@kici-dev/compiler 0.1.22 → 0.1.24

package/dist/remote/prod-defaults.js

@@ -17,7 +17,15 @@ const PROD_PLATFORM_URL = "https://api.kici.dev";
 const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
 /** Public OIDC client id registered for the `kici` CLI. */
 const PROD_OIDC_CLIENT_ID = "kici-cli";
+/**
+* Provenance trust root for `kici verify-attestation` when `--trust-root` is
+* omitted: the hosted KiCI Platform's provenance issuer. The verifier appends
+* `/.well-known/openid-configuration` and pins the token issuer to it. Pass
+* `--trust-root` to verify against a different environment (e.g. staging) or an
+* offline `{ issuer, jwks }` file.
+*/
+const PROD_PROVENANCE_ISSUER = "https://api.kici.dev";
 //#endregion
-export { PROD_OIDC_CLIENT_ID, PROD_OIDC_ISSUER, PROD_PLATFORM_URL };
+export { PROD_OIDC_CLIENT_ID, PROD_OIDC_ISSUER, PROD_PLATFORM_URL, PROD_PROVENANCE_ISSUER };
 
 //# sourceMappingURL=prod-defaults.js.map

package/dist/remote/uploader.js

@@ -232,6 +232,7 @@ function getSizeWarning(compressedSize) {
 */
 async function uploadTarball(opts) {
 	const { tarballPath, signedUrl, orchestratorPublicKey, onProgress } = opts;
+	if (!signedUrl) throw new Error("The orchestrator did not return an upload URL, so the overlay cannot be uploaded. This usually means the orchestrator has no object storage configured for remote runs. Ask your orchestrator operator to enable cache storage (KICI_STORAGE_TYPE=s3 or filesystem).");
 	const { encryptedPath, cliPublicKey } = await encryptTarball(tarballPath, orchestratorPublicKey);
 	const encryptedData = await fs.readFile(encryptedPath);
 	const encryptedSize = encryptedData.length;

package/dist/templates/agents-md.d.ts

@@ -4,5 +4,5 @@
  * picked up by Claude Code, Cursor, Aider, and other coding agents that scan
  * the working tree for an authoring context file.
  */
-export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici test pr:open --debug`| Preview which workflows match an event.     |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici test <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
+export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici preview pr:open --debug` | Preview which workflows match an event.   |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici preview <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
 //# sourceMappingURL=agents-md.d.ts.map

package/dist/templates/agents-md.js

@@ -112,7 +112,7 @@ into a portable lock file, and executed by self-hosted agents.
 | Command                         | Purpose                                     |
 | ------------------------------- | ------------------------------------------- |
 | \`pnpm kici compile --check\`     | Validate workflow source without writing.   |
-| \`pnpm kici test pr:open --debug\`| Preview which workflows match an event.     |
+| \`pnpm kici preview pr:open --debug\` | Preview which workflows match an event.   |
 | \`pnpm kici run local push\`      | Execute workflows locally with no orchestrator. |
 | \`pnpm kici docs llm\`            | Print the full LLM documentation bundle.    |
 | \`pnpm kici docs llm --index\`    | Print the curated link index.               |
@@ -126,7 +126,7 @@ If \`pnpm kici\` isn't in scripts, fall back to \`npx kici\`.
    the full bundle.
 3. Edit a workflow under \`.kici/workflows/\`.
 4. Run \`kici compile --check\` (zero exit means valid).
-5. Run \`kici test <event>\` to preview matching.
+5. Run \`kici preview <event>\` to preview matching.
 6. Run \`kici run local <event>\` to execute locally before pushing.
 `;
 //#endregion

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../chunk-BTugEXQM.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.22";
+const sdkVersion = "0.1.24";
 /**
 * Generate package.json content for .kici/ directory
 *

package/dist/test-runner/rule-evaluator.d.ts

@@ -3,7 +3,7 @@ import type { RuleEvaluationResult } from '@kici-dev/sdk';
 /**
  * Create RuleContext for rule evaluation.
  */
-export declare function createRuleContext(event: EventPayload, changedFiles?: string[]): RuleContext;
+export declare function createRuleContext(event: EventPayload, changedFiles?: string[], dispatchInputs?: Readonly<Record<string, string | number | boolean | null>>): RuleContext;
 /**
  * Evaluate rules with formatting output.
  * Wraps the SDK's evaluateRules() with a callback that logs each rule result.

package/dist/test-runner/rule-evaluator.js

@@ -8,11 +8,12 @@ initZx();
 /**
 * Create RuleContext for rule evaluation.
 */
-function createRuleContext(event, changedFiles = []) {
+function createRuleContext(event, changedFiles = [], dispatchInputs = {}) {
 	return {
 		event,
 		changedFiles,
 		env: { ...process.env },
+		dispatchInputs,
 		$
 	};
 }

package/dist/test-runner/step-context.d.ts

@@ -11,5 +11,5 @@ import type { StepContext, WorkflowInfo, JobInfo, MatrixValues } from '@kici-dev
 export declare function createStepContext(workflowInfo: WorkflowInfo, jobInfo: JobInfo, repoRoot: string, inputs?: Record<string, unknown>, matrix?: MatrixValues, testSecrets?: {
     flat: Record<string, string>;
     contexts: Record<string, Record<string, string>>;
-}, environment?: string, rawPayload?: Record<string, unknown>, provider?: string): StepContext;
+}, environment?: string, rawPayload?: Record<string, unknown>, provider?: string, dispatchInputs?: Readonly<Record<string, string | number | boolean | null>>, signal?: AbortSignal): StepContext;
 //# sourceMappingURL=step-context.d.ts.map

package/dist/test-runner/step-context.js

@@ -42,7 +42,7 @@ function createTestLogger(jobName) {
 * `ctx.$` would inherit `process.cwd()` — i.e. wherever the user invoked
 * `kici` — which silently breaks any step that uses relative paths.
 */
-function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix, testSecrets, environment, rawPayload, provider) {
+function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix, testSecrets, environment, rawPayload, provider, dispatchInputs = {}, signal = new AbortController().signal) {
 	const flat = testSecrets?.flat ?? {};
 	const namespacedSecrets = testSecrets?.contexts ?? {};
 	const mergedFlat = { ...flat };
@@ -99,6 +99,7 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 	return {
 		$: scoped$,
 		log: createTestLogger(jobInfo.name),
+		signal,
 		env,
 		setEnv: (key, value) => {
 			env[key] = value;
@@ -110,6 +111,7 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 			process.env.PATH = updated;
 		},
 		inputs,
+		dispatchInputs,
 		workflow: workflowInfo,
 		job: jobInfo,
 		matrix,
@@ -138,7 +140,11 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 				get: () => Promise.resolve(null)
 			},
 			oidc: { token: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.oidc.token() is not available in the local test runner")) },
-			host: { requestReboot: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.host.requestReboot() is not available in the local test runner")) }
+			host: { requestReboot: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.host.requestReboot() is not available in the local test runner")) },
+			bootstrap: {
+				ensureInitRunner: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.bootstrap.ensureInitRunner() is not available in the local test runner")),
+				preBootSend: () => Promise.reject(/* @__PURE__ */ new Error("ctx.kici.bootstrap.preBootSend() is not available in the local test runner"))
+			}
 		},
 		cache: {
 			restore: async () => ({ hit: false }),

package/dist/types.d.ts

@@ -12,7 +12,7 @@
  * v15 adds per-job init config(s).
  * v17 widens per-job init to typed presets ('mise' / { mise }) and 'auto' detection.
  */
-import type { ResourceRequest, ApproverClause, RunsOnAllPredicate, OnUnreachableMode, LabelMatcher, ExecutionJobStatus } from '@kici-dev/engine';
+import type { ResourceRequest, ApproverClause, RunsOnAllPredicate, OnUnreachableMode, LabelMatcher, ExecutionJobStatus, InputsDescriptorMap } from '@kici-dev/engine';
 /**
  * Normalized approval config carried in the lock file. Mirrors the engine
  * `LockApproval` type. Produced by the compiler from an SDK `approval` config.
@@ -28,7 +28,7 @@ export interface LockApproval {
     readonly when: 'always' | 'drift';
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 22;
+export declare const SCHEMA_VERSION: 29;
 /**
  * Source file reference with meaningful path.
  * Format: file is relative path from git root, export uses hash syntax.
@@ -127,6 +127,8 @@ export interface LockDispatchTrigger {
     readonly _type: 'dispatch';
     readonly types: readonly string[];
     readonly repos?: readonly LockBranchPattern[];
+    /** Typed dispatch-input descriptors (from `dispatch({ inputs })`). */
+    readonly inputs?: InputsDescriptorMap;
 }
 /**
  * Create trigger in lock file.
@@ -273,6 +275,8 @@ export interface LockScheduleTrigger {
     readonly cronExpression: string;
     readonly timezone: string;
     readonly description?: string;
+    /** Typed schedule-input descriptors (from `schedule({ inputs })`); defaults-only. */
+    readonly inputs?: InputsDescriptorMap;
 }
 /**
  * Lifecycle trigger in lock file.
@@ -317,6 +321,8 @@ export interface LockRule {
  * Minimal representation - agents load full step functions from source.
  */
 export interface LockStep {
+    /** Discriminator for the step union; absent/`'sequential'` is an ordinary step. */
+    readonly kind?: 'sequential';
     readonly name: string;
     readonly hasOutputs: boolean;
     /** When true, job proceeds even if this step fails. */
@@ -351,6 +357,24 @@ export interface LockStep {
     /** Normalized approval gate; when set the step pauses for a human approval. */
     readonly approval?: LockApproval;
 }
+/**
+ * A concurrent group of sequential steps in the lock file. Children run
+ * concurrently behind a join barrier; the group wrapper itself consumes no
+ * flat step index (its children carry the indices). No nesting is allowed.
+ */
+export interface LockParallelStep {
+    readonly kind: 'parallel';
+    readonly name: string;
+    /** Cancel in-flight siblings when the first child fails (default true). */
+    readonly failFast: boolean;
+    /** Maximum children running at once; queued children report `pending`. */
+    readonly maxParallel?: number;
+    readonly children: readonly LockStep[];
+}
+/** A lock-file entry in a job's `steps` array: an ordinary step or a parallel group. */
+export type LockStepEntry = LockStep | LockParallelStep;
+/** Type guard distinguishing a parallel group from an ordinary lock step. */
+export declare function isLockParallelStep(entry: LockStepEntry): entry is LockParallelStep;
 /**
  * Inline expression value for pure dynamic functions.
  * The compiler serializes pure functions as { _type: 'inline', expression: '(event) => ...' }
@@ -392,6 +416,8 @@ export interface LockJob {
     readonly runsOnAll?: RunsOnAllPredicate;
     /** Failure policy for unreachable durable hosts in a runsOnAll fan-out. */
     readonly onUnreachable?: OnUnreachableMode;
+    /** Widen runsOnAll to declared-but-un-agented hosts (init-runner bring-up per fresh box). */
+    readonly includeUninitialized?: boolean;
     /** Fan-out concurrency width (sliding window; 1 = serial). Applies to matrix and runsOnAll. */
     readonly maxParallel?: number;
     /** Halt the fan-out on first child failure, skipping the held remainder. Default false. */
@@ -399,7 +425,7 @@ export interface LockJob {
     readonly needs: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
     /** Group names this job depends on (populated from dynamicGroup refs). */
     readonly dependsOnGroups?: readonly string[];
-    readonly steps: readonly LockStep[];
+    readonly steps: readonly LockStepEntry[];
     readonly matrix?: LockMatrix;
     readonly include?: readonly Record<string, string>[];
     readonly exclude?: readonly Record<string, string>[];
@@ -414,10 +440,15 @@ export interface LockJob {
         image: string;
         env?: Record<string, string>;
     };
-    /** Deployment environment name (static string) or inline expression (pure function). */
-    readonly environment?: string | LockInlineValue;
-    /** When true, environment is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */
-    readonly dynamicEnvironment?: boolean;
+    /**
+     * Deployment environments in merge order. Each entry is a static name or inline
+     * expression (pure function); `dynamic` is set when it is a function resolved at
+     * two-phase eval. Later entries override earlier ones on name collisions.
+     */
+    readonly environments?: ReadonlyArray<{
+        value: string | LockInlineValue;
+        dynamic: boolean;
+    }>;
     /** Static environment variables or inline expression (pure function). */
     readonly env?: Record<string, string> | LockInlineValue;
     /** When true, env is dynamic (function) -- resolved at orchestrator two-phase eval or inline. */

package/dist/types.js

@@ -17,6 +17,10 @@ import { SCHEMA_VERSION as SCHEMA_VERSION$1 } from "@kici-dev/engine";
 */
 /** Schema version - re-exported from engine as single source of truth */
 const SCHEMA_VERSION = SCHEMA_VERSION$1;
+/** Type guard distinguishing a parallel group from an ordinary lock step. */
+function isLockParallelStep(entry) {
+	return entry.kind === "parallel";
+}
 /** Type guard for inline expression values */
 function isLockInlineValue(value) {
 	return typeof value === "object" && value !== null && value._type === "inline";
@@ -30,6 +34,6 @@ function isLockDynamicJobFn(job) {
 	return job._type === "dynamic";
 }
 //#endregion
-export { SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob };
+export { SCHEMA_VERSION, isLockDynamicJobFn, isLockInlineValue, isLockParallelStep, isLockStaticJob };
 
 //# sourceMappingURL=types.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.1.22",
+  "version": "0.1.24",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -30,9 +30,6 @@
     "access": "public"
   },
   "type": "module",
-  "bin": {
-    "kici": "./dist/cli.js"
-  },
   "files": [
     "dist",
     "!dist/**/*.map",
@@ -63,11 +60,11 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.1.22",
-    "@kici-dev/engine": "0.1.22"
+    "@kici-dev/core": "0.1.24",
+    "@kici-dev/engine": "0.1.24"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.1.22"
+    "@kici-dev/sdk": "0.1.24"
   },
   "devDependencies": {
     "@types/proper-lockfile": "^4.1.4"

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/compiler@0.1.22",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.22/3348af69-8089-4211-a0f3-9a8e9a3651f4",
+  "name": "@kici-dev/compiler@0.1.24",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fcompiler/0.1.24/5972016c-419a-4b37-a318-6beead684099",
   "creationInfo": {
-    "created": "2026-06-24T06:03:11Z",
+    "created": "2026-06-28T16:24:34Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -484,7 +484,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/compiler",
-      "versionInfo": "0.1.22",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -495,16 +495,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.22"
+          "referenceLocator": "pkg:npm/%40kici-dev/compiler@0.1.24"
         }
       ],
       "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "SPDXID": "SPDXRef-Package--kici-dev-core-0.1.24",
       "name": "@kici-dev/core",
-      "versionInfo": "0.1.22",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -515,16 +515,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.22"
+          "referenceLocator": "pkg:npm/%40kici-dev/core@0.1.24"
         }
       ],
       "description": "Light shared utilities for the KiCI stack (logging, errors, formatting, crypto, zx init, the TypeScript ESM loader hook). No server-side dependencies.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.22",
+      "SPDXID": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.22",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -535,16 +535,16 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.22"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.24"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
       "homepage": "https://kici.dev"
     },
     {
-      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.22",
+      "SPDXID": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "name": "@kici-dev/sdk",
-      "versionInfo": "0.1.22",
+      "versionInfo": "0.1.24",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -555,7 +555,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.22"
+          "referenceLocator": "pkg:npm/%40kici-dev/sdk@0.1.24"
         }
       ],
       "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
@@ -3222,17 +3222,17 @@
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.22",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
       "spdxElementId": "SPDXRef-RootPackage",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.22",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
@@ -3301,82 +3301,82 @@
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-oxc-transform-0.135.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-picocolors-1.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-daily-rotate-file-5.0.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-winston-3.19.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-jose-6.2.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-jsonpath-plus-10.4.0",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-picomatch-4.0.4",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-safe-regex-2.1.1",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-core-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
-      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
+      "relatedSpdxElement": "SPDXRef-Package--kici-dev-engine-0.1.24",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-micromatch-4.0.8",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zod-4.4.3",
       "relationshipType": "DEPENDS_ON"
     },
     {
-      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.22",
+      "spdxElementId": "SPDXRef-Package--kici-dev-sdk-0.1.24",
       "relatedSpdxElement": "SPDXRef-Package-zx-8.8.5",
       "relationshipType": "DEPENDS_ON"
     },