@kici-dev/compiler 0.1.14 → 0.1.16

package/dist/llm-context/llms.txt

@@ -7,7 +7,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 ## Getting started
 
 - [User guide](https://docs.kici.dev/user/): Writing and testing CI/CD workflows in TypeScript
-- [Getting started with KiCI](https://docs.kici.dev/user/getting-started/): Install the SDK, write your first workflow, compile and test locally
+- [Getting started with workflows](https://docs.kici.dev/user/getting-started/): Install the SDK, write your first workflow, compile and test locally
 - [5-minute quickstart](https://docs.kici.dev/user/quickstart/): Stand up a KiCI orchestrator + agent and run your first workflow
 
 ## Workflow patterns
@@ -20,7 +20,9 @@ The full markdown bundle of every page indexed here is available at https://docs
 
 ## SDK reference
 
+- [Caching](https://docs.kici.dev/user/sdk/caching/): Cache files and directories across runs with declarative job/step cache or the imperative ctx.cache API
 - [SDK reference: core](https://docs.kici.dev/user/sdk/core/): Factory functions (workflow, job, step) and authoring patterns: needs, output chaining, dynamic groups
+- [Event payload reference](https://docs.kici.dev/user/sdk/event-payloads/): Generated schema of the normalized event envelope passed to rules and dynamic functions.
 - [SDK reference: idempotent](https://docs.kici.dev/user/sdk/idempotent/): Idempotent helpers for declarative check / apply patterns inside workflow steps
 - [SDK reference: rules, matrix, dynamic jobs](https://docs.kici.dev/user/sdk/rules-matrix-dynamic/): rule(), skip(), matrix builds (static + dynamic), and dynamicJob / dynamicGroup
 - [SDK reference: runtime](https://docs.kici.dev/user/sdk/runtime/): Types index, StepContext, secrets, fixtures
@@ -40,6 +42,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 
 ## Workflow features
 
+- [Account and sign-in](https://docs.kici.dev/user/account-and-login/): How your KiCI account relates to sign-in methods, and how to change the way you sign in.
 - [Concurrency groups](https://docs.kici.dev/user/concurrency/): Control parallel execution with auto-cancel and queue modes
 - [Dashboard](https://docs.kici.dev/user/dashboard/)
 - [Dynamic values](https://docs.kici.dev/user/dynamic-values/)
@@ -58,5 +61,4 @@ The full markdown bundle of every page indexed here is available at https://docs
 ## Architecture overview
 
 - [Data flows](https://docs.kici.dev/architecture/data-flows/): End-to-end data flows through the KiCI three-tier architecture
-- [Design decisions](https://docs.kici.dev/architecture/design-decisions/): Why KiCI's architecture is shaped the way it is
 - [Architecture overview](https://docs.kici.dev/architecture/overview/): Three-tier relay model, package structure, and component responsibilities

package/dist/local-executor/index.js

@@ -2,18 +2,18 @@ import "../chunk-gOLHoazu.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";
+import { loadLocalSecrets } from "./secret-loader.js";
 import { executeDag, resolveJobFilter } from "./dag-scheduler.js";
 import { compileCommand } from "../commands/compile.js";
-import { loadLocalSecrets } from "./secret-loader.js";
 import { generateEventPayload } from "./payload-generator.js";
 import { executeResolvedJob, resolveJobs } from "./job-runner.js";
 import { displayLocalSummary, formatLocalJsonResult, formatLocalJunitResult } from "./output-streamer.js";
 import { PickerCancelledError, runPicker } from "./picker.js";
-import { materializeCheckout } from "./materializer.js";
+import { gcStaleRunCheckouts, materializeCheckout } from "./materializer.js";
 import { ConcurrencyKeyEvaluationError, acquireWorkflowLock } from "./workflow-lock.js";
+import path from "node:path";
 import pc from "picocolors";
 import { writeFile } from "node:fs/promises";
-import path from "node:path";
 import { logger } from "@kici-dev/core";
 import { matchAllWorkflows } from "@kici-dev/engine";
 import os from "node:os";
@@ -107,7 +107,7 @@ async function runOneMatchedWorkflow(workflow, ctx) {
 		lockHandle = await acquireWorkflowLock({
 			workflowName: workflow.name,
 			workflow,
-			event: event.payload,
+			event,
 			branch: deriveBranchForGroupCtx(event),
 			debug: options.debug
 		});
@@ -272,6 +272,7 @@ async function executeLocal(options) {
 	let materialized = null;
 	let execDir = repoRoot;
 	if (!options.inPlace) {
+		await gcStaleRunCheckouts(process.env.KICI_RUN_DIR ?? os.tmpdir());
 		materialized = await materializeCheckout(repoRoot, { runDir: process.env.KICI_RUN_DIR });
 		execDir = materialized.path;
 		logger.info(pc.gray(`running in ${execDir}`));

package/dist/local-executor/job-runner.js

@@ -3,8 +3,9 @@ import { ensureTsLoaderHook } from "../execution/ts-loader.js";
 import { formatter } from "../test-runner/output-formatter.js";
 import { createStepContext } from "../test-runner/step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "../test-runner/rule-evaluator.js";
-import path from "node:path";
+import { toEventPayload } from "./to-event-payload.js";
 import { pathToFileURL } from "node:url";
+import path from "node:path";
 import { applyIncludeExclude, expandMatrix, isDynamicJobFn, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
 //#region src/local-executor/job-runner.ts
 /**
@@ -72,10 +73,7 @@ async function resolveJobs(workflow, event) {
 			$: (await import("zx")).$,
 			ctx: {
 				workflow: { name: workflow.name },
-				event: {
-					type: event.type,
-					...event.payload
-				}
+				event: toEventPayload(event)
 			},
 			log: {
 				info: () => {},

package/dist/local-executor/materializer.d.ts

@@ -36,4 +36,9 @@ export interface MaterializeOptions {
  * @throws If `repoRoot` is not inside a git work tree
  */
 export declare function materializeCheckout(repoRoot: string, opts?: MaterializeOptions): Promise<MaterializedCheckout>;
+/**
+ * Collect stale retained checkouts under the run base. Invoked on every
+ * `kici run local`; never throws (the GC must not break the run).
+ */
+export declare function gcStaleRunCheckouts(base: string): Promise<string[]>;
 //# sourceMappingURL=materializer.d.ts.map

package/dist/local-executor/materializer.js

@@ -1,10 +1,12 @@
 import "../chunk-gOLHoazu.js";
 import { selectOverlayFiles } from "../remote/uploader.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
+import { logger } from "@kici-dev/core";
 import { execSync } from "node:child_process";
 import os from "node:os";
 import { randomBytes } from "node:crypto";
+import { gcStaleTmpDirs } from "@kici-dev/core/tmp-gc";
 //#region src/local-executor/materializer.ts
 /**
 * Materialize an isolated tmp checkout of the repo for `kici run local`.
@@ -52,6 +54,25 @@ async function materializeCheckout(repoRoot, opts) {
 	};
 }
 /**
+* Checkouts retained for inspection (failed runs, --keep) stay around this
+* long before the next `kici run local` invocation collects them.
+*/
+const RUN_CHECKOUT_GC_MAX_AGE_MS = 4320 * 60 * 1e3;
+/** Matches the kici-run-<6 hex> dirs materializeCheckout creates — nothing else. */
+const RUN_CHECKOUT_PATTERN = /^kici-run-[0-9a-f]{6}$/;
+/**
+* Collect stale retained checkouts under the run base. Invoked on every
+* `kici run local`; never throws (the GC must not break the run).
+*/
+async function gcStaleRunCheckouts(base) {
+	return gcStaleTmpDirs({
+		base,
+		pattern: RUN_CHECKOUT_PATTERN,
+		maxAgeMs: RUN_CHECKOUT_GC_MAX_AGE_MS,
+		log: (m) => logger.debug(m)
+	});
+}
+/**
 * Throw an actionable error if `repoRoot` is not a git work tree.
 */
 function requireGitRepo(repoRoot) {
@@ -106,6 +127,6 @@ function shellQuote(value) {
 	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 //#endregion
-export { materializeCheckout };
+export { gcStaleRunCheckouts, materializeCheckout };
 
 //# sourceMappingURL=materializer.js.map

package/dist/local-executor/secret-loader.js

@@ -1,7 +1,7 @@
 import "../chunk-gOLHoazu.js";
 import { loadSecretsFile } from "../test-runner/secrets-file.js";
-import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { readFile } from "node:fs/promises";
 import { parse } from "yaml";
 //#region src/local-executor/secret-loader.ts
 /**

package/dist/local-executor/to-event-payload.d.ts

@@ -0,0 +1,16 @@
+import type { SimulatedEvent } from '@kici-dev/engine';
+import type { EventPayload } from '@kici-dev/sdk';
+/**
+ * Map a {@link SimulatedEvent} into the normalized SDK {@link EventPayload}
+ * envelope that every user-authored dynamic function (dynamic job generators,
+ * `concurrency.group()`) receives as its `event` argument.
+ *
+ * `SimulatedEvent` already carries the normalized fields (`type`, `action`,
+ * `targetBranch`, …) alongside the raw provider body under `payload`, so the
+ * single cast at this boundary is a deliberate type assertion over a
+ * structurally-identical value: it asserts the discriminated-union view
+ * without reshaping anything. Raw provider fields stay nested under
+ * `payload.<field>`; normalized fields live at the top level.
+ */
+export declare function toEventPayload(event: SimulatedEvent): EventPayload;
+//# sourceMappingURL=to-event-payload.d.ts.map

package/dist/local-executor/to-event-payload.js

@@ -0,0 +1,21 @@
+import "../chunk-gOLHoazu.js";
+//#region src/local-executor/to-event-payload.ts
+/**
+* Map a {@link SimulatedEvent} into the normalized SDK {@link EventPayload}
+* envelope that every user-authored dynamic function (dynamic job generators,
+* `concurrency.group()`) receives as its `event` argument.
+*
+* `SimulatedEvent` already carries the normalized fields (`type`, `action`,
+* `targetBranch`, …) alongside the raw provider body under `payload`, so the
+* single cast at this boundary is a deliberate type assertion over a
+* structurally-identical value: it asserts the discriminated-union view
+* without reshaping anything. Raw provider fields stay nested under
+* `payload.<field>`; normalized fields live at the top level.
+*/
+function toEventPayload(event) {
+	return event;
+}
+//#endregion
+export { toEventPayload };
+
+//# sourceMappingURL=to-event-payload.js.map

package/dist/local-executor/workflow-lock.d.ts

@@ -20,6 +20,7 @@
  * `os.tmpdir()/kici-local-locks-<uid>/`).
  */
 import type { Workflow } from '@kici-dev/sdk';
+import type { SimulatedEvent } from '@kici-dev/engine';
 /** Sidecar metadata persisted next to the lock dir for diagnostics + reclamation. */
 export interface LockHolderMetadata {
     pid: number;
@@ -35,8 +36,8 @@ export interface WorkflowLockHandle {
 export interface AcquireWorkflowLockOptions {
     workflowName: string;
     workflow: Workflow;
-    /** The simulated-event payload object passed as `groupCtx.event` to the user's group fn. */
-    event: Record<string, unknown>;
+    /** The simulated event mapped to the normalized envelope passed as `groupCtx.event`. */
+    event: SimulatedEvent;
     /** Branch derived from the simulated event for `groupCtx.branch`. */
     branch: string;
     debug?: boolean;
@@ -68,7 +69,7 @@ export declare function resolveLockDir(): Promise<string>;
  * Returns `null` when the workflow has no `concurrency` block. Throws
  * {@link ConcurrencyKeyEvaluationError} when the group function throws or rejects.
  */
-export declare function resolveConcurrencyKey(workflow: Workflow, event: Record<string, unknown>, branch: string): Promise<string | null>;
+export declare function resolveConcurrencyKey(workflow: Workflow, event: SimulatedEvent, branch: string): Promise<string | null>;
 /**
  * Acquire the workflow-level concurrency lock for a `kici run local` invocation.
  *

package/dist/lockfile/generator.js

@@ -3,9 +3,9 @@ import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "../types.js";
 import { computeContentHash } from "./hasher.js";
 import { resolveHashFiles } from "./hash-files.js";
 import { analyzePurity } from "./purity-analyzer.js";
-import { readFileSync } from "node:fs";
 import path from "node:path";
-import { getDynamicJobGroup, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject } from "@kici-dev/sdk";
+import { readFileSync } from "node:fs";
+import { getDynamicJobGroup, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeCacheSpecs, normalizeRequireApproval } from "@kici-dev/sdk";
 import { sha256 } from "@kici-dev/core";
 import { PackageManager, detectPackageManagerSync } from "@kici-dev/core/package-manager";
 import { validateResourceRequest } from "@kici-dev/engine";
@@ -151,7 +151,9 @@ function transformWorkflow(workflow, sourceFile, exportRef, bundleSource, gitRoo
 			hasGroup: !!workflow.concurrency.group,
 			...workflow.concurrency.cancelInProgress !== void 0 && { cancelInProgress: workflow.concurrency.cancelInProgress },
 			...workflow.concurrency.max !== void 0 && { max: workflow.concurrency.max }
-		} }
+		} },
+		...workflow.timeout !== void 0 && { timeout: workflow.timeout },
+		...workflow.requireApproval !== void 0 && { approval: toLockApproval(workflow.requireApproval) }
 	};
 }
 /**
@@ -528,6 +530,7 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 		rules: job.rules ? transformRules(job.rules, configPath, index) : void 0,
 		description: job.description,
 		...job.checkout !== void 0 && { checkout: job.checkout },
+		...job.cache !== void 0 && { cache: normalizeCacheSpecs(job.cache) },
 		...job.container !== void 0 && { container: job.container },
 		...environmentFields,
 		...envFields,
@@ -539,7 +542,10 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 		...job.beforeStep !== void 0 && { hasBeforeStep: true },
 		...job.afterStep !== void 0 && { hasAfterStep: true },
 		...job.gracePeriod !== void 0 && { gracePeriod: job.gracePeriod },
-		...job.resources !== void 0 && { resources: job.resources }
+		...job.timeout !== void 0 && { timeout: job.timeout },
+		...job.resources !== void 0 && { resources: job.resources },
+		...job.init !== void 0 && { init: job.init },
+		...job.requireApproval !== void 0 && { approval: toLockApproval(job.requireApproval) }
 	};
 }
 /**
@@ -587,6 +593,15 @@ function resolveNeedsForLock(needs, uuidToName) {
 * Assigns counter-based IDs to unnamed steps (bare functions and id-less steps).
 * Counter only increments for unnamed entries; named steps keep their names.
 */
+/** Map an SDK `requireApproval` to the normalized lock `approval` block. */
+function toLockApproval(r) {
+	const n = normalizeRequireApproval(r);
+	return {
+		clauses: n.clauses,
+		...n.reason !== void 0 && { reason: n.reason },
+		...n.timeoutSeconds !== void 0 && { timeoutSeconds: n.timeoutSeconds }
+	};
+}
 function transformSteps(steps, gitRoot) {
 	let stepCounter = 0;
 	return steps.map((stepOrFn) => {
@@ -603,6 +618,7 @@ function transformSteps(steps, gitRoot) {
 			hasOutputs: !!step.outputs && Object.keys(step.outputs).length > 0,
 			...step.continueOnError !== void 0 && { continueOnError: step.continueOnError },
 			...step.timeout !== void 0 && { timeout: step.timeout },
+			...step.cache !== void 0 && { cache: normalizeCacheSpecs(step.cache) },
 			...step._sourceLocation && { sourceLocation: {
 				file: makeRelativePath(step._sourceLocation.file, gitRoot),
 				line: step._sourceLocation.line,
@@ -613,7 +629,8 @@ function transformSteps(steps, gitRoot) {
 				rules: transformRules(step.rules, makeRelativePath(step._sourceLocation?.file ?? "", gitRoot))
 			},
 			...step.onCancel !== void 0 && { hasOnCancel: true },
-			...step.cleanup !== void 0 && { hasCleanup: true }
+			...step.cleanup !== void 0 && { hasCleanup: true },
+			...step.requireApproval !== void 0 && { approval: toLockApproval(step.requireApproval) }
 		};
 	});
 }

package/dist/lockfile/hash-files.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
-import { readFileSync } from "node:fs";
 import path from "node:path";
+import { readFileSync } from "node:fs";
 import fg from "fast-glob";
 //#region src/lockfile/hash-files.ts
 /**

package/dist/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "./chunk-gOLHoazu.js";
-import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { confirm } from "@inquirer/prompts";
 //#region src/postinstall.ts

package/dist/remote/client.d.ts

@@ -33,6 +33,10 @@ export interface TestTriggerInput {
     /** CLI's ephemeral public key (base64, SPKI/DER) for overlay decryption */
     cliPublicKey?: string;
     secrets?: Record<string, string>;
+    /** Base64 X25519+AES-GCM blob of the developer's local secrets ({flat, contexts}). */
+    encryptedSecrets?: string;
+    /** Base64 ephemeral CLI public key that encrypted `encryptedSecrets`. */
+    encryptedSecretsKey?: string;
     workflowName?: string;
     /** JSON-stringified lock file content for repos with no remote. */
     inlineLockFile?: string;

package/dist/remote/config.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 import os from "node:os";
 //#region src/remote/config.ts
 const VALID_CONNECTION_MODES = ["platform", "direct"];

package/dist/remote/history.js

@@ -1,9 +1,9 @@
 import "../chunk-gOLHoazu.js";
 import { formatRelativeTime } from "../format.js";
 import { getConfigDir } from "./config.js";
+import path from "node:path";
 import pc from "picocolors";
 import fs from "node:fs/promises";
-import path from "node:path";
 import { formatDuration } from "@kici-dev/core";
 import picomatch from "picomatch";
 //#region src/remote/history.ts

package/dist/remote/prod-defaults.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Production defaults for the `kici login` OAuth flow. When the matching
+ * env var (or the `--platform-endpoint` flag) is unset, login resolves
+ * these so a developer targeting the hosted KiCI Platform authenticates
+ * with no setup. Setting the env var overrides the default — staging E2E
+ * and self-hosted Platforms depend on that override path.
+ *
+ * Resolution is login-local: these are read into locals in `oauthLogin`,
+ * never written back into `process.env`, so the orchestrator's separate
+ * `wss://…/ws` meaning of `KICI_PLATFORM_URL` is unaffected.
+ */
+/** Platform API base URL — login POSTs to `${value}/api/v1/cli/exchange-token`. */
+export declare const PROD_PLATFORM_URL = "https://api.kici.dev";
+/** OIDC issuer for the hosted Platform's Keycloak realm. */
+export declare const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
+/** Public OIDC client id registered for the `kici` CLI. */
+export declare const PROD_OIDC_CLIENT_ID = "kici-cli";
+//# sourceMappingURL=prod-defaults.d.ts.map

package/dist/remote/prod-defaults.js

@@ -0,0 +1,23 @@
+import "../chunk-gOLHoazu.js";
+//#region src/remote/prod-defaults.ts
+/**
+* Production defaults for the `kici login` OAuth flow. When the matching
+* env var (or the `--platform-endpoint` flag) is unset, login resolves
+* these so a developer targeting the hosted KiCI Platform authenticates
+* with no setup. Setting the env var overrides the default — staging E2E
+* and self-hosted Platforms depend on that override path.
+*
+* Resolution is login-local: these are read into locals in `oauthLogin`,
+* never written back into `process.env`, so the orchestrator's separate
+* `wss://…/ws` meaning of `KICI_PLATFORM_URL` is unaffected.
+*/
+/** Platform API base URL — login POSTs to `${value}/api/v1/cli/exchange-token`. */
+const PROD_PLATFORM_URL = "https://api.kici.dev";
+/** OIDC issuer for the hosted Platform's Keycloak realm. */
+const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
+/** Public OIDC client id registered for the `kici` CLI. */
+const PROD_OIDC_CLIENT_ID = "kici-cli";
+//#endregion
+export { PROD_OIDC_CLIENT_ID, PROD_OIDC_ISSUER, PROD_PLATFORM_URL };
+
+//# sourceMappingURL=prod-defaults.js.map

package/dist/remote/secret-upload.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Parse `--context ctx.key=value` flag values into a nested
+ * `{ context: { key: value } }` map. The first `.` splits the context name
+ * from `key=value`; the first `=` splits key from value (values may contain
+ * `=`). Malformed entries (missing `.` or `=`, empty context/key) are skipped.
+ */
+export declare function parseContextFlags(flags: string[] | undefined): Record<string, Record<string, string>>;
+/**
+ * Load the developer's local secrets (same sources as `kici run local`: the
+ * `.kici` secret files plus `--env` flat flags) and `--context` namespaced
+ * flags, and encrypt them to the orchestrator's per-upload X25519 public key.
+ * `--context` values override `.kici/.secrets` file contexts for the same key.
+ * Returns the base64 ciphertext and the ephemeral CLI public key the
+ * orchestrator needs to decrypt, or null when there is nothing to send.
+ */
+export declare function buildEncryptedSecrets(kiciDir: string, envFlags: string[] | undefined, contextFlags: string[] | undefined, orchestratorPublicKeyB64: string): Promise<{
+    encryptedSecrets: string;
+    cliPublicKey: string;
+} | null>;
+//# sourceMappingURL=secret-upload.d.ts.map

package/dist/remote/secret-upload.js

@@ -0,0 +1,58 @@
+import "../chunk-gOLHoazu.js";
+import { loadLocalSecrets } from "../local-executor/secret-loader.js";
+import { encryptJson } from "@kici-dev/core";
+//#region src/remote/secret-upload.ts
+/**
+* Parse `--context ctx.key=value` flag values into a nested
+* `{ context: { key: value } }` map. The first `.` splits the context name
+* from `key=value`; the first `=` splits key from value (values may contain
+* `=`). Malformed entries (missing `.` or `=`, empty context/key) are skipped.
+*/
+function parseContextFlags(flags) {
+	const contexts = {};
+	for (const flag of flags ?? []) {
+		const dotIndex = flag.indexOf(".");
+		if (dotIndex === -1) continue;
+		const contextName = flag.slice(0, dotIndex).trim();
+		const rest = flag.slice(dotIndex + 1);
+		const eqIndex = rest.indexOf("=");
+		if (eqIndex === -1) continue;
+		const key = rest.slice(0, eqIndex).trim();
+		const value = rest.slice(eqIndex + 1).trim();
+		if (!contextName || !key) continue;
+		(contexts[contextName] ??= {})[key] = value;
+	}
+	return contexts;
+}
+/**
+* Load the developer's local secrets (same sources as `kici run local`: the
+* `.kici` secret files plus `--env` flat flags) and `--context` namespaced
+* flags, and encrypt them to the orchestrator's per-upload X25519 public key.
+* `--context` values override `.kici/.secrets` file contexts for the same key.
+* Returns the base64 ciphertext and the ephemeral CLI public key the
+* orchestrator needs to decrypt, or null when there is nothing to send.
+*/
+async function buildEncryptedSecrets(kiciDir, envFlags, contextFlags, orchestratorPublicKeyB64) {
+	const local = await loadLocalSecrets(kiciDir, envFlags);
+	const contexts = {};
+	for (const [ctxName, vals] of Object.entries(local.contexts)) contexts[ctxName] = { ...vals };
+	for (const [ctxName, vals] of Object.entries(parseContextFlags(contextFlags))) contexts[ctxName] = {
+		...contexts[ctxName] ?? {},
+		...vals
+	};
+	const hasFlat = Object.keys(local.flat).length > 0;
+	const hasContexts = Object.values(contexts).some((c) => Object.keys(c).length > 0);
+	if (!hasFlat && !hasContexts) return null;
+	const { ciphertextB64, senderPublicKeyB64 } = encryptJson({
+		flat: local.flat,
+		contexts
+	}, Buffer.from(orchestratorPublicKeyB64, "base64"));
+	return {
+		encryptedSecrets: ciphertextB64,
+		cliPublicKey: senderPublicKeyB64
+	};
+}
+//#endregion
+export { buildEncryptedSecrets, parseContextFlags };
+
+//# sourceMappingURL=secret-upload.js.map

package/dist/remote/uploader.js

@@ -1,7 +1,7 @@
 import "../chunk-gOLHoazu.js";
 import { encryptTarball } from "./encryption.js";
-import fs from "node:fs/promises";
 import path from "node:path";
+import fs from "node:fs/promises";
 import { formatBytes, sha256, sha256File } from "@kici-dev/core";
 import { execSync } from "node:child_process";
 import os from "node:os";

package/dist/templates/index.js

@@ -4,8 +4,8 @@ import { helloWorldWorkflow } from "./workflows/hello-world.js";
 import { prChecksWorkflow } from "./workflows/pr-checks.js";
 import { tsconfigTemplate } from "./tsconfig-json.js";
 import { generatePackageJson } from "./package-json.js";
-import path from "node:path";
 import { fileURLToPath } from "node:url";
+import path from "node:path";
 //#region src/templates/index.ts
 /**
 * Template aggregator for kici init command

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.14";
+const sdkVersion = "0.1.16";
 /**
 * Generate package.json content for .kici/ directory
 *

package/dist/templates/workflows/pr-checks.js

@@ -1,5 +1,5 @@
 import "../../chunk-gOLHoazu.js";
-import { job, pr, rule, skip, step, workflow } from "@kici-dev/sdk";
+import { isEventType, job, pr, rule, skip, step, workflow } from "@kici-dev/sdk";
 //#region src/templates/workflows/pr-checks.ts
 const prChecksWorkflow = workflow("pr-checks", {
 	on: pr({
@@ -7,7 +7,8 @@ const prChecksWorkflow = workflow("pr-checks", {
 		paths: ["src/**"]
 	}),
 	rules: [skip("skip-draft-prs", async (ctx) => {
-		return ctx.event.pull_request?.draft === true;
+		if (!isEventType(ctx.event, "pull_request")) return false;
+		return ctx.event.payload.pull_request.draft === true;
 	}), rule("require-src-changes", async (ctx) => {
 		return ctx.changedFiles.some((file) => file.startsWith("src/"));
 	})],

package/dist/templates/workflows/pr-checks.ts

@@ -2,7 +2,7 @@
 // Docs: https://kici.dev/docs/sdk-reference
 // Patterns: https://kici.dev/docs/workflow-patterns
 
-import { workflow, job, step, pr, rule, skip } from '@kici-dev/sdk';
+import { workflow, job, step, pr, rule, skip, isEventType } from '@kici-dev/sdk';
 
 export const prChecksWorkflow = workflow('pr-checks', {
   // Trigger: pr() matches pull request events
@@ -13,7 +13,9 @@ export const prChecksWorkflow = workflow('pr-checks', {
   // skip() = skip if true, rule() = run only if true
   rules: [
     skip('skip-draft-prs', async (ctx) => {
-      return (ctx.event as any).pull_request?.draft === true;
+      // Raw provider fields live under `ctx.event.payload`; narrow first for typing.
+      if (!isEventType(ctx.event, 'pull_request')) return false;
+      return ctx.event.payload.pull_request.draft === true;
     }),
 
     rule('require-src-changes', async (ctx) => {

package/dist/test-runner/git-detector.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
-import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { readFile } from "node:fs/promises";
 //#region src/test-runner/git-detector.ts
 /**
 * Auto-detect repository information from .git/config

package/dist/test-runner/job-executor.js

@@ -2,9 +2,9 @@ import "../chunk-gOLHoazu.js";
 import { formatter } from "./output-formatter.js";
 import { createStepContext } from "./step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "./rule-evaluator.js";
-import pc from "picocolors";
-import path from "node:path";
 import { pathToFileURL } from "node:url";
+import path from "node:path";
+import pc from "picocolors";
 import { setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/job-executor.ts

package/dist/test-runner/secrets-file.js

@@ -1,6 +1,6 @@
 import "../chunk-gOLHoazu.js";
-import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { readFile } from "node:fs/promises";
 //#region src/test-runner/secrets-file.ts
 /**
 * Parse an INI-style secrets file content.

package/dist/test-runner/step-context.js

@@ -1,7 +1,7 @@
 import "../chunk-gOLHoazu.js";
 import { formatter } from "./output-formatter.js";
-import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { createStepSecrets, resolveJobOutputs, resolveStepOutputs } from "@kici-dev/sdk";
 import { initZx } from "@kici-dev/core";
 import { tmpdir } from "node:os";
@@ -131,7 +131,11 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 		kici: { infrastructure: { list: () => Promise.resolve({
 			scalers: [],
 			agents: []
-		}) } }
+		}) } },
+		cache: {
+			restore: async () => ({ hit: false }),
+			save: async () => {}
+		}
 	};
 }
 //#endregion