@kici-dev/compiler 0.1.14 → 0.1.15

package/README.md

@@ -1 +1,21 @@
-TBD
+# @kici-dev/compiler
+
+Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.
+
+Part of [KiCI](https://kici.dev) — CI/CD workflows as TypeScript code: author them with full language power, dry-run them locally, and run them on your own infrastructure.
+
+## Install
+
+Usually consumed through the [`kici`](https://www.npmjs.com/package/kici) wrapper CLI:
+
+```bash
+npm install -g kici
+```
+
+Direct install (`npm install --save-dev @kici-dev/compiler`) works too when you want the library API.
+
+## Links
+
+- Documentation: <https://docs.kici.dev/user/cli-reference/>
+- Source: <https://github.com/kici-dev/kici-public/tree/main/packages/compiler>
+- License: Apache-2.0

package/dist/cli.js

@@ -4,7 +4,7 @@ import { shouldSuppressBanner } from "./cli-banner.js";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.14";
+const version = "0.1.15";
 const program = new Command();
 program.name("kici").description("KiCI workflow compiler").version(version);
 program.hook("preAction", (_thisCommand, actionCommand) => {
@@ -68,9 +68,12 @@ runCommand.command("local").argument("[event]", "Event type (e.g., push, pr:open
 	});
 	process.exit(success ? 0 : 1);
 });
-runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--secret <key=value>", "Inject flat secret (repeatable)", (val, prev) => [...prev, val], []).option("--context <ctx.key=value>", "Inject context secret (repeatable)", (val, prev) => [...prev, val], []).action(async (fixture, options) => {
+runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).action(async (fixture, options) => {
 	const { runRemoteCommand } = await import("./commands/index.js");
-	const success = await runRemoteCommand(fixture, options);
+	const success = await runRemoteCommand(fixture, {
+		...options,
+		envFlags: options.env
+	});
 	process.exit(success ? 0 : 1);
 });
 program.command("test").argument("[event]", "Event type to preview (e.g., push, pr:open, schedule)").description("Preview which workflows match a trigger event (dry-run)").option("--branch <name>", "Override target branch for trigger matching (default: main)").option("--sha <hash>", "Override commit SHA").option("--workflow <name>", "Filter to specific workflow in display").option("--job <name>", "Filter to specific job in display").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--files <path>", "Simulate changed file path for trigger matching (repeatable)", (val, prev) => [...prev, val], []).option("--secret <key=value>", "Inject flat secret (repeatable)", (val, prev) => [...prev, val], []).option("--context <ctx.key=value>", "Inject context secret (repeatable)", (val, prev) => [...prev, val], []).action(async (event, options) => {

package/dist/commands/login.js

@@ -1,6 +1,7 @@
 import "../chunk-gOLHoazu.js";
 import { getConfigPath, mergeGlobalConfig } from "../remote/config.js";
 import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
+import "../remote/prod-defaults.js";
 import { isHeadless } from "../auth/headless-detect.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";
@@ -45,21 +46,9 @@ function checkPatExpiry(expiresAt) {
 * 4. Save PAT to global config
 */
 async function oauthLogin(options) {
-	const platformUrl = options.platformEndpoint || process.env.KICI_PLATFORM_URL || "";
-	const issuer = process.env.KICI_OIDC_ISSUER || "";
-	const clientId = process.env.KICI_OIDC_CLIENT_ID || "";
-	const missing = [];
-	if (!platformUrl) missing.push("KICI_PLATFORM_URL");
-	if (!issuer) missing.push("KICI_OIDC_ISSUER");
-	if (!clientId) missing.push("KICI_OIDC_CLIENT_ID");
-	if (missing.length > 0) {
-		console.error(pc.red(`Error: missing required env var(s) for OAuth login: ${missing.join(", ")}`));
-		console.error(pc.gray("  Set them to your Platform and IdP endpoints, for example:"));
-		console.error(pc.gray("    export KICI_PLATFORM_URL=https://your-platform.example.com"));
-		console.error(pc.gray("    export KICI_OIDC_ISSUER=https://your-idp.example.com"));
-		console.error(pc.gray("    export KICI_OIDC_CLIENT_ID=<cli-client-id>"));
-		return false;
-	}
+	const platformUrl = options.platformEndpoint || process.env.KICI_PLATFORM_URL || "https://api.kici.dev";
+	const issuer = process.env.KICI_OIDC_ISSUER || "https://auth.kici.dev/realms/kici-internal";
+	const clientId = process.env.KICI_OIDC_CLIENT_ID || "kici-cli";
 	console.log(pc.cyan("\n  Step 1/4: Detecting environment..."));
 	const browserCmdSet = !!process.env.KICI_BROWSER_CMD;
 	const useDeviceFlow = options.device || !browserCmdSet && isHeadless();

package/dist/commands/run.js

@@ -5,6 +5,7 @@ import { AuthenticationError, ConnectionError, OrchestratorClient } from "../rem
 import { loadGlobalConfig } from "../remote/config.js";
 import { RunHistory } from "../remote/history.js";
 import { ObserverClient } from "../remote/observer.js";
+import { buildEncryptedSecrets } from "../remote/secret-upload.js";
 import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/uploader.js";
 import { formatJsonResult } from "../remote/output/json.js";
 import { formatJunitResult } from "../remote/output/junit.js";
@@ -185,7 +186,7 @@ async function runSingleFixture(fixture, client, options, config, history) {
 		let routingKey = options.routingKey ?? config.routingKey ?? "default";
 		if (!hasRemote) {
 			routingKey = `local:${path.basename(repoRoot)}`;
-			logger.warn("No remote detected -- steps that use git commands will fail (no .git directory)");
+			if (!options.quiet) logger.warn("No remote detected -- steps that use git commands will fail (no .git directory)");
 		}
 		let inlineLockFile;
 		if (!hasRemote) inlineLockFile = await readFile(path.join(kiciDir, "kici.lock.json"), "utf-8");
@@ -217,6 +218,7 @@ async function runSingleFixture(fixture, client, options, config, history) {
 			};
 		}
 		if (!options.quiet) logger.info(pc.gray("Triggering test run..."));
+		const encrypted = await buildEncryptedSecrets(kiciDir, options.envFlags, options.context, upload.publicKey);
 		const triggerResult = await client.triggerTest({
 			fixtureId: fixture.id,
 			event,
@@ -224,6 +226,10 @@ async function runSingleFixture(fixture, client, options, config, history) {
 			uploadId: upload.uploadId,
 			cliPublicKey: uploadResult.cliPublicKey.toString("base64"),
 			secrets: opts.secrets,
+			...encrypted && {
+				encryptedSecrets: encrypted.encryptedSecrets,
+				encryptedSecretsKey: encrypted.cliPublicKey
+			},
 			workflowName: opts.workflowName,
 			inlineLockFile,
 			fullRepo: !hasRemote || void 0
@@ -516,6 +522,7 @@ async function runDirectWorkflow(workflowName, options) {
 	const repoName = !hasRemote ? path.basename(repoRoot) : void 0;
 	const payload = {};
 	if (!hasRemote) payload.repository = { full_name: `local/${repoName}` };
+	const encrypted = await buildEncryptedSecrets(kiciDir, options.envFlags, options.context, upload.publicKey);
 	const result = await client.triggerTest({
 		fixtureId: `direct:${workflowName}`,
 		event: {
@@ -526,6 +533,10 @@ async function runDirectWorkflow(workflowName, options) {
 		routingKey,
 		uploadId: upload.uploadId,
 		cliPublicKey: directUploadResult.cliPublicKey.toString("base64"),
+		...encrypted && {
+			encryptedSecrets: encrypted.encryptedSecrets,
+			encryptedSecretsKey: encrypted.cliPublicKey
+		},
 		workflowName,
 		inlineLockFile,
 		fullRepo: !hasRemote || void 0

package/dist/commands/secrets-list.js

@@ -47,7 +47,7 @@ async function secretsListCommand(options) {
 		const contexts = ((await res.json()).environments ?? []).filter((e) => e.allow_local_execution);
 		if (contexts.length === 0) {
 			console.log(pc.yellow("No test-available secret contexts found."));
-			console.log(pc.gray("Set allowLocalExecution=true on an environment to make its secrets available for test runs."));
+			console.log(pc.gray("Enable test runs (allowLocalExecution) on an environment to make its secrets available for test runs."));
 			return true;
 		}
 		console.log(pc.bold("\nTest-available secret contexts:\n"));

package/dist/commands/status.js

@@ -15,7 +15,7 @@ import { formatDuration, logger, toErrorMessage } from "@kici-dev/core";
 * Looks up local history first, then fetches from the orchestrator for
 * up-to-date status and logs.
 */
-const CLI_VERSION = "0.1.14";
+const CLI_VERSION = "0.1.15";
 /**
 * Show status and details of a test run.
 *

package/dist/commands/test.d.ts

@@ -32,6 +32,8 @@ export interface RemoteRunOptions extends TestOptions {
     routingKey?: string;
     /** Show recent run history */
     history?: boolean;
+    /** --env KEY=VALUE flag values, uploaded as per-run secrets. */
+    envFlags?: string[];
 }
 /** Result of a single remote fixture run */
 export interface RemoteRunResult {