@kici-dev/orchestrator 0.1.7 → 0.1.9

package/dist/cli/service/entrypoint.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Resolves the command a service unit should run.
+ *
+ * A `npm install -g kici-admin` install exposes only the `kici-admin` /
+ * `kici-agent` CLI bins — the long-running orchestrator and agent servers are
+ * separate module entry points (`dist/server.js` / `dist/standalone.js`) that
+ * must be launched with `node <script>`. These helpers turn an install's
+ * options into the `{ executablePath, args }` pair the platform service
+ * managers write into the unit's run command.
+ */
+/** Server entry point variant for the orchestrator. */
+export type ServerEntry = 'server' | 'standalone';
+/** Resolved run command for a service unit. */
+export interface ServiceExecutable {
+    /** Program the unit runs (the Node binary, or an explicit self-launching binary). */
+    executablePath: string;
+    /** Arguments passed to the program (the resolved server script, or none). */
+    args: string[];
+}
+/**
+ * Pick the orchestrator server entry from an env file's `KICI_MODE`.
+ * `independent` runs the standalone server; `platform` / `hybrid` / unset run
+ * the Platform-connected server.
+ */
+export declare function selectServerEntry(envFileContent: string): ServerEntry;
+/**
+ * Build the `{ executablePath, args }` for a service unit.
+ * - An explicit `binary` is run directly (assumed self-launching), no args.
+ * - Otherwise the Node binary runs the resolved server `entryScript`.
+ */
+export declare function resolveServiceExecutable(opts: {
+    binary?: string;
+    nodePath: string;
+    entryScript?: string;
+}): ServiceExecutable;
+//# sourceMappingURL=entrypoint.d.ts.map

package/dist/cli/service/types.d.ts

@@ -30,6 +30,12 @@ export interface ServiceConfig {
     description: string;
     /** Path to the executable binary. */
     executablePath: string;
+    /**
+     * Arguments passed to {@link executablePath} in the unit's run command.
+     * For a Node-launched server this is the resolved server script path
+     * (e.g. `["/opt/kici/dist/server.js"]`); empty for a self-launching binary.
+     */
+    args?: string[];
     /** Path to the environment file (.env). */
     envFilePath: string;
     /** Working directory for the service process. */

package/dist/cli.js

@@ -24,6 +24,7 @@ import * as path$1 from "node:path";
 import path from "node:path";
 import archiver from "archiver";
 import JSZip from "jszip";
+import { fileURLToPath } from "node:url";
 import { confirm, input, password, select } from "@inquirer/prompts";
 import { pipeline } from "node:stream/promises";
 import "pg";
@@ -6176,8 +6177,11 @@ var init_systemd = __esmMin((() => {
 			lines.push("");
 			lines.push("[Service]");
 			lines.push("Type=simple");
-			lines.push(`ExecStart=${config.executablePath}`);
+			const execArgs = config.args?.length ? ` ${config.args.join(" ")}` : "";
+			lines.push(`ExecStart=${config.executablePath}${execArgs}`);
 			lines.push(`EnvironmentFile=${config.envFilePath}`);
+			const execBinDir = path.dirname(config.executablePath);
+			lines.push(`Environment=PATH=${execBinDir}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`);
 			lines.push(`WorkingDirectory=${config.workingDirectory}`);
 			if (!config.isUserLevel && config.user) {
 				lines.push(`User=${config.user}`);
@@ -6373,6 +6377,7 @@ var init_launchd = __esmMin((() => {
 			lines.push("  <key>ProgramArguments</key>");
 			lines.push("  <array>");
 			lines.push(`    <string>${this.escapeXml(config.executablePath)}</string>`);
+			for (const arg of config.args ?? []) lines.push(`    <string>${this.escapeXml(arg)}</string>`);
 			lines.push("  </array>");
 			lines.push("  <key>WorkingDirectory</key>");
 			lines.push(`  <string>${this.escapeXml(config.workingDirectory)}</string>`);
@@ -6819,6 +6824,7 @@ var init_windows = __esmMin((() => {
 				}
 			}
 			cmdParts.push("--", `"${config.executablePath}"`);
+			for (const arg of config.args ?? []) cmdParts.push(`"${arg}"`);
 			execSync(cmdParts.join(" "), { stdio: "pipe" });
 			execSync(`sc.exe config ${config.name} start= auto`, { stdio: "pipe" });
 			const actions = config.restartPolicy.delays.map((d) => `restart/${d * 1e3}`).join("/");
@@ -7095,6 +7101,33 @@ async function createServiceManager(platform) {
 	}
 }
 //#endregion
+//#region src/cli/service/entrypoint.ts
+/**
+* Pick the orchestrator server entry from an env file's `KICI_MODE`.
+* `independent` runs the standalone server; `platform` / `hybrid` / unset run
+* the Platform-connected server.
+*/
+function selectServerEntry(envFileContent) {
+	const match = envFileContent.match(/^[ \t]*KICI_MODE[ \t]*=[ \t]*(\S+)/m);
+	return match && match[1].trim() === "independent" ? "standalone" : "server";
+}
+/**
+* Build the `{ executablePath, args }` for a service unit.
+* - An explicit `binary` is run directly (assumed self-launching), no args.
+* - Otherwise the Node binary runs the resolved server `entryScript`.
+*/
+function resolveServiceExecutable(opts) {
+	if (opts.binary) return {
+		executablePath: opts.binary,
+		args: []
+	};
+	if (!opts.entryScript) throw new Error("resolveServiceExecutable: entryScript is required when no binary is given");
+	return {
+		executablePath: opts.nodePath,
+		args: [opts.entryScript]
+	};
+}
+//#endregion
 //#region src/cli/wizard/prompts.ts
 /**
 * Shared prompt utilities for the setup wizards.
@@ -7369,7 +7402,12 @@ function registerOrchestratorInstall(orchestrator) {
 				fs.appendFileSync(envFilePath, `\nKICI_DATABASE_URL=${devDbUrl}\n`);
 				console.log(`Appended KICI_DATABASE_URL to ${envFilePath}`);
 			}
-			const executablePath = opts.binary ? path.resolve(opts.binary) : process.argv[0];
+			const entryScript = opts.binary ? void 0 : fileURLToPath(import.meta.resolve(`@kici-dev/orchestrator/${selectServerEntry(fs.readFileSync(envFilePath, "utf-8"))}`));
+			const { executablePath, args } = resolveServiceExecutable({
+				binary: opts.binary ? path.resolve(opts.binary) : void 0,
+				nodePath: process.execPath,
+				entryScript
+			});
 			if (userLevel) try {
 				const envContent = fs.readFileSync(envFilePath, "utf-8");
 				if (envContent.includes("firecracker") || envContent.includes("FIRECRACKER")) {
@@ -7383,6 +7421,7 @@ function registerOrchestratorInstall(orchestrator) {
 				displayName: "KiCI Orchestrator",
 				description: "KiCI CI/CD workflow orchestrator service",
 				executablePath,
+				args,
 				envFilePath,
 				workingDirectory: configDir,
 				isUserLevel: userLevel,
@@ -7459,7 +7498,7 @@ function registerOrchestratorStart(orchestrator) {
 				displayName: "KiCI Orchestrator",
 				description: "KiCI CI/CD workflow orchestrator service",
 				executablePath: "",
-				envFilePath: `${configDir}${serviceName}.env`,
+				envFilePath: path.join(configDir, `${serviceName}.env`),
 				workingDirectory: configDir,
 				isUserLevel: userLevel,
 				restartPolicy: DEFAULT_RESTART_POLICY

package/dist/config.d.ts

@@ -57,6 +57,7 @@ declare const configSchema: z.ZodObject<{
     cacheBuildTimeoutMs: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     cacheMaxTarballBytes: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     webhookPayloadDir: z.ZodOptional<z.ZodString>;
+    dataDir: z.ZodOptional<z.ZodString>;
     scalerConfigPath: z.ZodOptional<z.ZodString>;
     scalerConfigDir: z.ZodOptional<z.ZodString>;
     machineLedgerDir: z.ZodOptional<z.ZodString>;
@@ -238,6 +239,7 @@ export declare const envDef: import("@kici-dev/shared/env").DefineEnvResult<{
     cacheStorageFsBaseUrl?: string | undefined;
     logStorageS3Bucket?: string | undefined;
     webhookPayloadDir?: string | undefined;
+    dataDir?: string | undefined;
     scalerConfigPath?: string | undefined;
     scalerConfigDir?: string | undefined;
     machineLedgerDir?: string | undefined;

