@kici-dev/compiler 0.1.22 → 0.1.24

package/dist/cli.js

@@ -7,7 +7,7 @@ import { realpathSync } from "node:fs";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.22";
+const version = "0.1.24";
 /**
 * Build the kici Commander program with every command registered. Exported so
 * the surface registry can walk the real command tree without parsing argv (no
@@ -44,7 +44,7 @@ function buildProgram() {
 		await fixtureCommand(event, options);
 	});
 	const runCommand = program.command("run").description("Execute workflows locally or remotely");
-	runCommand.command("local").argument("[event]", "Event type (e.g., push, pr:open, schedule) — optional with --pick").description("Execute workflows locally without orchestrator infrastructure").option("-p, --pick", "Interactively pick a workflow and trigger to simulate", false).option("--workflow <name>", "Run only the specified workflow").option("--job <name>", "Run only the specified job (and its dependencies)").option("--branch <name>", "Override detected git branch").option("--sha <hash>", "Override detected git SHA").option("--payload <path>", "Path to explicit event payload JSON file").option("--concurrency <n>", "Max parallel jobs (default: CPU cores)", parseInt).option("--keep-going", "Continue after job failure", false).option("--container", "Use Podman container isolation", false).option("--env <KEY=VALUE>", "Environment variable override (repeatable)", (val, prev) => [...prev, val], []).option("--quiet", "Suppress streaming output", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--files <path>", "Override changed file paths (repeatable, default: git diff)", (val, prev) => [...prev, val], []).option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--in-place", "Run against the real working directory instead of an isolated tmp checkout", false).option("--keep", "Always retain the isolated tmp checkout (default: keep only on failure)", false).option("--check", "Run in check mode: report drift, change nothing", false).option("--fail-on-drift", "In check mode, exit non-zero if any step reports drift", false).action(async (event, options) => {
+	runCommand.command("local").argument("[event]", "Event type (e.g., push, pr:open, schedule) — optional with --pick").description("Execute workflows locally without orchestrator infrastructure").option("-p, --pick", "Interactively pick a workflow and trigger to simulate", false).option("--workflow <name>", "Run only the specified workflow").option("--job <name>", "Run only the specified job (and its dependencies)").option("--branch <name>", "Override detected git branch").option("--sha <hash>", "Override detected git SHA").option("--payload <path>", "Path to explicit event payload JSON file").option("--concurrency <n>", "Max parallel jobs (default: CPU cores)", parseInt).option("--keep-going", "Continue after job failure", false).option("--container", "Use Podman container isolation", false).option("--env <KEY=VALUE>", "Environment variable override (repeatable)", (val, prev) => [...prev, val], []).option("--input <KEY=VALUE>", "Typed workflow-dispatch input (repeatable)", (val, prev) => [...prev, val], []).option("--quiet", "Suppress streaming output", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--files <path>", "Override changed file paths (repeatable, default: git diff)", (val, prev) => [...prev, val], []).option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--in-place", "Run against the real working directory instead of an isolated tmp checkout", false).option("--keep", "Always retain the isolated tmp checkout (default: keep only on failure)", false).option("--check", "Run in check mode: report drift, change nothing", false).option("--fail-on-drift", "In check mode, exit non-zero if any step reports drift", false).action(async (event, options) => {
 		if (options.pick && options.workflow) {
 			console.error("Error: --pick is mutually exclusive with --workflow.");
 			process.exit(2);
@@ -78,6 +78,7 @@ function buildProgram() {
 			keepGoing: options.keepGoing,
 			container: options.container,
 			env: options.env,
+			inputs: options.input,
 			quiet: options.quiet,
 			json: options.json,
 			junit: options.junit,
@@ -89,7 +90,19 @@ function buildProgram() {
 		});
 		process.exit(success ? 0 : 1);
 	});
-	runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--org <id>", "Target organization (overrides the active org)").option("--orchestrator <name>", "Target orchestrator cluster (overrides the per-org default)").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).option("--check", "Run in check mode: report drift, change nothing", false).option("--fail-on-drift", "In check mode, exit non-zero if any step reports drift", false).option("--target <selector>", "Narrow runsOnAll jobs to hosts matching this label selector (repeatable, AND-combined)", (val, prev) => [...prev, val], []).option("--target-allow-empty", "A --target that narrows a runsOnAll job to zero hosts skips it instead of failing", false).option("--approve-all, --yes", "Auto-approve every approval gate this run holds on (run-scoped; eligibility still enforced)", false).action(async (fixture, options) => {
+	runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("-p, --pick", "Interactively pick fixtures to run", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--org <id>", "Target organization (overrides the active org)").option("--orchestrator <name>", "Target orchestrator cluster (overrides the per-org default)").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).option("--check", "Run in check mode: report drift, change nothing", false).option("--fail-on-drift", "In check mode, exit non-zero if any step reports drift", false).option("--target <selector>", "Narrow runsOnAll jobs to hosts matching this label selector (repeatable, AND-combined)", (val, prev) => [...prev, val], []).option("--target-allow-empty", "A --target that narrows a runsOnAll job to zero hosts skips it instead of failing", false).option("--input <KEY=VALUE>", "Typed workflow-dispatch input (repeatable)", (val, prev) => [...prev, val], []).option("--approve-all, --yes", "Auto-approve every approval gate this run holds on (run-scoped; eligibility still enforced)", false).action(async (fixture, options) => {
+		if (options.pick && fixture) {
+			console.error("Error: --pick selects fixtures interactively; do not also pass a fixture name.");
+			process.exit(2);
+		}
+		if (options.pick && options.all) {
+			console.error("Error: --pick is mutually exclusive with --all.");
+			process.exit(2);
+		}
+		if (options.pick && options.workflow) {
+			console.error("Error: --pick is mutually exclusive with --workflow.");
+			process.exit(2);
+		}
 		const { runRemoteCommand } = await import("./commands/index.js");
 		const { resolveCheckMode } = await import("./commands/check-mode.js");
 		let checkMode;
@@ -108,13 +121,14 @@ function buildProgram() {
 			envFlags: options.env,
 			targets: options.target,
 			targetAllowEmpty: options.targetAllowEmpty,
-			approveAll: options.approveAll
+			approveAll: options.approveAll,
+			inputs: options.input
 		});
 		process.exit(success ? 0 : 1);
 	});
-	program.command("test").argument("[event]", "Event type to preview (e.g., push, pr:open, schedule)").description("Preview which workflows match a trigger event (dry-run)").option("--branch <name>", "Override target branch for trigger matching (default: main)").option("--sha <hash>", "Override commit SHA").option("--workflow <name>", "Filter to specific workflow in display").option("--job <name>", "Filter to specific job in display").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--files <path>", "Simulate changed file path for trigger matching (repeatable)", (val, prev) => [...prev, val], []).option("--secret <key=value>", "Inject flat secret (repeatable)", (val, prev) => [...prev, val], []).option("--context <ctx.key=value>", "Inject context secret (repeatable)", (val, prev) => [...prev, val], []).action(async (event, options) => {
-		const { testCommand } = await import("./commands/index.js");
-		const success = await testCommand(event, options);
+	program.command("preview").argument("[event]", "Event type to preview (e.g., push, pr:open, schedule)").description("Preview which workflows match a trigger event (no execution)").option("--branch <name>", "Override target branch for trigger matching (default: main)").option("--sha <hash>", "Override commit SHA").option("--workflow <name>", "Filter to specific workflow in display").option("--job <name>", "Filter to specific job in display").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--files <path>", "Simulate changed file path for trigger matching (repeatable)", (val, prev) => [...prev, val], []).option("--secret <key=value>", "Inject flat secret (repeatable)", (val, prev) => [...prev, val], []).option("--context <ctx.key=value>", "Inject context secret (repeatable)", (val, prev) => [...prev, val], []).action(async (event, options) => {
+		const { previewCommand } = await import("./commands/index.js");
+		const success = await previewCommand(event, options);
 		process.exit(success ? 0 : 1);
 	});
 	program.command("init").description("Initialize .kici/ directory with default workflows").option("--force", "Overwrite existing .kici/ directory", false).option("--skip-install", "Create files without installing dependencies", false).option("--package-manager <npm|pnpm|yarn>", "Force a package manager for the install step (default: auto-detect)").option("--mjs", "JavaScript-only mode (no TypeScript, no dependencies)", false).option("--no-agents-md", "Skip writing .kici/AGENTS.md (LLM authoring context)").option("--private-registry <url>", "Scaffold a workflow registries: entry pointing at <url>").option("--private-registry-scope <scope>", "Optional npm package scope (e.g. @my-org) for the private registry").option("--private-registry-secret <ref>", "Qualified secret reference (env:NAME) the private registry token comes from", "production:NPM_TOKEN").addOption(new Option("--use-verdaccio-local").default(false).hideHelp()).action(async (options) => {
@@ -185,6 +199,16 @@ Environment variables:
 		const success = await secretsListCommand();
 		process.exit(success ? 0 : 1);
 	});
+	program.command("pat").description("Manage personal access tokens").command("create").description("Mint a personal access token (use --agent for a coding-agent token)").option("--name <name>", "Token name (defaults to the agent label)").option("--agent", "Mint an agent-kind PAT for the KiCI MCP server", false).option("--expires-in-days <n>", "Custom expiry in days", (v) => parseInt(v, 10)).action(async (options) => {
+		const { patCreateCommand } = await import("./commands/index.js");
+		const success = await patCreateCommand({
+			name: options.name,
+			agent: options.agent,
+			label: options.name,
+			expiresInDays: options.expiresInDays
+		});
+		process.exit(success ? 0 : 1);
+	});
 	const runsCommand = program.command("runs").description("Inspect and manage execution runs");
 	runsCommand.command("list").description("List execution runs (mirrors the dashboard Runs page)").option("--status <s>", "Filter by status").option("--workflow <w>", "Filter by workflow name").option("--branch <b>", "Filter by branch/ref").option("--repo <r>", "Filter by repository").option("--trigger <t>", "Filter by trigger type").option("--source <routingKey>", "Filter by source routing key").option("--since <ts>", "Only runs since (ISO-8601 or epoch ms)").option("--page <n>", "Page number", (v) => parseInt(v, 10)).option("--json", "Output raw JSON", false).action(async (options) => {
 		const { runsListCommand } = await import("./commands/index.js");
@@ -268,10 +292,10 @@ Environment variables:
 		const { docsCommand } = await import("./commands/index.js");
 		const success = await docsCommand({ open: options.open });
 		process.exit(success ? 0 : 1);
-	}).command("llm").description("Print the bundled LLM context (llms-full.txt) to stdout").option("--index", "Print the curated llms.txt index instead of the full bundle", false).option("--out <path>", "Write the bundle to a file instead of stdout").action(async (options) => {
+	}).command("llm [topic]").description("Print KiCI LLM docs bundles. No topic prints the llms.txt index; <topic> prints a task bundle (e.g. sdk, cli, patterns, features, providers, architecture, getting-started); \"full\" prints the complete bundle.").option("--out <path>", "Write the bundle to a file instead of stdout").action(async (topic, options) => {
 		const { docsLlmCommand } = await import("./commands/index.js");
 		const success = await docsLlmCommand({
-			index: options.index,
+			topic,
 			out: options.out
 		});
 		process.exit(success ? 0 : 1);
@@ -281,7 +305,7 @@ Environment variables:
 		const success = await drainWorkerCommand({ url: options.url });
 		process.exit(success ? 0 : 1);
 	});
-	program.command("verify-attestation").argument("[artifact]", "Artifact path to digest-check against the attestation subject (optional)").description("Verify a KiCI provenance attestation bundle offline").option("--bundle <path>", "Path or URL to the attestation bundle JSON").option("--trust-root <url-or-file>", "Trusted issuer URL, or a self-contained { issuer, jwks } file").option("--audience <aud>", "Expected token audience").option("--json", "Output structured JSON result", false).action(async (artifact, options) => {
+	program.command("verify-attestation").argument("[artifact]", "Artifact path to digest-check against the attestation subject (optional)").description("Verify a KiCI provenance attestation bundle offline").option("--bundle <path>", "Path or URL to the attestation bundle JSON").option("--trust-root <url-or-file>", "Trusted issuer URL, or a self-contained { issuer, jwks } file (default: hosted KiCI platform)").option("--audience <aud>", "Expected token audience").option("--json", "Output structured JSON result", false).action(async (artifact, options) => {
 		const { verifyAttestationCommand } = await import("./commands/index.js");
 		const success = await verifyAttestationCommand(artifact, options);
 		process.exit(success ? 0 : 1);

package/dist/commands/compile.d.ts

@@ -6,6 +6,12 @@ export interface CompileOptions {
     check: boolean;
     /** Verbose output */
     verbose: boolean;
+    /**
+     * Suppress the success line on stdout (and the auto-types success line) so a
+     * caller emitting machine-readable output keeps stdout pure. Validation
+     * errors are still reported.
+     */
+    quiet?: boolean;
 }
 /**
  * Execute the compile command.

package/dist/commands/compile.js

@@ -76,7 +76,7 @@ async function compileCommand(options) {
 		const lockJson = serializeLockFile(generateLockFile(workflowsWithSource));
 		if (!options.check) {
 			await fs.writeFile(lockPath, lockJson, "utf-8");
-			logger.info(pc.green("✓") + ` Compiled workflows → .kici/kici.lock.json` + pc.dim(` (${workflowsWithSource.length} workflow${workflowsWithSource.length !== 1 ? "s" : ""})`));
+			if (!options.quiet) logger.info(pc.green("✓") + ` Compiled workflows → .kici/kici.lock.json` + pc.dim(` (${workflowsWithSource.length} workflow${workflowsWithSource.length !== 1 ? "s" : ""})`));
 			try {
 				const { loadGlobalConfig } = await import("../remote/config.js");
 				const config = await loadGlobalConfig();
@@ -84,12 +84,15 @@ async function compileCommand(options) {
 				const hasEndpoint = Boolean(config.platformEndpoint ?? config.endpoint);
 				if (hasToken && hasEndpoint && config.activeOrgId) {
 					const { typesCommand } = await import("./types.js");
-					await typesCommand({ kiciDir });
+					await typesCommand({
+						kiciDir,
+						quiet: options.quiet
+					});
 				}
 			} catch {
 				logger.warn(pc.yellow("Could not refresh types (Platform unreachable). Compilation succeeded."));
 			}
-		} else logger.info(pc.green("✓") + ` Workflows are valid` + pc.dim(` (${workflowsWithSource.length} workflow${workflowsWithSource.length !== 1 ? "s" : ""})`));
+		} else if (!options.quiet) logger.info(pc.green("✓") + ` Workflows are valid` + pc.dim(` (${workflowsWithSource.length} workflow${workflowsWithSource.length !== 1 ? "s" : ""})`));
 		return true;
 	} catch (error) {
 		if (isCompilerError(error)) logger.error(formatError(error));

package/dist/commands/docs.d.ts

@@ -3,11 +3,11 @@ export interface DocsOptions {
     open?: boolean;
 }
 export interface DocsLlmOptions {
-    /** Print only the llms.txt index instead of the full markdown bundle. */
-    index?: boolean;
+    /** Task bundle id to print. Undefined → the llms.txt index; 'full' → llms-full.txt. */
+    topic?: string;
     /** Override the bundled output destination (overrides default stdout). */
     out?: string;
-    /** Override the directory holding llms.txt + llms-full.txt (test seam). */
+    /** Override the directory holding the llms*.txt files (test seam). */
     bundleDir?: string;
 }
 /**
@@ -15,12 +15,12 @@ export interface DocsLlmOptions {
  */
 export declare function docsCommand(options?: DocsOptions): Promise<boolean>;
 /**
- * Print the bundled llms.txt or llms-full.txt content to stdout (or a file).
+ * Print a KiCI LLM docs bundle to stdout (or a file).
  *
- * The bundle is generated at build time by hack/postbuild.mjs and shipped at
- * dist/llm-context/{llms.txt,llms-full.txt}. Customer-facing LLM tools can
- * pipe `kici docs llm` straight into an Anthropic / OpenAI context buffer to
- * brief the agent on KiCI authoring conventions without an internet round-trip.
+ * No topic prints the llms.txt index (a router listing every task bundle).
+ * A topic prints that task bundle (e.g. `sdk`, `cli`, `patterns`); `full`
+ * prints the everything-bundle. Pipe straight into a coding agent's context
+ * to brief it on KiCI authoring without an internet round-trip.
  */
 export declare function docsLlmCommand(options?: DocsLlmOptions): Promise<boolean>;
 //# sourceMappingURL=docs.d.ts.map

package/dist/commands/docs.js

@@ -2,12 +2,24 @@ import "../chunk-BTugEXQM.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import pc from "picocolors";
-import { readFile, writeFile } from "node:fs/promises";
+import { readFile, readdir, writeFile } from "node:fs/promises";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import open from "open";
 //#region src/commands/docs.ts
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const DOCS_HOME_URL = "https://kici.dev/docs/";
+function bundleFilenameForTopic(topic) {
+	if (!topic) return "llms.txt";
+	if (topic === "full") return "llms-full.txt";
+	return `llms-${topic}.txt`;
+}
+async function availableTopics(bundleDir) {
+	try {
+		return [...(await readdir(bundleDir)).filter((n) => n.startsWith("llms-") && n.endsWith(".txt") && n !== "llms-full.txt").map((n) => n.slice(5, -4)).sort(), "full"];
+	} catch {
+		return ["full"];
+	}
+}
 /**
 * Open the published documentation site in the user's default browser.
 */
@@ -27,32 +39,39 @@ async function docsCommand(options = {}) {
 	}
 }
 /**
-* Print the bundled llms.txt or llms-full.txt content to stdout (or a file).
+* Print a KiCI LLM docs bundle to stdout (or a file).
 *
-* The bundle is generated at build time by hack/postbuild.mjs and shipped at
-* dist/llm-context/{llms.txt,llms-full.txt}. Customer-facing LLM tools can
-* pipe `kici docs llm` straight into an Anthropic / OpenAI context buffer to
-* brief the agent on KiCI authoring conventions without an internet round-trip.
+* No topic prints the llms.txt index (a router listing every task bundle).
+* A topic prints that task bundle (e.g. `sdk`, `cli`, `patterns`); `full`
+* prints the everything-bundle. Pipe straight into a coding agent's context
+* to brief it on KiCI authoring without an internet round-trip.
 */
 async function docsLlmCommand(options = {}) {
-	const filename = options.index ? "llms.txt" : "llms-full.txt";
+	const filename = bundleFilenameForTopic(options.topic);
 	const bundleDir = options.bundleDir ?? path.join(__dirname, "..", "llm-context");
 	const bundlePath = path.join(bundleDir, filename);
+	let content;
 	try {
-		const content = await readFile(bundlePath, "utf-8");
-		if (options.out) {
-			await writeFile(options.out, content, "utf-8");
-			logger.info(pc.gray(`Wrote ${filename} to ${options.out}`));
-			return true;
-		}
-		process.stdout.write(content);
-		if (!content.endsWith("\n")) process.stdout.write("\n");
-		return true;
+		content = await readFile(bundlePath, "utf-8");
 	} catch (error) {
+		if (options.topic && options.topic !== "full") {
+			const topics = await availableTopics(bundleDir);
+			logger.error(pc.red(`Unknown docs bundle "${options.topic}".`));
+			logger.info(pc.gray(`Available topics: ${topics.join(", ")} (no topic prints the index).`));
+			return false;
+		}
 		logger.error(pc.red(`Error reading bundled ${filename}: ${toErrorMessage(error)}`));
 		logger.info(pc.gray("The bundle ships with the @kici-dev/compiler package. If you built the package locally, run `pnpm build` in packages/compiler/."));
 		return false;
 	}
+	if (options.out) {
+		await writeFile(options.out, content, "utf-8");
+		logger.info(pc.gray(`Wrote ${filename} to ${options.out}`));
+		return true;
+	}
+	process.stdout.write(content);
+	if (!content.endsWith("\n")) process.stdout.write("\n");
+	return true;
 }
 //#endregion
 export { docsCommand, docsLlmCommand };

package/dist/commands/index.d.ts

@@ -3,8 +3,8 @@ export type { CompileOptions } from './compile.js';
 export { watchCommand } from './watch.js';
 export { fixtureCommand } from './fixture.js';
 export type { FixtureOptions } from './fixture.js';
-export { testCommand, testDryRun } from './test.js';
-export type { TestOptions, RemoteRunOptions, RemoteRunResult } from './test.js';
+export { previewCommand, previewEvent } from './preview.js';
+export type { PreviewOptions, RemoteRunOptions, RemoteRunResult } from './preview.js';
 export { runLocalCommand, runRemoteCommand } from './run.js';
 export { initCommand } from './init.js';
 export type { InitOptions } from './init.js';
@@ -14,6 +14,8 @@ export { loginCommand } from './login.js';
 export type { LoginOptions } from './login.js';
 export { secretsListCommand } from './secrets-list.js';
 export type { SecretsListOptions } from './secrets-list.js';
+export { patCreateCommand } from './pat.js';
+export type { PatCreateOptions } from './pat.js';
 export { runsListCommand } from './runs/list.js';
 export type { RunsListOptions } from './runs/list.js';
 export { runsShowCommand } from './runs/show.js';

package/dist/commands/index.js

@@ -8,11 +8,12 @@ import { endpointsCommand } from "./endpoints.js";
 import { fixtureCommand } from "./fixture.js";
 import { hookInstallCommand } from "./hook.js";
 import { watchCommand } from "./watch.js";
-import { testCommand, testDryRun } from "./test.js";
+import { previewCommand, previewEvent } from "./preview.js";
 import { runLocalCommand, runRemoteCommand } from "./run.js";
 import { initCommand } from "./init.js";
 import { loginCommand } from "./login.js";
 import { secretsListCommand } from "./secrets-list.js";
+import { patCreateCommand } from "./pat.js";
 import { runsListCommand } from "./runs/list.js";
 import { runsShowCommand } from "./runs/show.js";
 import { runsLogsCommand } from "./runs/logs.js";
@@ -25,4 +26,4 @@ import { logoutCommand } from "./logout.js";
 import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
 import { verifyAttestationCommand } from "./verify-attestation.js";
-export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, rejectCommand, runLocalCommand, runRemoteCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, testCommand, testDryRun, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };
+export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, runLocalCommand, runRemoteCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.js

@@ -117,10 +117,10 @@ async function initCommand(options = {}) {
 		logger.info(pc.gray("  1. Edit workflows in .kici/workflows/"));
 		if (options.mjs || options.skipInstall) {
 			logger.info(pc.gray("  2. Run your package manager install in .kici/ to generate a lockfile"));
-			logger.info(pc.gray("  3. Test locally: kici test push"));
+			logger.info(pc.gray("  3. Preview matching: kici preview push"));
 			logger.info(pc.gray("  4. Commit .kici/ to your repository\n"));
 		} else {
-			logger.info(pc.gray("  2. Test locally: kici test push"));
+			logger.info(pc.gray("  2. Preview matching: kici preview push"));
 			logger.info(pc.gray("  3. Commit .kici/ to your repository\n"));
 		}
 		return true;

package/dist/commands/org.js

@@ -65,9 +65,9 @@ async function orgListCommand() {
 		const isActive = org.id === config.activeOrgId;
 		const marker = isActive ? pc.green("* ") : "  ";
 		const name = isActive ? pc.bold(org.displayName) : org.displayName;
-		const role = pc.gray(`(${org.role})`);
+		const ownership = pc.gray(`(${org.isOwner ? "owner" : "member"})`);
 		const id = pc.gray(org.id);
-		console.log(`  ${marker}${name.padEnd(nameWidth)} ${role}  ${id}`);
+		console.log(`  ${marker}${name.padEnd(nameWidth)} ${ownership}  ${id}`);
 	}
 	console.log("");
 	return true;

package/dist/commands/pat.d.ts

@@ -0,0 +1,27 @@
+export interface PatCreateOptions {
+    /** Token name shown in the dashboard PAT list. Defaults to the agent label. */
+    name?: string;
+    /** Mint an agent-kind PAT (the only credential the developer MCP server accepts). */
+    agent?: boolean;
+    /**
+     * Agent label (required with `--agent`) — the human-set name recorded on every
+     * audit row the agent produces. Also used as the token name when `--name` is
+     * omitted.
+     */
+    label?: string;
+    /** Custom expiry in days (server default: 120). */
+    expiresInDays?: number;
+    /** Injected fetch for tests. Defaults to the global fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Mint a personal access token under the logged-in user's identity.
+ *
+ * `kici pat create --agent --name <label>` mints an agent-kind PAT: it inherits
+ * the user's permissions (provenance only, no authority change), carries its
+ * label into every audit row, and is the credential a coding agent points the
+ * KiCI developer MCP server at. The token is printed once — there is no way to
+ * retrieve it later.
+ */
+export declare function patCreateCommand(options?: PatCreateOptions): Promise<boolean>;
+//# sourceMappingURL=pat.d.ts.map

package/dist/commands/pat.js

@@ -0,0 +1,76 @@
+import "../chunk-BTugEXQM.js";
+import { loadGlobalConfig } from "../remote/config.js";
+import pc from "picocolors";
+import { toErrorMessage } from "@kici-dev/core";
+import { PatKind } from "@kici-dev/engine";
+//#region src/commands/pat.ts
+/**
+* Mint a personal access token under the logged-in user's identity.
+*
+* `kici pat create --agent --name <label>` mints an agent-kind PAT: it inherits
+* the user's permissions (provenance only, no authority change), carries its
+* label into every audit row, and is the credential a coding agent points the
+* KiCI developer MCP server at. The token is printed once — there is no way to
+* retrieve it later.
+*/
+async function patCreateCommand(options = {}) {
+	const doFetch = options.fetchImpl ?? fetch;
+	try {
+		const config = await loadGlobalConfig();
+		const token = config.pat ?? config.token;
+		const endpoint = config.platformEndpoint ?? config.endpoint;
+		if (!token || !endpoint) {
+			console.error(pc.red("Not logged in. Run `kici login` first."));
+			return false;
+		}
+		const kind = options.agent ? PatKind.enum.agent : PatKind.enum.user;
+		const label = options.label;
+		if (kind === PatKind.enum.agent && !label) {
+			console.error(pc.red("An agent PAT requires a label. Pass --name <label>."));
+			return false;
+		}
+		const name = options.name ?? label;
+		if (!name) {
+			console.error(pc.red("A token name is required. Pass --name <name>."));
+			return false;
+		}
+		const body = {
+			name,
+			kind
+		};
+		if (kind === PatKind.enum.agent) body.agentLabel = label;
+		if (options.expiresInDays !== void 0) body.expiresInDays = options.expiresInDays;
+		const res = await doFetch(`${endpoint.replace(/\/$/, "")}/api/v1/pats`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) {
+			let detail;
+			try {
+				detail = (await res.json()).error;
+			} catch {}
+			console.error(pc.red(`Failed to create token (${res.status}): ${detail ?? "request failed"}`));
+			return false;
+		}
+		const created = await res.json();
+		console.log(pc.bold(kind === PatKind.enum.agent ? "\nAgent PAT created.\n" : "\nPAT created.\n"));
+		console.log(`${pc.gray("Name:   ")}${created.name}`);
+		if (kind === PatKind.enum.agent) console.log(`${pc.gray("Agent:  ")}${label}`);
+		console.log(`${pc.gray("Expires:")} ${created.expiresAt}`);
+		console.log(`\n${pc.gray("Token (shown once — save it now):")}`);
+		console.log(pc.cyan(created.token));
+		if (kind === PatKind.enum.agent) console.log(pc.gray("\nPoint your coding agent at the KiCI MCP server with this token as the Bearer credential."));
+		return true;
+	} catch (err) {
+		console.error(pc.red(`Failed to create token: ${toErrorMessage(err)}`));
+		return false;
+	}
+}
+//#endregion
+export { patCreateCommand };
+
+//# sourceMappingURL=pat.js.map

package/dist/commands/preview.d.ts

@@ -0,0 +1,88 @@
+import { type PayloadOptions } from '../test-runner/payload-builder.js';
+import { type CheckMode } from '@kici-dev/engine';
+/** Options for the kici preview command (dry-run trigger preview) */
+export interface PreviewOptions extends PayloadOptions {
+    /** Filter to specific workflow */
+    workflow?: string;
+    /** Filter to specific job */
+    job?: string;
+    /** Enable debug output */
+    debug?: boolean;
+    /** Path to .kici directory (defaults to .kici) */
+    kiciDir?: string;
+    /** Flat secret overrides: KEY=VALUE */
+    secret?: string[];
+    /** Context secret overrides: contextName.KEY=VALUE */
+    context?: string[];
+}
+/** Options for the kici run remote command */
+export interface RemoteRunOptions extends PreviewOptions {
+    /** Run all available fixtures */
+    all?: boolean;
+    /** Interactively pick fixtures to run (multi-select checkbox). */
+    pick?: boolean;
+    /** Run matching fixtures concurrently */
+    parallel?: boolean;
+    /** Fire and forget (print runIds, don't stream) */
+    wait?: boolean;
+    /** Suppress output except final result */
+    quiet?: boolean;
+    /** Output structured JSON result */
+    json?: boolean;
+    /** Output JUnit XML result */
+    junit?: string;
+    /** Override routing key for this run */
+    routingKey?: string;
+    /** Show recent run history */
+    history?: boolean;
+    /** --env KEY=VALUE flag values, uploaded as per-run secrets. */
+    envFlags?: string[];
+    /** Target organization id (overrides config.activeOrgId). */
+    org?: string;
+    /** Target orchestrator cluster name (overrides the per-org default). */
+    orchestrator?: string;
+    /**
+     * Run mode resolved from --check / --fail-on-drift, threaded onto the dispatch
+     * payload so the orchestrator runs the agent step loop in the requested mode.
+     * Defaults to `apply`.
+     */
+    checkMode?: CheckMode;
+    /** `--target <selector>` values (repeatable), AND-combined into host narrowing. */
+    targets?: string[];
+    /** `--target-allow-empty`: a target that zeroes a runsOnAll job skips it instead of failing. */
+    targetAllowEmpty?: boolean;
+    /**
+     * `--approve-all` (alias `--yes`): auto-approve every approval gate this run
+     * holds on (run-scoped only — the run id this invocation dispatched). The
+     * operator must still be clause-eligible per hold; an ineligible hold blocks.
+     */
+    approveAll?: boolean;
+    /** `--input KEY=VALUE` values (repeatable): typed workflow-dispatch inputs. */
+    inputs?: string[];
+}
+/** Result of a single remote fixture run */
+export interface RemoteRunResult {
+    fixtureId: string;
+    runId: string;
+    status: 'accepted' | 'rejected' | 'success' | 'failed' | 'cancelled' | 'error';
+    reason?: string;
+    observeUrl?: string;
+    durationMs?: number;
+    jobs?: Array<{
+        name: string;
+        status: string;
+        durationMs?: number;
+    }>;
+}
+/**
+ * Main preview command entry point.
+ *
+ * `kici preview <event>` is a dry-run trigger preview only — it executes nothing.
+ * If the argument looks like a fixture name (not a known event type), prints a migration message.
+ */
+export declare function previewCommand(event: string | undefined, options: PreviewOptions): Promise<boolean>;
+/**
+ * Local-only dry-run mode: compile workflows, match triggers, display what would execute.
+ */
+export declare function previewEvent(event: string, options: PreviewOptions): Promise<boolean>;
+//# sourceMappingURL=preview.d.ts.map

package/dist/commands/{test.js → preview.js}

@@ -9,30 +9,31 @@ import { loadSecretsFile } from "../test-runner/secrets-file.js";
 import path from "node:path";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
+import { flattenStepInputs } from "@kici-dev/sdk";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { matchAllWorkflows } from "@kici-dev/engine";
 import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
-//#region src/commands/test.ts
+//#region src/commands/preview.ts
 /**
-* Main test command entry point.
+* Main preview command entry point.
 *
-* `kici test <event>` is now dry-run trigger preview only.
+* `kici preview <event>` is a dry-run trigger preview only — it executes nothing.
 * If the argument looks like a fixture name (not a known event type), prints a migration message.
 */
-async function testCommand(event, options) {
+async function previewCommand(event, options) {
 	if (options.debug) {
 		process.env.KICI_DEBUG = "true";
 		logger.info(pc.gray("Debug mode enabled"));
 	}
 	try {
 		if (!event) {
-			logger.info(pc.bold("\nUsage: kici test <event>\n"));
+			logger.info(pc.bold("\nUsage: kici preview <event>\n"));
 			logger.info(pc.gray("Preview which workflows and jobs would run for a given event.\n"));
 			logger.info(pc.gray("Examples:"));
-			logger.info(pc.gray("  kici test push"));
-			logger.info(pc.gray("  kici test pr:open"));
-			logger.info(pc.gray("  kici test schedule"));
-			logger.info(pc.gray("  kici test lifecycle:workflow_complete\n"));
+			logger.info(pc.gray("  kici preview push"));
+			logger.info(pc.gray("  kici preview pr:open"));
+			logger.info(pc.gray("  kici preview schedule"));
+			logger.info(pc.gray("  kici preview lifecycle:workflow_complete\n"));
 			logger.info(pc.gray("For remote fixture execution, use: kici run remote [fixture] [options]"));
 			logger.info(pc.gray("For local workflow execution, use: kici run local <event> [options]\n"));
 			return true;
@@ -41,7 +42,7 @@ async function testCommand(event, options) {
 			logger.info(pc.yellow(`\nFixture-based testing has moved to \`kici run remote\`.\nRun \`kici run remote ${event}\` instead.\n`));
 			return false;
 		}
-		return await testDryRun(event, options);
+		return await previewEvent(event, options);
 	} catch (error) {
 		const message = toErrorMessage(error);
 		logger.error(pc.red(`\nError: ${message}\n`));
@@ -64,7 +65,7 @@ function isKnownEventArg(arg) {
 /**
 * Local-only dry-run mode: compile workflows, match triggers, display what would execute.
 */
-async function testDryRun(event, options) {
+async function previewEvent(event, options) {
 	try {
 		const kiciDir = resolveKiciDir(options.kiciDir);
 		logger.info(pc.gray(`KiCI directory: ${kiciDir}`));
@@ -144,7 +145,7 @@ function workflowsToLockFormat(workflows) {
 					if ("group" in n) return `__group:${n.group}`;
 					return n.name;
 				}) ?? [],
-				steps: j.steps.map((s) => {
+				steps: flattenStepInputs(j.steps).map((s) => {
 					if (typeof s === "function") return {
 						name: "",
 						hasOutputs: false
@@ -213,6 +214,6 @@ async function loadTestSecrets(kiciDir, secretFlags, contextFlags) {
 	return secrets;
 }
 //#endregion
-export { testCommand, testDryRun };
+export { previewCommand, previewEvent };
 
-//# sourceMappingURL=test.js.map
+//# sourceMappingURL=preview.js.map