@kici-dev/compiler 0.1.23 → 0.1.24

package/dist/llm-context/llms-getting-started.txt

@@ -24,7 +24,7 @@ Why the lock file must stay in sync with workflow source, how to commit both tog
 
 ### [CLI reference](https://docs.kici.dev/user/cli-reference/)
 
-All CLI commands provided by `@kici-dev/compiler`: `kici compile` (with watch mode and check mode), `kici run` (local and remote execution), `kici test` (event simulation with dry-run, filtering, debug output, and custom payloads), `kici login`/`logout`/`org` (authentication and org management), `kici diagnostics` (infrastructure tree) and `kici runs` (`list`/`show`/`logs`/`rerun`/`cancel` — run management), `kici secrets` (secret listing), `kici types` (type generation), `kici fixture` (generate test payloads), `kici init` (interactive project scaffolding), `kici hook` (pre-commit hook installation), `kici endpoints` (webhook entrypoints), and `kici workflows` (workflow listing). Includes environment variables and exit codes.
+All CLI commands provided by `@kici-dev/compiler`: `kici compile` (with watch mode and check mode), `kici run` (local and remote execution), `kici preview` (event simulation with dry-run, filtering, debug output, and custom payloads), `kici login`/`logout`/`org` (authentication and org management), `kici diagnostics` (infrastructure tree) and `kici runs` (`list`/`show`/`logs`/`rerun`/`cancel` — run management), `kici secrets` (secret listing), `kici types` (type generation), `kici fixture` (generate test payloads), `kici init` (interactive project scaffolding), `kici hook` (pre-commit hook installation), `kici endpoints` (webhook entrypoints), and `kici workflows` (workflow listing). Includes environment variables and exit codes.
 
 ### [Workflow patterns](https://docs.kici.dev/user/workflow-patterns/)
 
@@ -247,10 +247,10 @@ The lock file (`kici.lock.json`) is a JSON representation of your workflow that
 
 ## Preview trigger matching
 
-Use `kici test` to preview which workflows match a trigger event (dry-run, no execution):
+Use `kici preview` to preview which workflows match a trigger event (dry-run, no execution):
 
 ```bash
-npx kici test pr:open
+npx kici preview pr:open
 ```
 
 Expected output (simplified):
@@ -416,14 +416,14 @@ Or add the flag to your root `package.json`:
 
 ## Authoring KiCI workflows with LLM coding agents
 
-KiCI is LLM-ready by design. Because workflows are real, typed TypeScript, coding agents reason over the SDK's `.d.ts` signatures instead of guessing a bespoke YAML DSL — and they verify their own pipelines with the same `kici test` and `kici run local` loop you use, so there's no push-to-find-out round-trip. First-class agent context ships in the box, so an agent is briefed the moment it opens the project.
+KiCI is LLM-ready by design. Because workflows are real, typed TypeScript, coding agents reason over the SDK's `.d.ts` signatures instead of guessing a bespoke YAML DSL — and they verify their own pipelines with the same `kici preview` and `kici run local` loop you use, so there's no push-to-find-out round-trip. First-class agent context ships in the box, so an agent is briefed the moment it opens the project.
 
 KiCI ships first-class context for LLM coding agents (Claude Code, Cursor, Aider, etc.). When you scaffold a project with `kici init`, the CLI writes `.kici/AGENTS.md`, a one-page briefing that tells the agent:
 
 - where the SDK type declarations live (`node_modules/@kici-dev/sdk/dist/index.d.ts`)
 - the five canonical authoring patterns with runnable examples
 - the anti-patterns that catch agents off-guard (no YAML, no `/dist/...` imports, no top-level `await`)
-- the local commands the agent should drive (`kici compile --check`, `kici test`, `kici run local`, `kici docs llm`)
+- the local commands the agent should drive (`kici compile --check`, `kici preview`, `kici run local`, `kici docs llm`)
 
 If you don't want the file, pass `--no-agents-md` to `kici init`, or delete the file afterwards — KiCI never reads it at runtime.
 
@@ -514,6 +514,6 @@ If you're not sure, pick Docker / Podman.
 
 ## Looking for the laptop-only path?
 
-Both quickstarts deploy a real orchestrator + agent. If you only want to write a workflow and dry-run it on your laptop with no infrastructure, [Getting started](https://docs.kici.dev/user/getting-started/) covers `kici test` and `kici run local` instead.
+Both quickstarts deploy a real orchestrator + agent. If you only want to write a workflow and dry-run it on your laptop with no infrastructure, [Getting started](https://docs.kici.dev/user/getting-started/) covers `kici preview` and `kici run local` instead.
 
 ---

package/dist/llm-context/llms-sdk.txt

@@ -807,7 +807,7 @@ const deploy = job('deploy', {
 
 **Important:** `needs` must be declared explicitly. Output chaining does not auto-infer dependencies -- you must list job dependencies in `needs` even if you access their outputs via `.result`.
 
-Cross-job output chaining works in both local test mode (`kici test`) and remote pipeline execution. The orchestrator's needs-aware dispatch scheduler guarantees upstream jobs reach a terminal state before downstream jobs dispatch, and upstream outputs are transported to the downstream agent sandbox via the `upstreamJobOutputs` field on `job.dispatch`. See [needs-scheduler](https://docs.kici.dev/architecture/execution/needs-scheduler/) for the full dispatch semantics.
+Cross-job output chaining works in both local execution (`kici run local`) and remote pipeline execution. The orchestrator's needs-aware dispatch scheduler guarantees upstream jobs reach a terminal state before downstream jobs dispatch, and upstream outputs are transported to the downstream agent sandbox via the `upstreamJobOutputs` field on `job.dispatch`. See [needs-scheduler](https://docs.kici.dev/architecture/execution/needs-scheduler/) for the full dispatch semantics.
 
 ### Job dependencies (`needs`)
 
@@ -1473,6 +1473,88 @@ The caller never has to branch on outcome — `result.result` is always a `Bucke
 
 ---
 
+## SDK reference: parallel
+
+Source: https://docs.kici.dev/user/sdk/parallel/
+
+`parallel([...steps], opts?)` runs a group of independent steps **concurrently**
+within one job, behind a join barrier: execution continues past the group only
+once every child has settled. Each child is its own observable step — it gets its
+own logs, status, timing, and retry — instead of being hidden inside one step's
+`Promise.all`.
+
+```ts
+import { workflow, job, step, parallel, push } from '@kici-dev/sdk';
+
+export default workflow('ci', {
+  on: push(),
+  jobs: [
+    job('checks', {
+      runsOn: 'kici:os:linux',
+      steps: [
+        checkout,
+        // lint, typecheck, and the unit tests have no ordering between them,
+        // so they run together — the job's wall-clock is the slowest child,
+        // not the sum of all three.
+        parallel([lint, typecheck, unitTests], { failFast: true }),
+        deploy,
+      ],
+    }),
+  ],
+});
+```
+
+`parallel(...)` returns a `ParallelGroup` that sits in the ordinary flat
+`steps: [...]` array — there is no new `job` field. A group's children are
+**sequential steps only**; groups cannot be nested.
+
+## Options
+
+`parallel(steps, opts?)` accepts:
+
+- **`failFast?: boolean`** — default `true`. When a child fails, the in-flight
+  siblings are cancelled immediately and the job fails. With `failFast: false`
+  every child runs to completion first, then the job fails if any child failed.
+- **`maxParallel?: number`** — default unlimited. Caps how many children run at
+  once; children waiting for a slot report a `pending` status until they launch.
+- **`name?: string`** — a label for the group's dashboard band.
+
+A child marked `continueOnError: true` never trips fail-fast and never fails the
+job — it still shows a `failed` status badge, but the group treats it as
+non-fatal.
+
+## Statuses
+
+Parallel steps introduce two step statuses:
+
+- **`pending`** — a child queued behind `maxParallel`, not yet launched.
+- **`cancelled`** — a sibling aborted by fail-fast. A cancelled step is **not** a
+  failure: only the child that actually failed fails the job; the cancelled
+  siblings render in gray (distinct from the red failing step) on the dashboard.
+
+Children may also complete **out of order** — the fastest child finishes first
+regardless of array position. A later sequential step can read a parallel child's
+`.result` after the barrier; children within a group cannot read each other's
+results (there is no ordering inside the group).
+
+## Scope: nests inside job-level fan-out
+
+`parallel()`'s `failFast` / `maxParallel` are **step-group** scopes — they govern
+only the steps inside the group. They are a different layer from the **job-level**
+`failFast` / `maxParallel` on a matrix / `runsOnAll` fan-out, which govern how a
+job's child _jobs_ spread across the matrix or host roster. A `parallel()` group
+inside a fan-out job nests its concurrency inside each fan-out child.
+
+## Local vs remote execution
+
+Run remotely (the orchestrator + agent), parallel children execute concurrently
+and each surfaces as its own dashboard step. `kici run local` executes the same
+children in array order in its single-process model — the results are identical,
+only the wall-clock and the live fail-fast cancellation differ. Use a remote run
+to observe the concurrent timeline.
+
+---
+
 ## SDK reference: rules, matrix, dynamic jobs
 
 Source: https://docs.kici.dev/user/sdk/rules-matrix-dynamic/
@@ -2371,7 +2453,7 @@ interface StepContext<TInputs = Record<string, unknown>> {
   rawPayload?: Record<string, unknown>;
   /** Which git provider triggered this workflow (e.g. 'github', 'gitlab') */
   provider?: string;
-  /** Whether this execution was triggered by `kici test` (remote test run) */
+  /** Whether this execution was triggered by `kici run remote` (developer-initiated remote run) */
   isTestRun: boolean;
   /** The resolved deployment environment name for this job (undefined without environment) */
   environment?: string;
@@ -2768,7 +2850,7 @@ Tools that require a file path on disk (sops `SOPS_AGE_KEY_FILE`, kubectl `KUBEC
 
 ### Local test mode secrets
 
-When running `kici test`, you can provide secrets locally without an orchestrator.
+When running `kici preview`, you can provide secrets locally without an orchestrator.
 
 #### .kici/.secrets file
 
@@ -2796,10 +2878,10 @@ Override or supplement file-based secrets with CLI flags:
 
 ```bash
 # Inject flat secrets (repeatable)
-kici test push --secret DEPLOY_TOKEN=my-token --secret API_KEY=my-key
+kici preview push --secret DEPLOY_TOKEN=my-token --secret API_KEY=my-key
 
 # Inject context-scoped secrets (repeatable)
-kici test push --context production.DB_PASSWORD=prod-secret --context npm-publish.NPM_TOKEN=abc123
+kici preview push --context production.DB_PASSWORD=prod-secret --context npm-publish.NPM_TOKEN=abc123
 ```
 
 **Precedence:** CLI flags override `.kici/.secrets` file values. Context secrets are auto-flattened into `ctx.secrets` using the same merge logic as production (last context wins).
@@ -3354,6 +3436,7 @@ interface ScheduleConfigInput {
   cron: string; // Required: cron expression (5-field)
   timezone?: string; // Timezone for cron evaluation (default: 'UTC')
   description?: string; // Human-readable description of the schedule
+  inputs?: DispatchInputsMap; // Optional: defaults-only typed inputs (see below)
 }
 ```
 
@@ -3364,6 +3447,41 @@ schedule({ cron: '0 9 * * 1', timezone: 'America/New_York' }); // Monday 9am ET
 schedule({ cron: '*/15 * * * *', description: 'health check every 15 min' });
 ```
 
+#### Schedule inputs (defaults-only)
+
+A `schedule()` trigger may declare typed `inputs`. A cron or dashboard
+"run now" fire carries **no operator-supplied values**, so each input resolves
+from its declared **default** and is exposed to steps and rules as
+`ctx.dispatchInputs` — the same surface as [typed dispatch inputs](https://docs.kici.dev/user/sdk/triggers/#typed-dispatch-inputs).
+
+Because there is no operator to supply a value, every schedule input must
+declare a `.default()` **or** be `.optional()`. An input that is neither is
+rejected at `kici compile` time.
+
+```typescript
+import { workflow, job, schedule, z } from '@kici-dev/sdk';
+
+export default workflow('nightly', {
+  on: schedule({
+    cron: '0 3 * * *',
+    inputs: { mode: z.enum(['full', 'quick']).default('full') },
+  }),
+  jobs: [
+    job('build', {
+      runsOn: 'default',
+      run: async (ctx) => {
+        ctx.log(`mode = ${ctx.dispatchInputs.mode}`); // "full" on every fire
+      },
+    }),
+  ],
+});
+```
+
+You can also share a typed handle via `defineDispatchInputs(...)` and read it
+back with `.from(ctx)`, exactly as with `dispatch()`. The allowed input types
+are the same closed subset documented under
+[typed dispatch inputs](https://docs.kici.dev/user/sdk/triggers/#typed-dispatch-inputs).
+
 ### lifecycle()
 
 Create a lifecycle trigger for cross-workflow orchestration events. Returns a frozen `LifecycleTriggerConfig`.
@@ -3692,7 +3810,7 @@ If `check()` throws while polling, the error is logged and polling continues —
 
 Source: https://docs.kici.dev/user/sdk-reference/
 
-Reference documentation for `@kici-dev/sdk`. The reference is split across five pages by topic.
+Reference documentation for `@kici-dev/sdk`. The reference is split across the per-topic pages below.
 
 | Page                                                         | Covers                                                                                                                                                                                                                      |
 | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -3704,6 +3822,7 @@ Reference documentation for `@kici-dev/sdk`. The reference is split across five
 | [Runtime](https://docs.kici.dev/user/sdk/runtime/)                                  | Types index, `StepContext`, secrets, and fixtures.                                                                                                                                                                          |
 | [Idempotent helpers](https://docs.kici.dev/user/sdk/idempotent/)                    | `idempotent()`, `idempotentStep()`, and the check-mode-aware `checkStep()` — check / apply pattern with typed results on both the skipped and applied branches.                                                             |
 | [Wait-for helpers](https://docs.kici.dev/user/sdk/wait-for/)                        | `waitFor()` and `waitForStep()` — poll a condition on an interval, run an optional success action, recover gracefully on timeout.                                                                                           |
+| [Parallel steps](https://docs.kici.dev/user/sdk/parallel/)                          | `parallel()` — run independent steps concurrently within one job behind a join barrier, each as its own observable step, with `failFast` and `maxParallel` controls.                                                        |
 
 The `@kici-dev/sdk` package re-exports the entire surface from a single entry point. Pick what you need:
 

package/dist/llm-context/llms.txt

@@ -10,11 +10,11 @@ Each bundle below is a self-contained markdown file for one authoring task. Fetc
 
 - [getting-started](https://docs.kici.dev/llms-getting-started.txt) (25 KB) — Install the SDK, write your first workflow, compile and test locally
 - [patterns](https://docs.kici.dev/llms-patterns.txt) (49 KB) — Copy-paste workflow recipes: triggers, conditionals, matrix, scheduling, integrations
-- [sdk](https://docs.kici.dev/llms-sdk.txt) (185 KB) — Authoring API: workflow/job/step factories, triggers, rules, matrix, runtime, caching
-- [cli](https://docs.kici.dev/llms-cli.txt) (117 KB) — Running the CLI: compile, test, run local/remote, auth, hooks, lock-file drift
-- [features](https://docs.kici.dev/llms-features.txt) (116 KB) — Workflow features: concurrency, environments, secrets, approvals, provenance, events
+- [sdk](https://docs.kici.dev/llms-sdk.txt) (190 KB) — Authoring API: workflow/job/step factories, triggers, rules, matrix, runtime, caching
+- [cli](https://docs.kici.dev/llms-cli.txt) (124 KB) — Running the CLI: compile, test, run local/remote, auth, hooks, lock-file drift
+- [features](https://docs.kici.dev/llms-features.txt) (124 KB) — Workflow features: concurrency, environments, secrets, approvals, provenance, events
 - [providers](https://docs.kici.dev/llms-providers.txt) (36 KB) — Connecting sources: GitHub App, universal-git (Forgejo/Gitea/GitLab), local file://
-- [architecture](https://docs.kici.dev/llms-architecture.txt) (88 KB) — How the runtime works: three-tier relay model, data flows, configuration
+- [architecture](https://docs.kici.dev/llms-architecture.txt) (87 KB) — How the runtime works: three-tier relay model, data flows, configuration
 
 ## Getting started
 
@@ -37,6 +37,7 @@ Each bundle below is a self-contained markdown file for one authoring task. Fetc
 - [SDK reference: core](https://docs.kici.dev/user/sdk/core/): Factory functions (workflow, job, step) and authoring patterns: needs, output chaining, dynamic groups
 - [Event payload reference](https://docs.kici.dev/user/sdk/event-payloads/): Generated schema of the normalized event envelope passed to rules and dynamic functions.
 - [SDK reference: idempotent](https://docs.kici.dev/user/sdk/idempotent/): Idempotent helpers for declarative check / apply patterns inside workflow steps
+- [SDK reference: parallel](https://docs.kici.dev/user/sdk/parallel/): Run independent steps concurrently within a single job, each as its own observable step
 - [SDK reference: rules, matrix, dynamic jobs](https://docs.kici.dev/user/sdk/rules-matrix-dynamic/): rule(), skip(), matrix builds (static + dynamic), and dynamicJob / dynamicGroup
 - [SDK reference: runsOnAll host fan-out](https://docs.kici.dev/user/sdk/runs-on-all/): Fan one job out to every matching connected host, one pinned execution per host
 - [SDK reference: runtime](https://docs.kici.dev/user/sdk/runtime/): Types index, StepContext, secrets, fixtures
@@ -47,8 +48,9 @@ Each bundle below is a self-contained markdown file for one authoring task. Fetc
 
 ## CLI and authoring
 
+- [Drive KiCI from your coding agent](https://docs.kici.dev/user/ai-agents/): Point a coding agent at KiCI's MCP server and let it trigger, read, and re-run your CI under your own identity.
 - [CLI authentication](https://docs.kici.dev/user/cli-auth/): Authenticate the KiCI CLI with browser OAuth, device flow, or API key paste
-- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), orchestrators, test, login, logout, org, diagnostics, runs (list/show/logs/rerun/cancel), secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
+- [CLI reference](https://docs.kici.dev/user/cli-reference/): All CLI commands: compile, run (local/remote), orchestrators, preview, login, logout, org, diagnostics, runs (list/show/logs/rerun/cancel), secrets, types, fixture, init, hook, endpoints, workflows, docs, admin
 - [Lifecycle hooks](https://docs.kici.dev/user/hooks/): SDK hook API for cancel, cleanup, success, failure, and step-level callbacks
 - [Lock file and workflow drift](https://docs.kici.dev/user/lock-file-and-drift/): Keep the lock file in sync with your workflow source and avoid drift
 - [Testing guide](https://docs.kici.dev/user/testing-guide/): Running remote test fixtures with kici run remote

package/dist/local-executor/index.js

@@ -14,6 +14,7 @@ import { ConcurrencyKeyEvaluationError, acquireWorkflowLock } from "./workflow-l
 import path from "node:path";
 import pc from "picocolors";
 import { writeFile } from "node:fs/promises";
+import { flattenStepInputs } from "@kici-dev/sdk";
 import { logger } from "@kici-dev/core";
 import { CheckMode, CheckStepOutcome, coerceDispatchInputs, matchAllWorkflows, parseInputPairs } from "@kici-dev/engine";
 import os from "node:os";
@@ -55,7 +56,7 @@ function workflowsToLockFormat(workflows) {
 				name: j.name,
 				runsOn: j.runsOn,
 				needs: j.needs?.map((n) => typeof n === "string" ? n : n.name) ?? [],
-				steps: j.steps.map((s) => {
+				steps: flattenStepInputs(j.steps).map((s) => {
 					if (typeof s === "function") return {
 						name: "",
 						hasOutputs: false

package/dist/local-executor/job-runner.js

@@ -7,7 +7,7 @@ import { localRunsOnString } from "./runs-on-display.js";
 import { toEventPayload } from "./to-event-payload.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
-import { applyIncludeExclude, expandMatrix, isDynamicJobFn, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
+import { applyIncludeExclude, expandMatrix, flattenStepInputs, isDynamicJobFn, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
 import { computeBackoffDelay } from "@kici-dev/core";
 import { CheckMode, CheckStepOutcome, formatMatrixSuffix } from "@kici-dev/engine";
 import { runIdempotentStep } from "@kici-dev/core/idempotency";
@@ -314,10 +314,10 @@ async function executeResolvedJobInner(resolvedJob, context, startTime) {
 	const stepCtx = createStepContext({ name: context.workflowName }, {
 		name: expandedName,
 		runsOn: localRunsOnString(job.runsOn)
-	}, repoRoot, void 0, hasMatrix ? matrixValues : void 0, context.secrets, void 0, context.event.payload, context.event.provider, context.dispatchInputs ?? {});
+	}, repoRoot, void 0, hasMatrix ? matrixValues : void 0, context.secrets, void 0, context.event.payload, context.event.provider, context.dispatchInputs ?? {}, context.signal);
 	const stepResults = [];
 	let stepCounter = 0;
-	for (const stepOrFn of job.steps) {
+	for (const stepOrFn of flattenStepInputs(job.steps)) {
 		if (context.signal.aborted) return {
 			name: expandedName,
 			status: "cancelled",

package/dist/lockfile/generator.d.ts

@@ -1,5 +1,5 @@
-import type { TriggerConfig } from '@kici-dev/sdk';
-import { type LockFile, type LockTrigger, type WorkflowWithSource } from '../types.js';
+import type { StepInput, TriggerConfig } from '@kici-dev/sdk';
+import { type LockFile, type LockTrigger, type LockStepEntry, type WorkflowWithSource } from '../types.js';
 /**
  * Detect git repository root by running `git rev-parse --show-toplevel`.
  * Falls back to cwd if not in a git repo.
@@ -40,6 +40,14 @@ export declare function generateLockFile(workflowsWithSource: WorkflowWithSource
  * Exported for reuse in the test runner's in-memory lock format conversion.
  */
 export declare function transformTriggers(triggers?: TriggerConfig[]): readonly LockTrigger[];
+/**
+ * Transform a job's `steps` array into lock-file entries. Sequential steps and
+ * parallel-group children share one flat `step-N` counter (anonymous steps are
+ * numbered across the whole flattened sequence, parallel children inline) so the
+ * compiler's naming matches the agent's `extractAndNormalizeSteps` enumeration —
+ * the flat-stepIndex invariant.
+ */
+export declare function transformSteps(steps: readonly StepInput[], gitRoot: string): readonly LockStepEntry[];
 /**
  * Serialize lock file to JSON string.
  *

package/dist/lockfile/generator.js

@@ -5,10 +5,10 @@ import { resolveHashFiles } from "./hash-files.js";
 import { analyzePurity } from "./purity-analyzer.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
-import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isStaticArray, isStaticObject, normalizeApproval, normalizeCacheSpecs } from "@kici-dev/sdk";
+import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject, normalizeApproval, normalizeCacheSpecs } from "@kici-dev/sdk";
 import { sha256 } from "@kici-dev/core";
 import { PackageManager, detectPackageManagerSync, detectYarnFlavorSync } from "@kici-dev/core/package-manager";
-import { extractInputsDescriptorMap, resolveWhenToRunOn, validateResourceRequest } from "@kici-dev/engine";
+import { assertScheduleInputsSatisfiable, extractInputsDescriptorMap, resolveWhenToRunOn, validateResourceRequest } from "@kici-dev/engine";
 import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, runsOnPickFromInput } from "@kici-dev/engine/labels/compile";
 import { execSync } from "node:child_process";
 //#region src/lockfile/generator.ts
@@ -345,11 +345,14 @@ function toLockGenericWebhook(t) {
 	};
 }
 function toLockSchedule(t) {
+	const inputs = t.inputs ? extractInputsDescriptorMap(t.inputs) : void 0;
+	if (inputs) assertScheduleInputsSatisfiable(inputs);
 	return {
 		_type: "schedule",
 		cronExpression: t.cron,
 		timezone: t.timezone,
-		...t.description && { description: t.description }
+		...t.description && { description: t.description },
+		...inputs && { inputs }
 	};
 }
 function toLockLifecycle(t) {
@@ -482,6 +485,34 @@ function validateRunsOn(runsOn, jobName) {
 	if (overlap.length > 0) throw new Error(`Job "${jobName}": labels and exclude overlap on [${overlap.join(", ")}]. A label cannot be both required and excluded.`);
 }
 /**
+* Transform one environment reference (static name or function) into a lock
+* `{ value, dynamic }` entry. A function element is analyzed for purity: a pure
+* function becomes an inline expression resolvable at two-phase eval; an impure
+* one carries only the `dynamic` flag (the agent runs an init job to resolve it).
+*/
+function transformEnvironmentRef(ref, jobName) {
+	if (typeof ref === "function") {
+		const fnSource = ref.toString();
+		const purity = analyzePurity(fnSource);
+		if (purity.pure) return {
+			value: {
+				_type: "inline",
+				expression: fnSource
+			},
+			dynamic: true
+		};
+		console.warn(`[kici] Job "${jobName}": environment function is not pure (${purity.reason}). An init job will be required, adding ~5-10s delay.`);
+		return {
+			value: "",
+			dynamic: true
+		};
+	}
+	return {
+		value: ref,
+		dynamic: false
+	};
+}
+/**
 * Transform a static job to lock file format.
 */
 function transformJob(job, configPath, index, gitRoot, uuidToName) {
@@ -492,18 +523,8 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 	if (!(job.matrix !== void 0 || job.runsOnAll !== void 0) && (job.maxParallel !== void 0 || job.failFast !== void 0)) console.warn(`[kici] job '${job.name}': maxParallel/failFast are ignored without matrix or runsOnAll (no fan-out to bound)`);
 	if (job.runsOn !== void 0) validateRunsOn(job.runsOn, job.name);
 	const environmentFields = {};
-	if (job.environment !== void 0) {
-		if (typeof job.environment === "function") {
-			const fnSource = job.environment.toString();
-			const purity = analyzePurity(fnSource);
-			environmentFields.dynamicEnvironment = true;
-			if (purity.pure) environmentFields.environment = {
-				_type: "inline",
-				expression: fnSource
-			};
-			else console.warn(`[kici] Job "${job.name}": environment function is not pure (${purity.reason}). An init job will be required, adding ~5-10s delay.`);
-		} else if (typeof job.environment === "string") environmentFields.environment = job.environment;
-	}
+	const envRefs = job.environments ?? (job.environment !== void 0 ? [job.environment] : void 0);
+	if (envRefs !== void 0 && envRefs.length > 0) environmentFields.environments = envRefs.map((ref) => transformEnvironmentRef(ref, job.name));
 	const envFields = {};
 	if (job.env !== void 0) {
 		if (typeof job.env === "function") {
@@ -642,45 +663,78 @@ function assertNonStepApprovalScope(c, scope) {
 function assertStepApprovalCheckFacet(step) {
 	if (step.approval !== void 0 && normalizeApproval(step.approval).when === "drift" && step.check === void 0) throw new Error(`step '${step.name || "(unnamed)"}': approval.when "drift" requires a check facet`);
 }
+/**
+* Transform a job's `steps` array into lock-file entries. Sequential steps and
+* parallel-group children share one flat `step-N` counter (anonymous steps are
+* numbered across the whole flattened sequence, parallel children inline) so the
+* compiler's naming matches the agent's `extractAndNormalizeSteps` enumeration —
+* the flat-stepIndex invariant.
+*/
 function transformSteps(steps, gitRoot) {
-	let stepCounter = 0;
-	return steps.map((stepOrFn) => {
-		if (typeof stepOrFn === "function") {
-			stepCounter++;
-			return {
-				name: `step-${stepCounter}`,
-				hasOutputs: false
-			};
-		}
-		const step = stepOrFn;
+	const counter = { n: 0 };
+	let groupOrdinal = 0;
+	return steps.map((entry) => {
+		if (isParallelGroup(entry)) return transformParallelGroup(entry, gitRoot, counter, groupOrdinal++);
+		return transformSequentialStep(entry, gitRoot, counter);
+	});
+}
+/** Validate and transform a `ParallelGroup` into a `LockParallelStep`. */
+function transformParallelGroup(group, gitRoot, counter, groupOrdinal) {
+	if (group.steps.length === 0) throw new Error("job step: empty parallel group not allowed");
+	const seen = /* @__PURE__ */ new Set();
+	const children = group.steps.map((child) => {
+		if (isParallelGroup(child)) throw new Error("job step: nested parallel groups are not supported");
+		const lockChild = transformSequentialStep(child, gitRoot, counter);
+		if (seen.has(lockChild.name)) throw new Error(`job step: duplicate step name '${lockChild.name}' in parallel group`);
+		seen.add(lockChild.name);
+		return lockChild;
+	});
+	if (children.length === 1) console.warn(`[kici] parallel group with a single step ('${children[0].name}') runs identically to a sequential step`);
+	return {
+		kind: "parallel",
+		name: group.name ?? `parallel-${groupOrdinal}`,
+		failFast: group.failFast,
+		...group.maxParallel !== void 0 && { maxParallel: group.maxParallel },
+		children
+	};
+}
+/** Transform a single sequential step (or bare function) into a `LockStep`. */
+function transformSequentialStep(stepOrFn, gitRoot, counter) {
+	if (typeof stepOrFn === "function") {
+		counter.n++;
 		return {
-			name: step.name || `step-${++stepCounter}`,
-			hasOutputs: !!step.outputs && Object.keys(step.outputs).length > 0,
-			...step.continueOnError !== void 0 && { continueOnError: step.continueOnError },
-			...step.timeout !== void 0 && { timeout: step.timeout },
-			...step.retry !== void 0 && { retry: {
-				maxAttempts: step.retry.maxAttempts,
-				delayMs: step.retry.delayMs,
-				backoff: step.retry.backoff,
-				maxDelayMs: step.retry.maxDelayMs
-			} },
-			...step.cache !== void 0 && { cache: normalizeCacheSpecs(step.cache) },
-			...step._sourceLocation && { sourceLocation: {
-				file: makeRelativePath(step._sourceLocation.file, gitRoot),
-				line: step._sourceLocation.line,
-				column: step._sourceLocation.column
-			} },
-			...step.rules && step.rules.length > 0 && {
-				hasRules: true,
-				rules: transformRules(step.rules, makeRelativePath(step._sourceLocation?.file ?? "", gitRoot))
-			},
-			...step.onCancel !== void 0 && { hasOnCancel: true },
-			...step.cleanup !== void 0 && { hasCleanup: true },
-			...step.check !== void 0 && { hasCheck: true },
-			...step.whenInSync !== void 0 && { hasWhenInSync: true },
-			...step.approval !== void 0 && { approval: (assertStepApprovalCheckFacet(step), toLockApproval(step.approval)) }
+			name: `step-${counter.n}`,
+			hasOutputs: false
 		};
-	});
+	}
+	const step = stepOrFn;
+	return {
+		name: step.name || `step-${++counter.n}`,
+		hasOutputs: !!step.outputs && Object.keys(step.outputs).length > 0,
+		...step.continueOnError !== void 0 && { continueOnError: step.continueOnError },
+		...step.timeout !== void 0 && { timeout: step.timeout },
+		...step.retry !== void 0 && { retry: {
+			maxAttempts: step.retry.maxAttempts,
+			delayMs: step.retry.delayMs,
+			backoff: step.retry.backoff,
+			maxDelayMs: step.retry.maxDelayMs
+		} },
+		...step.cache !== void 0 && { cache: normalizeCacheSpecs(step.cache) },
+		...step._sourceLocation && { sourceLocation: {
+			file: makeRelativePath(step._sourceLocation.file, gitRoot),
+			line: step._sourceLocation.line,
+			column: step._sourceLocation.column
+		} },
+		...step.rules && step.rules.length > 0 && {
+			hasRules: true,
+			rules: transformRules(step.rules, makeRelativePath(step._sourceLocation?.file ?? "", gitRoot))
+		},
+		...step.onCancel !== void 0 && { hasOnCancel: true },
+		...step.cleanup !== void 0 && { hasCleanup: true },
+		...step.check !== void 0 && { hasCheck: true },
+		...step.whenInSync !== void 0 && { hasWhenInSync: true },
+		...step.approval !== void 0 && { approval: (assertStepApprovalCheckFacet(step), toLockApproval(step.approval)) }
+	};
 }
 /**
 * Strip the `?t=...` query suffix added by cache-busting `import()` calls.
@@ -758,6 +812,6 @@ function serializeLockFile(lockFile, pretty = true) {
 	return JSON.stringify(lockFile, null, pretty ? 2 : void 0);
 }
 //#endregion
-export { computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile, transformTriggers };
+export { computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile, transformSteps, transformTriggers };
 
 //# sourceMappingURL=generator.js.map

package/dist/remote/history.d.ts

@@ -2,7 +2,7 @@
  * Local run history manager.
  *
  * Persists test run history in ~/.kici/history/runs.json so developers
- * can review past runs (kici test --history) and inspect specific runs
+ * can review past runs (kici run remote --history) and inspect specific runs
  * (kici status <run-id>).
  */
 /** Status of a test run */

package/dist/remote/history.js

@@ -11,7 +11,7 @@ import picomatch from "picomatch";
 * Local run history manager.
 *
 * Persists test run history in ~/.kici/history/runs.json so developers
-* can review past runs (kici test --history) and inspect specific runs
+* can review past runs (kici run remote --history) and inspect specific runs
 * (kici status <run-id>).
 */
 /** Maximum number of entries to keep in history */

package/dist/remote/local-repo-identity.d.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+/** Git hosts whose origin URL we can turn into a real `owner/repo` + web link. */
+export declare const RecognizedProvider: z.ZodEnum<{
+    github: "github";
+    gitlab: "gitlab";
+    bitbucket: "bitbucket";
+}>;
+export type RecognizedProvider = z.infer<typeof RecognizedProvider>;
+/** The literal provider value stamped when no recognized git origin exists. */
+export declare const LOCAL_PROVIDER = "local";
+/**
+ * Parse a git remote URL into `{ provider, owner/repo }` for a recognized host.
+ * Handles scp-style ssh (`git@host:owner/repo.git`), `ssh://`, and `https://`
+ * forms; strips a trailing `.git`. Returns null for any unrecognized host or
+ * unparseable input.
+ */
+export declare function parseGitOrigin(url: string): {
+    provider: RecognizedProvider;
+    repoIdentifier: string;
+} | null;
+/** Read the `origin` remote URL of the working tree at `repoRoot`, or null. */
+export declare function detectGitOrigin(repoRoot: string): string | null;
+/**
+ * Build the repo identity stamped on a `kici run remote` run. A recognized git
+ * origin yields the real `owner/repo` + provider so the dashboard can link to
+ * it; otherwise a synthetic `local/<basename>` identity with provider `local`.
+ */
+export declare function buildLocalRepoIdentity(repoRoot: string): {
+    repoIdentifier: string;
+    provider: string;
+};
+//# sourceMappingURL=local-repo-identity.d.ts.map