@kici-dev/orchestrator 0.1.9 → 0.1.10

package/dist/scaler/manager.d.ts

@@ -15,6 +15,19 @@ import type { ScalerStateStore, ScalerStateRecovery } from './scaler-state-store
  * combined with the scaler's `defaults.resources`, applying the request<->limit
  * mirroring rule. Caps aggregate `requests`; backends use `limits`.
  */
+/**
+ * Resolve the orchestrator WebSocket URL a scaler-spawned agent should dial.
+ *
+ * 1. Per-scaler `orchestratorUrl` (scalers.yaml) wins — required for container
+ *    agents (host.docker.internal / LAN IP) and Firecracker VMs (bridge gateway
+ *    IP), which cannot reach the orchestrator over the host's loopback.
+ * 2. `KICI_ORCHESTRATOR_URL` env override.
+ * 3. Default `ws://127.0.0.1:<orchestrator-port>/ws` — for local (bare-metal)
+ *    agents that share the host. The port is the orchestrator's own bind port
+ *    (`KICI_PORT`, default 4000), NOT the agent's 8080 default; pointing local
+ *    agents at 8080 leaves them unable to reach the orchestrator.
+ */
+export declare function resolveScalerOrchestratorUrl(configUrl: string | undefined, envUrl: string | undefined, port: string | number | undefined): string;
 export interface ResolvedResources {
     requests: {
         cpus: number;

package/dist/server.js

@@ -3,7 +3,7 @@ import { dirname as __cjs_dirname } from "node:path";
 __cjs_dirname(__cjs_fileURLToPath(import.meta.url));
 import "node:module";
 import { BaseColdStore, RingBuffer, createDb, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, createPool, createS3Client, encodeKeySegment, enrichRequestContext, formatDuration, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, requestContext, serializeError, setServiceName, setupGracefulShutdown, sha256, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
-import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, ORCH_CAPABILITIES, OrchRole, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, createWorkflowDecision, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, minAccessLogWarmDays, minSecretAuditLogWarmDays, observeSubscribeSchema, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, platformToOrchestratorMessageSchema, resolveRoleLabels, resolveSecretsForEnvironment, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, stringifyActor, stripScopePrefix, testEventSchema } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, ORCH_CAPABILITIES, OrchRole, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, createWorkflowDecision, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, joinRequestSchema, logPullPlatformToOrchSchema, matchAllWorkflows, matchScopePattern, minAccessLogWarmDays, minSecretAuditLogWarmDays, observeSubscribeSchema, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, platformToOrchestratorMessageSchema, resolveRoleLabels, resolveSecretsForEnvironment, scalerAgentLabels, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, stringifyActor, stripScopePrefix, testEventSchema } from "@kici-dev/engine";
 import { verifySignature } from "@kici-dev/engine/webhook/signature";
 import { X509Certificate, createCipheriv, createDecipheriv, createHmac, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import os, { cpus, freemem, homedir, hostname, release, tmpdir, totalmem, uptime, userInfo, version } from "node:os";
@@ -15151,7 +15151,7 @@ var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_peer_credentials();
 	logger$73 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.1.9";
+	SOFTWARE_VERSION$1 = "0.1.10";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -16614,7 +16614,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$72 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.1.9";
+	SOFTWARE_VERSION = "0.1.10";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -24774,13 +24774,25 @@ var init_check_run_reporter = __esmMin((() => {
 * returns `false` after closing the WS on the first violation, in which
 * case the caller MUST stop processing.
 */
+/**
+* WebSocket close reasons are capped at 123 UTF-8 bytes (RFC 6455 §5.5.1).
+* A reason longer than that makes `ws.close()` throw a RangeError, which —
+* thrown from an async message handler — surfaces as an unhandled rejection
+* and skips the close entirely. Truncate on a byte boundary and drop any
+* trailing partial multi-byte char.
