@kici-dev/compiler 0.1.23 → 0.1.25

package/dist/auth/headless-detect.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/auth/headless-detect.ts
 /**
 * Detect if the current environment is headless (no browser available).

package/dist/cli-banner.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 //#region src/cli-banner.ts
 /**
 * Whether the version banner should be suppressed for the command about to run.

package/dist/cli.d.ts

@@ -1,5 +1,23 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+/**
+ * Top-level commands that were removed, mapped to their current equivalent.
+ * Consulted when the CLI hits an unknown command so the user gets a precise
+ * redirect instead of a bare "unknown command" dead end. The redirect text
+ * lives here once; every consumer reads it from this map.
+ */
+export declare const RETIRED_COMMANDS: Record<string, string>;
+/**
+ * Redirect message for a retired top-level command, or undefined if the name is
+ * not a known-retired command.
+ */
+export declare function retiredCommandHint(commandName: string | undefined): string | undefined;
+/**
+ * Derive the command name a user attempted from the parsed operands, falling
+ * back to the first non-option token in the raw argv. Used to look up a retired
+ * command after commander rejects an unknown command.
+ */
+export declare function attemptedCommand(program: Command, argv: string[]): string | undefined;
 /**
  * Build the kici Commander program with every command registered. Exported so
  * the surface registry can walk the real command tree without parsing argv (no

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { shouldSuppressBanner } from "./cli-banner.js";
 import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
@@ -7,7 +7,34 @@ import { realpathSync } from "node:fs";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.23";
+const version = "0.1.25";
+/**
+* Top-level commands that were removed, mapped to their current equivalent.
+* Consulted when the CLI hits an unknown command so the user gets a precise
+* redirect instead of a bare "unknown command" dead end. The redirect text
+* lives here once; every consumer reads it from this map.
+*/
+const RETIRED_COMMANDS = {
+	status: "`kici status` is no longer a command. Use `kici runs list` / `kici runs show <run-id>` to inspect runs, or `kici diagnostics` for orchestrator, scaler, and agent health.",
+	cancel: "`kici cancel` is no longer a command. Use `kici runs cancel <run-id>`."
+};
+/**
+* Redirect message for a retired top-level command, or undefined if the name is
+* not a known-retired command.
+*/
+function retiredCommandHint(commandName) {
+	return commandName ? RETIRED_COMMANDS[commandName] : void 0;
+}
+/**
+* Derive the command name a user attempted from the parsed operands, falling
+* back to the first non-option token in the raw argv. Used to look up a retired
+* command after commander rejects an unknown command.
+*/
+function attemptedCommand(program, argv) {
+	const firstOperand = program.args[0];
+	if (firstOperand) return firstOperand;
+	return argv.slice(2).find((token) => !token.startsWith("-"));
+}
 /**
 * Build the kici Commander program with every command registered. Exported so
 * the surface registry can walk the real command tree without parsing argv (no
@@ -23,6 +50,8 @@ function buildProgram() {
 	program.configureOutput({ outputError: (str, write) => {
 		write(pc.red(str));
 	} });
+	program.showSuggestionAfterError(true);
+	program.showHelpAfterError("(run `kici --help` to see all commands)");
 	program.command("compile").description("Compile workflows from .kici/workflows/ to kici.lock.json").option("--check", "Validate workflows without writing lock file", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--verbose", "Detailed output", false).option("--watch", "Watch for changes and recompile", false).action(async (options) => {
 		const { compileCommand, watchCommand } = await import("./commands/index.js");
 		if (options.watch) await watchCommand({
@@ -50,7 +79,8 @@ function buildProgram() {
 			process.exit(2);
 		}
 		if (!options.pick && !event) {
-			console.error("Error: missing event argument. Pass an event or use --pick.");
+			const { printRunLocalUsage } = await import("./commands/index.js");
+			printRunLocalUsage();
 			process.exit(2);
 		}
 		const { runLocalCommand } = await import("./commands/index.js");
@@ -90,7 +120,7 @@ function buildProgram() {
 		});
 		process.exit(success ? 0 : 1);
 	});
-	runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("-p, --pick", "Interactively pick fixtures to run", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--org <id>", "Target organization (overrides the active org)").option("--orchestrator <name>", "Target orchestrator cluster (overrides the per-org default)").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).option("--check", "Run in check mode: report drift, change nothing", false).option("--fail-on-drift", "In check mode, exit non-zero if any step reports drift", false).option("--target <selector>", "Narrow runsOnAll jobs to hosts matching this label selector (repeatable, AND-combined)", (val, prev) => [...prev, val], []).option("--target-allow-empty", "A --target that narrows a runsOnAll job to zero hosts skips it instead of failing", false).option("--input <KEY=VALUE>", "Typed workflow-dispatch input (repeatable)", (val, prev) => [...prev, val], []).option("--approve-all, --yes", "Auto-approve every approval gate this run holds on (run-scoped; eligibility still enforced)", false).action(async (fixture, options) => {
+	runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("-p, --pick", "Interactively pick fixtures to run", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--org <id>", "Target organization (overrides the active org)").option("--orchestrator <name>", "Target orchestrator cluster (overrides the per-org default)").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).option("--check", "Run in check mode: report drift, change nothing", false).option("--fail-on-drift", "In check mode, exit non-zero if any step reports drift", false).option("--target <selector>", "Narrow runsOnAll jobs to hosts matching this label selector (repeatable, AND-combined)", (val, prev) => [...prev, val], []).option("--target-allow-empty", "A --target that narrows a runsOnAll job to zero hosts skips it instead of failing", false).option("--input <KEY=VALUE>", "Typed workflow-dispatch input (repeatable)", (val, prev) => [...prev, val], []).option("--yes, --approve-all", "Auto-approve every approval gate this run holds on (run-scoped; eligibility still enforced)", false).action(async (fixture, options) => {
 		if (options.pick && fixture) {
 			console.error("Error: --pick selects fixtures interactively; do not also pass a fixture name.");
 			process.exit(2);
@@ -126,9 +156,9 @@ function buildProgram() {
 		});
 		process.exit(success ? 0 : 1);
 	});
-	program.command("test").argument("[event]", "Event type to preview (e.g., push, pr:open, schedule)").description("Preview which workflows match a trigger event (dry-run)").option("--branch <name>", "Override target branch for trigger matching (default: main)").option("--sha <hash>", "Override commit SHA").option("--workflow <name>", "Filter to specific workflow in display").option("--job <name>", "Filter to specific job in display").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--files <path>", "Simulate changed file path for trigger matching (repeatable)", (val, prev) => [...prev, val], []).option("--secret <key=value>", "Inject flat secret (repeatable)", (val, prev) => [...prev, val], []).option("--context <ctx.key=value>", "Inject context secret (repeatable)", (val, prev) => [...prev, val], []).action(async (event, options) => {
-		const { testCommand } = await import("./commands/index.js");
-		const success = await testCommand(event, options);
+	program.command("preview").argument("[event]", "Event type to preview (e.g., push, pr:open, schedule)").description("Preview which workflows match a trigger event (no execution)").option("--branch <name>", "Override target branch for trigger matching (default: main)").option("--sha <hash>", "Override commit SHA").option("--workflow <name>", "Filter to specific workflow in display").option("--job <name>", "Filter to specific job in display").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--files <path>", "Simulate changed file path for trigger matching (repeatable)", (val, prev) => [...prev, val], []).option("--secret <key=value>", "Inject flat secret (repeatable)", (val, prev) => [...prev, val], []).option("--context <ctx.key=value>", "Inject context secret (repeatable)", (val, prev) => [...prev, val], []).action(async (event, options) => {
+		const { previewCommand } = await import("./commands/index.js");
+		const success = await previewCommand(event, options);
 		process.exit(success ? 0 : 1);
 	});
 	program.command("init").description("Initialize .kici/ directory with default workflows").option("--force", "Overwrite existing .kici/ directory", false).option("--skip-install", "Create files without installing dependencies", false).option("--package-manager <npm|pnpm|yarn>", "Force a package manager for the install step (default: auto-detect)").option("--mjs", "JavaScript-only mode (no TypeScript, no dependencies)", false).option("--no-agents-md", "Skip writing .kici/AGENTS.md (LLM authoring context)").option("--private-registry <url>", "Scaffold a workflow registries: entry pointing at <url>").option("--private-registry-scope <scope>", "Optional npm package scope (e.g. @my-org) for the private registry").option("--private-registry-secret <ref>", "Qualified secret reference (env:NAME) the private registry token comes from", "production:NPM_TOKEN").addOption(new Option("--use-verdaccio-local").default(false).hideHelp()).action(async (options) => {
@@ -199,6 +229,16 @@ Environment variables:
 		const success = await secretsListCommand();
 		process.exit(success ? 0 : 1);
 	});
+	program.command("pat").description("Manage personal access tokens").command("create").description("Mint a personal access token (use --agent for a coding-agent token)").option("--name <name>", "Token name (defaults to the agent label)").option("--agent", "Mint an agent-kind PAT for the KiCI MCP server", false).option("--expires-in-days <n>", "Custom expiry in days", (v) => parseInt(v, 10)).action(async (options) => {
+		const { patCreateCommand } = await import("./commands/index.js");
+		const success = await patCreateCommand({
+			name: options.name,
+			agent: options.agent,
+			label: options.name,
+			expiresInDays: options.expiresInDays
+		});
+		process.exit(success ? 0 : 1);
+	});
 	const runsCommand = program.command("runs").description("Inspect and manage execution runs");
 	runsCommand.command("list").description("List execution runs (mirrors the dashboard Runs page)").option("--status <s>", "Filter by status").option("--workflow <w>", "Filter by workflow name").option("--branch <b>", "Filter by branch/ref").option("--repo <r>", "Filter by repository").option("--trigger <t>", "Filter by trigger type").option("--source <routingKey>", "Filter by source routing key").option("--since <ts>", "Only runs since (ISO-8601 or epoch ms)").option("--page <n>", "Page number", (v) => parseInt(v, 10)).option("--json", "Output raw JSON", false).action(async (options) => {
 		const { runsListCommand } = await import("./commands/index.js");
@@ -295,16 +335,37 @@ Environment variables:
 		const success = await drainWorkerCommand({ url: options.url });
 		process.exit(success ? 0 : 1);
 	});
-	program.command("verify-attestation").argument("[artifact]", "Artifact path to digest-check against the attestation subject (optional)").description("Verify a KiCI provenance attestation bundle offline").option("--bundle <path>", "Path or URL to the attestation bundle JSON").option("--trust-root <url-or-file>", "Trusted issuer URL, or a self-contained { issuer, jwks } file").option("--audience <aud>", "Expected token audience").option("--json", "Output structured JSON result", false).action(async (artifact, options) => {
+	program.command("verify-attestation").argument("[artifact]", "Artifact path to digest-check against the attestation subject (optional)").description("Verify a KiCI provenance attestation bundle offline").option("--bundle <path>", "Path or URL to the attestation bundle JSON").option("--trust-root <url-or-file>", "Trusted issuer URL, or a self-contained { issuer, jwks } file (default: hosted KiCI platform)").option("--audience <aud>", "Expected token audience").option("--json", "Output structured JSON result", false).action(async (artifact, options) => {
 		const { verifyAttestationCommand } = await import("./commands/index.js");
 		const success = await verifyAttestationCommand(artifact, options);
 		process.exit(success ? 0 : 1);
 	});
 	return program;
 }
+/**
+* Handle a commander parse exit thrown under `exitOverride`. Help and version
+* requests exit cleanly; an unknown command is augmented with a retired-command
+* redirect when one applies (commander already wrote the generic error,
+* suggestion, and help pointer before throwing); every other parse error keeps
+* commander's own exit code and already-printed message.
+*/
+function handleCliParseExit(err, argv, program) {
+	if (err.code === "commander.helpDisplayed" || err.code === "commander.version") process.exit(0);
+	if (err.code === "commander.unknownCommand") {
+		const hint = retiredCommandHint(attemptedCommand(program, argv));
+		if (hint) process.stderr.write(pc.red(`${hint}\n`));
+	}
+	process.exit(err.exitCode ?? 1);
+}
 /** Build the program and parse argv — the bin-shim entry point. */
 function runCli(argv = process.argv) {
-	buildProgram().parse(argv);
+	const program = buildProgram();
+	program.exitOverride();
+	try {
+		program.parse(argv);
+	} catch (err) {
+		handleCliParseExit(err, argv, program);
+	}
 }
 /**
 * Decide whether this module is the process entry point, tolerating a
@@ -330,6 +391,6 @@ function isMainEntryPoint(argv1, importMetaUrl) {
 }
 if (isMainEntryPoint(process.argv[1], import.meta.url)) runCli();
 //#endregion
-export { buildProgram, isMainEntryPoint, runCli };
+export { RETIRED_COMMANDS, attemptedCommand, buildProgram, isMainEntryPoint, retiredCommandHint, runCli };
 
 //# sourceMappingURL=cli.js.map

package/dist/commands/approve.js

@@ -1,8 +1,8 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { listHeldRunsForRun, postApprove, resolveHeldRunContext } from "./held-run-client.js";
-import { resolveHeldRunId } from "./held-run-resolve.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
+import { resolveHeldRunId } from "@kici-dev/engine";
 //#region src/commands/approve.ts
 /**
 * kici approve command

package/dist/commands/check-mode.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { CheckMode } from "@kici-dev/engine";
 //#region src/commands/check-mode.ts
 /**

package/dist/commands/compile.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { formatError, isCompilerError } from "../errors/formatter.js";
 import "../errors/index.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";

package/dist/commands/diagnostics.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import { relativeTime } from "../remote/render.js";
 import pc from "picocolors";

package/dist/commands/docs.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import pc from "picocolors";

package/dist/commands/drain-worker.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/drain-worker.ts

package/dist/commands/endpoints.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { loadGlobalConfig } from "../remote/config.js";

package/dist/commands/fixture.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { detectRepoFromGit } from "../test-runner/git-detector.js";
 import { getDefaultFixture } from "../fixtures/defaults/index.js";
@@ -13,7 +13,7 @@ import { logger } from "@kici-dev/core";
 * including internal events (schedule, lifecycle, generic_webhook, kici_event).
 */
 /** Internal event types that don't have GitHub webhook fixture files */
-const INTERNAL_EVENT_TYPES = new Set([
+const INTERNAL_EVENT_TYPES = /* @__PURE__ */ new Set([
 	"kici_event",
 	"workflow_complete",
 	"job_complete",

package/dist/commands/held-run-client.d.ts

@@ -5,7 +5,7 @@
  * exposes thin list / approve / reject helpers against the Platform dashboard
  * API.
  */
-import type { HeldRunSummary } from './held-run-resolve.js';
+import type { HeldRunSummary } from '@kici-dev/engine';
 /** Resolved auth context for a held-run command. */
 export interface HeldRunContext {
     endpoint: string;

package/dist/commands/held-run-client.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";

package/dist/commands/hook.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { detectHookTools, findGitDir } from "../hooks/detector.js";
 import { installHook } from "../hooks/installer.js";
 import "../hooks/index.js";

package/dist/commands/index.d.ts

@@ -3,9 +3,9 @@ export type { CompileOptions } from './compile.js';
 export { watchCommand } from './watch.js';
 export { fixtureCommand } from './fixture.js';
 export type { FixtureOptions } from './fixture.js';
-export { testCommand, testDryRun } from './test.js';
-export type { TestOptions, RemoteRunOptions, RemoteRunResult } from './test.js';
-export { runLocalCommand, runRemoteCommand } from './run.js';
+export { previewCommand, previewEvent } from './preview.js';
+export type { PreviewOptions, RemoteRunOptions, RemoteRunResult } from './preview.js';
+export { runLocalCommand, runRemoteCommand, printRunLocalUsage } from './run.js';
 export { initCommand } from './init.js';
 export type { InitOptions } from './init.js';
 export { hookInstallCommand } from './hook.js';
@@ -14,6 +14,8 @@ export { loginCommand } from './login.js';
 export type { LoginOptions } from './login.js';
 export { secretsListCommand } from './secrets-list.js';
 export type { SecretsListOptions } from './secrets-list.js';
+export { patCreateCommand } from './pat.js';
+export type { PatCreateOptions } from './pat.js';
 export { runsListCommand } from './runs/list.js';
 export type { RunsListOptions } from './runs/list.js';
 export { runsShowCommand } from './runs/show.js';

package/dist/commands/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { compileCommand } from "./compile.js";
 import { approveCommand } from "./approve.js";
 import { diagnosticsCommand } from "./diagnostics.js";
@@ -8,11 +8,12 @@ import { endpointsCommand } from "./endpoints.js";
 import { fixtureCommand } from "./fixture.js";
 import { hookInstallCommand } from "./hook.js";
 import { watchCommand } from "./watch.js";
-import { testCommand, testDryRun } from "./test.js";
-import { runLocalCommand, runRemoteCommand } from "./run.js";
+import { previewCommand, previewEvent } from "./preview.js";
+import { printRunLocalUsage, runLocalCommand, runRemoteCommand } from "./run.js";
 import { initCommand } from "./init.js";
 import { loginCommand } from "./login.js";
 import { secretsListCommand } from "./secrets-list.js";
+import { patCreateCommand } from "./pat.js";
 import { runsListCommand } from "./runs/list.js";
 import { runsShowCommand } from "./runs/show.js";
 import { runsLogsCommand } from "./runs/logs.js";
@@ -25,4 +26,4 @@ import { logoutCommand } from "./logout.js";
 import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
 import { verifyAttestationCommand } from "./verify-attestation.js";
-export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, rejectCommand, runLocalCommand, runRemoteCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, testCommand, testDryRun, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };
+export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, printRunLocalUsage, rejectCommand, runLocalCommand, runRemoteCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { agentsMdTemplate } from "../templates/agents-md.js";
 import { tsconfigTemplate } from "../templates/tsconfig-json.js";
 import { generatePackageJson } from "../templates/package-json.js";
@@ -117,10 +117,10 @@ async function initCommand(options = {}) {
 		logger.info(pc.gray("  1. Edit workflows in .kici/workflows/"));
 		if (options.mjs || options.skipInstall) {
 			logger.info(pc.gray("  2. Run your package manager install in .kici/ to generate a lockfile"));
-			logger.info(pc.gray("  3. Test locally: kici test push"));
+			logger.info(pc.gray("  3. Preview matching: kici preview push"));
 			logger.info(pc.gray("  4. Commit .kici/ to your repository\n"));
 		} else {
-			logger.info(pc.gray("  2. Test locally: kici test push"));
+			logger.info(pc.gray("  2. Preview matching: kici preview push"));
 			logger.info(pc.gray("  3. Commit .kici/ to your repository\n"));
 		}
 		return true;

package/dist/commands/login.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { getConfigPath, loadGlobalConfig, mergeGlobalConfig, saveGlobalConfig } from "../remote/config.js";
 import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
 import "../remote/prod-defaults.js";

package/dist/commands/logout.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { getConfigPath, loadGlobalConfig, saveGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/logout.ts

package/dist/commands/orchestrators.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig, mergeGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/orchestrators.ts

package/dist/commands/org.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig, mergeGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/org.ts

package/dist/commands/pat.d.ts

@@ -0,0 +1,27 @@
+export interface PatCreateOptions {
+    /** Token name shown in the dashboard PAT list. Defaults to the agent label. */
+    name?: string;
+    /** Mint an agent-kind PAT (the only credential the developer MCP server accepts). */
+    agent?: boolean;
+    /**
+     * Agent label (required with `--agent`) — the human-set name recorded on every
+     * audit row the agent produces. Also used as the token name when `--name` is
+     * omitted.
+     */
+    label?: string;
+    /** Custom expiry in days (server default: 120). */
+    expiresInDays?: number;
+    /** Injected fetch for tests. Defaults to the global fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Mint a personal access token under the logged-in user's identity.
+ *
+ * `kici pat create --agent --name <label>` mints an agent-kind PAT: it inherits
+ * the user's permissions (provenance only, no authority change), carries its
+ * label into every audit row, and is the credential a coding agent points the
+ * KiCI developer MCP server at. The token is printed once — there is no way to
+ * retrieve it later.
+ */
+export declare function patCreateCommand(options?: PatCreateOptions): Promise<boolean>;
+//# sourceMappingURL=pat.d.ts.map

package/dist/commands/pat.js

@@ -0,0 +1,76 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { loadGlobalConfig } from "../remote/config.js";
+import pc from "picocolors";
+import { toErrorMessage } from "@kici-dev/core";
+import { PatKind } from "@kici-dev/engine";
+//#region src/commands/pat.ts
+/**
+* Mint a personal access token under the logged-in user's identity.
+*
+* `kici pat create --agent --name <label>` mints an agent-kind PAT: it inherits
+* the user's permissions (provenance only, no authority change), carries its
+* label into every audit row, and is the credential a coding agent points the
+* KiCI developer MCP server at. The token is printed once — there is no way to
+* retrieve it later.
+*/
+async function patCreateCommand(options = {}) {
+	const doFetch = options.fetchImpl ?? fetch;
+	try {
+		const config = await loadGlobalConfig();
+		const token = config.pat ?? config.token;
+		const endpoint = config.platformEndpoint ?? config.endpoint;
+		if (!token || !endpoint) {
+			console.error(pc.red("Not logged in. Run `kici login` first."));
+			return false;
+		}
+		const kind = options.agent ? PatKind.enum.agent : PatKind.enum.user;
+		const label = options.label;
+		if (kind === PatKind.enum.agent && !label) {
+			console.error(pc.red("An agent PAT requires a label. Pass --name <label>."));
+			return false;
+		}
+		const name = options.name ?? label;
+		if (!name) {
+			console.error(pc.red("A token name is required. Pass --name <name>."));
+			return false;
+		}
+		const body = {
+			name,
+			kind
+		};
+		if (kind === PatKind.enum.agent) body.agentLabel = label;
+		if (options.expiresInDays !== void 0) body.expiresInDays = options.expiresInDays;
+		const res = await doFetch(`${endpoint.replace(/\/$/, "")}/api/v1/pats`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) {
+			let detail;
+			try {
+				detail = (await res.json()).error;
+			} catch {}
+			console.error(pc.red(`Failed to create token (${res.status}): ${detail ?? "request failed"}`));
+			return false;
+		}
+		const created = await res.json();
+		console.log(pc.bold(kind === PatKind.enum.agent ? "\nAgent PAT created.\n" : "\nPAT created.\n"));
+		console.log(`${pc.gray("Name:   ")}${created.name}`);
+		if (kind === PatKind.enum.agent) console.log(`${pc.gray("Agent:  ")}${label}`);
+		console.log(`${pc.gray("Expires:")} ${created.expiresAt}`);
+		console.log(`\n${pc.gray("Token (shown once — save it now):")}`);
+		console.log(pc.cyan(created.token));
+		if (kind === PatKind.enum.agent) console.log(pc.gray("\nPoint your coding agent at the KiCI MCP server with this token as the Bearer credential."));
+		return true;
+	} catch (err) {
+		console.error(pc.red(`Failed to create token: ${toErrorMessage(err)}`));
+		return false;
+	}
+}
+//#endregion
+export { patCreateCommand };
+
+//# sourceMappingURL=pat.js.map

package/dist/commands/preview.d.ts

@@ -0,0 +1,88 @@
+import { type PayloadOptions } from '../test-runner/payload-builder.js';
+import { type CheckMode } from '@kici-dev/engine';
+/** Options for the kici preview command (dry-run trigger preview) */
+export interface PreviewOptions extends PayloadOptions {
+    /** Filter to specific workflow */
+    workflow?: string;
+    /** Filter to specific job */
+    job?: string;
+    /** Enable debug output */
+    debug?: boolean;
+    /** Path to .kici directory (defaults to .kici) */
+    kiciDir?: string;
+    /** Flat secret overrides: KEY=VALUE */
+    secret?: string[];
+    /** Context secret overrides: contextName.KEY=VALUE */
+    context?: string[];
+}
+/** Options for the kici run remote command */
+export interface RemoteRunOptions extends PreviewOptions {
+    /** Run all available fixtures */
+    all?: boolean;
+    /** Interactively pick fixtures to run (multi-select checkbox). */
+    pick?: boolean;
+    /** Run matching fixtures concurrently */
+    parallel?: boolean;
+    /** Fire and forget (print runIds, don't stream) */
+    wait?: boolean;
+    /** Suppress output except final result */
+    quiet?: boolean;
+    /** Output structured JSON result */
+    json?: boolean;
+    /** Output JUnit XML result */
+    junit?: string;
+    /** Override routing key for this run */
+    routingKey?: string;
+    /** Show recent run history */
+    history?: boolean;
+    /** --env KEY=VALUE flag values, uploaded as per-run secrets. */
+    envFlags?: string[];
+    /** Target organization id (overrides config.activeOrgId). */
+    org?: string;
+    /** Target orchestrator cluster name (overrides the per-org default). */
+    orchestrator?: string;
+    /**
+     * Run mode resolved from --check / --fail-on-drift, threaded onto the dispatch
+     * payload so the orchestrator runs the agent step loop in the requested mode.
+     * Defaults to `apply`.
+     */
+    checkMode?: CheckMode;
+    /** `--target <selector>` values (repeatable), AND-combined into host narrowing. */
+    targets?: string[];
+    /** `--target-allow-empty`: a target that zeroes a runsOnAll job skips it instead of failing. */
+    targetAllowEmpty?: boolean;
+    /**
+     * `--approve-all` (alias `--yes`): auto-approve every approval gate this run
+     * holds on (run-scoped only — the run id this invocation dispatched). The
+     * operator must still be clause-eligible per hold; an ineligible hold blocks.
+     */
+    approveAll?: boolean;
+    /** `--input KEY=VALUE` values (repeatable): typed workflow-dispatch inputs. */
+    inputs?: string[];
+}
+/** Result of a single remote fixture run */
+export interface RemoteRunResult {
+    fixtureId: string;
+    runId: string;
+    status: 'accepted' | 'rejected' | 'success' | 'failed' | 'cancelled' | 'error';
+    reason?: string;
+    observeUrl?: string;
+    durationMs?: number;
+    jobs?: Array<{
+        name: string;
+        status: string;
+        durationMs?: number;
+    }>;
+}
+/**
+ * Main preview command entry point.
+ *
+ * `kici preview <event>` is a dry-run trigger preview only — it executes nothing.
+ * If the argument looks like a fixture name (not a known event type), prints a migration message.
+ */
+export declare function previewCommand(event: string | undefined, options: PreviewOptions): Promise<boolean>;
+/**
+ * Local-only dry-run mode: compile workflows, match triggers, display what would execute.
+ */
+export declare function previewEvent(event: string, options: PreviewOptions): Promise<boolean>;
+//# sourceMappingURL=preview.d.ts.map