 'kysely';
+import type { HeldRunStore, ReleaseSignal } from '../environments/held-runs.js';
+import type { TeamMembershipLookup } from '../approvals/approval-resolver.js';
 import type { DashboardPlatformToOrchMessage } from '@kici-dev/engine';
 import type { EnvironmentStore } from '../environments/environment-store.js';
 import type { VariableStore } from '../environments/variable-store.js';
@@ -44,6 +46,26 @@ export interface DashboardEnvHandlerDeps {
     accessLog?: AccessLogWriter;
     /** Routing key for access_log rows (null when not run-scoped). */
     routingKey?: string | null;
+    /**
+     * Held-run store + resume hook for the approve/reject flow. When present, the
+     * approve/reject handlers route through the shared `applyDecision` applier
+     * (eligibility check, real attribution, multi-clause accumulation, and the
+     * resume-after-approval re-dispatch). When absent (legacy / tests), the
+     * handlers fall back to the direct status flip.
+     */
+    approvals?: ApprovalHandlerDeps;
+}
+/** Dependencies enabling the resolver-backed approve/reject + resume path. */
+export interface ApprovalHandlerDeps {
+    store: HeldRunStore;
+    /** Team name → member user ids (Plan-1 trust-policy cache). */
+    teamMembershipLookup: TeamMembershipLookup;
+    /** Re-dispatch a released job/workflow hold (consumes its pending context). */
+    resumeJob: (signal: ReleaseSignal) => Promise<void>;
+    /** Notify a waiting agent that a step hold released (step scope). */
+    resumeStep?: (signal: ReleaseSignal) => Promise<void>;
+    /** Notify a waiting agent that a step hold was rejected (step scope). */
+    rejectStep?: (heldRunId: string, reason?: string) => Promise<void> | void;
 }
 /**
  * Handler for all dashboard environment and held run WS messages.
@@ -107,6 +129,19 @@ export declare class DashboardEnvHandler {
     private handleScopeDelete;
     private handleEnvHistory;
     private handleHeldRunsList;
+    /**
+     * Resolve the actor's Keycloak sub for approval attribution. Only `user` and
+     * `platform_operator` actors carry a `sub`; others fall back to a stable id.
+     */
+    private actorSub;
+    /** Read org_settings.allow_self_approval (default true). */
+    private readAllowSelfApproval;
+    /**
+     * Route an approve/reject through the shared `applyDecision` applier:
+     * eligibility check, real attribution, multi-clause accumulation, and the
+     * resume-after-approval re-dispatch. Sends the matching response message.
+     */
+    private applyApprovalDecision;
     private handleHeldRunApprove;
     private handleHeldRunReject;
     private sendError;

package/dist/ws/fleet-agent-collector.d.ts

@@ -0,0 +1,23 @@
+export interface FleetAgentCollectorOptions {
+    timeoutMs: number;
+}
+export declare class FleetAgentCollector {
+    private readonly opts;
+    private readonly waiter;
+    /** requestId -> owning agentId, so a disconnect rejects only that agent's requests. */
+    private readonly requestAgent;
+    constructor(opts: FleetAgentCollectorOptions);
+    /**
+     * Register the pending request `requestId` (owned by `agentId`), invoke
+     * `send` to dispatch the fleet.logs.request envelope, and await the
+     * reassembled bundle Buffer.
+     */
+    request(requestId: string, agentId: string, send: () => void): Promise<Buffer>;
+    onChunk(requestId: string, seq: number, dataB64: string, isLast: boolean): void;
+    onError(requestId: string, message: string): void;
+    /** Reject every pending request owned by `agentId` (called on its disconnect). */
+    rejectAgent(agentId: string, reason: string): void;
+    /** Reject every pending request regardless of owner (orchestrator shutdown). */
+    rejectAll(reason: string): void;
+}
+//# sourceMappingURL=fleet-agent-collector.d.ts.map

