@kici-dev/compiler 0.1.13 → 0.1.15

package/dist/llm-context/llms.txt

@@ -2,61 +2,62 @@
 
 > KiCI is a TypeScript-native CI/CD workflow engine. Workflows are defined in TypeScript (not YAML), compiled into a portable lock file, and executed by self-hosted agents. The docs below cover the SDK, the CLI, workflow patterns, and the runtime architecture an LLM coding agent needs in order to author and test KiCI workflows.
 
-The full markdown bundle of every page indexed here is available at https://kici.dev/llms-full.txt.
+The full markdown bundle of every page indexed here is available at https://docs.kici.dev/llms-full.txt.
 
 ## Getting started
 
-- [User guide](https://kici.dev/docs/user/): Writing and testing CI/CD workflows in TypeScript
-- [Getting started with KiCI](https://kici.dev/docs/user/getting-started/): Install the SDK, write your first workflow, compile and test locally
-- [5-minute quickstart](https://kici.dev/docs/user/quickstart/): Stand up a KiCI orchestrator + agent and run your first workflow
+- [User guide](https://docs.kici.dev/user/): Writing and testing CI/CD workflows in TypeScript
+- [Getting started with KiCI](https://docs.kici.dev/user/getting-started/): Install the SDK, write your first workflow, compile and test locally
+- [5-minute quickstart](https://docs.kici.dev/user/quickstart/): Stand up a KiCI orchestrator + agent and run your first workflow
 
 ## Workflow patterns
 
-- [Basic workflow patterns](https://kici.dev/docs/user/patterns/basic/): Basic CI, PR-only / push-only filters, multiple triggers, manual-only workflows
-- [Conditionals & matrix patterns](https://kici.dev/docs/user/patterns/conditionals-matrix/): Conditional execution with rules, matrix builds (static + dynamic), dynamic job generation
-- [Integration patterns](https://kici.dev/docs/user/patterns/integrations/): Workflow chaining, generic webhooks, Stripe, self-hosted git forges, plain GitHub repos
-- [Pattern reference](https://kici.dev/docs/user/patterns/reference/): Step context, examples repository, GitHub check run output — cross-cutting reference for all patterns
-- [Scheduling & event patterns](https://kici.dev/docs/user/patterns/scheduling-and-events/): Nightly cron, workflow-complete-triggered deploys, custom event chaining
+- [Basic workflow patterns](https://docs.kici.dev/user/patterns/basic/): Basic CI, PR-only / push-only filters, multiple triggers, manual-only workflows
+- [Conditionals & matrix patterns](https://docs.kici.dev/user/patterns/conditionals-matrix/): Conditional execution with rules, matrix builds (static + dynamic), dynamic job generation
+- [Integration patterns](https://docs.kici.dev/user/patterns/integrations/): Workflow chaining, generic webhooks, Stripe, self-hosted git forges, plain GitHub repos
+- [Pattern reference](https://docs.kici.dev/user/patterns/reference/): Step context, examples repository, GitHub check run output — cross-cutting reference for all patterns
+- [Scheduling & event patterns](https://docs.kici.dev/user/patterns/scheduling-and-events/): Nightly cron, workflow-complete-triggered deploys, custom event chaining
 
 ## SDK reference
 
-- [SDK reference: core](https://kici.dev/docs/user/sdk/core/): Factory functions (workflow, job, step) and authoring patterns: needs, output chaining, dynamic groups
-- [SDK reference: idempotent](https://kici.dev/docs/user/sdk/idempotent/): Idempotent helpers for declarative check / apply patterns inside workflow steps
-- [SDK reference: rules, matrix, dynamic jobs](https://kici.dev/docs/user/sdk/rules-matrix-dynamic/): rule(), skip(), matrix builds (static + dynamic), and dynamicJob / dynamicGroup
-- [SDK reference: runtime](https://kici.dev/docs/user/sdk/runtime/): Types index, StepContext, secrets, fixtures
-- [SDK reference: triggers](https://kici.dev/docs/user/sdk/triggers/): GitHub event triggers, kiciEvent, workflowComplete, jobComplete, genericWebhook, schedule, lifecycle
-- [SDK reference: validation & events](https://kici.dev/docs/user/sdk/validation-events/): validateDag(), event definitions, and event emission
-- [SDK reference: waitFor](https://kici.dev/docs/user/sdk/wait-for/): Polling helpers for steps that pause until an external condition becomes true
-- [SDK reference](https://kici.dev/docs/user/sdk-reference/): Complete API reference for @kici-dev/sdk -- workflows, jobs, steps, triggers, rules, matrix, validation, runtime
+- [Caching](https://docs.kici.dev/user/sdk/caching/): Cache files and directories across runs with declarative job/step cache or the imperative ctx.cache API
+- [SDK reference: core](https://docs.kici.dev/user/sdk/core/): Factory functions (workflow, job, step) and authoring patterns: needs, output chaining, dynamic groups
+- [Event payload reference](https://docs.kici.dev/user/sdk/event-payloads/): Generated schema of the normalized event envelope passed to rules and dynamic functions.
+- [SDK reference: idempotent](https://docs.kici.dev/user/sdk/idempotent/): Idempotent helpers for declarative check / apply patterns inside workflow steps
+- [SDK reference: rules, matrix, dynamic jobs](https://docs.kici.dev/user/sdk/rules-matrix-dynamic/): rule(), skip(), matrix builds (static + dynamic), and dynamicJob / dynamicGroup
+- [SDK reference: runtime](https://docs.kici.dev/user/sdk/runtime/): Types index, StepContext, secrets, fixtures
+- [SDK reference: triggers](https://docs.kici.dev/user/sdk/triggers/): GitHub event triggers, kiciEvent, workflowComplete, jobComplete, genericWebhook, schedule, lifecycle
+- [SDK reference: validation & events](https://docs.kici.dev/user/sdk/validation-events/): validateDag(), event definitions, and event emission
+- [SDK reference: waitFor](https://docs.kici.dev/user/sdk/wait-for/): Polling helpers for steps that pause until an external condition becomes true
+- [SDK reference](https://docs.kici.dev/user/sdk-reference/): Complete API reference for @kici-dev/sdk -- workflows, jobs, steps, triggers, rules, matrix, validation, runtime
 
 ## CLI and authoring
 
-- [CLI authentication](https://kici.dev/docs/user/cli-auth/): Authenticate the KiCI CLI with browser OAuth, device flow, or API key paste
-- [CLI reference](https://kici.dev/docs/user/cli-reference/): All CLI commands: compile, run (local/remote), test, login, logout, org, status, cancel, secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
-- [Lifecycle hooks](https://kici.dev/docs/user/hooks/): SDK hook API for cancel, cleanup, success, failure, and step-level callbacks
-- [Lock file and workflow drift](https://kici.dev/docs/user/lock-file-and-drift/): Keep the lock file in sync with your workflow source and avoid drift
-- [Testing guide](https://kici.dev/docs/user/testing-guide/): Running remote test fixtures with kici run remote
-- [Workflow patterns](https://kici.dev/docs/user/workflow-patterns/): Common patterns: monorepo builds, conditional jobs, dynamic matrices, generic webhooks, scheduling
+- [CLI authentication](https://docs.kici.dev/user/cli-auth/): Authenticate the KiCI CLI with browser OAuth, device flow, or API key paste
+- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), test, login, logout, org, status, cancel, secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
+- [Lifecycle hooks](https://docs.kici.dev/user/hooks/): SDK hook API for cancel, cleanup, success, failure, and step-level callbacks
+- [Lock file and workflow drift](https://docs.kici.dev/user/lock-file-and-drift/): Keep the lock file in sync with your workflow source and avoid drift
+- [Testing guide](https://docs.kici.dev/user/testing-guide/): Running remote test fixtures with kici run remote
+- [Workflow patterns](https://docs.kici.dev/user/workflow-patterns/): Common patterns: monorepo builds, conditional jobs, dynamic matrices, generic webhooks, scheduling
 
