@kici-dev/compiler 0.1.16 → 0.1.17

package/dist/llm-context/llms.txt

@@ -34,7 +34,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 ## CLI and authoring
 
 - [CLI authentication](https://docs.kici.dev/user/cli-auth/): Authenticate the KiCI CLI with browser OAuth, device flow, or API key paste
-- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), test, login, logout, org, status, cancel, secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
+- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), orchestrators, test, login, logout, org, diagnostics, runs (list/show/logs/rerun/cancel), secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
 - [Lifecycle hooks](https://docs.kici.dev/user/hooks/): SDK hook API for cancel, cleanup, success, failure, and step-level callbacks
 - [Lock file and workflow drift](https://docs.kici.dev/user/lock-file-and-drift/): Keep the lock file in sync with your workflow source and avoid drift
 - [Testing guide](https://docs.kici.dev/user/testing-guide/): Running remote test fixtures with kici run remote
@@ -43,6 +43,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 ## Workflow features
 
 - [Account and sign-in](https://docs.kici.dev/user/account-and-login/): How your KiCI account relates to sign-in methods, and how to change the way you sign in.
+- [Approval gates](https://docs.kici.dev/user/approvals/): Pause a workflow for human sign-off at step, job, or workflow granularity with requireApproval
 - [Concurrency groups](https://docs.kici.dev/user/concurrency/): Control parallel execution with auto-cancel and queue modes
 - [Dashboard](https://docs.kici.dev/user/dashboard/)
 - [Dynamic values](https://docs.kici.dev/user/dynamic-values/)
@@ -51,11 +52,13 @@ The full markdown bundle of every page indexed here is available at https://docs
 - [Event system](https://docs.kici.dev/user/events/): How KiCI's event model works -- event types, the registration model, event matching, and circuit breaker protection
 - [Global workflows](https://docs.kici.dev/user/global-workflows/): Cross-repo workflows that run on events from any repo in the same org
 - [Private npm registries](https://docs.kici.dev/user/private-registries/): Authenticate `npm install` against private registries (CodeArtifact, GitHub Packages, Verdaccio, …) from a workflow's `.kici/package.json`
+- [Build provenance and attestations](https://docs.kici.dev/user/provenance/): Generate and verify signed SLSA provenance for the artifacts your workflows build
 - [Secrets](https://docs.kici.dev/user/secrets/): How to access secrets in KiCI workflow steps
 
 ## Providers
 
 - [GitHub App provider](https://docs.kici.dev/user/providers/github/): Connect KiCI to GitHub via a GitHub App — full Checks API, installation-token clones, and cross-org dispatch
+- [Local filesystem (file://) source](https://docs.kici.dev/user/providers/local-file/): Register a git repo present on the agent filesystem as a file:// source, triggered by the kici-admin CLI or a push hook
 - [Universal-git provider](https://docs.kici.dev/user/providers/universal-git/): Connect Forgejo, Gitea, Gogs, GitLab, or plain GitHub via webhook + PAT or SSH deploy key
 
 ## Architecture overview

package/dist/local-executor/dag-scheduler.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/local-executor/dag-scheduler.ts
 /**
 * Detect cycles using Kahn's algorithm.

package/dist/local-executor/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";

