@kici-dev/sdk 0.1.15 → 0.1.17

package/dist/secrets.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { SecretNotFoundError } from "./errors.js";
 //#region src/secrets.ts
 /**

package/dist/step.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { createStepOutputProxy } from "./outputs.js";
 //#region src/step.ts
 /**
@@ -69,6 +69,7 @@ function step(nameOrRunOrOptions, runOrOptions) {
 		rules: options.rules,
 		onCancel: options.onCancel,
 		cleanup: options.cleanup,
+		...options.requireApproval !== void 0 && { requireApproval: options.requireApproval },
 		_sourceLocation,
 		result: createStepOutputProxy(name)
 	};

package/dist/triggers/comment.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/comment.ts
 /**

package/dist/triggers/create.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/create.ts
 /**

package/dist/triggers/delete.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/delete.ts
 /**

package/dist/triggers/dispatch.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/dispatch.ts
 /**

package/dist/triggers/fork.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/fork.ts
 /**

package/dist/triggers/generic-webhook.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/generic-webhook.ts
 /**
 * Create a generic webhook trigger configuration.

package/dist/triggers/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { DEFAULT_PR_EVENTS, toBranchPattern } from "./types.js";
 import { pr } from "./pr.js";
 import { push } from "./push.js";

package/dist/triggers/job-complete.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/job-complete.ts
 /**
 * Create a job completion trigger configuration.

package/dist/triggers/kici-event.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/kici-event.ts
 /**
 * Create a KiCI custom event trigger configuration.

package/dist/triggers/lifecycle.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/lifecycle.ts
 /**
 * Create a lifecycle trigger configuration.

package/dist/triggers/pr.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { DEFAULT_PR_EVENTS, asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/pr.ts
 /**

package/dist/triggers/push.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/push.ts
 /**

package/dist/triggers/release.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/release.ts
 /**

package/dist/triggers/review-comment.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/review-comment.ts
 /**

package/dist/triggers/review.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/review.ts
 /**

package/dist/triggers/schedule.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/schedule.ts
 /**
 * Create a schedule trigger configuration.

package/dist/triggers/star.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/star.ts
 /**

package/dist/triggers/status.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/status.ts
 /**

package/dist/triggers/tag.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/tag.ts
 /**

package/dist/triggers/types.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/types.ts
 /**
 * Default PR events when pr() is called without explicit events.

package/dist/triggers/watch.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/watch.ts
 /**

package/dist/triggers/webhook.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/webhook.ts
 /**

package/dist/triggers/workflow-complete.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/triggers/workflow-complete.ts
 /**
 * Create a workflow completion trigger configuration.

package/dist/triggers/workflow-run.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { asArray, toBranchPattern } from "./types.js";
 //#region src/triggers/workflow-run.ts
 /**

package/dist/types.d.ts

@@ -9,6 +9,7 @@ import type { HookInput } from './hooks/types.js';
 import type { KiciApi } from './api-types.js';
 import type { DynamicGroupRef } from './dynamic-group.js';
 import type { EventPayload } from './events/event-payloads.js';
+import type { RequireApproval } from './approval.js';
 export type { ResourceRequest, ResourceSpec } from '@kici-dev/engine';
 /** Source location captured at a step() call site. */
 export interface SourceLocation {
@@ -53,6 +54,8 @@ export interface Step<TResult = void> {
     readonly onCancel?: HookInput;
     /** Always runs after step (success, failure, or cancel). */
     readonly cleanup?: HookInput;
+    /** Pause for a manual human approval before this step runs. */
+    readonly requireApproval?: RequireApproval;
     /** Internal: source location captured at step() call site. Not part of public API. */
     readonly _sourceLocation?: SourceLocation;
     /**
@@ -91,6 +94,8 @@ export interface StepOptions<TResult = void> {
     onCancel?: HookInput;
     /** Always runs after step (success, failure, or cancel). */
     cleanup?: HookInput;
+    /** Pause for a manual human approval before this step runs. */
+    requireApproval?: RequireApproval;
 }
 /** Trigger type (config objects returned by pr()/push() factory functions) */
 export type Trigger = TriggerConfig;
@@ -205,13 +210,48 @@ export interface GenericInitConfig {
     /** Static environment variables available to the command. */
     env?: Record<string, string>;
 }
+/**
+ * Overrides for the `mise` init preset. The preset supplies the `run` command;
+ * these tune the same fields a hand-written {@link GenericInitConfig} exposes,
+ * minus `run`.
+ */
+export interface MiseInitConfig {
+    /** Cache spec for mise's data dir. Omit -> content-derived default; `false` -> no cache. */
+    cache?: import('./cache-types.js').CacheSpec | false;
+    /** Max wall-clock for the mise init command in ms. Defaults to 600000. */
+    timeout?: number;
+    /** Static environment variables available to the mise command. */
+    env?: Record<string, string>;
+    /** Shell used to run the mise command. Defaults to the OS template's shell. */
+    shell?: string;
+}
+/** A typed toolchain preset: zero-config string or an object with overrides. */
+export type InitPreset = 'mise' | {
+    mise: MiseInitConfig;
+};
+/** One init directive: a hand-written generic config or a typed preset. */
+export type InitItem = GenericInitConfig | InitPreset;
+/**
+ * Per-job init configuration:
+ * - a single {@link InitItem} (generic config or preset),
+ * - an ordered array of items (run in order),
+ * - `'auto'` — detect the toolchain from committed files (mise.toml / .tool-versions),
+ * - `false` — explicit opt-out.
+ *
+ * An unset `init` is also "no init". `'auto'` is a scalar only — never an array element.
+ */
+export type InitConfig = InitItem | InitItem[] | 'auto' | false;
 /**
  * Structured runsOn selector with required and excluded labels.
  * Used when jobs need to target specific agents while excluding others.
  *
- * **Reserved namespace:** Labels with the `kici:` prefix are reserved for internal use
- * (e.g., `kici:role:builder`, `kici:role:init-runner`). User-supplied labels starting with
- * `kici:` will be rejected at compile time and agent startup.
+ * **Targeting `kici:` labels:** `runsOn` may target any agent label, including the
+ * `kici:`-namespaced auto-labels (e.g. `kici:os:linux`, `kici:arch:arm64`,
+ * `kici:host:<name>`). Targeting is a requirement on candidate agents, never a grant.
+ * Note that `kici:scaler:<name>` / `kici:agent:<backend>` are deployment-specific names,
+ * so targeting them couples a workflow to one orchestrator's configuration. Users still
+ * cannot *set* `kici:` labels on agents — that namespace is reserved for the scaler and
+ * the agent's self-reported platform facts.
  */
 export interface RunsOnSelector {
     labels: string | string[];
@@ -219,13 +259,15 @@ export interface RunsOnSelector {
 }
 /**
  * Polymorphic runsOn type: string shorthand, array shorthand, or full selector object.
- * - `'linux'` — single label shorthand
- * - `['linux', 'docker']` — multi-label shorthand
- * - `{ labels: ['linux', 'docker'], exclude: ['gpu'] }` — full selector with exclusions
+ * - `'kici:os:linux'` — single label shorthand (targets any linux agent)
+ * - `['kici:os:linux', 'gpu']` — multi-label shorthand (all must match)
+ * - `{ labels: ['kici:os:linux'], exclude: ['kici:host:box-01'] }` — full selector
  *
- * **Reserved namespace:** Labels with the `kici:` prefix are reserved for internal use
- * (e.g., `kici:role:builder`, `kici:role:init-runner`). User-supplied labels starting with
- * `kici:` will be rejected at compile time and agent startup.
+ * **Targeting `kici:` labels:** `runsOn` may target any agent label, including the
+ * `kici:`-namespaced auto-labels (`kici:os:`, `kici:arch:`, `kici:host:`, `kici:agent:`,
+ * `kici:scaler:`, `kici:role:`). Targeting is a requirement on candidate agents, never a
+ * grant. `kici:scaler:` / `kici:agent:` are deployment-specific, so prefer custom labels
+ * for portable pool targeting. Users still cannot *set* `kici:` labels on agents.
  */
 export type RunsOn = string | string[] | RunsOnSelector;
 /** Job definition returned by job() factory */
@@ -293,12 +335,16 @@ export interface Job {
     readonly resources?: ResourceRequest;
     /**
      * Per-job initialization. Runs after clone, before steps.
-     * - A `GenericInitConfig` (or array, run in order) provisions a toolchain.
-     * - `false` is an explicit opt-out (reserved for the future auto-detect layer).
+     * - A `GenericInitConfig` or typed preset (`'mise'` / `{ mise }`), single or
+     *   in an ordered array, provisions a toolchain.
+     * - `'auto'` detects the toolchain from committed files (mise.toml / .tool-versions).
+     * - `false` is an explicit opt-out (an unset `init` is also "no init").
      */
-    readonly init?: GenericInitConfig | GenericInitConfig[] | false;
+    readonly init?: InitConfig;
     /** Declarative cache: restored before steps, saved after the job on key miss. */
     readonly cache?: import('./cache-types.js').CacheInput;
+    /** Pause for a manual human approval before this job dispatches. */
+    readonly requireApproval?: RequireApproval;
     /**
      * Type-safe proxy for accessing this job's outputs.
      * For multi-step jobs: jobRef.result.stepName.field
@@ -394,12 +440,16 @@ export interface JobOptions {
     resources?: ResourceRequest;
     /**
      * Per-job initialization. Runs after clone, before steps.
-     * - A `GenericInitConfig` (or array, run in order) provisions a toolchain.
-     * - `false` is an explicit opt-out (reserved for the future auto-detect layer).
+     * - A `GenericInitConfig` or typed preset (`'mise'` / `{ mise }`), single or
+     *   in an ordered array, provisions a toolchain.
+     * - `'auto'` detects the toolchain from committed files (mise.toml / .tool-versions).
+     * - `false` is an explicit opt-out (an unset `init` is also "no init").
      */
-    init?: GenericInitConfig | GenericInitConfig[] | false;
+    init?: InitConfig;
     /** Declarative cache: restored before steps, saved after the job on key miss. */
     cache?: import('./cache-types.js').CacheInput;
+    /** Pause for a manual human approval before this job dispatches. */
+    requireApproval?: RequireApproval;
 }
 /**
  * Private npm registry declaration. Tells the agent to authenticate against
@@ -477,6 +527,8 @@ export interface Workflow {
         readonly cancelInProgress?: boolean;
         readonly max?: number;
     };
+    /** Pause for a manual human approval before the whole workflow dispatches. */
+    readonly requireApproval?: RequireApproval;
 }
 /** Options for workflow() factory */
 export interface WorkflowOptions {
@@ -528,6 +580,8 @@ export interface WorkflowOptions {
         cancelInProgress?: boolean;
         max?: number;
     };
+    /** Pause for a manual human approval before the whole workflow dispatches. */
+    requireApproval?: RequireApproval;
 }
 export type { TriggerConfig, PrTriggerConfig, PushTriggerConfig } from './triggers/types.js';
 export type { Rule, RuleContext, RuleCheckFn, RuleResult } from './rules/types.js';

package/dist/types.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/types.ts
 /**
 * Type guard to check if a JobOrFactory is a dynamic job generator.

package/dist/validation/dag.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/validation/dag.ts
 /**
 * Validate a DAG for common issues: self-references, missing dependencies, and cycles.

package/dist/validation/index.js

@@ -1,3 +1,3 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { validateDag } from "./dag.js";
 export { validateDag };

package/dist/wait-for.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import { step } from "./step.js";
 //#region src/wait-for.ts
 /**

package/dist/workflow.js

@@ -1,4 +1,4 @@
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 //#region src/workflow.ts
 /**
 * Normalize triggers to array.
@@ -75,7 +75,8 @@ function workflow(name, options) {
 		cleanup: options.cleanup,
 		onSuccess: options.onSuccess,
 		onFailure: options.onFailure,
-		concurrency: options.concurrency
+		concurrency: options.concurrency,
+		requireApproval: options.requireApproval
 	};
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/sdk",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
   "keywords": [
     "ci",
@@ -46,12 +46,11 @@
     }
   },
   "dependencies": {
-    "fast-cartesian": "^9.0.1",
     "micromatch": "^4.0.8",
     "zod": "^4.3.6",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.15",
-    "@kici-dev/engine": "0.1.15"
+    "@kici-dev/core": "0.1.17",
+    "@kici-dev/engine": "0.1.17"
   },
   "devDependencies": {
     "@types/micromatch": "^4.0.10"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/sdk@0.1.15",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fsdk/0.1.15/35101d65-2a7e-4b17-9adf-2a2b29322815",
+  "name": "@kici-dev/sdk@0.1.17",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fsdk/0.1.17/3fe04364-30c3-435e-8804-37ebcd2fee4b",
   "creationInfo": {
-    "created": "2026-06-11T03:03:30Z",
+    "created": "2026-06-14T12:30:22Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -146,9 +146,9 @@
       "homepage": "https://ericsmekens.github.io/jsep/tree/master/packages/regex#readme"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.17",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.15",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -159,16 +159,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.15"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.17"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.15",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.15",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -179,7 +179,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.15"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.17"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
@@ -188,7 +188,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.15",
+      "versionInfo": "0.1.17",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -199,7 +199,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.15"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.17"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
@@ -936,6 +936,26 @@
       ],
       "description": "Check if something is a Node.js stream"
     },
+    {
+      "SPDXID": "SPDXRef-Package-jose-6.2.3",
+      "name": "jose",
+      "versionInfo": "6.2.3",
+      "downloadLocation": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/jose@6.2.3"
+        }
+      ],
+      "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
+      "homepage": "https://github.com/panva/jose"
+    },
     {
       "SPDXID": "SPDXRef-Package-jsep-1.4.0",
       "name": "jsep",
@@ -1544,63 +1564,68 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.128.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.15",
-      "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-fast-cartesian-9.0.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.15",
-      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.15",
-      "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.15",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
+      "relationshipType": "DEPENDS_ON"
+    },
+    {
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.17",
+      "relatedSpdxElement": "SPDXRef-Package-zod-4.3.6",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.15",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.17",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package-fast-cartesian-9.0.1",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.17",
       "relationshipType": "DEPENDS_ON"
     },
     {