 ## Workflow features
 
-- [Concurrency groups](https://kici.dev/docs/user/concurrency/): Control parallel execution with auto-cancel and queue modes
-- [Dashboard](https://kici.dev/docs/user/dashboard/)
-- [Dynamic values](https://kici.dev/docs/user/dynamic-values/)
-- [Environment variables](https://kici.dev/docs/user/env-vars/): KICI_* environment variable reference for the CLI
-- [Environments](https://kici.dev/docs/user/environments/): Configure deployment environments with variables, secrets, and protection rules
-- [Event system](https://kici.dev/docs/user/events/): How KiCI's event model works -- event types, the registration model, event matching, and circuit breaker protection
-- [Global workflows](https://kici.dev/docs/user/global-workflows/): Cross-repo workflows that run on events from any repo in the same org
-- [Private npm registries](https://kici.dev/docs/user/private-registries/): Authenticate `npm install` against private registries (CodeArtifact, GitHub Packages, Verdaccio, …) from a workflow's `.kici/package.json`
-- [Secrets](https://kici.dev/docs/user/secrets/): How to access secrets in KiCI workflow steps
+- [Concurrency groups](https://docs.kici.dev/user/concurrency/): Control parallel execution with auto-cancel and queue modes
+- [Dashboard](https://docs.kici.dev/user/dashboard/)
+- [Dynamic values](https://docs.kici.dev/user/dynamic-values/)
+- [Environment variables](https://docs.kici.dev/user/env-vars/): KICI_* environment variable reference for the CLI
+- [Environments](https://docs.kici.dev/user/environments/): Configure deployment environments with variables, secrets, and protection rules
+- [Event system](https://docs.kici.dev/user/events/): How KiCI's event model works -- event types, the registration model, event matching, and circuit breaker protection
+- [Global workflows](https://docs.kici.dev/user/global-workflows/): Cross-repo workflows that run on events from any repo in the same org
+- [Private npm registries](https://docs.kici.dev/user/private-registries/): Authenticate `npm install` against private registries (CodeArtifact, GitHub Packages, Verdaccio, …) from a workflow's `.kici/package.json`
+- [Secrets](https://docs.kici.dev/user/secrets/): How to access secrets in KiCI workflow steps
 
 ## Providers
 
-- [GitHub App provider](https://kici.dev/docs/user/providers/github/): Connect KiCI to GitHub via a GitHub App — full Checks API, installation-token clones, and cross-org dispatch
-- [Universal-git provider](https://kici.dev/docs/user/providers/universal-git/): Connect Forgejo, Gitea, Gogs, GitLab, or plain GitHub via webhook + PAT or SSH deploy key
+- [GitHub App provider](https://docs.kici.dev/user/providers/github/): Connect KiCI to GitHub via a GitHub App — full Checks API, installation-token clones, and cross-org dispatch
+- [Universal-git provider](https://docs.kici.dev/user/providers/universal-git/): Connect Forgejo, Gitea, Gogs, GitLab, or plain GitHub via webhook + PAT or SSH deploy key
 
 ## Architecture overview
 
-- [Data flows](https://kici.dev/docs/architecture/data-flows/): End-to-end data flows through the KiCI three-tier architecture
-- [Design decisions](https://kici.dev/docs/architecture/design-decisions/): Why KiCI's architecture is shaped the way it is
-- [Architecture overview](https://kici.dev/docs/architecture/overview/): Three-tier relay model, package structure, and component responsibilities
+- [Data flows](https://docs.kici.dev/architecture/data-flows/): End-to-end data flows through the KiCI three-tier architecture
+- [Architecture overview](https://docs.kici.dev/architecture/overview/): Three-tier relay model, package structure, and component responsibilities

package/dist/local-executor/index.js

@@ -2,19 +2,19 @@ import "../chunk-gOLHoazu.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";
-import { compileCommand } from "../commands/compile.js";
-import { executeDag, resolveJobFilter } from "./dag-scheduler.js";
 import { loadLocalSecrets } from "./secret-loader.js";
+import { executeDag, resolveJobFilter } from "./dag-scheduler.js";
+import { compileCommand } from "../commands/compile.js";
 import { generateEventPayload } from "./payload-generator.js";
 import { executeResolvedJob, resolveJobs } from "./job-runner.js";
 import { displayLocalSummary, formatLocalJsonResult, formatLocalJunitResult } from "./output-streamer.js";
 import { PickerCancelledError, runPicker } from "./picker.js";
-import { materializeCheckout } from "./materializer.js";
+import { gcStaleRunCheckouts, materializeCheckout } from "./materializer.js";
 import { ConcurrencyKeyEvaluationError, acquireWorkflowLock } from "./workflow-lock.js";
 import pc from "picocolors";
 import { writeFile } from "node:fs/promises";
 import path from "node:path";
-import { logger } from "@kici-dev/shared";
+import { logger } from "@kici-dev/core";
 import { matchAllWorkflows } from "@kici-dev/engine";
 import os from "node:os";
 //#region src/local-executor/index.ts
@@ -107,7 +107,7 @@ async function runOneMatchedWorkflow(workflow, ctx) {
 		lockHandle = await acquireWorkflowLock({
 			workflowName: workflow.name,
 			workflow,
-			event: event.payload,
+			event,
 			branch: deriveBranchForGroupCtx(event),
 			debug: options.debug
 		});
@@ -272,6 +272,7 @@ async function executeLocal(options) {
 	let materialized = null;
 	let execDir = repoRoot;
 	if (!options.inPlace) {
+		await gcStaleRunCheckouts(process.env.KICI_RUN_DIR ?? os.tmpdir());
 		materialized = await materializeCheckout(repoRoot, { runDir: process.env.KICI_RUN_DIR });
 		execDir = materialized.path;
 		logger.info(pc.gray(`running in ${execDir}`));

package/dist/local-executor/job-runner.js

@@ -1,7 +1,9 @@
 import "../chunk-gOLHoazu.js";
+import { ensureTsLoaderHook } from "../execution/ts-loader.js";
 import { formatter } from "../test-runner/output-formatter.js";
 import { createStepContext } from "../test-runner/step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "../test-runner/rule-evaluator.js";
+import { toEventPayload } from "./to-event-payload.js";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { applyIncludeExclude, expandMatrix, isDynamicJobFn, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
@@ -21,7 +23,9 @@ import { applyIncludeExclude, expandMatrix, isDynamicJobFn, setJobOutputsMap, se
 */
 async function resolveSdkSetters(kiciDir) {
 	if (kiciDir) try {
-		const sdk = await import(pathToFileURL(path.join(kiciDir, "node_modules", "@kici-dev", "sdk", "dist", "index.js")).href);
+		const sdkUrl = pathToFileURL(path.join(kiciDir, "node_modules", "@kici-dev", "sdk", "dist", "index.js")).href;
+		ensureTsLoaderHook();
+		const sdk = await import(sdkUrl);
 		return {
 			setStepOutputsMap: sdk.setStepOutputsMap,
 			setStepRefMap: sdk.setStepRefMap,
@@ -69,10 +73,7 @@ async function resolveJobs(workflow, event) {
 			$: (await import("zx")).$,
 			ctx: {
 				workflow: { name: workflow.name },
-				event: {
-					type: event.type,
-					...event.payload
-				}
+				event: toEventPayload(event)
 			},
 			log: {
 				info: () => {},

package/dist/local-executor/materializer.d.ts

@@ -36,4 +36,9 @@ export interface MaterializeOptions {
  * @throws If `repoRoot` is not inside a git work tree
  */
 export declare function materializeCheckout(repoRoot: string, opts?: MaterializeOptions): Promise<MaterializedCheckout>;
+/**
+ * Collect stale retained checkouts under the run base. Invoked on every
+ * `kici run local`; never throws (the GC must not break the run).
+ */
+export declare function gcStaleRunCheckouts(base: string): Promise<string[]>;
 //# sourceMappingURL=materializer.d.ts.map

package/dist/local-executor/materializer.js

@@ -2,9 +2,11 @@ import "../chunk-gOLHoazu.js";
 import { selectOverlayFiles } from "../remote/uploader.js";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { logger } from "@kici-dev/core";
 import { execSync } from "node:child_process";
 import os from "node:os";
 import { randomBytes } from "node:crypto";
+import { gcStaleTmpDirs } from "@kici-dev/core/tmp-gc";
 //#region src/local-executor/materializer.ts
 /**
 * Materialize an isolated tmp checkout of the repo for `kici run local`.
@@ -52,6 +54,25 @@ async function materializeCheckout(repoRoot, opts) {
 	};
 }
 /**
+* Checkouts retained for inspection (failed runs, --keep) stay around this
+* long before the next `kici run local` invocation collects them.
+*/
+const RUN_CHECKOUT_GC_MAX_AGE_MS = 4320 * 60 * 1e3;
+/** Matches the kici-run-<6 hex> dirs materializeCheckout creates — nothing else. */
+const RUN_CHECKOUT_PATTERN = /^kici-run-[0-9a-f]{6}$/;
+/**
+* Collect stale retained checkouts under the run base. Invoked on every
+* `kici run local`; never throws (the GC must not break the run).
+*/
+async function gcStaleRunCheckouts(base) {
+	return gcStaleTmpDirs({
+		base,
+		pattern: RUN_CHECKOUT_PATTERN,
+		maxAgeMs: RUN_CHECKOUT_GC_MAX_AGE_MS,
+		log: (m) => logger.debug(m)
+	});
+}
+/**
 * Throw an actionable error if `repoRoot` is not a git work tree.
 */
 function requireGitRepo(repoRoot) {
@@ -106,6 +127,6 @@ function shellQuote(value) {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 //#endregion
-export { materializeCheckout };
+export { gcStaleRunCheckouts, materializeCheckout };
 
 //# sourceMappingURL=materializer.js.map

package/dist/local-executor/output-streamer.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
 import pc from "picocolors";
-import { logger } from "@kici-dev/shared";
+import { logger } from "@kici-dev/core";
 //#region src/local-executor/output-streamer.ts
 /**
 * Output formatting for local execution: tree summary, JSON, JUnit XML.

package/dist/local-executor/picker.js

@@ -2,7 +2,7 @@ import "../chunk-gOLHoazu.js";
 import { transformTriggers } from "../lockfile/generator.js";
 import { parseEventArg, triggerSummary, triggerToEventArg } from "../test-runner/event-types.js";
 import pc from "picocolors";
-import { logger } from "@kici-dev/shared";
+import { logger } from "@kici-dev/core";
 import { select } from "@inquirer/prompts";
 //#region src/local-executor/picker.ts
 /**

package/dist/local-executor/to-event-payload.d.ts

@@ -0,0 +1,16 @@
+import type { SimulatedEvent } from '@kici-dev/engine';
+import type { EventPayload } from '@kici-dev/sdk';
+/**
+ * Map a {@link SimulatedEvent} into the normalized SDK {@link EventPayload}
+ * envelope that every user-authored dynamic function (dynamic job generators,
+ * `concurrency.group()`) receives as its `event` argument.
+ *
+ * `SimulatedEvent` already carries the normalized fields (`type`, `action`,
+ * `targetBranch`, …) alongside the raw provider body under `payload`, so the
+ * single cast at this boundary is a deliberate type assertion over a
+ * structurally-identical value: it asserts the discriminated-union view
+ * without reshaping anything. Raw provider fields stay nested under
+ * `payload.<field>`; normalized fields live at the top level.
+ */
+export declare function toEventPayload(event: SimulatedEvent): EventPayload;
+//# sourceMappingURL=to-event-payload.d.ts.map

package/dist/local-executor/to-event-payload.js

@@ -0,0 +1,21 @@
+import "../chunk-gOLHoazu.js";
+//#region src/local-executor/to-event-payload.ts
+/**
+* Map a {@link SimulatedEvent} into the normalized SDK {@link EventPayload}
+* envelope that every user-authored dynamic function (dynamic job generators,
+* `concurrency.group()`) receives as its `event` argument.
+*
+* `SimulatedEvent` already carries the normalized fields (`type`, `action`,
+* `targetBranch`, …) alongside the raw provider body under `payload`, so the
+* single cast at this boundary is a deliberate type assertion over a
+* structurally-identical value: it asserts the discriminated-union view
+* without reshaping anything. Raw provider fields stay nested under
+* `payload.<field>`; normalized fields live at the top level.
+*/
+function toEventPayload(event) {
+	return event;
+}
+//#endregion
+export { toEventPayload };
+
+//# sourceMappingURL=to-event-payload.js.map

package/dist/local-executor/workflow-lock.d.ts

@@ -20,6 +20,7 @@
  * `os.tmpdir()/kici-local-locks-<uid>/`).
  */
 import type { Workflow } from '@kici-dev/sdk';
+import type { SimulatedEvent } from '@kici-dev/engine';
 /** Sidecar metadata persisted next to the lock dir for diagnostics + reclamation. */
 export interface LockHolderMetadata {
     pid: number;
@@ -35,8 +36,8 @@ export interface WorkflowLockHandle {
 export interface AcquireWorkflowLockOptions {
     workflowName: string;
     workflow: Workflow;
-    /** The simulated-event payload object passed as `groupCtx.event` to the user's group fn. */
-    event: Record<string, unknown>;
+    /** The simulated event mapped to the normalized envelope passed as `groupCtx.event`. */
+    event: SimulatedEvent;
     /** Branch derived from the simulated event for `groupCtx.branch`. */
     branch: string;
     debug?: boolean;
@@ -68,7 +69,7 @@ export declare function resolveLockDir(): Promise<string>;
  * Returns `null` when the workflow has no `concurrency` block. Throws
  * {@link ConcurrencyKeyEvaluationError} when the group function throws or rejects.
  */
-export declare function resolveConcurrencyKey(workflow: Workflow, event: Record<string, unknown>, branch: string): Promise<string | null>;
+export declare function resolveConcurrencyKey(workflow: Workflow, event: SimulatedEvent, branch: string): Promise<string | null>;
 /**
  * Acquire the workflow-level concurrency lock for a `kici run local` invocation.
  *

package/dist/lockfile/generator.js

@@ -5,11 +5,11 @@ import { resolveHashFiles } from "./hash-files.js";
 import { analyzePurity } from "./purity-analyzer.js";
 import { readFileSync } from "node:fs";
 import path from "node:path";
-import { execSync } from "node:child_process";
-import { sha256 } from "@kici-dev/shared";
-import { getDynamicJobGroup, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject } from "@kici-dev/sdk";
-import { PackageManager, detectPackageManagerSync } from "@kici-dev/shared/package-manager";
+import { getDynamicJobGroup, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeCacheSpecs } from "@kici-dev/sdk";
+import { sha256 } from "@kici-dev/core";
+import { PackageManager, detectPackageManagerSync } from "@kici-dev/core/package-manager";
 import { validateResourceRequest } from "@kici-dev/engine";
+import { execSync } from "node:child_process";
 //#region src/lockfile/generator.ts
 /**
 * Detect git repository root by running `git rev-parse --show-toplevel`.
@@ -151,7 +151,8 @@ function transformWorkflow(workflow, sourceFile, exportRef, bundleSource, gitRoo
 			hasGroup: !!workflow.concurrency.group,
 			...workflow.concurrency.cancelInProgress !== void 0 && { cancelInProgress: workflow.concurrency.cancelInProgress },
 			...workflow.concurrency.max !== void 0 && { max: workflow.concurrency.max }
-		} }
+		} },
+		...workflow.timeout !== void 0 && { timeout: workflow.timeout }
 	};
 }
 /**
@@ -528,6 +529,7 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 		rules: job.rules ? transformRules(job.rules, configPath, index) : void 0,
 		description: job.description,
 		...job.checkout !== void 0 && { checkout: job.checkout },
+		...job.cache !== void 0 && { cache: normalizeCacheSpecs(job.cache) },
 		...job.container !== void 0 && { container: job.container },
 		...environmentFields,
 		...envFields,
@@ -539,7 +541,9 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 		...job.beforeStep !== void 0 && { hasBeforeStep: true },
 		...job.afterStep !== void 0 && { hasAfterStep: true },
 		...job.gracePeriod !== void 0 && { gracePeriod: job.gracePeriod },
-		...job.resources !== void 0 && { resources: job.resources }
+		...job.timeout !== void 0 && { timeout: job.timeout },
+		...job.resources !== void 0 && { resources: job.resources },
+		...job.init !== void 0 && { init: job.init }
 	};
 }
 /**
@@ -603,6 +607,7 @@ function transformSteps(steps, gitRoot) {
 			hasOutputs: !!step.outputs && Object.keys(step.outputs).length > 0,
 			...step.continueOnError !== void 0 && { continueOnError: step.continueOnError },
 			...step.timeout !== void 0 && { timeout: step.timeout },
+			...step.cache !== void 0 && { cache: normalizeCacheSpecs(step.cache) },
 			...step._sourceLocation && { sourceLocation: {
 				file: makeRelativePath(step._sourceLocation.file, gitRoot),
 				line: step._sourceLocation.line,

package/dist/lockfile/hasher.js

@@ -1,5 +1,5 @@
 import "../chunk-gOLHoazu.js";
-import { normalizeLineEndings, sha256 } from "@kici-dev/shared";
+import { normalizeLineEndings, sha256 } from "@kici-dev/core";
 //#region src/lockfile/hasher.ts
 /**
 * Compile schema version -- bump when compilation approach changes

package/dist/remote/client.d.ts

@@ -33,6 +33,10 @@ export interface TestTriggerInput {
     /** CLI's ephemeral public key (base64, SPKI/DER) for overlay decryption */
     cliPublicKey?: string;
     secrets?: Record<string, string>;
+    /** Base64 X25519+AES-GCM blob of the developer's local secrets ({flat, contexts}). */
+    encryptedSecrets?: string;
+    /** Base64 ephemeral CLI public key that encrypted `encryptedSecrets`. */
+    encryptedSecretsKey?: string;
     workflowName?: string;
     /** JSON-stringified lock file content for repos with no remote. */
     inlineLockFile?: string;

package/dist/remote/client.js

@@ -1,5 +1,5 @@
 import "../chunk-gOLHoazu.js";
-import { toErrorMessage } from "@kici-dev/shared";
+import { toErrorMessage } from "@kici-dev/core";
 //#region src/remote/client.ts
 /**
 * REST client for communicating with the KiCI orchestrator.

package/dist/remote/encryption.d.ts

@@ -1,4 +1,4 @@
-import { deriveSharedSecret } from '@kici-dev/shared';
+import { deriveSharedSecret } from '@kici-dev/core';
 export { deriveSharedSecret };
 /**
  * Generate an ephemeral X25519 keypair.

package/dist/remote/encryption.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
 import fs from "node:fs/promises";
-import { deriveSharedSecret } from "@kici-dev/shared";
+import { deriveSharedSecret } from "@kici-dev/core";
 import crypto from "node:crypto";
 //#region src/remote/encryption.ts
 /**

package/dist/remote/history.js

@@ -1,10 +1,10 @@
 import "../chunk-gOLHoazu.js";
-import { getConfigDir } from "./config.js";
 import { formatRelativeTime } from "../format.js";
+import { getConfigDir } from "./config.js";
 import pc from "picocolors";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { formatDuration } from "@kici-dev/shared";
+import { formatDuration } from "@kici-dev/core";
 import picomatch from "picomatch";
 //#region src/remote/history.ts
 /**

package/dist/remote/oauth.js

@@ -1,8 +1,8 @@
 import "../chunk-gOLHoazu.js";
 import { discoverOidcEndpoints } from "./oidc-discovery.js";
 import pc from "picocolors";
+import { toErrorMessage } from "@kici-dev/core";
 import { exec } from "node:child_process";
-import { toErrorMessage } from "@kici-dev/shared";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer } from "node:http";
 import open from "open";

package/dist/remote/oidc-discovery.js

@@ -1,5 +1,5 @@
 import "../chunk-gOLHoazu.js";
-import { toErrorMessage } from "@kici-dev/shared";
+import { toErrorMessage } from "@kici-dev/core";
 //#region src/remote/oidc-discovery.ts
 const cache = /* @__PURE__ */ new Map();
 /**

package/dist/remote/output/streaming.js

@@ -1,6 +1,6 @@
 import "../../chunk-gOLHoazu.js";
 import pc from "picocolors";
-import { formatDuration } from "@kici-dev/shared";
+import { formatDuration } from "@kici-dev/core";
 //#region src/remote/output/streaming.ts
 /**
 * Real-time log streaming output formatter for CLI observer.

package/dist/remote/output/summary.js

@@ -1,6 +1,6 @@
 import "../../chunk-gOLHoazu.js";
 import pc from "picocolors";
-import { formatDuration } from "@kici-dev/shared";
+import { formatDuration } from "@kici-dev/core";
 //#region src/remote/output/summary.ts
 /**
 * Completion summary output formatters.

package/dist/remote/prod-defaults.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Production defaults for the `kici login` OAuth flow. When the matching
+ * env var (or the `--platform-endpoint` flag) is unset, login resolves
+ * these so a developer targeting the hosted KiCI Platform authenticates
+ * with no setup. Setting the env var overrides the default — staging E2E
+ * and self-hosted Platforms depend on that override path.
+ *
+ * Resolution is login-local: these are read into locals in `oauthLogin`,
+ * never written back into `process.env`, so the orchestrator's separate
+ * `wss://…/ws` meaning of `KICI_PLATFORM_URL` is unaffected.
+ */
+/** Platform API base URL — login POSTs to `${value}/api/v1/cli/exchange-token`. */
+export declare const PROD_PLATFORM_URL = "https://api.kici.dev";
+/** OIDC issuer for the hosted Platform's Keycloak realm. */
+export declare const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
+/** Public OIDC client id registered for the `kici` CLI. */
+export declare const PROD_OIDC_CLIENT_ID = "kici-cli";
+//# sourceMappingURL=prod-defaults.d.ts.map

package/dist/remote/prod-defaults.js

@@ -0,0 +1,23 @@
+import "../chunk-gOLHoazu.js";
+//#region src/remote/prod-defaults.ts
+/**
+* Production defaults for the `kici login` OAuth flow. When the matching
+* env var (or the `--platform-endpoint` flag) is unset, login resolves
+* these so a developer targeting the hosted KiCI Platform authenticates
+* with no setup. Setting the env var overrides the default — staging E2E
+* and self-hosted Platforms depend on that override path.
+*
+* Resolution is login-local: these are read into locals in `oauthLogin`,
+* never written back into `process.env`, so the orchestrator's separate
+* `wss://…/ws` meaning of `KICI_PLATFORM_URL` is unaffected.
+*/
+/** Platform API base URL — login POSTs to `${value}/api/v1/cli/exchange-token`. */
+const PROD_PLATFORM_URL = "https://api.kici.dev";
+/** OIDC issuer for the hosted Platform's Keycloak realm. */
+const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
+/** Public OIDC client id registered for the `kici` CLI. */
+const PROD_OIDC_CLIENT_ID = "kici-cli";
+//#endregion
+export { PROD_OIDC_CLIENT_ID, PROD_OIDC_ISSUER, PROD_PLATFORM_URL };
+
+//# sourceMappingURL=prod-defaults.js.map

package/dist/remote/secret-upload.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Parse `--context ctx.key=value` flag values into a nested
+ * `{ context: { key: value } }` map. The first `.` splits the context name
+ * from `key=value`; the first `=` splits key from value (values may contain
+ * `=`). Malformed entries (missing `.` or `=`, empty context/key) are skipped.
+ */
+export declare function parseContextFlags(flags: string[] | undefined): Record<string, Record<string, string>>;
+/**
+ * Load the developer's local secrets (same sources as `kici run local`: the
+ * `.kici` secret files plus `--env` flat flags) and `--context` namespaced
+ * flags, and encrypt them to the orchestrator's per-upload X25519 public key.
+ * `--context` values override `.kici/.secrets` file contexts for the same key.
+ * Returns the base64 ciphertext and the ephemeral CLI public key the
+ * orchestrator needs to decrypt, or null when there is nothing to send.
+ */
+export declare function buildEncryptedSecrets(kiciDir: string, envFlags: string[] | undefined, contextFlags: string[] | undefined, orchestratorPublicKeyB64: string): Promise<{
+    encryptedSecrets: string;
+    cliPublicKey: string;
+} | null>;
+//# sourceMappingURL=secret-upload.d.ts.map

package/dist/remote/secret-upload.js

@@ -0,0 +1,58 @@
+import "../chunk-gOLHoazu.js";
+import { loadLocalSecrets } from "../local-executor/secret-loader.js";
+import { encryptJson } from "@kici-dev/core";
+//#region src/remote/secret-upload.ts
+/**
+* Parse `--context ctx.key=value` flag values into a nested
+* `{ context: { key: value } }` map. The first `.` splits the context name
+* from `key=value`; the first `=` splits key from value (values may contain
+* `=`). Malformed entries (missing `.` or `=`, empty context/key) are skipped.
+*/
+function parseContextFlags(flags) {
+	const contexts = {};
+	for (const flag of flags ?? []) {
+		const dotIndex = flag.indexOf(".");
+		if (dotIndex === -1) continue;
+		const contextName = flag.slice(0, dotIndex).trim();
+		const rest = flag.slice(dotIndex + 1);
+		const eqIndex = rest.indexOf("=");
+		if (eqIndex === -1) continue;
+		const key = rest.slice(0, eqIndex).trim();
+		const value = rest.slice(eqIndex + 1).trim();
+		if (!contextName || !key) continue;
+		(contexts[contextName] ??= {})[key] = value;
+	}
+	return contexts;
+}
+/**
+* Load the developer's local secrets (same sources as `kici run local`: the
+* `.kici` secret files plus `--env` flat flags) and `--context` namespaced
+* flags, and encrypt them to the orchestrator's per-upload X25519 public key.
+* `--context` values override `.kici/.secrets` file contexts for the same key.
+* Returns the base64 ciphertext and the ephemeral CLI public key the
+* orchestrator needs to decrypt, or null when there is nothing to send.
+*/
+async function buildEncryptedSecrets(kiciDir, envFlags, contextFlags, orchestratorPublicKeyB64) {
+	const local = await loadLocalSecrets(kiciDir, envFlags);
+	const contexts = {};
+	for (const [ctxName, vals] of Object.entries(local.contexts)) contexts[ctxName] = { ...vals };
+	for (const [ctxName, vals] of Object.entries(parseContextFlags(contextFlags))) contexts[ctxName] = {
+		...contexts[ctxName] ?? {},
+		...vals
+	};
+	const hasFlat = Object.keys(local.flat).length > 0;
+	const hasContexts = Object.values(contexts).some((c) => Object.keys(c).length > 0);
+	if (!hasFlat && !hasContexts) return null;
+	const { ciphertextB64, senderPublicKeyB64 } = encryptJson({
+		flat: local.flat,
+		contexts
+	}, Buffer.from(orchestratorPublicKeyB64, "base64"));
+	return {
+		encryptedSecrets: ciphertextB64,
+		cliPublicKey: senderPublicKeyB64
+	};
+}
+//#endregion
+export { buildEncryptedSecrets, parseContextFlags };
+
+//# sourceMappingURL=secret-upload.js.map

package/dist/remote/uploader.js

@@ -2,8 +2,8 @@ import "../chunk-gOLHoazu.js";
 import { encryptTarball } from "./encryption.js";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { formatBytes, sha256, sha256File } from "@kici-dev/core";
 import { execSync } from "node:child_process";
-import { formatBytes, sha256, sha256File } from "@kici-dev/shared";
 import os from "node:os";
 import picomatch from "picomatch";
 import { create } from "tar";