@kici-dev/compiler 0.1.17 → 0.1.18

package/dist/llm-context/llms.txt

@@ -25,6 +25,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 - [Event payload reference](https://docs.kici.dev/user/sdk/event-payloads/): Generated schema of the normalized event envelope passed to rules and dynamic functions.
 - [SDK reference: idempotent](https://docs.kici.dev/user/sdk/idempotent/): Idempotent helpers for declarative check / apply patterns inside workflow steps
 - [SDK reference: rules, matrix, dynamic jobs](https://docs.kici.dev/user/sdk/rules-matrix-dynamic/): rule(), skip(), matrix builds (static + dynamic), and dynamicJob / dynamicGroup
+- [SDK reference: runsOnAll host fan-out](https://docs.kici.dev/user/sdk/runs-on-all/): Fan one job out to every matching connected host, one pinned execution per host
 - [SDK reference: runtime](https://docs.kici.dev/user/sdk/runtime/): Types index, StepContext, secrets, fixtures
 - [SDK reference: triggers](https://docs.kici.dev/user/sdk/triggers/): GitHub event triggers, kiciEvent, workflowComplete, jobComplete, genericWebhook, schedule, lifecycle
 - [SDK reference: validation & events](https://docs.kici.dev/user/sdk/validation-events/): validateDag(), event definitions, and event emission
@@ -45,7 +46,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 - [Account and sign-in](https://docs.kici.dev/user/account-and-login/): How your KiCI account relates to sign-in methods, and how to change the way you sign in.
 - [Approval gates](https://docs.kici.dev/user/approvals/): Pause a workflow for human sign-off at step, job, or workflow granularity with requireApproval
 - [Concurrency groups](https://docs.kici.dev/user/concurrency/): Control parallel execution with auto-cancel and queue modes
-- [Dashboard](https://docs.kici.dev/user/dashboard/)
+- [Dashboard](https://docs.kici.dev/user/dashboard/): Web UI for monitoring workflow runs, managing sources, secrets, and organization settings.
 - [Dynamic values](https://docs.kici.dev/user/dynamic-values/)
 - [Environment variables](https://docs.kici.dev/user/env-vars/): KICI_* environment variable reference for the CLI
 - [Environments](https://docs.kici.dev/user/environments/): Configure deployment environments with variables, secrets, and protection rules

package/dist/local-executor/job-runner.js

@@ -3,6 +3,7 @@ import { ensureTsLoaderHook } from "../execution/ts-loader.js";
 import { formatter } from "../test-runner/output-formatter.js";
 import { createStepContext } from "../test-runner/step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "../test-runner/rule-evaluator.js";
+import { localRunsOnString } from "./runs-on-display.js";
 import { toEventPayload } from "./to-event-payload.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
@@ -135,7 +136,7 @@ async function resolveStaticJob(job, expansionMap) {
 				workflow: { name: "" },
 				job: {
 					name: job.name,
-					runsOn: job.runsOn
+					runsOn: localRunsOnString(job.runsOn)
 				}
 			},
 			log: {
@@ -235,7 +236,7 @@ async function executeResolvedJobInner(resolvedJob, context, startTime) {
 	const repoRoot = context.execDir;
 	const stepCtx = createStepContext({ name: context.workflowName }, {
 		name: expandedName,
-		runsOn: typeof job.runsOn === "string" ? job.runsOn : Array.isArray(job.runsOn) ? job.runsOn.join(",") : (Array.isArray(job.runsOn.labels) ? job.runsOn.labels : [job.runsOn.labels]).join(",")
+		runsOn: localRunsOnString(job.runsOn)
 	}, repoRoot, void 0, hasMatrix ? matrixValues : void 0, context.secrets, void 0, context.event.payload, context.event.provider);
 	const stepResults = [];
 	let stepCounter = 0;

package/dist/local-executor/runs-on-display.d.ts

@@ -0,0 +1,9 @@
+import type { RunsOn } from '@kici-dev/sdk';
+/**
+ * Render a job's `runsOn` to the comma-joined label string the local/test
+ * runners surface as `ctx.job.runsOn`. A `runsOnAll` job has no `runsOn` —
+ * locally it runs once on this machine, so we surface the marker `'runsOnAll'`.
+ * RegExp selectors render via their `/source/flags` literal.
+ */
+export declare function localRunsOnString(runsOn: RunsOn | undefined): string;
+//# sourceMappingURL=runs-on-display.d.ts.map

package/dist/local-executor/runs-on-display.js

@@ -0,0 +1,23 @@
+import "../chunk-BTugEXQM.js";
+//#region src/local-executor/runs-on-display.ts
+/** Render one selector element (string label or RegExp) for the local display string. */
+function runsOnElementString(el) {
+	return el instanceof RegExp ? el.toString() : el;
+}
+/**
+* Render a job's `runsOn` to the comma-joined label string the local/test
+* runners surface as `ctx.job.runsOn`. A `runsOnAll` job has no `runsOn` —
+* locally it runs once on this machine, so we surface the marker `'runsOnAll'`.
+* RegExp selectors render via their `/source/flags` literal.
+*/
+function localRunsOnString(runsOn) {
+	if (runsOn === void 0) return "runsOnAll";
+	if (typeof runsOn === "string") return runsOn;
+	if (runsOn instanceof RegExp) return runsOn.toString();
+	if (Array.isArray(runsOn)) return runsOn.map(runsOnElementString).join(",");
+	return (Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels]).map(runsOnElementString).join(",");
+}
+//#endregion
+export { localRunsOnString };
+
+//# sourceMappingURL=runs-on-display.js.map

package/dist/lockfile/generator.d.ts

@@ -20,6 +20,8 @@ export declare function detectGitRoot(): string;
  * `.kici/` and keyed on `.kici/yarn.lock`. The hash input is prefixed with the
  * manager name so two managers can never collide on identical lockfile bytes
  * (and a restored tree can never be the wrong layout for the agent's manager).
+ * For yarn the prefix also carries the flavor (`yarn-classic` / `yarn-berry`),
+ * so a classic-layout dep-cache tarball is never restored into a berry install.
  *
  * @param gitRoot - Absolute path to git repository root
  * @returns Hex SHA-256 hash string, or null if no lockfile is found

package/dist/lockfile/generator.js

@@ -5,10 +5,11 @@ import { resolveHashFiles } from "./hash-files.js";
 import { analyzePurity } from "./purity-analyzer.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
-import { getDynamicJobGroup, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeCacheSpecs, normalizeRequireApproval } from "@kici-dev/sdk";
+import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeCacheSpecs, normalizeRequireApproval } from "@kici-dev/sdk";
 import { sha256 } from "@kici-dev/core";
-import { PackageManager, detectPackageManagerSync } from "@kici-dev/core/package-manager";
+import { PackageManager, detectPackageManagerSync, detectYarnFlavorSync } from "@kici-dev/core/package-manager";
 import { validateResourceRequest } from "@kici-dev/engine";
+import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
 import { execSync } from "node:child_process";
 //#region src/lockfile/generator.ts
 /**
@@ -44,15 +45,18 @@ function detectGitRoot() {
 * `.kici/` and keyed on `.kici/yarn.lock`. The hash input is prefixed with the
 * manager name so two managers can never collide on identical lockfile bytes
 * (and a restored tree can never be the wrong layout for the agent's manager).
+* For yarn the prefix also carries the flavor (`yarn-classic` / `yarn-berry`),
+* so a classic-layout dep-cache tarball is never restored into a berry install.
 *
 * @param gitRoot - Absolute path to git repository root
 * @returns Hex SHA-256 hash string, or null if no lockfile is found
 */
 function computeLockfileHash(gitRoot) {
 	const pm = detectPackageManagerSync(gitRoot) === PackageManager.Npm ? detectPackageManagerSync(path.join(gitRoot, ".kici")) : detectPackageManagerSync(gitRoot);
-	const candidates = pm === PackageManager.Pnpm ? [path.join(gitRoot, "pnpm-lock.yaml")] : pm === PackageManager.Yarn ? [path.join(gitRoot, "yarn.lock"), path.join(gitRoot, ".kici", "yarn.lock")] : [path.join(gitRoot, ".kici", "package-lock.json")];
+	const candidates = pm === PackageManager.Pnpm ? [path.join(gitRoot, "pnpm-lock.yaml"), path.join(gitRoot, ".kici", "pnpm-lock.yaml")] : pm === PackageManager.Yarn ? [path.join(gitRoot, "yarn.lock"), path.join(gitRoot, ".kici", "yarn.lock")] : [path.join(gitRoot, ".kici", "package-lock.json")];
+	const prefix = pm === PackageManager.Yarn ? `${pm}-${detectYarnFlavorSync(detectPackageManagerSync(gitRoot) === PackageManager.Yarn ? gitRoot : path.join(gitRoot, ".kici"))}` : pm;
 	for (const lockfilePath of candidates) try {
-		return sha256(`${pm}\n${readFileSync(lockfilePath, "utf-8")}`);
+		return sha256(`${prefix}\n${readFileSync(lockfilePath, "utf-8")}`);
 	} catch {}
 	return null;
 }
@@ -422,13 +426,19 @@ function transformJobs(jobs, configPath, gitRoot) {
 	return jobs.map((jobOrFactory, index) => {
 		if (isDynamicJobFn(jobOrFactory)) {
 			const groupName = getDynamicJobGroup(jobOrFactory);
+			const declaredNeeds = getDynamicJobNeeds(jobOrFactory);
+			const resolvedNeeds = declaredNeeds ? resolveNeedsForLock(declaredNeeds, uuidToName) : void 0;
 			return {
 				_type: "dynamic",
 				source: {
 					file: configPath,
 					index
 				},
-				...groupName && { group: groupName }
+				...groupName && { group: groupName },
+				...resolvedNeeds && {
+					needs: resolvedNeeds.needs,
+					resultAware: true
+				}
 			};
 		}
 		const j = jobOrFactory;
@@ -440,19 +450,15 @@ function transformJobs(jobs, configPath, gitRoot) {
 	});
 }
 /**
-* Normalize SDK runsOn into lock file representation.
-* - String passthrough: `'linux'` -> `{ runsOn: 'linux' }`
-* - Array passthrough: `['linux', 'docker']` -> `{ runsOn: ['linux', 'docker'] }`
-* - Object form: `{ labels: ['linux'], exclude: ['gpu'] }` -> `{ runsOn: ['linux'], excludeLabels: ['gpu'] }`
+* Normalize SDK runsOn into lock file matchers.
+* Plain strings stay exact; globs convert to regex; RegExp literals become regex.
+* Throws (via the engine ReDoS gate) on a ReDoS-prone author regex.
 */
-function normalizeRunsOnForLock(runsOn) {
-	if (typeof runsOn === "string") return { runsOn };
-	if (Array.isArray(runsOn)) return { runsOn };
-	const labels = Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels];
-	const exclude = runsOn.exclude ? Array.isArray(runsOn.exclude) ? runsOn.exclude : [runsOn.exclude] : void 0;
+function normalizeRunsOnForLock(runsOn, jobName) {
+	const { include, exclude } = normalizeRunsOnToMatchers(runsOn, `job '${jobName}' runsOn`);
 	return {
-		runsOn: labels.length === 1 ? labels[0] : labels,
-		...exclude && exclude.length > 0 ? { excludeLabels: exclude } : {}
+		runsOn: include,
+		...exclude.length > 0 ? { excludeLabels: exclude } : {}
 	};
 }
 /**
@@ -463,19 +469,26 @@ function normalizeRunsOnForLock(runsOn) {
 * targeting a `kici:os:linux` / `kici:role:builder` label is benign. The forgery
 * boundary is label *setting* (scaler labelSet validation + the agent
 * register-time scope gate), which is enforced elsewhere and unaffected here.
+*
+* The overlap check compares exact matchers only — a glob/regex include and an
+* exact exclude (or vice versa) cannot be statically known to overlap.
 */
 function validateRunsOn(runsOn, jobName) {
-	if (typeof runsOn === "string" || Array.isArray(runsOn)) return;
-	const labels = Array.isArray(runsOn.labels) ? runsOn.labels : [runsOn.labels];
-	const exclude = runsOn.exclude ? Array.isArray(runsOn.exclude) ? runsOn.exclude : [runsOn.exclude] : [];
-	const overlap = labels.filter((l) => exclude.includes(l));
+	const { include, exclude } = normalizeRunsOnToMatchers(runsOn, `job '${jobName}' runsOn`);
+	const includeExact = new Set(include.filter((m) => m.kind === "exact").map((m) => m.value));
+	const overlap = exclude.filter((m) => m.kind === "exact").map((m) => m.value).filter((v) => includeExact.has(v));
 	if (overlap.length > 0) throw new Error(`Job "${jobName}": labels and exclude overlap on [${overlap.join(", ")}]. A label cannot be both required and excluded.`);
 }
 /**
 * Transform a static job to lock file format.
 */
 function transformJob(job, configPath, index, gitRoot, uuidToName) {
-	validateRunsOn(job.runsOn, job.name);
+	if (job.runsOn !== void 0 && job.runsOnAll !== void 0) throw new Error(`job '${job.name}': runsOn and runsOnAll are mutually exclusive`);
+	if (job.runsOn === void 0 && job.runsOnAll === void 0) throw new Error(`job '${job.name}': one of runsOn or runsOnAll is required`);
+	if (job.onUnreachable !== void 0 && job.runsOnAll === void 0) console.warn(`[kici] job '${job.name}': onUnreachable is ignored without runsOnAll`);
+	if (job.maxParallel !== void 0 && job.maxParallel < 1) throw new Error(`job '${job.name}': maxParallel must be >= 1`);
+	if (!(job.matrix !== void 0 || job.runsOnAll !== void 0) && (job.maxParallel !== void 0 || job.failFast !== void 0)) console.warn(`[kici] job '${job.name}': maxParallel/failFast are ignored without matrix or runsOnAll (no fan-out to bound)`);
+	if (job.runsOn !== void 0) validateRunsOn(job.runsOn, job.name);
 	const environmentFields = {};
 	if (job.environment !== void 0) {
 		if (typeof job.environment === "function") {
@@ -524,7 +537,11 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 	return {
 		_type: "static",
 		name: job.name,
-		...normalizeRunsOnForLock(job.runsOn),
+		...job.runsOn !== void 0 ? normalizeRunsOnForLock(job.runsOn, job.name) : {},
+		...job.runsOnAll !== void 0 && { runsOnAll: normalizeRunsOnAllToMatchers(job.runsOnAll, `job '${job.name}' runsOnAll`) },
+		...job.onUnreachable !== void 0 && { onUnreachable: job.onUnreachable },
+		...job.maxParallel !== void 0 && { maxParallel: job.maxParallel },
+		...job.failFast !== void 0 && { failFast: job.failFast },
 		...resolveNeedsForLock(job.needs, uuidToName),
 		steps: transformSteps(job.steps, gitRoot),
 		matrix: job.matrix ? transformMatrix(job.matrix, job.name, configPath) : void 0,

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../chunk-BTugEXQM.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.17";
+const sdkVersion = "0.1.18";
 /**
 * Generate package.json content for .kici/ directory
 *

package/dist/test-runner/job-executor.js

@@ -2,6 +2,7 @@ import "../chunk-BTugEXQM.js";
 import { formatter } from "./output-formatter.js";
 import { createStepContext } from "./step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "./rule-evaluator.js";
+import { localRunsOnString } from "../local-executor/runs-on-display.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
 import pc from "picocolors";
@@ -94,7 +95,7 @@ async function executeJob(job, workflowName, event, repoRoot, testSecrets, sdkSe
 	setStepRefMap(refMap);
 	const ctx = createStepContext({ name: workflowName }, {
 		name: job.name,
-		runsOn: typeof job.runsOn === "string" ? job.runsOn : Array.isArray(job.runsOn) ? job.runsOn.join(",") : (Array.isArray(job.runsOn.labels) ? job.runsOn.labels : [job.runsOn.labels]).join(",")
+		runsOn: localRunsOnString(job.runsOn)
 	}, repoRoot, void 0, void 0, testSecrets, void 0, event.payload, event.provider);
 	let stepCounter = 0;
 	for (const stepOrFn of job.steps) {

package/dist/types.d.ts

@@ -12,7 +12,7 @@
  * v15 adds per-job init config(s).
  * v17 widens per-job init to typed presets ('mise' / { mise }) and 'auto' detection.
  */
-import type { ResourceRequest, ApproverClause } from '@kici-dev/engine';
+import type { ResourceRequest, ApproverClause, RunsOnAllPredicate, OnUnreachableMode, LabelMatcher } from '@kici-dev/engine';
 /**
  * Normalized approval config carried in the lock file. Mirrors the engine
  * `LockApproval` type. Produced by the compiler from an SDK `requireApproval`.
@@ -23,7 +23,7 @@ export interface LockApproval {
     readonly timeoutSeconds?: number;
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 17;
+export declare const SCHEMA_VERSION: 20;
 /**
  * Source file reference with meaningful path.
  * Format: file is relative path from git root, export uses hash syntax.
@@ -371,8 +371,17 @@ export interface LockNeedsGroupEntry {
 export interface LockJob {
     readonly _type: 'static';
     readonly name: string;
-    readonly runsOn: string | readonly string[];
-    readonly excludeLabels?: readonly string[];
+    /** Single-agent targeting matchers. Absent when the job uses runsOnAll instead. */
+    readonly runsOn?: readonly LabelMatcher[];
+    readonly excludeLabels?: readonly LabelMatcher[];
+    /** Host fan-out predicate (mutually exclusive with runsOn). */
+    readonly runsOnAll?: RunsOnAllPredicate;
+    /** Failure policy for unreachable durable hosts in a runsOnAll fan-out. */
+    readonly onUnreachable?: OnUnreachableMode;
+    /** Fan-out concurrency width (sliding window; 1 = serial). Applies to matrix and runsOnAll. */
+    readonly maxParallel?: number;
+    /** Halt the fan-out on first child failure, skipping the held remainder. Default false. */
+    readonly failFast?: boolean;
     readonly needs: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
     /** Group names this job depends on (populated from dynamicGroup refs). */
     readonly dependsOnGroups?: readonly string[];
@@ -448,6 +457,15 @@ export interface LockDynamicJobFn {
     };
     /** Group name for cross-domain needs (set when dynamicJob('name', fn) is used). */
     readonly group?: string;
+    /**
+     * Declared upstream needs for a result-aware generator. When present the
+     * generator's eval job is deferred until these upstreams complete, then run
+     * with their frozen outputs available as ctx.needs. Same normalized shape as
+     * a static job's `needs`.
+     */
+    readonly needs?: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
+    /** True when this dynamic entry was authored as dynamicJob(group, { needs, generate }). */
+    readonly resultAware?: boolean;
 }
 /** Job or dynamic job generator */
 export type LockJobOrFactory = LockJob | LockDynamicJobFn;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -49,25 +49,25 @@
     "./cli": "./dist/cli.js"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.4.2",
+    "@inquirer/prompts": "^8.5.2",
     "chokidar": "^5.0.0",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "fast-glob": "^3.3.3",
     "open": "^11.0.0",
     "picocolors": "^1.1.1",
     "picomatch": "^4.0.4",
     "proper-lockfile": "^4.1.2",
-    "tar": "^7.5.13",
+    "tar": "^7.5.16",
     "typescript": "^6.0.3",
-    "ws": "^8.20.0",
-    "yaml": "^2.8.3",
-    "zod": "^4.3.6",
+    "ws": "^8.21.0",
+    "yaml": "^2.9.0",
+    "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.17",
-    "@kici-dev/engine": "0.1.17"
+    "@kici-dev/core": "0.1.18",
+    "@kici-dev/engine": "0.1.18"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.1.17"
+    "@kici-dev/sdk": "0.1.18"
   },
   "devDependencies": {
     "@types/proper-lockfile": "^4.1.4"