@kici-dev/compiler 0.1.22 → 0.1.24

package/dist/llm-context/llms.txt

@@ -4,6 +4,18 @@
 
 The full markdown bundle of every page indexed here is available at https://docs.kici.dev/llms-full.txt.
 
+## Bundles
+
+Each bundle below is a self-contained markdown file for one authoring task. Fetch only the one your task needs instead of the full bundle:
+
+- [getting-started](https://docs.kici.dev/llms-getting-started.txt) (25 KB) — Install the SDK, write your first workflow, compile and test locally
+- [patterns](https://docs.kici.dev/llms-patterns.txt) (49 KB) — Copy-paste workflow recipes: triggers, conditionals, matrix, scheduling, integrations
+- [sdk](https://docs.kici.dev/llms-sdk.txt) (190 KB) — Authoring API: workflow/job/step factories, triggers, rules, matrix, runtime, caching
+- [cli](https://docs.kici.dev/llms-cli.txt) (124 KB) — Running the CLI: compile, test, run local/remote, auth, hooks, lock-file drift
+- [features](https://docs.kici.dev/llms-features.txt) (124 KB) — Workflow features: concurrency, environments, secrets, approvals, provenance, events
+- [providers](https://docs.kici.dev/llms-providers.txt) (36 KB) — Connecting sources: GitHub App, universal-git (Forgejo/Gitea/GitLab), local file://
+- [architecture](https://docs.kici.dev/llms-architecture.txt) (87 KB) — How the runtime works: three-tier relay model, data flows, configuration
+
 ## Getting started
 
 - [User guide](https://docs.kici.dev/user/): Writing and testing CI/CD workflows in TypeScript
@@ -25,6 +37,7 @@ The full markdown bundle of every page indexed here is available at https://docs
 - [SDK reference: core](https://docs.kici.dev/user/sdk/core/): Factory functions (workflow, job, step) and authoring patterns: needs, output chaining, dynamic groups
 - [Event payload reference](https://docs.kici.dev/user/sdk/event-payloads/): Generated schema of the normalized event envelope passed to rules and dynamic functions.
 - [SDK reference: idempotent](https://docs.kici.dev/user/sdk/idempotent/): Idempotent helpers for declarative check / apply patterns inside workflow steps
+- [SDK reference: parallel](https://docs.kici.dev/user/sdk/parallel/): Run independent steps concurrently within a single job, each as its own observable step
 - [SDK reference: rules, matrix, dynamic jobs](https://docs.kici.dev/user/sdk/rules-matrix-dynamic/): rule(), skip(), matrix builds (static + dynamic), and dynamicJob / dynamicGroup
 - [SDK reference: runsOnAll host fan-out](https://docs.kici.dev/user/sdk/runs-on-all/): Fan one job out to every matching connected host, one pinned execution per host
 - [SDK reference: runtime](https://docs.kici.dev/user/sdk/runtime/): Types index, StepContext, secrets, fixtures
@@ -35,8 +48,9 @@ The full markdown bundle of every page indexed here is available at https://docs
 
 ## CLI and authoring
 
+- [Drive KiCI from your coding agent](https://docs.kici.dev/user/ai-agents/): Point a coding agent at KiCI's MCP server and let it trigger, read, and re-run your CI under your own identity.
 - [CLI authentication](https://docs.kici.dev/user/cli-auth/): Authenticate the KiCI CLI with browser OAuth, device flow, or API key paste
-- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), orchestrators, test, login, logout, org, diagnostics, runs (list/show/logs/rerun/cancel), secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
+- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), orchestrators, preview, login, logout, org, diagnostics, runs (list/show/logs/rerun/cancel), secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
 - [Lifecycle hooks](https://docs.kici.dev/user/hooks/): SDK hook API for cancel, cleanup, success, failure, and step-level callbacks
 - [Lock file and workflow drift](https://docs.kici.dev/user/lock-file-and-drift/): Keep the lock file in sync with your workflow source and avoid drift
 - [Testing guide](https://docs.kici.dev/user/testing-guide/): Running remote test fixtures with kici run remote
@@ -66,5 +80,6 @@ The full markdown bundle of every page indexed here is available at https://docs
 
 ## Architecture overview
 
+- [Configuration architecture](https://docs.kici.dev/architecture/configuration/): Config resolution chain, DB schema, encryption, hot-reload, cluster sync
 - [Data flows](https://docs.kici.dev/architecture/data-flows/): End-to-end data flows through the KiCI three-tier architecture
 - [Architecture overview](https://docs.kici.dev/architecture/overview/): Three-tier relay model, package structure, and component responsibilities

package/dist/local-executor/index.js

@@ -14,8 +14,9 @@ import { ConcurrencyKeyEvaluationError, acquireWorkflowLock } from "./workflow-l
 import path from "node:path";
 import pc from "picocolors";
 import { writeFile } from "node:fs/promises";
+import { flattenStepInputs } from "@kici-dev/sdk";
 import { logger } from "@kici-dev/core";
-import { CheckMode, CheckStepOutcome, matchAllWorkflows } from "@kici-dev/engine";
+import { CheckMode, CheckStepOutcome, coerceDispatchInputs, matchAllWorkflows, parseInputPairs } from "@kici-dev/engine";
 import os from "node:os";
 //#region src/local-executor/index.ts
 /**
@@ -55,7 +56,7 @@ function workflowsToLockFormat(workflows) {
 				name: j.name,
 				runsOn: j.runsOn,
 				needs: j.needs?.map((n) => typeof n === "string" ? n : n.name) ?? [],
-				steps: j.steps.map((s) => {
+				steps: flattenStepInputs(j.steps).map((s) => {
 					if (typeof s === "function") return {
 						name: "",
 						hasOutputs: false
@@ -136,8 +137,37 @@ async function runOneMatchedWorkflow(workflow, ctx) {
 * The actual DAG-execution body for one workflow. Split out so
 * {@link runOneMatchedWorkflow} can wrap it in a lock acquire/release.
 */
+/**
+* Resolve the dispatch-input descriptor declared on a workflow's `dispatch()`
+* trigger(s) from the in-memory trigger objects, merged across triggers.
+* Returns undefined when none declared.
+*/
+function dispatchInputsDescriptorForWorkflow(workflow) {
+	const merged = {};
+	let found = false;
+	for (const trigger of transformTriggers(workflow.on)) if (trigger._type === "dispatch" && trigger.inputs) {
+		Object.assign(merged, trigger.inputs);
+		found = true;
+	}
+	return found ? merged : void 0;
+}
+/**
+* Coerce + default the operator's `--input` pairs against the workflow's
+* dispatch descriptor for a local run. The local executor is authoritative for
+* `run local` (no orchestrator), so defaults are applied here exactly once.
+* Returns the resolved values, or throws when input is invalid.
+*/
+function resolveLocalDispatchInputs(workflow, options) {
+	const descriptor = dispatchInputsDescriptorForWorkflow(workflow);
+	const raw = parseInputPairs(options.inputs ?? []);
+	if (!descriptor) return raw;
+	const r = coerceDispatchInputs(raw, descriptor);
+	if ("error" in r) throw r.error;
+	return r.values;
+}
 async function runWorkflowBody(workflow, ctx, options, secrets, kiciDir, concurrency, failFast) {
 	const { event } = ctx;
+	const dispatchInputs = resolveLocalDispatchInputs(workflow, options);
 	const resolvedJobs = await resolveJobs(workflow, event);
 	let dagNodes = resolvedJobs.map((r) => ({
 		name: r.expandedName,
@@ -170,7 +200,8 @@ async function runWorkflowBody(workflow, ctx, options, secrets, kiciDir, concurr
 				execDir: ctx.execDir,
 				jobOutputsMap,
 				signal,
-				checkMode: options.checkMode
+				checkMode: options.checkMode,
+				dispatchInputs
 			});
 		},
 		isSuccess: (result) => result.status === "success" || result.status === "skipped"
@@ -223,7 +254,8 @@ async function executeLocal(options) {
 	if (!await compileCommand({
 		kiciDir,
 		check: false,
-		verbose: options.debug ?? false
+		verbose: options.debug ?? false,
+		quiet: Boolean(options.json || options.quiet)
 	})) {
 		process.exitCode = 2;
 		return false;
@@ -268,6 +300,12 @@ async function executeLocal(options) {
 			return true;
 		}
 	}
+	for (const workflow of matchedWorkflows) try {
+		resolveLocalDispatchInputs(workflow, options);
+	} catch (err) {
+		logger.error(pc.red(`Error: ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(2);
+	}
 	const isQuiet = Boolean(options.quiet || options.json);
 	const repoRoot = path.dirname(kiciDir);
 	let materialized = null;

package/dist/local-executor/job-runner.d.ts

@@ -27,6 +27,8 @@ export interface JobExecutionContext {
     signal: AbortSignal;
     /** Run mode for idempotent steps. Defaults to `apply` when unset. */
     checkMode?: CheckMode;
+    /** Resolved (coerced + defaulted) workflow-dispatch inputs for `ctx.dispatchInputs`. */
+    dispatchInputs?: Readonly<Record<string, string | number | boolean | null>>;
 }
 /**
  * Resolve all jobs in a workflow, expanding matrix jobs and evaluating dynamic jobs.

package/dist/local-executor/job-runner.js

@@ -7,7 +7,8 @@ import { localRunsOnString } from "./runs-on-display.js";
 import { toEventPayload } from "./to-event-payload.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
-import { applyIncludeExclude, expandMatrix, isDynamicJobFn, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { applyIncludeExclude, expandMatrix, flattenStepInputs, isDynamicJobFn, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { computeBackoffDelay } from "@kici-dev/core";
 import { CheckMode, CheckStepOutcome, formatMatrixSuffix } from "@kici-dev/engine";
 import { runIdempotentStep } from "@kici-dev/core/idempotency";
 //#region src/local-executor/job-runner.ts
@@ -91,6 +92,33 @@ async function runLocalStepWithCheckMode(step, ctx, checkMode) {
 	};
 }
 /**
+* Run a local step through its retry policy. An attempt is one full
+* `runLocalStepWithCheckMode` call (which throws on failure). A thrown attempt
+* is retried while attempts remain AND `retryIf(err)` is true; backoff sleeps
+* between attempts. Mirrors the agent step loop so `kici run local` retries
+* identically to a remote run.
+*/
+async function runLocalStepWithRetry(step, ctx, checkMode, log) {
+	const retry = step.retry;
+	const max = retry?.maxAttempts ?? 1;
+	let lastErr;
+	for (let n = 1; n <= max; n++) try {
+		return await runLocalStepWithCheckMode(step, ctx, checkMode);
+	} catch (err) {
+		lastErr = err;
+		if (!(n < max && (retry?.retryIf?.(err) ?? true))) break;
+		const delay = computeBackoffDelay(n, {
+			maxAttempts: max,
+			delayMs: retry.delayMs,
+			backoff: retry.backoff,
+			maxDelayMs: retry.maxDelayMs
+		});
+		log(`Step '${step.name}' attempt ${n}/${max} failed: ${err instanceof Error ? err.message : String(err)}; retrying in ${delay}ms`);
+		await new Promise((r) => setTimeout(r, delay));
+	}
+	throw lastErr;
+}
+/**
 * Maintain the base-name `{ byMatrix, merged }` envelope as each matrix child
 * completes. `merged` is rebuilt last-write-wins in suffix order so the result
 * is deterministic regardless of child completion order — matching the remote
@@ -146,7 +174,11 @@ async function resolveJobs(workflow, event) {
 					get: () => Promise.resolve(null)
 				},
 				oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available during local execution")) },
-				host: { requestReboot: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.host.requestReboot() is not available during local execution")) }
+				host: { requestReboot: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.host.requestReboot() is not available during local execution")) },
+				bootstrap: {
+					ensureInitRunner: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.bootstrap.ensureInitRunner() is not available during local execution")),
+					preBootSend: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.bootstrap.preBootSend() is not available during local execution"))
+				}
 			}
 		});
 		for (const genJob of generatedJobs) {
@@ -257,7 +289,7 @@ async function executeResolvedJobInner(resolvedJob, context, startTime) {
 	const sdkSetters = await resolveSdkSetters(context.kiciDir);
 	let ruleResults;
 	if (job.rules && job.rules.length > 0) {
-		const ruleContext = createRuleContext(context.event, context.event.changedFiles);
+		const ruleContext = createRuleContext(context.event, context.event.changedFiles, context.dispatchInputs ?? {});
 		const ruleEval = await evaluateRulesWithFormatting(job.rules, ruleContext, expandedName);
 		ruleResults = ruleEval.results;
 		if (!ruleEval.allPassed) return {
@@ -282,10 +314,10 @@ async function executeResolvedJobInner(resolvedJob, context, startTime) {
 	const stepCtx = createStepContext({ name: context.workflowName }, {
 		name: expandedName,
 		runsOn: localRunsOnString(job.runsOn)
-	}, repoRoot, void 0, hasMatrix ? matrixValues : void 0, context.secrets, void 0, context.event.payload, context.event.provider);
+	}, repoRoot, void 0, hasMatrix ? matrixValues : void 0, context.secrets, void 0, context.event.payload, context.event.provider, context.dispatchInputs ?? {}, context.signal);
 	const stepResults = [];
 	let stepCounter = 0;
-	for (const stepOrFn of job.steps) {
+	for (const stepOrFn of flattenStepInputs(job.steps)) {
 		if (context.signal.aborted) return {
 			name: expandedName,
 			status: "cancelled",
@@ -313,7 +345,7 @@ async function executeResolvedJobInner(resolvedJob, context, startTime) {
 		const stepStart = Date.now();
 		try {
 			const checkMode = context.checkMode ?? CheckMode.enum.apply;
-			const phase = await runLocalStepWithCheckMode(normalizedStep, stepCtx, checkMode);
+			const phase = await runLocalStepWithRetry(normalizedStep, stepCtx, checkMode, (line) => formatter.logJobLine(expandedName, line));
 			const outputs = phase.outputs;
 			const stepDuration = Date.now() - stepStart;
 			formatter.logStepComplete(expandedName, normalizedStep.name, stepDuration);

package/dist/local-executor/types.d.ts

@@ -27,6 +27,8 @@ export interface RunLocalOptions {
     container?: boolean;
     /** --env KEY=VALUE overrides (repeatable) */
     env?: string[];
+    /** --input KEY=VALUE typed workflow-dispatch inputs (repeatable) */
+    inputs?: string[];
     /** --quiet: minimal output */
     quiet?: boolean;
     /** --json: JSON output format */

package/dist/lockfile/generator.d.ts

@@ -1,5 +1,5 @@
-import type { TriggerConfig } from '@kici-dev/sdk';
-import { type LockFile, type LockTrigger, type WorkflowWithSource } from '../types.js';
+import type { StepInput, TriggerConfig } from '@kici-dev/sdk';
+import { type LockFile, type LockTrigger, type LockStepEntry, type WorkflowWithSource } from '../types.js';
 /**
  * Detect git repository root by running `git rev-parse --show-toplevel`.
  * Falls back to cwd if not in a git repo.
@@ -40,6 +40,14 @@ export declare function generateLockFile(workflowsWithSource: WorkflowWithSource
  * Exported for reuse in the test runner's in-memory lock format conversion.
  */
 export declare function transformTriggers(triggers?: TriggerConfig[]): readonly LockTrigger[];
+/**
+ * Transform a job's `steps` array into lock-file entries. Sequential steps and
+ * parallel-group children share one flat `step-N` counter (anonymous steps are
+ * numbered across the whole flattened sequence, parallel children inline) so the
+ * compiler's naming matches the agent's `extractAndNormalizeSteps` enumeration —
+ * the flat-stepIndex invariant.
+ */
+export declare function transformSteps(steps: readonly StepInput[], gitRoot: string): readonly LockStepEntry[];
 /**
  * Serialize lock file to JSON string.
  *

package/dist/lockfile/generator.js

@@ -5,11 +5,11 @@ import { resolveHashFiles } from "./hash-files.js";
 import { analyzePurity } from "./purity-analyzer.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
-import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeApproval, normalizeCacheSpecs } from "@kici-dev/sdk";
+import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject, normalizeApproval, normalizeCacheSpecs } from "@kici-dev/sdk";
 import { sha256 } from "@kici-dev/core";
 import { PackageManager, detectPackageManagerSync, detectYarnFlavorSync } from "@kici-dev/core/package-manager";
-import { resolveWhenToRunOn, validateResourceRequest } from "@kici-dev/engine";
-import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
+import { assertScheduleInputsSatisfiable, extractInputsDescriptorMap, resolveWhenToRunOn, validateResourceRequest } from "@kici-dev/engine";
+import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, runsOnPickFromInput } from "@kici-dev/engine/labels/compile";
 import { execSync } from "node:child_process";
 //#region src/lockfile/generator.ts
 /**
@@ -234,7 +234,8 @@ function toLockDispatch(t) {
 	return {
 		_type: "dispatch",
 		types: t.types,
-		...reposField(t)
+		...reposField(t),
+		...t.inputs && { inputs: extractInputsDescriptorMap(t.inputs) }
 	};
 }
 function toLockCreate(t) {
@@ -344,11 +345,14 @@ function toLockGenericWebhook(t) {
 	};
 }
 function toLockSchedule(t) {
+	const inputs = t.inputs ? extractInputsDescriptorMap(t.inputs) : void 0;
+	if (inputs) assertScheduleInputsSatisfiable(inputs);
 	return {
 		_type: "schedule",
 		cronExpression: t.cron,
 		timezone: t.timezone,
-		...t.description && { description: t.description }
+		...t.description && { description: t.description },
+		...inputs && { inputs }
 	};
 }
 function toLockLifecycle(t) {
@@ -458,7 +462,8 @@ function normalizeRunsOnForLock(runsOn, jobName) {
 	const { include, exclude } = normalizeRunsOnToMatchers(runsOn, `job '${jobName}' runsOn`);
 	return {
 		runsOn: include,
-		...exclude.length > 0 ? { excludeLabels: exclude } : {}
+		...exclude.length > 0 ? { excludeLabels: exclude } : {},
+		runsOnPick: runsOnPickFromInput(runsOn)
 	};
 }
 /**
@@ -480,6 +485,34 @@ function validateRunsOn(runsOn, jobName) {
 	if (overlap.length > 0) throw new Error(`Job "${jobName}": labels and exclude overlap on [${overlap.join(", ")}]. A label cannot be both required and excluded.`);
 }
 /**
+* Transform one environment reference (static name or function) into a lock
+* `{ value, dynamic }` entry. A function element is analyzed for purity: a pure
+* function becomes an inline expression resolvable at two-phase eval; an impure
+* one carries only the `dynamic` flag (the agent runs an init job to resolve it).
+*/
+function transformEnvironmentRef(ref, jobName) {
+	if (typeof ref === "function") {
+		const fnSource = ref.toString();
+		const purity = analyzePurity(fnSource);
+		if (purity.pure) return {
+			value: {
+				_type: "inline",
+				expression: fnSource
+			},
+			dynamic: true
+		};
+		console.warn(`[kici] Job "${jobName}": environment function is not pure (${purity.reason}). An init job will be required, adding ~5-10s delay.`);
+		return {
+			value: "",
+			dynamic: true
+		};
+	}
+	return {
+		value: ref,
+		dynamic: false
+	};
+}
+/**
 * Transform a static job to lock file format.
 */
 function transformJob(job, configPath, index, gitRoot, uuidToName) {
@@ -490,18 +523,8 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 	if (!(job.matrix !== void 0 || job.runsOnAll !== void 0) && (job.maxParallel !== void 0 || job.failFast !== void 0)) console.warn(`[kici] job '${job.name}': maxParallel/failFast are ignored without matrix or runsOnAll (no fan-out to bound)`);
 	if (job.runsOn !== void 0) validateRunsOn(job.runsOn, job.name);
 	const environmentFields = {};
-	if (job.environment !== void 0) {
-		if (typeof job.environment === "function") {
-			const fnSource = job.environment.toString();
-			const purity = analyzePurity(fnSource);
-			environmentFields.dynamicEnvironment = true;
-			if (purity.pure) environmentFields.environment = {
-				_type: "inline",
-				expression: fnSource
-			};
-			else console.warn(`[kici] Job "${job.name}": environment function is not pure (${purity.reason}). An init job will be required, adding ~5-10s delay.`);
-		} else if (typeof job.environment === "string") environmentFields.environment = job.environment;
-	}
+	const envRefs = job.environments ?? (job.environment !== void 0 ? [job.environment] : void 0);
+	if (envRefs !== void 0 && envRefs.length > 0) environmentFields.environments = envRefs.map((ref) => transformEnvironmentRef(ref, job.name));
 	const envFields = {};
 	if (job.env !== void 0) {
 		if (typeof job.env === "function") {
@@ -540,6 +563,7 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 		...job.runsOn !== void 0 ? normalizeRunsOnForLock(job.runsOn, job.name) : {},
 		...job.runsOnAll !== void 0 && { runsOnAll: normalizeRunsOnAllToMatchers(job.runsOnAll, `job '${job.name}' runsOnAll`) },
 		...job.onUnreachable !== void 0 && { onUnreachable: job.onUnreachable },
+		...job.includeUninitialized !== void 0 && { includeUninitialized: job.includeUninitialized },
 		...job.maxParallel !== void 0 && { maxParallel: job.maxParallel },
 		...job.failFast !== void 0 && { failFast: job.failFast },
 		...resolveNeedsForLock(job.needs, uuidToName),
@@ -639,39 +663,78 @@ function assertNonStepApprovalScope(c, scope) {
 function assertStepApprovalCheckFacet(step) {
 	if (step.approval !== void 0 && normalizeApproval(step.approval).when === "drift" && step.check === void 0) throw new Error(`step '${step.name || "(unnamed)"}': approval.when "drift" requires a check facet`);
 }
+/**
+* Transform a job's `steps` array into lock-file entries. Sequential steps and
+* parallel-group children share one flat `step-N` counter (anonymous steps are
+* numbered across the whole flattened sequence, parallel children inline) so the
+* compiler's naming matches the agent's `extractAndNormalizeSteps` enumeration —
+* the flat-stepIndex invariant.
+*/
 function transformSteps(steps, gitRoot) {
-	let stepCounter = 0;
-	return steps.map((stepOrFn) => {
-		if (typeof stepOrFn === "function") {
-			stepCounter++;
-			return {
-				name: `step-${stepCounter}`,
-				hasOutputs: false
-			};
-		}
-		const step = stepOrFn;
+	const counter = { n: 0 };
+	let groupOrdinal = 0;
+	return steps.map((entry) => {
+		if (isParallelGroup(entry)) return transformParallelGroup(entry, gitRoot, counter, groupOrdinal++);
+		return transformSequentialStep(entry, gitRoot, counter);
+	});
+}
+/** Validate and transform a `ParallelGroup` into a `LockParallelStep`. */
+function transformParallelGroup(group, gitRoot, counter, groupOrdinal) {
+	if (group.steps.length === 0) throw new Error("job step: empty parallel group not allowed");
+	const seen = /* @__PURE__ */ new Set();
+	const children = group.steps.map((child) => {
+		if (isParallelGroup(child)) throw new Error("job step: nested parallel groups are not supported");
+		const lockChild = transformSequentialStep(child, gitRoot, counter);
+		if (seen.has(lockChild.name)) throw new Error(`job step: duplicate step name '${lockChild.name}' in parallel group`);
+		seen.add(lockChild.name);
+		return lockChild;
+	});
+	if (children.length === 1) console.warn(`[kici] parallel group with a single step ('${children[0].name}') runs identically to a sequential step`);
+	return {
+		kind: "parallel",
+		name: group.name ?? `parallel-${groupOrdinal}`,
+		failFast: group.failFast,
+		...group.maxParallel !== void 0 && { maxParallel: group.maxParallel },
+		children
+	};
+}
+/** Transform a single sequential step (or bare function) into a `LockStep`. */
+function transformSequentialStep(stepOrFn, gitRoot, counter) {
+	if (typeof stepOrFn === "function") {
+		counter.n++;
 		return {
-			name: step.name || `step-${++stepCounter}`,
-			hasOutputs: !!step.outputs && Object.keys(step.outputs).length > 0,
-			...step.continueOnError !== void 0 && { continueOnError: step.continueOnError },
-			...step.timeout !== void 0 && { timeout: step.timeout },
-			...step.cache !== void 0 && { cache: normalizeCacheSpecs(step.cache) },
-			...step._sourceLocation && { sourceLocation: {
-				file: makeRelativePath(step._sourceLocation.file, gitRoot),
-				line: step._sourceLocation.line,
-				column: step._sourceLocation.column
-			} },
-			...step.rules && step.rules.length > 0 && {
-				hasRules: true,
-				rules: transformRules(step.rules, makeRelativePath(step._sourceLocation?.file ?? "", gitRoot))
-			},
-			...step.onCancel !== void 0 && { hasOnCancel: true },
-			...step.cleanup !== void 0 && { hasCleanup: true },
-			...step.check !== void 0 && { hasCheck: true },
-			...step.whenInSync !== void 0 && { hasWhenInSync: true },
-			...step.approval !== void 0 && { approval: (assertStepApprovalCheckFacet(step), toLockApproval(step.approval)) }
+			name: `step-${counter.n}`,
+			hasOutputs: false
 		};
-	});
+	}
+	const step = stepOrFn;
+	return {
+		name: step.name || `step-${++counter.n}`,
+		hasOutputs: !!step.outputs && Object.keys(step.outputs).length > 0,
+		...step.continueOnError !== void 0 && { continueOnError: step.continueOnError },
+		...step.timeout !== void 0 && { timeout: step.timeout },
+		...step.retry !== void 0 && { retry: {
+			maxAttempts: step.retry.maxAttempts,
+			delayMs: step.retry.delayMs,
+			backoff: step.retry.backoff,
+			maxDelayMs: step.retry.maxDelayMs
+		} },
+		...step.cache !== void 0 && { cache: normalizeCacheSpecs(step.cache) },
+		...step._sourceLocation && { sourceLocation: {
+			file: makeRelativePath(step._sourceLocation.file, gitRoot),
+			line: step._sourceLocation.line,
+			column: step._sourceLocation.column
+		} },
+		...step.rules && step.rules.length > 0 && {
+			hasRules: true,
+			rules: transformRules(step.rules, makeRelativePath(step._sourceLocation?.file ?? "", gitRoot))
+		},
+		...step.onCancel !== void 0 && { hasOnCancel: true },
+		...step.cleanup !== void 0 && { hasCleanup: true },
+		...step.check !== void 0 && { hasCheck: true },
+		...step.whenInSync !== void 0 && { hasWhenInSync: true },
+		...step.approval !== void 0 && { approval: (assertStepApprovalCheckFacet(step), toLockApproval(step.approval)) }
+	};
 }
 /**
 * Strip the `?t=...` query suffix added by cache-busting `import()` calls.
@@ -749,6 +812,6 @@ function serializeLockFile(lockFile, pretty = true) {
 	return JSON.stringify(lockFile, null, pretty ? 2 : void 0);
 }
 //#endregion
-export { computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile, transformTriggers };
+export { computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile, transformSteps, transformTriggers };
 
 //# sourceMappingURL=generator.js.map

package/dist/remote/history.d.ts

@@ -2,7 +2,7 @@
  * Local run history manager.
  *
  * Persists test run history in ~/.kici/history/runs.json so developers
- * can review past runs (kici test --history) and inspect specific runs
+ * can review past runs (kici run remote --history) and inspect specific runs
  * (kici status <run-id>).
  */
 /** Status of a test run */

package/dist/remote/history.js

@@ -11,7 +11,7 @@ import picomatch from "picomatch";
 * Local run history manager.
 *
 * Persists test run history in ~/.kici/history/runs.json so developers
-* can review past runs (kici test --history) and inspect specific runs
+* can review past runs (kici run remote --history) and inspect specific runs
 * (kici status <run-id>).
 */
 /** Maximum number of entries to keep in history */

package/dist/remote/local-repo-identity.d.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+/** Git hosts whose origin URL we can turn into a real `owner/repo` + web link. */
+export declare const RecognizedProvider: z.ZodEnum<{
+    github: "github";
+    gitlab: "gitlab";
+    bitbucket: "bitbucket";
+}>;
+export type RecognizedProvider = z.infer<typeof RecognizedProvider>;
+/** The literal provider value stamped when no recognized git origin exists. */
+export declare const LOCAL_PROVIDER = "local";
+/**
+ * Parse a git remote URL into `{ provider, owner/repo }` for a recognized host.
+ * Handles scp-style ssh (`git@host:owner/repo.git`), `ssh://`, and `https://`
+ * forms; strips a trailing `.git`. Returns null for any unrecognized host or
+ * unparseable input.
+ */
+export declare function parseGitOrigin(url: string): {
+    provider: RecognizedProvider;
+    repoIdentifier: string;
+} | null;
+/** Read the `origin` remote URL of the working tree at `repoRoot`, or null. */
+export declare function detectGitOrigin(repoRoot: string): string | null;
+/**
+ * Build the repo identity stamped on a `kici run remote` run. A recognized git
+ * origin yields the real `owner/repo` + provider so the dashboard can link to
+ * it; otherwise a synthetic `local/<basename>` identity with provider `local`.
+ */
+export declare function buildLocalRepoIdentity(repoRoot: string): {
+    repoIdentifier: string;
+    provider: string;
+};
+//# sourceMappingURL=local-repo-identity.d.ts.map

package/dist/remote/local-repo-identity.js

@@ -0,0 +1,74 @@
+import "../chunk-BTugEXQM.js";
+import path from "node:path";
+import { execSync } from "node:child_process";
+import { z } from "zod";
+//#region src/remote/local-repo-identity.ts
+/** Git hosts whose origin URL we can turn into a real `owner/repo` + web link. */
+const RecognizedProvider = z.enum([
+	"github",
+	"gitlab",
+	"bitbucket"
+]);
+/** Host → provider map. The keys are the canonical public hostnames. */
+const HOST_PROVIDER = {
+	"github.com": "github",
+	"gitlab.com": "gitlab",
+	"bitbucket.org": "bitbucket"
+};
+/** The literal provider value stamped when no recognized git origin exists. */
+const LOCAL_PROVIDER = "local";
+/**
+* Parse a git remote URL into `{ provider, owner/repo }` for a recognized host.
+* Handles scp-style ssh (`git@host:owner/repo.git`), `ssh://`, and `https://`
+* forms; strips a trailing `.git`. Returns null for any unrecognized host or
+* unparseable input.
+*/
+function parseGitOrigin(url) {
+	const trimmed = url.trim();
+	const scp = /^[^@]+@([^:]+):(.+?)(?:\.git)?$/.exec(trimmed);
+	const urlStyle = /^[a-z]+:\/\/(?:[^@/]+@)?([^/]+)\/(.+?)(?:\.git)?$/.exec(trimmed);
+	const match = scp ?? urlStyle;
+	if (!match) return null;
+	const provider = HOST_PROVIDER[match[1].toLowerCase()];
+	if (!provider) return null;
+	const repoIdentifier = match[2].replace(/^\/+|\/+$/g, "");
+	if (!repoIdentifier.includes("/")) return null;
+	return {
+		provider,
+		repoIdentifier
+	};
+}
+/** Read the `origin` remote URL of the working tree at `repoRoot`, or null. */
+function detectGitOrigin(repoRoot) {
+	try {
+		return execSync("git remote get-url origin", {
+			cwd: repoRoot,
+			encoding: "utf-8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+/**
+* Build the repo identity stamped on a `kici run remote` run. A recognized git
+* origin yields the real `owner/repo` + provider so the dashboard can link to
+* it; otherwise a synthetic `local/<basename>` identity with provider `local`.
+*/
+function buildLocalRepoIdentity(repoRoot) {
+	const origin = detectGitOrigin(repoRoot);
+	const parsed = origin ? parseGitOrigin(origin) : null;
+	if (parsed) return parsed;
+	return {
+		repoIdentifier: `local/${path.basename(repoRoot)}`,
+		provider: LOCAL_PROVIDER
+	};
+}
+//#endregion
+export { LOCAL_PROVIDER, RecognizedProvider, buildLocalRepoIdentity, detectGitOrigin, parseGitOrigin };
+
+//# sourceMappingURL=local-repo-identity.js.map

package/dist/remote/platform-client.d.ts

@@ -82,6 +82,12 @@ export interface PlatformTriggerInput {
      * the orchestrator, which intersects each runsOnAll roster with it.
      */
     target?: HostTargetSelector;
+    /**
+     * Raw operator-supplied `kici run --input KEY=VALUE` pairs (not defaulted /
+     * coerced). The Platform relays them verbatim; the orchestrator validates,
+     * coerces, and applies defaults authoritatively against the lock descriptor.
+     */
+    dispatchInputs?: Record<string, string>;
 }
 export interface PlatformTriggerResponse {
     runId: string;

package/dist/remote/prod-defaults.d.ts

@@ -15,4 +15,12 @@ export declare const PROD_PLATFORM_URL = "https://api.kici.dev";
 export declare const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
 /** Public OIDC client id registered for the `kici` CLI. */
 export declare const PROD_OIDC_CLIENT_ID = "kici-cli";
+/**
+ * Provenance trust root for `kici verify-attestation` when `--trust-root` is
+ * omitted: the hosted KiCI Platform's provenance issuer. The verifier appends
+ * `/.well-known/openid-configuration` and pins the token issuer to it. Pass
+ * `--trust-root` to verify against a different environment (e.g. staging) or an
+ * offline `{ issuer, jwks }` file.
+ */
+export declare const PROD_PROVENANCE_ISSUER = "https://api.kici.dev";
 //# sourceMappingURL=prod-defaults.d.ts.map