+*/
+function truncateCloseReason(reason) {
+	const bytes = Buffer.from(reason, "utf-8");
+	if (bytes.length <= 123) return reason;
+	return bytes.subarray(0, 123).toString("utf-8").replace(/�+$/, "");
+}
 function enforceRegisterAuthGates(authState, payload, ws, agentIdToTokenId) {
 	if (authState === void 0) return true;
 	const { tokenId, tokenLabels, tokenAgentType, tokenCreatedBy } = authState;
 	const { agentId, labels } = payload;
 	if (tokenLabels !== void 0 && tokenLabels !== null) {
 		const allowedSet = new Set(tokenLabels);
-		const elevated = labels.filter((l) => !allowedSet.has(l));
+		const elevated = labels.filter((l) => !allowedSet.has(l) && !isSelfReportedLabel(l));
 		if (elevated.length > 0) {
 			logger$59.warn("Agent register-time label-scope violation: wire labels exceed token-bound set", {
 				agentId,
@@ -24788,7 +24800,7 @@ function enforceRegisterAuthGates(authState, payload, ws, agentIdToTokenId) {
 				wireLabels: labels,
 				elevated
 			});
-			ws.close(WS_CLOSE_AGENT_AUTH_FAILED, `Agent labels exceed token-bound scope: ${elevated.join(",")}`);
+			ws.close(WS_CLOSE_AGENT_AUTH_FAILED, truncateCloseReason(`Agent labels exceed token-bound scope: ${elevated.join(",")}`));
 			return false;
 		}
 	}
@@ -24798,7 +24810,7 @@ function enforceRegisterAuthGates(authState, payload, ws, agentIdToTokenId) {
 			tokenCreatedBy,
 			tokenId
 		});
-		ws.close(WS_CLOSE_AGENT_AUTH_FAILED, `Ephemeral token bound to a different agentId: expected ${tokenCreatedBy}, got ${agentId}`);
+		ws.close(WS_CLOSE_AGENT_AUTH_FAILED, truncateCloseReason(`Ephemeral token bound to a different agentId: expected ${tokenCreatedBy}, got ${agentId}`));
 		return false;
 	}
 	if (tokenId !== void 0) {
@@ -34104,15 +34116,15 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.1.9",
-			buildDate: "2026-05-26T16:38:18.222Z",
-			buildCommit: "54278bfb2",
-			sdkVersion: "0.1.9",
-			sdkBundleHash: "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128",
-			sharedVersion: "0.1.9",
+			version: "0.1.10",
+			buildDate: "2026-05-26T17:19:08.888Z",
+			buildCommit: "6bf528b56",
+			sdkVersion: "0.1.10",
+			sdkBundleHash: "unknown",
+			sharedVersion: "0.1.10",
 			sharedBundleHash: "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae",
-			engineVersion: "0.1.9",
-			engineBundleHash: "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21"
+			engineVersion: "0.1.10",
+			engineBundleHash: "dff25bbd7602e853cec6e6e985c6c956ad773e245830273cd52950fff958d4bb"
 		}),
 		readinessCheck: deps.db ? async () => {
 			const checks = {};
@@ -34146,7 +34158,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.1.9",
+			orchestratorVersion: "0.1.10",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -36583,17 +36595,13 @@ var init_container_backend = __esmMin((() => {
 					const stripped = key.slice(KICI_AGENT_ENV_PREFIX.length);
 					if (stripped.length > 0) agentEnvForwarded.push(`${stripped}=${value}`);
 				}
+				const fullLabels = scalerAgentLabels(labelSet, this.type, this.name, this.roles);
 				let agentToken;
-				if (this.tokenStore) agentToken = await this.tokenStore.createEphemeral(agentId, labelSet, this.tokenTtlMs);
+				if (this.tokenStore) agentToken = await this.tokenStore.createEphemeral(agentId, fullLabels, this.tokenTtlMs);
 				const env = [
 					`KICI_ORCHESTRATOR_URL=${orchestratorUrl}`,
 					`KICI_AGENT_ID=${agentId}`,
-					`KICI_LABELS=${[
-						...labelSet,
-						`kici:agent:${this.type}`,
-						`kici:scaler:${this.name}`,
-						...resolveRoleLabels(this.roles)
-					].join(",")}`,
+					`KICI_LABELS=${fullLabels.join(",")}`,
 					`KICI_SCALER_MANAGED=1`,
 					`KICI_EXECUTION_MODE=bare-metal`,
 					...agentToken ? [`KICI_AGENT_TOKEN=${agentToken}`] : [],
@@ -36889,15 +36897,11 @@ var init_bare_metal_backend = __esmMin((() => {
 				const strippedKey = key.slice(KICI_AGENT_ENV_PREFIX.length);
