@kici-dev/compiler 0.1.16 → 0.1.18

package/dist/llm-context/llms.txt

@@ -25,6 +25,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 - [Event payload reference](https://docs.kici.dev/user/sdk/event-payloads/): Generated schema of the normalized event envelope passed to rules and dynamic functions.
 - [SDK reference: idempotent](https://docs.kici.dev/user/sdk/idempotent/): Idempotent helpers for declarative check / apply patterns inside workflow steps
 - [SDK reference: rules, matrix, dynamic jobs](https://docs.kici.dev/user/sdk/rules-matrix-dynamic/): rule(), skip(), matrix builds (static + dynamic), and dynamicJob / dynamicGroup
+- [SDK reference: runsOnAll host fan-out](https://docs.kici.dev/user/sdk/runs-on-all/): Fan one job out to every matching connected host, one pinned execution per host
 - [SDK reference: runtime](https://docs.kici.dev/user/sdk/runtime/): Types index, StepContext, secrets, fixtures
 - [SDK reference: triggers](https://docs.kici.dev/user/sdk/triggers/): GitHub event triggers, kiciEvent, workflowComplete, jobComplete, genericWebhook, schedule, lifecycle
 - [SDK reference: validation & events](https://docs.kici.dev/user/sdk/validation-events/): validateDag(), event definitions, and event emission
@@ -34,7 +35,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 ## CLI and authoring
 
 - [CLI authentication](https://docs.kici.dev/user/cli-auth/): Authenticate the KiCI CLI with browser OAuth, device flow, or API key paste
-- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), test, login, logout, org, status, cancel, secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
+- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), orchestrators, test, login, logout, org, diagnostics, runs (list/show/logs/rerun/cancel), secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
 - [Lifecycle hooks](https://docs.kici.dev/user/hooks/): SDK hook API for cancel, cleanup, success, failure, and step-level callbacks
 - [Lock file and workflow drift](https://docs.kici.dev/user/lock-file-and-drift/): Keep the lock file in sync with your workflow source and avoid drift
 - [Testing guide](https://docs.kici.dev/user/testing-guide/): Running remote test fixtures with kici run remote
@@ -43,19 +44,22 @@ The full markdown bundle of every page indexed here is available at https://docs
 ## Workflow features
 
 - [Account and sign-in](https://docs.kici.dev/user/account-and-login/): How your KiCI account relates to sign-in methods, and how to change the way you sign in.
+- [Approval gates](https://docs.kici.dev/user/approvals/): Pause a workflow for human sign-off at step, job, or workflow granularity with requireApproval
 - [Concurrency groups](https://docs.kici.dev/user/concurrency/): Control parallel execution with auto-cancel and queue modes
-- [Dashboard](https://docs.kici.dev/user/dashboard/)
+- [Dashboard](https://docs.kici.dev/user/dashboard/): Web UI for monitoring workflow runs, managing sources, secrets, and organization settings.
 - [Dynamic values](https://docs.kici.dev/user/dynamic-values/)
 - [Environment variables](https://docs.kici.dev/user/env-vars/): KICI_* environment variable reference for the CLI
 - [Environments](https://docs.kici.dev/user/environments/): Configure deployment environments with variables, secrets, and protection rules
 - [Event system](https://docs.kici.dev/user/events/): How KiCI's event model works -- event types, the registration model, event matching, and circuit breaker protection
 - [Global workflows](https://docs.kici.dev/user/global-workflows/): Cross-repo workflows that run on events from any repo in the same org
 - [Private npm registries](https://docs.kici.dev/user/private-registries/): Authenticate `npm install` against private registries (CodeArtifact, GitHub Packages, Verdaccio, …) from a workflow's `.kici/package.json`
+- [Build provenance and attestations](https://docs.kici.dev/user/provenance/): Generate and verify signed SLSA provenance for the artifacts your workflows build
 - [Secrets](https://docs.kici.dev/user/secrets/): How to access secrets in KiCI workflow steps
 
 ## Providers
 
 - [GitHub App provider](https://docs.kici.dev/user/providers/github/): Connect KiCI to GitHub via a GitHub App — full Checks API, installation-token clones, and cross-org dispatch
+- [Local filesystem (file://) source](https://docs.kici.dev/user/providers/local-file/): Register a git repo present on the agent filesystem as a file:// source, triggered by the kici-admin CLI or a push hook
 - [Universal-git provider](https://docs.kici.dev/user/providers/universal-git/): Connect Forgejo, Gitea, Gogs, GitLab, or plain GitHub via webhook + PAT or SSH deploy key
 
 ## Architecture overview

package/dist/local-executor/dag-scheduler.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/local-executor/dag-scheduler.ts
 /**
 * Detect cycles using Kahn's algorithm.

package/dist/local-executor/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";

package/dist/local-executor/job-runner.js

@@ -1,12 +1,14 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { ensureTsLoaderHook } from "../execution/ts-loader.js";
 import { formatter } from "../test-runner/output-formatter.js";
 import { createStepContext } from "../test-runner/step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "../test-runner/rule-evaluator.js";
+import { localRunsOnString } from "./runs-on-display.js";
 import { toEventPayload } from "./to-event-payload.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
 import { applyIncludeExclude, expandMatrix, isDynamicJobFn, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { formatMatrixSuffix } from "@kici-dev/engine";
 //#region src/local-executor/job-runner.ts
 /**
 * Job resolution (matrix/dynamic) and single-job execution with step context.
@@ -39,15 +41,6 @@ async function resolveSdkSetters(kiciDir) {
 	};
 }
 /**
-* Format matrix values into a display string for the job name.
-* Single-dimension: "node-18"
-* Multi-dimensional: "linux, 18"
-*/
-function formatMatrixSuffix(matrixValues) {
-	if ("value" in matrixValues && matrixValues.value !== void 0) return matrixValues.value;
-	return Object.values(matrixValues).filter((v) => v !== void 0).join(", ");
-}
-/**
 * Resolve a needs entry to a string name.
 * Handles Job objects, strings, DynamicGroupRef, and object forms.
 */
@@ -58,6 +51,27 @@ function resolveNeedName(need) {
 	return need.name;
 }
 /**
+* Maintain the base-name `{ byMatrix, merged }` envelope as each matrix child
+* completes. `merged` is rebuilt last-write-wins in suffix order so the result
+* is deterministic regardless of child completion order — matching the remote
+* path's name-ordered merge.
+*/
+function updateBaseMatrixEnvelope(jobOutputsMap, baseName, matrixValues, childOutputs) {
+	const existing = jobOutputsMap.get(baseName);
+	const byMatrix = existing && "byMatrix" in existing ? { ...existing.byMatrix } : {};
+	const suffix = formatMatrixSuffix(matrixValues);
+	byMatrix[suffix] = childOutputs;
+	let merged = {};
+	for (const key of Object.keys(byMatrix).sort()) merged = {
+		...merged,
+		...byMatrix[key]
+	};
+	jobOutputsMap.set(baseName, {
+		byMatrix,
+		merged
+	});
+}
+/**
 * Resolve all jobs in a workflow, expanding matrix jobs and evaluating dynamic jobs.
 *
 * - Static jobs: create ResolvedJob with name, needs, job reference
@@ -82,10 +96,13 @@ async function resolveJobs(workflow, event) {
 				debug: () => {}
 			},
 			env: { ...process.env },
-			kici: { infrastructure: { list: () => Promise.resolve({
-				scalers: [],
-				agents: []
-			}) } }
+			kici: {
+				infrastructure: { list: () => Promise.resolve({
+					scalers: [],
+					agents: []
+				}) },
+				oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available during local execution")) }
+			}
 		});
 		for (const genJob of generatedJobs) {
 			const genResolved = await resolveStaticJob(genJob, expansionMap);
@@ -119,7 +136,7 @@ async function resolveStaticJob(job, expansionMap) {
 				workflow: { name: "" },
 				job: {
 					name: job.name,
-					runsOn: job.runsOn
+					runsOn: localRunsOnString(job.runsOn)
 				}
 			},
 			log: {
@@ -219,7 +236,7 @@ async function executeResolvedJobInner(resolvedJob, context, startTime) {
 	const repoRoot = context.execDir;
 	const stepCtx = createStepContext({ name: context.workflowName }, {
 		name: expandedName,
-		runsOn: typeof job.runsOn === "string" ? job.runsOn : Array.isArray(job.runsOn) ? job.runsOn.join(",") : (Array.isArray(job.runsOn.labels) ? job.runsOn.labels : [job.runsOn.labels]).join(",")
+		runsOn: localRunsOnString(job.runsOn)
 	}, repoRoot, void 0, hasMatrix ? matrixValues : void 0, context.secrets, void 0, context.event.payload, context.event.provider);
 	const stepResults = [];
 	let stepCounter = 0;
@@ -285,11 +302,16 @@ async function executeResolvedJobInner(resolvedJob, context, startTime) {
 		}
 	}
 	const stepsWithOutputs = stepResults.filter((s) => s.outputs != null);
-	if (stepsWithOutputs.length === 1 && stepResults.length === 1) context.jobOutputsMap.set(expandedName, stepsWithOutputs[0].outputs);
+	let jobOutputs;
+	if (stepsWithOutputs.length === 1 && stepResults.length === 1) jobOutputs = stepsWithOutputs[0].outputs;
 	else if (stepsWithOutputs.length > 0) {
 		const aggregated = {};
 		for (const stepResult of stepsWithOutputs) aggregated[stepResult.name] = stepResult.outputs;
-		context.jobOutputsMap.set(expandedName, aggregated);
+		jobOutputs = aggregated;
+	}
+	if (jobOutputs) {
+		context.jobOutputsMap.set(expandedName, jobOutputs);
+		if (expandedName !== job.name) updateBaseMatrixEnvelope(context.jobOutputsMap, job.name, matrixValues, jobOutputs);
 	}
 	const durationMs = Date.now() - startTime;
 	formatter.logJobComplete(expandedName, durationMs);

package/dist/local-executor/materializer.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { selectOverlayFiles } from "../remote/uploader.js";
 import path from "node:path";
 import fs from "node:fs/promises";

package/dist/local-executor/output-streamer.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/local-executor/output-streamer.ts

package/dist/local-executor/payload-generator.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { buildEventPayload } from "../test-runner/payload-builder.js";
 import { execSync } from "node:child_process";

package/dist/local-executor/picker.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { transformTriggers } from "../lockfile/generator.js";
 import { parseEventArg, triggerSummary, triggerToEventArg } from "../test-runner/event-types.js";
 import pc from "picocolors";

package/dist/local-executor/runs-on-display.d.ts

@@ -0,0 +1,9 @@
+import type { RunsOn } from '@kici-dev/sdk';
+/**
+ * Render a job's `runsOn` to the comma-joined label string the local/test
+ * runners surface as `ctx.job.runsOn`. A `runsOnAll` job has no `runsOn` —
+ * locally it runs once on this machine, so we surface the marker `'runsOnAll'`.
+ * RegExp selectors render via their `/source/flags` literal.
+ */
+export declare function localRunsOnString(runsOn: RunsOn | undefined): string;
+//# sourceMappingURL=runs-on-display.d.ts.map

package/dist/local-executor/runs-on-display.js

@@ -0,0 +1,23 @@
+import "../chunk-BTugEXQM.js";
+//#region src/local-executor/runs-on-display.ts
+/** Render one selector element (string label or RegExp) for the local display string. */
+function runsOnElementString(el) {
+	return el instanceof RegExp ? el.toString() : el;
+}
+/**
+* Render a job's `runsOn` to the comma-joined label string the local/test
+* runners surface as `ctx.job.runsOn`. A `runsOnAll` job has no `runsOn` —
+* locally it runs once on this machine, so we surface the marker `'runsOnAll'`.
+* RegExp selectors render via their `/source/flags` literal.
+*/
+function localRunsOnString(runsOn) {
+	if (runsOn === void 0) return "runsOnAll";
+	if (typeof runsOn === "string") return runsOn;
+	if (runsOn instanceof RegExp) return runsOn.toString();
+	if (Array.isArray(runsOn)) return runsOn.map(runsOnElementString).join(",");
+	return (Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels]).map(runsOnElementString).join(",");
+}
+//#endregion
+export { localRunsOnString };
+
+//# sourceMappingURL=runs-on-display.js.map

package/dist/local-executor/secret-loader.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { loadSecretsFile } from "../test-runner/secrets-file.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/local-executor/to-event-payload.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/local-executor/to-event-payload.ts
 /**
 * Map a {@link SimulatedEvent} into the normalized SDK {@link EventPayload}

package/dist/local-executor/types.js

@@ -1,2 +1,2 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 export {};

package/dist/lockfile/generator.d.ts

@@ -13,11 +13,15 @@ export declare function detectGitRoot(): string;
  *
  * The authoritative lockfile differs by manager: `.kici/package-lock.json` for
  * npm, the repo-root `pnpm-lock.yaml` for a pnpm workspace, the repo-root
- * `yarn.lock` for yarn. A pnpm/yarn `.kici/` member resolves against the root
- * lockfile, so keying on `.kici/package-lock.json` alone would miss the
- * authoritative graph. The hash input is prefixed with the manager name so two
- * managers can never collide on identical lockfile bytes (and a restored tree
- * can never be the wrong layout for the agent's manager).
+ * `yarn.lock` for a yarn workspace. A pnpm/yarn `.kici/` member resolves against
+ * the root lockfile, so keying on `.kici/package-lock.json` alone would miss the
+ * authoritative graph. A standalone `.kici` yarn project (its own
+ * `packageManager` field + `.kici/yarn.lock`, no root signal) is detected from
+ * `.kici/` and keyed on `.kici/yarn.lock`. The hash input is prefixed with the
+ * manager name so two managers can never collide on identical lockfile bytes
+ * (and a restored tree can never be the wrong layout for the agent's manager).
+ * For yarn the prefix also carries the flavor (`yarn-classic` / `yarn-berry`),
+ * so a classic-layout dep-cache tarball is never restored into a berry install.
  *
  * @param gitRoot - Absolute path to git repository root
  * @returns Hex SHA-256 hash string, or null if no lockfile is found

package/dist/lockfile/generator.js

@@ -1,14 +1,15 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "../types.js";
 import { computeContentHash } from "./hasher.js";
 import { resolveHashFiles } from "./hash-files.js";
 import { analyzePurity } from "./purity-analyzer.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
-import { getDynamicJobGroup, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeCacheSpecs, normalizeRequireApproval } from "@kici-dev/sdk";
+import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeCacheSpecs, normalizeRequireApproval } from "@kici-dev/sdk";
 import { sha256 } from "@kici-dev/core";
-import { PackageManager, detectPackageManagerSync } from "@kici-dev/core/package-manager";
+import { PackageManager, detectPackageManagerSync, detectYarnFlavorSync } from "@kici-dev/core/package-manager";
 import { validateResourceRequest } from "@kici-dev/engine";
+import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
 import { execSync } from "node:child_process";
 //#region src/lockfile/generator.ts
 /**
@@ -37,23 +38,27 @@ function detectGitRoot() {
 *
 * The authoritative lockfile differs by manager: `.kici/package-lock.json` for
 * npm, the repo-root `pnpm-lock.yaml` for a pnpm workspace, the repo-root
-* `yarn.lock` for yarn. A pnpm/yarn `.kici/` member resolves against the root
-* lockfile, so keying on `.kici/package-lock.json` alone would miss the
-* authoritative graph. The hash input is prefixed with the manager name so two
-* managers can never collide on identical lockfile bytes (and a restored tree
-* can never be the wrong layout for the agent's manager).
+* `yarn.lock` for a yarn workspace. A pnpm/yarn `.kici/` member resolves against
+* the root lockfile, so keying on `.kici/package-lock.json` alone would miss the
+* authoritative graph. A standalone `.kici` yarn project (its own
+* `packageManager` field + `.kici/yarn.lock`, no root signal) is detected from
+* `.kici/` and keyed on `.kici/yarn.lock`. The hash input is prefixed with the
+* manager name so two managers can never collide on identical lockfile bytes
+* (and a restored tree can never be the wrong layout for the agent's manager).
+* For yarn the prefix also carries the flavor (`yarn-classic` / `yarn-berry`),
+* so a classic-layout dep-cache tarball is never restored into a berry install.
 *
 * @param gitRoot - Absolute path to git repository root
 * @returns Hex SHA-256 hash string, or null if no lockfile is found
 */
 function computeLockfileHash(gitRoot) {
-	const pm = detectPackageManagerSync(gitRoot);
-	const lockfilePath = pm === PackageManager.Pnpm ? path.join(gitRoot, "pnpm-lock.yaml") : pm === PackageManager.Yarn ? path.join(gitRoot, "yarn.lock") : path.join(gitRoot, ".kici", "package-lock.json");
-	try {
-		return sha256(`${pm}\n${readFileSync(lockfilePath, "utf-8")}`);
-	} catch {
-		return null;
-	}
+	const pm = detectPackageManagerSync(gitRoot) === PackageManager.Npm ? detectPackageManagerSync(path.join(gitRoot, ".kici")) : detectPackageManagerSync(gitRoot);
+	const candidates = pm === PackageManager.Pnpm ? [path.join(gitRoot, "pnpm-lock.yaml"), path.join(gitRoot, ".kici", "pnpm-lock.yaml")] : pm === PackageManager.Yarn ? [path.join(gitRoot, "yarn.lock"), path.join(gitRoot, ".kici", "yarn.lock")] : [path.join(gitRoot, ".kici", "package-lock.json")];
+	const prefix = pm === PackageManager.Yarn ? `${pm}-${detectYarnFlavorSync(detectPackageManagerSync(gitRoot) === PackageManager.Yarn ? gitRoot : path.join(gitRoot, ".kici"))}` : pm;
+	for (const lockfilePath of candidates) try {
+		return sha256(`${prefix}\n${readFileSync(lockfilePath, "utf-8")}`);
+	} catch {}
+	return null;
 }
 /**
 * Format export reference with hash syntax.
@@ -421,13 +426,19 @@ function transformJobs(jobs, configPath, gitRoot) {
 	return jobs.map((jobOrFactory, index) => {
 		if (isDynamicJobFn(jobOrFactory)) {
 			const groupName = getDynamicJobGroup(jobOrFactory);
+			const declaredNeeds = getDynamicJobNeeds(jobOrFactory);
+			const resolvedNeeds = declaredNeeds ? resolveNeedsForLock(declaredNeeds, uuidToName) : void 0;
 			return {
 				_type: "dynamic",
 				source: {
 					file: configPath,
 					index
 				},
-				...groupName && { group: groupName }
+				...groupName && { group: groupName },
+				...resolvedNeeds && {
+					needs: resolvedNeeds.needs,
+					resultAware: true
+				}
 			};
 		}
 		const j = jobOrFactory;
@@ -439,40 +450,45 @@ function transformJobs(jobs, configPath, gitRoot) {
 	});
 }
 /**
-* Normalize SDK runsOn into lock file representation.
-* - String passthrough: `'linux'` -> `{ runsOn: 'linux' }`
-* - Array passthrough: `['linux', 'docker']` -> `{ runsOn: ['linux', 'docker'] }`
-* - Object form: `{ labels: ['linux'], exclude: ['gpu'] }` -> `{ runsOn: ['linux'], excludeLabels: ['gpu'] }`
+* Normalize SDK runsOn into lock file matchers.
+* Plain strings stay exact; globs convert to regex; RegExp literals become regex.
+* Throws (via the engine ReDoS gate) on a ReDoS-prone author regex.
 */
-function normalizeRunsOnForLock(runsOn) {
-	if (typeof runsOn === "string") return { runsOn };
-	if (Array.isArray(runsOn)) return { runsOn };
-	const labels = Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels];
-	const exclude = runsOn.exclude ? Array.isArray(runsOn.exclude) ? runsOn.exclude : [runsOn.exclude] : void 0;
+function normalizeRunsOnForLock(runsOn, jobName) {
+	const { include, exclude } = normalizeRunsOnToMatchers(runsOn, `job '${jobName}' runsOn`);
 	return {
-		runsOn: labels.length === 1 ? labels[0] : labels,
-		...exclude && exclude.length > 0 ? { excludeLabels: exclude } : {}
+		runsOn: include,
+		...exclude.length > 0 ? { excludeLabels: exclude } : {}
 	};
 }
 /**
-* Validate runsOn labels:
-* 1. Reject kici:* reserved prefix in user-supplied labels.
-* 2. Reject overlap between required and excluded labels.
+* Validate runsOn labels: reject overlap between required and excluded labels.
+*
+* `kici:` labels ARE valid runsOn selectors. runsOn expresses a requirement on
+* candidate agents — it only narrows the set, it never grants authority — so
+* targeting a `kici:os:linux` / `kici:role:builder` label is benign. The forgery
+* boundary is label *setting* (scaler labelSet validation + the agent
+* register-time scope gate), which is enforced elsewhere and unaffected here.
+*
+* The overlap check compares exact matchers only — a glob/regex include and an
+* exact exclude (or vice versa) cannot be statically known to overlap.
 */
 function validateRunsOn(runsOn, jobName) {
-	const labels = typeof runsOn === "string" ? [runsOn] : Array.isArray(runsOn) ? runsOn : Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels];
-	const reservedLabels = labels.filter((l) => l.toLowerCase().startsWith("kici:"));
-	if (reservedLabels.length > 0) throw new Error(`Job "${jobName}": labels with 'kici:' prefix are reserved and cannot be used in runsOn: ${reservedLabels.join(", ")}`);
-	if (typeof runsOn === "string" || Array.isArray(runsOn)) return;
-	const exclude = runsOn.exclude ? Array.isArray(runsOn.exclude) ? runsOn.exclude : [runsOn.exclude] : [];
-	const overlap = labels.filter((l) => exclude.includes(l));
+	const { include, exclude } = normalizeRunsOnToMatchers(runsOn, `job '${jobName}' runsOn`);
+	const includeExact = new Set(include.filter((m) => m.kind === "exact").map((m) => m.value));
+	const overlap = exclude.filter((m) => m.kind === "exact").map((m) => m.value).filter((v) => includeExact.has(v));
 	if (overlap.length > 0) throw new Error(`Job "${jobName}": labels and exclude overlap on [${overlap.join(", ")}]. A label cannot be both required and excluded.`);
 }
 /**
 * Transform a static job to lock file format.
 */
 function transformJob(job, configPath, index, gitRoot, uuidToName) {
-	validateRunsOn(job.runsOn, job.name);
+	if (job.runsOn !== void 0 && job.runsOnAll !== void 0) throw new Error(`job '${job.name}': runsOn and runsOnAll are mutually exclusive`);
+	if (job.runsOn === void 0 && job.runsOnAll === void 0) throw new Error(`job '${job.name}': one of runsOn or runsOnAll is required`);
+	if (job.onUnreachable !== void 0 && job.runsOnAll === void 0) console.warn(`[kici] job '${job.name}': onUnreachable is ignored without runsOnAll`);
+	if (job.maxParallel !== void 0 && job.maxParallel < 1) throw new Error(`job '${job.name}': maxParallel must be >= 1`);
+	if (!(job.matrix !== void 0 || job.runsOnAll !== void 0) && (job.maxParallel !== void 0 || job.failFast !== void 0)) console.warn(`[kici] job '${job.name}': maxParallel/failFast are ignored without matrix or runsOnAll (no fan-out to bound)`);
+	if (job.runsOn !== void 0) validateRunsOn(job.runsOn, job.name);
 	const environmentFields = {};
 	if (job.environment !== void 0) {
 		if (typeof job.environment === "function") {
@@ -521,7 +537,11 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 	return {
 		_type: "static",
 		name: job.name,
-		...normalizeRunsOnForLock(job.runsOn),
+		...job.runsOn !== void 0 ? normalizeRunsOnForLock(job.runsOn, job.name) : {},
+		...job.runsOnAll !== void 0 && { runsOnAll: normalizeRunsOnAllToMatchers(job.runsOnAll, `job '${job.name}' runsOnAll`) },
+		...job.onUnreachable !== void 0 && { onUnreachable: job.onUnreachable },
+		...job.maxParallel !== void 0 && { maxParallel: job.maxParallel },
+		...job.failFast !== void 0 && { failFast: job.failFast },
 		...resolveNeedsForLock(job.needs, uuidToName),
 		steps: transformSteps(job.steps, gitRoot),
 		matrix: job.matrix ? transformMatrix(job.matrix, job.name, configPath) : void 0,

package/dist/lockfile/hash-files.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
 import fg from "fast-glob";

package/dist/lockfile/hasher.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { normalizeLineEndings, sha256 } from "@kici-dev/core";
 //#region src/lockfile/hasher.ts
 /**

package/dist/lockfile/index.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { COMPILE_SCHEMA_VERSION, computeContentHash } from "./hasher.js";
 import { computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile } from "./generator.js";
 export { COMPILE_SCHEMA_VERSION, computeContentHash, computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile };

package/dist/lockfile/purity-analyzer.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import ts from "typescript";
 //#region src/lockfile/purity-analyzer.ts
 /**

package/dist/postinstall.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-gOLHoazu.js";
+import "./chunk-BTugEXQM.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";

package/dist/provenance-trust-root.d.ts

@@ -0,0 +1,14 @@
+/** Structural JWKS shape — the engine verifier owns the real `jose` type. */
+export interface JsonWebKeySet {
+    keys: Record<string, unknown>[];
+}
+export interface TrustRoot {
+    issuer: string;
+    jwks: JsonWebKeySet;
+}
+/**
+ * Resolve `--trust-root`: an HTTPS issuer URL (discovery → `jwks_uri` → JWKS) or
+ * a self-contained offline file `{ issuer, jwks }`.
+ */
+export declare function resolveTrustRoot(trustRoot: string): Promise<TrustRoot>;
+//# sourceMappingURL=provenance-trust-root.d.ts.map

package/dist/provenance-trust-root.js

@@ -0,0 +1,49 @@
+import "./chunk-BTugEXQM.js";
+import { readFile } from "node:fs/promises";
+//#region src/provenance-trust-root.ts
+/**
+* Trust-root resolution for `kici verify-attestation`.
+*
+* The verifier never blindly trusts a provenance token's own `iss`: the trusted
+* issuer + its JWKS are supplied out-of-band via `--trust-root`. This resolver
+* turns that flag into a concrete `{ issuer, jwks }`:
+*
+*  - an **HTTPS issuer URL** (online): fetch `<url>/.well-known/openid-configuration`,
+*    read its `issuer` + `jwks_uri`, then fetch the JWKS;
+*  - a **local file path** (offline / air-gapped): a self-contained
+*    `{ "issuer": "...", "jwks": { "keys": [...] } }` JSON document, no network.
+*
+* Node-specific (`fetch` + `fs`) so the engine verify core stays pure /
+* browser-safe; the JWKS is passed straight through to the engine, which owns
+* the crypto, so this module defines only a structural `JsonWebKeySet` type
+* rather than depending on `jose`.
+*/
+/**
+* Resolve `--trust-root`: an HTTPS issuer URL (discovery → `jwks_uri` → JWKS) or
+* a self-contained offline file `{ issuer, jwks }`.
+*/
+async function resolveTrustRoot(trustRoot) {
+	if (/^https?:\/\//.test(trustRoot)) {
+		const base = trustRoot.replace(/\/+$/, "");
+		const disco = await fetchJson(`${base}/.well-known/openid-configuration`);
+		return {
+			issuer: typeof disco.issuer === "string" ? disco.issuer : base,
+			jwks: await fetchJson(typeof disco.jwks_uri === "string" ? disco.jwks_uri : `${base}/.well-known/jwks.json`)
+		};
+	}
+	const file = JSON.parse(await readFile(trustRoot, "utf-8"));
+	if (typeof file.issuer !== "string" || !file.jwks || !Array.isArray(file.jwks.keys)) throw new Error("trust-root file must contain { issuer, jwks: { keys: [...] } }");
+	return {
+		issuer: file.issuer,
+		jwks: file.jwks
+	};
+}
+async function fetchJson(url) {
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`failed to fetch ${url}: ${res.status}`);
+	return await res.json();
+}
+//#endregion
+export { resolveTrustRoot };
+
+//# sourceMappingURL=provenance-trust-root.js.map

package/dist/remote/config.d.ts

@@ -9,8 +9,6 @@ export interface GlobalConfig {
     endpoint?: string;
     /** Platform relay URL */
     platformEndpoint?: string;
-    /** Connection mode: 'platform' or 'direct' */
-    connectionMode?: 'platform' | 'direct';
     /** Routing key for webhook source identification (e.g., 'github:42') */
     routingKey?: string;
     /** Personal access token (from OAuth login) */
@@ -23,6 +21,12 @@ export interface GlobalConfig {
     activeOrgId?: string;
     /** User email from OIDC token */
     userEmail?: string;
+    /**
+     * Per-org default orchestrator cluster for `kici run remote`, keyed by org id.
+     * Set by `kici orchestrators use <cluster>`; consulted when `--orchestrator`
+     * is omitted so a developer with one preferred cluster types no flag.
+     */
+    defaultClusters?: Record<string, string>;
 }
 /**
  * Returns the global KiCI config directory path.

package/dist/remote/config.js

@@ -1,9 +1,8 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import os from "node:os";
 //#region src/remote/config.ts
-const VALID_CONNECTION_MODES = ["platform", "direct"];
 /**
 * Strips unknown keys and validates known fields from a raw config object.
 * Returns a clean GlobalConfig with only recognized, valid fields.
@@ -15,13 +14,17 @@ function sanitizeConfig(raw) {
 	if (typeof obj.token === "string") config.token = obj.token;
 	if (typeof obj.endpoint === "string") config.endpoint = obj.endpoint;
 	if (typeof obj.platformEndpoint === "string") config.platformEndpoint = obj.platformEndpoint;
-	if (typeof obj.connectionMode === "string" && VALID_CONNECTION_MODES.includes(obj.connectionMode)) config.connectionMode = obj.connectionMode;
 	if (typeof obj.routingKey === "string") config.routingKey = obj.routingKey;
 	if (typeof obj.pat === "string") config.pat = obj.pat;
 	if (typeof obj.patId === "string") config.patId = obj.patId;
 	if (typeof obj.patExpiresAt === "string") config.patExpiresAt = obj.patExpiresAt;
 	if (typeof obj.activeOrgId === "string") config.activeOrgId = obj.activeOrgId;
 	if (typeof obj.userEmail === "string") config.userEmail = obj.userEmail;
+	if (typeof obj.defaultClusters === "object" && obj.defaultClusters !== null && !Array.isArray(obj.defaultClusters)) {
+		const clusters = {};
+		for (const [orgId, clusterName] of Object.entries(obj.defaultClusters)) if (typeof clusterName === "string") clusters[orgId] = clusterName;
+		if (Object.keys(clusters).length > 0) config.defaultClusters = clusters;
+	}
 	return config;
 }
 /**
@@ -76,13 +79,13 @@ async function mergeGlobalConfig(partial) {
 	if (partial.token !== void 0) merged.token = partial.token;
 	if (partial.endpoint !== void 0) merged.endpoint = partial.endpoint;
 	if (partial.platformEndpoint !== void 0) merged.platformEndpoint = partial.platformEndpoint;
-	if (partial.connectionMode !== void 0) merged.connectionMode = partial.connectionMode;
 	if (partial.routingKey !== void 0) merged.routingKey = partial.routingKey;
 	if (partial.pat !== void 0) merged.pat = partial.pat;
 	if (partial.patId !== void 0) merged.patId = partial.patId;
 	if (partial.patExpiresAt !== void 0) merged.patExpiresAt = partial.patExpiresAt;
 	if (partial.activeOrgId !== void 0) merged.activeOrgId = partial.activeOrgId;
 	if (partial.userEmail !== void 0) merged.userEmail = partial.userEmail;
+	if (partial.defaultClusters !== void 0) merged.defaultClusters = partial.defaultClusters;
 	await saveGlobalConfig(merged);
 	return merged;
 }