package/dist/data-dir.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Resolve the writable base directory for orchestrator-local data (execution
+ * log storage, cache).
+ *
+ * A system-level orchestrator owns `/var/lib/kici`; a user-level install
+ * (e.g. `kici-admin orchestrator install --user-level`) does not and cannot
+ * write there. Mirrors the scaler-ledger resolution in machine-ledger.ts so
+ * both pieces of orchestrator state degrade the same way: explicit override →
+ * `/var/lib/kici` if writable → XDG state dir → tmpdir.
+ */
+/**
+ * Return the first candidate directory that can be created and written to.
+ *
+ * Each candidate is `mkdir -p`'d and probed with a sentinel write (removed
+ * immediately) so "exists but not writable" is caught the same as "cannot be
+ * created". Throws if none are usable.
+ */
+export declare function firstWritableDir(candidates: string[]): string;
+/**
+ * Resolve the orchestrator data root.
+ *
+ * 1. `explicit` (KICI_DATA_DIR) wins — created if missing.
+ * 2. `/var/lib/kici` if writable (system-level install).
+ * 3. `${XDG_STATE_HOME:-$HOME/.local/state}/kici` (user-level install).
+ * 4. `${tmpdir}/kici-data` (last resort, e.g. CI sandboxes).
+ *
+ * Callers append their own subdir (e.g. `${dataDir}/cache/logs`).
+ */
+export declare function resolveDataDir(explicit: string | undefined): string;
+//# sourceMappingURL=data-dir.d.ts.map

package/dist/scaler/container-backend.d.ts

@@ -8,7 +8,7 @@
  */
 import { type ToolRequirement } from '@kici-dev/shared';
 import type { AgentTokenStore } from '../agent/token-store.js';
-import type { ScalerBackend, ManagedAgent, LabelSetConfig, LogCapture, ResourceRequest, EffectiveLimits, ScalerEventCallback, ValidationResult } from './types.js';
+import type { ScalerBackend, ManagedAgent, LabelSetConfig, LogCapture, ResourceRequest, EffectiveLimits, ScalerEventCallback, ValidationResult, ScalerEntry } from './types.js';
 /**
  * Result of runtime detection.
  */
@@ -93,10 +93,16 @@ export declare class ContainerScalerBackend implements ScalerBackend {
     private ensureIsolatedNetwork;
     /**
      * Declare required tools for a container scaler entry.
-     * Container runtime socket and nftables are validated during create() — no
-     * additional tool declarations needed here.
+     *
+     * For the auto-detect case (no explicit socketPath / remote host) the
+     * orchestrator must have a local container runtime — docker OR podman — on
+     * PATH, otherwise the scaler cannot spawn agent containers. Declaring it
+     * here lets the startup tool-validation gate fail fast with a clear error
+     * instead of the first job hanging. When a socketPath or remote host is
+     * configured the binary need not be on PATH (the runtime may be remote), so
+     * reachability is validated later in create().
      */
-    static getRequiredTools(): ToolRequirement[];
+    static getRequiredTools(entry: ScalerEntry): ToolRequirement[];
     /**
      * Create a ContainerScalerBackend with auto-detected or configured socket.
      * Throws if no container runtime is found and no host is configured.

package/dist/server.js

@@ -18,7 +18,7 @@ import picomatch from "picomatch";
 import vm from "node:vm";
 import { EventEmitter } from "node:events";
 import { DASHBOARD_WRITE_OPERATIONS_BY_NAME, dashboardWritePolicyMapSchema, isDashboardWriteOperationEnabled, resolveFullPolicyView, resolveFullPolicyView as resolveFullPolicyView$1 } from "@kici-dev/engine/protocol/dashboard-write-operations";
-import { chmodSync, closeSync, createReadStream, createWriteStream, mkdtempSync, openSync, promises, readFileSync, rmSync, statSync, unlinkSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, createReadStream, createWriteStream, mkdirSync, mkdtempSync, openSync, promises, readFileSync, rmSync, statSync, unlinkSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
 import { Cron } from "croner";
 import Vault from "hashi-vault-js";
 import "pg";
@@ -421,6 +421,7 @@ var init_config$5 = __esmMin((() => {
 		cacheBuildTimeoutMs: z.coerce.number().default(6e5),
 		cacheMaxTarballBytes: z.coerce.number().default(524288e3),
 		webhookPayloadDir: z.string().optional(),
+		dataDir: z.string().optional(),
 		scalerConfigPath: z.string().optional(),
 		scalerConfigDir: z.string().optional(),
 		machineLedgerDir: z.string().optional(),
@@ -605,6 +606,7 @@ var init_config$5 = __esmMin((() => {
 			workerConcurrency: "KICI_WORKER_CONCURRENCY",
 			concurrencyWaitTimeoutMs: "KICI_CONCURRENCY_WAIT_TIMEOUT_MS",
 			webhookPayloadDir: "KICI_WEBHOOK_PAYLOAD_DIR",
+			dataDir: "KICI_DATA_DIR",
 			scalerConfigPath: "KICI_SCALER_CONFIG_PATH",
 			scalerConfigDir: "KICI_SCALER_CONFIG_DIR",
 			machineLedgerDir: "KICI_MACHINE_LEDGER_DIR",
@@ -15149,7 +15151,7 @@ var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_peer_credentials();
 	logger$73 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.1.7";
+	SOFTWARE_VERSION$1 = "0.1.9";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -16612,7 +16614,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$72 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.1.7";
+	SOFTWARE_VERSION = "0.1.9";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -18172,6 +18174,59 @@ var init_global_workflow_policy = __esmMin((() => {
 	};
 }));
 //#endregion
+//#region src/data-dir.ts
+/**
+* Resolve the writable base directory for orchestrator-local data (execution
+* log storage, cache).
+*
+* A system-level orchestrator owns `/var/lib/kici`; a user-level install
+* (e.g. `kici-admin orchestrator install --user-level`) does not and cannot
+* write there. Mirrors the scaler-ledger resolution in machine-ledger.ts so
+* both pieces of orchestrator state degrade the same way: explicit override →
+* `/var/lib/kici` if writable → XDG state dir → tmpdir.
+*/
+/**
+* Return the first candidate directory that can be created and written to.
+*
+* Each candidate is `mkdir -p`'d and probed with a sentinel write (removed
+* immediately) so "exists but not writable" is caught the same as "cannot be
+* created". Throws if none are usable.
+*/
+function firstWritableDir(candidates) {
+	for (const dir of candidates) try {
+		mkdirSync(dir, { recursive: true });
+		const sentinel = join(dir, `.write-probe-${process.pid}`);
+		writeFileSync(sentinel, "probe");
+		rmSync(sentinel, { force: true });
+		return dir;
+	} catch {
+		continue;
+	}
+	throw new Error(`data-dir: no writable directory among candidates: ${candidates.join(", ")}`);
+}
+/**
+* Resolve the orchestrator data root.
+*
+* 1. `explicit` (KICI_DATA_DIR) wins — created if missing.
+* 2. `/var/lib/kici` if writable (system-level install).
+* 3. `${XDG_STATE_HOME:-$HOME/.local/state}/kici` (user-level install).
+* 4. `${tmpdir}/kici-data` (last resort, e.g. CI sandboxes).
+*
+* Callers append their own subdir (e.g. `${dataDir}/cache/logs`).
+*/
+function resolveDataDir(explicit) {
+	if (explicit) {
+		mkdirSync(explicit, { recursive: true });
+		return explicit;
+	}
+	return firstWritableDir([
+		"/var/lib/kici",
+		join(process.env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "kici"),
+		join(tmpdir(), "kici-data")
+	]);
+}
+var init_data_dir = __esmMin((() => {}));
+//#endregion
 //#region src/config/reload.ts
 /**
 * Compute a list of top-level config fields that differ between old and new config.
@@ -34049,14 +34104,14 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.1.7",
-			buildDate: "2026-05-26T13:18:35.789Z",
-			buildCommit: "4c0abe030",
-			sdkVersion: "0.1.7",
+			version: "0.1.9",
+			buildDate: "2026-05-26T16:38:18.222Z",
+			buildCommit: "54278bfb2",
+			sdkVersion: "0.1.9",
 			sdkBundleHash: "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128",
-			sharedVersion: "0.1.7",
+			sharedVersion: "0.1.9",
 			sharedBundleHash: "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae",
-			engineVersion: "0.1.7",
+			engineVersion: "0.1.9",
 			engineBundleHash: "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21"
 		}),
 		readinessCheck: deps.db ? async () => {
@@ -34091,7 +34146,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.1.7",
+			orchestratorVersion: "0.1.9",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -36452,11 +36507,22 @@ var init_container_backend = __esmMin((() => {
 		}
 		/**
 		* Declare required tools for a container scaler entry.
-		* Container runtime socket and nftables are validated during create() — no
-		* additional tool declarations needed here.
+		*
+		* For the auto-detect case (no explicit socketPath / remote host) the
+		* orchestrator must have a local container runtime — docker OR podman — on
+		* PATH, otherwise the scaler cannot spawn agent containers. Declaring it
+		* here lets the startup tool-validation gate fail fast with a clear error
+		* instead of the first job hanging. When a socketPath or remote host is
+		* configured the binary need not be on PATH (the runtime may be remote), so
+		* reachability is validated later in create().
 		*/
-		static getRequiredTools() {
-			return [];
+		static getRequiredTools(entry) {
+			if (entry.host || entry.socketPath) return [];
+			return [{
+				type: "any-path-binary",
+				names: ["docker", "podman"],
+				reason: `container scaler "${entry.name}" needs a local container runtime to spawn agents. Install Docker or Podman, or set socketPath / host in scalers.yaml for a remote runtime.`
+			}];
 		}
 		/**
 		* Create a ContainerScalerBackend with auto-detected or configured socket.
@@ -36780,6 +36846,11 @@ var init_bare_metal_backend = __esmMin((() => {
 				mode: "executable",
 				reason: `agent binary for bare-metal scaler "${entry.name}"`
 			}));
+			requirements.push({
+				type: "path-binary",
+				name: "node",
+				reason: `bare-metal scaler "${entry.name}" spawns the kici-agent node script. node must be on the orchestrator's PATH (it is forwarded to spawned agents). Ensure the orchestrator service's PATH includes your node install (e.g. the systemd unit's Environment=PATH covers the mise/nvm node bin dir).`
+			});
 			const sandboxViaGlobalEnv = process.env.KICI_AGENT_ENV_KICI_SANDBOX === "true";
 			const sandboxViaLabelSet = entry.labelSets.some((ls) => ls.env && ls.env.KICI_SANDBOX === "true");
 			if (sandboxViaGlobalEnv || sandboxViaLabelSet) requirements.push({
@@ -47162,7 +47233,7 @@ async function initializeScaler(config, db, tokenStore) {
 	}
 	const toolErrors = validateRequiredTools(scalerConfig.scalers.flatMap((s) => {
 		switch (s.type) {
-			case "container": return ContainerScalerBackend.getRequiredTools();
+			case "container": return ContainerScalerBackend.getRequiredTools(s);
 			case "bare-metal": return BareMetalScalerBackend.getRequiredTools(s);
 			case "firecracker": return FirecrackerScalerBackend.getRequiredTools(s);
 			default: return [];
@@ -48154,7 +48225,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		forcePathStyle: config.storage.forcePathStyle
 	} : {
 		type: "filesystem",
-		basePath: (config.webhookPayloadDir ?? "/var/lib/kici/cache") + "/logs"
+		basePath: (config.webhookPayloadDir ?? resolveDataDir(config.dataDir) + "/cache") + "/logs"
 	});
 	const observerRegistry = new ObserverRegistry();
 	let executionTrackerRef = null;
@@ -48954,6 +49025,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 }
 var logger$2;
 var init_orchestrator_core = __esmMin((() => {
+	init_data_dir();
 	init_reload();
 	init_resolver();
 	init_client();
@@ -50226,13 +50298,13 @@ var init_worker_core = __esmMin((() => {
 	init_agent_handler();
 	init_worker_status();
 	init_agent_heartbeat();
-	ORCHESTRATOR_VERSION$1 = "0.1.7";
-	WORKER_BUILD_COMMIT = "4c0abe030";
-	WORKER_SDK_VERSION = "0.1.7";
+	ORCHESTRATOR_VERSION$1 = "0.1.9";
+	WORKER_BUILD_COMMIT = "54278bfb2";
+	WORKER_SDK_VERSION = "0.1.9";
 	WORKER_SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-	WORKER_SHARED_VERSION = "0.1.7";
+	WORKER_SHARED_VERSION = "0.1.9";
 	WORKER_SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-	WORKER_ENGINE_VERSION = "0.1.7";
+	WORKER_ENGINE_VERSION = "0.1.9";
 	WORKER_ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
 	logger$1 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -50254,13 +50326,13 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown in reverse order:
 * Platform client -> agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.1.7";
-const BUILD_COMMIT = "4c0abe030";
-const SDK_VERSION = "0.1.7";
+const ORCHESTRATOR_VERSION = "0.1.9";
+const BUILD_COMMIT = "54278bfb2";
+const SDK_VERSION = "0.1.9";
 const SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-const SHARED_VERSION = "0.1.7";
+const SHARED_VERSION = "0.1.9";
 const SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-const ENGINE_VERSION = "0.1.7";
+const ENGINE_VERSION = "0.1.9";
 const ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",

package/dist/standalone.js

@@ -8,7 +8,7 @@ import { X509Certificate, createCipheriv, createDecipheriv, createHmac, createPr
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
 import WebSocket from "ws";
-import { chmodSync, closeSync, createReadStream, createWriteStream, mkdtempSync, openSync, promises, readFileSync, rmSync, statSync, unlinkSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, createReadStream, createWriteStream, mkdirSync, mkdtempSync, openSync, promises, readFileSync, rmSync, statSync, unlinkSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
 import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CheckRunConclusion, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, createWorkflowDecision, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, matchAllWorkflows, minAccessLogWarmDays, minSecretAuditLogWarmDays, observeSubscribeSchema, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, resolveRoleLabels, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, testEventSchema } from "@kici-dev/engine";
 import { access, appendFile, chmod, constants, copyFile, link, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
@@ -175,6 +175,7 @@ var init_config$5 = __esmMin((() => {
 		cacheBuildTimeoutMs: z.coerce.number().default(6e5),
 		cacheMaxTarballBytes: z.coerce.number().default(524288e3),
 		webhookPayloadDir: z.string().optional(),
+		dataDir: z.string().optional(),
 		scalerConfigPath: z.string().optional(),
 		scalerConfigDir: z.string().optional(),
 		machineLedgerDir: z.string().optional(),
@@ -359,6 +360,7 @@ var init_config$5 = __esmMin((() => {
 			workerConcurrency: "KICI_WORKER_CONCURRENCY",
 			concurrencyWaitTimeoutMs: "KICI_CONCURRENCY_WAIT_TIMEOUT_MS",
 			webhookPayloadDir: "KICI_WEBHOOK_PAYLOAD_DIR",
+			dataDir: "KICI_DATA_DIR",
 			scalerConfigPath: "KICI_SCALER_CONFIG_PATH",
 			scalerConfigDir: "KICI_SCALER_CONFIG_DIR",
 			machineLedgerDir: "KICI_MACHINE_LEDGER_DIR",
@@ -1038,7 +1040,7 @@ var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_peer_credentials();
 	logger$85 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.1.7";
+	SOFTWARE_VERSION$1 = "0.1.9";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -2501,7 +2503,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$84 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.1.7";
+	SOFTWARE_VERSION = "0.1.9";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -3739,6 +3741,59 @@ var init_cluster = __esmMin((() => {
 	init_health_api();
 }));
 //#endregion
+//#region src/data-dir.ts
+/**
+* Resolve the writable base directory for orchestrator-local data (execution
+* log storage, cache).
+*
+* A system-level orchestrator owns `/var/lib/kici`; a user-level install
+* (e.g. `kici-admin orchestrator install --user-level`) does not and cannot
+* write there. Mirrors the scaler-ledger resolution in machine-ledger.ts so
+* both pieces of orchestrator state degrade the same way: explicit override →
+* `/var/lib/kici` if writable → XDG state dir → tmpdir.
+*/
+/**
+* Return the first candidate directory that can be created and written to.
+*
+* Each candidate is `mkdir -p`'d and probed with a sentinel write (removed
+* immediately) so "exists but not writable" is caught the same as "cannot be
+* created". Throws if none are usable.
+*/
+function firstWritableDir(candidates) {
+	for (const dir of candidates) try {
+		mkdirSync(dir, { recursive: true });
+		const sentinel = join(dir, `.write-probe-${process.pid}`);
+		writeFileSync(sentinel, "probe");
+		rmSync(sentinel, { force: true });
+		return dir;
+	} catch {
+		continue;
+	}
+	throw new Error(`data-dir: no writable directory among candidates: ${candidates.join(", ")}`);
+}
+/**
+* Resolve the orchestrator data root.
+*
+* 1. `explicit` (KICI_DATA_DIR) wins — created if missing.
+* 2. `/var/lib/kici` if writable (system-level install).
+* 3. `${XDG_STATE_HOME:-$HOME/.local/state}/kici` (user-level install).
+* 4. `${tmpdir}/kici-data` (last resort, e.g. CI sandboxes).
+*
+* Callers append their own subdir (e.g. `${dataDir}/cache/logs`).
+*/
+function resolveDataDir(explicit) {
+	if (explicit) {
+		mkdirSync(explicit, { recursive: true });
+		return explicit;
+	}
+	return firstWritableDir([
