@kici-dev/compiler 0.1.16 → 0.1.18

package/dist/remote/dashboard-client.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Typed client for the Platform org-scoped dashboard API (the endpoints the
+ * web UI uses). Authenticated with the stored PAT + active org. This is the
+ * only place in the CLI that knows these routes.
+ */
+import { z } from 'zod';
+import { type RunListResponse, type RunListItem, type DiagnosticsInfrastructureResponse, type DiagnosticsSummaryResponse, type DashboardRunDetailApiResponse, type DashboardStepLogsApiResponse, type RegistrationItem } from '@kici-dev/engine';
+import { type GlobalConfig } from './config.js';
+export type DashboardErrorKind = 'not_logged_in' | 'no_active_org' | 'unauthorized' | 'forbidden' | 'not_found' | 'conflict' | 'cooldown' | 'orchestrator_offline' | 'http';
+/** Typed error raised by every DashboardClient method on a non-2xx response. */
+export declare class DashboardClientError extends Error {
+    readonly kind: DashboardErrorKind;
+    readonly status?: number | undefined;
+    constructor(kind: DashboardErrorKind, message: string, status?: number | undefined);
+}
+/** Filters accepted by the runs-list endpoint. */
+export interface RunsListFilters {
+    status?: string;
+    workflow?: string;
+    branch?: string;
+    repo?: string;
+    trigger?: string;
+    source?: string;
+    since?: string;
+    page?: number;
+}
+/** Result of {@link DashboardClient.listRegistrations}. */
+export interface RegistrationsListResult {
+    registrations: RegistrationItem[];
+    registryVersion: number;
+    registryUpdatedAt: string;
+}
+/** Filters accepted by the registrations-list endpoint. */
+export interface RegistrationsListFilters {
+    triggerType?: string;
+    repoIdentifier?: string;
+}
+/**
+ * A secret context (environment) as surfaced to the developer CLI's
+ * `secrets list` / `types` commands. The orchestrator returns the per-env
+ * secret key names (never values) when `includeSecrets` is requested.
+ */
+declare const environmentContextSchema: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodBoolean;
+    allowLocalExecution: z.ZodBoolean;
+    secretKeys: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/** A secret context (environment) returned by {@link DashboardClient.listEnvironments}. */
+export type EnvironmentContext = z.infer<typeof environmentContextSchema>;
+export declare class DashboardClient {
+    private readonly endpoint;
+    private readonly token;
+    private readonly orgId;
+    private constructor();
+    static fromConfig(config: GlobalConfig): DashboardClient;
+    static load(): Promise<DashboardClient>;
+    private orgUrl;
+    private request;
+    private throwForStatus;
+    /** Generic GET helper used by typed methods (and tests). */
+    getJson(path: string): Promise<unknown>;
+    /** Generic POST helper used by typed methods (and tests). */
+    postJson(path: string, body?: unknown): Promise<unknown>;
+    getDiagnosticsSummary(): Promise<DiagnosticsSummaryResponse>;
+    getInfrastructure(): Promise<DiagnosticsInfrastructureResponse>;
+    listRuns(filters?: RunsListFilters): Promise<RunListResponse>;
+    getRun(runId: string): Promise<RunListItem>;
+    getRunDetail(runId: string): Promise<DashboardRunDetailApiResponse>;
+    getStepLogs(runId: string, jobId: string, stepIndex: number): Promise<DashboardStepLogsApiResponse>;
+    rerunRun(runId: string): Promise<{
+        newRunId: string;
+    }>;
+    cancelRun(runId: string, force: boolean): Promise<{
+        cancelledJobs?: number;
+    }>;
+    cancelByBranch(branch: string): Promise<{
+        cancelledRuns?: number;
+    }>;
+    /** List the org's permanently registered workflows (GET /registrations). */
+    listRegistrations(filters?: RegistrationsListFilters): Promise<RegistrationsListResult>;
+    /**
+     * List the org's environments as secret contexts (GET /environments).
+     *
+     * Pass `includeSecrets` to have the orchestrator attach each environment's
+     * reachable secret key names (never values). Used by `kici secrets list`
+     * and `kici types`.
+     */
+    listEnvironments(includeSecrets?: boolean): Promise<EnvironmentContext[]>;
+}
+export {};
+//# sourceMappingURL=dashboard-client.d.ts.map

package/dist/remote/dashboard-client.js

@@ -0,0 +1,168 @@
+import "../chunk-BTugEXQM.js";
+import { loadGlobalConfig } from "./config.js";
+import { dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, registrationItemSchema, runListItemSchema, runListResponseSchema } from "@kici-dev/engine";
+import { z } from "zod";
+//#region src/remote/dashboard-client.ts
+/**
+* Typed client for the Platform org-scoped dashboard API (the endpoints the
+* web UI uses). Authenticated with the stored PAT + active org. This is the
+* only place in the CLI that knows these routes.
+*/
+/** Typed error raised by every DashboardClient method on a non-2xx response. */
+var DashboardClientError = class extends Error {
+	kind;
+	status;
+	constructor(kind, message, status) {
+		super(message);
+		this.kind = kind;
+		this.status = status;
+		this.name = "DashboardClientError";
+	}
+};
+const singleRunSchema = z.object({ run: runListItemSchema });
+const rerunResponseSchema = z.object({ newRunId: z.string() });
+const cancelResponseSchema = z.object({ cancelledJobs: z.number().optional() });
+const cancelByBranchResponseSchema = z.object({ cancelledRuns: z.number().optional() });
+const registrationsListSchema = z.object({
+	registrations: z.array(registrationItemSchema).default([]),
+	registryVersion: z.number(),
+	registryUpdatedAt: z.string()
+});
+/**
+* A secret context (environment) as surfaced to the developer CLI's
+* `secrets list` / `types` commands. The orchestrator returns the per-env
+* secret key names (never values) when `includeSecrets` is requested.
+*/
+const environmentContextSchema = z.object({
+	name: z.string(),
+	enabled: z.boolean(),
+	allowLocalExecution: z.boolean(),
+	secretKeys: z.array(z.string()).default([])
+});
+const environmentsListSchema = z.object({ environments: z.array(environmentContextSchema).default([]) });
+const STATUS_ERROR_MAP = {
+	401: ["unauthorized", "Authentication failed. Run `kici login` to re-authenticate."],
+	403: ["forbidden", "Access denied."],
+	404: ["not_found", "Not found."],
+	409: ["conflict", "Already in a terminal state."],
+	429: ["cooldown", "Rate limited — wait and retry."],
+	503: ["orchestrator_offline", "Orchestrator offline — try again shortly."],
+	504: ["orchestrator_offline", "Orchestrator timed out — try again shortly."]
+};
+var DashboardClient = class DashboardClient {
+	endpoint;
+	token;
+	orgId;
+	constructor(endpoint, token, orgId) {
+		this.endpoint = endpoint;
+		this.token = token;
+		this.orgId = orgId;
+	}
+	static fromConfig(config) {
+		const token = config.pat ?? config.token;
+		const endpoint = config.platformEndpoint ?? config.endpoint;
+		if (!token) throw new DashboardClientError("not_logged_in", "Not logged in. Run `kici login` first.");
+		if (!endpoint) throw new DashboardClientError("not_logged_in", "No endpoint configured. Run `kici login` first.");
+		if (!config.activeOrgId) throw new DashboardClientError("no_active_org", "No active organization. Run `kici org use <name>` to set one.");
+		return new DashboardClient(endpoint.replace(/\/$/, ""), token, config.activeOrgId);
+	}
+	static async load() {
+		return DashboardClient.fromConfig(await loadGlobalConfig());
+	}
+	orgUrl(path) {
+		return `${this.endpoint}/api/v1/orgs/${this.orgId}/${path.replace(/^\//, "")}`;
+	}
+	async request(method, path, body) {
+		const res = await fetch(this.orgUrl(path), {
+			method,
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${this.token}`
+			},
+			body: body === void 0 ? void 0 : JSON.stringify(body)
+		}).catch((err) => {
+			throw new DashboardClientError("http", `Network error: ${String(err)}`);
+		});
+		if (res.ok) {
+			const text = await res.text();
+			return text ? JSON.parse(text) : {};
+		}
+		return this.throwForStatus(res);
+	}
+	async throwForStatus(res) {
+		let detail;
+		try {
+			detail = (await res.json()).error;
+		} catch {}
+		const [kind, fallback] = STATUS_ERROR_MAP[res.status] ?? ["http", `Request failed (${res.status}).`];
+		throw new DashboardClientError(kind, detail ?? fallback, res.status);
+	}
+	/** Generic GET helper used by typed methods (and tests). */
+	async getJson(path) {
+		return this.request("GET", path);
+	}
+	/** Generic POST helper used by typed methods (and tests). */
+	async postJson(path, body) {
+		return this.request("POST", path, body);
+	}
+	async getDiagnosticsSummary() {
+		return diagnosticsSummaryResponseSchema.parse(await this.getJson("/diagnostics"));
+	}
+	async getInfrastructure() {
+		return diagnosticsInfrastructureResponseSchema.parse(await this.getJson("/diagnostics/infrastructure"));
+	}
+	async listRuns(filters = {}) {
+		const qs = new URLSearchParams();
+		if (filters.status) qs.set("status", filters.status);
+		if (filters.workflow) qs.set("workflow", filters.workflow);
+		if (filters.branch) qs.set("branch", filters.branch);
+		if (filters.repo) qs.set("repository", filters.repo);
+		if (filters.trigger) qs.set("triggerType", filters.trigger);
+		if (filters.source) qs.set("source", filters.source);
+		if (filters.since) qs.set("since", filters.since);
+		if (filters.page) qs.set("page", String(filters.page));
+		const suffix = qs.toString() ? `?${qs.toString()}` : "";
+		return runListResponseSchema.parse(await this.getJson(`/runs${suffix}`));
+	}
+	async getRun(runId) {
+		return singleRunSchema.parse(await this.getJson(`/runs/${runId}`)).run;
+	}
+	async getRunDetail(runId) {
+		return dashboardRunDetailApiResponseSchema.parse(await this.getJson(`/runs/${runId}/detail`));
+	}
+	async getStepLogs(runId, jobId, stepIndex) {
+		return dashboardStepLogsApiResponseSchema.parse(await this.getJson(`/runs/${runId}/jobs/${jobId}/steps/${stepIndex}/logs`));
+	}
+	async rerunRun(runId) {
+		return rerunResponseSchema.parse(await this.postJson(`/runs/${runId}/rerun`));
+	}
+	async cancelRun(runId, force) {
+		return cancelResponseSchema.parse(await this.postJson(`/runs/${runId}/cancel`, { force }));
+	}
+	async cancelByBranch(branch) {
+		return cancelByBranchResponseSchema.parse(await this.postJson("/runs/cancel-by-branch", { branch }));
+	}
+	/** List the org's permanently registered workflows (GET /registrations). */
+	async listRegistrations(filters = {}) {
+		const qs = new URLSearchParams();
+		if (filters.triggerType) qs.set("triggerType", filters.triggerType);
+		if (filters.repoIdentifier) qs.set("repoIdentifier", filters.repoIdentifier);
+		const suffix = qs.toString() ? `?${qs.toString()}` : "";
+		return registrationsListSchema.parse(await this.getJson(`/registrations${suffix}`));
+	}
+	/**
+	* List the org's environments as secret contexts (GET /environments).
+	*
+	* Pass `includeSecrets` to have the orchestrator attach each environment's
+	* reachable secret key names (never values). Used by `kici secrets list`
+	* and `kici types`.
+	*/
+	async listEnvironments(includeSecrets = false) {
+		const suffix = includeSecrets ? "?includeSecrets=true" : "";
+		return environmentsListSchema.parse(await this.getJson(`/environments${suffix}`)).environments;
+	}
+};
+//#endregion
+export { DashboardClient, DashboardClientError };
+
+//# sourceMappingURL=dashboard-client.js.map

package/dist/remote/encryption.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import fs from "node:fs/promises";
 import { deriveSharedSecret } from "@kici-dev/core";
 import crypto from "node:crypto";
@@ -11,7 +11,6 @@ import crypto from "node:crypto";
 * Same pattern as engine/src/secrets/crypto.ts.
 */
 const IV_LENGTH = 12;
-const AUTH_TAG_LENGTH = 16;
 /**
 * Generate an ephemeral X25519 keypair.
 * Keys are exported as DER buffers for compact wire format.
@@ -72,8 +71,8 @@ async function decryptTarball(encryptedPath, cliPublicKey, orchestratorPrivateKe
 	const aesKey = deriveSharedSecret(orchestratorPrivateKey, cliPublicKey);
 	const encrypted = await fs.readFile(encryptedPath);
 	const iv = encrypted.subarray(0, IV_LENGTH);
-	const authTag = encrypted.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
-	const ciphertext = encrypted.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+	const authTag = encrypted.subarray(IV_LENGTH, 28);
+	const ciphertext = encrypted.subarray(28);
 	const decipher = crypto.createDecipheriv("aes-256-gcm", aesKey, iv);
 	decipher.setAuthTag(authTag);
 	const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);

package/dist/remote/history.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { formatRelativeTime } from "../format.js";
 import { getConfigDir } from "./config.js";
 import path from "node:path";

package/dist/remote/oauth.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { discoverOidcEndpoints } from "./oidc-discovery.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";

package/dist/remote/oidc-discovery.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/remote/oidc-discovery.ts
 const cache = /* @__PURE__ */ new Map();

package/dist/remote/output/json.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 //#region src/remote/output/json.ts
 /**
 * Format run results as structured JSON with 2-space indentation.

package/dist/remote/output/junit.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 //#region src/remote/output/junit.ts
 /**
 * Format run results as JUnit XML following the standard schema.

package/dist/remote/output/streaming.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { formatDuration } from "@kici-dev/core";
 //#region src/remote/output/streaming.ts

package/dist/remote/output/summary.js

@@ -1,4 +1,4 @@
-import "../../chunk-gOLHoazu.js";
+import "../../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { formatDuration } from "@kici-dev/core";
 //#region src/remote/output/summary.ts

package/dist/remote/platform-client.d.ts

@@ -0,0 +1,142 @@
+/**
+ * PAT-authenticated client for the Platform's dev-facing run-remote routes.
+ *
+ * This is the developer CLI's contact point for `kici run remote` and its
+ * companion commands. It targets the Platform (`config.platformEndpoint`), which
+ * relays each control request over the WS dashboard-proxy to the org's
+ * orchestrator cluster — the orchestrator's own HTTP API is never reached
+ * directly (it may live on a hidden network).
+ *
+ * The overlay tarball does NOT flow through here: `initUpload` returns an
+ * external presigned URL the CLI PUTs to directly (data plane).
+ */
+export declare class AuthenticationError extends Error {
+    constructor(message?: string);
+}
+export declare class AccessDeniedError extends Error {
+    constructor(message?: string);
+}
+export declare class NotFoundError extends Error {
+    constructor(message?: string);
+}
+export declare class ConnectionError extends Error {
+    endpoint?: string | undefined;
+    constructor(message: string, endpoint?: string | undefined);
+}
+/**
+ * Thrown when the org has more than one connected orchestrator cluster and the
+ * developer did not pick one (no `--orchestrator` flag, no per-org default).
+ * Carries the list of connected cluster names so the CLI can print the choice.
+ */
+export declare class AmbiguousClusterError extends Error {
+    clusters: string[];
+    constructor(clusters: string[], message?: string);
+}
+/** Thrown when the org has no connected orchestrator cluster. */
+export declare class NoClusterError extends Error {
+    constructor(message?: string);
+}
+export interface PlatformUploadInitInput {
+    sha?: string;
+    fileCount?: number;
+    compressedSize?: number;
+}
+export interface PlatformUploadInitResponse {
+    uploadId: string;
+    signedUrl: string;
+    publicKey: string;
+    expiresIn: number;
+}
+export interface PlatformTriggerInput {
+    fixtureId: string;
+    event: {
+        type: string;
+        action?: string;
+        targetBranch: string;
+        sourceBranch?: string;
+        payload: Record<string, unknown>;
+        changedFiles?: string[];
+    };
+    workflowName?: string;
+    uploadId?: string;
+    /**
+     * Ephemeral X25519 public key the CLI used to encrypt the overlay tarball.
+     * The orchestrator pairs it with the upload's stored private key to decrypt
+     * the overlay. Distinct from `encryptedSecretsKey` (the optional secrets key).
+     */
+    cliPublicKey?: string;
+    inlineLockFile?: string;
+    fullRepo?: boolean;
+    secrets?: Record<string, string>;
+    encryptedSecrets?: string;
+    encryptedSecretsKey?: string;
+}
+export interface PlatformTriggerResponse {
+    runId: string;
+    status: 'accepted' | 'rejected';
+    reason?: string;
+    jobIds?: string[];
+}
+export interface PlatformRunStatusResponse {
+    runId: string;
+    status: string;
+    jobs: Array<{
+        jobId: string;
+        jobName: string;
+        status: string;
+        exitCode?: number | null;
+        errorMessage?: string | null;
+    }>;
+    done: boolean;
+}
+export interface PlatformRunLogsResponse {
+    lines: string[];
+    nextCursor: number;
+    done: boolean;
+}
+export interface PlatformCancelResponse {
+    cancelled: boolean;
+}
+interface PlatformRunClientConfig {
+    /** Platform base URL, e.g. `https://api.kici.dev`. */
+    platformEndpoint: string;
+    /** Personal access token (PAT) used as the bearer credential. */
+    token: string;
+}
+/** Cluster targeting for a run-remote request. */
+export interface ClusterTarget {
+    /** Explicit `--orchestrator <name>` pick. */
+    orchestrator?: string;
+    /** Per-org default cluster (`config.defaultClusters[orgId]`). */
+    defaultCluster?: string;
+}
+/**
+ * Client for the Platform's `/api/v1/orgs/:orgId/test/*` relay routes.
+ */
+export declare class PlatformRunClient {
+    private readonly baseUrl;
+    private readonly token;
+    constructor(config: PlatformRunClientConfig);
+    /** POST /test/uploads/init — mint an external presigned upload URL. */
+    initUpload(orgId: string, target: ClusterTarget, body: PlatformUploadInitInput): Promise<PlatformUploadInitResponse>;
+    /** POST /test/trigger — trigger a remote run. */
+    trigger(orgId: string, target: ClusterTarget, body: PlatformTriggerInput): Promise<PlatformTriggerResponse>;
+    /** GET /test/runs/:runId — run-status snapshot. */
+    runStatus(orgId: string, runId: string, target?: ClusterTarget): Promise<PlatformRunStatusResponse>;
+    /** GET /test/runs/:runId/logs?cursor=<n> — next log chunk from a cursor. */
+    runLogs(orgId: string, runId: string, cursor: number, target?: ClusterTarget): Promise<PlatformRunLogsResponse>;
+    /** POST /test/runs/:runId/cancel — cancel a run. */
+    cancel(orgId: string, runId: string, target?: ClusterTarget): Promise<PlatformCancelResponse>;
+    /**
+     * Make a PAT-authenticated request to the Platform.
+     *
+     * Classifies errors: 401 → AuthenticationError, 403 → AccessDeniedError,
+     * 404 → NotFoundError, 422 ambiguous_cluster → AmbiguousClusterError,
+     * 422 no_cluster → NoClusterError. Network failures → ConnectionError.
+     */
+    private request;
+    /** Map a non-OK Platform response to a typed error. Always throws. */
+    private throwForStatus;
+}
+export {};
+//# sourceMappingURL=platform-client.d.ts.map

package/dist/remote/platform-client.js

@@ -0,0 +1,187 @@
+import "../chunk-BTugEXQM.js";
+import { toErrorMessage } from "@kici-dev/core";
+//#region src/remote/platform-client.ts
+/**
+* PAT-authenticated client for the Platform's dev-facing run-remote routes.
+*
+* This is the developer CLI's contact point for `kici run remote` and its
+* companion commands. It targets the Platform (`config.platformEndpoint`), which
+* relays each control request over the WS dashboard-proxy to the org's
+* orchestrator cluster — the orchestrator's own HTTP API is never reached
+* directly (it may live on a hidden network).
+*
+* The overlay tarball does NOT flow through here: `initUpload` returns an
+* external presigned URL the CLI PUTs to directly (data plane).
+*/
+var AuthenticationError = class extends Error {
+	constructor(message = "Invalid or expired token. Run `kici login` to authenticate.") {
+		super(message);
+		this.name = "AuthenticationError";
+	}
+};
+var AccessDeniedError = class extends Error {
+	constructor(message = "Access denied") {
+		super(message);
+		this.name = "AccessDeniedError";
+	}
+};
+var NotFoundError = class extends Error {
+	constructor(message = "Resource not found") {
+		super(message);
+		this.name = "NotFoundError";
+	}
+};
+var ConnectionError = class extends Error {
+	endpoint;
+	constructor(message, endpoint) {
+		super(message);
+		this.endpoint = endpoint;
+		this.name = "ConnectionError";
+	}
+};
+/**
+* Thrown when the org has more than one connected orchestrator cluster and the
+* developer did not pick one (no `--orchestrator` flag, no per-org default).
+* Carries the list of connected cluster names so the CLI can print the choice.
+*/
+var AmbiguousClusterError = class extends Error {
+	clusters;
+	constructor(clusters, message = "Multiple orchestrator clusters are connected — pass --orchestrator <name>") {
+		super(message);
+		this.clusters = clusters;
+		this.name = "AmbiguousClusterError";
+	}
+};
+/** Thrown when the org has no connected orchestrator cluster. */
+var NoClusterError = class extends Error {
+	constructor(message = "No orchestrator is connected for this organization.") {
+		super(message);
+		this.name = "NoClusterError";
+	}
+};
+/**
+* Append the cluster-targeting query params the Platform routes understand:
+* `?orchestrator=<cluster>` (explicit pick) and `?defaultCluster=<cluster>`
+* (the CLI's per-org default). Either may be omitted to let the Platform
+* sole-select or return a 422 with the cluster list.
+*/
+function clusterQuery(orchestrator, defaultCluster) {
+	const params = new URLSearchParams();
+	if (orchestrator) params.set("orchestrator", orchestrator);
+	if (defaultCluster) params.set("defaultCluster", defaultCluster);
+	const q = params.toString();
+	return q ? `?${q}` : "";
+}
+/**
+* Client for the Platform's `/api/v1/orgs/:orgId/test/*` relay routes.
+*/
+var PlatformRunClient = class {
+	baseUrl;
+	token;
+	constructor(config) {
+		this.baseUrl = config.platformEndpoint.replace(/\/+$/, "");
+		this.token = config.token;
+	}
+	/** POST /test/uploads/init — mint an external presigned upload URL. */
+	async initUpload(orgId, target, body) {
+		const path = `/api/v1/orgs/${orgId}/test/uploads/init${clusterQuery(target.orchestrator, target.defaultCluster)}`;
+		return await (await this.request(path, {
+			method: "POST",
+			body: JSON.stringify(body)
+		})).json();
+	}
+	/** POST /test/trigger — trigger a remote run. */
+	async trigger(orgId, target, body) {
+		const path = `/api/v1/orgs/${orgId}/test/trigger${clusterQuery(target.orchestrator, target.defaultCluster)}`;
+		return await (await this.request(path, {
+			method: "POST",
+			body: JSON.stringify(body)
+		})).json();
+	}
+	/** GET /test/runs/:runId — run-status snapshot. */
+	async runStatus(orgId, runId, target = {}) {
+		const path = `/api/v1/orgs/${orgId}/test/runs/${runId}${clusterQuery(target.orchestrator, target.defaultCluster)}`;
+		return await (await this.request(path, { method: "GET" })).json();
+	}
+	/** GET /test/runs/:runId/logs?cursor=<n> — next log chunk from a cursor. */
+	async runLogs(orgId, runId, cursor, target = {}) {
+		const params = new URLSearchParams();
+		params.set("cursor", String(cursor));
+		if (target.orchestrator) params.set("orchestrator", target.orchestrator);
+		if (target.defaultCluster) params.set("defaultCluster", target.defaultCluster);
+		const path = `/api/v1/orgs/${orgId}/test/runs/${runId}/logs?${params.toString()}`;
+		return await (await this.request(path, { method: "GET" })).json();
+	}
+	/** POST /test/runs/:runId/cancel — cancel a run. */
+	async cancel(orgId, runId, target = {}) {
+		const path = `/api/v1/orgs/${orgId}/test/runs/${runId}/cancel${clusterQuery(target.orchestrator, target.defaultCluster)}`;
+		return await (await this.request(path, {
+			method: "POST",
+			body: JSON.stringify({})
+		})).json();
+	}
+	/**
+	* Make a PAT-authenticated request to the Platform.
+	*
+	* Classifies errors: 401 → AuthenticationError, 403 → AccessDeniedError,
+	* 404 → NotFoundError, 422 ambiguous_cluster → AmbiguousClusterError,
+	* 422 no_cluster → NoClusterError. Network failures → ConnectionError.
+	*/
+	async request(path, init) {
+		const url = `${this.baseUrl}${path}`;
+		let response;
+		try {
+			response = await fetch(url, {
+				...init,
+				headers: {
+					"Content-Type": "application/json",
+					Authorization: `Bearer ${this.token}`,
+					...init.headers
+				}
+			});
+		} catch (err) {
+			throw new ConnectionError(`Failed to connect to the Platform at ${this.baseUrl}: ${toErrorMessage(err)}`, this.baseUrl);
+		}
+		if (response.ok) return response;
+		await this.throwForStatus(response);
+		return response;
+	}
+	/** Map a non-OK Platform response to a typed error. Always throws. */
+	async throwForStatus(response) {
+		if (response.status === 401) throw new AuthenticationError();
+		if (response.status === 403) throw new AccessDeniedError(await readError(response, "Access denied"));
+		if (response.status === 404) throw new NotFoundError(await readError(response, "Resource not found"));
+		if (response.status === 422) {
+			const body = await readJson(response);
+			if (body.error === "ambiguous_cluster") throw new AmbiguousClusterError(body.clusters ?? [], body.message);
+			if (body.error === "no_cluster") throw new NoClusterError(body.message);
+			throw new Error(body.reason ?? body.message ?? body.error ?? "Request rejected (422)");
+		}
+		throw new Error(`Request failed with status ${response.status}: ${await readError(response, "")}`);
+	}
+};
+/** Read a JSON body, returning `{}` on any parse failure. */
+async function readJson(response) {
+	try {
+		return await response.json();
+	} catch {
+		return {};
+	}
+}
+/** Read the `error` field of a JSON body, falling back to text then a default. */
+async function readError(response, fallback) {
+	try {
+		const body = await response.clone().json();
+		if (body.error) return body.error;
+		if (body.message) return body.message;
+	} catch {}
+	try {
+		const text = await response.text();
+		if (text) return text;
+	} catch {}
+	return fallback;
+}
+//#endregion
+export { AccessDeniedError, AmbiguousClusterError, AuthenticationError, ConnectionError, NoClusterError, NotFoundError, PlatformRunClient };
+
+//# sourceMappingURL=platform-client.js.map

package/dist/remote/prod-defaults.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 //#region src/remote/prod-defaults.ts
 /**
 * Production defaults for the `kici login` OAuth flow. When the matching