@kici-dev/compiler 0.1.21 → 0.1.22

package/dist/local-executor/job-runner.js

@@ -145,7 +145,8 @@ async function resolveJobs(workflow, event) {
 					query: () => Promise.resolve([]),
 					get: () => Promise.resolve(null)
 				},
-				oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available during local execution")) }
+				oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available during local execution")) },
+				host: { requestReboot: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.host.requestReboot() is not available during local execution")) }
 			}
 		});
 		for (const genJob of generatedJobs) {

package/dist/lockfile/generator.js

@@ -5,10 +5,10 @@ import { resolveHashFiles } from "./hash-files.js";
 import { analyzePurity } from "./purity-analyzer.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
-import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeCacheSpecs, normalizeRequireApproval } from "@kici-dev/sdk";
+import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeApproval, normalizeCacheSpecs } from "@kici-dev/sdk";
 import { sha256 } from "@kici-dev/core";
 import { PackageManager, detectPackageManagerSync, detectYarnFlavorSync } from "@kici-dev/core/package-manager";
-import { validateResourceRequest } from "@kici-dev/engine";
+import { resolveWhenToRunOn, validateResourceRequest } from "@kici-dev/engine";
 import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
 import { execSync } from "node:child_process";
 //#region src/lockfile/generator.ts
@@ -158,7 +158,7 @@ function transformWorkflow(workflow, sourceFile, exportRef, bundleSource, gitRoo
 			...workflow.concurrency.max !== void 0 && { max: workflow.concurrency.max }
 		} },
 		...workflow.timeout !== void 0 && { timeout: workflow.timeout },
-		...workflow.requireApproval !== void 0 && { approval: toLockApproval(workflow.requireApproval) }
+		...workflow.approval !== void 0 && { approval: (assertNonStepApprovalScope(workflow.approval, "workflow"), toLockApproval(workflow.approval)) }
 	};
 }
 /**
@@ -565,12 +565,13 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 		...job.timeout !== void 0 && { timeout: job.timeout },
 		...job.resources !== void 0 && { resources: job.resources },
 		...job.init !== void 0 && { init: job.init },
-		...job.requireApproval !== void 0 && { approval: toLockApproval(job.requireApproval) }
+		...job.approval !== void 0 && { approval: (assertNonStepApprovalScope(job.approval, "job"), toLockApproval(job.approval)) }
 	};
 }
 /**
 * Resolve needs to lock file format.
-* Handles strings, Job objects, DynamicGroupRef, and object forms with ifFailed policy.
+* Handles strings, Job objects, DynamicGroupRef, and object forms with a `when`
+* run condition (normalized to a `runOn` status-set via the engine helper).
 * Uses the UUID-to-renamed-name mapping so that references to id-less jobs
 * resolve to their lock file names (job-N) instead of the original UUIDs.
 */
@@ -582,26 +583,26 @@ function resolveNeedsForLock(needs, uuidToName) {
 	else if (isDynamicGroupRef(need)) {
 		resolvedNeeds.push({
 			group: need.group,
-			ifFailed: need.ifFailed ?? "skip"
+			runOn: resolveWhenToRunOn(need.when)
 		});
 		groups.push(need.group);
+	} else if ("_tag" in need && need._tag === "Job") {
+		const name = need.name;
+		resolvedNeeds.push(uuidToName?.get(name) ?? name);
 	} else if ("group" in need && typeof need.group === "string") {
 		const g = need;
 		resolvedNeeds.push({
 			group: g.group,
-			ifFailed: g.ifFailed ?? "skip"
+			runOn: resolveWhenToRunOn(g.when)
 		});
 		groups.push(g.group);
-	} else if ("ifFailed" in need && "name" in need) {
+	} else {
 		const n = need;
 		const name = uuidToName?.get(n.name) ?? n.name;
 		resolvedNeeds.push({
 			name,
-			ifFailed: n.ifFailed
+			runOn: resolveWhenToRunOn(n.when)
 		});
-	} else {
-		const name = need.name;
-		resolvedNeeds.push(uuidToName?.get(name) ?? name);
 	}
 	return {
 		needs: resolvedNeeds,
@@ -613,15 +614,31 @@ function resolveNeedsForLock(needs, uuidToName) {
 * Assigns counter-based IDs to unnamed steps (bare functions and id-less steps).
 * Counter only increments for unnamed entries; named steps keep their names.
 */
-/** Map an SDK `requireApproval` to the normalized lock `approval` block. */
-function toLockApproval(r) {
-	const n = normalizeRequireApproval(r);
+/** Map an SDK `approval` to the normalized lock `approval` block. */
+function toLockApproval(c) {
+	const n = normalizeApproval(c);
 	return {
 		clauses: n.clauses,
 		...n.reason !== void 0 && { reason: n.reason },
-		...n.timeoutSeconds !== void 0 && { timeoutSeconds: n.timeoutSeconds }
+		...n.timeoutSeconds !== void 0 && { timeoutSeconds: n.timeoutSeconds },
+		when: n.when
 	};
 }
+/**
+* Validate an approval config at job/workflow scope: `when: 'drift'` is a
+* step-scope-only gate (it fires between a step's check and run), so it is a
+* compile error anywhere else.
+*/
+function assertNonStepApprovalScope(c, scope) {
+	if (normalizeApproval(c).when === "drift") throw new Error(`approval.when "drift" is only valid on steps (found at ${scope} scope)`);
+}
+/**
+* Validate a step's approval config: `when: 'drift'` fires between the step's
+* check and run, so it requires a `check` facet. A compile error otherwise.
+*/
+function assertStepApprovalCheckFacet(step) {
+	if (step.approval !== void 0 && normalizeApproval(step.approval).when === "drift" && step.check === void 0) throw new Error(`step '${step.name || "(unnamed)"}': approval.when "drift" requires a check facet`);
+}
 function transformSteps(steps, gitRoot) {
 	let stepCounter = 0;
 	return steps.map((stepOrFn) => {
@@ -652,7 +669,7 @@ function transformSteps(steps, gitRoot) {
 			...step.cleanup !== void 0 && { hasCleanup: true },
 			...step.check !== void 0 && { hasCheck: true },
 			...step.whenInSync !== void 0 && { hasWhenInSync: true },
-			...step.requireApproval !== void 0 && { approval: toLockApproval(step.requireApproval) }
+			...step.approval !== void 0 && { approval: (assertStepApprovalCheckFacet(step), toLockApproval(step.approval)) }
 		};
 	});
 }

package/dist/remote/config.d.ts

@@ -9,6 +9,8 @@ export interface GlobalConfig {
     endpoint?: string;
     /** Platform relay URL */
     platformEndpoint?: string;
+    /** OIDC issuer URL the PAT was minted against (provenance; from OAuth login) */
+    oidcIssuer?: string;
     /** Routing key for webhook source identification (e.g., 'github:42') */
     routingKey?: string;
     /** Personal access token (from OAuth login) */

package/dist/remote/config.js

@@ -14,6 +14,7 @@ function sanitizeConfig(raw) {
 	if (typeof obj.token === "string") config.token = obj.token;
 	if (typeof obj.endpoint === "string") config.endpoint = obj.endpoint;
 	if (typeof obj.platformEndpoint === "string") config.platformEndpoint = obj.platformEndpoint;
+	if (typeof obj.oidcIssuer === "string") config.oidcIssuer = obj.oidcIssuer;
 	if (typeof obj.routingKey === "string") config.routingKey = obj.routingKey;
 	if (typeof obj.pat === "string") config.pat = obj.pat;
 	if (typeof obj.patId === "string") config.patId = obj.patId;

package/dist/remote/platform-client.d.ts

@@ -10,7 +10,7 @@
  * The overlay tarball does NOT flow through here: `initUpload` returns an
  * external presigned URL the CLI PUTs to directly (data plane).
  */
-import type { CheckMode } from '@kici-dev/engine';
+import type { CheckMode, HostTargetSelector } from '@kici-dev/engine';
 export declare class AuthenticationError extends Error {
     constructor(message?: string);
 }
@@ -77,6 +77,11 @@ export interface PlatformTriggerInput {
      * agent step loop in the requested mode. Omitted means `apply`.
      */
     checkMode?: CheckMode;
+    /**
+     * Host narrowing from `kici run --target`. The Platform relays it verbatim to
+     * the orchestrator, which intersects each runsOnAll roster with it.
+     */
+    target?: HostTargetSelector;
 }
 export interface PlatformTriggerResponse {
     runId: string;

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../chunk-BTugEXQM.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.21";
+const sdkVersion = "0.1.22";
 /**
 * Generate package.json content for .kici/ directory
 *

package/dist/test-runner/step-context.js

@@ -137,7 +137,8 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 				query: () => Promise.resolve([]),
 				get: () => Promise.resolve(null)
 			},
-			oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available in the local test runner")) }
+			oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available in the local test runner")) },
+			host: { requestReboot: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.host.requestReboot() is not available in the local test runner")) }
 		},
 		cache: {
 			restore: async () => ({ hit: false }),

package/dist/types.d.ts

@@ -12,18 +12,23 @@
  * v15 adds per-job init config(s).
  * v17 widens per-job init to typed presets ('mise' / { mise }) and 'auto' detection.
  */
-import type { ResourceRequest, ApproverClause, RunsOnAllPredicate, OnUnreachableMode, LabelMatcher } from '@kici-dev/engine';
+import type { ResourceRequest, ApproverClause, RunsOnAllPredicate, OnUnreachableMode, LabelMatcher, ExecutionJobStatus } from '@kici-dev/engine';
 /**
  * Normalized approval config carried in the lock file. Mirrors the engine
- * `LockApproval` type. Produced by the compiler from an SDK `requireApproval`.
+ * `LockApproval` type. Produced by the compiler from an SDK `approval` config.
  */
 export interface LockApproval {
     readonly clauses: ApproverClause[];
     readonly reason?: string;
     readonly timeoutSeconds?: number;
+    /**
+     * When the gate fires. `always` (default) gates before the element; `drift`
+     * gates between a step's check and run on detected drift (step scope only).
+     */
+    readonly when: 'always' | 'drift';
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 21;
+export declare const SCHEMA_VERSION: 22;
 /**
  * Source file reference with meaningful path.
  * Format: file is relative path from git root, export uses hash syntax.
@@ -367,15 +372,15 @@ export declare function isLockInlineValue(value: unknown): value is LockInlineVa
  * (e.g., `kici:role:builder`, `kici:role:init-runner`) are injected by the orchestrator
  * for internal job types (build/init) and are not user-settable.
  */
-/** Needs entry with per-edge failure policy (mirrors engine NeedsEntry). */
+/** Needs entry with per-edge run-on status-set (mirrors engine NeedsEntry). */
 export interface LockNeedsEntry {
     readonly name: string;
-    readonly ifFailed: 'skip' | 'run';
+    readonly runOn: ExecutionJobStatus[];
 }
 /** Needs group entry for dynamic group dependencies (mirrors engine NeedsGroupEntry). */
 export interface LockNeedsGroupEntry {
     readonly group: string;
-    readonly ifFailed: 'skip' | 'run';
+    readonly runOn: ExecutionJobStatus[];
 }
 export interface LockJob {
     readonly _type: 'static';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -63,11 +63,11 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.21",
-    "@kici-dev/engine": "0.1.21"
+    "@kici-dev/core": "0.1.22",
+    "@kici-dev/engine": "0.1.22"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.1.21"
+    "@kici-dev/sdk": "0.1.22"
   },
   "devDependencies": {
     "@types/proper-lockfile": "^4.1.4"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/compiler@0.1.21",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.21/4162fc88-26bd-41e3-8085-1dc26bb0eb1f",
+  "name": "@kici-dev/compiler@0.1.22",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.22/3348af69-8089-4211-a0f3-9a8e9a3651f4",
   "creationInfo": {
-    "created": "2026-06-23T05:10:19Z",
+    "created": "2026-06-24T06:03:11Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -484,7 +484,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/compiler",
-      "versionInfo": "0.1.21",
+      "versionInfo": "0.1.22",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -495,16 +495,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.21"
+          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.22"
         }
       ],
       "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.22",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.21",
+      "versionInfo": "0.1.22",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -515,16 +515,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.21"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.22"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.21",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.22",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.21",
+      "versionInfo": "0.1.22",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -535,16 +535,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.21"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.22"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.21",
+      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.22",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.21",
+      "versionInfo": "0.1.22",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -555,7 +555,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.21"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.22"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
@@ -3222,17 +3222,17 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.22",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.21",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.22",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.21",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.22",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -3301,82 +3301,82 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.22",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.22",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-micromatch-4.0.8",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.21",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },