@kici-dev/compiler 0.0.0 → 0.1.2

package/dist/commands/init.js

@@ -0,0 +1,393 @@
+import "../chunk-gOLHoazu.js";
+import { tsconfigTemplate } from "../templates/tsconfig-json.js";
+import { generatePackageJson } from "../templates/package-json.js";
+import { agentsMdTemplate } from "../templates/agents-md.js";
+import { workflowPaths } from "../templates/index.js";
+import { getTypeScriptPaths } from "../execution/sdk-alias.js";
+import { detectHookTools, findGitDir } from "../hooks/detector.js";
+import { installHook } from "../hooks/installer.js";
+import "../hooks/index.js";
+import pc from "picocolors";
+import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { initZx, logger, toErrorMessage } from "@kici-dev/shared";
+import { $ } from "zx";
+import { checkbox, confirm, select } from "@inquirer/prompts";
+//#region src/commands/init.ts
+/**
+* kici init command
+*
+* Creates .kici/ directory structure with workflow templates.
+* Supports TypeScript mode (with package.json/node_modules) and MJS mode (pure JS).
+*/
+/**
+* Initialize .kici/ directory with workflow templates
+*
+* @param options - Configuration options for initialization
+* @returns true on success, false on error
+*/
+async function initCommand(options = {}) {
+	initZx();
+	try {
+		const kiciDir = path.resolve(".kici");
+		const exists = await checkExists(kiciDir);
+		if (exists && !options.force) {
+			logger.error(pc.red("\nError: .kici/ directory already exists."));
+			logger.error(pc.gray("Use --force to overwrite.\n"));
+			return false;
+		}
+		if (exists && options.force) {
+			logger.info(pc.yellow("Removing existing .kici/ directory..."));
+			await rm(kiciDir, {
+				recursive: true,
+				force: true
+			});
+		}
+		const workflows = await selectWorkflows();
+		logger.info(pc.cyan("\nInitializing kici...\n"));
+		logger.info(pc.gray("Creating .kici/"));
+		await mkdir(kiciDir, { recursive: true });
+		logger.info(pc.gray("Creating .kici/workflows/"));
+		await mkdir(path.join(kiciDir, "workflows"), { recursive: true });
+		const defaultBranch = await detectDefaultBranch();
+		for (const workflow of workflows) {
+			logger.info(pc.gray(`Writing .kici/workflows/${workflow}.ts`));
+			const sourcePath = workflowPaths[workflow];
+			let content = await readFile(sourcePath, "utf-8");
+			if (defaultBranch !== "main") {
+				content = content.replaceAll("targeting('main')", `targeting('${defaultBranch}')`);
+				content = content.replaceAll("targeting the main branch", `targeting the ${defaultBranch} branch`);
+			}
+			await writeFile(path.join(kiciDir, "workflows", `${workflow}.ts`), content, "utf-8");
+		}
+		logger.info(pc.gray("Creating .kici/tests/"));
+		await mkdir(path.join(kiciDir, "tests"), { recursive: true });
+		logger.info(pc.gray("Writing .kici/tests/push-test.ts"));
+		const fixtureContent = generateSampleFixture(defaultBranch);
+		await writeFile(path.join(kiciDir, "tests", "push-test.ts"), fixtureContent, "utf-8");
+		logger.info(pc.green("Created sample test fixture at .kici/tests/push-test.ts"));
+		const kiciIgnorePath = path.resolve(".kiciignore");
+		if (!await checkExists(kiciIgnorePath)) {
+			logger.info(pc.gray("Writing .kiciignore"));
+			await writeFile(kiciIgnorePath, kiciIgnoreTemplate, "utf-8");
+		}
+		const devMode = options.useVerdaccioLocal || await detectDevelopmentMode();
+		logger.info(pc.gray("Writing .kici/package.json"));
+		const pkgContent = generatePackageJson(devMode);
+		await writeFile(path.join(kiciDir, "package.json"), pkgContent, "utf-8");
+		const useVerdaccio = devMode;
+		if (useVerdaccio) {
+			logger.info(pc.yellow("Pointing @kici-dev to local Verdaccio registry."));
+			const npmrc = "@kici-dev:registry=http://verdaccio.local:4873\n";
+			await writeFile(path.join(kiciDir, ".npmrc"), npmrc, "utf-8");
+			const rootNpmrc = path.resolve(".npmrc");
+			if (!await checkExists(rootNpmrc)) {
+				logger.info(pc.gray("Writing .npmrc (Verdaccio scope)"));
+				await writeFile(rootNpmrc, npmrc, "utf-8");
+			}
+		}
+		if (!options.mjs) {
+			logger.info(pc.gray("Writing .kici/tsconfig.json"));
+			const tsconfigContent = await generateTsConfig();
+			await writeFile(path.join(kiciDir, "tsconfig.json"), tsconfigContent, "utf-8");
+			await mkdir(path.join(kiciDir, "types"), { recursive: true });
+			logger.info(pc.gray("Created .kici/types/ for generated type declarations"));
+			if (!options.skipInstall) {
+				logger.info(pc.gray("Running npm install..."));
+				await $`cd ${kiciDir} && npm install`;
+			}
+		}
+		if (options.privateRegistry) await writePrivateRegistryScaffold(kiciDir, {
+			url: options.privateRegistry,
+			scope: options.privateRegistryScope,
+			secretRef: options.privateRegistrySecret ?? "production:NPM_TOKEN"
+		});
+		if (await shouldWriteAgentsMd(options)) await writeAgentsMd(kiciDir);
+		logger.info(pc.gray("Updating .gitignore"));
+		await updateGitignore(useVerdaccio);
+		if (process.stdout.isTTY && process.env.CI !== "true") {
+			if (await findGitDir()) await offerHookInstallation(useVerdaccio);
+		}
+		logger.info(pc.green("\n✓ kici initialized successfully!\n"));
+		logger.info(pc.gray("Next steps:"));
+		logger.info(pc.gray("  1. Edit workflows in .kici/workflows/"));
+		if (options.mjs || options.skipInstall) {
+			logger.info(pc.gray("  2. Run npm install in .kici/ to generate a lockfile"));
+			logger.info(pc.gray("  3. Test locally: kici test push"));
+			logger.info(pc.gray("  4. Commit .kici/ to your repository\n"));
+		} else {
+			logger.info(pc.gray("  2. Test locally: kici test push"));
+			logger.info(pc.gray("  3. Commit .kici/ to your repository\n"));
+		}
+		return true;
+	} catch (error) {
+		const message = toErrorMessage(error);
+		logger.error(pc.red(`\nError: ${message}\n`));
+		if (process.env.KICI_DEBUG === "true" && error instanceof Error && error.stack) logger.error(pc.gray(error.stack));
+		return false;
+	}
+}
+/**
+* Check if a path exists
+*
+* @param targetPath - Path to check
+* @returns true if exists, false otherwise
+*/
+async function checkExists(targetPath) {
+	try {
+		await access(targetPath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Select which workflows to include
+*
+* Interactive in TTY mode, defaults to all workflows in non-TTY/CI.
+*
+* @returns Array of workflow names to include
+*/
+async function selectWorkflows() {
+	if (!process.stdout.isTTY || process.env.CI === "true") return ["hello-world", "pr-checks"];
+	const selected = await checkbox({
+		message: "Which workflows would you like to include?",
+		choices: [{
+			name: "Hello World (minimal push example)",
+			value: "hello-world",
+			checked: true
+		}, {
+			name: "PR Checks (comprehensive PR workflow)",
+			value: "pr-checks",
+			checked: true
+		}]
+	});
+	if (selected.length === 0) return ["hello-world"];
+	return selected;
+}
+/**
+* Detect the default branch of the current git repository.
+*
+* Tries in order:
+* 1. git symbolic-ref refs/remotes/origin/HEAD (set after clone)
+* 2. Current branch (HEAD)
+* 3. Falls back to 'main'
+*/
+async function detectDefaultBranch() {
+	try {
+		const branch = (await $`git symbolic-ref refs/remotes/origin/HEAD`.quiet()).stdout.trim().replace("refs/remotes/origin/", "");
+		if (branch) return branch;
+	} catch {}
+	try {
+		const branch = (await $`git rev-parse --abbrev-ref HEAD`.quiet()).stdout.trim();
+		if (branch && branch !== "HEAD") return branch;
+	} catch {}
+	return "main";
+}
+/**
+* Detect if running in development mode
+*
+* Development mode uses workspace:* dependencies for local testing.
+* Checks:
+* 1. KICI_DEV environment variable
+* 2. Root package.json kici.development flag
+*
+* @returns true if in development mode
+*/
+async function detectDevelopmentMode() {
+	if (process.env.KICI_DEV === "true") return true;
+	try {
+		const content = await readFile(path.resolve(process.cwd(), "package.json"), "utf-8");
+		return JSON.parse(content).kici?.development === true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Generate tsconfig.json content with optional TypeScript path mappings.
+*
+* If sdkPath is configured in .kici/package.json, adds path mapping
+* to enable IDE autocomplete from local SDK source.
+*
+* @returns tsconfig.json content as string
+*/
+async function generateTsConfig() {
+	const typeScriptPaths = await getTypeScriptPaths();
+	if (!typeScriptPaths) return tsconfigTemplate;
+	const baseConfig = JSON.parse(tsconfigTemplate);
+	baseConfig.compilerOptions.paths = typeScriptPaths;
+	return JSON.stringify(baseConfig, null, 2) + "\n";
+}
+/**
+* Update .gitignore with .kici/ entries
+*
+* Safely appends to .gitignore, checking for existing entries to avoid duplicates.
+* Handles cases where .gitignore doesn't exist or already has broader patterns.
+*
+* @param useVerdaccio - When true, also adds .npmrc entries for .kici/ and root
+*/
+async function updateGitignore(useVerdaccio) {
+	const gitignorePath = path.resolve(".gitignore");
+	const entries = [".kici/node_modules/", ".kici/.secrets"];
+	if (useVerdaccio) entries.push(".kici/.npmrc", ".npmrc");
+	let content = "";
+	if (await checkExists(gitignorePath)) content = await readFile(gitignorePath, "utf-8");
+	const lines = content.split("\n");
+	if (lines.some((line) => {
+		const trimmed = line.trim();
+		return trimmed === ".kici/" || trimmed === ".kici/*";
+	})) return;
+	let newContent = content;
+	for (const entry of entries) if (!lines.some((line) => {
+		const trimmed = line.trim();
+		return trimmed === entry || trimmed === entry.replace(/\/$/, "");
+	})) newContent = newContent.endsWith("\n") || newContent === "" ? newContent + entry + "\n" : newContent + "\n" + entry + "\n";
+	await writeFile(gitignorePath, newContent, "utf-8");
+}
+/**
+* Scaffolds a private-registry example workflow + a `.kici/.npmrc.example`.
+* Both files are inert by default — the customer wires them up after editing.
+* Existing files are never overwritten.
+*/
+async function writePrivateRegistryScaffold(kiciDir, args) {
+	const scopeLine = args.scope ? `\n      scope: '${args.scope}',` : "";
+	const npmrcScopeLine = args.scope ? `${args.scope}:registry=${args.url}\n` : `registry=${args.url}\n`;
+	const url = args.url.replace(/\/+$/, "");
+	const workflowExample = `// Example: workflow declaring a private npm registry.
+// Copy or adapt into a real workflow under .kici/workflows/.
+//
+// The agent renders these into the .kici/.npmrc before running \`npm install\`.
+// The token is resolved from the qualified secret reference at dispatch time
+// (the orchestrator looks it up under the named environment's scoped secrets).