+		"/var/lib/kici",
+		join(process.env.XDG_STATE_HOME ?? join(homedir(), ".local", "state"), "kici"),
+		join(tmpdir(), "kici-data")
+	]);
+}
+var init_data_dir = __esmMin((() => {}));
+//#endregion
 //#region src/metrics/prometheus.ts
 /** Set the current number of active agents. */
 function setAgentsActive(value) {
@@ -21536,14 +21591,14 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.1.7",
-			buildDate: "2026-05-26T13:18:35.789Z",
-			buildCommit: "4c0abe030",
-			sdkVersion: "0.1.7",
+			version: "0.1.9",
+			buildDate: "2026-05-26T16:38:18.222Z",
+			buildCommit: "54278bfb2",
+			sdkVersion: "0.1.9",
 			sdkBundleHash: "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128",
-			sharedVersion: "0.1.7",
+			sharedVersion: "0.1.9",
 			sharedBundleHash: "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae",
-			engineVersion: "0.1.7",
+			engineVersion: "0.1.9",
 			engineBundleHash: "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21"
 		}),
 		readinessCheck: deps.db ? async () => {
@@ -21578,7 +21633,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.1.7",
+			orchestratorVersion: "0.1.9",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -28795,11 +28850,22 @@ var init_container_backend = __esmMin((() => {
 		}
 		/**
 		* Declare required tools for a container scaler entry.
-		* Container runtime socket and nftables are validated during create() — no
-		* additional tool declarations needed here.
+		*
+		* For the auto-detect case (no explicit socketPath / remote host) the
+		* orchestrator must have a local container runtime — docker OR podman — on
+		* PATH, otherwise the scaler cannot spawn agent containers. Declaring it
+		* here lets the startup tool-validation gate fail fast with a clear error
+		* instead of the first job hanging. When a socketPath or remote host is
+		* configured the binary need not be on PATH (the runtime may be remote), so
+		* reachability is validated later in create().
 		*/
-		static getRequiredTools() {
-			return [];
+		static getRequiredTools(entry) {
+			if (entry.host || entry.socketPath) return [];
+			return [{
+				type: "any-path-binary",
+				names: ["docker", "podman"],
+				reason: `container scaler "${entry.name}" needs a local container runtime to spawn agents. Install Docker or Podman, or set socketPath / host in scalers.yaml for a remote runtime.`
+			}];
 		}
 		/**
 		* Create a ContainerScalerBackend with auto-detected or configured socket.
@@ -29123,6 +29189,11 @@ var init_bare_metal_backend = __esmMin((() => {
 				mode: "executable",
 				reason: `agent binary for bare-metal scaler "${entry.name}"`
 			}));
+			requirements.push({
+				type: "path-binary",
+				name: "node",
+				reason: `bare-metal scaler "${entry.name}" spawns the kici-agent node script. node must be on the orchestrator's PATH (it is forwarded to spawned agents). Ensure the orchestrator service's PATH includes your node install (e.g. the systemd unit's Environment=PATH covers the mise/nvm node bin dir).`
+			});
 			const sandboxViaGlobalEnv = process.env.KICI_AGENT_ENV_KICI_SANDBOX === "true";
 			const sandboxViaLabelSet = entry.labelSets.some((ls) => ls.env && ls.env.KICI_SANDBOX === "true");
 			if (sandboxViaGlobalEnv || sandboxViaLabelSet) requirements.push({
@@ -40755,7 +40826,7 @@ async function initializeScaler(config, db, tokenStore) {
 	}
 	const toolErrors = validateRequiredTools(scalerConfig.scalers.flatMap((s) => {
 		switch (s.type) {
-			case "container": return ContainerScalerBackend.getRequiredTools();
+			case "container": return ContainerScalerBackend.getRequiredTools(s);
 			case "bare-metal": return BareMetalScalerBackend.getRequiredTools(s);
 			case "firecracker": return FirecrackerScalerBackend.getRequiredTools(s);
 			default: return [];
@@ -41747,7 +41818,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 		forcePathStyle: config.storage.forcePathStyle
 	} : {
 		type: "filesystem",
-		basePath: (config.webhookPayloadDir ?? "/var/lib/kici/cache") + "/logs"
+		basePath: (config.webhookPayloadDir ?? resolveDataDir(config.dataDir) + "/cache") + "/logs"
 	});
 	const observerRegistry = new ObserverRegistry();
 	let executionTrackerRef = null;
@@ -42547,6 +42618,7 @@ async function bootstrapOrchestrator$1(config, hooks, options) {
 }
 var logger$2;
 var init_orchestrator_core = __esmMin((() => {
+	init_data_dir();
 	init_reload();
 	init_resolver();
 	init_client();
@@ -43705,13 +43777,13 @@ var init_worker_core = __esmMin((() => {
 	init_agent_handler();
 	init_worker_status();
 	init_agent_heartbeat();
-	ORCHESTRATOR_VERSION$1 = "0.1.7";
-	WORKER_BUILD_COMMIT = "4c0abe030";
-	WORKER_SDK_VERSION = "0.1.7";
+	ORCHESTRATOR_VERSION$1 = "0.1.9";
+	WORKER_BUILD_COMMIT = "54278bfb2";
+	WORKER_SDK_VERSION = "0.1.9";
 	WORKER_SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-	WORKER_SHARED_VERSION = "0.1.7";
+	WORKER_SHARED_VERSION = "0.1.9";
 	WORKER_SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-	WORKER_ENGINE_VERSION = "0.1.7";
+	WORKER_ENGINE_VERSION = "0.1.9";
 	WORKER_ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
 	logger$1 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
@@ -43736,13 +43808,13 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown:
 * agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.1.7";
-const BUILD_COMMIT = "4c0abe030";
-const SDK_VERSION = "0.1.7";
+const ORCHESTRATOR_VERSION = "0.1.9";
+const BUILD_COMMIT = "54278bfb2";
+const SDK_VERSION = "0.1.9";
 const SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-const SHARED_VERSION = "0.1.7";
+const SHARED_VERSION = "0.1.9";
 const SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-const ENGINE_VERSION = "0.1.7";
+const ENGINE_VERSION = "0.1.9";
 const ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "kici",
@@ -43,7 +43,9 @@
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
-    "./cli": "./dist/cli.js"
+    "./cli": "./dist/cli.js",
+    "./server": "./dist/server.js",
+    "./standalone": "./dist/standalone.js"
   },
   "build": {
     "entries": {
@@ -80,8 +82,8 @@
     "ws": "^8.20.0",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@kici-dev/engine": "0.1.7",
-    "@kici-dev/shared": "0.1.7"
+    "@kici-dev/engine": "0.1.9",
+    "@kici-dev/shared": "0.1.9"
   },
   "kici": {
     "metrics": {

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.1.7",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.7/4ec68fa2-15a1-43a2-9a19-4c7a17f679fb",
+  "name": "@kici-dev/orchestrator@0.1.9",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.9/ba441a14-82fe-4153-ab6c-224a79dfea78",
   "creationInfo": {
-    "created": "2026-05-26T14:00:41Z",
+    "created": "2026-05-26T16:49:21Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1477,9 +1477,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.7",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.9",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.7",
+      "versionInfo": "0.1.9",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1490,7 +1490,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.7"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.9"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1499,7 +1499,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.1.7",
+      "versionInfo": "0.1.9",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1510,16 +1510,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.7"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.9"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.7",
+      "versionInfo": "0.1.9",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1530,7 +1530,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.7"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.9"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -10682,17 +10682,17 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
@@ -10728,12 +10728,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.7",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.9",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -10837,102 +10837,102 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1038.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.28.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.40.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-diff-7.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.18",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.7",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },