@kici-dev/compiler 0.1.24 → 0.1.25

package/dist/auth/headless-detect.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 //#region src/auth/headless-detect.ts
 /**
 * Detect if the current environment is headless (no browser available).

package/dist/cli-banner.js

@@ -1,4 +1,4 @@
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 //#region src/cli-banner.ts
 /**
 * Whether the version banner should be suppressed for the command about to run.

package/dist/cli.d.ts

@@ -1,5 +1,23 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+/**
+ * Top-level commands that were removed, mapped to their current equivalent.
+ * Consulted when the CLI hits an unknown command so the user gets a precise
+ * redirect instead of a bare "unknown command" dead end. The redirect text
+ * lives here once; every consumer reads it from this map.
+ */
+export declare const RETIRED_COMMANDS: Record<string, string>;
+/**
+ * Redirect message for a retired top-level command, or undefined if the name is
+ * not a known-retired command.
+ */
+export declare function retiredCommandHint(commandName: string | undefined): string | undefined;
+/**
+ * Derive the command name a user attempted from the parsed operands, falling
+ * back to the first non-option token in the raw argv. Used to look up a retired
+ * command after commander rejects an unknown command.
+ */
+export declare function attemptedCommand(program: Command, argv: string[]): string | undefined;
 /**
  * Build the kici Commander program with every command registered. Exported so
  * the surface registry can walk the real command tree without parsing argv (no

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./chunk-BTugEXQM.js";
+import "./rolldown-runtime-ClRpJifh.js";
 import { shouldSuppressBanner } from "./cli-banner.js";
 import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
@@ -7,7 +7,34 @@ import { realpathSync } from "node:fs";
 import { Argument, Command, Option } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.1.24";
+const version = "0.1.25";
+/**
+* Top-level commands that were removed, mapped to their current equivalent.
+* Consulted when the CLI hits an unknown command so the user gets a precise
+* redirect instead of a bare "unknown command" dead end. The redirect text
+* lives here once; every consumer reads it from this map.
+*/
+const RETIRED_COMMANDS = {
+	status: "`kici status` is no longer a command. Use `kici runs list` / `kici runs show <run-id>` to inspect runs, or `kici diagnostics` for orchestrator, scaler, and agent health.",
+	cancel: "`kici cancel` is no longer a command. Use `kici runs cancel <run-id>`."
+};
+/**
+* Redirect message for a retired top-level command, or undefined if the name is
+* not a known-retired command.
+*/
+function retiredCommandHint(commandName) {
+	return commandName ? RETIRED_COMMANDS[commandName] : void 0;
+}
+/**
+* Derive the command name a user attempted from the parsed operands, falling
+* back to the first non-option token in the raw argv. Used to look up a retired
+* command after commander rejects an unknown command.
+*/
+function attemptedCommand(program, argv) {
+	const firstOperand = program.args[0];
+	if (firstOperand) return firstOperand;
+	return argv.slice(2).find((token) => !token.startsWith("-"));
+}
 /**
 * Build the kici Commander program with every command registered. Exported so
 * the surface registry can walk the real command tree without parsing argv (no
@@ -23,6 +50,8 @@ function buildProgram() {
 	program.configureOutput({ outputError: (str, write) => {
 		write(pc.red(str));
 	} });
+	program.showSuggestionAfterError(true);
+	program.showHelpAfterError("(run `kici --help` to see all commands)");
 	program.command("compile").description("Compile workflows from .kici/workflows/ to kici.lock.json").option("--check", "Validate workflows without writing lock file", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--verbose", "Detailed output", false).option("--watch", "Watch for changes and recompile", false).action(async (options) => {
 		const { compileCommand, watchCommand } = await import("./commands/index.js");
 		if (options.watch) await watchCommand({
@@ -50,7 +79,8 @@ function buildProgram() {
 			process.exit(2);
 		}
 		if (!options.pick && !event) {
-			console.error("Error: missing event argument. Pass an event or use --pick.");
+			const { printRunLocalUsage } = await import("./commands/index.js");
+			printRunLocalUsage();
 			process.exit(2);
 		}
 		const { runLocalCommand } = await import("./commands/index.js");
@@ -90,7 +120,7 @@ function buildProgram() {
 		});
 		process.exit(success ? 0 : 1);
 	});
-	runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("-p, --pick", "Interactively pick fixtures to run", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--org <id>", "Target organization (overrides the active org)").option("--orchestrator <name>", "Target orchestrator cluster (overrides the per-org default)").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).option("--check", "Run in check mode: report drift, change nothing", false).option("--fail-on-drift", "In check mode, exit non-zero if any step reports drift", false).option("--target <selector>", "Narrow runsOnAll jobs to hosts matching this label selector (repeatable, AND-combined)", (val, prev) => [...prev, val], []).option("--target-allow-empty", "A --target that narrows a runsOnAll job to zero hosts skips it instead of failing", false).option("--input <KEY=VALUE>", "Typed workflow-dispatch input (repeatable)", (val, prev) => [...prev, val], []).option("--approve-all, --yes", "Auto-approve every approval gate this run holds on (run-scoped; eligibility still enforced)", false).action(async (fixture, options) => {
+	runCommand.command("remote").argument("[fixture]", "Fixture name or glob pattern (omit to list available)").description("Execute fixtures remotely via orchestrator").option("--workflow <name>", "Run a specific workflow directly (bypass triggers)").option("--all", "Run all available fixtures", false).option("-p, --pick", "Interactively pick fixtures to run", false).option("--parallel", "Run matching fixtures concurrently", false).option("--no-wait", "Fire and forget (print runIds, don't stream)").option("--quiet", "Suppress output except final result", false).option("--json", "Output structured JSON result", false).option("--junit <path>", "Output JUnit XML result").option("--history", "Show recent run history", false).option("--routing-key <key>", "Override routing key for this run").option("--org <id>", "Target organization (overrides the active org)").option("--orchestrator <name>", "Target orchestrator cluster (overrides the per-org default)").option("--debug", "Verbose internals", false).option("--kici-dir <path>", "Path to .kici directory", ".kici").option("--context <ctx.key=value>", "Inject a namespaced context secret, uploaded encrypted to the orchestrator (repeatable)", (val, prev) => [...prev, val], []).option("--env <KEY=VALUE>", "Provide a per-run secret (repeatable); uploaded encrypted to the orchestrator", (val, prev) => [...prev, val], []).option("--check", "Run in check mode: report drift, change nothing", false).option("--fail-on-drift", "In check mode, exit non-zero if any step reports drift", false).option("--target <selector>", "Narrow runsOnAll jobs to hosts matching this label selector (repeatable, AND-combined)", (val, prev) => [...prev, val], []).option("--target-allow-empty", "A --target that narrows a runsOnAll job to zero hosts skips it instead of failing", false).option("--input <KEY=VALUE>", "Typed workflow-dispatch input (repeatable)", (val, prev) => [...prev, val], []).option("--yes, --approve-all", "Auto-approve every approval gate this run holds on (run-scoped; eligibility still enforced)", false).action(async (fixture, options) => {
 		if (options.pick && fixture) {
 			console.error("Error: --pick selects fixtures interactively; do not also pass a fixture name.");
 			process.exit(2);
@@ -312,9 +342,30 @@ Environment variables:
 	});
 	return program;
 }
+/**
+* Handle a commander parse exit thrown under `exitOverride`. Help and version
+* requests exit cleanly; an unknown command is augmented with a retired-command
+* redirect when one applies (commander already wrote the generic error,
+* suggestion, and help pointer before throwing); every other parse error keeps
+* commander's own exit code and already-printed message.
+*/
+function handleCliParseExit(err, argv, program) {
+	if (err.code === "commander.helpDisplayed" || err.code === "commander.version") process.exit(0);
+	if (err.code === "commander.unknownCommand") {
+		const hint = retiredCommandHint(attemptedCommand(program, argv));
+		if (hint) process.stderr.write(pc.red(`${hint}\n`));
+	}
+	process.exit(err.exitCode ?? 1);
+}
 /** Build the program and parse argv — the bin-shim entry point. */
 function runCli(argv = process.argv) {
-	buildProgram().parse(argv);
+	const program = buildProgram();
+	program.exitOverride();
+	try {
+		program.parse(argv);
+	} catch (err) {
+		handleCliParseExit(err, argv, program);
+	}
 }
 /**
 * Decide whether this module is the process entry point, tolerating a
@@ -340,6 +391,6 @@ function isMainEntryPoint(argv1, importMetaUrl) {
 }
 if (isMainEntryPoint(process.argv[1], import.meta.url)) runCli();
 //#endregion
-export { buildProgram, isMainEntryPoint, runCli };
+export { RETIRED_COMMANDS, attemptedCommand, buildProgram, isMainEntryPoint, retiredCommandHint, runCli };
 
 //# sourceMappingURL=cli.js.map

package/dist/commands/approve.js

@@ -1,8 +1,8 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { listHeldRunsForRun, postApprove, resolveHeldRunContext } from "./held-run-client.js";
-import { resolveHeldRunId } from "./held-run-resolve.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
+import { resolveHeldRunId } from "@kici-dev/engine";
 //#region src/commands/approve.ts
 /**
 * kici approve command

package/dist/commands/check-mode.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { CheckMode } from "@kici-dev/engine";
 //#region src/commands/check-mode.ts
 /**

package/dist/commands/compile.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { formatError, isCompilerError } from "../errors/formatter.js";
 import "../errors/index.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";

package/dist/commands/diagnostics.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import { relativeTime } from "../remote/render.js";
 import pc from "picocolors";

package/dist/commands/docs.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import pc from "picocolors";

package/dist/commands/drain-worker.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/drain-worker.ts

package/dist/commands/endpoints.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { loadGlobalConfig } from "../remote/config.js";

package/dist/commands/fixture.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { detectRepoFromGit } from "../test-runner/git-detector.js";
 import { getDefaultFixture } from "../fixtures/defaults/index.js";
@@ -13,7 +13,7 @@ import { logger } from "@kici-dev/core";
 * including internal events (schedule, lifecycle, generic_webhook, kici_event).
 */
 /** Internal event types that don't have GitHub webhook fixture files */
-const INTERNAL_EVENT_TYPES = new Set([
+const INTERNAL_EVENT_TYPES = /* @__PURE__ */ new Set([
 	"kici_event",
 	"workflow_complete",
 	"job_complete",

package/dist/commands/held-run-client.d.ts

@@ -5,7 +5,7 @@
  * exposes thin list / approve / reject helpers against the Platform dashboard
  * API.
  */
-import type { HeldRunSummary } from './held-run-resolve.js';
+import type { HeldRunSummary } from '@kici-dev/engine';
 /** Resolved auth context for a held-run command. */
 export interface HeldRunContext {
     endpoint: string;

package/dist/commands/held-run-client.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";

package/dist/commands/hook.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { detectHookTools, findGitDir } from "../hooks/detector.js";
 import { installHook } from "../hooks/installer.js";
 import "../hooks/index.js";

package/dist/commands/index.d.ts

@@ -5,7 +5,7 @@ export { fixtureCommand } from './fixture.js';
 export type { FixtureOptions } from './fixture.js';
 export { previewCommand, previewEvent } from './preview.js';
 export type { PreviewOptions, RemoteRunOptions, RemoteRunResult } from './preview.js';
-export { runLocalCommand, runRemoteCommand } from './run.js';
+export { runLocalCommand, runRemoteCommand, printRunLocalUsage } from './run.js';
 export { initCommand } from './init.js';
 export type { InitOptions } from './init.js';
 export { hookInstallCommand } from './hook.js';

package/dist/commands/index.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { compileCommand } from "./compile.js";
 import { approveCommand } from "./approve.js";
 import { diagnosticsCommand } from "./diagnostics.js";
@@ -9,7 +9,7 @@ import { fixtureCommand } from "./fixture.js";
 import { hookInstallCommand } from "./hook.js";
 import { watchCommand } from "./watch.js";
 import { previewCommand, previewEvent } from "./preview.js";
-import { runLocalCommand, runRemoteCommand } from "./run.js";
+import { printRunLocalUsage, runLocalCommand, runRemoteCommand } from "./run.js";
 import { initCommand } from "./init.js";
 import { loginCommand } from "./login.js";
 import { secretsListCommand } from "./secrets-list.js";
@@ -26,4 +26,4 @@ import { logoutCommand } from "./logout.js";
 import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
 import { verifyAttestationCommand } from "./verify-attestation.js";
-export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, runLocalCommand, runRemoteCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };
+export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, printRunLocalUsage, rejectCommand, runLocalCommand, runRemoteCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { agentsMdTemplate } from "../templates/agents-md.js";
 import { tsconfigTemplate } from "../templates/tsconfig-json.js";
 import { generatePackageJson } from "../templates/package-json.js";

package/dist/commands/login.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { getConfigPath, loadGlobalConfig, mergeGlobalConfig, saveGlobalConfig } from "../remote/config.js";
 import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
 import "../remote/prod-defaults.js";

package/dist/commands/logout.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { getConfigPath, loadGlobalConfig, saveGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/logout.ts

package/dist/commands/orchestrators.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig, mergeGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/orchestrators.ts

package/dist/commands/org.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig, mergeGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/org.ts

package/dist/commands/pat.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";

package/dist/commands/preview.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";

package/dist/commands/reject.js

@@ -1,8 +1,8 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { listHeldRunsForRun, postReject, resolveHeldRunContext } from "./held-run-client.js";
-import { resolveHeldRunId } from "./held-run-resolve.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
+import { resolveHeldRunId } from "@kici-dev/engine";
 //#region src/commands/reject.ts
 /**
 * kici reject command

package/dist/commands/run-hold-watch.d.ts

@@ -10,10 +10,13 @@
  * path as `kici approve` / `kici reject`. In a non-TTY it prints guidance and
  * keeps polling (the run stays held until resolved out-of-band).
  */
-import type { HeldRunSummary } from './held-run-resolve.js';
+import type { HeldRunSummary } from '@kici-dev/engine';
 import { type HeldRunContext } from './held-run-client.js';
 /** A yes/no prompt; injected so the poll branch is unit-testable. */
 export type ConfirmPrompt = (message: string) => Promise<boolean>;
+/** Where hold/approve text is written. Injected so callers can route it to
+ *  stderr in quiet/json mode (keeping stdout a pure JSON channel). */
+export type HoldOutput = (line: string) => void;
 /** What to do with a newly-observed hold. Pure — no IO. */
 export type HoldAction = {
     kind: 'prompt';
@@ -48,6 +51,12 @@ export declare function handleNewHolds(args: {
      * audits it distinctly. Eligibility is still enforced server-side.
      */
     approveAll?: boolean;
+    /**
+     * Where hold/approve text goes. Defaults to `logger.info` (stdout). Quiet /
+     * `--json` callers pass a stderr sink so the machine-readable stdout payload
+     * stays pure.
+     */
+    output?: HoldOutput;
     /** Override for tests; defaults to the shared Platform held-run context. */
     resolveContext?: () => Promise<HeldRunContext | null>;
     /** Override for tests. */

package/dist/commands/run-hold-watch.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { postApprove, postReject, resolveHeldRunContext } from "./held-run-client.js";
 import pc from "picocolors";
 import { logger } from "@kici-dev/core";
@@ -37,14 +37,14 @@ function classifyNewHolds(holds, seen, isTty) {
 		seen: next
 	};
 }
-/** Print a hold's identity + its drift payload (when present) to stdout. */
-function printHold(hold) {
+/** Print a hold's identity + its drift payload (when present) via `out`. */
+function printHold(hold, out) {
 	const scope = hold.holdScope ?? "job";
 	const where = scope === "step" && hold.stepIndex != null ? `step #${hold.stepIndex}${hold.jobId ? ` of job '${hold.jobId}'` : ""}` : hold.jobId ? `job '${hold.jobId}'` : scope;
-	logger.info(pc.yellow(`\n[kici] Run held for approval (${where}).`));
+	out(pc.yellow(`\n[kici] Run held for approval (${where}).`));
 	if (hold.payload?.summaryMarkdown) {
-		logger.info(pc.dim("Computed drift — review before approving:"));
-		for (const line of hold.payload.summaryMarkdown.split("\n")) logger.info(pc.dim(`    ${line}`));
+		out(pc.dim("Computed drift — review before approving:"));
+		for (const line of hold.payload.summaryMarkdown.split("\n")) out(pc.dim(`    ${line}`));
 	}
 }
 /**
@@ -56,28 +56,29 @@ function printHold(hold) {
 async function handleNewHolds(args) {
 	const { actions, seen } = classifyNewHolds(args.holds, args.seen, args.isTty);
 	if (actions.length === 0) return seen;
+	const out = args.output ?? ((line) => logger.info(line));
 	const resolveCtx = args.resolveContext ?? resolveHeldRunContext;
 	const doApprove = args.approve ?? postApprove;
 	const doReject = args.reject ?? postReject;
 	let ctx = null;
-	if (args.approveAll) logger.info(pc.yellow("[kici] --approve-all: auto-approving every gate for this run (eligibility enforced)."));
+	if (args.approveAll) out(pc.yellow("[kici] --approve-all: auto-approving every gate for this run (eligibility enforced)."));
 	for (const action of actions) {
-		printHold(action.hold);
+		printHold(action.hold, out);
 		ctx = ctx ?? await resolveCtx();
 		if (!ctx) {
-			logger.info(pc.dim(`Run held; approve via \`kici approve ${action.hold.runId}\`.`));
+			out(pc.dim(`Run held; approve via \`kici approve ${action.hold.runId}\`.`));
 			continue;
 		}
 		if (args.approveAll) {
-			if (await doApprove(ctx, action.hold.id, true)) logger.info(pc.green("[kici] Auto-approved."));
+			if (await doApprove(ctx, action.hold.id, true)) out(pc.green("[kici] Auto-approved."));
 			continue;
 		}
 		if (action.kind === "notify") {
-			logger.info(pc.dim(`Run held; approve via the dashboard or \`kici approve ${action.hold.runId}\`.`));
+			out(pc.dim(`Run held; approve via the dashboard or \`kici approve ${action.hold.runId}\`.`));
 			continue;
 		}
 		const approved = await args.confirm("Approve this gate?");
-		if (approved ? await doApprove(ctx, action.hold.id) : await doReject(ctx, action.hold.id, "rejected via kici run")) logger.info(approved ? pc.green("[kici] Approved.") : pc.red("[kici] Rejected."));
+		if (approved ? await doApprove(ctx, action.hold.id) : await doReject(ctx, action.hold.id, "rejected via kici run")) out(approved ? pc.green("[kici] Approved.") : pc.red("[kici] Rejected."));
 	}
 	return seen;
 }

package/dist/commands/run.d.ts

@@ -1,6 +1,15 @@
 import { type HostTargetSelector, type InputsDescriptorMap } from '@kici-dev/engine';
 import type { RunLocalOptions } from '../local-executor/types.js';
 import type { RemoteRunOptions } from './preview.js';
+/**
+ * Print a usage block for `kici run local` when the event argument is missing.
+ *
+ * Mirrors the discoverable help `kici preview` prints for a missing event: a
+ * bold synopsis line, a one-line description, and a few concrete event
+ * examples. The caller exits non-zero after printing — a missing event is a
+ * usage error, unlike `kici preview` which treats no-event as help.
+ */
+export declare function printRunLocalUsage(): void;
 /**
  * Compile `--target` selector strings into a {@link HostTargetSelector}. Each
  * string becomes one AND value (its own include set); repeated values

package/dist/commands/run.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { loadGlobalConfig } from "../remote/config.js";
@@ -24,8 +24,26 @@ import { coerceDispatchInputs, parseInputPairs } from "@kici-dev/engine";
 import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
 import { confirm } from "@inquirer/prompts";
 //#region src/commands/run.ts
+/**
+* Print a usage block for `kici run local` when the event argument is missing.
+*
+* Mirrors the discoverable help `kici preview` prints for a missing event: a
+* bold synopsis line, a one-line description, and a few concrete event
+* examples. The caller exits non-zero after printing — a missing event is a
+* usage error, unlike `kici preview` which treats no-event as help.
+*/
+function printRunLocalUsage() {
+	logger.info(pc.bold("\nUsage: kici run local <event> [options]\n"));
+	logger.info(pc.gray("Execute workflows locally for a given event, without orchestrator infrastructure.\n"));
+	logger.info(pc.gray("Examples:"));
+	logger.info(pc.gray("  kici run local push"));
+	logger.info(pc.gray("  kici run local pr:open"));
+	logger.info(pc.gray("  kici run local schedule"));
+	logger.info(pc.gray("  kici run local lifecycle:workflow_complete\n"));
+	logger.info(pc.gray("Or pick a workflow interactively: kici run local --pick\n"));
+}
 /** Terminal run statuses returned by the Platform run-status snapshot. */
-const TERMINAL_STATUSES = new Set([
+const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
 	"success",
 	"failed",
 	"cancelled",
@@ -420,7 +438,10 @@ async function runSingleFixture(fixture, ctx, options, config, history) {
 				reason: triggerResult.reason
 			};
 		}
-		if (!options.quiet) logger.info(pc.green(`Run started: ${triggerResult.runId}`));
+		if (!options.quiet) {
+			logger.info(pc.green(`Run started: ${triggerResult.runId}`));
+			for (const warning of triggerResult.warnings ?? []) logger.warn(pc.yellow(`⚠ ${warning}`));
+		}
 		await history.addEntry({
 			runId: triggerResult.runId,
 			fixtureId: fixture.id,
@@ -499,7 +520,7 @@ async function pollRunToCompletion(ctx, runId, fixtureId, options) {
 			lastStatus = await ctx.client.runStatus(ctx.orgId, runId, ctx.target);
 			const terminal = lastStatus.done || TERMINAL_STATUSES.has(lastStatus.status);
 			if (terminal && logs.done) return finishRun(fixtureId, runId, lastStatus, startTime, tailLines, options);
-			if (!terminal && !options.quiet) await watchRunHolds(runId, seenHolds, () => heldCtx, (c) => heldCtx = c, options);
+			if (!terminal) await watchRunHolds(runId, seenHolds, () => heldCtx, (c) => heldCtx = c, options);
 			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
 		}
 		return {
@@ -529,10 +550,12 @@ async function watchRunHolds(runId, seenHolds, getCtx, setCtx, options) {
 		if (!ctx) return;
 		const holds = await listHeldRunsForRun(ctx, runId);
 		if (holds.length === 0) return;
+		const quiet = Boolean(options.quiet);
 		await handleNewHolds({
 			holds,
 			seen: seenHolds,
-			isTty: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+			isTty: quiet ? false : Boolean(process.stdin.isTTY && process.stdout.isTTY),
+			output: quiet ? (line) => void process.stderr.write(line + "\n") : (line) => logger.info(line),
 			approveAll: Boolean(options.approveAll),
 			confirm: (message) => confirm({
 				message,
@@ -671,6 +694,6 @@ function displayRemoteResults(results) {
 	logger.info("");
 }
 //#endregion
-export { buildDispatchInputs, buildTargetSelector, lookupDispatchInputsDescriptor, runLocalCommand, runRemoteCommand, withStdoutOnStderr };
+export { buildDispatchInputs, buildTargetSelector, lookupDispatchInputsDescriptor, printRunLocalUsage, runLocalCommand, runRemoteCommand, withStdoutOnStderr };
 
 //# sourceMappingURL=run.js.map

package/dist/commands/runs/cancel.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";

package/dist/commands/runs/list.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { colorStatus, formatDuration as formatDuration$1, relativeTime, renderTable } from "../../remote/render.js";
 import pc from "picocolors";

package/dist/commands/runs/logs.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { colorStatus } from "../../remote/render.js";
 import pc from "picocolors";

package/dist/commands/runs/rerun.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";

package/dist/commands/runs/show.js

@@ -1,4 +1,4 @@
-import "../../chunk-BTugEXQM.js";
+import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { RunHistory } from "../../remote/history.js";
 import { colorStatus, formatDuration as formatDuration$1, relativeTime } from "../../remote/render.js";

package/dist/commands/secrets-list.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";

package/dist/commands/types.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import { generateSecretsDts } from "../generators/secrets-dts.js";

package/dist/commands/verify-attestation.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { resolveTrustRoot } from "../provenance-trust-root.js";
 import "../remote/prod-defaults.js";
 import pc from "picocolors";
@@ -63,7 +63,13 @@ async function verifyAttestationCommand(artifact, options = {}) {
 		if (result.verified) {
 			logger.info(`${pc.green("PASS")} provenance verified (issuer ${issuer})`);
 			const c = result.claims ?? {};
-			logger.info(pc.gray(`  repository=${c.repository} ref=${c.ref} sha=${c.sha} run=${c.kici_run_id} job=${c.kici_job_id}`));
+			logger.info(pc.gray(`  origin org=${c.org_id ?? "unknown"}`));
+			if (c.source_origin === "run-remote") logger.info(pc.bold(pc.yellow("  SOURCE: kici run remote (local working-tree overlay — repository/ref/sha are caller-supplied, not a triggered VCS commit)")));
+			else logger.info(pc.gray(`  source: ${c.source_origin ?? "triggered"}`));
+			const origin = result.attestationOrigin ?? "live";
+			if (origin === "deferred") logger.info(pc.bold(pc.yellow("  ATTESTATION: deferred — the build facts were sealed at build time; the identity token was minted later (after a transient Platform outage), bound to the frozen statement by hash.")));
+			else if (origin === "offline-backfill") logger.info(pc.bold(pc.yellow("  ATTESTATION: offline-backfill — the run was ingested while the Platform was down; its run/job rows were backfilled and the token minted later. The org id is the authoritative anchor; the temporal gap is disclosed.")));
+			logger.info(pc.gray(`  repository=${c.repository} ref=${c.ref} sha=${c.sha} provider=${c.provider ?? "unknown"} run=${c.kici_run_id} job=${c.kici_job_id}`));
 		} else logger.error(`${pc.red("FAIL")} provenance NOT verified: ${result.failures.join(", ")}`);
 		return result.verified;
 	} catch (error) {

package/dist/commands/watch.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { compileCommand } from "./compile.js";

package/dist/commands/workflows.js

@@ -1,4 +1,4 @@
-import "../chunk-BTugEXQM.js";
+import "../rolldown-runtime-ClRpJifh.js";
 import { formatRelativeTime } from "../format.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import pc from "picocolors";