 				if (strippedKey.length > 0) env[strippedKey] = value;
 			}
-			if (this.tokenStore) env.KICI_AGENT_TOKEN = await this.tokenStore.createEphemeral(agentId, labelSet, this.tokenTtlMs);
+			const fullLabels = scalerAgentLabels(labelSet, this.type, this.name, this.roles);
+			if (this.tokenStore) env.KICI_AGENT_TOKEN = await this.tokenStore.createEphemeral(agentId, fullLabels, this.tokenTtlMs);
 			env.KICI_ORCHESTRATOR_URL = orchestratorUrl;
 			env.KICI_AGENT_ID = agentId;
-			env.KICI_LABELS = [
-				...labelSet,
-				`kici:agent:${this.type}`,
-				`kici:scaler:${this.name}`,
-				...resolveRoleLabels(this.roles)
-			].join(",");
+			env.KICI_LABELS = fullLabels.join(",");
 			env.KICI_SCALER_MANAGED = "1";
 			env.KICI_EXECUTION_MODE = "bare-metal";
 			env.KICI_PORT = "0";
@@ -37647,18 +37651,14 @@ var init_firecracker_backend = __esmMin((() => {
 					if (chmodLoosenInterval) clearInterval(chmodLoosenInterval);
 				}
 				if (!ready) throw new Error(`Firecracker API socket not ready within 5s for agent ${agentId}`);
+				const fullLabels = scalerAgentLabels(labelSet, this.type, this.name, this.roles);
 				let agentToken;
-				if (this.tokenStore) agentToken = await this.tokenStore.createEphemeral(agentId, labelSet, this.tokenTtlMs);
+				if (this.tokenStore) agentToken = await this.tokenStore.createEphemeral(agentId, fullLabels, this.tokenTtlMs);
 				const acceptedEnv = this.buildForwardedEnv(matchedLabelSet, agentId);
 				await api.putMmds({ latest: { "meta-data": {
 					"kici-orchestrator-url": orchestratorUrl,
 					"kici-agent-id": agentId,
-					"kici-labels": [
-						...labelSet,
-						`kici:agent:${this.type}`,
-						`kici:scaler:${this.name}`,
-						...resolveRoleLabels(this.roles)
-					].join(","),
+					"kici-labels": fullLabels.join(","),
 					"kici-scaler-managed": "1",
 					"kici-gateway-ip": this.gateway,
 					...agentToken ? { "kici-agent-token": agentToken } : {},
@@ -38735,6 +38735,29 @@ var init_machine_ledger = __esmMin((() => {
 * and manages the agent lifecycle from spawn to destroy.
 */
 /**
+* Resolved per-job resource amounts (cpus + bytes) for both `requests` and
+* `limits`. The scaler manager produces this from the job's declared resources
+* combined with the scaler's `defaults.resources`, applying the request<->limit
+* mirroring rule. Caps aggregate `requests`; backends use `limits`.
+*/
+/**
+* Resolve the orchestrator WebSocket URL a scaler-spawned agent should dial.
+*
+* 1. Per-scaler `orchestratorUrl` (scalers.yaml) wins — required for container
+*    agents (host.docker.internal / LAN IP) and Firecracker VMs (bridge gateway
+*    IP), which cannot reach the orchestrator over the host's loopback.
+* 2. `KICI_ORCHESTRATOR_URL` env override.
+* 3. Default `ws://127.0.0.1:<orchestrator-port>/ws` — for local (bare-metal)
+*    agents that share the host. The port is the orchestrator's own bind port
+*    (`KICI_PORT`, default 4000), NOT the agent's 8080 default; pointing local
+*    agents at 8080 leaves them unable to reach the orchestrator.
+*/
+function resolveScalerOrchestratorUrl(configUrl, envUrl, port) {
+	if (configUrl) return configUrl;
+	if (envUrl) return envUrl;
+	return `ws://127.0.0.1:${port ?? "4000"}/ws`;
+}
+/**
 * Apply the request<->limit mirroring rule: if only one side is set, copy it
 * to the other; if neither is set, return undefined; if both are set, leave them.
 *
@@ -39646,9 +39669,7 @@ var init_manager = __esmMin((() => {
 			});
 		}
 		getOrchestratorUrl(backendName) {
-			const configUrl = this.scalerUrls.get(backendName);
-			if (configUrl) return configUrl;
-			return process.env.KICI_ORCHESTRATOR_URL ?? "ws://localhost:8080/ws";
+			return resolveScalerOrchestratorUrl(this.scalerUrls.get(backendName), process.env.KICI_ORCHESTRATOR_URL, process.env.KICI_PORT);
 		}
 		/**
 		* Create a per-agent event emitter closure to pass to backend.spawn().
@@ -50298,14 +50319,14 @@ var init_worker_core = __esmMin((() => {
 	init_agent_handler();
 	init_worker_status();
 	init_agent_heartbeat();
-	ORCHESTRATOR_VERSION$1 = "0.1.9";
-	WORKER_BUILD_COMMIT = "54278bfb2";
-	WORKER_SDK_VERSION = "0.1.9";
-	WORKER_SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-	WORKER_SHARED_VERSION = "0.1.9";
+	ORCHESTRATOR_VERSION$1 = "0.1.10";
+	WORKER_BUILD_COMMIT = "6bf528b56";
+	WORKER_SDK_VERSION = "0.1.10";
+	WORKER_SDK_BUNDLE_HASH = "unknown";
+	WORKER_SHARED_VERSION = "0.1.10";
 	WORKER_SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-	WORKER_ENGINE_VERSION = "0.1.9";
-	WORKER_ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
+	WORKER_ENGINE_VERSION = "0.1.10";
+	WORKER_ENGINE_BUNDLE_HASH = "dff25bbd7602e853cec6e6e985c6c956ad773e245830273cd52950fff958d4bb";
 	logger$1 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
 }));
@@ -50326,14 +50347,14 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown in reverse order:
 * Platform client -> agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.1.9";
-const BUILD_COMMIT = "54278bfb2";
-const SDK_VERSION = "0.1.9";
-const SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-const SHARED_VERSION = "0.1.9";
+const ORCHESTRATOR_VERSION = "0.1.10";
+const BUILD_COMMIT = "6bf528b56";
+const SDK_VERSION = "0.1.10";
+const SDK_BUNDLE_HASH = "unknown";
+const SHARED_VERSION = "0.1.10";
 const SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-const ENGINE_VERSION = "0.1.9";
-const ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
+const ENGINE_VERSION = "0.1.10";
+const ENGINE_BUNDLE_HASH = "dff25bbd7602e853cec6e6e985c6c956ad773e245830273cd52950fff958d4bb";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT

package/dist/standalone.js

@@ -9,7 +9,7 @@ import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
 import WebSocket from "ws";
 import { chmodSync, closeSync, createReadStream, createWriteStream, mkdirSync, mkdtempSync, openSync, promises, readFileSync, rmSync, statSync, unlinkSync, unwatchFile, watchFile, writeFileSync } from "node:fs";
-import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CheckRunConclusion, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, createWorkflowDecision, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, matchAllWorkflows, minAccessLogWarmDays, minSecretAuditLogWarmDays, observeSubscribeSchema, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, resolveRoleLabels, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, testEventSchema } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogSource, AccessLogTargetType, ActorType, CheckRunConclusion, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SCHEMA_VERSION, ScalerBackendType, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WsRateLimiter, accessLogWarmSqlCase, agentAuthRequestSchema, agentToOrchestratorMessageSchema, agentTypeLabel, createWorkflowDecision, deriveOsArchLabels, flattenActor, getAccessLogColdDays, getSecretAuditLogColdDays, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, matchAllWorkflows, minAccessLogWarmDays, minSecretAuditLogWarmDays, observeSubscribeSchema, peerAuthRequestSchema, peerFromPeerMessageSchema, peerHelloResponseSchema, peerHelloSchema, resolveRoleLabels, scalerAgentLabels, scalerLabel, secretAuditLogWarmSqlCase, shouldRecordAccess, shouldRecordSecretResolve, testEventSchema } from "@kici-dev/engine";
 import { access, appendFile, chmod, constants, copyFile, link, mkdir, mkdtemp, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join, relative, resolve } from "node:path";
 import { sql } from "kysely";
@@ -1040,7 +1040,7 @@ var init_peer_client = __esmMin((() => {
 	init_peer_crypto();
 	init_peer_credentials();
 	logger$85 = createLogger({ prefix: "peer-client" });
-	SOFTWARE_VERSION$1 = "0.1.9";
+	SOFTWARE_VERSION$1 = "0.1.10";
 	PeerClient$1 = class {
 		ws = null;
 		_state = "disconnected";
@@ -2503,7 +2503,7 @@ var init_peer_handler = __esmMin((() => {
 	init_peer_crypto();
 	init_join_token();
 	logger$84 = createLogger({ prefix: "peer-handler" });
-	SOFTWARE_VERSION = "0.1.9";
+	SOFTWARE_VERSION = "0.1.10";
 	RATE_LIMIT_MAX = 5;
 	RATE_LIMIT_WINDOW_MS = 6e4;
 }));
@@ -10900,13 +10900,25 @@ var init_check_run_reporter = __esmMin((() => {
 * returns `false` after closing the WS on the first violation, in which
 * case the caller MUST stop processing.
 */
+/**
+* WebSocket close reasons are capped at 123 UTF-8 bytes (RFC 6455 §5.5.1).
+* A reason longer than that makes `ws.close()` throw a RangeError, which —
+* thrown from an async message handler — surfaces as an unhandled rejection
+* and skips the close entirely. Truncate on a byte boundary and drop any
+* trailing partial multi-byte char.
+*/
+function truncateCloseReason(reason) {
+	const bytes = Buffer.from(reason, "utf-8");
+	if (bytes.length <= 123) return reason;
+	return bytes.subarray(0, 123).toString("utf-8").replace(/�+$/, "");
+}
 function enforceRegisterAuthGates(authState, payload, ws, agentIdToTokenId) {
 	if (authState === void 0) return true;
 	const { tokenId, tokenLabels, tokenAgentType, tokenCreatedBy } = authState;
 	const { agentId, labels } = payload;
 	if (tokenLabels !== void 0 && tokenLabels !== null) {
 		const allowedSet = new Set(tokenLabels);
-		const elevated = labels.filter((l) => !allowedSet.has(l));
+		const elevated = labels.filter((l) => !allowedSet.has(l) && !isSelfReportedLabel(l));
 		if (elevated.length > 0) {
 			logger$69.warn("Agent register-time label-scope violation: wire labels exceed token-bound set", {
 				agentId,
@@ -10914,7 +10926,7 @@ function enforceRegisterAuthGates(authState, payload, ws, agentIdToTokenId) {
 				wireLabels: labels,
 				elevated
 			});
-			ws.close(WS_CLOSE_AGENT_AUTH_FAILED, `Agent labels exceed token-bound scope: ${elevated.join(",")}`);
+			ws.close(WS_CLOSE_AGENT_AUTH_FAILED, truncateCloseReason(`Agent labels exceed token-bound scope: ${elevated.join(",")}`));
 			return false;
 		}
 	}
@@ -10924,7 +10936,7 @@ function enforceRegisterAuthGates(authState, payload, ws, agentIdToTokenId) {
 			tokenCreatedBy,
 			tokenId
 		});
-		ws.close(WS_CLOSE_AGENT_AUTH_FAILED, `Ephemeral token bound to a different agentId: expected ${tokenCreatedBy}, got ${agentId}`);
+		ws.close(WS_CLOSE_AGENT_AUTH_FAILED, truncateCloseReason(`Ephemeral token bound to a different agentId: expected ${tokenCreatedBy}, got ${agentId}`));
 		return false;
 	}
 	if (tokenId !== void 0) {
@@ -21591,15 +21603,15 @@ var init_admin_config = __esmMin((() => {
 function createHealthRoutes$1(deps = {}) {
 	return createHealthRoutes({
 		livenessInfo: () => ({
-			version: "0.1.9",
-			buildDate: "2026-05-26T16:38:18.222Z",
-			buildCommit: "54278bfb2",
-			sdkVersion: "0.1.9",
-			sdkBundleHash: "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128",
-			sharedVersion: "0.1.9",
+			version: "0.1.10",
+			buildDate: "2026-05-26T17:19:08.888Z",
+			buildCommit: "6bf528b56",
+			sdkVersion: "0.1.10",
+			sdkBundleHash: "unknown",
+			sharedVersion: "0.1.10",
 			sharedBundleHash: "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae",
-			engineVersion: "0.1.9",
-			engineBundleHash: "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21"
+			engineVersion: "0.1.10",
+			engineBundleHash: "dff25bbd7602e853cec6e6e985c6c956ad773e245830273cd52950fff958d4bb"
 		}),
 		readinessCheck: deps.db ? async () => {
 			const checks = {};
@@ -21633,7 +21645,7 @@ function createCapabilitiesRoutes() {
 	const app = new Hono();
 	app.get("/api/v1/capabilities", (c) => {
 		const manifest = {
-			orchestratorVersion: "0.1.9",
+			orchestratorVersion: "0.1.10",
 			protocolVersion: PROTOCOL_VERSION,
 			minProtocolVersion: MIN_PROTOCOL_VERSION
 		};
@@ -28926,17 +28938,13 @@ var init_container_backend = __esmMin((() => {
 					const stripped = key.slice(KICI_AGENT_ENV_PREFIX.length);
 					if (stripped.length > 0) agentEnvForwarded.push(`${stripped}=${value}`);
 				}
+				const fullLabels = scalerAgentLabels(labelSet, this.type, this.name, this.roles);
 				let agentToken;
-				if (this.tokenStore) agentToken = await this.tokenStore.createEphemeral(agentId, labelSet, this.tokenTtlMs);
+				if (this.tokenStore) agentToken = await this.tokenStore.createEphemeral(agentId, fullLabels, this.tokenTtlMs);
 				const env = [
 					`KICI_ORCHESTRATOR_URL=${orchestratorUrl}`,
 					`KICI_AGENT_ID=${agentId}`,
-					`KICI_LABELS=${[
-						...labelSet,
-						`kici:agent:${this.type}`,
-						`kici:scaler:${this.name}`,
-						...resolveRoleLabels(this.roles)
-					].join(",")}`,
+					`KICI_LABELS=${fullLabels.join(",")}`,
 					`KICI_SCALER_MANAGED=1`,
 					`KICI_EXECUTION_MODE=bare-metal`,
 					...agentToken ? [`KICI_AGENT_TOKEN=${agentToken}`] : [],
@@ -29232,15 +29240,11 @@ var init_bare_metal_backend = __esmMin((() => {
 				const strippedKey = key.slice(KICI_AGENT_ENV_PREFIX.length);
 				if (strippedKey.length > 0) env[strippedKey] = value;
 			}
-			if (this.tokenStore) env.KICI_AGENT_TOKEN = await this.tokenStore.createEphemeral(agentId, labelSet, this.tokenTtlMs);
+			const fullLabels = scalerAgentLabels(labelSet, this.type, this.name, this.roles);
+			if (this.tokenStore) env.KICI_AGENT_TOKEN = await this.tokenStore.createEphemeral(agentId, fullLabels, this.tokenTtlMs);
 			env.KICI_ORCHESTRATOR_URL = orchestratorUrl;
 			env.KICI_AGENT_ID = agentId;
-			env.KICI_LABELS = [
-				...labelSet,
-				`kici:agent:${this.type}`,
-				`kici:scaler:${this.name}`,
-				...resolveRoleLabels(this.roles)
-			].join(",");
+			env.KICI_LABELS = fullLabels.join(",");
 			env.KICI_SCALER_MANAGED = "1";
 			env.KICI_EXECUTION_MODE = "bare-metal";
 			env.KICI_PORT = "0";
@@ -29990,18 +29994,14 @@ var init_firecracker_backend = __esmMin((() => {
 					if (chmodLoosenInterval) clearInterval(chmodLoosenInterval);
 				}
 				if (!ready) throw new Error(`Firecracker API socket not ready within 5s for agent ${agentId}`);
+				const fullLabels = scalerAgentLabels(labelSet, this.type, this.name, this.roles);
 				let agentToken;
-				if (this.tokenStore) agentToken = await this.tokenStore.createEphemeral(agentId, labelSet, this.tokenTtlMs);
+				if (this.tokenStore) agentToken = await this.tokenStore.createEphemeral(agentId, fullLabels, this.tokenTtlMs);
 				const acceptedEnv = this.buildForwardedEnv(matchedLabelSet, agentId);
 				await api.putMmds({ latest: { "meta-data": {
 					"kici-orchestrator-url": orchestratorUrl,
 					"kici-agent-id": agentId,
-					"kici-labels": [
-						...labelSet,
-						`kici:agent:${this.type}`,
-						`kici:scaler:${this.name}`,
-						...resolveRoleLabels(this.roles)
-					].join(","),
+					"kici-labels": fullLabels.join(","),
 					"kici-scaler-managed": "1",
 					"kici-gateway-ip": this.gateway,
 					...agentToken ? { "kici-agent-token": agentToken } : {},
@@ -31078,6 +31078,29 @@ var init_machine_ledger = __esmMin((() => {
 * and manages the agent lifecycle from spawn to destroy.
 */
 /**
+* Resolved per-job resource amounts (cpus + bytes) for both `requests` and
+* `limits`. The scaler manager produces this from the job's declared resources
+* combined with the scaler's `defaults.resources`, applying the request<->limit
+* mirroring rule. Caps aggregate `requests`; backends use `limits`.
+*/
+/**
+* Resolve the orchestrator WebSocket URL a scaler-spawned agent should dial.
+*
+* 1. Per-scaler `orchestratorUrl` (scalers.yaml) wins — required for container
+*    agents (host.docker.internal / LAN IP) and Firecracker VMs (bridge gateway
+*    IP), which cannot reach the orchestrator over the host's loopback.
+* 2. `KICI_ORCHESTRATOR_URL` env override.
+* 3. Default `ws://127.0.0.1:<orchestrator-port>/ws` — for local (bare-metal)
+*    agents that share the host. The port is the orchestrator's own bind port
+*    (`KICI_PORT`, default 4000), NOT the agent's 8080 default; pointing local
+*    agents at 8080 leaves them unable to reach the orchestrator.
+*/
+function resolveScalerOrchestratorUrl(configUrl, envUrl, port) {
+	if (configUrl) return configUrl;
+	if (envUrl) return envUrl;
+	return `ws://127.0.0.1:${port ?? "4000"}/ws`;
+}
+/**
 * Apply the request<->limit mirroring rule: if only one side is set, copy it
 * to the other; if neither is set, return undefined; if both are set, leave them.
 *
@@ -31989,9 +32012,7 @@ var init_manager = __esmMin((() => {
 			});
 		}
 		getOrchestratorUrl(backendName) {
-			const configUrl = this.scalerUrls.get(backendName);
-			if (configUrl) return configUrl;
-			return process.env.KICI_ORCHESTRATOR_URL ?? "ws://localhost:8080/ws";
+			return resolveScalerOrchestratorUrl(this.scalerUrls.get(backendName), process.env.KICI_ORCHESTRATOR_URL, process.env.KICI_PORT);
 		}
 		/**
 		* Create a per-agent event emitter closure to pass to backend.spawn().
@@ -43777,14 +43798,14 @@ var init_worker_core = __esmMin((() => {
 	init_agent_handler();
 	init_worker_status();
 	init_agent_heartbeat();
-	ORCHESTRATOR_VERSION$1 = "0.1.9";
-	WORKER_BUILD_COMMIT = "54278bfb2";
-	WORKER_SDK_VERSION = "0.1.9";
-	WORKER_SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-	WORKER_SHARED_VERSION = "0.1.9";
+	ORCHESTRATOR_VERSION$1 = "0.1.10";
+	WORKER_BUILD_COMMIT = "6bf528b56";
+	WORKER_SDK_VERSION = "0.1.10";
+	WORKER_SDK_BUNDLE_HASH = "unknown";
+	WORKER_SHARED_VERSION = "0.1.10";
 	WORKER_SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-	WORKER_ENGINE_VERSION = "0.1.9";
-	WORKER_ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
+	WORKER_ENGINE_VERSION = "0.1.10";
+	WORKER_ENGINE_BUNDLE_HASH = "dff25bbd7602e853cec6e6e985c6c956ad773e245830273cd52950fff958d4bb";
 	logger$1 = createLogger({ prefix: "worker" });
 	DRAIN_TIMEOUT_MS = 3e5;
 }));
@@ -43808,14 +43829,14 @@ var init_worker_core = __esmMin((() => {
 * Graceful shutdown:
 * agent WS -> heartbeat -> HTTP -> DB
 */
-const ORCHESTRATOR_VERSION = "0.1.9";
-const BUILD_COMMIT = "54278bfb2";
-const SDK_VERSION = "0.1.9";
-const SDK_BUNDLE_HASH = "675aafe4de03e677785ef2794d8f34951b14e2bd1e6f0ea825953d6c2abfe128";
-const SHARED_VERSION = "0.1.9";
+const ORCHESTRATOR_VERSION = "0.1.10";
+const BUILD_COMMIT = "6bf528b56";
+const SDK_VERSION = "0.1.10";
+const SDK_BUNDLE_HASH = "unknown";
+const SHARED_VERSION = "0.1.10";
 const SHARED_BUNDLE_HASH = "36a23a454fd75ec35f258d39f254543ec0451c6b543fe3618ce427e6e6369aae";
-const ENGINE_VERSION = "0.1.9";
-const ENGINE_BUNDLE_HASH = "b704538612ec796a5668765bd55e0eaeaf1bad8a2afa508f9e20ad7b9eb61d21";
+const ENGINE_VERSION = "0.1.10";
+const ENGINE_BUNDLE_HASH = "dff25bbd7602e853cec6e6e985c6c956ad773e245830273cd52950fff958d4bb";
 const otelSdk = initTelemetry({
 	serviceName: "kici-orchestrator",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT

package/dist/ws/agent-handler.d.ts

@@ -29,6 +29,39 @@ import type { PendingDynamicTracker } from '../cache/pending-dynamics.js';
 import type { CacheStorage } from '../storage/types.js';
 import type { AgentMetricsAggregator } from '../metrics/agent-metrics-aggregator.js';
 import type { AgentApiRegistry } from './agent-api-registry.js';
+/**
+ * Run the three token-bound authorization gates against a wire-supplied
+ * `agent.register` payload. The gates are identical at first register
+ * (Phase 2 / `pendingRegistration`) and on every subsequent re-register
+ * arriving on the same registered WS — every code path that mutates the
+ * registry's `agentId → entry` mapping for an authenticated WS MUST run
+ * them, otherwise the §5.3 / §5.1 invariants only hold for the very first
+ * register and a re-register can silently overwrite the authority.
+ *
+ * Gates:
+ *  1. Token-scope subset — wire labels MUST be a subset of
+ *     `agent_tokens.labels` when that set is non-null. Closes the WS with
+ *     `WS_CLOSE_AGENT_AUTH_FAILED` listing the elevated labels.
+ *  2. Ephemeral identity-binding — for `agent_type === 'ephemeral'`,
+ *     wire `agentId` MUST equal `tokenCreatedBy` (the scaler-spawned
+ *     agentId the token was issued for). Closes the WS with
+ *     `WS_CLOSE_AGENT_AUTH_FAILED`.
+ *  3. Static-token agentId-collision — a different `tokenId` must not
+ *     already claim the wire `agentId`. Closes the WS with
+ *     `WS_CLOSE_INVALID_MESSAGE`.
+ *
+ * Returns `true` when every gate passed and the caller may proceed;
+ * returns `false` after closing the WS on the first violation, in which
+ * case the caller MUST stop processing.
+ */
+/**
+ * WebSocket close reasons are capped at 123 UTF-8 bytes (RFC 6455 §5.5.1).
+ * A reason longer than that makes `ws.close()` throw a RangeError, which —
+ * thrown from an async message handler — surfaces as an unhandled rejection
+ * and skips the close entirely. Truncate on a byte boundary and drop any
+ * trailing partial multi-byte char.
+ */
+export declare function truncateCloseReason(reason: string): string;
 export interface AgentWsHandlerDeps {
     registry: AgentRegistry;
     dispatcher: Dispatcher;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/orchestrator",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
   "keywords": [
     "kici",
@@ -82,8 +82,8 @@
     "ws": "^8.20.0",
     "yaml": "^2.8.3",
     "zod": "^4.3.6",
-    "@kici-dev/engine": "0.1.9",
-    "@kici-dev/shared": "0.1.9"
+    "@kici-dev/shared": "0.1.10",
+    "@kici-dev/engine": "0.1.10"
   },
   "kici": {
     "metrics": {

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/orchestrator@0.1.9",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.9/ba441a14-82fe-4153-ab6c-224a79dfea78",
+  "name": "@kici-dev/orchestrator@0.1.10",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Forchestrator/0.1.10/1e7943f5-2300-4aee-b905-0121c011771c",
   "creationInfo": {
-    "created": "2026-05-26T16:49:21Z",
+    "created": "2026-05-26T17:26:36Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -1477,9 +1477,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.9",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.10",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.9",
+      "versionInfo": "0.1.10",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1490,7 +1490,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.9"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.10"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -1499,7 +1499,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/orchestrator",
-      "versionInfo": "0.1.9",
+      "versionInfo": "0.1.10",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1510,16 +1510,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.9"
+          "referenceLocator": "pkg:npm/%40kici-dev/orchestrator@0.1.10"
         }
       ],
       "description": "Customer-deployable orchestrator for the KiCI CI/CD stack. Receives webhook events (direct or via Platform relay), matches triggers against the lock file, and dispatches jobs to connected agents.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "SPDXID": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "name": "@kici-dev/shared",
-      "versionInfo": "0.1.9",
+      "versionInfo": "0.1.10",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -1530,7 +1530,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.9"
+          "referenceLocator": "pkg:npm/%40kici-dev/shared@0.1.10"
         }
       ],
       "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
@@ -10682,17 +10682,17 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
@@ -10728,12 +10728,12 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.9",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.10",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -10837,102 +10837,102 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--aws-sdk-client-s3-3.1038.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-api-1.9.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-metrics-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-prometheus-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-exporter-trace-otlp-http-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-instrumentation-runtime-node-0.28.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-resources-2.7.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-sdk-node-0.217.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package--opentelemetry-semantic-conventions-1.40.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-diff-7.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-hono-4.12.18",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-kysely-0.29.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-pg-8.20.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-yaml-2.8.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.9",
+      "spdxElementId": "SPDXRef-Package--kici-dev-shared-0.1.10",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },