@kici-dev/compiler 0.1.14 → 0.1.16

package/dist/commands/held-run-client.js

@@ -0,0 +1,98 @@
+import "../chunk-gOLHoazu.js";
+import { loadGlobalConfig } from "../remote/config.js";
+import pc from "picocolors";
+import { logger } from "@kici-dev/core";
+//#region src/commands/held-run-client.ts
+/**
+* Shared HTTP plumbing for the `kici approve` / `kici reject` held-run
+* commands. Resolves auth + endpoint from the global config (PAT preferred,
+* API key fallback; Platform endpoint preferred, orchestrator fallback) and
+* exposes thin list / approve / reject helpers against the Platform dashboard
+* API.
+*/
+/**
+* Resolve the auth context, printing a clear error and returning null when the
+* CLI is not authenticated / no active org is set.
+*/
+async function resolveHeldRunContext() {
+	const config = await loadGlobalConfig();
+	const token = config.pat ?? config.token;
+	if (!token) {
+		logger.error(pc.red("Not authenticated. Run `kici login` to get started."));
+		return null;
+	}
+	const endpoint = config.platformEndpoint ?? config.endpoint;
+	if (!endpoint) {
+		logger.error(pc.red("No endpoint configured. Run `kici login` to configure."));
+		return null;
+	}
+	if (!config.activeOrgId) {
+		logger.error(pc.red("No active organization. Run `kici org use <name>` to set one."));
+		return null;
+	}
+	return {
+		endpoint,
+		token,
+		orgId: config.activeOrgId
+	};
+}
+function authHeaders(token) {
+	return {
+		"Content-Type": "application/json",
+		Authorization: `Bearer ${token}`
+	};
+}
+/** List the held runs for a single run id. */
+async function listHeldRunsForRun(ctx, runId) {
+	const url = `${ctx.endpoint}/api/v1/orgs/${ctx.orgId}/held-runs?runId=${encodeURIComponent(runId)}`;
+	const response = await fetch(url, {
+		method: "GET",
+		headers: authHeaders(ctx.token)
+	});
+	if (!response.ok) throw new Error(await describeError(response));
+	return (await response.json()).heldRuns ?? [];
+}
+/** POST an approve decision for a held run. Returns true on success. */
+async function postApprove(ctx, heldRunId) {
+	const url = `${ctx.endpoint}/api/v1/orgs/${ctx.orgId}/held-runs/${heldRunId}/approve`;
+	const response = await fetch(url, {
+		method: "POST",
+		headers: authHeaders(ctx.token)
+	});
+	if (!response.ok) {
+		logger.error(pc.red(await describeError(response)));
+		return false;
+	}
+	return true;
+}
+/** POST a reject decision (with reason) for a held run. Returns true on success. */
+async function postReject(ctx, heldRunId, reason) {
+	const url = `${ctx.endpoint}/api/v1/orgs/${ctx.orgId}/held-runs/${heldRunId}/reject`;
+	const response = await fetch(url, {
+		method: "POST",
+		headers: authHeaders(ctx.token),
+		body: JSON.stringify({ reason })
+	});
+	if (!response.ok) {
+		logger.error(pc.red(await describeError(response)));
+		return false;
+	}
+	return true;
+}
+/** Build a user-facing error string from a failed response. */
+async function describeError(response) {
+	let detail;
+	try {
+		detail = (await response.json()).error;
+	} catch {}
+	switch (response.status) {
+		case 401: return "Authentication failed. Run `kici login` to re-authenticate.";
+		case 403: return `Access denied${detail ? `: ${detail}` : ""}.`;
+		case 404: return `Held run not found${detail ? `: ${detail}` : ""}.`;
+		default: return detail ?? `Request failed with status ${response.status}.`;
+	}
+}
+//#endregion
+export { listHeldRunsForRun, postApprove, postReject, resolveHeldRunContext };
+
+//# sourceMappingURL=held-run-client.js.map

package/dist/commands/held-run-resolve.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared held-run resolution for the `kici approve` / `kici reject` commands.
+ *
+ * Both commands first list the pending holds for a run, then resolve the one
+ * the user named via `--job` / `--step` (or the sole pending hold when there is
+ * exactly one and no filter is given). The resolution is a pure function so it
+ * can be unit-tested without HTTP.
+ */
+/** Hold scope, mirroring the engine `HoldScope` enum. */
+export type HeldRunScope = 'workflow' | 'job' | 'step';
+/** A pending-hold row as returned by `GET /orgs/:orgId/held-runs`. */
+export interface HeldRunSummary {
+    id: string;
+    runId: string;
+    jobId?: string;
+    holdScope?: HeldRunScope;
+    stepIndex?: number | null;
+    status: string;
+}
+/** Filters supplied on the command line. */
+export interface HeldRunFilter {
+    /** Match a hold by its job name. */
+    job?: string;
+    /** Match a step-scoped hold by its step index (compared as a string). */
+    step?: string;
+}
+/** Resolution result: either a held-run id or a user-facing error message. */
+export type ResolveResult = {
+    ok: true;
+    heldRunId: string;
+    hold: HeldRunSummary;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Resolve the held-run id matching the filter from a list of pending holds.
+ *
+ * - `--step` requires `--job` and matches a `step`-scoped hold whose step index
+ *   equals the given value.
+ * - `--job` alone matches a `job`/`workflow`-scoped hold for that job.
+ * - With no filter, the sole pending hold is used; ambiguity is an error.
+ */
+export declare function resolveHeldRunId(holds: readonly HeldRunSummary[], filter: HeldRunFilter): ResolveResult;
+//# sourceMappingURL=held-run-resolve.d.ts.map

package/dist/commands/held-run-resolve.js

@@ -0,0 +1,53 @@
+import "../chunk-gOLHoazu.js";
+//#region src/commands/held-run-resolve.ts
+/**
+* Resolve the held-run id matching the filter from a list of pending holds.
+*
+* - `--step` requires `--job` and matches a `step`-scoped hold whose step index
+*   equals the given value.
+* - `--job` alone matches a `job`/`workflow`-scoped hold for that job.
+* - With no filter, the sole pending hold is used; ambiguity is an error.
+*/
+function resolveHeldRunId(holds, filter) {
+	const pending = holds.filter((h) => h.status === "pending");
+	if (pending.length === 0) return {
+		ok: false,
+		error: "No pending approval holds found for this run."
+	};
+	if (filter.step !== void 0) {
+		if (!filter.job) return {
+			ok: false,
+			error: "--step requires --job to identify the held step."
+		};
+		return pickSingle(pending.filter((h) => h.holdScope === "step" && h.jobId === filter.job && String(h.stepIndex ?? "") === filter.step), `step ${filter.step} of job '${filter.job}'`);
+	}
+	if (filter.job !== void 0) return pickSingle(pending.filter((h) => h.jobId === filter.job && h.holdScope !== "step"), `job '${filter.job}'`);
+	if (pending.length > 1) return {
+		ok: false,
+		error: "Multiple pending holds for this run. Use --job <name> (and --step <index>) to choose one."
+	};
+	return {
+		ok: true,
+		heldRunId: pending[0].id,
+		hold: pending[0]
+	};
+}
+function pickSingle(matches, label) {
+	if (matches.length === 0) return {
+		ok: false,
+		error: `No pending hold found for ${label}.`
+	};
+	if (matches.length > 1) return {
+		ok: false,
+		error: `Multiple pending holds match ${label}; cannot disambiguate.`
+	};
+	return {
+		ok: true,
+		heldRunId: matches[0].id,
+		hold: matches[0]
+	};
+}
+//#endregion
+export { resolveHeldRunId };
+
+//# sourceMappingURL=held-run-resolve.js.map

package/dist/commands/hook.js

@@ -2,9 +2,9 @@ import "../chunk-gOLHoazu.js";
 import { detectHookTools, findGitDir } from "../hooks/detector.js";
 import { installHook } from "../hooks/installer.js";
 import "../hooks/index.js";
+import path from "node:path";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
-import path from "node:path";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { select } from "@inquirer/prompts";
 //#region src/commands/hook.ts

package/dist/commands/index.d.ts

@@ -24,6 +24,10 @@ export { orgListCommand, orgUseCommand, orgCurrentCommand } from './org.js';
 export { logoutCommand } from './logout.js';
 export { cancelCommand } from './cancel.js';
 export type { CancelOptions } from './cancel.js';
+export { approveCommand } from './approve.js';
+export type { ApproveOptions } from './approve.js';
+export { rejectCommand } from './reject.js';
+export type { RejectOptions } from './reject.js';
 export { workflowsListCommand } from './workflows.js';
 export type { WorkflowsListOptions } from './workflows.js';
 export { drainWorkerCommand } from './drain-worker.js';

package/dist/commands/index.js

@@ -1,5 +1,6 @@
 import "../chunk-gOLHoazu.js";
 import { compileCommand } from "./compile.js";
+import { approveCommand } from "./approve.js";
 import { cancelCommand } from "./cancel.js";
 import { docsCommand, docsLlmCommand } from "./docs.js";
 import { drainWorkerCommand } from "./drain-worker.js";
@@ -16,5 +17,6 @@ import { statusCommand } from "./status.js";
 import { typesCommand } from "./types.js";
 import { orgCurrentCommand, orgListCommand, orgUseCommand } from "./org.js";
 import { logoutCommand } from "./logout.js";
+import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
-export { cancelCommand, compileCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orgCurrentCommand, orgListCommand, orgUseCommand, runLocalCommand, runRemoteCommand, secretsListCommand, statusCommand, testCommand, testDryRun, typesCommand, watchCommand, workflowsListCommand };
+export { approveCommand, cancelCommand, compileCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orgCurrentCommand, orgListCommand, orgUseCommand, rejectCommand, runLocalCommand, runRemoteCommand, secretsListCommand, statusCommand, testCommand, testDryRun, typesCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.js

@@ -7,9 +7,9 @@ import { detectHookTools, findGitDir } from "../hooks/detector.js";
 import { installHook } from "../hooks/installer.js";
 import "../hooks/index.js";
 import { getTypeScriptPaths } from "../execution/sdk-alias.js";
+import path from "node:path";
 import pc from "picocolors";
 import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
 import { initZx, logger, toErrorMessage } from "@kici-dev/core";
 import { detectPackageManager, installBuildPolicyArgs, installCommand, parsePackageManager } from "@kici-dev/core/package-manager";
 import { checkbox, confirm, select } from "@inquirer/prompts";

package/dist/commands/login.js

@@ -1,6 +1,7 @@
 import "../chunk-gOLHoazu.js";
 import { getConfigPath, mergeGlobalConfig } from "../remote/config.js";
 import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
+import "../remote/prod-defaults.js";
 import { isHeadless } from "../auth/headless-detect.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";
@@ -45,21 +46,9 @@ function checkPatExpiry(expiresAt) {
 * 4. Save PAT to global config
 */
 async function oauthLogin(options) {
-	const platformUrl = options.platformEndpoint || process.env.KICI_PLATFORM_URL || "";
-	const issuer = process.env.KICI_OIDC_ISSUER || "";
-	const clientId = process.env.KICI_OIDC_CLIENT_ID || "";
-	const missing = [];
-	if (!platformUrl) missing.push("KICI_PLATFORM_URL");
-	if (!issuer) missing.push("KICI_OIDC_ISSUER");
-	if (!clientId) missing.push("KICI_OIDC_CLIENT_ID");
-	if (missing.length > 0) {
-		console.error(pc.red(`Error: missing required env var(s) for OAuth login: ${missing.join(", ")}`));
-		console.error(pc.gray("  Set them to your Platform and IdP endpoints, for example:"));
-		console.error(pc.gray("    export KICI_PLATFORM_URL=https://your-platform.example.com"));
-		console.error(pc.gray("    export KICI_OIDC_ISSUER=https://your-idp.example.com"));
-		console.error(pc.gray("    export KICI_OIDC_CLIENT_ID=<cli-client-id>"));
-		return false;
-	}
+	const platformUrl = options.platformEndpoint || process.env.KICI_PLATFORM_URL || "https://api.kici.dev";
+	const issuer = process.env.KICI_OIDC_ISSUER || "https://auth.kici.dev/realms/kici-internal";
+	const clientId = process.env.KICI_OIDC_CLIENT_ID || "kici-cli";
 	console.log(pc.cyan("\n  Step 1/4: Detecting environment..."));
 	const browserCmdSet = !!process.env.KICI_BROWSER_CMD;
 	const useDeviceFlow = options.device || !browserCmdSet && isHeadless();

package/dist/commands/reject.d.ts

@@ -0,0 +1,25 @@
+/**
+ * kici reject command
+ *
+ * Rejects a held approval gate for a run (requires `--reason`). Resolves the
+ * held element by `--job` / `--step` (or the sole pending hold), then records
+ * the rejection via the Platform dashboard API (PAT auth).
+ */
+/** Options for the reject command. */
+export interface RejectOptions {
+    /** Match a hold by its job name. */
+    job?: string;
+    /** Match a step-scoped hold by its step index. */
+    step?: string;
+    /** Required rejection reason. */
+    reason?: string;
+}
+/**
+ * Reject a held approval gate.
+ *
+ * @param runId - The run whose hold to reject.
+ * @param options - Job/step filters plus the required reason.
+ * @returns true on success, false on error.
+ */
+export declare function rejectCommand(runId: string, options?: RejectOptions): Promise<boolean>;
+//# sourceMappingURL=reject.d.ts.map

package/dist/commands/reject.js

@@ -0,0 +1,49 @@
+import "../chunk-gOLHoazu.js";
+import { listHeldRunsForRun, postReject, resolveHeldRunContext } from "./held-run-client.js";
+import { resolveHeldRunId } from "./held-run-resolve.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/reject.ts
+/**
+* kici reject command
+*
+* Rejects a held approval gate for a run (requires `--reason`). Resolves the
+* held element by `--job` / `--step` (or the sole pending hold), then records
+* the rejection via the Platform dashboard API (PAT auth).
+*/
+/**
+* Reject a held approval gate.
+*
+* @param runId - The run whose hold to reject.
+* @param options - Job/step filters plus the required reason.
+* @returns true on success, false on error.
+*/
+async function rejectCommand(runId, options = {}) {
+	try {
+		if (!options.reason) {
+			logger.error(pc.red("A rejection reason is required. Pass --reason <text>."));
+			return false;
+		}
+		const ctx = await resolveHeldRunContext();
+		if (!ctx) return false;
+		const resolution = resolveHeldRunId(await listHeldRunsForRun(ctx, runId), {
+			job: options.job,
+			step: options.step
+		});
+		if (!resolution.ok) {
+			logger.error(pc.red(resolution.error));
+			return false;
+		}
+		logger.info(`Rejecting held run ${pc.cyan(resolution.heldRunId)} for run ${pc.cyan(runId)}...`);
+		if (!await postReject(ctx, resolution.heldRunId, options.reason)) return false;
+		logger.info(pc.yellow("Rejection recorded. The held element will fail."));
+		return true;
+	} catch (error) {
+		logger.error(pc.red(`Error: ${toErrorMessage(error)}`));
+		return false;
+	}
+}
+//#endregion
+export { rejectCommand };
+
+//# sourceMappingURL=reject.js.map

package/dist/commands/run.js

@@ -5,15 +5,16 @@ import { AuthenticationError, ConnectionError, OrchestratorClient } from "../rem
 import { loadGlobalConfig } from "../remote/config.js";
 import { RunHistory } from "../remote/history.js";
 import { ObserverClient } from "../remote/observer.js";
+import { buildEncryptedSecrets } from "../remote/secret-upload.js";
 import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/uploader.js";
 import { formatJsonResult } from "../remote/output/json.js";
 import { formatJunitResult } from "../remote/output/junit.js";
 import { StreamingFormatter } from "../remote/output/streaming.js";
 import { formatErrorHighlight, formatMultiFixtureSummary, formatSummary } from "../remote/output/summary.js";
 import { compileFixtures, filterFixtures } from "../fixtures/compiler.js";
+import path from "node:path";
 import pc from "picocolors";
 import { readFile, writeFile } from "node:fs/promises";
-import path from "node:path";
 import { formatBytes, logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/run.ts
 /**
@@ -185,7 +186,7 @@ async function runSingleFixture(fixture, client, options, config, history) {
 		let routingKey = options.routingKey ?? config.routingKey ?? "default";
 		if (!hasRemote) {
 			routingKey = `local:${path.basename(repoRoot)}`;
-			logger.warn("No remote detected -- steps that use git commands will fail (no .git directory)");
+			if (!options.quiet) logger.warn("No remote detected -- steps that use git commands will fail (no .git directory)");
 		}
 		let inlineLockFile;
 		if (!hasRemote) inlineLockFile = await readFile(path.join(kiciDir, "kici.lock.json"), "utf-8");
@@ -217,6 +218,7 @@ async function runSingleFixture(fixture, client, options, config, history) {
 			};
 		}
 		if (!options.quiet) logger.info(pc.gray("Triggering test run..."));
+		const encrypted = await buildEncryptedSecrets(kiciDir, options.envFlags, options.context, upload.publicKey);
 		const triggerResult = await client.triggerTest({
 			fixtureId: fixture.id,
 			event,
@@ -224,6 +226,10 @@ async function runSingleFixture(fixture, client, options, config, history) {
 			uploadId: upload.uploadId,
 			cliPublicKey: uploadResult.cliPublicKey.toString("base64"),
 			secrets: opts.secrets,
+			...encrypted && {
+				encryptedSecrets: encrypted.encryptedSecrets,
+				encryptedSecretsKey: encrypted.cliPublicKey
+			},
 			workflowName: opts.workflowName,
 			inlineLockFile,
 			fullRepo: !hasRemote || void 0
@@ -516,6 +522,7 @@ async function runDirectWorkflow(workflowName, options) {
 	const repoName = !hasRemote ? path.basename(repoRoot) : void 0;
 	const payload = {};
 	if (!hasRemote) payload.repository = { full_name: `local/${repoName}` };
+	const encrypted = await buildEncryptedSecrets(kiciDir, options.envFlags, options.context, upload.publicKey);
 	const result = await client.triggerTest({
 		fixtureId: `direct:${workflowName}`,
 		event: {
@@ -526,6 +533,10 @@ async function runDirectWorkflow(workflowName, options) {
 		routingKey,
 		uploadId: upload.uploadId,
 		cliPublicKey: directUploadResult.cliPublicKey.toString("base64"),
+		...encrypted && {
+			encryptedSecrets: encrypted.encryptedSecrets,
+			encryptedSecretsKey: encrypted.cliPublicKey
+		},
 		workflowName,
 		inlineLockFile,
 		fullRepo: !hasRemote || void 0

package/dist/commands/secrets-list.js

@@ -47,7 +47,7 @@ async function secretsListCommand(options) {
 		const contexts = ((await res.json()).environments ?? []).filter((e) => e.allow_local_execution);
 		if (contexts.length === 0) {
 			console.log(pc.yellow("No test-available secret contexts found."));
-			console.log(pc.gray("Set allowLocalExecution=true on an environment to make its secrets available for test runs."));
+			console.log(pc.gray("Enable test runs (allowLocalExecution) on an environment to make its secrets available for test runs."));
 			return true;
 		}
 		console.log(pc.bold("\nTest-available secret contexts:\n"));

package/dist/commands/status.js

@@ -15,7 +15,7 @@ import { formatDuration, logger, toErrorMessage } from "@kici-dev/core";
 * Looks up local history first, then fetches from the orchestrator for
 * up-to-date status and logs.
 */
-const CLI_VERSION = "0.1.14";
+const CLI_VERSION = "0.1.16";
 /**
 * Show status and details of a test run.
 *

package/dist/commands/test.d.ts

@@ -32,6 +32,8 @@ export interface RemoteRunOptions extends TestOptions {
     routingKey?: string;
     /** Show recent run history */
     history?: boolean;
+    /** --env KEY=VALUE flag values, uploaded as per-run secrets. */
+    envFlags?: string[];
 }
 /** Result of a single remote fixture run */
 export interface RemoteRunResult {

package/dist/commands/test.js

@@ -6,9 +6,9 @@ import { displayDryRun } from "../test-runner/dry-run.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { buildEventPayload } from "../test-runner/payload-builder.js";
 import { loadSecretsFile } from "../test-runner/secrets-file.js";
+import path from "node:path";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
-import path from "node:path";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { matchAllWorkflows, normalizeRunsOn } from "@kici-dev/engine";
 //#region src/commands/test.ts

package/dist/commands/types.js

@@ -1,9 +1,9 @@
 import "../chunk-gOLHoazu.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import { generateSecretsDts } from "../generators/secrets-dts.js";
+import path from "node:path";
 import pc from "picocolors";
 import fs from "node:fs/promises";
-import path from "node:path";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/commands/types.ts
 /**

package/dist/commands/watch.js

@@ -2,8 +2,8 @@ import "../chunk-gOLHoazu.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { compileCommand } from "./compile.js";
-import pc from "picocolors";
 import path from "node:path";
+import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import chokidar from "chokidar";
 //#region src/commands/watch.ts

package/dist/execution/executor.js

@@ -2,10 +2,10 @@ import "../chunk-gOLHoazu.js";
 import { compilerError } from "../errors/formatter.js";
 import "../errors/index.js";
 import { ensureTsLoaderHook } from "./ts-loader.js";
+import { pathToFileURL } from "node:url";
+import path from "node:path";
 import { existsSync } from "node:fs";
 import fs from "node:fs/promises";
-import path from "node:path";
-import { pathToFileURL } from "node:url";
 //#region src/execution/executor.ts
 /**
 * Load a TypeScript workflow/config module by direct dynamic import.

package/dist/execution/sdk-alias.js

@@ -1,7 +1,7 @@
 import "../chunk-gOLHoazu.js";
+import path from "node:path";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import path from "node:path";
 import { logger } from "@kici-dev/core";
 //#region src/execution/sdk-alias.ts
 /**

package/dist/fixtures/compiler.js

@@ -1,8 +1,8 @@
 import "../chunk-gOLHoazu.js";
 import { ensureTsLoaderHook } from "../execution/ts-loader.js";
-import fs from "node:fs/promises";
-import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import path from "node:path";
+import fs from "node:fs/promises";
 import picomatch from "picomatch";
 //#region src/fixtures/compiler.ts
 /**

package/dist/fixtures/defaults/index.js

@@ -1,7 +1,7 @@
 import "../../chunk-gOLHoazu.js";
-import { readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { readFileSync } from "node:fs";
 //#region src/fixtures/defaults/index.ts
 /**
 * Built-in fixture registry for common GitHub webhook events.

package/dist/hooks/detector.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
-import { readFile, stat } from "node:fs/promises";
 import path from "node:path";
+import { readFile, stat } from "node:fs/promises";
 //#region src/hooks/detector.ts
 const TOOL_CONFIGS = [
 	{

package/dist/hooks/installer.js

@@ -1,8 +1,8 @@
 import "../chunk-gOLHoazu.js";
 import { findGitDir } from "./detector.js";
 import { getHookTemplate, hasKiciHook } from "./templates.js";
-import { chmod, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
+import { chmod, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { exec } from "node:child_process";
 import { promisify } from "node:util";
 //#region src/hooks/installer.ts

package/dist/index.d.ts

@@ -4,7 +4,7 @@ export { validateConfig } from './validation/index.js';
 export type { ValidationResult } from './validation/index.js';
 export { generateLockFile, serializeLockFile } from './lockfile/index.js';
 export { SCHEMA_VERSION, isLockStaticJob } from './types.js';
-export type { LockFile, LockWorkflow, LockJob, LockDynamicJobFn, LockJobOrFactory, LockTrigger, LockPrTrigger, LockPushTrigger, LockMatrix, LockRule, LockStep, LockSource, LockBranchPattern, } from './types.js';
+export type { LockFile, LockWorkflow, LockJob, LockDynamicJobFn, LockJobOrFactory, LockTrigger, LockPrTrigger, LockPushTrigger, LockMatrix, LockRule, LockStep, LockApproval, LockSource, LockBranchPattern, } from './types.js';
 export { formatError, compilerError, isCompilerError } from './errors/index.js';
 export type { SourceLocation, CompilerError } from './errors/index.js';
 export { CapabilityGapError, formatCapabilityGapError } from './errors/index.js';