package/dist/local-executor/job-runner.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { ensureTsLoaderHook } from "../execution/ts-loader.js";
 import { formatter } from "../test-runner/output-formatter.js";
 import { createStepContext } from "../test-runner/step-context.js";
@@ -7,6 +7,7 @@ import { toEventPayload } from "./to-event-payload.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
 import { applyIncludeExclude, expandMatrix, isDynamicJobFn, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { formatMatrixSuffix } from "@kici-dev/engine";
 //#region src/local-executor/job-runner.ts
 /**
 * Job resolution (matrix/dynamic) and single-job execution with step context.
@@ -39,15 +40,6 @@ async function resolveSdkSetters(kiciDir) {
 	};
 }
 /**
-* Format matrix values into a display string for the job name.
-* Single-dimension: "node-18"
-* Multi-dimensional: "linux, 18"
-*/
-function formatMatrixSuffix(matrixValues) {
-	if ("value" in matrixValues && matrixValues.value !== void 0) return matrixValues.value;
-	return Object.values(matrixValues).filter((v) => v !== void 0).join(", ");
-}
-/**
 * Resolve a needs entry to a string name.
 * Handles Job objects, strings, DynamicGroupRef, and object forms.
 */
@@ -58,6 +50,27 @@ function resolveNeedName(need) {
 	return need.name;
 }
 /**
+* Maintain the base-name `{ byMatrix, merged }` envelope as each matrix child
+* completes. `merged` is rebuilt last-write-wins in suffix order so the result
+* is deterministic regardless of child completion order — matching the remote
+* path's name-ordered merge.
+*/
+function updateBaseMatrixEnvelope(jobOutputsMap, baseName, matrixValues, childOutputs) {
+	const existing = jobOutputsMap.get(baseName);
+	const byMatrix = existing && "byMatrix" in existing ? { ...existing.byMatrix } : {};
+	const suffix = formatMatrixSuffix(matrixValues);
+	byMatrix[suffix] = childOutputs;
+	let merged = {};
+	for (const key of Object.keys(byMatrix).sort()) merged = {
+		...merged,
+		...byMatrix[key]
+	};
+	jobOutputsMap.set(baseName, {
+		byMatrix,
+		merged
+	});
+}
+/**
 * Resolve all jobs in a workflow, expanding matrix jobs and evaluating dynamic jobs.
 *
 * - Static jobs: create ResolvedJob with name, needs, job reference
@@ -82,10 +95,13 @@ async function resolveJobs(workflow, event) {
 				debug: () => {}
 			},
 			env: { ...process.env },
-			kici: { infrastructure: { list: () => Promise.resolve({
-				scalers: [],
-				agents: []
-			}) } }
+			kici: {
+				infrastructure: { list: () => Promise.resolve({
+					scalers: [],
+					agents: []
+				}) },
+				oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available during local execution")) }
+			}
 		});
 		for (const genJob of generatedJobs) {
 			const genResolved = await resolveStaticJob(genJob, expansionMap);
@@ -285,11 +301,16 @@ async function executeResolvedJobInner(resolvedJob, context, startTime) {
 		}
 	}
 	const stepsWithOutputs = stepResults.filter((s) => s.outputs != null);
-	if (stepsWithOutputs.length === 1 && stepResults.length === 1) context.jobOutputsMap.set(expandedName, stepsWithOutputs[0].outputs);
+	let jobOutputs;
+	if (stepsWithOutputs.length === 1 && stepResults.length === 1) jobOutputs = stepsWithOutputs[0].outputs;
 	else if (stepsWithOutputs.length > 0) {
 		const aggregated = {};
 		for (const stepResult of stepsWithOutputs) aggregated[stepResult.name] = stepResult.outputs;
-		context.jobOutputsMap.set(expandedName, aggregated);
+		jobOutputs = aggregated;
+	}
+	if (jobOutputs) {
+		context.jobOutputsMap.set(expandedName, jobOutputs);
+		if (expandedName !== job.name) updateBaseMatrixEnvelope(context.jobOutputsMap, job.name, matrixValues, jobOutputs);
 	}
 	const durationMs = Date.now() - startTime;
 	formatter.logJobComplete(expandedName, durationMs);

package/dist/local-executor/materializer.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { selectOverlayFiles } from "../remote/uploader.js";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/local-executor/output-streamer.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/local-executor/output-streamer.ts

package/dist/local-executor/payload-generator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { buildEventPayload } from "../test-runner/payload-builder.js";
 import { execSync } from "node:child_process";

package/dist/local-executor/picker.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { transformTriggers } from "../lockfile/generator.js";
 import { parseEventArg, triggerSummary, triggerToEventArg } from "../test-runner/event-types.js";
 import pc from "picocolors";

package/dist/local-executor/secret-loader.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { loadSecretsFile } from "../test-runner/secrets-file.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/local-executor/to-event-payload.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/local-executor/to-event-payload.ts
 /**
 * Map a {@link SimulatedEvent} into the normalized SDK {@link EventPayload}

package/dist/local-executor/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/lockfile/generator.d.ts

@@ -13,11 +13,13 @@ export declare function detectGitRoot(): string;
  *
  * The authoritative lockfile differs by manager: `.kici/package-lock.json` for
  * npm, the repo-root `pnpm-lock.yaml` for a pnpm workspace, the repo-root
- * `yarn.lock` for yarn. A pnpm/yarn `.kici/` member resolves against the root
- * lockfile, so keying on `.kici/package-lock.json` alone would miss the
- * authoritative graph. The hash input is prefixed with the manager name so two
- * managers can never collide on identical lockfile bytes (and a restored tree
- * can never be the wrong layout for the agent's manager).
+ * `yarn.lock` for a yarn workspace. A pnpm/yarn `.kici/` member resolves against
+ * the root lockfile, so keying on `.kici/package-lock.json` alone would miss the
+ * authoritative graph. A standalone `.kici` yarn project (its own
+ * `packageManager` field + `.kici/yarn.lock`, no root signal) is detected from
+ * `.kici/` and keyed on `.kici/yarn.lock`. The hash input is prefixed with the
+ * manager name so two managers can never collide on identical lockfile bytes
+ * (and a restored tree can never be the wrong layout for the agent's manager).
  *
  * @param gitRoot - Absolute path to git repository root
  * @returns Hex SHA-256 hash string, or null if no lockfile is found

package/dist/lockfile/generator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "../types.js";
 import { computeContentHash } from "./hasher.js";
 import { resolveHashFiles } from "./hash-files.js";
@@ -37,23 +37,24 @@ function detectGitRoot() {
 *
 * The authoritative lockfile differs by manager: `.kici/package-lock.json` for
 * npm, the repo-root `pnpm-lock.yaml` for a pnpm workspace, the repo-root
-* `yarn.lock` for yarn. A pnpm/yarn `.kici/` member resolves against the root
-* lockfile, so keying on `.kici/package-lock.json` alone would miss the
-* authoritative graph. The hash input is prefixed with the manager name so two
-* managers can never collide on identical lockfile bytes (and a restored tree
-* can never be the wrong layout for the agent's manager).
+* `yarn.lock` for a yarn workspace. A pnpm/yarn `.kici/` member resolves against
+* the root lockfile, so keying on `.kici/package-lock.json` alone would miss the
+* authoritative graph. A standalone `.kici` yarn project (its own
+* `packageManager` field + `.kici/yarn.lock`, no root signal) is detected from
+* `.kici/` and keyed on `.kici/yarn.lock`. The hash input is prefixed with the
+* manager name so two managers can never collide on identical lockfile bytes
+* (and a restored tree can never be the wrong layout for the agent's manager).
 *
 * @param gitRoot - Absolute path to git repository root
 * @returns Hex SHA-256 hash string, or null if no lockfile is found
 */
 function computeLockfileHash(gitRoot) {
-	const pm = detectPackageManagerSync(gitRoot);
-	const lockfilePath = pm === PackageManager.Pnpm ? path.join(gitRoot, "pnpm-lock.yaml") : pm === PackageManager.Yarn ? path.join(gitRoot, "yarn.lock") : path.join(gitRoot, ".kici", "package-lock.json");
-	try {
+	const pm = detectPackageManagerSync(gitRoot) === PackageManager.Npm ? detectPackageManagerSync(path.join(gitRoot, ".kici")) : detectPackageManagerSync(gitRoot);
+	const candidates = pm === PackageManager.Pnpm ? [path.join(gitRoot, "pnpm-lock.yaml")] : pm === PackageManager.Yarn ? [path.join(gitRoot, "yarn.lock"), path.join(gitRoot, ".kici", "yarn.lock")] : [path.join(gitRoot, ".kici", "package-lock.json")];
+	for (const lockfilePath of candidates) try {
 		return sha256(`${pm}\n${readFileSync(lockfilePath, "utf-8")}`);
-	} catch {
-		return null;
-	}
+	} catch {}
+	return null;
 }
 /**
 * Format export reference with hash syntax.
@@ -455,15 +456,17 @@ function normalizeRunsOnForLock(runsOn) {
 	};
 }
 /**
-* Validate runsOn labels:
-* 1. Reject kici:* reserved prefix in user-supplied labels.
-* 2. Reject overlap between required and excluded labels.
+* Validate runsOn labels: reject overlap between required and excluded labels.
+*
+* `kici:` labels ARE valid runsOn selectors. runsOn expresses a requirement on
+* candidate agents — it only narrows the set, it never grants authority — so
+* targeting a `kici:os:linux` / `kici:role:builder` label is benign. The forgery
+* boundary is label *setting* (scaler labelSet validation + the agent
+* register-time scope gate), which is enforced elsewhere and unaffected here.
 */
 function validateRunsOn(runsOn, jobName) {
-	const labels = typeof runsOn === "string" ? [runsOn] : Array.isArray(runsOn) ? runsOn : Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels];
-	const reservedLabels = labels.filter((l) => l.toLowerCase().startsWith("kici:"));
-	if (reservedLabels.length > 0) throw new Error(`Job "${jobName}": labels with 'kici:' prefix are reserved and cannot be used in runsOn: ${reservedLabels.join(", ")}`);
 	if (typeof runsOn === "string" || Array.isArray(runsOn)) return;
+	const labels = Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels];
 	const exclude = runsOn.exclude ? Array.isArray(runsOn.exclude) ? runsOn.exclude : [runsOn.exclude] : [];
 	const overlap = labels.filter((l) => exclude.includes(l));
 	if (overlap.length > 0) throw new Error(`Job "${jobName}": labels and exclude overlap on [${overlap.join(", ")}]. A label cannot be both required and excluded.`);

package/dist/lockfile/hash-files.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
 import fg from "fast-glob";

package/dist/lockfile/hasher.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { normalizeLineEndings, sha256 } from "@kici-dev/core";
 //#region src/lockfile/hasher.ts
 /**

package/dist/lockfile/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { COMPILE_SCHEMA_VERSION, computeContentHash } from "./hasher.js";
 import { computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile } from "./generator.js";
 export { COMPILE_SCHEMA_VERSION, computeContentHash, computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile };

package/dist/lockfile/purity-analyzer.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import ts from "typescript";
 //#region src/lockfile/purity-analyzer.ts
 /**

package/dist/postinstall.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";

package/dist/provenance-trust-root.d.ts

@@ -0,0 +1,14 @@
+/** Structural JWKS shape — the engine verifier owns the real `jose` type. */
+export interface JsonWebKeySet {
+    keys: Record<string, unknown>[];
+}
+export interface TrustRoot {
+    issuer: string;
+    jwks: JsonWebKeySet;
+}
+/**
+ * Resolve `--trust-root`: an HTTPS issuer URL (discovery → `jwks_uri` → JWKS) or
+ * a self-contained offline file `{ issuer, jwks }`.
+ */
+export declare function resolveTrustRoot(trustRoot: string): Promise<TrustRoot>;
+//# sourceMappingURL=provenance-trust-root.d.ts.map

package/dist/provenance-trust-root.js

@@ -0,0 +1,49 @@
+import "./chunk-BTugEXQM.js";
+import { readFile } from "node:fs/promises";
+//#region src/provenance-trust-root.ts
+/**
+* Trust-root resolution for `kici verify-attestation`.
+*
+* The verifier never blindly trusts a provenance token's own `iss`: the trusted
+* issuer + its JWKS are supplied out-of-band via `--trust-root`. This resolver
+* turns that flag into a concrete `{ issuer, jwks }`:
+*
+*  - an **HTTPS issuer URL** (online): fetch `<url>/.well-known/openid-configuration`,
+*    read its `issuer` + `jwks_uri`, then fetch the JWKS;
+*  - a **local file path** (offline / air-gapped): a self-contained
+*    `{ "issuer": "...", "jwks": { "keys": [...] } }` JSON document, no network.
+*
+* Node-specific (`fetch` + `fs`) so the engine verify core stays pure /
+* browser-safe; the JWKS is passed straight through to the engine, which owns
+* the crypto, so this module defines only a structural `JsonWebKeySet` type
+* rather than depending on `jose`.
+*/
+/**
+* Resolve `--trust-root`: an HTTPS issuer URL (discovery → `jwks_uri` → JWKS) or
+* a self-contained offline file `{ issuer, jwks }`.
+*/
+async function resolveTrustRoot(trustRoot) {
+	if (/^https?:\/\//.test(trustRoot)) {
+		const base = trustRoot.replace(/\/+$/, "");
+		const disco = await fetchJson(`${base}/.well-known/openid-configuration`);
+		return {
+			issuer: typeof disco.issuer === "string" ? disco.issuer : base,
+			jwks: await fetchJson(typeof disco.jwks_uri === "string" ? disco.jwks_uri : `${base}/.well-known/jwks.json`)
+		};
+	}
+	const file = JSON.parse(await readFile(trustRoot, "utf-8"));
+	if (typeof file.issuer !== "string" || !file.jwks || !Array.isArray(file.jwks.keys)) throw new Error("trust-root file must contain { issuer, jwks: { keys: [...] } }");
+	return {
+		issuer: file.issuer,
+		jwks: file.jwks
+	};
+}
+async function fetchJson(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`failed to fetch ${url}: ${res.status}`);
+	return await res.json();
+}
+//#endregion
+export { resolveTrustRoot };
+
+//# sourceMappingURL=provenance-trust-root.js.map

package/dist/remote/config.d.ts

@@ -9,8 +9,6 @@ export interface GlobalConfig {
     endpoint?: string;
     /** Platform relay URL */
     platformEndpoint?: string;
-    /** Connection mode: 'platform' or 'direct' */
-    connectionMode?: 'platform' | 'direct';
     /** Routing key for webhook source identification (e.g., 'github:42') */
     routingKey?: string;
     /** Personal access token (from OAuth login) */
@@ -23,6 +21,12 @@ export interface GlobalConfig {
     activeOrgId?: string;
     /** User email from OIDC token */
     userEmail?: string;
+    /**
+     * Per-org default orchestrator cluster for `kici run remote`, keyed by org id.
+     * Set by `kici orchestrators use <cluster>`; consulted when `--orchestrator`
+     * is omitted so a developer with one preferred cluster types no flag.
+     */
+    defaultClusters?: Record<string, string>;
 }
 /**
  * Returns the global KiCI config directory path.

package/dist/remote/config.js

@@ -1,9 +1,8 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import os from "node:os";
 //#region src/remote/config.ts
-const VALID_CONNECTION_MODES = ["platform", "direct"];
 /**
 * Strips unknown keys and validates known fields from a raw config object.
 * Returns a clean GlobalConfig with only recognized, valid fields.
@@ -15,13 +14,17 @@ function sanitizeConfig(raw) {
 	if (typeof obj.token === "string") config.token = obj.token;
 	if (typeof obj.endpoint === "string") config.endpoint = obj.endpoint;
 	if (typeof obj.platformEndpoint === "string") config.platformEndpoint = obj.platformEndpoint;
-	if (typeof obj.connectionMode === "string" && VALID_CONNECTION_MODES.includes(obj.connectionMode)) config.connectionMode = obj.connectionMode;
 	if (typeof obj.routingKey === "string") config.routingKey = obj.routingKey;
 	if (typeof obj.pat === "string") config.pat = obj.pat;
 	if (typeof obj.patId === "string") config.patId = obj.patId;
 	if (typeof obj.patExpiresAt === "string") config.patExpiresAt = obj.patExpiresAt;
 	if (typeof obj.activeOrgId === "string") config.activeOrgId = obj.activeOrgId;
 	if (typeof obj.userEmail === "string") config.userEmail = obj.userEmail;
+	if (typeof obj.defaultClusters === "object" && obj.defaultClusters !== null && !Array.isArray(obj.defaultClusters)) {
+		const clusters = {};
+		for (const [orgId, clusterName] of Object.entries(obj.defaultClusters)) if (typeof clusterName === "string") clusters[orgId] = clusterName;
+		if (Object.keys(clusters).length > 0) config.defaultClusters = clusters;
+	}
 	return config;
 }
 /**
@@ -76,13 +79,13 @@ async function mergeGlobalConfig(partial) {
 	if (partial.token !== void 0) merged.token = partial.token;
 	if (partial.endpoint !== void 0) merged.endpoint = partial.endpoint;
 	if (partial.platformEndpoint !== void 0) merged.platformEndpoint = partial.platformEndpoint;
-	if (partial.connectionMode !== void 0) merged.connectionMode = partial.connectionMode;
 	if (partial.routingKey !== void 0) merged.routingKey = partial.routingKey;
 	if (partial.pat !== void 0) merged.pat = partial.pat;
 	if (partial.patId !== void 0) merged.patId = partial.patId;
 	if (partial.patExpiresAt !== void 0) merged.patExpiresAt = partial.patExpiresAt;
 	if (partial.activeOrgId !== void 0) merged.activeOrgId = partial.activeOrgId;
 	if (partial.userEmail !== void 0) merged.userEmail = partial.userEmail;
+	if (partial.defaultClusters !== void 0) merged.defaultClusters = partial.defaultClusters;
 	await saveGlobalConfig(merged);
 	return merged;
 }

package/dist/remote/dashboard-client.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Typed client for the Platform org-scoped dashboard API (the endpoints the
+ * web UI uses). Authenticated with the stored PAT + active org. This is the
+ * only place in the CLI that knows these routes.
+ */
+import { z } from 'zod';
+import { type RunListResponse, type RunListItem, type DiagnosticsInfrastructureResponse, type DiagnosticsSummaryResponse, type DashboardRunDetailApiResponse, type DashboardStepLogsApiResponse, type RegistrationItem } from '@kici-dev/engine';
+import { type GlobalConfig } from './config.js';
+export type DashboardErrorKind = 'not_logged_in' | 'no_active_org' | 'unauthorized' | 'forbidden' | 'not_found' | 'conflict' | 'cooldown' | 'orchestrator_offline' | 'http';
+/** Typed error raised by every DashboardClient method on a non-2xx response. */
+export declare class DashboardClientError extends Error {
+    readonly kind: DashboardErrorKind;
+    readonly status?: number | undefined;
+    constructor(kind: DashboardErrorKind, message: string, status?: number | undefined);
+}
+/** Filters accepted by the runs-list endpoint. */
+export interface RunsListFilters {
+    status?: string;
+    workflow?: string;
+    branch?: string;
+    repo?: string;
+    trigger?: string;
+    source?: string;
+    since?: string;
+    page?: number;
+}
+/** Result of {@link DashboardClient.listRegistrations}. */
+export interface RegistrationsListResult {
+    registrations: RegistrationItem[];
+    registryVersion: number;
+    registryUpdatedAt: string;
+}
+/** Filters accepted by the registrations-list endpoint. */
+export interface RegistrationsListFilters {
+    triggerType?: string;
+    repoIdentifier?: string;
+}
+/**
+ * A secret context (environment) as surfaced to the developer CLI's
+ * `secrets list` / `types` commands. The orchestrator returns the per-env
+ * secret key names (never values) when `includeSecrets` is requested.
+ */
+declare const environmentContextSchema: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodBoolean;
+    allowLocalExecution: z.ZodBoolean;
+    secretKeys: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** A secret context (environment) returned by {@link DashboardClient.listEnvironments}. */
+export type EnvironmentContext = z.infer<typeof environmentContextSchema>;
+export declare class DashboardClient {
+    private readonly endpoint;
+    private readonly token;
+    private readonly orgId;
+    private constructor();
+    static fromConfig(config: GlobalConfig): DashboardClient;
+    static load(): Promise<DashboardClient>;
+    private orgUrl;
+    private request;
+    private throwForStatus;
+    /** Generic GET helper used by typed methods (and tests). */
+    getJson(path: string): Promise<unknown>;
+    /** Generic POST helper used by typed methods (and tests). */
+    postJson(path: string, body?: unknown): Promise<unknown>;
+    getDiagnosticsSummary(): Promise<DiagnosticsSummaryResponse>;
+    getInfrastructure(): Promise<DiagnosticsInfrastructureResponse>;
+    listRuns(filters?: RunsListFilters): Promise<RunListResponse>;
+    getRun(runId: string): Promise<RunListItem>;
+    getRunDetail(runId: string): Promise<DashboardRunDetailApiResponse>;
+    getStepLogs(runId: string, jobId: string, stepIndex: number): Promise<DashboardStepLogsApiResponse>;
+    rerunRun(runId: string): Promise<{
+        newRunId: string;
+    }>;
+    cancelRun(runId: string, force: boolean): Promise<{
+        cancelledJobs?: number;
+    }>;
+    cancelByBranch(branch: string): Promise<{
+        cancelledRuns?: number;
+    }>;
+    /** List the org's permanently registered workflows (GET /registrations). */
+    listRegistrations(filters?: RegistrationsListFilters): Promise<RegistrationsListResult>;
+    /**
+     * List the org's environments as secret contexts (GET /environments).
+     *
+     * Pass `includeSecrets` to have the orchestrator attach each environment's
+     * reachable secret key names (never values). Used by `kici secrets list`
+     * and `kici types`.
+     */
+    listEnvironments(includeSecrets?: boolean): Promise<EnvironmentContext[]>;
+}
+export {};
+//# sourceMappingURL=dashboard-client.d.ts.map