+import { workflow, job, step } from '@kici-dev/sdk';
+
+export default workflow('private-registry-example', {
+  registries: [
+    {
+      url: '${args.url}',${scopeLine}
+      tokenSecret: '${args.secretRef}',
+    },
+  ],
+  jobs: [
+    job('build', {
+      runsOn: 'linux',
+      steps: [step('install', async () => { /* deps install with auth */ })],
+    }),
+  ],
+});
+`;
+	const npmrcExample = `# Example .kici/.npmrc using the option C escape hatch.
+# Customer commits this file (without secret values), declares
+# \`installEnv: ['<env>:<NAME>']\` on the workflow to project the
+# secret as an env var on the install subprocess, and npm's native
+# \${VAR} substitution does the rest.
+${npmrcScopeLine}//${url.replace(/^https?:\/\//, "")}/:_authToken=\${MY_NPM_TOKEN}
+`;
+	const examplePath = path.join(kiciDir, "workflows", "private-registry-example.ts.example");
+	if (await checkExists(examplePath)) logger.info(pc.gray("Skipping .kici/workflows/private-registry-example.ts.example (already exists)"));
+	else {
+		logger.info(pc.gray("Writing .kici/workflows/private-registry-example.ts.example"));
+		await writeFile(examplePath, workflowExample, "utf-8");
+	}
+	const npmrcPath = path.join(kiciDir, ".npmrc.example");
+	if (await checkExists(npmrcPath)) logger.info(pc.gray("Skipping .kici/.npmrc.example (already exists)"));
+	else {
+		logger.info(pc.gray("Writing .kici/.npmrc.example"));
+		await writeFile(npmrcPath, npmrcExample, "utf-8");
+	}
+}
+/**
+* Generate sample test fixture content.
+* Uses the detected default branch for realistic fixture configuration.
+*/
+function generateSampleFixture(defaultBranch) {
+	return `import { fixture, push } from '@kici-dev/sdk';
+
+/**
+ * Sample test fixture: push to ${defaultBranch} branch.
+ *
+ * Run with: kici run remote push-${defaultBranch}
+ * List all:  kici run remote
+ */
+export const push${capitalize(defaultBranch)} = fixture('push-${defaultBranch}', {
+  event: push({ branches: ['${defaultBranch}'] }),
+});
+`;
+}
+/**
+* Capitalize the first letter of a string.
+*/
+function capitalize(s) {
+	return s.charAt(0).toUpperCase() + s.slice(1);
+}
+/** Default .kiciignore content */
+const kiciIgnoreTemplate = `node_modules/
+.git/
+dist/
+coverage/
+*.log
+`;
+/**
+* Decide whether to scaffold .kici/AGENTS.md. The flag wins; otherwise we
+* prompt in TTY mode (default Y) and default to writing in CI / non-TTY.
+*/
+async function shouldWriteAgentsMd(options) {
+	if (options.noAgentsMd) return false;
+	if (!process.stdout.isTTY || process.env.CI === "true") return true;
+	return await confirm({
+		message: "Add LLM authoring context (.kici/AGENTS.md)?",
+		default: true
+	});
+}
+/**
+* Write the AGENTS.md template. Never overwrites an existing file — the
+* customer may have hand-edited it for their project.
+*/
+async function writeAgentsMd(kiciDir) {
+	const target = path.join(kiciDir, "AGENTS.md");
+	if (await checkExists(target)) {
+		logger.info(pc.gray("Skipping .kici/AGENTS.md (already exists)"));
+		return;
+	}
+	logger.info(pc.gray("Writing .kici/AGENTS.md"));
+	await writeFile(target, agentsMdTemplate, "utf-8");
+}
+/**
+* Offer to install pre-commit hook.
+* Detects existing hook tools and prompts user.
+*/
+async function offerHookInstallation(useVerdaccio) {
+	const tools = await detectHookTools();
+	let selectedTool;
+	if (tools.length === 0) if (!await confirm({
+		message: "No pre-commit tool found. Install husky for git hooks?",
+		default: false
+	})) {
+		if (!await confirm({
+			message: "Add kici compile to .git/hooks/pre-commit instead?",
+			default: false
+		})) return;
+		selectedTool = "git";
+	} else selectedTool = "husky";
+	else if (tools.length === 1) {
+		if (!await confirm({
+			message: `Found ${tools[0].name}. Add kici compile hook?`,
+			default: true
+		})) return;
+		selectedTool = tools[0].name;
+	} else selectedTool = await select({
+		message: "Multiple pre-commit tools detected. Which would you like to use?",
+		choices: tools.map((t) => ({
+			name: t.name,
+			value: t.name
+		}))
+	});
+	const result = await installHook(selectedTool, { useVerdaccio });
+	if (result.success) if (result.action === "skipped") logger.info(pc.yellow(`Hook already installed: ${result.message}`));
+	else logger.info(pc.green(`Hook installed: ${result.message}`));
+	else logger.warn(pc.yellow(`Warning: ${result.message}`));
+}
+//#endregion
+export { initCommand };
+
+//# sourceMappingURL=init.js.map

package/dist/commands/login.d.ts

@@ -0,0 +1,23 @@
+export interface LoginOptions {
+    /** API key for non-interactive authentication */
+    token?: string;
+    /** Orchestrator URL for direct connection */
+    endpoint?: string;
+    /** Platform relay URL */
+    platformEndpoint?: string;
+    /** Routing key for webhook source identification */
+    routingKey?: string;
+    /** Force device authorization flow regardless of environment */
+    device?: boolean;
+}
+/**
+ * Authenticate with KiCI.
+ *
+ * - With `--token`, saves the API key directly (legacy flow)
+ * - Without `--token`, runs OAuth flow: PKCE (desktop) or device (headless)
+ * - With `--device`, forces device authorization flow
+ *
+ * Returns true on success, false on error.
+ */
+export declare function loginCommand(options: LoginOptions): Promise<boolean>;
+//# sourceMappingURL=login.d.ts.map

package/dist/commands/login.js

@@ -0,0 +1,144 @@
+import "../chunk-gOLHoazu.js";
+import { getConfigPath, mergeGlobalConfig } from "../remote/config.js";
+import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
+import { isHeadless } from "../auth/headless-detect.js";
+import pc from "picocolors";
+import { toErrorMessage } from "@kici-dev/shared";
+import os from "node:os";
+import { createInterface } from "node:readline";
+//#region src/commands/login.ts
+/**
+* Prompt the user for input via stdin.
+* Returns the trimmed input string.
+*/
+async function promptInput(prompt) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+	return new Promise((resolve) => {
+		rl.question(prompt, (answer) => {
+			rl.close();
+			resolve(answer.trim());
+		});
+	});
+}
+/**
+* Check if a PAT is expiring within 7 days and print a warning.
+*/
+function checkPatExpiry(expiresAt) {
+	const expiryDate = new Date(expiresAt);
+	const now = /* @__PURE__ */ new Date();
+	const daysUntilExpiry = (expiryDate.getTime() - now.getTime()) / (1e3 * 60 * 60 * 24);
+	if (daysUntilExpiry <= 7 && daysUntilExpiry > 0) {
+		console.log(pc.yellow(`\n  Warning: your personal access token expires in ${Math.ceil(daysUntilExpiry)} day(s) (${expiryDate.toLocaleDateString()}).`));
+		console.log(pc.yellow("  Run `kici login` again to refresh it."));
+	}
+}
+/**
+* Run the OAuth authentication flow (PKCE or device flow).
+*
+* Steps:
+* 1. Detect environment (headless vs desktop)
+* 2. Run appropriate OAuth flow to get OIDC access token
+* 3. Exchange OIDC token for a personal access token (PAT)
+* 4. Save PAT to global config
+*/
+async function oauthLogin(options) {
+	const platformUrl = options.platformEndpoint || process.env.KICI_PLATFORM_URL || "";
+	const issuer = process.env.KICI_OIDC_ISSUER || "";
+	const clientId = process.env.KICI_OIDC_CLIENT_ID || "";
+	const projectId = process.env.KICI_OIDC_PROJECT_ID || "";
+	const missing = [];
+	if (!platformUrl) missing.push("KICI_PLATFORM_URL");
+	if (!issuer) missing.push("KICI_OIDC_ISSUER");
+	if (!clientId) missing.push("KICI_OIDC_CLIENT_ID");
+	if (missing.length > 0) {
+		console.error(pc.red(`Error: missing required env var(s) for OAuth login: ${missing.join(", ")}`));
+		console.error(pc.gray("  Set them to your Platform and Zitadel endpoints, for example:"));
+		console.error(pc.gray("    export KICI_PLATFORM_URL=https://your-platform.example.com"));
+		console.error(pc.gray("    export KICI_OIDC_ISSUER=https://your-zitadel.example.com"));
+		console.error(pc.gray("    export KICI_OIDC_CLIENT_ID=<cli-client-id>"));
+		return false;
+	}
+	console.log(pc.cyan("\n  Step 1/4: Detecting environment..."));
+	const browserCmdSet = !!process.env.KICI_BROWSER_CMD;
+	const useDeviceFlow = options.device || !browserCmdSet && isHeadless();
+	const flowName = useDeviceFlow ? "device authorization" : "PKCE (browser)";
+	console.log(pc.gray(`  Using ${flowName} flow`));
+	console.log(pc.cyan(`\n  Step 2/4: Authenticating with ZITADEL (${flowName})...`));
+	let accessToken;
+	const oauthOpts = {
+		issuer,
+		clientId,
+		projectId: projectId || void 0
+	};
+	if (useDeviceFlow) accessToken = await deviceFlow(oauthOpts);
+	else accessToken = await pkceFlow(oauthOpts);
+	console.log(pc.cyan("\n  Step 3/4: Exchanging token for personal access token..."));
+	const machineName = os.hostname();
+	const patResult = await exchangeTokenForPat({
+		platformUrl,
+		accessToken,
+		machineName
+	});
+	console.log(pc.cyan("\n  Step 4/4: Saving credentials..."));
+	const configUpdate = {
+		pat: patResult.token,
+		patId: patResult.id,
+		patExpiresAt: patResult.expiresAt
+	};
+	if (options.endpoint) configUpdate.endpoint = options.endpoint;
+	if (options.platformEndpoint) configUpdate.platformEndpoint = options.platformEndpoint;
+	if (options.routingKey) configUpdate.routingKey = options.routingKey;
+	await mergeGlobalConfig(configUpdate);
+	const configPath = getConfigPath();
+	const expiryDate = new Date(patResult.expiresAt).toLocaleDateString();
+	console.log(pc.green(`\n  Authenticated successfully!`));
+	console.log(pc.gray(`  PAT expires: ${expiryDate}`));
+	console.log(pc.gray(`  Config saved to ${configPath}`));
+	checkPatExpiry(patResult.expiresAt);
+	return true;
+}
+/**
+* Authenticate with KiCI.
+*
+* - With `--token`, saves the API key directly (legacy flow)
+* - Without `--token`, runs OAuth flow: PKCE (desktop) or device (headless)
+* - With `--device`, forces device authorization flow
+*
+* Returns true on success, false on error.
+*/
+async function loginCommand(options) {
+	try {
+		if (options.token !== void 0) return await legacyTokenLogin(options);
+		return await oauthLogin(options);
+	} catch (err) {
+		const message = toErrorMessage(err);
+		console.error(pc.red(`\n  Login failed: ${message}`));
+		return false;
+	}
+}
+/**
+* Legacy login flow: saves an API key directly to config.
+*/
+async function legacyTokenLogin(options) {
+	let token = options.token;
+	if (token === void 0) token = await promptInput("Enter your KiCI API key: ");
+	if (!token || token.length === 0) {
+		console.error(pc.red("Error: API key cannot be empty"));
+		return false;
+	}
+	const update = { token };
+	if (options.endpoint) update.endpoint = options.endpoint;
+	if (options.platformEndpoint) update.platformEndpoint = options.platformEndpoint;
+	if (options.routingKey) update.routingKey = options.routingKey;
+	await mergeGlobalConfig(update);
+	const configPath = getConfigPath();
+	console.log(pc.green(`Authenticated successfully. Config saved to ${configPath}`));
+	return true;
+}
+//#endregion
+export { loginCommand };
+
+//# sourceMappingURL=login.js.map

package/dist/commands/logout.d.ts

@@ -0,0 +1,18 @@
+/**
+ * kici logout command
+ *
+ * Revokes PAT server-side and clears local auth config.
+ */
+/**
+ * Logout from KiCI.
+ *
+ * 1. Revokes the PAT server-side (DELETE /api/v1/pats/:id)
+ * 2. Clears auth fields from local config (preserves non-auth settings)
+ *
+ * If server revocation fails (network error), still clears local config
+ * with a warning that the PAT will expire automatically.
+ *
+ * @returns true on completion (always succeeds from user's perspective)
+ */
+export declare function logoutCommand(): Promise<boolean>;
+//# sourceMappingURL=logout.d.ts.map

package/dist/commands/logout.js

@@ -0,0 +1,55 @@
+import "../chunk-gOLHoazu.js";
+import { getConfigPath, loadGlobalConfig, saveGlobalConfig } from "../remote/config.js";
+import pc from "picocolors";
+//#region src/commands/logout.ts
+/**
+* kici logout command
+*
+* Revokes PAT server-side and clears local auth config.
+*/
+/**
+* Logout from KiCI.
+*
+* 1. Revokes the PAT server-side (DELETE /api/v1/pats/:id)
+* 2. Clears auth fields from local config (preserves non-auth settings)
+*
+* If server revocation fails (network error), still clears local config
+* with a warning that the PAT will expire automatically.
+*
+* @returns true on completion (always succeeds from user's perspective)
+*/
+async function logoutCommand() {
+	const config = await loadGlobalConfig();
+	if (!config.pat && !config.token) {
+		console.log(pc.gray("Not logged in."));
+		return true;
+	}
+	if (config.patId && config.platformEndpoint) try {
+		const url = `${config.platformEndpoint}/api/v1/pats/${config.patId}`;
+		if ((await fetch(url, {
+			method: "DELETE",
+			headers: {
+				Authorization: `Bearer ${config.pat}`,
+				"Content-Type": "application/json"
+			}
+		})).ok) console.log(pc.green("PAT revoked on server."));
+		else console.log(pc.yellow("Warning: could not revoke PAT on server (will expire automatically)."));
+	} catch {
+		console.log(pc.yellow("Warning: could not revoke PAT on server (will expire automatically)."));
+	}
+	const cleanConfig = { ...config };
+	delete cleanConfig.pat;
+	delete cleanConfig.patId;
+	delete cleanConfig.patExpiresAt;
+	delete cleanConfig.userEmail;
+	delete cleanConfig.activeOrgId;
+	delete cleanConfig.token;
+	await saveGlobalConfig(cleanConfig);
+	const configPath = getConfigPath();
+	console.log(pc.green(`Logged out. Config cleared at ${configPath}.`));
+	return true;
+}
+//#endregion
+export { logoutCommand };
+
+//# sourceMappingURL=logout.js.map

package/dist/commands/org.d.ts

@@ -0,0 +1,27 @@
+/**
+ * kici org commands
+ *
+ * Org management: list, use, current.
+ * Uses PAT auth to fetch user's organizations from Platform API.
+ */
+/**
+ * List user's organizations.
+ *
+ * Fetches orgs from Platform API and displays them as a formatted table.
+ * Active org is marked with a star.
+ */
+export declare function orgListCommand(): Promise<boolean>;
+/**
+ * Switch active organization.
+ *
+ * Matches by display name (case-insensitive) or ID.
+ * Validates org exists before setting.
+ */
+export declare function orgUseCommand(nameOrId: string): Promise<boolean>;
+/**
+ * Display current active organization.
+ *
+ * If PAT is available, fetches org name for display.
+ */
+export declare function orgCurrentCommand(): Promise<boolean>;
+//# sourceMappingURL=org.d.ts.map