@kici-dev/compiler 0.1.25 → 0.1.27

package/dist/commands/run-banner.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Always-on startup banner for a routed `kici run --local` invocation. States
+ * the selected plane, where the agent runs, the secret + identity source, the
+ * control commands, and the flags that force a different behavior — so a
+ * developer always knows which plane a run used and why (design §5).
+ *
+ * Three variants:
+ * - `offline`  — independent plane, local secrets, dev-signed identity.
+ * - `attached` — hybrid plane, real Platform-minted OIDC + attestation.
+ * - `fallback` — wanted attached but the Platform was unreachable, so the run
+ *   fell back to offline; a LOUD first line makes the degradation obvious.
+ */
+export type RunBannerMode = 'offline' | 'attached' | 'fallback';
+export interface RunBannerInput {
+    mode: RunBannerMode;
+    /** Plane orchestrator URL (surfaced on the control line). */
+    planeUrl: string;
+    /** Org id (attached variant). */
+    orgId?: string;
+    /** Why the run fell back to offline (fallback variant). */
+    fallbackReason?: string;
+    /**
+     * Trusted fleet-agent profile (`--trusted`): the run routes to the trusted
+     * label set, so steps see the ambient host env (minus the agent's own KiCI
+     * identity secrets). Surfaced as a loud line so a trusted run is never silent.
+     */
+    trusted?: boolean;
+}
+/** Render the boxed run banner as a plain (uncolored) multi-line string. */
+export declare function renderRunBanner(input: RunBannerInput): string;
+//# sourceMappingURL=run-banner.d.ts.map

package/dist/commands/run-banner.js

@@ -0,0 +1,25 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/commands/run-banner.ts
+/** Render the boxed run banner as a plain (uncolored) multi-line string. */
+function renderRunBanner(input) {
+	const title = input.mode === "attached" ? "kici run --local (connected)" : "kici run --local";
+	const rows = [];
+	if (input.mode === "fallback") rows.push(["⚠", `Platform unreachable — fell back to OFFLINE${input.fallbackReason ? ` (${input.fallbackReason})` : ""}`]);
+	if (input.mode === "attached") rows.push(["plane", "local dev orchestrator (hybrid, attached)"], ["agent", "this machine (bare-metal)"], ["secrets", `REAL scoped${input.orgId ? ` (org: ${input.orgId})` : ""}`], ["identity", "real Platform OIDC + attestation"], ["control", `kici local status | logs | detach   (${input.planeUrl})`], ["force", "--offline (local plane) · --in-place (ambient)"]);
+	else rows.push(["plane", "local dev orchestrator (independent, offline)"], ["agent", "this machine (bare-metal)"], ["secrets", "LOCAL files (.kici/.secrets, .env.local, --env)"], ["identity", "DEV-SIGNED (iss=kici-local — NOT prod)"], ["control", `kici local status | logs | down   (${input.planeUrl})`], ["force", "--connected (attach to Platform) · --in-place (ambient)"]);
+	if (input.trusted) rows.push(["execution", "TRUSTED — host env passthrough (NOT sandboxed)"]);
+	const labelWidth = Math.max(...rows.map(([label]) => label.length));
+	const bodyLines = rows.map(([label, value]) => `${(label + ":").padEnd(labelWidth + 1)} ${value}`);
+	const contentWidth = Math.max(title.length + 2, ...bodyLines.map((l) => l.length));
+	const top = `┌ ${title} ${"─".repeat(Math.max(0, contentWidth - title.length))}┐`;
+	const bottom = `└${"─".repeat(contentWidth + 2)}┘`;
+	return [
+		top,
+		...bodyLines.map((l) => `│ ${l.padEnd(contentWidth)} │`),
+		bottom
+	].join("\n");
+}
+//#endregion
+export { renderRunBanner };
+
+//# sourceMappingURL=run-banner.js.map

package/dist/commands/run-routed.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `kici run --local [event]` — a real routed dispatch with this machine as the
+ * ephemeral agent, through the warm local dev plane. In this phase only the
+ * offline (independent) plane is wired; Platform attachment (`--connected` /
+ * auto-select hybrid) lands with the attachment work.
+ *
+ * The offline path reuses the real orchestrator + agent pipeline end-to-end, so
+ * the execution parity dividend (emit / cache / needs / parallel / `KICI_SOURCE_*`)
+ * holds by construction — there is no second engine.
+ */
+export interface RunRoutedOptions {
+    event?: string;
+    local?: boolean;
+    offline?: boolean;
+    connected?: boolean;
+    inPlace?: boolean;
+    /**
+     * Trusted fleet-agent profile: route this run to the plane's trusted label
+     * set so steps run with the ambient host env passed through (minus the
+     * agent's own KiCI identity secrets). Selects a PRE-CONFIGURED trusted scaler
+     * label set by appending the `self-hosted` routing label to the run's job
+     * `runsOn` — it never injects `KICI_TRUSTED_ENV` onto a dispatch payload.
+     */
+    trusted?: boolean;
+    /** Flat per-run secrets (`--env KEY=VALUE`); delivery lands with the secret path. */
+    env?: string[];
+    /**
+     * Path to a dispatch payload JSON `{ action?, client_payload? }`. Only read
+     * when the event is `dispatch`: `action` becomes the dispatch `types` matcher
+     * key and `client_payload` reaches the workflow. This is how `packages/ci`
+     * targets a single `dispatch()` workflow (e.g. deploy-stg) on the routed path.
+     */
+    payload?: string;
+    kiciDir?: string;
+    quiet?: boolean;
+    debug?: boolean;
+}
+/**
+ * Entry point for the action-bearing `kici run`. Validates the routing flags and
+ * drives the offline routed run. Returns true on run success.
+ */
+export declare function runRoutedCommand(options: RunRoutedOptions): Promise<boolean>;
+/**
+ * Read a dispatch payload file `{ action?, client_payload? }`. Returns the
+ * action + client_payload the routed dispatch trigger carries. An absent
+ * `--payload` yields an empty action (a bare `dispatch()` workflow still
+ * matches); a present file is parsed as JSON.
+ */
+export declare function readDispatchPayload(payloadPath?: string): {
+    action?: string;
+    clientPayload?: unknown;
+};
+//# sourceMappingURL=run-routed.d.ts.map

package/dist/commands/run-routed.js

@@ -0,0 +1,176 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { resolveKiciDir } from "../execution/executor.js";
+import "../execution/index.js";
+import { formatSummary } from "../remote/output/summary.js";
+import { IN_PLACE_ROUTING_LABEL, TRUSTED_ROUTING_LABEL } from "../local-plane/scaler-config.js";
+import { ensureLocalSource } from "../local-plane/plane-seed.js";
+import { triggerRun } from "../local-plane/plane-trigger.js";
+import { resolvePlaneForRun } from "../local-plane/resolve-plane.js";
+import { followRun } from "../local-plane/run-follow.js";
+import { seedLocalSecrets } from "../local-plane/secret-seed.js";
+import { resolveWorkdir } from "../local-plane/source-provider.js";
+import { injectRunsOnLabel } from "../local-plane/trusted-routing.js";
+import { compileCommand } from "./compile.js";
+import { withStdoutOnStderr } from "./run.js";
+import { renderRunBanner } from "./run-banner.js";
+import path from "node:path";
+import { readFileSync } from "node:fs";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/run-routed.ts
+/**
+* `kici run --local [event]` — a real routed dispatch with this machine as the
+* ephemeral agent, through the warm local dev plane. In this phase only the
+* offline (independent) plane is wired; Platform attachment (`--connected` /
+* auto-select hybrid) lands with the attachment work.
+*
+* The offline path reuses the real orchestrator + agent pipeline end-to-end, so
+* the execution parity dividend (emit / cache / needs / parallel / `KICI_SOURCE_*`)
+* holds by construction — there is no second engine.
+*/
+/**
+* Entry point for the action-bearing `kici run`. Validates the routing flags and
+* drives the offline routed run. Returns true on run success.
+*/
+async function runRoutedCommand(options) {
+	if (options.debug) process.env.KICI_DEBUG = "true";
+	if (!options.local) {
+		logger.error(pc.red("kici run (connected cloud run) is not yet available. Use `kici run --local` for a routed run on this machine, or `kici run remote <fixture>` for the fixture path."));
+		return false;
+	}
+	if (!options.event) {
+		logger.error(pc.red("Provide an event to run, e.g. `kici run --local push`."));
+		return false;
+	}
+	return runRouted({
+		...options,
+		event: options.event
+	});
+}
+/**
+* Read a dispatch payload file `{ action?, client_payload? }`. Returns the
+* action + client_payload the routed dispatch trigger carries. An absent
+* `--payload` yields an empty action (a bare `dispatch()` workflow still
+* matches); a present file is parsed as JSON.
+*/
+function readDispatchPayload(payloadPath) {
+	if (!payloadPath) return {};
+	const raw = JSON.parse(readFileSync(payloadPath, "utf-8"));
+	return {
+		action: raw.action,
+		clientPayload: raw.client_payload
+	};
+}
+/** Drive the full routed run against the warm local plane (offline or attached). */
+async function runRouted(options) {
+	const quiet = Boolean(options.quiet);
+	const kiciDir = resolveKiciDir(options.kiciDir);
+	const repoRoot = path.resolve(kiciDir, "..");
+	if (!(quiet ? await withStdoutOnStderr(() => compileCommand({
+		kiciDir,
+		check: false,
+		verbose: options.debug ?? false,
+		quiet: true
+	})) : await compileCommand({
+		kiciDir,
+		check: false,
+		verbose: options.debug ?? false
+	}))) return false;
+	let cleanup;
+	const restoreLocks = [];
+	try {
+		if (!quiet) logger.info(pc.dim("Starting the local dev plane…"));
+		const resolved = await resolvePlaneForRun({
+			offline: options.offline,
+			connected: options.connected
+		});
+		if ("error" in resolved) {
+			logger.error(pc.red(resolved.error));
+			return false;
+		}
+		const plane = resolved.plane;
+		if (!plane.url || !plane.adminToken) {
+			logger.error(pc.red("Local dev plane did not report a URL + admin token."));
+			return false;
+		}
+		const trusted = Boolean(options.trusted);
+		if (!quiet) logger.info(renderRunBanner(resolved.kind === "attached" ? {
+			mode: "attached",
+			planeUrl: plane.url,
+			orgId: resolved.orgId,
+			trusted
+		} : resolved.kind === "fallback" ? {
+			mode: "fallback",
+			planeUrl: plane.url,
+			fallbackReason: resolved.reason,
+			trusted
+		} : {
+			mode: "offline",
+			planeUrl: plane.url,
+			trusted
+		}));
+		const workdir = await resolveWorkdir({
+			inPlace: Boolean(options.inPlace),
+			repoRoot
+		});
+		cleanup = workdir.cleanup;
+		if (trusted) {
+			const lockPath = path.join(workdir.dir, ".kici", "kici.lock.json");
+			restoreLocks.push(injectRunsOnLabel(lockPath, TRUSTED_ROUTING_LABEL).restore);
+			if (options.inPlace) restoreLocks.push(injectRunsOnLabel(lockPath, IN_PLACE_ROUTING_LABEL).restore);
+		}
+		const seeded = await ensureLocalSource(plane.url, plane.adminToken, {
+			repoDir: workdir.dir,
+			inPlace: Boolean(options.inPlace)
+		});
+		const seededSecrets = await seedLocalSecrets(plane.url, plane.adminToken, {
+			orgId: seeded.orgId,
+			kiciDir
+		});
+		if (!quiet && seededSecrets.contexts.length > 0) logger.info(pc.dim(`Seeded ${seededSecrets.secretCount} local secret(s) across ${seededSecrets.contexts.length} context(s): ${seededSecrets.contexts.join(", ")}`));
+		if (!quiet) logger.info(pc.dim(`Triggering ${options.event} …`));
+		const dispatch = options.event === "dispatch" ? readDispatchPayload(options.payload) : void 0;
+		const runId = await triggerRun(plane.url, plane.adminToken, {
+			orgId: seeded.orgId,
+			sourceId: seeded.sourceName,
+			repoFullName: ".",
+			event: options.event === "dispatch" ? "dispatch" : options.event === "pull_request" ? "pull_request" : "push",
+			ref: workdir.ref,
+			sha: workdir.sha,
+			defaultBranch: workdir.branch,
+			...dispatch && {
+				action: dispatch.action,
+				clientPayload: dispatch.clientPayload
+			}
+		});
+		if (!quiet) logger.info(pc.green(`Run started: ${runId}`));
+		const outcome = await followRun(plane.url, plane.adminToken, runId, {
+			quiet,
+			onLine: (line) => process.stdout.write(line + "\n")
+		});
+		if (!quiet) {
+			const result = {
+				fixtureId: options.event,
+				runId,
+				status: outcome.status === "success" ? "success" : "failed",
+				totalDurationMs: 0,
+				jobs: outcome.jobs
+			};
+			process.stdout.write("\n" + formatSummary(result) + "\n");
+		}
+		return outcome.status === "success";
+	} catch (error) {
+		logger.error(pc.red(`\nError: ${toErrorMessage(error)}\n`));
+		if (options.debug && error instanceof Error && error.stack) logger.error(pc.gray(error.stack));
+		return false;
+	} finally {
+		for (const restore of restoreLocks.reverse()) try {
+			restore();
+		} catch {}
+		if (cleanup) await cleanup().catch(() => void 0);
+	}
+}
+//#endregion
+export { readDispatchPayload, runRoutedCommand };
+
+//# sourceMappingURL=run-routed.js.map

package/dist/commands/run.d.ts

@@ -1,15 +1,5 @@
 import { type HostTargetSelector, type InputsDescriptorMap } from '@kici-dev/engine';
-import type { RunLocalOptions } from '../local-executor/types.js';
 import type { RemoteRunOptions } from './preview.js';
-/**
- * Print a usage block for `kici run local` when the event argument is missing.
- *
- * Mirrors the discoverable help `kici preview` prints for a missing event: a
- * bold synopsis line, a one-line description, and a few concrete event
- * examples. The caller exits non-zero after printing — a missing event is a
- * usage error, unlike `kici preview` which treats no-event as help.
- */
-export declare function printRunLocalUsage(): void;
 /**
  * Compile `--target` selector strings into a {@link HostTargetSelector}. Each
  * string becomes one AND value (its own include set); repeated values
@@ -42,13 +32,6 @@ export declare function buildDispatchInputs(pairs: string[], descriptor: InputsD
  * stderr regardless.
  */
 export declare function withStdoutOnStderr<T>(fn: () => Promise<T>): Promise<T>;
-/**
- * Run a workflow locally using the local executor.
- * Thin wrapper that delegates to executeLocal from local-executor.
- *
- * Exit codes: 0 = success, 1 = job failure, 2 = config/compilation error
- */
-export declare function runLocalCommand(options: RunLocalOptions): Promise<boolean>;
 /**
  * Run fixtures remotely, routed through the Platform.
  */

package/dist/commands/run.js

@@ -10,11 +10,11 @@ import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/u
 import { formatJsonResult } from "../remote/output/json.js";
 import { formatJunitResult } from "../remote/output/junit.js";
 import { formatErrorHighlight, formatMultiFixtureSummary, formatSummary } from "../remote/output/summary.js";
-import { compileCommand } from "./compile.js";
 import { compileFixtures, filterFixtures } from "../fixtures/compiler.js";
 import { describeEvent } from "../fixtures/describe-event.js";
 import { FixturePickerCancelledError, runFixturePicker } from "../fixtures/picker.js";
 import { listHeldRunsForRun, resolveHeldRunContext } from "./held-run-client.js";
+import { compileCommand } from "./compile.js";
 import { handleNewHolds } from "./run-hold-watch.js";
 import path from "node:path";
 import pc from "picocolors";
@@ -24,24 +24,6 @@ import { coerceDispatchInputs, parseInputPairs } from "@kici-dev/engine";
 import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
 import { confirm } from "@inquirer/prompts";
 //#region src/commands/run.ts
-/**
-* Print a usage block for `kici run local` when the event argument is missing.
-*
-* Mirrors the discoverable help `kici preview` prints for a missing event: a
-* bold synopsis line, a one-line description, and a few concrete event
-* examples. The caller exits non-zero after printing — a missing event is a
-* usage error, unlike `kici preview` which treats no-event as help.
-*/
-function printRunLocalUsage() {
-	logger.info(pc.bold("\nUsage: kici run local <event> [options]\n"));
-	logger.info(pc.gray("Execute workflows locally for a given event, without orchestrator infrastructure.\n"));
-	logger.info(pc.gray("Examples:"));
-	logger.info(pc.gray("  kici run local push"));
-	logger.info(pc.gray("  kici run local pr:open"));
-	logger.info(pc.gray("  kici run local schedule"));
-	logger.info(pc.gray("  kici run local lifecycle:workflow_complete\n"));
-	logger.info(pc.gray("Or pick a workflow interactively: kici run local --pick\n"));
-}
 /** Terminal run statuses returned by the Platform run-status snapshot. */
 const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
 	"success",
@@ -127,11 +109,11 @@ async function withStdoutOnStderr(fn) {
 	}
 }
 /**
-* Recompile `.kici/workflows` → `kici.lock.json` before a remote run, mirroring
-* `kici run local`. The orchestrator matches triggers and dispatches against the
-* inline lock, so a stale lock would route an edited or newly-added workflow
-* incorrectly. Returns false on a compile/validation error so the caller can
-* abort before any upload or dispatch.
+* Recompile `.kici/workflows` → `kici.lock.json` before a remote run. The
+* orchestrator matches triggers and dispatches against the inline lock, so a
+* stale lock would route an edited or newly-added workflow incorrectly. Returns
+* false on a compile/validation error so the caller can abort before any upload
+* or dispatch.
 */
 async function compileBeforeRemoteRun(options) {
 	const pureStdout = Boolean(options.json || options.quiet);
@@ -144,31 +126,6 @@ async function compileBeforeRemoteRun(options) {
 	return pureStdout ? withStdoutOnStderr(compile) : compile();
 }
 /**
-* Run a workflow locally using the local executor.
-* Thin wrapper that delegates to executeLocal from local-executor.
-*
-* Exit codes: 0 = success, 1 = job failure, 2 = config/compilation error
-*/
-async function runLocalCommand(options) {
-	if (options.debug) {
-		process.env.KICI_DEBUG = "true";
-		if (!options.quiet) logger.info(pc.gray("Debug mode enabled"));
-	}
-	try {
-		const { executeLocal } = await import("../local-executor/index.js");
-		return await executeLocal(options);
-	} catch (error) {
-		if (error instanceof Error && (error.message.includes("Cannot find module") || error.message.includes("ERR_MODULE_NOT_FOUND"))) {
-			logger.error(pc.red("Local executor not yet available. The local execution engine is under development."));
-			return false;
-		}
-		const message = toErrorMessage(error);
-		logger.error(pc.red(`\nError: ${message}\n`));
-		if (options.debug && error instanceof Error && error.stack) logger.error(pc.gray(error.stack));
-		return false;
-	}
-}
-/**
 * Run fixtures remotely, routed through the Platform.
 */
 async function runRemoteCommand(fixture, options) {
@@ -694,6 +651,6 @@ function displayRemoteResults(results) {
 	logger.info("");
 }
 //#endregion
-export { buildDispatchInputs, buildTargetSelector, lookupDispatchInputsDescriptor, printRunLocalUsage, runLocalCommand, runRemoteCommand, withStdoutOnStderr };
+export { buildDispatchInputs, buildTargetSelector, lookupDispatchInputsDescriptor, runRemoteCommand, withStdoutOnStderr };
 
 //# sourceMappingURL=run.js.map

package/dist/commands/secrets-list.d.ts

@@ -5,8 +5,8 @@ export interface SecretsListOptions {
 /**
  * List test-available secret contexts through the Platform.
  *
- * Calls GET /api/v1/orgs/:orgId/environments?includeSecrets=true (relayed to
- * the org's orchestrator), filters to environments with
+ * Calls GET /api/v1/orgs/:orgId/contexts?includeSecrets=true (relayed to
+ * the org's orchestrator), filters to contexts with
  * allowLocalExecution=true, and displays a table of names, key names, and
  * flags. Values are never exposed -- only key names.
  */

package/dist/commands/secrets-list.js

@@ -6,17 +6,17 @@ import { toErrorMessage } from "@kici-dev/core";
 /**
 * List test-available secret contexts through the Platform.
 *
-* Calls GET /api/v1/orgs/:orgId/environments?includeSecrets=true (relayed to
-* the org's orchestrator), filters to environments with
+* Calls GET /api/v1/orgs/:orgId/contexts?includeSecrets=true (relayed to
+* the org's orchestrator), filters to contexts with
 * allowLocalExecution=true, and displays a table of names, key names, and
 * flags. Values are never exposed -- only key names.
 */
 async function secretsListCommand(_options = {}) {
 	try {
-		const contexts = (await (await DashboardClient.load()).listEnvironments(true)).filter((e) => e.allowLocalExecution);
+		const contexts = (await (await DashboardClient.load()).listContexts(true)).filter((e) => e.allowLocalExecution);
 		if (contexts.length === 0) {
 			console.log(pc.yellow("No test-available secret contexts found."));
-			console.log(pc.gray("Enable test runs (allowLocalExecution) on an environment to make its secrets available for test runs."));
+			console.log(pc.gray("Enable test runs (allowLocalExecution) on a context to make its secrets available for test runs."));
 			return true;
 		}
 		renderContextTable(contexts);

package/dist/commands/types.d.ts

@@ -5,11 +5,11 @@ export interface TypesOptions {
     quiet?: boolean;
 }
 /**
- * Generate TypeScript declarations for environment secrets.
+ * Generate TypeScript declarations for context secrets.
  *
- * Fetches environment metadata (with secret key names) through the Platform
+ * Fetches context metadata (with secret key names) through the Platform
  * and generates .kici/types/secrets.d.ts with module augmentation for
- * KnownSecretKeys and EnvironmentSecrets.
+ * KnownSecretKeys and ContextSecrets.
  *
  * @param options - Command options
  * @returns true on success, false on error

package/dist/commands/types.js

@@ -8,11 +8,11 @@ import fs from "node:fs/promises";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/commands/types.ts
 /**
-* Generate TypeScript declarations for environment secrets.
+* Generate TypeScript declarations for context secrets.
 *
-* Fetches environment metadata (with secret key names) through the Platform
+* Fetches context metadata (with secret key names) through the Platform
 * and generates .kici/types/secrets.d.ts with module augmentation for
-* KnownSecretKeys and EnvironmentSecrets.
+* KnownSecretKeys and ContextSecrets.
 *
 * @param options - Command options
 * @returns true on success, false on error
@@ -21,7 +21,7 @@ async function typesCommand(options = {}) {
 	try {
 		const config = await loadGlobalConfig();
 		const dtsContent = generateSecretsDts({
-			environments: (await DashboardClient.fromConfig(config).listEnvironments(true)).map((e) => ({
+			contexts: (await DashboardClient.fromConfig(config).listContexts(true)).map((e) => ({
 				name: e.name,
 				keys: e.secretKeys ?? []
 			})),

package/dist/execution/executor.js

@@ -5,7 +5,7 @@ import { ensureTsLoaderHook } from "./ts-loader.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
 import { existsSync } from "node:fs";
-import fs from "node:fs/promises";
+import fs$1 from "node:fs/promises";
 //#region src/execution/executor.ts
 /**
 * Load a TypeScript workflow/config module by direct dynamic import.
@@ -23,7 +23,7 @@ import fs from "node:fs/promises";
 async function loadModule(entryPoint, errorContext) {
 	let hashBundleSource;
 	try {
-		hashBundleSource = await fs.readFile(entryPoint, "utf-8");
+		hashBundleSource = await fs$1.readFile(entryPoint, "utf-8");
 	} catch {}
 	try {
 		ensureTsLoaderHook();
@@ -60,12 +60,12 @@ async function loadModule(entryPoint, errorContext) {
 async function executeConfig(configPath) {
 	const absolutePath = path.resolve(configPath);
 	try {
-		await fs.access(absolutePath);
+		await fs$1.access(absolutePath);
 	} catch {
 		throw compilerError("E001", `Config file not found: ${absolutePath}`, { suggestion: "Ensure workflow files exist in .kici/workflows/" });
 	}
 	try {
-		await fs.readFile(absolutePath, "utf-8");
+		await fs$1.readFile(absolutePath, "utf-8");
 	} catch {
 		throw compilerError("E001", `Failed to read config file: ${absolutePath}`, { suggestion: "Check file permissions" });
 	}
@@ -180,14 +180,14 @@ async function discoverWorkflows(kiciDir) {
 	const absoluteKiciDir = resolveKiciDir(kiciDir);
 	const workflowDir = path.join(absoluteKiciDir, "workflows");
 	try {
-		if (!(await fs.stat(workflowDir)).isDirectory()) throw compilerError("E001", `.kici/workflows/ is not a directory: ${workflowDir}`, { suggestion: "Run \"kici init\" to create the .kici/workflows/ directory" });
+		if (!(await fs$1.stat(workflowDir)).isDirectory()) throw compilerError("E001", `.kici/workflows/ is not a directory: ${workflowDir}`, { suggestion: "Run \"kici init\" to create the .kici/workflows/ directory" });
 	} catch (err) {
 		if (err.code === "ENOENT") throw compilerError("E001", `.kici/workflows/ directory not found: ${workflowDir}`, { suggestion: "Run \"kici init\" to create the .kici/workflows/ directory" });
 		throw err;
 	}
 	let files;
 	try {
-		files = (await fs.readdir(workflowDir, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => path.join(workflowDir, entry.name));
+		files = (await fs$1.readdir(workflowDir, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".ts")).map((entry) => path.join(workflowDir, entry.name));
 	} catch {
 		throw compilerError("E001", `Failed to read .kici/workflows/ directory: ${workflowDir}`, { suggestion: "Check directory permissions" });
 	}
@@ -213,7 +213,7 @@ async function discoverWorkflows(kiciDir) {
 */
 async function executeWorkflowFile(filePath) {
 	try {
-		await fs.access(filePath);
+		await fs$1.access(filePath);
 	} catch {
 		throw compilerError("E001", `Failed to read workflow file: ${filePath}`, { suggestion: "Check file permissions" });
 	}

package/dist/generators/secrets-dts.d.ts

@@ -1,27 +1,27 @@
 /**
- * .d.ts generator for environment secret type augmentation.
+ * .d.ts generator for context secret type augmentation.
  *
  * Produces a TypeScript declaration file that augments @kici-dev/sdk's
- * KnownSecretKeys and EnvironmentSecrets interfaces, enabling compile-time
+ * KnownSecretKeys and ContextSecrets interfaces, enabling compile-time
  * autocomplete and type checking for `ctx.secrets.get()` and `ctx.secrets.expose()`
- * key names per environment.
+ * key names per context.
  */
-export interface EnvironmentMetadata {
+export interface ContextMetadata {
     name: string;
     keys: string[];
 }
 interface GenerateSecretsDtsOptions {
-    environments: EnvironmentMetadata[];
+    contexts: ContextMetadata[];
     endpoint: string;
     generatedAt: Date;
 }
 /**
- * Generate a .d.ts string from environment metadata.
+ * Generate a .d.ts string from context metadata.
  *
- * The output augments @kici-dev/sdk's KnownSecretKeys and EnvironmentSecrets
- * interfaces, enabling compile-time autocomplete for secret keys per environment.
+ * The output augments @kici-dev/sdk's KnownSecretKeys and ContextSecrets
+ * interfaces, enabling compile-time autocomplete for secret keys per context.
  *
- * @param options - Environment metadata, endpoint URL, and generation timestamp
+ * @param options - Context metadata, endpoint URL, and generation timestamp
  * @returns The .d.ts file content as a string
  */
 export declare function generateSecretsDts(options: GenerateSecretsDtsOptions): string;

package/dist/generators/secrets-dts.js

@@ -13,11 +13,11 @@ function formatProperty(name) {
 	return isValidIdentifier(name) ? name : `'${escapeQuotes(name)}'`;
 }
 /**
-* Build a map of key -> list of environment names that provide it.
+* Build a map of key -> list of context names that provide it.
 */
-function buildKeySourceMap(environments) {
+function buildKeySourceMap(contexts) {
 	const map = /* @__PURE__ */ new Map();
-	for (const env of environments) for (const key of env.keys) {
+	for (const env of contexts) for (const key of env.keys) {
 		const sources = map.get(key);
 		if (sources) sources.push(env.name);
 		else map.set(key, [env.name]);
@@ -25,16 +25,16 @@ function buildKeySourceMap(environments) {
 	return map;
 }
 /**
-* Generate a .d.ts string from environment metadata.
+* Generate a .d.ts string from context metadata.
 *
-* The output augments @kici-dev/sdk's KnownSecretKeys and EnvironmentSecrets
-* interfaces, enabling compile-time autocomplete for secret keys per environment.
+* The output augments @kici-dev/sdk's KnownSecretKeys and ContextSecrets
+* interfaces, enabling compile-time autocomplete for secret keys per context.
 *
-* @param options - Environment metadata, endpoint URL, and generation timestamp
+* @param options - Context metadata, endpoint URL, and generation timestamp
 * @returns The .d.ts file content as a string
 */
 function generateSecretsDts(options) {
-	const { environments, endpoint, generatedAt } = options;
+	const { contexts, endpoint, generatedAt } = options;
 	const lines = [];
 	lines.push("// @generated by kici types -- DO NOT EDIT");
 	lines.push(`// Source: ${endpoint}`);
@@ -42,16 +42,16 @@ function generateSecretsDts(options) {
 	lines.push("// Run `kici types` to refresh");
 	lines.push("");
 	lines.push("declare module '@kici-dev/sdk' {");
-	const keySourceMap = buildKeySourceMap(environments);
+	const keySourceMap = buildKeySourceMap(contexts);
 	lines.push("  interface KnownSecretKeys {");
 	for (const [key, sources] of keySourceMap) {
-		lines.push(`    /** From environment: ${sources.join(", ")} */`);
+		lines.push(`    /** From context: ${sources.join(", ")} */`);
 		lines.push(`    ${formatProperty(key)}: string;`);
 	}
 	lines.push("  }");
 	lines.push("");
-	lines.push("  interface EnvironmentSecrets {");
-	for (const env of environments) if (env.keys.length === 0) lines.push(`    ${formatProperty(env.name)}: never;`);
+	lines.push("  interface ContextSecrets {");
+	for (const env of contexts) if (env.keys.length === 0) lines.push(`    ${formatProperty(env.name)}: never;`);
 	else {
 		const keyUnion = env.keys.map((k) => `'${escapeQuotes(k)}'`).join(" | ");
 		lines.push(`    ${formatProperty(env.name)}: ${keyUnion};`);