@kici-dev/compiler 0.1.16 → 0.1.17

package/dist/commands/runs/cancel.d.ts

@@ -0,0 +1,6 @@
+export interface RunsCancelOptions {
+    force?: boolean;
+    branch?: string;
+}
+export declare function runsCancelCommand(runId: string | undefined, options?: RunsCancelOptions): Promise<boolean>;
+//# sourceMappingURL=cancel.d.ts.map

package/dist/commands/runs/cancel.js

@@ -0,0 +1,32 @@
+import "../../chunk-BTugEXQM.js";
+import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/runs/cancel.ts
+/** kici runs cancel — cancel a run or all in-progress runs on a branch. */
+async function runsCancelCommand(runId, options = {}) {
+	try {
+		const client = await DashboardClient.load();
+		if (options.branch) {
+			logger.info(`Cancelling all in-progress runs on branch ${pc.cyan(options.branch)}...`);
+			const { cancelledRuns = 0 } = await client.cancelByBranch(options.branch);
+			console.log(cancelledRuns === 0 ? pc.yellow(`No in-progress runs found on branch ${options.branch}.`) : pc.green(`Cancelled ${cancelledRuns} run${cancelledRuns !== 1 ? "s" : ""} on branch ${options.branch}.`));
+			return true;
+		}
+		if (!runId) {
+			logger.error(pc.red("Please provide a run ID or use --branch to cancel by branch."));
+			return false;
+		}
+		logger.info(`${options.force ? "Force-cancelling" : "Cancelling"} run ${pc.cyan(runId)}...`);
+		const { cancelledJobs = 0 } = await client.cancelRun(runId, options.force ?? false);
+		console.log(pc.green(`Run ${runId} cancelled (${cancelledJobs} job${cancelledJobs !== 1 ? "s" : ""} affected).`));
+		return true;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+//#endregion
+export { runsCancelCommand };
+
+//# sourceMappingURL=cancel.js.map

package/dist/commands/runs/list.d.ts

@@ -0,0 +1,6 @@
+import { type RunsListFilters } from '../../remote/dashboard-client.js';
+export interface RunsListOptions extends RunsListFilters {
+    json?: boolean;
+}
+export declare function runsListCommand(options?: RunsListOptions): Promise<boolean>;
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/runs/list.js

@@ -0,0 +1,49 @@
+import "../../chunk-BTugEXQM.js";
+import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
+import { colorStatus, formatDuration as formatDuration$1, relativeTime, renderTable } from "../../remote/render.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/runs/list.ts
+/** kici runs list — mirrors the dashboard Runs page list. */
+async function runsListCommand(options = {}) {
+	try {
+		const client = await DashboardClient.load();
+		const { json, ...filters } = options;
+		const page = await client.listRuns(filters);
+		if (json) {
+			console.log(JSON.stringify(page, null, 2));
+			return true;
+		}
+		if (page.runs.length === 0) {
+			console.log(pc.gray("No runs found."));
+			return true;
+		}
+		const rows = page.runs.map((r) => [
+			r.runId,
+			r.workflowName ?? "—",
+			colorStatus(r.status),
+			r.ref ?? "—",
+			r.triggerEvent ?? "—",
+			relativeTime(r.startedAt ?? void 0),
+			r.durationMs ? formatDuration$1(r.durationMs) : "—"
+		]);
+		console.log(renderTable([
+			"run-id",
+			"workflow",
+			"status",
+			"branch",
+			"trigger",
+			"started",
+			"duration"
+		], rows));
+		console.log(pc.gray(`\nPage ${page.page} · ${page.runs.length} of ${page.total}${page.hasMore ? " (more — use --page)" : ""}`));
+		return true;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+//#endregion
+export { runsListCommand };
+
+//# sourceMappingURL=list.js.map

package/dist/commands/runs/logs.d.ts

@@ -0,0 +1,7 @@
+export interface RunsLogsOptions {
+    job?: string;
+    follow?: boolean;
+    json?: boolean;
+}
+export declare function runsLogsCommand(runId: string, options?: RunsLogsOptions): Promise<boolean>;
+//# sourceMappingURL=logs.d.ts.map

package/dist/commands/runs/logs.js

@@ -0,0 +1,67 @@
+import "../../chunk-BTugEXQM.js";
+import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
+import { colorStatus } from "../../remote/render.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+import { TERMINAL_RUN_STATES } from "@kici-dev/engine";
+//#region src/commands/runs/logs.ts
+/** kici runs logs — step logs for a run (replaces `kici status --logs`). */
+const POLL_INTERVAL_MS = 2e3;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function runsLogsCommand(runId, options = {}) {
+	try {
+		const client = await DashboardClient.load();
+		if (options.json) {
+			const out = await collectAllLogs(client, runId, (await client.getRunDetail(runId)).jobs, options.job);
+			console.log(JSON.stringify(out, null, 2));
+			return true;
+		}
+		if (options.follow) return await followLogs(client, runId, options.job);
+		await printAllLogs(client, runId, (await client.getRunDetail(runId)).jobs, options.job);
+		return true;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+function selectJobs(jobs, jobFilter) {
+	return jobFilter ? jobs.filter((j) => j.jobName === jobFilter) : jobs;
+}
+async function printAllLogs(client, runId, jobs, jobFilter) {
+	for (const j of selectJobs(jobs, jobFilter)) for (const s of j.steps ?? []) {
+		console.log(pc.bold(`\n=== ${j.jobName} › ${s.stepName} `) + colorStatus(s.status) + pc.bold(" ==="));
+		const logs = await client.getStepLogs(runId, j.jobId, s.stepIndex);
+		for (const line of logs.lines) console.log(line);
+	}
+}
+async function collectAllLogs(client, runId, jobs, jobFilter) {
+	const out = {};
+	for (const j of selectJobs(jobs, jobFilter)) for (const s of j.steps ?? []) out[`${j.jobName}/${s.stepName}`] = (await client.getStepLogs(runId, j.jobId, s.stepIndex)).lines;
+	return out;
+}
+async function followLogs(client, runId, jobFilter) {
+	const printed = {};
+	for (;;) {
+		const run = await client.getRun(runId);
+		const detail = await client.getRunDetail(runId);
+		for (const j of selectJobs(detail.jobs, jobFilter)) for (const s of j.steps ?? []) {
+			const key = `${j.jobId}:${s.stepIndex}`;
+			const logs = await client.getStepLogs(runId, j.jobId, s.stepIndex);
+			const seen = printed[key] ?? 0;
+			if (logs.lines.length > seen) {
+				if (seen === 0) console.log(pc.bold(`\n=== ${j.jobName} › ${s.stepName} ===`));
+				for (const line of logs.lines.slice(seen)) console.log(line);
+				printed[key] = logs.lines.length;
+			}
+		}
+		if (TERMINAL_RUN_STATES.has(run.status)) {
+			console.log(pc.gray(`\nrun ${colorStatus(run.status)}`));
+			return true;
+		}
+		await sleep(POLL_INTERVAL_MS);
+	}
+}
+//#endregion
+export { runsLogsCommand };
+
+//# sourceMappingURL=logs.js.map

package/dist/commands/runs/rerun.d.ts

@@ -0,0 +1,5 @@
+export interface RunsRerunOptions {
+    json?: boolean;
+}
+export declare function runsRerunCommand(runId: string, options?: RunsRerunOptions): Promise<boolean>;
+//# sourceMappingURL=rerun.d.ts.map

package/dist/commands/runs/rerun.js

@@ -0,0 +1,21 @@
+import "../../chunk-BTugEXQM.js";
+import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/runs/rerun.ts
+/** kici runs rerun — re-trigger a run (mirrors the dashboard rerun button). */
+async function runsRerunCommand(runId, options = {}) {
+	try {
+		const out = await (await DashboardClient.load()).rerunRun(runId);
+		if (options.json) console.log(JSON.stringify(out, null, 2));
+		else console.log(pc.green(`Rerun queued: ${pc.bold(out.newRunId)}`));
+		return true;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+//#endregion
+export { runsRerunCommand };
+
+//# sourceMappingURL=rerun.js.map

package/dist/commands/runs/show.d.ts

@@ -0,0 +1,5 @@
+export interface RunsShowOptions {
+    json?: boolean;
+}
+export declare function runsShowCommand(runId: string, options?: RunsShowOptions): Promise<boolean>;
+//# sourceMappingURL=show.d.ts.map

package/dist/commands/runs/show.js

@@ -0,0 +1,65 @@
+import "../../chunk-BTugEXQM.js";
+import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
+import { RunHistory } from "../../remote/history.js";
+import { colorStatus, formatDuration as formatDuration$1, relativeTime } from "../../remote/render.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/runs/show.ts
+/** kici runs show — run summary + jobs/steps tree (replaces `kici status`). */
+async function runsShowCommand(runId, options = {}) {
+	try {
+		const client = await DashboardClient.load();
+		let run;
+		try {
+			run = await client.getRun(runId);
+		} catch (err) {
+			if (err instanceof DashboardClientError && err.kind === "not_found") return await showLocalFallback(runId, options.json ?? false);
+			throw err;
+		}
+		const detail = await client.getRunDetail(runId);
+		if (options.json) {
+			console.log(JSON.stringify({
+				run,
+				detail
+			}, null, 2));
+			return true;
+		}
+		printHeader(run);
+		printJobs(detail.jobs);
+		return true;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+function printHeader(run) {
+	const f = (v) => v == null ? "—" : v;
+	console.log(pc.bold(`\nRun ${run.runId}`) + `  ${colorStatus(run.status)}`);
+	console.log(pc.gray(`  workflow=${f(run.workflowName)} repo=${f(run.repoIdentifier)} branch=${f(run.ref)} sha=${f(run.sha)} trigger=${f(run.triggerEvent)} by=${f(run.triggeredBy)}`));
+	console.log(pc.gray(`  started=${relativeTime(run.startedAt ?? void 0)}`));
+}
+function printJobs(jobs) {
+	for (const j of jobs) {
+		console.log(`\n  ${pc.bold(j.jobName)} ${colorStatus(j.status)} ` + pc.gray(j.durationMs ? formatDuration$1(j.durationMs) : ""));
+		for (const s of j.steps ?? []) console.log(pc.gray("    └─ ") + `${s.stepName} ${colorStatus(s.status)} ` + pc.gray(`${s.durationMs ? formatDuration$1(s.durationMs) : ""}${s.exitCode != null ? ` exit=${s.exitCode}` : ""}`));
+	}
+}
+async function showLocalFallback(runId, json) {
+	const history = new RunHistory();
+	await history.load();
+	const entry = history.getEntry(runId);
+	if (!entry) {
+		logger.error(pc.red(`Run not found: ${runId} (no remote run and no local history).`));
+		return false;
+	}
+	if (json) console.log(JSON.stringify(entry, null, 2));
+	else {
+		logger.info(pc.yellow("Run not found on the Platform. Showing local history:\n"));
+		console.log(JSON.stringify(entry, null, 2));
+	}
+	return true;
+}
+//#endregion
+export { runsShowCommand };
+
+//# sourceMappingURL=show.js.map

package/dist/commands/secrets-list.d.ts

@@ -1,16 +1,14 @@
 export interface SecretsListOptions {
-    /** Orchestrator endpoint override (defaults to global config). */
+    /** Reserved for future use; the command targets the Platform via the active org. */
     endpoint?: string;
 }
 /**
- * List test-available secret contexts from the orchestrator.
+ * List test-available secret contexts through the Platform.
  *
- * Loads the global config for auth token and active org, calls
- * GET /api/v1/admin/environments?orgId=<org>&includeSecrets=true,
- * filters to envs with allow_local_execution=true, and displays a
- * table of names, key names, and flags.
- *
- * Values are never exposed -- only key names.
+ * Calls GET /api/v1/orgs/:orgId/environments?includeSecrets=true (relayed to
+ * the org's orchestrator), filters to environments with
+ * allowLocalExecution=true, and displays a table of names, key names, and
+ * flags. Values are never exposed -- only key names.
  */
-export declare function secretsListCommand(options: SecretsListOptions): Promise<boolean>;
+export declare function secretsListCommand(_options?: SecretsListOptions): Promise<boolean>;
 //# sourceMappingURL=secrets-list.d.ts.map

package/dist/commands/secrets-list.js

@@ -1,84 +1,60 @@
-import "../chunk-gOLHoazu.js";
-import { loadGlobalConfig } from "../remote/config.js";
+import "../chunk-BTugEXQM.js";
+import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/commands/secrets-list.ts
 /**
-* List test-available secret contexts from the orchestrator.
+* List test-available secret contexts through the Platform.
 *
-* Loads the global config for auth token and active org, calls
-* GET /api/v1/admin/environments?orgId=<org>&includeSecrets=true,
-* filters to envs with allow_local_execution=true, and displays a
-* table of names, key names, and flags.
-*
-* Values are never exposed -- only key names.
+* Calls GET /api/v1/orgs/:orgId/environments?includeSecrets=true (relayed to
+* the org's orchestrator), filters to environments with
+* allowLocalExecution=true, and displays a table of names, key names, and
+* flags. Values are never exposed -- only key names.
 */
-async function secretsListCommand(options) {
+async function secretsListCommand(_options = {}) {
 	try {
-		const config = await loadGlobalConfig();
-		if (!config.token) {
-			console.error(pc.red("Not authenticated. Run `kici login` first."));
-			return false;
-		}
-		const endpoint = options.endpoint ?? config.endpoint;
-		if (!endpoint) {
-			console.error(pc.red("No orchestrator endpoint configured. Run `kici login --endpoint <url>` first."));
-			return false;
-		}
-		if (!config.activeOrgId) {
-			console.error(pc.red("No active organization. Run `kici org list` then `kici org use <name>` first."));
-			return false;
-		}
-		const url = `${endpoint.replace(/\/+$/, "")}/api/v1/admin/environments?orgId=${encodeURIComponent(config.activeOrgId)}&includeSecrets=true`;
-		const res = await fetch(url, { headers: { Authorization: `Bearer ${config.token}` } });
-		if (res.status === 401) {
-			console.error(pc.red("Authentication failed. Check your API key with `kici login`."));
-			return false;
-		}
-		if (res.status === 403) {
-			console.error(pc.red("Permission denied. Your API key does not have secret.read access."));
-			return false;
-		}
-		if (!res.ok) {
-			const text = await res.text();
-			console.error(pc.red(`Failed to fetch contexts: ${res.status} ${text}`));
-			return false;
-		}
-		const contexts = ((await res.json()).environments ?? []).filter((e) => e.allow_local_execution);
+		const contexts = (await (await DashboardClient.load()).listEnvironments(true)).filter((e) => e.allowLocalExecution);
 		if (contexts.length === 0) {
 			console.log(pc.yellow("No test-available secret contexts found."));
 			console.log(pc.gray("Enable test runs (allowLocalExecution) on an environment to make its secrets available for test runs."));
 			return true;
 		}
-		console.log(pc.bold("\nTest-available secret contexts:\n"));
-		const ctxKeys = (c) => c.secret_keys ?? [];
-		const nameWidth = Math.max(7, ...contexts.map((c) => c.name.length));
-		const keysWidth = Math.max(4, ...contexts.map((c) => {
-			const k = ctxKeys(c);
-			return k.length > 0 ? k.join(", ").length : 4;
-		}));
-		const flagsWidth = Math.max(5, ...contexts.map((c) => c.enabled ? 0 : 8));
-		const pad = (s, w) => s.padEnd(w);
-		const hr = (w) => "─".repeat(w);
-		console.log(`\u250c${hr(nameWidth + 2)}\u252c${hr(keysWidth + 2)}\u252c${hr(flagsWidth + 2)}\u2510`);
-		console.log(`\u2502 ${pad("Context", nameWidth)} \u2502 ${pad("Keys", keysWidth)} \u2502 ${pad("Flags", flagsWidth)} \u2502`);
-		console.log(`\u251c${hr(nameWidth + 2)}\u253c${hr(keysWidth + 2)}\u253c${hr(flagsWidth + 2)}\u2524`);
-		for (const ctx of contexts) {
-			const k = ctxKeys(ctx);
-			const keys = k.length > 0 ? k.join(", ") : pc.gray("none");
-			const keysRaw = k.length > 0 ? k.join(", ") : "none";
-			const flagStr = ctx.enabled ? "" : "disabled";
-			console.log(`\u2502 ${pad(ctx.name, nameWidth)} \u2502 ${keys}${" ".repeat(Math.max(0, keysWidth - keysRaw.length))} \u2502 ${pad(flagStr, flagsWidth)} \u2502`);
-		}
-		console.log(`\u2514${hr(nameWidth + 2)}\u2534${hr(keysWidth + 2)}\u2534${hr(flagsWidth + 2)}\u2518`);
-		console.log("");
+		renderContextTable(contexts);
 		return true;
 	} catch (err) {
-		const message = toErrorMessage(err);
-		console.error(pc.red(`Failed to list secrets: ${message}`));
+		if (err instanceof DashboardClientError) {
+			console.error(pc.red(err.message));
+			return false;
+		}
+		console.error(pc.red(`Failed to list secrets: ${toErrorMessage(err)}`));
 		return false;
 	}
 }
+/** Render the secret-context table to stdout. */
+function renderContextTable(contexts) {
+	console.log(pc.bold("\nTest-available secret contexts:\n"));
+	const ctxKeys = (c) => c.secretKeys ?? [];
+	const nameWidth = Math.max(7, ...contexts.map((c) => c.name.length));
+	const keysWidth = Math.max(4, ...contexts.map((c) => {
+		const k = ctxKeys(c);
+		return k.length > 0 ? k.join(", ").length : 4;
+	}));
+	const flagsWidth = Math.max(5, ...contexts.map((c) => c.enabled ? 0 : 8));
+	const pad = (s, w) => s.padEnd(w);
+	const hr = (w) => "─".repeat(w);
+	console.log(`┌${hr(nameWidth + 2)}┬${hr(keysWidth + 2)}┬${hr(flagsWidth + 2)}┐`);
+	console.log(`│ ${pad("Context", nameWidth)} │ ${pad("Keys", keysWidth)} │ ${pad("Flags", flagsWidth)} │`);
+	console.log(`├${hr(nameWidth + 2)}┼${hr(keysWidth + 2)}┼${hr(flagsWidth + 2)}┤`);
+	for (const ctx of contexts) {
+		const k = ctxKeys(ctx);
+		const keys = k.length > 0 ? k.join(", ") : pc.gray("none");
+		const keysRaw = k.length > 0 ? k.join(", ") : "none";
+		const flagStr = ctx.enabled ? "" : "disabled";
+		console.log(`│ ${pad(ctx.name, nameWidth)} │ ${keys}${" ".repeat(Math.max(0, keysWidth - keysRaw.length))} │ ${pad(flagStr, flagsWidth)} │`);
+	}
+	console.log(`└${hr(nameWidth + 2)}┴${hr(keysWidth + 2)}┴${hr(flagsWidth + 2)}┘`);
+	console.log("");
+}
 //#endregion
 export { secretsListCommand };
 

package/dist/commands/test.d.ts

@@ -34,6 +34,10 @@ export interface RemoteRunOptions extends TestOptions {
     history?: boolean;
     /** --env KEY=VALUE flag values, uploaded as per-run secrets. */
     envFlags?: string[];
+    /** Target organization id (overrides config.activeOrgId). */
+    org?: string;
+    /** Target orchestrator cluster name (overrides the per-org default). */
+    orchestrator?: string;
 }
 /** Result of a single remote fixture run */
 export interface RemoteRunResult {

package/dist/commands/test.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";

package/dist/commands/types.d.ts

@@ -1,18 +1,16 @@
 export interface TypesOptions {
     /** Path to .kici directory (defaults to .kici) */
     kiciDir?: string;
-    /** Orchestrator endpoint override (defaults to global config) */
-    endpoint?: string;
 }
 /**
  * Generate TypeScript declarations for environment secrets.
  *
- * Fetches environment metadata from the orchestrator and generates
- * .kici/types/secrets.d.ts with module augmentation for
+ * Fetches environment metadata (with secret key names) through the Platform
+ * and generates .kici/types/secrets.d.ts with module augmentation for
  * KnownSecretKeys and EnvironmentSecrets.
  *
  * @param options - Command options
  * @returns true on success, false on error
  */
-export declare function typesCommand(options: TypesOptions): Promise<boolean>;
+export declare function typesCommand(options?: TypesOptions): Promise<boolean>;
 //# sourceMappingURL=types.d.ts.map

package/dist/commands/types.js

@@ -1,5 +1,6 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { loadGlobalConfig } from "../remote/config.js";
+import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import { generateSecretsDts } from "../generators/secrets-dts.js";
 import path from "node:path";
 import pc from "picocolors";
@@ -9,50 +10,22 @@ import { toErrorMessage } from "@kici-dev/core";
 /**
 * Generate TypeScript declarations for environment secrets.
 *
-* Fetches environment metadata from the orchestrator and generates
-* .kici/types/secrets.d.ts with module augmentation for
+* Fetches environment metadata (with secret key names) through the Platform
+* and generates .kici/types/secrets.d.ts with module augmentation for
 * KnownSecretKeys and EnvironmentSecrets.
 *
 * @param options - Command options
 * @returns true on success, false on error
 */
-async function typesCommand(options) {
+async function typesCommand(options = {}) {
 	try {
 		const config = await loadGlobalConfig();
-		if (!config.token) {
-			console.error(pc.red("Not authenticated. Run `kici login` first to connect to your orchestrator."));
-			return false;
-		}
-		const endpoint = options.endpoint ?? config.endpoint;
-		if (!endpoint) {
-			console.error(pc.red("No orchestrator endpoint configured. Run `kici login --endpoint <url>` first."));
-			return false;
-		}
-		if (!config.activeOrgId) {
-			console.error(pc.red("No active organization. Run `kici org list` then `kici org use <name>` first."));
-			return false;
-		}
-		const url = `${endpoint.replace(/\/+$/, "")}/api/v1/admin/environments?orgId=${encodeURIComponent(config.activeOrgId)}&includeSecrets=true`;
-		const res = await fetch(url, { headers: { Authorization: `Bearer ${config.token}` } });
-		if (res.status === 401) {
-			console.error(pc.red("Authentication failed. Check your API key with `kici login`."));
-			return false;
-		}
-		if (res.status === 403) {
-			console.error(pc.red("Permission denied. Your API key does not have environments.read access."));
-			return false;
-		}
-		if (!res.ok) {
-			const text = await res.text();
-			console.error(pc.red(`Failed to fetch environments: ${res.status} ${text}`));
-			return false;
-		}
 		const dtsContent = generateSecretsDts({
-			environments: ((await res.json()).environments ?? []).map((e) => ({
+			environments: (await DashboardClient.fromConfig(config).listEnvironments(true)).map((e) => ({
 				name: e.name,
-				keys: e.secret_keys ?? []
+				keys: e.secretKeys ?? []
 			})),
-			endpoint: endpoint.replace(/\/+$/, ""),
+			endpoint: (config.platformEndpoint ?? config.endpoint ?? "kici Platform").replace(/\/+$/, ""),
 			generatedAt: /* @__PURE__ */ new Date()
 		});
 		const kiciDir = options.kiciDir ?? ".kici";
@@ -63,8 +36,11 @@ async function typesCommand(options) {
 		console.log(pc.green("Types generated") + pc.dim(` ${outputPath}`));
 		return true;
 	} catch (err) {
-		const message = toErrorMessage(err);
-		console.error(pc.red(`Failed to generate types: ${message}`));
+		if (err instanceof DashboardClientError) {
+			console.error(pc.red(err.message));
+			return false;
+		}
+		console.error(pc.red(`Failed to generate types: ${toErrorMessage(err)}`));
 		return false;
 	}
 }

package/dist/commands/verify-attestation.d.ts

@@ -0,0 +1,12 @@
+export interface VerifyAttestationOptions {
+    /** Path or `http(s)` URL to the attestation bundle JSON. Required. */
+    bundle?: string;
+    /** Trusted issuer URL (online discovery) or a self-contained `{ issuer, jwks }` file. Required. */
+    trustRoot?: string;
+    /** Expected token audience (defaults to the KiCI provenance audience). */
+    audience?: string;
+    /** Emit the structured `VerifyResult` as JSON instead of human output. */
+    json?: boolean;
+}
+export declare function verifyAttestationCommand(artifact: string | undefined, options?: VerifyAttestationOptions): Promise<boolean>;
+//# sourceMappingURL=verify-attestation.d.ts.map

package/dist/commands/verify-attestation.js

@@ -0,0 +1,69 @@
+import "../chunk-BTugEXQM.js";
+import { resolveTrustRoot } from "../provenance-trust-root.js";
+import pc from "picocolors";
+import { readFile } from "node:fs/promises";
+import { logger, sha256File, toErrorMessage } from "@kici-dev/core";
+import { KICI_PROVENANCE_AUDIENCE } from "@kici-dev/engine/provenance/bundle";
+import { verifyKiciBundle } from "@kici-dev/engine/provenance/verify";
+//#region src/commands/verify-attestation.ts
+/**
+* `kici verify-attestation [artifact] --bundle <path|url> --trust-root <url|file>`
+*
+* Offline verification of a KiCI-signed provenance bundle: read the bundle,
+* resolve the trusted issuer + JWKS out-of-band (`--trust-root`), optionally
+* digest the artifact, and hand everything to the shared browser-safe
+* `verifyKiciBundle` core in `@kici-dev/engine`. The engine owns all crypto;
+* this command is the thin Node wrapper (fs / fetch / artifact digest / output).
+*
+* Returns a boolean (verified) so `cli.ts` can map it to an exit code (0/1).
+*/
+async function verifyAttestationCommand(artifact, options = {}) {
+	try {
+		if (!options.bundle) {
+			logger.error(pc.red("Error: --bundle <path|url> is required"));
+			return false;
+		}
+		if (!options.trustRoot) {
+			logger.error(pc.red("Error: --trust-root <url|file> is required"));
+			return false;
+		}
+		const bundle = JSON.parse(await readBundle(options.bundle));
+		const { issuer, jwks } = await resolveTrustRoot(options.trustRoot);
+		const expectedDigest = artifact ? {
+			alg: "sha256",
+			hex: await sha256File(artifact)
+		} : void 0;
+		const result = await verifyKiciBundle({
+			bundle,
+			jwks,
+			expectedIssuer: issuer,
+			expectedAudience: options.audience ?? KICI_PROVENANCE_AUDIENCE,
+			expectedDigest
+		});
+		if (options.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return result.verified;
+		}
+		if (result.verified) {
+			logger.info(`${pc.green("PASS")} provenance verified (issuer ${issuer})`);
+			const c = result.claims ?? {};
+			logger.info(pc.gray(`  repository=${c.repository} ref=${c.ref} sha=${c.sha} run=${c.kici_run_id} job=${c.kici_job_id}`));
+		} else logger.error(`${pc.red("FAIL")} provenance NOT verified: ${result.failures.join(", ")}`);
+		return result.verified;
+	} catch (error) {
+		logger.error(pc.red(`Error: ${toErrorMessage(error)}`));
+		return false;
+	}
+}
+async function readBundle(bundlePathOrUrl) {
+	if (/^https?:\/\//.test(bundlePathOrUrl)) {
+		const res = await fetch(bundlePathOrUrl);
+		if (!res.ok) throw new Error(`failed to fetch bundle: ${res.status}`);
+		return res.text();
+	}
+	return readFile(bundlePathOrUrl, "utf-8");
+}
+//#endregion
+export { verifyAttestationCommand };
+
+//# sourceMappingURL=verify-attestation.js.map

package/dist/commands/watch.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { compileCommand } from "./compile.js";