@kici-dev/compiler 0.1.23 → 0.1.25

package/dist/commands/{test.js → preview.js}

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";
@@ -9,30 +9,31 @@ import { loadSecretsFile } from "../test-runner/secrets-file.js";
 import path from "node:path";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
+import { flattenStepInputs } from "@kici-dev/sdk";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { matchAllWorkflows } from "@kici-dev/engine";
 import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
-//#region src/commands/test.ts
+//#region src/commands/preview.ts
 /**
-* Main test command entry point.
+* Main preview command entry point.
 *
-* `kici test <event>` is now dry-run trigger preview only.
+* `kici preview <event>` is a dry-run trigger preview only — it executes nothing.
 * If the argument looks like a fixture name (not a known event type), prints a migration message.
 */
-async function testCommand(event, options) {
+async function previewCommand(event, options) {
 	if (options.debug) {
 		process.env.KICI_DEBUG = "true";
 		logger.info(pc.gray("Debug mode enabled"));
 	}
 	try {
 		if (!event) {
-			logger.info(pc.bold("\nUsage: kici test <event>\n"));
+			logger.info(pc.bold("\nUsage: kici preview <event>\n"));
 			logger.info(pc.gray("Preview which workflows and jobs would run for a given event.\n"));
 			logger.info(pc.gray("Examples:"));
-			logger.info(pc.gray("  kici test push"));
-			logger.info(pc.gray("  kici test pr:open"));
-			logger.info(pc.gray("  kici test schedule"));
-			logger.info(pc.gray("  kici test lifecycle:workflow_complete\n"));
+			logger.info(pc.gray("  kici preview push"));
+			logger.info(pc.gray("  kici preview pr:open"));
+			logger.info(pc.gray("  kici preview schedule"));
+			logger.info(pc.gray("  kici preview lifecycle:workflow_complete\n"));
 			logger.info(pc.gray("For remote fixture execution, use: kici run remote [fixture] [options]"));
 			logger.info(pc.gray("For local workflow execution, use: kici run local <event> [options]\n"));
 			return true;
@@ -41,7 +42,7 @@ async function testCommand(event, options) {
 			logger.info(pc.yellow(`\nFixture-based testing has moved to \`kici run remote\`.\nRun \`kici run remote ${event}\` instead.\n`));
 			return false;
 		}
-		return await testDryRun(event, options);
+		return await previewEvent(event, options);
 	} catch (error) {
 		const message = toErrorMessage(error);
 		logger.error(pc.red(`\nError: ${message}\n`));
@@ -64,7 +65,7 @@ function isKnownEventArg(arg) {
 /**
 * Local-only dry-run mode: compile workflows, match triggers, display what would execute.
 */
-async function testDryRun(event, options) {
+async function previewEvent(event, options) {
 	try {
 		const kiciDir = resolveKiciDir(options.kiciDir);
 		logger.info(pc.gray(`KiCI directory: ${kiciDir}`));
@@ -144,7 +145,7 @@ function workflowsToLockFormat(workflows) {
 					if ("group" in n) return `__group:${n.group}`;
 					return n.name;
 				}) ?? [],
-				steps: j.steps.map((s) => {
+				steps: flattenStepInputs(j.steps).map((s) => {
 					if (typeof s === "function") return {
 						name: "",
 						hasOutputs: false
@@ -213,6 +214,6 @@ async function loadTestSecrets(kiciDir, secretFlags, contextFlags) {
 	return secrets;
 }
 //#endregion
-export { testCommand, testDryRun };
+export { previewCommand, previewEvent };
 
-//# sourceMappingURL=test.js.map
+//# sourceMappingURL=preview.js.map

package/dist/commands/reject.js

@@ -1,8 +1,8 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { listHeldRunsForRun, postReject, resolveHeldRunContext } from "./held-run-client.js";
-import { resolveHeldRunId } from "./held-run-resolve.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
+import { resolveHeldRunId } from "@kici-dev/engine";
 //#region src/commands/reject.ts
 /**
 * kici reject command

package/dist/commands/run-hold-watch.d.ts

@@ -10,10 +10,13 @@
  * path as `kici approve` / `kici reject`. In a non-TTY it prints guidance and
  * keeps polling (the run stays held until resolved out-of-band).
  */
-import type { HeldRunSummary } from './held-run-resolve.js';
+import type { HeldRunSummary } from '@kici-dev/engine';
 import { type HeldRunContext } from './held-run-client.js';
 /** A yes/no prompt; injected so the poll branch is unit-testable. */
 export type ConfirmPrompt = (message: string) => Promise<boolean>;
+/** Where hold/approve text is written. Injected so callers can route it to
+ *  stderr in quiet/json mode (keeping stdout a pure JSON channel). */
+export type HoldOutput = (line: string) => void;
 /** What to do with a newly-observed hold. Pure — no IO. */
 export type HoldAction = {
     kind: 'prompt';
@@ -48,6 +51,12 @@ export declare function handleNewHolds(args: {
      * audits it distinctly. Eligibility is still enforced server-side.
      */
     approveAll?: boolean;
+    /**
+     * Where hold/approve text goes. Defaults to `logger.info` (stdout). Quiet /
+     * `--json` callers pass a stderr sink so the machine-readable stdout payload
+     * stays pure.
+     */
+    output?: HoldOutput;
     /** Override for tests; defaults to the shared Platform held-run context. */
     resolveContext?: () => Promise<HeldRunContext | null>;
     /** Override for tests. */

package/dist/commands/run-hold-watch.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { postApprove, postReject, resolveHeldRunContext } from "./held-run-client.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
@@ -37,14 +37,14 @@ function classifyNewHolds(holds, seen, isTty) {
 		seen: next
 	};
 }
-/** Print a hold's identity + its drift payload (when present) to stdout. */
-function printHold(hold) {
+/** Print a hold's identity + its drift payload (when present) via `out`. */
+function printHold(hold, out) {
 	const scope = hold.holdScope ?? "job";
 	const where = scope === "step" && hold.stepIndex != null ? `step #${hold.stepIndex}${hold.jobId ? ` of job '${hold.jobId}'` : ""}` : hold.jobId ? `job '${hold.jobId}'` : scope;
-	logger.info(pc.yellow(`\n[kici] Run held for approval (${where}).`));
+	out(pc.yellow(`\n[kici] Run held for approval (${where}).`));
 	if (hold.payload?.summaryMarkdown) {
-		logger.info(pc.dim("Computed drift — review before approving:"));
-		for (const line of hold.payload.summaryMarkdown.split("\n")) logger.info(pc.dim(`    ${line}`));
+		out(pc.dim("Computed drift — review before approving:"));
+		for (const line of hold.payload.summaryMarkdown.split("\n")) out(pc.dim(`    ${line}`));
 	}
 }
 /**
@@ -56,28 +56,29 @@ function printHold(hold) {
 async function handleNewHolds(args) {
 	const { actions, seen } = classifyNewHolds(args.holds, args.seen, args.isTty);
 	if (actions.length === 0) return seen;
+	const out = args.output ?? ((line) => logger.info(line));
 	const resolveCtx = args.resolveContext ?? resolveHeldRunContext;
 	const doApprove = args.approve ?? postApprove;
 	const doReject = args.reject ?? postReject;
 	let ctx = null;
-	if (args.approveAll) logger.info(pc.yellow("[kici] --approve-all: auto-approving every gate for this run (eligibility enforced)."));
+	if (args.approveAll) out(pc.yellow("[kici] --approve-all: auto-approving every gate for this run (eligibility enforced)."));
 	for (const action of actions) {
-		printHold(action.hold);
+		printHold(action.hold, out);
 		ctx = ctx ?? await resolveCtx();
 		if (!ctx) {
-			logger.info(pc.dim(`Run held; approve via \`kici approve ${action.hold.runId}\`.`));
+			out(pc.dim(`Run held; approve via \`kici approve ${action.hold.runId}\`.`));
 			continue;
 		}
 		if (args.approveAll) {
-			if (await doApprove(ctx, action.hold.id, true)) logger.info(pc.green("[kici] Auto-approved."));
+			if (await doApprove(ctx, action.hold.id, true)) out(pc.green("[kici] Auto-approved."));
 			continue;
 		}
 		if (action.kind === "notify") {
-			logger.info(pc.dim(`Run held; approve via the dashboard or \`kici approve ${action.hold.runId}\`.`));
+			out(pc.dim(`Run held; approve via the dashboard or \`kici approve ${action.hold.runId}\`.`));
 			continue;
 		}
 		const approved = await args.confirm("Approve this gate?");
-		if (approved ? await doApprove(ctx, action.hold.id) : await doReject(ctx, action.hold.id, "rejected via kici run")) logger.info(approved ? pc.green("[kici] Approved.") : pc.red("[kici] Rejected."));
+		if (approved ? await doApprove(ctx, action.hold.id) : await doReject(ctx, action.hold.id, "rejected via kici run")) out(approved ? pc.green("[kici] Approved.") : pc.red("[kici] Rejected."));
 	}
 	return seen;
 }

package/dist/commands/run.d.ts

@@ -1,6 +1,15 @@
 import { type HostTargetSelector, type InputsDescriptorMap } from '@kici-dev/engine';
 import type { RunLocalOptions } from '../local-executor/types.js';
-import type { RemoteRunOptions } from './test.js';
+import type { RemoteRunOptions } from './preview.js';
+/**
+ * Print a usage block for `kici run local` when the event argument is missing.
+ *
+ * Mirrors the discoverable help `kici preview` prints for a missing event: a
+ * bold synopsis line, a one-line description, and a few concrete event
+ * examples. The caller exits non-zero after printing — a missing event is a
+ * usage error, unlike `kici preview` which treats no-event as help.
+ */
+export declare function printRunLocalUsage(): void;
 /**
  * Compile `--target` selector strings into a {@link HostTargetSelector}. Each
  * string becomes one AND value (its own include set); repeated values
@@ -23,6 +32,16 @@ export declare function lookupDispatchInputsDescriptor(inlineLockFile: string |
  * authoritative and applies coercion + defaults exactly once.
  */
 export declare function buildDispatchInputs(pairs: string[], descriptor: InputsDescriptorMap | undefined): Record<string, string>;
+/**
+ * Run `fn` with everything written to `process.stdout` redirected to
+ * `process.stderr`, then restore the original writer. Compiling a repo
+ * evaluates every user workflow / fixture module, and a `console.log` at a
+ * module's top level writes straight to stdout. On a machine-readable
+ * (`--json`) run that stdout MUST carry only the final JSON result, so the
+ * compile phases run inside this guard — workflow log output belongs on
+ * stderr regardless.
+ */
+export declare function withStdoutOnStderr<T>(fn: () => Promise<T>): Promise<T>;
 /**
  * Run a workflow locally using the local executor.
  * Thin wrapper that delegates to executeLocal from local-executor.

package/dist/commands/run.js

@@ -1,8 +1,9 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import { RunHistory } from "../remote/history.js";
+import { buildLocalRepoIdentity } from "../remote/local-repo-identity.js";
 import { AccessDeniedError, AmbiguousClusterError, AuthenticationError, ConnectionError, NoClusterError, PlatformRunClient } from "../remote/platform-client.js";
 import { buildEncryptedSecrets } from "../remote/secret-upload.js";
 import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/uploader.js";
@@ -23,8 +24,26 @@ import { coerceDispatchInputs, parseInputPairs } from "@kici-dev/engine";
 import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
 import { confirm } from "@inquirer/prompts";
 //#region src/commands/run.ts
+/**
+* Print a usage block for `kici run local` when the event argument is missing.
+*
+* Mirrors the discoverable help `kici preview` prints for a missing event: a
+* bold synopsis line, a one-line description, and a few concrete event
+* examples. The caller exits non-zero after printing — a missing event is a
+* usage error, unlike `kici preview` which treats no-event as help.
+*/
+function printRunLocalUsage() {
+	logger.info(pc.bold("\nUsage: kici run local <event> [options]\n"));
+	logger.info(pc.gray("Execute workflows locally for a given event, without orchestrator infrastructure.\n"));
+	logger.info(pc.gray("Examples:"));
+	logger.info(pc.gray("  kici run local push"));
+	logger.info(pc.gray("  kici run local pr:open"));
+	logger.info(pc.gray("  kici run local schedule"));
+	logger.info(pc.gray("  kici run local lifecycle:workflow_complete\n"));
+	logger.info(pc.gray("Or pick a workflow interactively: kici run local --pick\n"));
+}
 /** Terminal run statuses returned by the Platform run-status snapshot. */
-const TERMINAL_STATUSES = new Set([
+const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
 	"success",
 	"failed",
 	"cancelled",
@@ -90,6 +109,24 @@ function buildDispatchInputs(pairs, descriptor) {
 /** Interval between status/log polls while a run is active. */
 const POLL_INTERVAL_MS = 750;
 /**
+* Run `fn` with everything written to `process.stdout` redirected to
+* `process.stderr`, then restore the original writer. Compiling a repo
+* evaluates every user workflow / fixture module, and a `console.log` at a
+* module's top level writes straight to stdout. On a machine-readable
+* (`--json`) run that stdout MUST carry only the final JSON result, so the
+* compile phases run inside this guard — workflow log output belongs on
+* stderr regardless.
+*/
+async function withStdoutOnStderr(fn) {
+	const realWrite = process.stdout.write.bind(process.stdout);
+	process.stdout.write = process.stderr.write.bind(process.stderr);
+	try {
+		return await fn();
+	} finally {
+		process.stdout.write = realWrite;
+	}
+}
+/**
 * Recompile `.kici/workflows` → `kici.lock.json` before a remote run, mirroring
 * `kici run local`. The orchestrator matches triggers and dispatches against the
 * inline lock, so a stale lock would route an edited or newly-added workflow
@@ -97,12 +134,14 @@ const POLL_INTERVAL_MS = 750;
 * abort before any upload or dispatch.
 */
 async function compileBeforeRemoteRun(options) {
-	return compileCommand({
+	const pureStdout = Boolean(options.json || options.quiet);
+	const compile = () => compileCommand({
 		kiciDir: options.kiciDir ?? ".kici",
 		check: false,
 		verbose: options.debug ?? false,
-		quiet: Boolean(options.json || options.quiet)
+		quiet: pureStdout
 	});
+	return pureStdout ? withStdoutOnStderr(compile) : compile();
 }
 /**
 * Run a workflow locally using the local executor.
@@ -148,7 +187,8 @@ async function runRemoteCommand(fixture, options) {
 			console.log(history.formatTable(entries));
 			return true;
 		}
-		const fixtures = await compileFixtures(path.join(kiciDir, "tests"));
+		const testsDir = path.join(kiciDir, "tests");
+		const fixtures = options.json ? await withStdoutOnStderr(() => compileFixtures(testsDir)) : await compileFixtures(testsDir);
 		let selected;
 		if (options.pick) {
 			if (fixtures.length === 0) return listFixtures(fixtures);
@@ -355,11 +395,12 @@ async function runSingleFixture(fixture, ctx, options, config, history) {
 		const uploaded = await initAndUpload(ctx, overlay, options);
 		const event = buildEventFromFixture(opts);
 		{
-			const repoName = path.basename(overlay.repoRoot);
+			const identity = buildLocalRepoIdentity(overlay.repoRoot);
 			const repo = event.payload.repository;
 			event.payload.repository = {
 				...repo ?? {},
-				full_name: `local/${repoName}`
+				full_name: identity.repoIdentifier,
+				provider: identity.provider
 			};
 		}
 		if (!options.quiet) logger.info(pc.gray("Triggering test run..."));
@@ -397,7 +438,10 @@ async function runSingleFixture(fixture, ctx, options, config, history) {
 				reason: triggerResult.reason
 			};
 		}
-		if (!options.quiet) logger.info(pc.green(`Run started: ${triggerResult.runId}`));
+		if (!options.quiet) {
+			logger.info(pc.green(`Run started: ${triggerResult.runId}`));
+			for (const warning of triggerResult.warnings ?? []) logger.warn(pc.yellow(`⚠ ${warning}`));
+		}
 		await history.addEntry({
 			runId: triggerResult.runId,
 			fixtureId: fixture.id,
@@ -476,7 +520,7 @@ async function pollRunToCompletion(ctx, runId, fixtureId, options) {
 			lastStatus = await ctx.client.runStatus(ctx.orgId, runId, ctx.target);
 			const terminal = lastStatus.done || TERMINAL_STATUSES.has(lastStatus.status);
 			if (terminal && logs.done) return finishRun(fixtureId, runId, lastStatus, startTime, tailLines, options);
-			if (!terminal && !options.quiet) await watchRunHolds(runId, seenHolds, () => heldCtx, (c) => heldCtx = c, options);
+			if (!terminal) await watchRunHolds(runId, seenHolds, () => heldCtx, (c) => heldCtx = c, options);
 			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
 		}
 		return {
@@ -506,10 +550,12 @@ async function watchRunHolds(runId, seenHolds, getCtx, setCtx, options) {
 		if (!ctx) return;
 		const holds = await listHeldRunsForRun(ctx, runId);
 		if (holds.length === 0) return;
+		const quiet = Boolean(options.quiet);
 		await handleNewHolds({
 			holds,
 			seen: seenHolds,
-			isTty: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+			isTty: quiet ? false : Boolean(process.stdin.isTTY && process.stdout.isTTY),
+			output: quiet ? (line) => void process.stderr.write(line + "\n") : (line) => logger.info(line),
 			approveAll: Boolean(options.approveAll),
 			confirm: (message) => confirm({
 				message,
@@ -589,7 +635,11 @@ async function runDirectWorkflow(workflowName, options) {
 	try {
 		const overlay = await prepareOverlay(options);
 		const uploaded = await initAndUpload(ctx, overlay, options);
-		const payload = { repository: { full_name: `local/${path.basename(overlay.repoRoot)}` } };
+		const identity = buildLocalRepoIdentity(overlay.repoRoot);
+		const payload = { repository: {
+			full_name: identity.repoIdentifier,
+			provider: identity.provider
+		} };
 		const encrypted = await buildEncryptedSecrets(overlay.kiciDir, options.envFlags, options.context, uploaded.publicKey);
 		const triggerResult = await ctx.client.trigger(ctx.orgId, ctx.target, {
 			fixtureId,
@@ -644,6 +694,6 @@ function displayRemoteResults(results) {
 	logger.info("");
 }
 //#endregion
-export { buildDispatchInputs, buildTargetSelector, lookupDispatchInputsDescriptor, runLocalCommand, runRemoteCommand };
+export { buildDispatchInputs, buildTargetSelector, lookupDispatchInputsDescriptor, printRunLocalUsage, runLocalCommand, runRemoteCommand, withStdoutOnStderr };
 
 //# sourceMappingURL=run.js.map

package/dist/commands/runs/cancel.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";

package/dist/commands/runs/list.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { colorStatus, formatDuration as formatDuration$1, relativeTime, renderTable } from "../../remote/render.js";
 import pc from "picocolors";

package/dist/commands/runs/logs.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { colorStatus } from "../../remote/render.js";
 import pc from "picocolors";

package/dist/commands/runs/rerun.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";

package/dist/commands/runs/show.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { RunHistory } from "../../remote/history.js";
 import { colorStatus, formatDuration as formatDuration$1, relativeTime } from "../../remote/render.js";

package/dist/commands/secrets-list.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";

package/dist/commands/types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import { generateSecretsDts } from "../generators/secrets-dts.js";

package/dist/commands/verify-attestation.d.ts

@@ -1,7 +1,10 @@
 export interface VerifyAttestationOptions {
     /** Path or `http(s)` URL to the attestation bundle JSON. Required. */
     bundle?: string;
-    /** Trusted issuer URL (online discovery) or a self-contained `{ issuer, jwks }` file. Required. */
+    /**
+     * Trusted issuer URL (online discovery) or a self-contained `{ issuer, jwks }`
+     * file. Optional — defaults to the hosted KiCI Platform's provenance issuer.
+     */
     trustRoot?: string;
     /** Expected token audience (defaults to the KiCI provenance audience). */
     audience?: string;

package/dist/commands/verify-attestation.js

@@ -1,5 +1,6 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { resolveTrustRoot } from "../provenance-trust-root.js";
+import "../remote/prod-defaults.js";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
 import { logger, sha256File, toErrorMessage } from "@kici-dev/core";
@@ -7,13 +8,18 @@ import { KICI_PROVENANCE_AUDIENCE } from "@kici-dev/engine/provenance/bundle";
 import { verifyKiciBundle } from "@kici-dev/engine/provenance/verify";
 //#region src/commands/verify-attestation.ts
 /**
-* `kici verify-attestation [artifact] --bundle <path|url> --trust-root <url|file>`
+* `kici verify-attestation [artifact] --bundle <path|url> [--trust-root <url|file>]`
 *
 * Offline verification of a KiCI-signed provenance bundle: read the bundle,
-* resolve the trusted issuer + JWKS out-of-band (`--trust-root`), optionally
-* digest the artifact, and hand everything to the shared browser-safe
-* `verifyKiciBundle` core in `@kici-dev/engine`. The engine owns all crypto;
-* this command is the thin Node wrapper (fs / fetch / artifact digest / output).
+* resolve the trusted issuer + JWKS out-of-band, optionally digest the artifact,
+* and hand everything to the shared browser-safe `verifyKiciBundle` core in
+* `@kici-dev/engine`. The engine owns all crypto; this command is the thin Node
+* wrapper (fs / fetch / artifact digest / output).
+*
+* `--trust-root` is optional: when omitted it defaults to the hosted KiCI
+* Platform's provenance issuer, so the common case (verifying a bundle attested
+* on the hosted platform) needs no flag. Pass `--trust-root` to verify against a
+* different environment (e.g. staging) or an offline `{ issuer, jwks }` file.
 *
 * Returns a boolean (verified) so `cli.ts` can map it to an exit code (0/1).
 */
@@ -23,12 +29,22 @@ async function verifyAttestationCommand(artifact, options = {}) {
 			logger.error(pc.red("Error: --bundle <path|url> is required"));
 			return false;
 		}
-		if (!options.trustRoot) {
-			logger.error(pc.red("Error: --trust-root <url|file> is required"));
-			return false;
-		}
+		const trustRoot = options.trustRoot ?? "https://api.kici.dev";
+		const usingDefault = !options.trustRoot;
+		if (usingDefault) logger.info(pc.gray(`Using default trust root ${trustRoot} (pass --trust-root to override)`));
 		const bundle = JSON.parse(await readBundle(options.bundle));
-		const { issuer, jwks } = await resolveTrustRoot(options.trustRoot);
+		let resolved;
+		try {
+			resolved = await resolveTrustRoot(trustRoot);
+		} catch (error) {
+			const msg = toErrorMessage(error);
+			if (usingDefault && /\b503\b/.test(msg)) {
+				logger.error(pc.red(`Error: build provenance is not enabled on the hosted KiCI platform yet (${trustRoot} returned 503). Pass --trust-root to verify against another environment (e.g. staging) or an offline { issuer, jwks } file.`));
+				return false;
+			}
+			throw error;
+		}
+		const { issuer, jwks } = resolved;
 		const expectedDigest = artifact ? {
 			alg: "sha256",
 			hex: await sha256File(artifact)
@@ -47,7 +63,13 @@ async function verifyAttestationCommand(artifact, options = {}) {
 		if (result.verified) {
 			logger.info(`${pc.green("PASS")} provenance verified (issuer ${issuer})`);
 			const c = result.claims ?? {};
-			logger.info(pc.gray(`  repository=${c.repository} ref=${c.ref} sha=${c.sha} run=${c.kici_run_id} job=${c.kici_job_id}`));
+			logger.info(pc.gray(`  origin org=${c.org_id ?? "unknown"}`));
+			if (c.source_origin === "run-remote") logger.info(pc.bold(pc.yellow("  SOURCE: kici run remote (local working-tree overlay — repository/ref/sha are caller-supplied, not a triggered VCS commit)")));
+			else logger.info(pc.gray(`  source: ${c.source_origin ?? "triggered"}`));
+			const origin = result.attestationOrigin ?? "live";
+			if (origin === "deferred") logger.info(pc.bold(pc.yellow("  ATTESTATION: deferred — the build facts were sealed at build time; the identity token was minted later (after a transient Platform outage), bound to the frozen statement by hash.")));
+			else if (origin === "offline-backfill") logger.info(pc.bold(pc.yellow("  ATTESTATION: offline-backfill — the run was ingested while the Platform was down; its run/job rows were backfilled and the token minted later. The org id is the authoritative anchor; the temporal gap is disclosed.")));
+			logger.info(pc.gray(`  repository=${c.repository} ref=${c.ref} sha=${c.sha} provider=${c.provider ?? "unknown"} run=${c.kici_run_id} job=${c.kici_job_id}`));
 		} else logger.error(`${pc.red("FAIL")} provenance NOT verified: ${result.failures.join(", ")}`);
 		return result.verified;
 	} catch (error) {

package/dist/commands/watch.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { compileCommand } from "./compile.js";

package/dist/commands/workflows.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { formatRelativeTime } from "../format.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import pc from "picocolors";

package/dist/errors/capability-gap.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 //#region src/errors/capability-gap.ts
 /**

package/dist/errors/formatter.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 //#region src/errors/formatter.ts
 /**

package/dist/errors/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { compilerError, formatError, isCompilerError } from "./formatter.js";
 import { CapabilityGapError, formatCapabilityGapError } from "./capability-gap.js";
 export { CapabilityGapError, compilerError, formatCapabilityGapError, formatError, isCompilerError };

package/dist/execution/executor.d.ts

@@ -19,12 +19,11 @@ export interface DiscoveryResult {
  * Execute a TypeScript config file and extract workflow definitions.
  *
  * Process:
- * 1. Read TypeScript source from disk
- * 2. Transform to ESM JavaScript via rolldown (in-memory)
- * 3. Write temp file for Node.js dynamic import (required by ESM spec)
- * 4. Dynamic import the compiled module
- * 5. Extract and return workflow definitions
- * 6. Clean up temp file
+ * 1. Resolve the path and verify the file exists and is readable
+ * 2. Register the oxc-transform TS loader hook and dynamic-import the module
+ *    (TypeScript compiled on the fly by the hook — no bundling, no temp files)
+ * 3. Extract workflow definitions from the module's default/named exports
+ * 4. Return the workflows with source tracking
  *
  * @param configPath - Path to workflow file (relative or absolute)
  * @returns Workflows exported from the config

package/dist/execution/executor.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { compilerError } from "../errors/formatter.js";
 import "../errors/index.js";
 import { ensureTsLoaderHook } from "./ts-loader.js";
@@ -47,12 +47,11 @@ async function loadModule(entryPoint, errorContext) {
 * Execute a TypeScript config file and extract workflow definitions.
 *
 * Process:
-* 1. Read TypeScript source from disk
-* 2. Transform to ESM JavaScript via rolldown (in-memory)
-* 3. Write temp file for Node.js dynamic import (required by ESM spec)
-* 4. Dynamic import the compiled module
-* 5. Extract and return workflow definitions
-* 6. Clean up temp file
+* 1. Resolve the path and verify the file exists and is readable
+* 2. Register the oxc-transform TS loader hook and dynamic-import the module
+*    (TypeScript compiled on the fly by the hook — no bundling, no temp files)
+* 3. Extract workflow definitions from the module's default/named exports
+* 4. Return the workflows with source tracking
 *
 * @param configPath - Path to workflow file (relative or absolute)
 * @returns Workflows exported from the config

package/dist/execution/index.js

@@ -1,3 +1,3 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { discoverWorkflows, executeConfig, resolveKiciDir } from "./executor.js";
 export { discoverWorkflows, executeConfig, resolveKiciDir };

package/dist/execution/sdk-alias.d.ts

@@ -1,23 +1,13 @@
 /**
- * SDK aliasing for development mode
+ * SDK development-mode path resolution.
  *
- * Enables automatic aliasing of @kici-dev/sdk imports to a local development repository when:
+ * Resolves a local @kici-dev/sdk checkout for IDE tsconfig `paths` mappings when:
  * 1. sdkPath is configured in .kici/package.json
  * 2. Current project is NOT the kici development repo itself
  *
- * This allows developers to test SDK changes in real-time without publishing or manual linking.
+ * This gives developers editor autocomplete against local SDK source without
+ * publishing or manual linking.
  */
-/**
- * Get rolldown alias configuration for SDK development mode.
- *
- * Returns alias mapping if:
- * - sdkPath is configured in .kici/package.json
- * - Current project is NOT the kici repo itself
- * - SDK build exists at configured path
- *
- * @returns Alias config for rolldown (empty object if aliasing disabled)
- */
-export declare function getSdkAliasConfig(): Promise<Record<string, string>>;
 /**
  * Get TypeScript path mappings for IDE support.
  *