@kici-dev/orchestrator 0.1.2 → 0.1.5

package/dist/webhook/generic-sources-listener.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Cross-peer propagation of generic-webhook-source registration changes.
+ *
+ * Sister to the GitHub-app `SourceManager`
+ * (`packages/orchestrator/src/sources/source-manager.ts`), which owns the
+ * `sources_change` channel. This listener owns `generic_sources_change`
+ * — the channel the migration-019 trigger emits on every INSERT, UPDATE,
+ * or DELETE of a `generic_webhook_sources` row.
+ *
+ * On NOTIFY:
+ *   1. Queue the affected `routing_key` (the channel payload).
+ *   2. Debounce 200 ms so rapid edits coalesce into one drain pass.
+ *   3. For each queued routing_key:
+ *        - Re-query `GenericSourceManager.getByRoutingKey()`. The query
+ *          already filters out soft-deleted (`deleted_at IS NOT NULL`)
+ *          and disabled (`enabled = false`) rows.
+ *        - If the row is gone (DELETE, soft-delete, or disable):
+ *          `providerRegistry.unregister(routingKey)`.
+ *        - Otherwise: `registerProviderBundleForSource(row, deps)`
+ *          (idempotent — a second call replaces the prior bundle).
+ *
+ * The listener does NOT own the `ProviderRegistry` — it mutates the
+ * shared instance the rest of the orchestrator dispatches against. This
+ * differs from `SourceManager`, which rebuilds a fresh registry on
+ * every reload and asks the caller to swap the reference. The reason is
+ * shared ownership: the GitHub-app and generic-webhook sources both
+ * populate the same `ProviderRegistry` instance, so a wholesale rebuild
+ * by one of them would clobber the other's bundles.
+ *
+ * The admin POST/PATCH/DELETE handlers in `routes/admin-events.ts` ALSO
+ * mutate the registry inline so the API response is self-consistent on
+ * the issuing peer (a webhook fired immediately after a 200 OK sees the
+ * change without waiting for the NOTIFY round-trip). The local NOTIFY
+ * fires too — `registerByRoutingKey` is idempotent, so the redundant
+ * apply is harmless.
+ */
+import type pg from 'pg';
+import type { GenericSourceManager } from './generic-sources.js';
+import type { ProviderRegistry } from '../provider-registry.js';
+import type { AppConfig } from '../config.js';
+import type { SecretResolver } from '../secrets/secret-resolver.js';
+export interface GenericSourcesChangeListenerOptions {
+    /** Raw pg pool — a dedicated PoolClient is checked out for LISTEN. */
+    pool: pg.Pool;
+    /** Used to re-query the affected row by routing_key on each NOTIFY. */
+    sourceManager: GenericSourceManager;
+    /** Mutated in place — registerByRoutingKey / unregister. */
+    providerRegistry: ProviderRegistry;
+    /** Gates internal-provider bundle registration in the helper. */
+    config: AppConfig;
+    /** Required for universal-git source rows; null is acceptable on
+     *  peers that cannot serve them. */
+    secretResolver: SecretResolver | null;
+    /** Coalesce window for rapid NOTIFYs against the same row. Default 200 ms. */
+    debounceMs?: number;
+}
+export declare class GenericSourcesChangeListener {
+    private readonly opts;
+    private client;
+    private readonly pending;
+    private debounceTimer;
+    private readonly debounceMs;
+    constructor(opts: GenericSourcesChangeListenerOptions);
+    /** Open the dedicated client and subscribe. Cold-boot bundle
+     *  registration is handled by the orchestrator-core startup loop
+     *  via the same helper; this listener only services warm-path
+     *  NOTIFYs. */
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    private scheduleDrain;
+    /** Visible for tests — drain the queued routing_keys synchronously. */
+    drain(): Promise<void>;
+}
+//# sourceMappingURL=generic-sources-listener.d.ts.map

package/dist/webhook/register-source-bundle.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Per-source provider-bundle registration.
+ *
+ * Three call sites need this logic; the helper exists so they don't
+ * each carry a copy of the `provider_type` / `git_config` dispatch:
+ *
+ *   1. `orchestrator-core.ts` startup, where it loops over every source
+ *      already in `generic_webhook_sources` and registers the matching
+ *      provider bundle into `ProviderRegistry`. Cold-boot path.
+ *   2. The admin HTTP handlers in `admin-events.ts` —
+ *      `POST /api/v1/admin/generic-sources` and the matching PATCH /
+ *      DELETE / enable / disable endpoints. Calling the helper inline
+ *      makes the API response self-consistent on the issuing peer (a
+ *      webhook fired immediately after the 200 reaches the right
+ *      normalizer without waiting for the `pg_notify` round-trip).
+ *   3. `GenericSourcesChangeListener` (`webhook/generic-sources-listener.ts`),
+ *      which listens for the migration-019 `pg_notify('generic_sources_change',
+ *      routing_key)` and applies the change on every other peer in the
+ *      HA cluster.
+ *
+ * `registerProviderBundleForSource` is the single source of truth. It
+ * dispatches on `row.provider_type` and `row.git_config` so callers
+ * don't have to know which bundle to build — they hand over the row +
+ * the orchestrator's already-instantiated registry / config /
+ * secret-resolver and we do the right thing.
+ *
+ * Failure semantics match the startup behaviour: internal-only-but-
+ * unservable peers log + skip (no throw); universal-git config errors
+ * bump the per-row metric + log but never propagate. The caller can
+ * assume "returns normally" means "the right thing happened or we
+ * recorded why it didn't".
+ */
+import type { AppConfig } from '../config.js';
+import type { ProviderRegistry } from '../provider-registry.js';
+import type { SecretResolver } from '../secrets/secret-resolver.js';
+import type { GenericWebhookSource } from '../db/types.js';
+export interface RegisterSourceBundleDeps {
+    providerRegistry: ProviderRegistry;
+    config: AppConfig;
+    /** Required for universal-git source rows. Null is allowed; rows that
+     *  carry `git_config` will be skipped with a metric bump. */
+    secretResolver: SecretResolver | null;
+}
+/**
+ * Register the per-routing-key provider bundle a source row needs.
+ *
+ *   - `provider_type='internal'`: registers an `InternalWebhookNormalizer`
+ *     bundle when the peer can serve it (gated on
+ *     `internalProviderRepoPath` per `canServeGenericProviderType`).
+ *   - `git_config IS NOT NULL`: registers a universal-git bundle.
+ *   - everything else: no-op — the default `'generic'` bundle handles it.
+ *
+ * Idempotent under `ProviderRegistry.registerByRoutingKey` semantics: a
+ * second call with the same routing key replaces the prior bundle.
+ */
+export declare function registerProviderBundleForSource(row: GenericWebhookSource, deps: RegisterSourceBundleDeps): void;
+//# sourceMappingURL=register-source-bundle.d.ts.map

package/dist/ws/dashboard-backends-handler.d.ts

@@ -2,12 +2,16 @@ import type { BackendSyncManager, DashboardPlatformToOrchMessage } from '@kici-d
 import type { BackendRegistry } from '../secrets/backend-registry.js';
 import type { BackendHealthChecker } from '../secrets/backend-health.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
 interface DashboardBackendsHandlerDeps {
     /** Send a response message back to Platform over the WS connection. */
     send: (msg: unknown) => void;
     registry: BackendRegistry;
     healthChecker: BackendHealthChecker;
     syncManager?: BackendSyncManager;
+    /** Database — required for dashboard-write policy lookups. */
+    db: Kysely<Database>;
     /** Access log writer — records one row per read / mutation with actor attribution. */
     accessLog?: AccessLogWriter;
     /** Org ID for access_log rows (null when the orchestrator isn't org-scoped). */
@@ -31,6 +35,16 @@ export declare class DashboardBackendsHandler {
      * the single tenant org from the `sources` / `generic_webhook_sources` table.
      */
     setOrgContext(orgId: string | null, routingKey: string | null): void;
+    /**
+     * Defense-in-depth dashboard-write policy gate. Returns true when the
+     * operation is allowed and the caller should proceed. Returns false
+     * when the policy is disabled — also records a `denied` access_log row
+     * and emits a structured `operation_disabled` envelope on the WS.
+     *
+     * Fails open when no org is bound — the orch hasn't resolved a
+     * customer yet, so there's nothing to look up.
+     */
+    private enforcePolicy;
     /**
      * Write an access_log row for a handler invocation. Best-effort; the writer
      * swallows failures.

package/dist/ws/dashboard-env-handler.d.ts

@@ -59,6 +59,13 @@ export declare class DashboardEnvHandler {
     setOrgId(orgId: string): void;
     /** Update the routing key bound to access_log rows. */
     setRoutingKey(routingKey: string | null): void;
+    /**
+     * Defense-in-depth dashboard-write policy gate. Returns true when the
+     * operation is allowed and the caller should proceed. Returns false when
+     * the policy is disabled — also records a `denied` access_log row and
+     * sends a structured `operation_disabled` envelope back to Platform.
+     */
+    private enforcePolicy;
     /**
      * Write an access_log row for a handler invocation. Uses the handler's
      * bound orgId + routingKey, the msg.actor principal, and the handler-

package/dist/ws/dashboard-global-workflows-handler.d.ts

@@ -38,6 +38,12 @@ export declare class DashboardGlobalWorkflowsHandler {
     constructor(deps: DashboardGlobalWorkflowsHandlerDeps);
     /** Update the customer / org id this handler operates on. */
     setOrgId(customerId: string | null): void;
+    /**
+     * Defense-in-depth dashboard-write policy gate. Returns true when the
+     * operation is allowed; false (with a structured `operation_disabled`
+     * envelope and a `denied` access_log row) when policy says no.
+     */
+    private enforcePolicy;
     /**
      * Write an access_log row for a handler invocation. Best-effort; the writer
      * swallows failures.

package/dist/ws/dashboard-registrations-handler.d.ts

@@ -57,6 +57,13 @@ export declare class DashboardRegistrationsHandler {
     setOrgId(orgId: string): void;
     /** Update the routing key bound to access_log rows. */
     setRoutingKey(routingKey: string | null): void;
+    /**
+     * Defense-in-depth dashboard-write policy gate. Returns true when the
+     * operation is allowed and the caller should proceed. Returns false
+     * when the policy is disabled — also records a `denied` access_log row
+     * and emits a structured `operation_disabled` envelope on the WS.
+     */
+    private enforcePolicy;
     /**
      * Write an access_log row for a handler invocation. Uses the handler's
      * bound orgId + routingKey, the msg.actor principal, and the handler-

package/dist/ws/platform-client.d.ts

@@ -36,6 +36,20 @@ export interface PlatformClientOptions {
     providerSources?: ProviderSource[];
     /** Orchestrator cluster instance ID (sent in source.register for peer correlation). */
     instanceId?: string;
+    /**
+     * Human-friendly cluster name resolved on orch boot
+     * (`cluster_meta.cluster_name`). Sent in source.register so Platform
+     * can route per-orch dashboard requests by this identifier.
+     */
+    clusterName?: string;
+    /**
+     * Orchestrator DB identifier (UUID, seeded by migration 001 in
+     * `cluster_meta` key `'cluster_id'`). Sent in source.register so
+     * Platform can warn when two unrelated clusters in the same org
+     * accidentally share a `clusterName`. HA siblings share the same orch
+     * DB and therefore the same `clusterId`.
+     */
+    clusterId?: string;
     /** Reachable address for peer-to-peer connections (from KICI_CLUSTER_ADDRESS env var). Null if not configured. */
     address?: string | null;
     /** Orchestrator version string (e.g. "0.0.1"). Sent in source.register for diagnostics. */
@@ -141,6 +155,8 @@ export declare class PlatformClient {
     private readonly onWebhookRelay;
     private providerSources;
     private readonly instanceId?;
+    private readonly clusterName?;
+    private readonly clusterId?;
     private readonly address?;
     private readonly version?;
     private readonly mode?;
@@ -166,7 +182,7 @@ export declare class PlatformClient {
     private readonly onTrustPolicyUpdate?;
     private readonly onStaleCheckrunCleanup?;
     private readonly onJoinRequest?;
-    private readonly orchCapabilities;
+    private orchCapabilities;
     private readonly onVerifyInbound?;
     private readonly relayBuffer;
     /**
@@ -184,6 +200,19 @@ export declare class PlatformClient {
      */
     getOrgPublicAlias(): string | undefined;
     constructor(options: PlatformClientOptions);
+    /**
+     * Merge `updates` into the stored orch capabilities and broadcast the
+     * full set to Platform via `orch.capabilities.update`. Buffers via
+     * `send()` when not yet authenticated. The next `auth.request` will
+     * also carry the merged capabilities, so a reconnect-followed-by-
+     * runtime-broadcast still ends Platform in the correct cache state.
+     */
+    broadcastCapabilities(updates: Partial<OrchCapabilities>): void;
+    /**
+     * Current merged orchestrator capabilities. Read-only view used by
+     * tests and diagnostics; mutate via `broadcastCapabilities`.
+     */
+    getCapabilities(): OrchCapabilities;
     /** Current connection state. */
     get state(): ConnectionState;
     /** Number of messages currently buffered. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.1.2",
+  "version": "0.1.5",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "kici",
@@ -80,8 +80,8 @@
     "ws": "^8.20.0",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@kici-dev/engine": "0.1.2",
-    "@kici-dev/shared": "0.1.2"
+    "@kici-dev/engine": "0.1.5",
+    "@kici-dev/shared": "0.1.5"
   },
   "kici": {
     "metrics": {

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.1.2",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.2/1d9e1ce0-5863-4254-ad10-52256d934202",
+  "name": "@kici-dev/orchestrator@0.1.5",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.5/f7580817-f3f2-47bc-964e-be4abe428a71",
   "creationInfo": {
-    "created": "2026-05-15T11:44:11Z",
+    "created": "2026-05-25T13:20:51Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1477,9 +1477,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.2",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.5",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.2",
+      "versionInfo": "0.1.5",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1490,7 +1490,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.2"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.5"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1499,7 +1499,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.1.2",
+      "versionInfo": "0.1.5",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1510,16 +1510,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.2"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.5"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.2",
+      "versionInfo": "0.1.5",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1530,7 +1530,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.2"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.5"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -10682,17 +10682,17 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
@@ -10728,12 +10728,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.2",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -10837,97 +10837,102 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1038.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.28.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.40.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-diff-7.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.18",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
+      "relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.2",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.5",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },