@kici-dev/compiler 0.1.13 → 0.1.15

package/README.md

@@ -1 +1,21 @@
-TBD
+# @kici-dev/compiler
+
+Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.
+
+Part of [KiCI](https://kici.dev) — CI/CD workflows as TypeScript code: author them with full language power, dry-run them locally, and run them on your own infrastructure.
+
+## Install
+
+Usually consumed through the [`kici`](https://www.npmjs.com/package/kici) wrapper CLI:
+
+```bash
+npm install -g kici
+```
+
+Direct install (`npm install --save-dev @kici-dev/compiler`) works too when you want the library API.
+
+## Links
+
+- Documentation: <https://docs.kici.dev/user/cli-reference/>
+- Source: <https://github.com/kici-dev/kici-public/tree/main/packages/compiler>
+- License: Apache-2.0

package/dist/cli.js

@@ -1,29 +1,10 @@
 #!/usr/bin/env node
 import "./chunk-gOLHoazu.js";
 import { shouldSuppressBanner } from "./cli-banner.js";
-import { compileCommand } from "./commands/compile.js";
-import { watchCommand } from "./commands/watch.js";
-import { fixtureCommand } from "./commands/fixture.js";
-import { testCommand } from "./commands/test.js";
-import { runLocalCommand, runRemoteCommand } from "./commands/run.js";
-import { initCommand } from "./commands/init.js";
-import { hookInstallCommand } from "./commands/hook.js";
-import { loginCommand } from "./commands/login.js";
-import { secretsListCommand } from "./commands/secrets-list.js";
-import { statusCommand } from "./commands/status.js";
-import { typesCommand } from "./commands/types.js";
-import { endpointsCommand } from "./commands/endpoints.js";
-import { orgCurrentCommand, orgListCommand, orgUseCommand } from "./commands/org.js";
-import { logoutCommand } from "./commands/logout.js";
-import { cancelCommand } from "./commands/cancel.js";
-import { workflowsListCommand } from "./commands/workflows.js";
-import { drainWorkerCommand } from "./commands/drain-worker.js";
-import { docsCommand, docsLlmCommand } from "./commands/docs.js";
-import "./commands/index.js";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.13";
+const version = "0.1.15";
 const program = new Command();
 program.name("kici").description("KiCI workflow compiler").version(version);
 program.hook("preAction", (_thisCommand, actionCommand) => {
@@ -34,6 +15,7 @@ program.configureOutput({ outputError: (str, write) => {
 	write(pc.red(str));
 } });
 program.command("compile").description("Compile workflows from .kici/workflows/ to kici.lock.json").option("--check", "Validate workflows without writing lock file", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--verbose", "Detailed output", false).option("--watch", "Watch for changes and recompile", false).action(async (options) => {
+	const { compileCommand, watchCommand } = await import("./commands/index.js");
 	if (options.watch) await watchCommand({
 		kiciDir: options.kiciDir,
 		verbose: options.verbose
@@ -49,6 +31,7 @@ program.command("compile").description("Compile workflows from .kici/workflows/
 });
 const fixtureEventArg = new Argument("<event>", "Event to generate fixture for (e.g., pr:open, push, schedule, lifecycle:workflow_complete)");
 program.command("fixture").addArgument(fixtureEventArg).description("Generate fixture template for event type").option("--output <path>", "Write to file instead of stdout").action(async (event, options) => {
+	const { fixtureCommand } = await import("./commands/index.js");
 	await fixtureCommand(event, options);
 });
 const runCommand = program.command("run").description("Execute workflows locally or remotely");
@@ -61,6 +44,7 @@ runCommand.command("local").argument("[event]", "Event type (e.g., push, pr:open
 		console.error("Error: missing event argument. Pass an event or use --pick.");
 		process.exit(2);
 	}
+	const { runLocalCommand } = await import("./commands/index.js");
 	const success = await runLocalCommand({
 		event,
 		pick: options.pick,
@@ -84,15 +68,21 @@ runCommand.command("local").argument("[event]", "Event type (e.g., push, pr:open
 	});
 	process.exit(success ? 0 : 1);
 });
-runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--secret <key=value>", "Inject flat secret (repeatable)", (val, prev) => [...prev, val], []).option("--context <ctx.key=value>", "Inject context secret (repeatable)", (val, prev) => [...prev, val], []).action(async (fixture, options) => {
-	const success = await runRemoteCommand(fixture, options);
+runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).action(async (fixture, options) => {
+	const { runRemoteCommand } = await import("./commands/index.js");
+	const success = await runRemoteCommand(fixture, {
+		...options,
+		envFlags: options.env
+	});
 	process.exit(success ? 0 : 1);
 });
 program.command("test").argument("[event]", "Event type to preview (e.g., push, pr:open, schedule)").description("Preview which workflows match a trigger event (dry-run)").option("--branch <name>", "Override target branch for trigger matching (default: main)").option("--sha <hash>", "Override commit SHA").option("--workflow <name>", "Filter to specific workflow in display").option("--job <name>", "Filter to specific job in display").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--files <path>", "Simulate changed file path for trigger matching (repeatable)", (val, prev) => [...prev, val], []).option("--secret <key=value>", "Inject flat secret (repeatable)", (val, prev) => [...prev, val], []).option("--context <ctx.key=value>", "Inject context secret (repeatable)", (val, prev) => [...prev, val], []).action(async (event, options) => {
+	const { testCommand } = await import("./commands/index.js");
 	const success = await testCommand(event, options);
 	process.exit(success ? 0 : 1);
 });
 program.command("init").description("Initialize .kici/ directory with default workflows").option("--force", "Overwrite existing .kici/ directory", false).option("--skip-install", "Create files without installing dependencies", false).option("--package-manager <npm|pnpm|yarn>", "Force a package manager for the install step (default: auto-detect)").option("--mjs", "JavaScript-only mode (no TypeScript, no dependencies)", false).option("--no-agents-md", "Skip writing .kici/AGENTS.md (LLM authoring context)").option("--private-registry <url>", "Scaffold a workflow registries: entry pointing at <url>").option("--private-registry-scope <scope>", "Optional npm package scope (e.g. @my-org) for the private registry").option("--private-registry-secret <ref>", "Qualified secret reference (env:NAME) the private registry token comes from", "production:NPM_TOKEN").addOption(new Option("--use-verdaccio-local").default(false).hideHelp()).action(async (options) => {
+	const { initCommand } = await import("./commands/index.js");
 	const success = await initCommand({
 		...options,
 		noAgentsMd: options.agentsMd === false
@@ -100,6 +90,7 @@ program.command("init").description("Initialize .kici/ directory with default wo
 	process.exit(success ? 0 : 1);
 });
 program.command("hook").description("Manage pre-commit hooks").command("install").description("Install kici compile pre-commit hook").option("--git", "Use raw git hook (.git/hooks/pre-commit)", false).action(async (options) => {
+	const { hookInstallCommand } = await import("./commands/index.js");
 	const success = await hookInstallCommand({ git: options.git });
 	process.exit(success ? 0 : 1);
 });
@@ -111,6 +102,7 @@ Environment variables:
   KICI_OIDC_ISSUER     Override OIDC issuer URL
   KICI_OIDC_CLIENT_ID  Override OIDC client ID
 `).action(async (options) => {
+	const { loginCommand } = await import("./commands/index.js");
 	const success = await loginCommand({
 		token: options.token,
 		device: options.device,
@@ -121,27 +113,33 @@ Environment variables:
 	process.exit(success ? 0 : 1);
 });
 program.command("logout").description("Revoke PAT and clear local credentials").action(async () => {
+	const { logoutCommand } = await import("./commands/index.js");
 	const success = await logoutCommand();
 	process.exit(success ? 0 : 1);
 });
 const orgCommand = program.command("org").description("Manage organizations");
 orgCommand.command("list").description("List organizations you belong to").action(async () => {
+	const { orgListCommand } = await import("./commands/index.js");
 	const success = await orgListCommand();
 	process.exit(success ? 0 : 1);
 });
 orgCommand.command("use").argument("<name>", "Organization name or ID").description("Switch active organization").action(async (name) => {
+	const { orgUseCommand } = await import("./commands/index.js");
 	const success = await orgUseCommand(name);
 	process.exit(success ? 0 : 1);
 });
 orgCommand.command("current").description("Show current active organization").action(async () => {
+	const { orgCurrentCommand } = await import("./commands/index.js");
 	const success = await orgCurrentCommand();
 	process.exit(success ? 0 : 1);
 });
 program.command("secrets").description("Manage secrets").command("list").description("List test-available secret contexts").option("--endpoint <url>", "Orchestrator URL override").action(async (options) => {
+	const { secretsListCommand } = await import("./commands/index.js");
 	const success = await secretsListCommand({ endpoint: options.endpoint });
 	process.exit(success ? 0 : 1);
 });
 program.command("status").argument("<run-id>", "Run ID to inspect").description("Show status and details of a test run").option("--logs", "Stream full log replay", false).option("--job <name>", "Filter logs to specific job").option("--json", "Output raw JSON", false).action(async (runId, options) => {
+	const { statusCommand } = await import("./commands/index.js");
 	const success = await statusCommand(runId, {
 		logs: options.logs,
 		job: options.job,
@@ -150,6 +148,7 @@ program.command("status").argument("<run-id>", "Run ID to inspect").description(
 	process.exit(success ? 0 : 1);
 });
 program.command("cancel").argument("[run-id]", "Run ID to cancel").description("Cancel a running workflow or all runs on a branch").option("--force", "Force cancel (kill immediately, skip hooks)", false).option("--branch <name>", "Cancel all in-progress runs on this branch").action(async (runId, options) => {
+	const { cancelCommand } = await import("./commands/index.js");
 	const success = await cancelCommand(runId, {
 		force: options.force,
 		branch: options.branch
@@ -157,6 +156,7 @@ program.command("cancel").argument("[run-id]", "Run ID to cancel").description("
 	process.exit(success ? 0 : 1);
 });
 program.command("types").description("Generate TypeScript declarations for secret contexts").option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--endpoint <url>", "Orchestrator URL override").action(async (options) => {
+	const { typesCommand } = await import("./commands/index.js");
 	const success = await typesCommand({
 		kiciDir: options.kiciDir,
 		endpoint: options.endpoint
@@ -164,10 +164,12 @@ program.command("types").description("Generate TypeScript declarations for secre
 	process.exit(success ? 0 : 1);
 });
 program.command("endpoints").description("List all webhook entrypoints for the current project").option("--kici-dir <path>", "Path to .kici directory", ".kici").action(async (options) => {
+	const { endpointsCommand } = await import("./commands/index.js");
 	const success = await endpointsCommand({ kiciDir: options.kiciDir });
 	process.exit(success ? 0 : 1);
 });
 program.command("workflows").description("Manage workflow registrations").command("list").description("List permanently registered workflows").option("--json", "Output as JSON", false).option("--stale <duration>", "Filter stale registrations (e.g., 30d, 7d)").option("--trigger-type <type>", "Filter by trigger type").option("--repo <repo>", "Filter by repository").action(async (options) => {
+	const { workflowsListCommand } = await import("./commands/index.js");
 	const success = await workflowsListCommand({
 		json: options.json,
 		stale: options.stale,
@@ -177,9 +179,11 @@ program.command("workflows").description("Manage workflow registrations").comman
 	process.exit(success ? 0 : 1);
 });
 program.command("docs").description("Open the KiCI documentation site in the default browser").option("--no-open", "Print the docs URL instead of opening a browser").action(async (options) => {
+	const { docsCommand } = await import("./commands/index.js");
 	const success = await docsCommand({ open: options.open });
 	process.exit(success ? 0 : 1);
 }).command("llm").description("Print the bundled LLM context (llms-full.txt) to stdout").option("--index", "Print the curated llms.txt index instead of the full bundle", false).option("--out <path>", "Write the bundle to a file instead of stdout").action(async (options) => {
+	const { docsLlmCommand } = await import("./commands/index.js");
 	const success = await docsLlmCommand({
 		index: options.index,
 		out: options.out
@@ -187,6 +191,7 @@ program.command("docs").description("Open the KiCI documentation site in the def
 	process.exit(success ? 0 : 1);
 });
 program.command("admin").description("Operator-facing commands for running instances").command("drain-worker").description("Trigger graceful drain on a worker instance").requiredOption("--url <url>", "Worker URL (e.g., http://worker-host:<port>)").action(async (options) => {
+	const { drainWorkerCommand } = await import("./commands/index.js");
 	const success = await drainWorkerCommand({ url: options.url });
 	process.exit(success ? 0 : 1);
 });

package/dist/commands/cancel.js

@@ -1,7 +1,7 @@
 import "../chunk-gOLHoazu.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
-import { logger, toErrorMessage } from "@kici-dev/shared";
+import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/cancel.ts
 /**
 * kici cancel command

package/dist/commands/compile.js

@@ -11,8 +11,8 @@ import pc from "picocolors";
 import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { logger, toErrorMessage } from "@kici-dev/core";
 import { execSync } from "node:child_process";
-import { logger, toErrorMessage } from "@kici-dev/shared";
 //#region src/commands/compile.ts
 /**
 * Read the existing lock file and return its lockfileHash, if present.

package/dist/commands/docs.js

@@ -2,8 +2,8 @@ import "../chunk-gOLHoazu.js";
 import pc from "picocolors";
 import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { logger, toErrorMessage } from "@kici-dev/shared";
 import { fileURLToPath } from "node:url";
+import { logger, toErrorMessage } from "@kici-dev/core";
 import open from "open";
 //#region src/commands/docs.ts
 const __dirname = path.dirname(fileURLToPath(import.meta.url));

package/dist/commands/drain-worker.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
 import pc from "picocolors";
-import { logger, toErrorMessage } from "@kici-dev/shared";
+import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/drain-worker.ts
 /**
 * kici admin drain-worker command

package/dist/commands/endpoints.js

@@ -5,7 +5,7 @@ import { loadGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { logger, toErrorMessage } from "@kici-dev/shared";
+import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/endpoints.ts
 /**
 * kici endpoints command

package/dist/commands/fixture.js

@@ -1,10 +1,10 @@
 import "../chunk-gOLHoazu.js";
-import { getDefaultFixture } from "../fixtures/defaults/index.js";
-import { detectRepoFromGit } from "../test-runner/git-detector.js";
 import { parseEventArg } from "../test-runner/event-types.js";
+import { detectRepoFromGit } from "../test-runner/git-detector.js";
+import { getDefaultFixture } from "../fixtures/defaults/index.js";
 import pc from "picocolors";
 import { writeFile } from "node:fs/promises";
-import { logger } from "@kici-dev/shared";
+import { logger } from "@kici-dev/core";
 //#region src/commands/fixture.ts
 /**
 * Fixture generation command

package/dist/commands/hook.js

@@ -5,7 +5,7 @@ import "../hooks/index.js";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { logger, toErrorMessage } from "@kici-dev/shared";
+import { logger, toErrorMessage } from "@kici-dev/core";
 import { select } from "@inquirer/prompts";
 //#region src/commands/hook.ts
 /**

package/dist/commands/index.js

@@ -1,20 +1,20 @@
 import "../chunk-gOLHoazu.js";
 import { compileCommand } from "./compile.js";
-import { watchCommand } from "./watch.js";
+import { cancelCommand } from "./cancel.js";
+import { docsCommand, docsLlmCommand } from "./docs.js";
+import { drainWorkerCommand } from "./drain-worker.js";
+import { endpointsCommand } from "./endpoints.js";
 import { fixtureCommand } from "./fixture.js";
+import { hookInstallCommand } from "./hook.js";
+import { watchCommand } from "./watch.js";
 import { testCommand, testDryRun } from "./test.js";
 import { runLocalCommand, runRemoteCommand } from "./run.js";
 import { initCommand } from "./init.js";
-import { hookInstallCommand } from "./hook.js";
 import { loginCommand } from "./login.js";
 import { secretsListCommand } from "./secrets-list.js";
 import { statusCommand } from "./status.js";
 import { typesCommand } from "./types.js";
-import { endpointsCommand } from "./endpoints.js";
 import { orgCurrentCommand, orgListCommand, orgUseCommand } from "./org.js";
 import { logoutCommand } from "./logout.js";
-import { cancelCommand } from "./cancel.js";
 import { workflowsListCommand } from "./workflows.js";
-import { drainWorkerCommand } from "./drain-worker.js";
-import { docsCommand, docsLlmCommand } from "./docs.js";
 export { cancelCommand, compileCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orgCurrentCommand, orgListCommand, orgUseCommand, runLocalCommand, runRemoteCommand, secretsListCommand, statusCommand, testCommand, testDryRun, typesCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.js

@@ -1,19 +1,19 @@
 import "../chunk-gOLHoazu.js";
+import { agentsMdTemplate } from "../templates/agents-md.js";
 import { tsconfigTemplate } from "../templates/tsconfig-json.js";
 import { generatePackageJson } from "../templates/package-json.js";
-import { agentsMdTemplate } from "../templates/agents-md.js";
 import { workflowPaths } from "../templates/index.js";
-import { getTypeScriptPaths } from "../execution/sdk-alias.js";
 import { detectHookTools, findGitDir } from "../hooks/detector.js";
 import { installHook } from "../hooks/installer.js";
 import "../hooks/index.js";
+import { getTypeScriptPaths } from "../execution/sdk-alias.js";
 import pc from "picocolors";
 import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { initZx, logger, toErrorMessage } from "@kici-dev/shared";
-import { detectPackageManager, installCommand, parsePackageManager } from "@kici-dev/shared/package-manager";
-import { $ } from "zx";
+import { initZx, logger, toErrorMessage } from "@kici-dev/core";
+import { detectPackageManager, installBuildPolicyArgs, installCommand, parsePackageManager } from "@kici-dev/core/package-manager";
 import { checkbox, confirm, select } from "@inquirer/prompts";
+import { $ } from "zx";
 //#region src/commands/init.ts
 /**
 * kici init command
@@ -94,9 +94,11 @@ async function initCommand(options = {}) {
 			await mkdir(path.join(kiciDir, "types"), { recursive: true });
 			logger.info(pc.gray("Created .kici/types/ for generated type declarations"));
 			if (!options.skipInstall) {
-				const [bin, action] = installCommand(await resolvePackageManager(options.packageManager));
+				const pm = await resolvePackageManager(options.packageManager);
+				const [bin, action] = installCommand(pm);
+				const buildPolicyArgs = installBuildPolicyArgs(pm);
 				logger.info(pc.gray(`Running ${bin} ${action}...`));
-				await $`cd ${kiciDir} && ${bin} ${action}`;
+				await $`cd ${kiciDir} && ${bin} ${action} ${buildPolicyArgs}`;
 			}
 		}
 		if (options.privateRegistry) await writePrivateRegistryScaffold(kiciDir, {

package/dist/commands/login.js

@@ -1,9 +1,10 @@
 import "../chunk-gOLHoazu.js";
 import { getConfigPath, mergeGlobalConfig } from "../remote/config.js";
 import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
+import "../remote/prod-defaults.js";
 import { isHeadless } from "../auth/headless-detect.js";
 import pc from "picocolors";
-import { toErrorMessage } from "@kici-dev/shared";
+import { toErrorMessage } from "@kici-dev/core";
 import os from "node:os";
 import { createInterface } from "node:readline";
 //#region src/commands/login.ts
@@ -45,21 +46,9 @@ function checkPatExpiry(expiresAt) {
 * 4. Save PAT to global config
 */
 async function oauthLogin(options) {
-	const platformUrl = options.platformEndpoint || process.env.KICI_PLATFORM_URL || "";
-	const issuer = process.env.KICI_OIDC_ISSUER || "";
-	const clientId = process.env.KICI_OIDC_CLIENT_ID || "";
-	const missing = [];
-	if (!platformUrl) missing.push("KICI_PLATFORM_URL");
-	if (!issuer) missing.push("KICI_OIDC_ISSUER");
-	if (!clientId) missing.push("KICI_OIDC_CLIENT_ID");
-	if (missing.length > 0) {
-		console.error(pc.red(`Error: missing required env var(s) for OAuth login: ${missing.join(", ")}`));
-		console.error(pc.gray("  Set them to your Platform and IdP endpoints, for example:"));
-		console.error(pc.gray("    export KICI_PLATFORM_URL=https://your-platform.example.com"));
-		console.error(pc.gray("    export KICI_OIDC_ISSUER=https://your-idp.example.com"));
-		console.error(pc.gray("    export KICI_OIDC_CLIENT_ID=<cli-client-id>"));
-		return false;
-	}
+	const platformUrl = options.platformEndpoint || process.env.KICI_PLATFORM_URL || "https://api.kici.dev";
+	const issuer = process.env.KICI_OIDC_ISSUER || "https://auth.kici.dev/realms/kici-internal";
+	const clientId = process.env.KICI_OIDC_CLIENT_ID || "kici-cli";
 	console.log(pc.cyan("\n  Step 1/4: Detecting environment..."));
 	const browserCmdSet = !!process.env.KICI_BROWSER_CMD;
 	const useDeviceFlow = options.device || !browserCmdSet && isHeadless();

package/dist/commands/run.js

@@ -1,20 +1,21 @@
 import "../chunk-gOLHoazu.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
-import { loadGlobalConfig } from "../remote/config.js";
 import { AuthenticationError, ConnectionError, OrchestratorClient } from "../remote/client.js";
-import { compileFixtures, filterFixtures } from "../fixtures/compiler.js";
-import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/uploader.js";
+import { loadGlobalConfig } from "../remote/config.js";
+import { RunHistory } from "../remote/history.js";
 import { ObserverClient } from "../remote/observer.js";
-import { StreamingFormatter } from "../remote/output/streaming.js";
-import { formatErrorHighlight, formatMultiFixtureSummary, formatSummary } from "../remote/output/summary.js";
+import { buildEncryptedSecrets } from "../remote/secret-upload.js";
+import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/uploader.js";
 import { formatJsonResult } from "../remote/output/json.js";
 import { formatJunitResult } from "../remote/output/junit.js";
-import { RunHistory } from "../remote/history.js";
+import { StreamingFormatter } from "../remote/output/streaming.js";
+import { formatErrorHighlight, formatMultiFixtureSummary, formatSummary } from "../remote/output/summary.js";
+import { compileFixtures, filterFixtures } from "../fixtures/compiler.js";
 import pc from "picocolors";
 import { readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
-import { formatBytes, logger, toErrorMessage } from "@kici-dev/shared";
+import { formatBytes, logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/run.ts
 /**
 * Run a workflow locally using the local executor.
@@ -185,7 +186,7 @@ async function runSingleFixture(fixture, client, options, config, history) {
 		let routingKey = options.routingKey ?? config.routingKey ?? "default";
 		if (!hasRemote) {
 			routingKey = `local:${path.basename(repoRoot)}`;
-			logger.warn("No remote detected -- steps that use git commands will fail (no .git directory)");
+			if (!options.quiet) logger.warn("No remote detected -- steps that use git commands will fail (no .git directory)");
 		}
 		let inlineLockFile;
 		if (!hasRemote) inlineLockFile = await readFile(path.join(kiciDir, "kici.lock.json"), "utf-8");
@@ -217,6 +218,7 @@ async function runSingleFixture(fixture, client, options, config, history) {
 			};
 		}
 		if (!options.quiet) logger.info(pc.gray("Triggering test run..."));
+		const encrypted = await buildEncryptedSecrets(kiciDir, options.envFlags, options.context, upload.publicKey);
 		const triggerResult = await client.triggerTest({
 			fixtureId: fixture.id,
 			event,
@@ -224,6 +226,10 @@ async function runSingleFixture(fixture, client, options, config, history) {
 			uploadId: upload.uploadId,
 			cliPublicKey: uploadResult.cliPublicKey.toString("base64"),
 			secrets: opts.secrets,
+			...encrypted && {
+				encryptedSecrets: encrypted.encryptedSecrets,
+				encryptedSecretsKey: encrypted.cliPublicKey
+			},
 			workflowName: opts.workflowName,
 			inlineLockFile,
 			fullRepo: !hasRemote || void 0
@@ -516,6 +522,7 @@ async function runDirectWorkflow(workflowName, options) {
 	const repoName = !hasRemote ? path.basename(repoRoot) : void 0;
 	const payload = {};
 	if (!hasRemote) payload.repository = { full_name: `local/${repoName}` };
+	const encrypted = await buildEncryptedSecrets(kiciDir, options.envFlags, options.context, upload.publicKey);
 	const result = await client.triggerTest({
 		fixtureId: `direct:${workflowName}`,
 		event: {
@@ -526,6 +533,10 @@ async function runDirectWorkflow(workflowName, options) {
 		routingKey,
 		uploadId: upload.uploadId,
 		cliPublicKey: directUploadResult.cliPublicKey.toString("base64"),
+		...encrypted && {
+			encryptedSecrets: encrypted.encryptedSecrets,
+			encryptedSecretsKey: encrypted.cliPublicKey
+		},
 		workflowName,
 		inlineLockFile,
 		fullRepo: !hasRemote || void 0

package/dist/commands/secrets-list.js

@@ -1,7 +1,7 @@
 import "../chunk-gOLHoazu.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
-import { toErrorMessage } from "@kici-dev/shared";
+import { toErrorMessage } from "@kici-dev/core";
 //#region src/commands/secrets-list.ts
 /**
 * List test-available secret contexts from the orchestrator.
@@ -47,7 +47,7 @@ async function secretsListCommand(options) {
 		const contexts = ((await res.json()).environments ?? []).filter((e) => e.allow_local_execution);
 		if (contexts.length === 0) {
 			console.log(pc.yellow("No test-available secret contexts found."));
-			console.log(pc.gray("Set allowLocalExecution=true on an environment to make its secrets available for test runs."));
+			console.log(pc.gray("Enable test runs (allowLocalExecution) on an environment to make its secrets available for test runs."));
 			return true;
 		}
 		console.log(pc.bold("\nTest-available secret contexts:\n"));

package/dist/commands/status.js

@@ -1,12 +1,12 @@
 import "../chunk-gOLHoazu.js";
 import { formatCapabilityGapError } from "../errors/capability-gap.js";
-import { loadGlobalConfig } from "../remote/config.js";
 import { AuthenticationError, ConnectionError, NotFoundError, OrchestratorClient } from "../remote/client.js";
-import { StreamingFormatter } from "../remote/output/streaming.js";
+import { loadGlobalConfig } from "../remote/config.js";
 import { RunHistory } from "../remote/history.js";
+import { StreamingFormatter } from "../remote/output/streaming.js";
 import { observeCompletion } from "./run.js";
 import pc from "picocolors";
-import { formatDuration, logger, toErrorMessage } from "@kici-dev/shared";
+import { formatDuration, logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/status.ts
 /**
 * kici status command
@@ -15,7 +15,7 @@ import { formatDuration, logger, toErrorMessage } from "@kici-dev/shared";
 * Looks up local history first, then fetches from the orchestrator for
 * up-to-date status and logs.
 */
-const CLI_VERSION = "0.1.13";
+const CLI_VERSION = "0.1.15";
 /**
 * Show status and details of a test run.
 *

package/dist/commands/test.d.ts

@@ -32,6 +32,8 @@ export interface RemoteRunOptions extends TestOptions {
     routingKey?: string;
     /** Show recent run history */
     history?: boolean;
+    /** --env KEY=VALUE flag values, uploaded as per-run secrets. */
+    envFlags?: string[];
 }
 /** Result of a single remote fixture run */
 export interface RemoteRunResult {

package/dist/commands/test.js

@@ -2,14 +2,14 @@ import "../chunk-gOLHoazu.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";
+import { displayDryRun } from "../test-runner/dry-run.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { buildEventPayload } from "../test-runner/payload-builder.js";
-import { displayDryRun } from "../test-runner/dry-run.js";
 import { loadSecretsFile } from "../test-runner/secrets-file.js";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { logger, toErrorMessage } from "@kici-dev/shared";
+import { logger, toErrorMessage } from "@kici-dev/core";
 import { matchAllWorkflows, normalizeRunsOn } from "@kici-dev/engine";
 //#region src/commands/test.ts
 /**

package/dist/commands/types.js

@@ -4,7 +4,7 @@ import { generateSecretsDts } from "../generators/secrets-dts.js";
 import pc from "picocolors";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { toErrorMessage } from "@kici-dev/shared";
+import { toErrorMessage } from "@kici-dev/core";
 //#region src/commands/types.ts
 /**
 * Generate TypeScript declarations for environment secrets.

package/dist/commands/watch.js

@@ -4,7 +4,7 @@ import "../execution/index.js";
 import { compileCommand } from "./compile.js";
 import pc from "picocolors";
 import path from "node:path";
-import { logger, toErrorMessage } from "@kici-dev/shared";
+import { logger, toErrorMessage } from "@kici-dev/core";
 import chokidar from "chokidar";
 //#region src/commands/watch.ts
 /** Debounce delay in milliseconds */

package/dist/commands/workflows.js

@@ -1,9 +1,9 @@
 import "../chunk-gOLHoazu.js";
-import { loadGlobalConfig } from "../remote/config.js";
-import { AuthenticationError, ConnectionError, OrchestratorClient, ServerError } from "../remote/client.js";
 import { formatRelativeTime } from "../format.js";
+import { AuthenticationError, ConnectionError, OrchestratorClient, ServerError } from "../remote/client.js";
+import { loadGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
-import { toErrorMessage } from "@kici-dev/shared";
+import { toErrorMessage } from "@kici-dev/core";
 //#region src/commands/workflows.ts
 /**
 * kici workflows list command

package/dist/execution/executor.js

@@ -1,6 +1,7 @@
 import "../chunk-gOLHoazu.js";
 import { compilerError } from "../errors/formatter.js";
 import "../errors/index.js";
+import { ensureTsLoaderHook } from "./ts-loader.js";
 import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
@@ -9,9 +10,10 @@ import { pathToFileURL } from "node:url";
 /**
 * Load a TypeScript workflow/config module by direct dynamic import.
 *
-* Relies on the shared `@kici-dev/shared/ts-loader-hook` ESM loader hook
-* registered by `packages/kici/bin/kici.js` (the same hook the agent registers
-* in its sandbox process). No Rolldown bundling: host-repo imports and
+* Relies on the `@kici-dev/core/ts-loader-hook` ESM loader hook, registered
+* lazily via `ensureTsLoaderHook()` just before the dynamic import (the same
+* hook the agent registers in its sandbox process). No Rolldown bundling:
+* host-repo imports and
 * transitive deps with dynamic import() resolve via Node's normal ESM loader
 * against the workspace's node_modules — the same module graph any other
 * `pnpm exec tsx` invocation would see. This keeps ops-style workflows (which
@@ -24,6 +26,7 @@ async function loadModule(entryPoint, errorContext) {
 		hashBundleSource = await fs.readFile(entryPoint, "utf-8");
 	} catch {}
 	try {
+		ensureTsLoaderHook();
 		return {
 			module: await import(pathToFileURL(entryPoint).href + `?t=${Date.now()}`),
 			hashBundleSource

package/dist/execution/sdk-alias.js

@@ -2,7 +2,7 @@ import "../chunk-gOLHoazu.js";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
-import { logger } from "@kici-dev/shared";
+import { logger } from "@kici-dev/core";
 //#region src/execution/sdk-alias.ts
 /**
 * SDK aliasing for development mode

package/dist/execution/ts-loader.d.ts

@@ -0,0 +1,2 @@
+export declare function ensureTsLoaderHook(): void;
+//# sourceMappingURL=ts-loader.d.ts.map

package/dist/execution/ts-loader.js

@@ -0,0 +1,13 @@
+import "../chunk-gOLHoazu.js";
+import { register } from "node:module";
+//#region src/execution/ts-loader.ts
+let registered = false;
+function ensureTsLoaderHook() {
+	if (registered) return;
+	registered = true;
+	register("@kici-dev/core/ts-loader-hook", import.meta.url);
+}
+//#endregion
+export { ensureTsLoaderHook };
+
+//# sourceMappingURL=ts-loader.js.map