package/installer-image-digests.json

@@ -0,0 +1,7 @@
+{
+  "version": "0.1.16",
+  "images": {
+    "kici-agent": "sha256:817dfadfe941eb9e9096724c58d7af6d53665d813de0bc952c31090347b959da",
+    "kici-orchestrator": "sha256:85dd71ae39df06dad94defc19cc9152621640a5324e2008a83813cac001d979e"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "ci",
@@ -30,7 +30,8 @@
   "files": [
     "dist",
     "!dist/**/*.map",
-    "sbom.spdx.json"
+    "sbom.spdx.json",
+    "installer-image-digests.json"
   ],
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -85,8 +86,8 @@
     "ws": "^8.20.0",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@kici-dev/engine": "0.1.15",
-    "@kici-dev/shared": "0.1.15"
+    "@kici-dev/engine": "0.1.16",
+    "@kici-dev/shared": "0.1.16"
   },
   "kici": {
     "metrics": {
@@ -100,7 +101,7 @@
     "@types/archiver": "^7.0.0",
     "@types/dockerode": "^4.0.1",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/agent": "0.1.15"
+    "@kici-dev/agent": "0.1.16"
   },
   "scripts": {
     "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.1.15",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.15/098f67ed-8ddb-4745-a28c-e2c731216540",
+  "name": "@kici-dev/orchestrator@0.1.16",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.16/6b96d055-7c14-4de7-933b-c4d260b0d312",
   "creationInfo": {
-    "created": "2026-06-11T03:03:47Z",
+    "created": "2026-06-12T09:41:54Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1477,9 +1477,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.16",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.15",
+      "versionInfo": "0.1.16",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1490,16 +1490,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.15"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.16"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.15",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.16",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.15",
+      "versionInfo": "0.1.16",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1510,7 +1510,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.15"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.16"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1519,7 +1519,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.1.15",
+      "versionInfo": "0.1.16",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1530,16 +1530,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.15"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.16"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.15",
+      "versionInfo": "0.1.16",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1550,7 +1550,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.15"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.16"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -7737,10 +7737,10 @@
       "homepage": "https://github.com/browserify/stream-browserify"
     },
     {
-      "SPDXID": "SPDXRef-Package-streamx-2.23.0",
+      "SPDXID": "SPDXRef-Package-streamx-2.25.0",
       "name": "streamx",
-      "versionInfo": "2.23.0",
-      "downloadLocation": "https://registry.npmjs.org/streamx/-/streamx-2.23.0.tgz",
+      "versionInfo": "2.25.0",
+      "downloadLocation": "https://registry.npmjs.org/streamx/-/streamx-2.25.0.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "MIT",
@@ -7750,7 +7750,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/streamx@2.23.0"
+          "referenceLocator": "pkg:npm/streamx@2.25.0"
         }
       ],
       "description": "An iteration of the Node.js core streams with a series of improvements",
@@ -10702,47 +10702,47 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
@@ -10778,12 +10778,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.16",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -10887,107 +10887,112 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1038.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.16",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.28.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.40.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
+      "relatedSpdxElement": "SPDXRef-Package-archiver-7.0.1",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-diff-7.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.18",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.16",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
@@ -13148,7 +13153,7 @@
     },
     {
       "spdxElementId": "SPDXRef-Package-bare-stream-2.8.1",
-      "relatedSpdxElement": "SPDXRef-Package-streamx-2.23.0",
+      "relatedSpdxElement": "SPDXRef-Package-streamx-2.25.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -14082,17 +14087,17 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package-streamx-2.23.0",
+      "spdxElementId": "SPDXRef-Package-streamx-2.25.0",
       "relatedSpdxElement": "SPDXRef-Package-events-universal-1.0.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package-streamx-2.23.0",
+      "spdxElementId": "SPDXRef-Package-streamx-2.25.0",
       "relatedSpdxElement": "SPDXRef-Package-fast-fifo-1.3.2",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package-streamx-2.23.0",
+      "spdxElementId": "SPDXRef-Package-streamx-2.25.0",
       "relatedSpdxElement": "SPDXRef-Package-text-decoder-1.2.7",
       "relationshipType": "DEPENDS_ON"
     },
@@ -14208,7 +14213,7 @@
     },
     {
       "spdxElementId": "SPDXRef-Package-tar-stream-3.1.8",
-      "relatedSpdxElement": "SPDXRef-Package-streamx-2.23.0",
+      "relatedSpdxElement": "SPDXRef-Package-streamx-2.25.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -14238,7 +14243,7 @@
     },
     {
       "spdxElementId": "SPDXRef-Package-teex-1.0.1",
-      "relatedSpdxElement": "SPDXRef-Package-streamx-2.23.0",
+      "relatedSpdxElement": "SPDXRef-Package-streamx-2.25.0",
       "relationshipType": "DEPENDS_ON"
     },
     {