@kici-dev/compiler 0.1.23 → 0.1.25

package/dist/lockfile/hash-files.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
 import fg from "fast-glob";

package/dist/lockfile/hasher.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { normalizeLineEndings, sha256 } from "@kici-dev/core";
 //#region src/lockfile/hasher.ts
 /**

package/dist/lockfile/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { COMPILE_SCHEMA_VERSION, computeContentHash } from "./hasher.js";
 import { computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile } from "./generator.js";
 export { COMPILE_SCHEMA_VERSION, computeContentHash, computeLockfileHash, detectGitRoot, generateLockFile, serializeLockFile };

package/dist/lockfile/purity-analyzer.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import ts from "typescript";
 //#region src/lockfile/purity-analyzer.ts
 /**
@@ -16,7 +16,7 @@ import ts from "typescript";
 * Safe globals that pure functions are allowed to reference.
 * These are deterministic, side-effect-free built-ins.
 */
-const SAFE_GLOBALS = new Set([
+const SAFE_GLOBALS = /* @__PURE__ */ new Set([
 	"undefined",
 	"null",
 	"true",
@@ -42,7 +42,7 @@ const SAFE_GLOBALS = new Set([
 /**
 * Assignment operators that indicate mutation.
 */
-const ASSIGNMENT_OPERATORS = new Set([
+const ASSIGNMENT_OPERATORS = /* @__PURE__ */ new Set([
 	ts.SyntaxKind.EqualsToken,
 	ts.SyntaxKind.PlusEqualsToken,
 	ts.SyntaxKind.MinusEqualsToken,

package/dist/postinstall.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";

package/dist/provenance-trust-root.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { readFile } from "node:fs/promises";
 //#region src/provenance-trust-root.ts
 /**

package/dist/remote/config.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 import os from "node:os";

package/dist/remote/dashboard-client.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "./config.js";
 import { dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, registrationItemSchema, runListItemSchema, runListResponseSchema } from "@kici-dev/engine";
 import { z } from "zod";

package/dist/remote/encryption.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import fs from "node:fs/promises";
 import { deriveSharedSecret } from "@kici-dev/core";
 import crypto from "node:crypto";

package/dist/remote/history.d.ts

@@ -2,7 +2,7 @@
  * Local run history manager.
  *
  * Persists test run history in ~/.kici/history/runs.json so developers
- * can review past runs (kici test --history) and inspect specific runs
+ * can review past runs (kici run remote --history) and inspect specific runs
  * (kici status <run-id>).
  */
 /** Status of a test run */

package/dist/remote/history.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { formatRelativeTime } from "../format.js";
 import { getConfigDir } from "./config.js";
 import path from "node:path";
@@ -11,7 +11,7 @@ import picomatch from "picomatch";
 * Local run history manager.
 *
 * Persists test run history in ~/.kici/history/runs.json so developers
-* can review past runs (kici test --history) and inspect specific runs
+* can review past runs (kici run remote --history) and inspect specific runs
 * (kici status <run-id>).
 */
 /** Maximum number of entries to keep in history */

package/dist/remote/local-repo-identity.d.ts

@@ -0,0 +1,32 @@
+import { z } from 'zod';
+/** Git hosts whose origin URL we can turn into a real `owner/repo` + web link. */
+export declare const RecognizedProvider: z.ZodEnum<{
+    github: "github";
+    gitlab: "gitlab";
+    bitbucket: "bitbucket";
+}>;
+export type RecognizedProvider = z.infer<typeof RecognizedProvider>;
+/** The literal provider value stamped when no recognized git origin exists. */
+export declare const LOCAL_PROVIDER = "local";
+/**
+ * Parse a git remote URL into `{ provider, owner/repo }` for a recognized host.
+ * Handles scp-style ssh (`git@host:owner/repo.git`), `ssh://`, and `https://`
+ * forms; strips a trailing `.git`. Returns null for any unrecognized host or
+ * unparseable input.
+ */
+export declare function parseGitOrigin(url: string): {
+    provider: RecognizedProvider;
+    repoIdentifier: string;
+} | null;
+/** Read the `origin` remote URL of the working tree at `repoRoot`, or null. */
+export declare function detectGitOrigin(repoRoot: string): string | null;
+/**
+ * Build the repo identity stamped on a `kici run remote` run. A recognized git
+ * origin yields the real `owner/repo` + provider so the dashboard can link to
+ * it; otherwise a synthetic `local/<basename>` identity with provider `local`.
+ */
+export declare function buildLocalRepoIdentity(repoRoot: string): {
+    repoIdentifier: string;
+    provider: string;
+};
+//# sourceMappingURL=local-repo-identity.d.ts.map

package/dist/remote/local-repo-identity.js

@@ -0,0 +1,74 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import path from "node:path";
+import { execSync } from "node:child_process";
+import { z } from "zod";
+//#region src/remote/local-repo-identity.ts
+/** Git hosts whose origin URL we can turn into a real `owner/repo` + web link. */
+const RecognizedProvider = z.enum([
+	"github",
+	"gitlab",
+	"bitbucket"
+]);
+/** Host → provider map. The keys are the canonical public hostnames. */
+const HOST_PROVIDER = {
+	"github.com": "github",
+	"gitlab.com": "gitlab",
+	"bitbucket.org": "bitbucket"
+};
+/** The literal provider value stamped when no recognized git origin exists. */
+const LOCAL_PROVIDER = "local";
+/**
+* Parse a git remote URL into `{ provider, owner/repo }` for a recognized host.
+* Handles scp-style ssh (`git@host:owner/repo.git`), `ssh://`, and `https://`
+* forms; strips a trailing `.git`. Returns null for any unrecognized host or
+* unparseable input.
+*/
+function parseGitOrigin(url) {
+	const trimmed = url.trim();
+	const scp = /^[^@]+@([^:]+):(.+?)(?:\.git)?$/.exec(trimmed);
+	const urlStyle = /^[a-z]+:\/\/(?:[^@/]+@)?([^/]+)\/(.+?)(?:\.git)?$/.exec(trimmed);
+	const match = scp ?? urlStyle;
+	if (!match) return null;
+	const provider = HOST_PROVIDER[match[1].toLowerCase()];
+	if (!provider) return null;
+	const repoIdentifier = match[2].replace(/^\/+|\/+$/g, "");
+	if (!repoIdentifier.includes("/")) return null;
+	return {
+		provider,
+		repoIdentifier
+	};
+}
+/** Read the `origin` remote URL of the working tree at `repoRoot`, or null. */
+function detectGitOrigin(repoRoot) {
+	try {
+		return execSync("git remote get-url origin", {
+			cwd: repoRoot,
+			encoding: "utf-8",
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+/**
+* Build the repo identity stamped on a `kici run remote` run. A recognized git
+* origin yields the real `owner/repo` + provider so the dashboard can link to
+* it; otherwise a synthetic `local/<basename>` identity with provider `local`.
+*/
+function buildLocalRepoIdentity(repoRoot) {
+	const origin = detectGitOrigin(repoRoot);
+	const parsed = origin ? parseGitOrigin(origin) : null;
+	if (parsed) return parsed;
+	return {
+		repoIdentifier: `local/${path.basename(repoRoot)}`,
+		provider: LOCAL_PROVIDER
+	};
+}
+//#endregion
+export { LOCAL_PROVIDER, RecognizedProvider, buildLocalRepoIdentity, detectGitOrigin, parseGitOrigin };
+
+//# sourceMappingURL=local-repo-identity.js.map

package/dist/remote/oauth.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { discoverOidcEndpoints } from "./oidc-discovery.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";

package/dist/remote/oidc-discovery.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/remote/oidc-discovery.ts
 const cache = /* @__PURE__ */ new Map();

package/dist/remote/output/json.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 //#region src/remote/output/json.ts
 /**
 * Format run results as structured JSON with 2-space indentation.

package/dist/remote/output/junit.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 //#region src/remote/output/junit.ts
 /**
 * Format run results as JUnit XML following the standard schema.

package/dist/remote/output/streaming.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { formatDuration } from "@kici-dev/core";
 //#region src/remote/output/streaming.ts

package/dist/remote/output/summary.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { formatDuration } from "@kici-dev/core";
 //#region src/remote/output/summary.ts

package/dist/remote/platform-client.d.ts

@@ -94,6 +94,8 @@ export interface PlatformTriggerResponse {
     status: 'accepted' | 'rejected';
     reason?: string;
     jobIds?: string[];
+    /** User-visible warnings on acceptance (e.g. skipped non-test bound environments). */
+    warnings?: string[];
 }
 export interface PlatformRunStatusResponse {
     runId: string;

package/dist/remote/platform-client.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/remote/platform-client.ts
 /**

package/dist/remote/prod-defaults.d.ts

@@ -3,7 +3,7 @@
  * env var (or the `--platform-endpoint` flag) is unset, login resolves
  * these so a developer targeting the hosted KiCI Platform authenticates
  * with no setup. Setting the env var overrides the default — staging E2E
- * and self-hosted Platforms depend on that override path.
+ * and other KiCI environments depend on that override path.
  *
  * Resolution is login-local: these are read into locals in `oauthLogin`,
  * never written back into `process.env`, so the orchestrator's separate
@@ -15,4 +15,12 @@ export declare const PROD_PLATFORM_URL = "https://api.kici.dev";
 export declare const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
 /** Public OIDC client id registered for the `kici` CLI. */
 export declare const PROD_OIDC_CLIENT_ID = "kici-cli";
+/**
+ * Provenance trust root for `kici verify-attestation` when `--trust-root` is
+ * omitted: the hosted KiCI Platform's provenance issuer. The verifier appends
+ * `/.well-known/openid-configuration` and pins the token issuer to it. Pass
+ * `--trust-root` to verify against a different environment (e.g. staging) or an
+ * offline `{ issuer, jwks }` file.
+ */
+export declare const PROD_PROVENANCE_ISSUER = "https://api.kici.dev";
 //# sourceMappingURL=prod-defaults.d.ts.map

package/dist/remote/prod-defaults.js

@@ -1,11 +1,11 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/remote/prod-defaults.ts
 /**
 * Production defaults for the `kici login` OAuth flow. When the matching
 * env var (or the `--platform-endpoint` flag) is unset, login resolves
 * these so a developer targeting the hosted KiCI Platform authenticates
 * with no setup. Setting the env var overrides the default — staging E2E
-* and self-hosted Platforms depend on that override path.
+* and other KiCI environments depend on that override path.
 *
 * Resolution is login-local: these are read into locals in `oauthLogin`,
 * never written back into `process.env`, so the orchestrator's separate
@@ -17,7 +17,15 @@ const PROD_PLATFORM_URL = "https://api.kici.dev";
 const PROD_OIDC_ISSUER = "https://auth.kici.dev/realms/kici-internal";
 /** Public OIDC client id registered for the `kici` CLI. */
 const PROD_OIDC_CLIENT_ID = "kici-cli";
+/**
+* Provenance trust root for `kici verify-attestation` when `--trust-root` is
+* omitted: the hosted KiCI Platform's provenance issuer. The verifier appends
+* `/.well-known/openid-configuration` and pins the token issuer to it. Pass
+* `--trust-root` to verify against a different environment (e.g. staging) or an
+* offline `{ issuer, jwks }` file.
+*/
+const PROD_PROVENANCE_ISSUER = "https://api.kici.dev";
 //#endregion
-export { PROD_OIDC_CLIENT_ID, PROD_OIDC_ISSUER, PROD_PLATFORM_URL };
+export { PROD_OIDC_CLIENT_ID, PROD_OIDC_ISSUER, PROD_PLATFORM_URL, PROD_PROVENANCE_ISSUER };
 
 //# sourceMappingURL=prod-defaults.js.map

package/dist/remote/render.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { formatDuration } from "@kici-dev/core";
 //#region src/remote/render.ts

package/dist/remote/secret-upload.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadLocalSecrets } from "../local-executor/secret-loader.js";
 import { encryptJson } from "@kici-dev/core";
 //#region src/remote/secret-upload.ts

package/dist/remote/uploader.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { encryptTarball } from "./encryption.js";
 import path from "node:path";
 import fs from "node:fs/promises";
@@ -113,7 +113,7 @@ async function selectOverlayFiles(repoRoot, options) {
 		const unstaged = gitLines("git diff --name-only HEAD", repoRoot);
 		const staged = gitLines("git diff --name-only --cached HEAD", repoRoot);
 		const untracked = gitLines("git ls-files --others --exclude-standard", repoRoot);
-		allFiles = [...new Set([
+		allFiles = [.../* @__PURE__ */ new Set([
 			...unstaged,
 			...staged,
 			...untracked
@@ -121,13 +121,13 @@ async function selectOverlayFiles(repoRoot, options) {
 	} else {
 		const tracked = gitLines("git ls-files", repoRoot);
 		const untracked = gitLines("git ls-files --others --exclude-standard", repoRoot);
-		allFiles = [...new Set([...tracked, ...untracked])];
+		allFiles = [.../* @__PURE__ */ new Set([...tracked, ...untracked])];
 	}
 	const kiciIgnore = await loadKiciIgnore(options?.kiciIgnorePath ?? path.join(repoRoot, ".kiciignore"));
 	if (kiciIgnore) allFiles = allFiles.filter((f) => !kiciIgnore(f));
 	if (options?.fullWorkingTree) {
 		const gitFiles = await collectGitDirFiles(repoRoot);
-		allFiles = [...new Set([...allFiles, ...gitFiles])];
+		allFiles = [.../* @__PURE__ */ new Set([...allFiles, ...gitFiles])];
 	}
 	const existingFiles = [];
 	const deletedFiles = [];

package/dist/{chunk-BTugEXQM.js → rolldown-runtime-ClRpJifh.js}

@@ -1,4 +1,3 @@
 import "node:module";
-import.meta.url;
 //#endregion
 export {};

package/dist/templates/agents-md.d.ts

@@ -4,5 +4,5 @@
  * picked up by Claude Code, Cursor, Aider, and other coding agents that scan
  * the working tree for an authoring context file.
  */
-export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici test pr:open --debug`| Preview which workflows match an event.     |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici test <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
+export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici preview pr:open --debug` | Preview which workflows match an event.   |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici preview <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
 //# sourceMappingURL=agents-md.d.ts.map

package/dist/templates/agents-md.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/templates/agents-md.ts
 /**
 * Template body for .kici/AGENTS.md, written by `kici init` (unless opted out
@@ -112,7 +112,7 @@ into a portable lock file, and executed by self-hosted agents.
 | Command                         | Purpose                                     |
 | ------------------------------- | ------------------------------------------- |
 | \`pnpm kici compile --check\`     | Validate workflow source without writing.   |
-| \`pnpm kici test pr:open --debug\`| Preview which workflows match an event.     |
+| \`pnpm kici preview pr:open --debug\` | Preview which workflows match an event.   |
 | \`pnpm kici run local push\`      | Execute workflows locally with no orchestrator. |
 | \`pnpm kici docs llm\`            | Print the full LLM documentation bundle.    |
 | \`pnpm kici docs llm --index\`    | Print the curated link index.               |
@@ -126,7 +126,7 @@ If \`pnpm kici\` isn't in scripts, fall back to \`npx kici\`.
    the full bundle.
 3. Edit a workflow under \`.kici/workflows/\`.
 4. Run \`kici compile --check\` (zero exit means valid).
-5. Run \`kici test <event>\` to preview matching.
+5. Run \`kici preview <event>\` to preview matching.
 6. Run \`kici run local <event>\` to execute locally before pushing.
 `;
 //#endregion

package/dist/templates/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { agentsMdTemplate } from "./agents-md.js";
 import { helloWorldWorkflow } from "./workflows/hello-world.js";
 import { prChecksWorkflow } from "./workflows/pr-checks.js";

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.23";
+const sdkVersion = "0.1.25";
 /**
 * Generate package.json content for .kici/ directory
 *

package/dist/templates/tsconfig-json.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/templates/tsconfig-json.ts
 /**
 * tsconfig.json template for kici init command

package/dist/templates/workflows/hello-world.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { job, push, step, workflow } from "@kici-dev/sdk";
 //#region src/templates/workflows/hello-world.ts
 const helloWorldWorkflow = workflow("hello-world", {

package/dist/templates/workflows/pr-checks.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { isEventType, job, pr, rule, skip, step, workflow } from "@kici-dev/sdk";
 //#region src/templates/workflows/pr-checks.ts
 const prChecksWorkflow = workflow("pr-checks", {

package/dist/test-runner/dry-run.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/dry-run.ts

package/dist/test-runner/event-types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/test-runner/event-types.ts
 /**
 * Parse CLI event argument to EventType.

package/dist/test-runner/git-detector.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 //#region src/test-runner/git-detector.ts

package/dist/test-runner/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { displayDryRun } from "./dry-run.js";
 import { parseEventArg, triggerSummary, triggerToEventArg } from "./event-types.js";
 import { detectRepoFromGit } from "./git-detector.js";

package/dist/test-runner/job-executor.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { formatter } from "./output-formatter.js";
 import { createStepContext } from "./step-context.js";
 import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "./rule-evaluator.js";

package/dist/test-runner/output-formatter.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/output-formatter.ts

package/dist/test-runner/payload-builder.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { parseEventArg } from "./event-types.js";
 import { detectRepoFromGit } from "./git-detector.js";
 import { getDefaultFixture } from "../fixtures/defaults/index.js";

package/dist/test-runner/rule-evaluator.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { formatter } from "./output-formatter.js";
 import { evaluateRules } from "@kici-dev/sdk";
 import { initZx } from "@kici-dev/core";

package/dist/test-runner/secrets-file.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 //#region src/test-runner/secrets-file.ts

package/dist/test-runner/step-context.d.ts

@@ -11,5 +11,5 @@ import type { StepContext, WorkflowInfo, JobInfo, MatrixValues } from '@kici-dev
 export declare function createStepContext(workflowInfo: WorkflowInfo, jobInfo: JobInfo, repoRoot: string, inputs?: Record<string, unknown>, matrix?: MatrixValues, testSecrets?: {
     flat: Record<string, string>;
     contexts: Record<string, Record<string, string>>;
-}, environment?: string, rawPayload?: Record<string, unknown>, provider?: string, dispatchInputs?: Readonly<Record<string, string | number | boolean | null>>): StepContext;
+}, environment?: string, rawPayload?: Record<string, unknown>, provider?: string, dispatchInputs?: Readonly<Record<string, string | number | boolean | null>>, signal?: AbortSignal): StepContext;
 //# sourceMappingURL=step-context.d.ts.map

package/dist/test-runner/step-context.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { formatter } from "./output-formatter.js";
 import { join } from "node:path";
 import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
@@ -42,7 +42,7 @@ function createTestLogger(jobName) {
 * `ctx.$` would inherit `process.cwd()` — i.e. wherever the user invoked
 * `kici` — which silently breaks any step that uses relative paths.
 */
-function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix, testSecrets, environment, rawPayload, provider, dispatchInputs = {}) {
+function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix, testSecrets, environment, rawPayload, provider, dispatchInputs = {}, signal = new AbortController().signal) {
 	const flat = testSecrets?.flat ?? {};
 	const namespacedSecrets = testSecrets?.contexts ?? {};
 	const mergedFlat = { ...flat };
@@ -99,6 +99,7 @@ function createStepContext(workflowInfo, jobInfo, repoRoot, inputs = {}, matrix,
 	return {
 		$: scoped$,
 		log: createTestLogger(jobInfo.name),
+		signal,
 		env,
 		setEnv: (key, value) => {
 			env[key] = value;