@kici-dev/compiler 0.1.23 → 0.1.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (137) hide show
  1. package/dist/auth/headless-detect.js +1 -1
  2. package/dist/cli-banner.js +1 -1
  3. package/dist/cli.d.ts +18 -0
  4. package/dist/cli.js +71 -10
  5. package/dist/commands/approve.js +2 -2
  6. package/dist/commands/check-mode.js +1 -1
  7. package/dist/commands/compile.js +1 -1
  8. package/dist/commands/diagnostics.js +1 -1
  9. package/dist/commands/docs.js +1 -1
  10. package/dist/commands/drain-worker.js +1 -1
  11. package/dist/commands/endpoints.js +1 -1
  12. package/dist/commands/fixture.js +2 -2
  13. package/dist/commands/held-run-client.d.ts +1 -1
  14. package/dist/commands/held-run-client.js +1 -1
  15. package/dist/commands/hook.js +1 -1
  16. package/dist/commands/index.d.ts +5 -3
  17. package/dist/commands/index.js +5 -4
  18. package/dist/commands/init.js +3 -3
  19. package/dist/commands/login.js +1 -1
  20. package/dist/commands/logout.js +1 -1
  21. package/dist/commands/orchestrators.js +1 -1
  22. package/dist/commands/org.js +1 -1
  23. package/dist/commands/pat.d.ts +27 -0
  24. package/dist/commands/pat.js +76 -0
  25. package/dist/commands/preview.d.ts +88 -0
  26. package/dist/commands/{test.js → preview.js} +16 -15
  27. package/dist/commands/reject.js +2 -2
  28. package/dist/commands/run-hold-watch.d.ts +10 -1
  29. package/dist/commands/run-hold-watch.js +13 -12
  30. package/dist/commands/run.d.ts +20 -1
  31. package/dist/commands/run.js +62 -12
  32. package/dist/commands/runs/cancel.js +1 -1
  33. package/dist/commands/runs/list.js +1 -1
  34. package/dist/commands/runs/logs.js +1 -1
  35. package/dist/commands/runs/rerun.js +1 -1
  36. package/dist/commands/runs/show.js +1 -1
  37. package/dist/commands/secrets-list.js +1 -1
  38. package/dist/commands/types.js +1 -1
  39. package/dist/commands/verify-attestation.d.ts +4 -1
  40. package/dist/commands/verify-attestation.js +34 -12
  41. package/dist/commands/watch.js +1 -1
  42. package/dist/commands/workflows.js +1 -1
  43. package/dist/errors/capability-gap.js +1 -1
  44. package/dist/errors/formatter.js +1 -1
  45. package/dist/errors/index.js +1 -1
  46. package/dist/execution/executor.d.ts +5 -6
  47. package/dist/execution/executor.js +6 -7
  48. package/dist/execution/index.js +1 -1
  49. package/dist/execution/sdk-alias.d.ts +4 -14
  50. package/dist/execution/sdk-alias.js +6 -45
  51. package/dist/execution/ts-loader.js +1 -1
  52. package/dist/fixtures/compiler.js +1 -1
  53. package/dist/fixtures/defaults/index.js +1 -1
  54. package/dist/fixtures/describe-event.d.ts +0 -4
  55. package/dist/fixtures/describe-event.js +35 -5
  56. package/dist/fixtures/picker.js +1 -1
  57. package/dist/format.js +1 -1
  58. package/dist/generators/secrets-dts.js +3 -1
  59. package/dist/hooks/detector.js +1 -1
  60. package/dist/hooks/index.js +1 -1
  61. package/dist/hooks/installer.js +1 -1
  62. package/dist/hooks/templates.js +1 -1
  63. package/dist/index.d.ts +2 -2
  64. package/dist/index.js +3 -3
  65. package/dist/llm-context/llms-architecture.txt +4 -4
  66. package/dist/llm-context/llms-cli.txt +346 -33
  67. package/dist/llm-context/llms-features.txt +128 -21
  68. package/dist/llm-context/llms-full.txt +610 -71
  69. package/dist/llm-context/llms-getting-started.txt +7 -7
  70. package/dist/llm-context/llms-sdk.txt +125 -6
  71. package/dist/llm-context/llms.txt +7 -5
  72. package/dist/local-executor/dag-scheduler.js +1 -1
  73. package/dist/local-executor/index.js +3 -2
  74. package/dist/local-executor/job-runner.js +4 -4
  75. package/dist/local-executor/materializer.js +1 -1
  76. package/dist/local-executor/output-streamer.js +1 -1
  77. package/dist/local-executor/payload-generator.js +1 -1
  78. package/dist/local-executor/picker.js +1 -1
  79. package/dist/local-executor/runs-on-display.js +1 -1
  80. package/dist/local-executor/secret-loader.js +1 -1
  81. package/dist/local-executor/to-event-payload.js +1 -1
  82. package/dist/local-executor/types.js +1 -1
  83. package/dist/local-executor/workflow-lock.js +0 -0
  84. package/dist/lockfile/generator.d.ts +10 -2
  85. package/dist/lockfile/generator.js +107 -53
  86. package/dist/lockfile/hash-files.js +1 -1
  87. package/dist/lockfile/hasher.js +1 -1
  88. package/dist/lockfile/index.js +1 -1
  89. package/dist/lockfile/purity-analyzer.js +3 -3
  90. package/dist/postinstall.js +1 -1
  91. package/dist/provenance-trust-root.js +1 -1
  92. package/dist/remote/config.js +1 -1
  93. package/dist/remote/dashboard-client.js +1 -1
  94. package/dist/remote/encryption.js +1 -1
  95. package/dist/remote/history.d.ts +1 -1
  96. package/dist/remote/history.js +2 -2
  97. package/dist/remote/local-repo-identity.d.ts +32 -0
  98. package/dist/remote/local-repo-identity.js +74 -0
  99. package/dist/remote/oauth.js +1 -1
  100. package/dist/remote/oidc-discovery.js +1 -1
  101. package/dist/remote/output/json.js +1 -1
  102. package/dist/remote/output/junit.js +1 -1
  103. package/dist/remote/output/streaming.js +1 -1
  104. package/dist/remote/output/summary.js +1 -1
  105. package/dist/remote/platform-client.d.ts +2 -0
  106. package/dist/remote/platform-client.js +1 -1
  107. package/dist/remote/prod-defaults.d.ts +9 -1
  108. package/dist/remote/prod-defaults.js +11 -3
  109. package/dist/remote/render.js +1 -1
  110. package/dist/remote/secret-upload.js +1 -1
  111. package/dist/remote/uploader.js +4 -4
  112. package/dist/{chunk-BTugEXQM.js → rolldown-runtime-ClRpJifh.js} +0 -1
  113. package/dist/templates/agents-md.d.ts +1 -1
  114. package/dist/templates/agents-md.js +3 -3
  115. package/dist/templates/index.js +1 -1
  116. package/dist/templates/package-json.js +2 -2
  117. package/dist/templates/tsconfig-json.js +1 -1
  118. package/dist/templates/workflows/hello-world.js +1 -1
  119. package/dist/templates/workflows/pr-checks.js +1 -1
  120. package/dist/test-runner/dry-run.js +1 -1
  121. package/dist/test-runner/event-types.js +1 -1
  122. package/dist/test-runner/git-detector.js +1 -1
  123. package/dist/test-runner/index.js +1 -1
  124. package/dist/test-runner/job-executor.js +1 -1
  125. package/dist/test-runner/output-formatter.js +1 -1
  126. package/dist/test-runner/payload-builder.js +1 -1
  127. package/dist/test-runner/rule-evaluator.js +1 -1
  128. package/dist/test-runner/secrets-file.js +1 -1
  129. package/dist/test-runner/step-context.d.ts +1 -1
  130. package/dist/test-runner/step-context.js +3 -2
  131. package/dist/types.d.ts +33 -6
  132. package/dist/types.js +6 -2
  133. package/dist/validation/index.js +1 -1
  134. package/dist/validation/validator.js +1 -1
  135. package/package.json +4 -7
  136. package/sbom.spdx.json +35 -35
  137. package/dist/commands/held-run-resolve.js +0 -53
@@ -1,41 +1,18 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  import path from "node:path";
3
- import { existsSync } from "node:fs";
4
3
  import { readFile } from "node:fs/promises";
5
- import { logger } from "@kici-dev/core";
6
4
  //#region src/execution/sdk-alias.ts
7
5
  /**
8
- * SDK aliasing for development mode
6
+ * SDK development-mode path resolution.
9
7
  *
10
- * Enables automatic aliasing of @kici-dev/sdk imports to a local development repository when:
8
+ * Resolves a local @kici-dev/sdk checkout for IDE tsconfig `paths` mappings when:
11
9
  * 1. sdkPath is configured in .kici/package.json
12
10
  * 2. Current project is NOT the kici development repo itself
13
11
  *
14
- * This allows developers to test SDK changes in real-time without publishing or manual linking.
12
+ * This gives developers editor autocomplete against local SDK source without
13
+ * publishing or manual linking.
15
14
  */
16
15
  /**
17
- * Get rolldown alias configuration for SDK development mode.
18
- *
19
- * Returns alias mapping if:
20
- * - sdkPath is configured in .kici/package.json
21
- * - Current project is NOT the kici repo itself
22
- * - SDK build exists at configured path
23
- *
24
- * @returns Alias config for rolldown (empty object if aliasing disabled)
25
- */
26
- async function getSdkAliasConfig() {
27
- const basePath = await getSdkPathFromPackageJson();
28
- if (!basePath) return {};
29
- if (await isInKiciRepo()) {
30
- if (process.env.KICI_DEBUG === "true") logger.warn("[kici] SDK aliasing disabled: running inside kici development repo");
31
- return {};
32
- }
33
- const sdkPath = resolveAndValidateSdkPath(basePath);
34
- if (!sdkPath) return {};
35
- logger.warn(`[kici] Development mode: using local SDK from ${path.dirname(path.dirname(sdkPath))}`);
36
- return { "@kici-dev/sdk": sdkPath };
37
- }
38
- /**
39
16
  * Read sdkPath from .kici/package.json configuration.
40
17
  *
41
18
  * @returns Absolute path to SDK repo, or null if not configured
@@ -66,22 +43,6 @@ async function isInKiciRepo() {
66
43
  }
67
44
  }
68
45
  /**
69
- * Resolve and validate the SDK dist path from a base kici repo path.
70
- *
71
- * @returns Absolute path to SDK dist/index.js, or null if not found
72
- */
73
- function resolveAndValidateSdkPath(basePath) {
74
- const sdkPath = path.resolve(basePath, "packages/sdk/dist/index.js");
75
- if (!existsSync(sdkPath)) {
76
- logger.warn("[kici] sdkPath configured but SDK not found at path");
77
- logger.warn(`[kici] Expected: ${sdkPath}`);
78
- logger.warn("[kici] Hint: run \"pnpm build\" in the kici repo");
79
- return null;
80
- }
81
- if (process.env.KICI_DEBUG === "true") logger.warn(`[kici] SDK alias resolved to: ${sdkPath}`);
82
- return sdkPath;
83
- }
84
- /**
85
46
  * Get TypeScript path mappings for IDE support.
86
47
  *
87
48
  * Returns path mapping configuration to include in tsconfig.json:
@@ -97,6 +58,6 @@ async function getTypeScriptPaths() {
97
58
  return { "@kici-dev/sdk": [path.resolve(basePath, "packages/sdk/src/index.ts")] };
98
59
  }
99
60
  //#endregion
100
- export { getSdkAliasConfig, getTypeScriptPaths };
61
+ export { getTypeScriptPaths };
101
62
 
102
63
  //# sourceMappingURL=sdk-alias.js.map
@@ -1,4 +1,4 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  import { register } from "node:module";
3
3
  //#region src/execution/ts-loader.ts
4
4
  let registered = false;
@@ -1,4 +1,4 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  import { ensureTsLoaderHook } from "../execution/ts-loader.js";
3
3
  import { fileURLToPath, pathToFileURL } from "node:url";
4
4
  import path from "node:path";
@@ -1,4 +1,4 @@
1
- import "../../chunk-BTugEXQM.js";
1
+ import "../../rolldown-runtime-ClRpJifh.js";
2
2
  import { fileURLToPath } from "node:url";
3
3
  import { dirname, join } from "node:path";
4
4
  import { readFileSync } from "node:fs";
@@ -1,6 +1,2 @@
1
- /**
2
- * Describe the event type from a fixture's trigger config, for the fixtures
3
- * table and the interactive picker.
4
- */
5
1
  export declare function describeEvent(event: unknown): string;
6
2
  //# sourceMappingURL=describe-event.d.ts.map
@@ -1,16 +1,46 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  //#region src/fixtures/describe-event.ts
3
3
  /**
4
4
  * Describe the event type from a fixture's trigger config, for the fixtures
5
5
  * table and the interactive picker.
6
+ *
7
+ * A fixture's `event` is an SDK `TriggerConfig`, discriminated by the `_tag`
8
+ * field (e.g. `PushTrigger`, `PrTrigger`). This maps each tag to a short,
9
+ * human-readable event label.
6
10
  */
11
+ const TAG_TO_EVENT = {
12
+ PushTrigger: "push",
13
+ PrTrigger: "pr",
14
+ TagTrigger: "tag",
15
+ CommentTrigger: "comment",
16
+ ReviewTrigger: "review",
17
+ ReviewCommentTrigger: "review_comment",
18
+ ReleaseTrigger: "release",
19
+ DispatchTrigger: "dispatch",
20
+ CreateTrigger: "create",
21
+ DeleteTrigger: "delete",
22
+ StatusTrigger: "status",
23
+ WorkflowRunTrigger: "workflow_run",
24
+ ForkTrigger: "fork",
25
+ StarTrigger: "star",
26
+ WatchTrigger: "watch",
27
+ KiciEventTrigger: "kici_event",
28
+ WorkflowCompleteTrigger: "workflow_complete",
29
+ JobCompleteTrigger: "job_complete",
30
+ GenericWebhookTrigger: "generic_webhook",
31
+ ScheduleTrigger: "schedule",
32
+ LifecycleTrigger: "lifecycle",
33
+ WebhookTrigger: "webhook"
34
+ };
7
35
  function describeEvent(event) {
8
36
  if (!event || typeof event !== "object") return "unknown";
9
37
  const e = event;
10
- if (e._type === "push") return "push";
11
- if (e._type === "pr") return `pr:${e.action ?? "open"}`;
12
- if (typeof e._type === "string") return String(e._type);
13
- return "custom";
38
+ const tag = e._tag;
39
+ if (typeof tag !== "string") return "custom";
40
+ const label = TAG_TO_EVENT[tag];
41
+ if (!label) return "custom";
42
+ if (tag === "PrTrigger" && Array.isArray(e.events) && e.events.length > 0) return `pr:${String(e.events[0])}`;
43
+ return label;
14
44
  }
15
45
  //#endregion
16
46
  export { describeEvent };
@@ -1,4 +1,4 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  import { describeEvent } from "./describe-event.js";
3
3
  import path from "node:path";
4
4
  import pc from "picocolors";
package/dist/format.js CHANGED
@@ -1,4 +1,4 @@
1
- import "./chunk-BTugEXQM.js";
1
+ import "./rolldown-runtime-ClRpJifh.js";
2
2
  //#region src/format.ts
3
3
  /**
4
4
  * Format an ISO timestamp as a relative time string (e.g. "2 minutes ago").
@@ -1,4 +1,4 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  //#region src/generators/secrets-dts.ts
3
3
  /**
4
4
  * Check if a string is a valid TypeScript identifier (unquoted property name).
@@ -59,6 +59,8 @@ function generateSecretsDts(options) {
59
59
  lines.push(" }");
60
60
  lines.push("}");
61
61
  lines.push("");
62
+ lines.push("export {};");
63
+ lines.push("");
62
64
  return lines.join("\n");
63
65
  }
64
66
  //#endregion
@@ -1,4 +1,4 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  import path from "node:path";
3
3
  import { readFile, stat } from "node:fs/promises";
4
4
  //#region src/hooks/detector.ts
@@ -1,4 +1,4 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  import { detectHookTools, findGitDir, findGitRoot } from "./detector.js";
3
3
  import { KICI_HOOK_MARKER, getHookTemplate, hasKiciHook } from "./templates.js";
4
4
  import { installHook } from "./installer.js";
@@ -1,4 +1,4 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  import { findGitDir } from "./detector.js";
3
3
  import { getHookTemplate, hasKiciHook } from "./templates.js";
4
4
  import path from "node:path";
@@ -1,4 +1,4 @@
1
- import "../chunk-BTugEXQM.js";
1
+ import "../rolldown-runtime-ClRpJifh.js";
2
2
  //#region src/hooks/templates.ts
3
3
  /** Marker comment to identify kici-added hooks */
4
4
  const KICI_HOOK_MARKER = "# KiCI: compile workflows on commit";
package/dist/index.d.ts CHANGED
@@ -3,8 +3,8 @@ export type { ExecutionResult } from './execution/index.js';
3
3
  export { validateConfig } from './validation/index.js';
4
4
  export type { ValidationResult } from './validation/index.js';
5
5
  export { generateLockFile, serializeLockFile } from './lockfile/index.js';
6
- export { SCHEMA_VERSION, isLockStaticJob } from './types.js';
7
- export type { LockFile, LockWorkflow, LockJob, LockDynamicJobFn, LockJobOrFactory, LockTrigger, LockPrTrigger, LockPushTrigger, LockMatrix, LockRule, LockStep, LockApproval, LockSource, LockBranchPattern, } from './types.js';
6
+ export { SCHEMA_VERSION, isLockStaticJob, isLockParallelStep } from './types.js';
7
+ export type { LockFile, LockWorkflow, LockJob, LockDynamicJobFn, LockJobOrFactory, LockTrigger, LockPrTrigger, LockPushTrigger, LockMatrix, LockRule, LockStep, LockParallelStep, LockStepEntry, LockApproval, LockSource, LockBranchPattern, } from './types.js';
8
8
  export { formatError, compilerError, isCompilerError } from './errors/index.js';
9
9
  export type { SourceLocation, CompilerError } from './errors/index.js';
10
10
  export { CapabilityGapError, formatCapabilityGapError } from './errors/index.js';
package/dist/index.js CHANGED
@@ -1,4 +1,4 @@
1
- import "./chunk-BTugEXQM.js";
1
+ import "./rolldown-runtime-ClRpJifh.js";
2
2
  import { compilerError, formatError, isCompilerError } from "./errors/formatter.js";
3
3
  import { CapabilityGapError, formatCapabilityGapError } from "./errors/capability-gap.js";
4
4
  import "./errors/index.js";
@@ -6,7 +6,7 @@ import { executeConfig } from "./execution/executor.js";
6
6
  import "./execution/index.js";
7
7
  import { validateConfig } from "./validation/validator.js";
8
8
  import "./validation/index.js";
9
- import { SCHEMA_VERSION, isLockStaticJob } from "./types.js";
9
+ import { SCHEMA_VERSION, isLockParallelStep, isLockStaticJob } from "./types.js";
10
10
  import { generateLockFile, serializeLockFile } from "./lockfile/generator.js";
11
11
  import "./lockfile/index.js";
12
- export { CapabilityGapError, SCHEMA_VERSION, compilerError, executeConfig, formatCapabilityGapError, formatError, generateLockFile, isCompilerError, isLockStaticJob, serializeLockFile, validateConfig };
12
+ export { CapabilityGapError, SCHEMA_VERSION, compilerError, executeConfig, formatCapabilityGapError, formatError, generateLockFile, isCompilerError, isLockParallelStep, isLockStaticJob, serializeLockFile, validateConfig };
@@ -376,7 +376,7 @@ Source: https://docs.kici.dev/architecture/data-flows/
376
376
 
377
377
  This document describes the key data flows through the KiCI architecture: webhook delivery, job execution, developer-initiated remote runs, dependency caching, re-run and cancel, trace ID propagation, internal event routing, and generic webhook ingestion.
378
378
 
379
- > **Lock file schema version:** The lock file uses schema version 21, which adds the `CheckMode` / `CheckStepOutcome` enums for check-mode step execution on top of v20's `LabelMatcher` (exact/regex) selectors for `runsOn`/`runsOnAll`/`excludeLabels`, v19's `maxParallel`/`failFast` fan-out concurrency, v18's `runsOnAll` host fan-out predicate and `onUnreachable` policy, v17's typed init presets (`mise` / `{ mise }`) and `auto` detection, v16's normalized approval config, v15's per-job init config, v14's declarative cache specs, v11's `LockInlineValue` for pure function inline evaluation, v10's simplified negative patterns (! prefix in repos/paths arrays), v9's global workflow repos matching, and v8's runsOn polymorphic type support.
379
+ > **Lock file schema version:** The lock file uses schema version 29. The orchestrator rejects any fetched lock whose `schemaVersion` does not exactly match the engine version it was built against, so a stale lock must be recompiled with `kici compile` and pushed again after any SDK upgrade that bumps the schema.
380
380
 
381
381
  ## Webhook delivery flow
382
382
 
@@ -582,7 +582,7 @@ Dep cache misses alone do **not** trigger a build job. Deps are platform-specifi
582
582
 
583
583
  ### Cross-source / no-contentHash workflows
584
584
 
585
- - **Lock files without `contentHash`** (schema v1) skip the source cache entirely; agents compile from source. Regenerate lock files with `kici compile` to enable caching. The current lock file schema version is 21.
585
+ - **Lock files without `contentHash`** (schema v1) skip the source cache entirely; agents compile from source. Regenerate lock files with `kici compile` to enable caching. The current lock file schema version is 29.
586
586
  - **Cross-source / global-workflow dispatch** (a workflow registered against source A fired by a webhook on source B) bypasses both caches. The registration's lock file entry still carries `contentHash`, but the cross-source path always clone-and-installs — the eval temp dir doesn't ship `@kici-dev/sdk`. The execution agent still verifies `contentHash` against the cloned source for drift detection.
587
587
 
588
588
  ### Build deduplication
@@ -1150,7 +1150,7 @@ The compiler processes the workflow definition:
1150
1150
 
1151
1151
  ### Execution time (local test runner)
1152
1152
 
1153
- When `kici test` runs a workflow:
1153
+ When `kici run local` runs a workflow:
1154
1154
 
1155
1155
  1. **SDK module resolution:** The runner resolves `setStepOutputsMap` / `setJobOutputsMap` from the same `@kici-dev/sdk` module instance that the workflow uses (ensures the proxy reads from the same map)
1156
1156
  2. **Map injection:** Fresh `OutputsMap` and `StepRefMap` are created and injected via `setStepOutputsMap()` / `setStepRefMap()` before each job
@@ -1260,7 +1260,7 @@ flowchart LR
1260
1260
 
1261
1261
  **Why three tiers?** Trust boundaries. The Platform relay never sees customer code -- it only verifies webhook signatures and forwards payloads. The orchestrator matches triggers against the lock file without cloning repositories. Only the agent, running on customer infrastructure, clones code and executes steps.
1262
1262
 
1263
- This model also enables fully self-hosted deployment: all three tiers can run on customer infrastructure, with the Platform tier receiving webhooks directly from GitHub.
1263
+ This model also supports an independent deployment without the hosted Platform: the orchestrator and agent run on customer infrastructure, with the orchestrator receiving webhooks directly from GitHub instead of through the Platform relay.
1264
1264
 
1265
1265
  ## Component responsibilities
1266
1266