@kici-dev/shared 0.1.27 → 0.2.0

package/dist/env/logger-env.js

@@ -4,13 +4,14 @@ import { z } from "zod";
 /**
 * Shared LoggerEnv schema.
 *
-* The logger (packages/shared/src/logger.ts) reads these env vars *before*
-* the per-service config loads, so we can't include them in the service
-* schemas the normal way. We still want them in `docs/operator/env-reference.md`
-* and in `validateUnknownKiciVars()`'s known-var set, so this schema documents
-* them in one place. Each service includes the keys here when computing its
-* "known KICI_* vars" list, and the docs generator emits a "Logger / shared"
-* section from this schema.
+* The logger (packages/core/src/logger.ts) reads these env vars *before*
+* the per-service config loads — as does `kiciTmpBase()`
+* (packages/core/src/tmp.ts) for the `KICI_TMPDIR` entry below — so we can't
+* include them in the service schemas the normal way. We still want them in
+* `docs/operator/env-reference.md` and in `validateUnknownKiciVars()`'s
+* known-var set, so this schema documents them in one place. Each service
+* includes the keys here when computing its "known KICI_* vars" list, and the
+* docs generator emits a "Logger / shared" section from this schema.
 *
 * IMPORTANT: do not change the runtime behaviour of `logger.ts` from this
 * schema — the schema is documentation + the unknown-var allowlist, not the
@@ -36,7 +37,13 @@ const LoggerEnvSchema = z.object({
 	/** Set by the agent process; used as a filename suffix. */
 	KICI_AGENT_ID: z.string().optional(),
 	/** Set by the platform process; used as a filename suffix. */
-	KICI_PLATFORM_INSTANCE_ID: z.string().optional()
+	KICI_PLATFORM_INSTANCE_ID: z.string().optional(),
+	/**
+	* Base directory for KiCI-created temp files (repo clones, build scratch,
+	* deploy render dirs). Read by `kiciTmpBase()` before any service config
+	* loads; defaults to the OS temp dir when unset.
+	*/
+	KICI_TMPDIR: z.string().optional()
 });
 /** All env vars the logger reads, for the unknown-KICI-var scanner. */
 const LOGGER_ENV_VARS = [
@@ -46,7 +53,8 @@ const LOGGER_ENV_VARS = [
 	"KICI_LOG_FORMAT",
 	"KICI_CLUSTER_INSTANCE_ID",
 	"KICI_AGENT_ID",
-	"KICI_PLATFORM_INSTANCE_ID"
+	"KICI_PLATFORM_INSTANCE_ID",
+	"KICI_TMPDIR"
 ];
 /** Doc-friendly description map (consumed by the env-reference generator). */
 const LOGGER_ENV_FIELD_SPECS = [
@@ -108,6 +116,14 @@ const LOGGER_ENV_FIELD_SPECS = [
 		required: false,
 		type: "string",
 		description: "Stable Platform identifier; appended to the platform log filename so multiple instances can share one KICI_LOG_DIR."
+	},
+	{
+		envVar: "KICI_TMPDIR",
+		aliases: [],
+		fieldPath: "KICI_TMPDIR",
+		required: false,
+		type: "string",
+		description: "Base directory for KiCI-created temporary files (repo clones, build scratch, deploy render dirs). Defaults to the operating system temp directory. Set it to a path on a volume with free space when the default temp filesystem is small."
 	}
 ];
 //#endregion

package/dist/idempotency-files.d.ts

@@ -63,6 +63,13 @@ export interface FileDriftEntry {
     remoteContent?: string;
     /** Set when content capture was intentionally skipped — used by the renderer to explain the gap. */
     contentSkipped?: ContentSkipReason;
+    /**
+     * Fleet machine the remote side of this comparison lives on. Stamped by the
+     * preview helpers, which already know the box. Consumers that aggregate
+     * drift across a whole fleet need it to attribute a file to a machine —
+     * `remotePath` alone is identical on every box.
+     */
+    box?: string;
     /**
      * Renderer hint. When omitted, the renderer auto-detects from
      * `remotePath`: `.env` → `'env-semantic'`, `.yaml` / `.yml` →

package/dist/index.d.ts

@@ -1,17 +1,19 @@
 export * from '@kici-dev/core';
+export * from './agent-platform.js';
 export { encrypt, decrypt, deriveKey, generateMasterKey, type EncryptedValue, } from './secret-crypto.js';
 export { RingBuffer } from './ring-buffer.js';
 export { redactConfig, addLogsToArchive, MAX_LOG_BYTES } from './diagnostics/bundle-archive.js';
 export { chunkBuffer, BundleChunkAssembler, ChunkRequestWaiter, FLEET_CHUNK_BYTES, type BundleChunkFrame, } from './diagnostics/bundle-chunks.js';
-export { createPool, createDb, type CreatePoolOptions, type PgPoolErrorSource } from './db.js';
+export { createPool, createDb, isPoolAcquireTimeout, type CreatePoolOptions, type PgPoolErrorSource, type PoolAcquireOutcome, } from './db.js';
 export { isPgUniqueViolation } from './pg-errors.js';
-export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeContextsDirect, seedContextDirect, deleteContextDirect, seedContextBindingDirect, setContextPolicyDirect, listContextsDirect, showContextDirect, createContextTemplateDirect, setContextSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, waitForExecutionRunStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, insertKiciEventAtDirect, paginateUnprocessedEventsKeysetDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedContextOpts, type SeedContextResult, type SeedContextBindingOpts, type SetContextPolicyOpts, type ContextRow, type ContextVariableRow, type ContextBindingRow, type ShowContextResult, type CreateContextTemplateOpts, type SetContextSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
+export { parseDatabaseUrl, maskDatabaseUrl, dropAndCreateDatabase, dropDatabaseDirect, ensureDatabase, type EnsureDatabaseOpts, createDbRole, createReadOnlyDbUser, computeMigrationsHash, storeMigrationContentHash, readStoredMigrationContentHash, isSchemaCurrent, clearDispatchQueueDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, purgeScopedSecretsDirect, purgeContextsDirect, seedContextDirect, deleteContextDirect, seedContextBindingDirect, setContextPolicyDirect, listContextsDirect, showContextDirect, createContextTemplateDirect, setContextSecretDirect, listQueueDirect, showQueueEntryDirect, listExecutionRunsDirect, showExecutionRunDirect, listCheckRunTrackingDirect, listExecutionJobsDirect, listRegistrationsDirect, showRegistrationDirect, registerWorkflowManualDirect, resetRaftStateDirect, emitKiciEventDirect, seedGenericWebhookSourceDirect, purgeSecretBackendsDirect, apiKeyExistsDirect, seedApiKeyInlineDirect, platformConnectionExistsDirect, countWebhookSourcesByConnectionIdDirect, getWebhookSourceByRoutingKeyDirect, findAnyUserApiKeyIdDirect, seedSyntheticGithubSourceDirect, seedWebhookSecretDirect, seedSourcePrivateKeyDirect, bumpRegistryVersionDirect, pollKiciEventsDirect, waitForPostgresDirect, waitForRunCompletionDirect, cleanupExecutionRowsDirect, isSchemaCurrentFromFilesDirect, storeMigrationContentHashInTableDirect, createJoinTokenDirect, deleteJoinTokensByCreatedByDirect, updateSourceRoutingKeyDirect, prunePeerCredentialsDirect, waitForPlatformRegistrationsDirect, seedUniversalGitSourceDirect, seedCiSecurityFixturesDirect, CI_SECURITY_OTHER_REPO, waitForExecutionRunReachesStatusSinceDirect, latestExecutionRunByStatusDirect, waitForLatestExecutionJobStatusDirect, describeTableColumnsDirect, tableExistsDirect, insertKiciEventRawDirect, showKiciEventDirect, listKiciEventsDirect, deleteKiciEventsDirect, insertKiciEventAtDirect, paginateUnprocessedEventsKeysetDirect, verifyKiciEventNotifyDirect, seedCrossRepoTrustDirect, listCrossRepoTrustBySourceRoutingKeyDirect, deleteCrossRepoTrustDirect, insertCrossRepoTrustStrictDirect, deleteWorkflowRegistrationsDirect, getWorkflowRegistrationByIdDirect, listRegistrationsByRoutingKeyDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, updateWorkflowRegistrationCommitShaDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, getRegistryVersionDirect, bumpRegistryVersionSimpleDirect, upsertCronLastFiredDirect, countCronLastFiredDirect, insertCronLastFiredNowDirect, deleteCronLastFiredDirect, deleteExecutionRunsByWorkflowNameDirect, getGenericWebhookSourceByRoutingKeyDirect, listActiveGenericWebhookSourcesDirect, updateGenericWebhookVerificationConfigDirect, deleteGenericWebhookSourcesByNameDirect, restoreSoftDeletedGenericWebhookSourceDirect, upsertOrgSettingsGlobalWorkflowsDirect, updateOrgSettingsDeniedReposDirect, deleteOrgSettingsByCustomerIdDirect, getExecutionRunSecurityDirect, getHeldRunByIdDirect, listHeldRunApprovalsDirect, countHeldRunsByRunIdDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForEventLogRowByDeliveryIdDirect, resolvePlatformWebhookSourceRoutingKeyDirect, ensureOrgOwnerMemberDirect, deletePeerCredentialsByInstanceIdLikeDirect, insertPeerCredentialExpiredDirect, getPeerCredentialRevokedAtDirect, listActivePeerCredentialsExcludingDirect, clearPeerCredentialsRevokedAtByIdsDirect, countActivePeerCredentialsByInstanceDirect, terminateIdleDbBackendsDirect, type ColumnInfo, type KiciEventRow, type CrossRepoTrustRow, type WorkflowRegistrationFullRow, type RegistrationsScopedResult, type LatestExecutionRunResult, type WaitForLatestJobResult, type ExecutionRunSecurityRow, type HeldRunSecurityRow, type EventLogRow as PlatformEventLogRow, type UpsertOrgSettingsOpts, type OrgSettingsRepoPatternEntry, type InsertKiciEventRawOpts, type EmitKiciEventOpts, type SeedGenericWebhookSourceOpts, REGISTERABLE_TRIGGER_TYPES, MIGRATION_HASH_TABLE, type PurgeStaleExecutionResult, type PurgeStaleSourcesResult, type SeedContextOpts, type SeedContextResult, type SeedContextBindingOpts, type SetContextPolicyOpts, type ContextRow, type ContextVariableRow, type ContextBindingRow, type ShowContextResult, type CreateContextTemplateOpts, type SetContextSecretOpts, type DispatchQueueRow, type ListQueueOpts, type ExecutionRunRow, type ExecutionJobRow, type ListExecutionRunsOpts, type CheckRunTrackingDirectRow, type ListCheckRunTrackingOpts, type WorkflowRegistrationRow, type ListRegistrationsOpts, type ListRegistrationsResult, type ShowRegistrationResult, type RegisterWorkflowManualOpts, type RegisterWorkflowManualResult, } from './db-admin.js';
 export { createMetricsRoutes, type MetricsRoutesDeps } from './routes/metrics.js';
 export { createHealthRoutes, type HealthRoutesDeps } from './routes/health.js';
 export { getReconnectDelay } from './reconnect-delay.js';
 export { initTelemetry, getPrometheusExporter, collectRuntimeMetricNames, createMeter, type TelemetryConfig, } from './telemetry/index.js';
 export { setupGracefulShutdown, type ShutdownStep, type ShutdownLogger, type ShutdownHandle, type GracefulShutdownOptions, } from './graceful-shutdown.js';
 export { validateRequiredTools, type ToolRequirement } from './tool-check.js';
+export { kiciTmpBase, kiciMkdtemp } from './tmp-dir.js';
 export { createS3Client, type CreateS3ClientOptions, type SharedS3Config } from './s3-client.js';
 export { BaseColdStore, ChunkLru, COLD_BUCKET_NAMES, DEFAULT_TABLE_CONFIG, chunkObjectKey, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, computeChunkId, decodeChunk, encodeChunk, encodeKeySegment, isLongerColdRetention, parseManifest, resolveTableConfig, serializeManifest, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, type ArchiveCycleSummary, type BaseColdStoreDeps, type ChunkCommitMetadata, type ChunkLruOptions, type ChunkManifest, type ColdBucketName, type ColdRetention, type ColdStore, type ColdStoreConfig, type ColdStoreFetchRangeArgs, type ColdStoreReplayChunkArgs, type ColdStoreReplayResult, type ColdStoreReplayRowArgs, type ColdStoreTableConfig, type DbKind, type DecodeChunkArgs, type EligiblePartition, type EncodeChunkArgs, type EncodedChunk, type PurgeableChunk, type PurgeChunkResult, type PurgeExpiredChunksOpts, type PurgeExpiredChunksSummary, type TableAdapter, } from './cold-store/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,6 +1,7 @@
 import "./rolldown-runtime-ClRpJifh.js";
-import { createDb, createPool } from "./db.js";
-import { MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
+import { AgentDeliveryMode, AgentPlatform, splitAgentPlatform } from "./agent-platform.js";
+import { createDb, createPool, isPoolAcquireTimeout } from "./db.js";
+import { CI_SECURITY_OTHER_REPO, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDbRole, createJoinTokenDirect, createReadOnlyDbUser, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, setContextPolicyDirect, setContextSecretDirect, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect } from "./db-admin.js";
 import { setupGracefulShutdown } from "./graceful-shutdown.js";
 import { decrypt, deriveKey, encrypt, generateMasterKey } from "./secret-crypto.js";
 import { RingBuffer } from "./ring-buffer.js";
@@ -14,6 +15,7 @@ import { collectRuntimeMetricNames, getPrometheusExporter, initTelemetry } from
 import { createMeter } from "./telemetry/metrics.js";
 import "./telemetry/index.js";
 import { validateRequiredTools } from "./tool-check.js";
+import { kiciMkdtemp, kiciTmpBase } from "./tmp-dir.js";
 import { createS3Client } from "./s3-client.js";
 import { chunkObjectKey, encodeKeySegment, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix } from "./cold-store/key.js";
 import { COLD_BUCKET_NAMES, coldDaysToBucket, isLongerColdRetention } from "./cold-store/bucket.js";
@@ -21,9 +23,9 @@ import { computeChunkId } from "./cold-store/chunk-id.js";
 import { decodeChunk, encodeChunk } from "./cold-store/chunk-encoder.js";
 import { parseManifest, serializeManifest } from "./cold-store/manifest.js";
 import { coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal } from "./cold-store/metrics.js";
+import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import { BaseColdStore } from "./cold-store/cold-store.js";
 import { ChunkLru } from "./cold-store/lru.js";
-import { DEFAULT_TABLE_CONFIG, resolveTableConfig } from "./cold-store/config.js";
 import "./cold-store/index.js";
 export * from "@kici-dev/core";
-export { BaseColdStore, BundleChunkAssembler, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDb, createDbRole, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isSchemaCurrent, isSchemaCurrentFromFilesDirect, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setContextPolicyDirect, setContextSecretDirect, setupGracefulShutdown, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };
+export { AgentDeliveryMode, AgentPlatform, BaseColdStore, BundleChunkAssembler, CI_SECURITY_OTHER_REPO, COLD_BUCKET_NAMES, ChunkLru, ChunkRequestWaiter, DEFAULT_TABLE_CONFIG, FLEET_CHUNK_BYTES, MAX_LOG_BYTES, MIGRATION_HASH_TABLE, REGISTERABLE_TRIGGER_TYPES, RingBuffer, addLogsToArchive, apiKeyExistsDirect, bumpRegistryVersionDirect, bumpRegistryVersionSimpleDirect, chunkBuffer, chunkObjectKey, cleanupExecutionRowsDirect, clearDispatchQueueDirect, clearPeerCredentialsRevokedAtByIdsDirect, coldDaysToBucket, coldStoreArchiveBytesTotal, coldStoreArchiveCyclesTotal, coldStoreArchiveDurationSeconds, coldStoreArchiveRowsTotal, coldStorePurgeBytesTotal, coldStorePurgeChunksTotal, coldStorePurgeDurationSeconds, coldStoreRehydrateBytesTotal, coldStoreRehydrateDurationSeconds, coldStoreRehydrateRequestsTotal, coldStoreReplayDurationSeconds, coldStoreReplayRowsTotal, coldStoreVerifyFailuresTotal, collectRuntimeMetricNames, computeChunkId, computeMigrationsHash, countActivePeerCredentialsByInstanceDirect, countCronLastFiredDirect, countHeldRunsByRunIdDirect, countWebhookSourcesByConnectionIdDirect, createContextTemplateDirect, createDb, createDbRole, createHealthRoutes, createJoinTokenDirect, createMeter, createMetricsRoutes, createPool, createReadOnlyDbUser, createS3Client, decodeChunk, decrypt, deleteContextDirect, deleteCronLastFiredDirect, deleteCrossRepoTrustDirect, deleteExecutionRunsByWorkflowNameDirect, deleteGenericWebhookSourcesByNameDirect, deleteJoinTokensByCreatedByDirect, deleteKiciEventsDirect, deleteOrgSettingsByCustomerIdDirect, deletePeerCredentialsByInstanceIdLikeDirect, deleteWorkflowRegistrationsDirect, deriveKey, describeTableColumnsDirect, dropAndCreateDatabase, dropDatabaseDirect, emitKiciEventDirect, encodeChunk, encodeKeySegment, encrypt, ensureDatabase, ensureOrgOwnerMemberDirect, findAnyUserApiKeyIdDirect, generateMasterKey, getExecutionRunSecurityDirect, getGenericWebhookSourceByRoutingKeyDirect, getHeldRunByIdDirect, getPeerCredentialRevokedAtDirect, getPrometheusExporter, getReconnectDelay, getRegistryVersionDirect, getWebhookSourceByRoutingKeyDirect, getWorkflowRegistrationByIdDirect, initTelemetry, insertCronLastFiredNowDirect, insertCrossRepoTrustStrictDirect, insertKiciEventAtDirect, insertKiciEventRawDirect, insertPeerCredentialExpiredDirect, insertWorkflowRegistrationRawDirect, insertWorkflowRegistrationStrictDirect, isLongerColdRetention, isPgUniqueViolation, isPoolAcquireTimeout, isSchemaCurrent, isSchemaCurrentFromFilesDirect, kiciMkdtemp, kiciTmpBase, latestExecutionRunByStatusDirect, listActiveGenericWebhookSourcesDirect, listActivePeerCredentialsExcludingDirect, listCheckRunTrackingDirect, listContextsDirect, listCrossRepoTrustBySourceRoutingKeyDirect, listExecutionJobsDirect, listExecutionRunsDirect, listHeldRunApprovalsDirect, listKiciEventsDirect, listQueueDirect, listRegistrationsByRoutingKeyDirect, listRegistrationsDirect, maskDatabaseUrl, paginateUnprocessedEventsKeysetDirect, parseDatabaseUrl, parseManifest, platformConnectionExistsDirect, pollKiciEventsDirect, prunePeerCredentialsDirect, purgeContextsDirect, purgeScopedSecretsDirect, purgeSecretBackendsDirect, purgeStaleExecutionDirect, purgeStaleSourcesDirect, readStoredMigrationContentHash, redactConfig, registerWorkflowManualDirect, resetRaftStateDirect, resolvePlatformWebhookSourceRoutingKeyDirect, resolveTableConfig, restoreSoftDeletedGenericWebhookSourceDirect, seedApiKeyInlineDirect, seedCiSecurityFixturesDirect, seedContextBindingDirect, seedContextDirect, seedCrossRepoTrustDirect, seedGenericWebhookSourceDirect, seedSourcePrivateKeyDirect, seedSyntheticGithubSourceDirect, seedUniversalGitSourceDirect, seedWebhookSecretDirect, serializeManifest, setContextPolicyDirect, setContextSecretDirect, setupGracefulShutdown, showContextDirect, showExecutionRunDirect, showKiciEventDirect, showQueueEntryDirect, showRegistrationDirect, splitAgentPlatform, storeMigrationContentHash, storeMigrationContentHashInTableDirect, tableExistsDirect, tablePrefix, tenantDayBucketPrefix, tenantDayPrefix, terminateIdleDbBackendsDirect, updateGenericWebhookVerificationConfigDirect, updateOrgSettingsDeniedReposDirect, updateSourceRoutingKeyDirect, updateWorkflowRegistrationCommitShaDirect, upsertCronLastFiredDirect, upsertOrgSettingsGlobalWorkflowsDirect, validateRequiredTools, verifyKiciEventNotifyDirect, waitForEventLogRowByDeliveryIdDirect, waitForExecutionRunReachesStatusSinceDirect, waitForLatestExecutionJobStatusDirect, waitForPlatformEventLogDistinctRoutedDirect, waitForPlatformExecutionRunStatusDirect, waitForPlatformRegistrationsDirect, waitForPostgresDirect, waitForRegistrationsByRoutingKeyDirect, waitForRegistrationsUpdatedAtAdvanceDirect, waitForRunCompletionDirect };

package/dist/telemetry/init.d.ts

@@ -17,14 +17,25 @@ export interface TelemetryConfig {
 export declare function initTelemetry(config: TelemetryConfig): NodeSDK;
 /** Get the PrometheusExporter instance created by initTelemetry(). */
 export declare function getPrometheusExporter(): PrometheusExporter | undefined;
+/** One instrument's identity plus the descriptor facts that decide its wire kind. */
+export interface RuntimeMetricDescriptor {
+    name: string;
+    dataPointType: number;
+    isMonotonic?: boolean;
+}
 /**
- * Boot `RuntimeNodeInstrumentation` standalone, exercise the event loop and
- * garbage collector, collect once, and return the set of dotted instrument
- * names it emitted. This is the ground truth for the curated runtime-metrics
- * catalog drift guard (`scripts/generate-prometheus.ts`). It deliberately
- * does NOT touch the singleton `_prometheusExporter` — it spins up an
- * isolated SDK so it can be called from tooling without affecting a running
- * service's telemetry.
+ * The sorted set of dotted instrument names `RuntimeNodeInstrumentation`
+ * emits. This is the ground truth for the curated runtime-metrics catalog
+ * drift guard (`scripts/generate-prometheus.ts`).
  */
 export declare function collectRuntimeMetricNames(): Promise<string[]>;
+/**
+ * Like `collectRuntimeMetricNames`, but also returns each instrument's
+ * descriptor type and monotonicity — the facts that decide the wire kind the
+ * Platform admits it as. Ground truth for the drift guard's kind check.
+ *
+ * Deliberately not exported from the package barrel: it is tooling ground truth,
+ * and `@kici-dev/shared` is a published surface.
+ */
+export declare function collectRuntimeMetricDescriptors(): Promise<RuntimeMetricDescriptor[]>;
 //# sourceMappingURL=init.d.ts.map

package/dist/telemetry/init.js

@@ -38,14 +38,12 @@ function getPrometheusExporter() {
 }
 /**
 * Boot `RuntimeNodeInstrumentation` standalone, exercise the event loop and
-* garbage collector, collect once, and return the set of dotted instrument
-* names it emitted. This is the ground truth for the curated runtime-metrics
-* catalog drift guard (`scripts/generate-prometheus.ts`). It deliberately
-* does NOT touch the singleton `_prometheusExporter` — it spins up an
-* isolated SDK so it can be called from tooling without affecting a running
-* service's telemetry.
+* garbage collector, collect once, and return one descriptor per instrument it
+* emitted. It deliberately does NOT touch the singleton `_prometheusExporter` —
+* it spins up an isolated SDK so it can be called from tooling without
+* affecting a running service's telemetry.
 */
-async function collectRuntimeMetricNames() {
+async function probeRuntimeInstruments() {
 	const exporter = new PrometheusExporter({ preventServerStart: true });
 	const sdk = new NodeSDK({
 		resource: resourceFromAttributes({ [ATTR_SERVICE_NAME]: "runtime-metrics-drift-guard" }),
@@ -61,13 +59,40 @@ async function collectRuntimeMetricNames() {
 	}
 	if (typeof global.gc === "function") global.gc();
 	await new Promise((r) => setTimeout(r, 500));
-	const names = /* @__PURE__ */ new Set();
+	const descriptors = [];
 	const { resourceMetrics } = await exporter.collect();
-	for (const scopeMetrics of resourceMetrics.scopeMetrics) for (const metric of scopeMetrics.metrics) names.add(metric.descriptor.name);
+	for (const scopeMetrics of resourceMetrics.scopeMetrics) for (const metric of scopeMetrics.metrics) {
+		const m = metric;
+		descriptors.push({
+			name: m.descriptor.name,
+			dataPointType: m.dataPointType,
+			...m.isMonotonic === void 0 ? {} : { isMonotonic: m.isMonotonic }
+		});
+	}
 	await sdk.shutdown();
-	return [...names].sort();
+	return descriptors;
+}
+/**
+* The sorted set of dotted instrument names `RuntimeNodeInstrumentation`
+* emits. This is the ground truth for the curated runtime-metrics catalog
+* drift guard (`scripts/generate-prometheus.ts`).
+*/
+async function collectRuntimeMetricNames() {
+	const descriptors = await probeRuntimeInstruments();
+	return [...new Set(descriptors.map((d) => d.name))].sort();
+}
+/**
+* Like `collectRuntimeMetricNames`, but also returns each instrument's
+* descriptor type and monotonicity — the facts that decide the wire kind the
+* Platform admits it as. Ground truth for the drift guard's kind check.
+*
+* Deliberately not exported from the package barrel: it is tooling ground truth,
+* and `@kici-dev/shared` is a published surface.
+*/
+async function collectRuntimeMetricDescriptors() {
+	return (await probeRuntimeInstruments()).sort((a, b) => a.name.localeCompare(b.name));
 }
 //#endregion
-export { collectRuntimeMetricNames, getPrometheusExporter, initTelemetry };
+export { collectRuntimeMetricDescriptors, collectRuntimeMetricNames, getPrometheusExporter, initTelemetry };
 
 //# sourceMappingURL=init.js.map

package/dist/tmp-dir.d.ts

@@ -0,0 +1,14 @@
+import { kiciTmpBase } from '@kici-dev/core/tmp';
+/**
+ * Base directory for KiCI-created temp files. Honors the `KICI_TMPDIR` env var
+ * (creating it if it does not yet exist) so an operator can route KiCI's temp
+ * footprint onto a volume with room; falls back to the OS temp dir otherwise.
+ * Server-side only (Node fs/os) — do NOT import from browser-bundled code.
+ *
+ * Delegates to `@kici-dev/core/tmp`'s resolver so `KICI_TMPDIR` is read in
+ * exactly one place across the codebase.
+ */
+export { kiciTmpBase };
+/** Create a fresh unique temp dir under {@link kiciTmpBase} with `prefix`. */
+export declare function kiciMkdtemp(prefix: string): string;
+//# sourceMappingURL=tmp-dir.d.ts.map

package/dist/tmp-dir.js

@@ -0,0 +1,13 @@
+import "./rolldown-runtime-ClRpJifh.js";
+import { mkdtempSync } from "node:fs";
+import path from "node:path";
+import { kiciTmpBase } from "@kici-dev/core/tmp";
+//#region src/tmp-dir.ts
+/** Create a fresh unique temp dir under {@link kiciTmpBase} with `prefix`. */
+function kiciMkdtemp(prefix) {
+	return mkdtempSync(path.join(kiciTmpBase(), prefix));
+}
+//#endregion
+export { kiciMkdtemp, kiciTmpBase };
+
+//# sourceMappingURL=tmp-dir.js.map

package/dist/tmp-dir.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tmp-dir.test.d.ts.map

package/dist/tmp.d.ts

@@ -0,0 +1,2 @@
+export * from '@kici-dev/core/tmp';
+//# sourceMappingURL=tmp.d.ts.map

package/dist/tmp.js

@@ -0,0 +1,3 @@
+import "./rolldown-runtime-ClRpJifh.js";
+export * from "@kici-dev/core/tmp";
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/shared",
-  "version": "0.1.27",
+  "version": "0.2.0",
   "description": "Shared utilities for the KiCI CI/CD stack — logging, zx setup, crypto, telemetry, health and metrics routes. No business logic.",
   "keywords": [
     "ci",
@@ -50,10 +50,18 @@
       "import": "./dist/ts-loader-hook.js",
       "types": "./dist/ts-loader-hook.d.ts"
     },
+    "./tmp": {
+      "import": "./dist/tmp.js",
+      "types": "./dist/tmp.d.ts"
+    },
     "./idempotency": {
       "import": "./dist/idempotency.js",
       "types": "./dist/idempotency.d.ts"
     },
+    "./ci-env": {
+      "import": "./dist/ci-env.js",
+      "types": "./dist/ci-env.d.ts"
+    },
     "./idempotency-files": {
       "import": "./dist/idempotency-files.js",
       "types": "./dist/idempotency-files.d.ts"
@@ -84,36 +92,37 @@
     }
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1064.0",
+    "@aws-sdk/client-s3": "^3.1089.0",
     "@opentelemetry/api": "^1.9.1",
-    "@opentelemetry/exporter-metrics-otlp-http": "^0.218.0",
-    "@opentelemetry/exporter-prometheus": "^0.218.0",
-    "@opentelemetry/exporter-trace-otlp-http": "^0.218.0",
-    "@opentelemetry/instrumentation-runtime-node": "^0.31.0",
-    "@opentelemetry/resources": "^2.7.1",
-    "@opentelemetry/sdk-node": "^0.218.0",
-    "@opentelemetry/semantic-conventions": "^1.41.1",
+    "@opentelemetry/exporter-metrics-otlp-http": "^0.221.0",
+    "@opentelemetry/exporter-prometheus": "^0.221.0",
+    "@opentelemetry/exporter-trace-otlp-http": "^0.221.0",
+    "@opentelemetry/instrumentation-runtime-node": "^0.34.0",
+    "@opentelemetry/resources": "^2.10.0",
+    "@opentelemetry/sdk-node": "^0.221.0",
+    "@opentelemetry/semantic-conventions": "^1.43.0",
     "archiver": "^8.0.0",
     "diff": "^9.0.0",
-    "hono": "^4.12.25",
-    "kysely": "^0.29.2",
-    "oxc-transform": "0.135.0",
-    "pg": "^8.21.0",
+    "hono": "^4.12.32",
+    "kysely": "^0.29.4",
+    "oxc-transform": "0.140.0",
+    "pg": "^8.22.0",
     "picocolors": "^1.1.1",
     "winston": "^3.19.0",
     "winston-daily-rotate-file": "^5.0.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.27"
+    "@kici-dev/core": "0.2.0",
+    "@kici-dev/engine": "0.2.0"
   },
   "devDependencies": {
-    "@opentelemetry/sdk-trace-base": "^2.7.1",
+    "@opentelemetry/sdk-trace-base": "^2.10.0",
     "@types/archiver": "^8.0.0"
   },
   "scripts": {
-    "build": "node ../../scripts/build-ts.mjs && tsc --emitDeclarationOnly",
+    "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",
     "test": "vitest run",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsgo --noEmit"
   }
 }