@kici-dev/orchestrator 0.1.24 → 0.1.26

package/dist/webhook/dedup.d.ts

@@ -24,6 +24,20 @@ export declare class DedupCache {
      * Idempotent -- duplicate marks are silently ignored.
      */
     mark(deliveryId: string): Promise<void>;
+    /**
+     * Atomically claim a delivery ID. Returns `true` when this call inserted the
+     * row (the caller owns this delivery — proceed), `false` when a row already
+     * existed (duplicate — drop it).
+     *
+     * This replaces the historic `exists()`-then-`mark()` check-then-act, which
+     * raced across cluster instances: behind an external load balancer, GitHub's
+     * own retries and LB retries can fan the same `X-GitHub-Delivery` to two
+     * instances concurrently — both passed `exists()` and both dispatched. The
+     * single `INSERT … ON CONFLICT (delivery_id) DO NOTHING` is the atomic
+     * arbiter backed by the `dedup_cache` primary key, so exactly one caller
+     * wins regardless of how many instances receive the same delivery.
+     */
+    claim(deliveryId: string): Promise<boolean>;
     /**
      * Remove expired entries from the database.
      * Also trims the in-memory cache to MAX_MEMORY_CACHE_SIZE.

package/dist/ws/agent-handler.d.ts

@@ -213,6 +213,29 @@ export interface AgentWsHandlerDeps {
         verifyReason: string | null;
         verifiedAt: Date | null;
     }) => Promise<void>;
+    /**
+     * Optional callback when an agent reports a deferred attestation (transient
+     * mint failure). Persists the frozen envelope into the deferred-attestation
+     * outbox; the job stays green and the token is minted later.
+     */
+    onProvenanceDefer?: (record: {
+        runId: string;
+        jobId: string;
+        subjectName: string;
+        subjectDigest: string;
+        audience: string;
+        mediaType: string;
+        statementHash: string;
+        dsseEnvelope: unknown;
+        publicKey: unknown;
+        originKind: 'deferred' | 'offline-backfill';
+    }) => Promise<void>;
+    /**
+     * Classify a deferred attestation's origin from the local run row: a run
+     * ingested while the Platform was down is `offline-backfill`, otherwise a
+     * transient blip is `deferred`. Defaults to always-`deferred` when unset.
+     */
+    classifyDeferOrigin?: (runId: string) => Promise<'deferred' | 'offline-backfill'>;
     /** Optional rate limiter configuration. */
     rateLimiterConfig?: RateLimiterConfig;
     /** Optional ownership tracker for validating job-related messages. */

package/dist/ws/oidc-token-relay.d.ts

@@ -4,39 +4,43 @@
  * Backs the `oidc.token.request` agent.api method: an agent asks for a
  * short-lived OIDC ID token for a job it is running; the orchestrator verifies
  * the agent owns that job, resolves its runId from its own dispatch state, and
- * relays a mint request to the Platform's token-mint endpoint over HTTPS using
- * the orchestrator's own `KICI_PLATFORM_TOKEN`. The agent never holds Platform
- * credentials and never asserts its own identity claims — the Platform derives
- * every identity claim from its own run/job rows.
+ * relays a mint request to the Platform over the authenticated orchestrator↔
+ * Platform WebSocket (orchestrator-initiated RPC). The agent never holds
+ * Platform credentials and never asserts its own identity claims — the Platform
+ * derives every identity claim from its own run/job rows.
  */
-import { type OidcTokenResult } from '@kici-dev/engine/protocol/messages/oidc-token-relay';
-/** 404 / 409: the run/job is missing on the Platform or the job is terminal. */
+import { type OidcTokenResult, type DeferredMintParams } from '@kici-dev/engine/protocol/messages/oidc-token-relay';
+/** rejected: the run/job is missing on the Platform or the job is terminal. */
 export declare class MintRejectedError extends Error {
 }
-/** 503: provenance signing is not configured / the Platform is unavailable. */
+/** unavailable: provenance signing is not configured / the Platform is unavailable. */
 export declare class MintUnavailableError extends Error {
 }
-/** Any other non-2xx from the mint endpoint. */
+/** Any other failure (transport or Platform-side). */
 export declare class MintRelayError extends Error {
 }
-/**
- * Turn the Platform WS URL (`wss://host[/base]/ws`) into its HTTP base
- * (`https://host[/base]`). Maps the scheme and strips a trailing `/ws` while
- * preserving the host and any basePath in front of it.
- */
-export declare function deriveHttpBaseFromWsUrl(wsUrl: string): string;
+/** Minimal surface the relay needs from the Platform WS client. */
+export interface MintPlatformClient {
+    sendRequestAndAwait<Res>(type: 'oidc.mint.request', payload: Record<string, unknown>, timeoutMs?: number): Promise<Res>;
+}
 export interface RequestMintArgs {
-    httpBase: string;
-    token: string;
+    platformClient: MintPlatformClient;
     orchestratorId: string;
     runId: string;
     jobId: string;
     audience: string;
+    /**
+     * Deferred *fulfilment* mint: when set, the request knowingly targets a
+     * completed (terminal) job and binds the frozen statement hash + origin so
+     * the Platform relaxes its live-job check and stamps the mint-timing marker.
+     * The live agent path never sets this.
+     */
+    deferred?: DeferredMintParams;
 }
 /**
- * Call the Platform token-mint endpoint over HTTPS using the orchestrator's
- * Platform token. Maps non-2xx responses to typed errors so the agent always
- * sees a clear message instead of a raw 5xx body.
+ * Send a mint request over the WS and map the typed response to either a result
+ * or one of the three error classes. The user-facing strings are produced here
+ * (client-side) so they stay stable regardless of Platform wording.
  */
 export declare function requestMint(args: RequestMintArgs): Promise<OidcTokenResult>;
 export interface OidcTokenHandlerDeps {
@@ -45,9 +49,15 @@ export interface OidcTokenHandlerDeps {
             runId: string;
         } | undefined;
     };
-    platformToken: string;
-    platformHttpBase: string;
+    platformClient: MintPlatformClient;
     orchestratorId: string;
+    /** Test-only fault-injection master switch (config.testMode). */
+    testMode: boolean;
+    /**
+     * Test-only: force-defer the *initial* agent mint for any job requesting this
+     * OIDC audience (config.testMintDeferAudience). Ignored unless `testMode`.
+     */
+    testMintDeferAudience?: string;
 }
 /**
  * Build the agent.api handler for `OIDC_TOKEN_REQUEST_METHOD`. Validates the

package/dist/ws/orch-rpc.d.ts

@@ -0,0 +1,9 @@
+/** Platform->orch message types that resolve a pending orch-initiated request. */
+export declare const ORCH_RPC_RESPONSE_TYPES: ReadonlySet<string>;
+export declare class OrchRpcRegistry {
+    private readonly pending;
+    register(requestId: string, timeoutMs: number): Promise<unknown>;
+    resolve(requestId: string, msg: unknown): void;
+    rejectAll(err: Error): void;
+}
+//# sourceMappingURL=orch-rpc.d.ts.map

package/dist/ws/platform-client.d.ts

@@ -1,4 +1,4 @@
-import { type OrchestratorToPlatformMessage, type WebhookRelay, type WebhookRelayResult, type TrustPolicyUpdate, type StaleCheckrunCleanup, type DashboardRunDetailRequest, type DashboardRunStructuredRequest, type DashboardRunsListRequest, type DashboardRunsFiltersRequest, type DashboardSourcesListRequest, type DashboardStepLogsRequest, type DashboardAttestationsListRequest, type DashboardAttestationsListAllRequest, type DashboardAttestationGetRequest, type DashboardOrchLogsRequest, type RunRerunRequest, type ManualScheduleRequest, type RunCancelRequest, type DashboardPayloadRequest, type DashboardPlatformToOrchMessage, type TestRelayRequest, type DashboardDiagnosticsRequest, type DashboardScalerCapacityRequest, type DashboardScalerAgentsRequest, type DashboardFleetHostsRequest, type DashboardFleetHostRequest, type DashboardFleetPreviewRequest, type DashboardFleetWorkflowsForHostRequest, type JoinRequest, type JoinResponse, type DeploymentIdentity, type OrchCapabilities, type OrchRole } from '@kici-dev/engine';
+import { type OrchestratorToPlatformMessage, type WebhookRelay, type WebhookRelayResult, type TrustPolicyUpdate, type StaleCheckrunCleanup, type DashboardRunDetailRequest, type DashboardRunStructuredRequest, type DashboardRunsListRequest, type DashboardRunsFiltersRequest, type DashboardSourcesListRequest, type DashboardStepLogsRequest, type DashboardAttestationsListRequest, type DashboardAttestationsListAllRequest, type DashboardAttestationGetRequest, type DashboardAttestationRetryRequest, type DashboardOrchLogsRequest, type RunRerunRequest, type ManualScheduleRequest, type RunCancelRequest, type DashboardPayloadRequest, type DashboardPlatformToOrchMessage, type TestRelayRequest, type DashboardDiagnosticsRequest, type DashboardScalerCapacityRequest, type DashboardScalerAgentsRequest, type DashboardFleetHostsRequest, type DashboardFleetHostRequest, type DashboardFleetPreviewRequest, type DashboardFleetWorkflowsForHostRequest, type JoinRequest, type JoinResponse, type DeploymentIdentity, type OrchCapabilities, type OrchRole } from '@kici-dev/engine';
 import { RelayBufferRegistry, type RelayStartMeta } from '../webhook/relay-buffer.js';
 /**
  * Verification + processing outcome returned by the chunked relay path's
@@ -124,6 +124,7 @@ export interface PlatformClientOptions {
     onDashboardAttestationsListAll?: (msg: DashboardAttestationsListAllRequest) => void;
     /** Optional callback for single-attestation detail requests from Platform. */
     onDashboardAttestationGet?: (msg: DashboardAttestationGetRequest) => void;
+    onDashboardAttestationRetry?: (msg: DashboardAttestationRetryRequest) => void;
     /** Optional callback for run re-run requests from Platform (dashboard action). */
     onRunRerun?: (msg: RunRerunRequest) => void;
     /** Optional callback for manual schedule trigger requests from Platform (dashboard action). */
@@ -226,6 +227,12 @@ export declare class PlatformClient {
      * `source.register.ack` arrives, or rejected on timeout / disconnect.
      */
     private readonly pendingSourceRegistrations;
+    /**
+     * Generic orchestrator-initiated RPC correlation (e.g. the provenance OIDC
+     * mint). The orchestrator sends a `requestId`-keyed request over the WS and
+     * awaits the Platform's matching `.response`; rejected on timeout or close.
+     */
+    private readonly orchRpc;
     private readonly instanceId?;
     private readonly clusterName?;
     private readonly clusterId?;
@@ -252,6 +259,7 @@ export declare class PlatformClient {
     private readonly onDashboardAttestationsList?;
     private readonly onDashboardAttestationsListAll?;
     private readonly onDashboardAttestationGet?;
+    private readonly onDashboardAttestationRetry?;
     private readonly onRunRerun?;
     private readonly onManualSchedule?;
     private readonly onRunCancel?;
@@ -332,6 +340,15 @@ export declare class PlatformClient {
      * NOT in the OrchestratorToPlatformMessage union (they are in the separate log pull schema).
      */
     sendRaw(data: unknown): void;
+    /**
+     * Send an orchestrator-initiated request over the Platform WS and await its
+     * typed `.response`. The reverse of the Platform's dashboard-RPC pattern: we
+     * hold the pending map and resolve on the echoed requestId. Rejects on timeout
+     * or connection close; protocol-level errors arrive inside the response body.
+     * The request type is a member of the typed orch->Platform union, so it rides
+     * the validated `send()` path.
+     */
+    sendRequestAndAwait<Res>(type: OrchestratorToPlatformMessage['type'], payload: Record<string, unknown>, timeoutMs?: number): Promise<Res>;
     /**
      * Register a new source at runtime (e.g., after config reload adds a new GitHub app).
      * Separate from the post-auth registration which sends all sources at once.

package/dist/ws/test-relay-handlers.d.ts

@@ -58,6 +58,8 @@ export interface TestTriggerPayload {
     status: 'accepted' | 'rejected';
     reason?: string;
     jobIds: string[];
+    /** User-visible warnings on acceptance (e.g. skipped non-test bound environments). */
+    warnings?: string[];
 }
 /**
  * Resolve the overlay tarball URL + decryption keys from the upload record, then

package/installer-image-digests.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.1.24",
+  "version": "0.1.26",
   "images": {
-    "kici-agent": "sha256:1e02f0cda7f398d72b2e95dd74f9c67fb5a8b041307886ef85a6eae3024c7a4e",
-    "kici-orchestrator": "sha256:9aa83c19f39b3f80d62f328af57a38a681670766ed2ec7f46dabecd11e82538b"
+    "kici-agent": "sha256:f53aeb2bc7c0da72461fbbbe13c94b119ed2c3ed564e2c3f528acde58124a6a9",
+    "kici-orchestrator": "sha256:eff0bddaff3ee355aeb1f05c46ea773cef75b57d04d18919068329f758aa63fb"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "ci",
@@ -71,6 +71,7 @@
     "dockerode": "^5.0.0",
     "hashi-vault-js": "^0.5.1",
     "hono": "^4.12.25",
+    "jose": "^6.1.0",
     "jsonpath-plus": "^10.4.0",
     "jszip": "^3.10.1",
     "kysely": "^0.29.2",
@@ -83,8 +84,8 @@
     "ws": "^8.21.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "@kici-dev/engine": "0.1.24",
-    "@kici-dev/shared": "0.1.24"
+    "@kici-dev/engine": "0.1.26",
+    "@kici-dev/shared": "0.1.26"
   },
   "kici": {
     "metrics": {
@@ -97,9 +98,8 @@
   "devDependencies": {
     "@types/archiver": "^8.0.0",
     "@types/dockerode": "^4.0.1",
-    "jose": "^6.1.0",
     "kysely-ctl": "^0.21.0",
-    "@kici-dev/agent": "0.1.24"
+    "@kici-dev/agent": "0.1.26"
   },
   "scripts": {
     "build": "node ../../scripts/build-service.mjs && tsc --emitDeclarationOnly",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.1.24",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.24/5d84c2e2-c2ae-4133-963c-274d1c6cb791",
+  "name": "@kici-dev/orchestrator@0.1.26",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.26/9c3ff4ff-35af-480a-9ce4-a8615e3dc279",
   "creationInfo": {
-    "created": "2026-06-28T16:24:42Z",
+    "created": "2026-07-06T04:29:58Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1190,9 +1190,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.24",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.26",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.24",
+      "versionInfo": "0.1.26",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1203,16 +1203,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.24"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.26"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.24",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.26",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.24",
+      "versionInfo": "0.1.26",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1223,7 +1223,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.24"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.26"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1232,7 +1232,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.1.24",
+      "versionInfo": "0.1.26",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1243,16 +1243,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.24"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.26"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.24",
+      "versionInfo": "0.1.26",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1263,7 +1263,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.24"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.26"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -8201,57 +8201,57 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
@@ -8287,12 +8287,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.24",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.26",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -8335,6 +8335,11 @@
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.25",
       "relationshipType": "DEPENDS_ON"
     },
+    {
+      "spdxElementId": "SPDXRef-RootPackage",
+      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
+      "relationshipType": "DEPENDS_ON"
+    },
     {
       "spdxElementId": "SPDXRef-RootPackage",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
@@ -8396,112 +8401,112 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1064.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.26",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.31.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.218.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.41.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-archiver-8.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-diff-9.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.25",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.2",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.21.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.9.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.24",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.26",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },