@kici-dev/compiler 0.1.18 → 0.1.20

package/dist/cli.js

@@ -6,7 +6,7 @@ import { resolve } from "node:path";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.18";
+const version = "0.1.20";
 /**
 * Build the kici Commander program with every command registered. Exported so
 * the surface registry can walk the real command tree without parsing argv (no

package/dist/llm-context/llms-full.txt

@@ -488,6 +488,8 @@ Source: https://docs.kici.dev/user/quickstart/
 
 KiCI offers two equally-supported quickstart paths. Pick the one that fits your machine — both end with the same working pipeline (orchestrator + agent + your first workflow run visible in the dashboard).
 
+Each guide is split into two parts. **Part 1** gets you a green run against your own orchestrator with `kici run remote` — no GitHub App needed, just sign up, bring up the stack, and run. **Part 2** then wires up real GitHub pushes so your team's commits trigger runs automatically. You can stop after Part 1 and come back to Part 2 whenever you're ready.
+
 ## Option A — Docker / Podman (recommended)
 
 Two containers brought up with `docker compose up -d` (orchestrator + PostgreSQL), plus one short-lived agent container spawned per job by the container scaler. Minimal host setup, perfect for a laptop, home server, or a tiny VM. No need to install PostgreSQL or any other system service.
@@ -502,12 +504,13 @@ Native systemd services managed by `kici-admin orchestrator install` / `kici-adm
 
 ## Which should I pick?
 
-|                   | Docker / Podman                          | Bare metal                                                                            |
-| ----------------- | ---------------------------------------- | ------------------------------------------------------------------------------------- |
-| Host requirements | `docker` or `podman` with compose v2.20+ | systemd, Node.js 24+, PostgreSQL 18 (container — needs `docker`/`podman` — or native) |
-| Time to first run | ~5 minutes                               | ~10 minutes                                                                           |
-| Upgrades          | `docker compose pull` + restart          | `kici-admin orchestrator restart` after `npm install -g kici-admin@latest`            |
-| Best for          | Quick evaluation, ephemeral hosts        | Long-lived production hosts                                                           |
+|                           | Docker / Podman                          | Bare metal                                                                            |
+| ------------------------- | ---------------------------------------- | ------------------------------------------------------------------------------------- |
+| Host requirements         | `docker` or `podman` with compose v2.20+ | systemd, Node.js 24+, PostgreSQL 18 (container — needs `docker`/`podman` — or native) |
+| First local run (Part 1)  | ~5 minutes                               | ~10 minutes                                                                           |
+| First GitHub run (Part 2) | + ~10 minutes                            | + ~10 minutes                                                                         |
+| Upgrades                  | `docker compose pull` + restart          | `kici-admin orchestrator restart` after `npm install -g kici-admin@latest`            |
+| Best for                  | Quick evaluation, ephemeral hosts        | Long-lived production hosts                                                           |
 
 If you're not sure, pick Docker / Podman.
 
@@ -5750,7 +5753,8 @@ kici login [options]
 | --------------------------- | ------- | ---------------------------------------------- |
 | `--token <key>`             | none    | API key for direct authentication (legacy)     |
 | `--device`                  | false   | Force device authorization flow (headless/SSH) |
-| `--platform-endpoint <url>` | none    | Platform API base URL                          |
+| `--platform-endpoint <url>` | none    | Platform relay URL                             |
+| `--routing-key <key>`       | none    | Routing key for webhook source identification  |
 
 **Environment variables:**
 
@@ -6039,11 +6043,10 @@ kici approve <run-id> [options]
 
 **Options:**
 
-| Option            | Default | Description                                         |
-| ----------------- | ------- | --------------------------------------------------- |
-| `--job <name>`    | none    | Approve a held job (omit for a workflow-level hold) |
-| `--step <name>`   | none    | Approve a held step (used with `--job`)             |
-| `--reason <text>` | none    | Optional note recorded with the approval            |
+| Option           | Default | Description                                          |
+| ---------------- | ------- | ---------------------------------------------------- |
+| `--job <name>`   | none    | Approve a held job (omit for a workflow-level hold)  |
+| `--step <index>` | none    | Approve a held step by its index (used with `--job`) |
 
 **Examples:**
 
@@ -6054,8 +6057,8 @@ kici approve abc123
 # Approve a held job
 kici approve abc123 --job deploy-production
 
-# Approve a held step
-kici approve abc123 --job migrate-and-deploy --step apply-migration
+# Approve a held step (steps are addressed by index)
+kici approve abc123 --job migrate-and-deploy --step 1
 ```
 
 You must be eligible for at least one unsatisfied clause (a member of a named team, or a named user) and hold the `environments:write` or `ci_trust:write` permission. The command reports whether the element was released, how many clauses remain, or that it was rejected.
@@ -6076,11 +6079,11 @@ kici reject <run-id> --reason <text> [options]
 
 **Options:**
 
-| Option            | Default | Description                                        |
-| ----------------- | ------- | -------------------------------------------------- |
-| `--reason <text>` | none    | Required. Reason recorded with the rejection       |
-| `--job <name>`    | none    | Reject a held job (omit for a workflow-level hold) |
-| `--step <name>`   | none    | Reject a held step (used with `--job`)             |
+| Option            | Default | Description                                         |
+| ----------------- | ------- | --------------------------------------------------- |
+| `--reason <text>` | none    | Required. Reason recorded with the rejection        |
+| `--job <name>`    | none    | Reject a held job (omit for a workflow-level hold)  |
+| `--step <index>`  | none    | Reject a held step by its index (used with `--job`) |
 
 **Examples:**
 
@@ -6094,15 +6097,9 @@ kici reject abc123 --job deploy-production --reason "Wrong release branch"
 List secret contexts available for test runs. Shows context names and key names (not values).
 
 ```bash
-kici secrets list [options]
+kici secrets list
 ```
 
-**Options:**
-
-| Option             | Default | Description               |
-| ------------------ | ------- | ------------------------- |
-| `--endpoint <url>` | none    | Orchestrator URL override |
-
 Each "context" corresponds to an environment configured on the orchestrator. The output lists every environment whose `allowLocalExecution` flag is `true` (the gate that lets CLI-initiated test runs resolve secrets through that environment), along with the secret key names reachable from the environment's bound scopes.
 
 Only key names are shown — secret values are never returned over this endpoint.
@@ -6119,10 +6116,9 @@ kici types [options]
 
 **Options:**
 
-| Option              | Default | Description               |
-| ------------------- | ------- | ------------------------- |
-| `--kici-dir <path>` | `.kici` | Path to .kici directory   |
-| `--endpoint <url>`  | none    | Orchestrator URL override |
+| Option              | Default | Description             |
+| ------------------- | ------- | ----------------------- |
+| `--kici-dir <path>` | `.kici` | Path to .kici directory |
 
 **Prerequisites:** Must be authenticated via `kici login`.
 
@@ -6136,9 +6132,6 @@ kici types
 
 # Use custom .kici directory
 kici types --kici-dir packages/app/.kici
-
-# Override orchestrator endpoint
-kici types --endpoint https://my-orchestrator.example.com
 ```
 
 **How it works:**
@@ -9266,7 +9259,8 @@ Each row shows:
   attestation's signature, the build identity, and the build context against the
   trusted provenance issuer. **verified** (green) means all of those pass;
   **failed** (red) shows why in a tooltip; **unverifiable** means the provenance
-  issuer is not configured.
+  issuer is not configured; **keys unavailable** (amber) means the issuer is
+  configured but its verification keys could not be fetched.
 - **Job / Artifact / Digest / Created** — the producing job, the artifact name,
   its content digest, and when it was recorded.
 - **Download** — saves the signed bundle as a `.sigstore.json` file.

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../chunk-BTugEXQM.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.18";
+const sdkVersion = "0.1.20";
 /**
 * Generate package.json content for .kici/ directory
 *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -63,11 +63,11 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.18",
-    "@kici-dev/engine": "0.1.18"
+    "@kici-dev/core": "0.1.20",
+    "@kici-dev/engine": "0.1.20"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.1.18"
+    "@kici-dev/sdk": "0.1.20"
   },
   "devDependencies": {
     "@types/proper-lockfile": "^4.1.4"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/compiler@0.1.18",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.18/c81ae2fd-a2fb-482c-99f7-a6fbbf7c4b39",
+  "name": "@kici-dev/compiler@0.1.20",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.20/dcfb0710-aa54-40ea-92e0-1c5c347cf9bf",
   "creationInfo": {
-    "created": "2026-06-17T10:55:55Z",
+    "created": "2026-06-19T09:07:23Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -484,7 +484,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/compiler",
-      "versionInfo": "0.1.18",
+      "versionInfo": "0.1.20",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -495,16 +495,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.18"
+          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.20"
         }
       ],
       "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.20",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.18",
+      "versionInfo": "0.1.20",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -515,16 +515,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.18"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.20"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.18",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.20",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.18",
+      "versionInfo": "0.1.20",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -535,16 +535,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.18"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.20"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.18",
+      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.20",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.18",
+      "versionInfo": "0.1.20",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -555,7 +555,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.18"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.20"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
@@ -3222,17 +3222,17 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.20",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.18",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.20",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.18",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.20",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -3301,82 +3301,82 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.18",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.20",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.20",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.18",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.20",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.20",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-micromatch-4.0.8",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.18",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.20",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },