@kici-dev/compiler 0.1.26 → 0.2.0

package/dist/lockfile/purity-diagnostics.js

@@ -0,0 +1,52 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { analyzePurity } from "./purity-analyzer.js";
+//#region src/lockfile/purity-diagnostics.ts
+/** Which dynamic-value slot on a job carried the impure function. */
+let DynamicValueField = /* @__PURE__ */ function(DynamicValueField) {
+	DynamicValueField["Context"] = "context";
+	DynamicValueField["Env"] = "env";
+	DynamicValueField["ConcurrencyGroup"] = "concurrencyGroup";
+	return DynamicValueField;
+}({});
+function pushIfImpure(out, fn, field, base) {
+	if (typeof fn !== "function") return;
+	const result = analyzePurity(fn.toString());
+	if (!result.pure) out.push({
+		...base,
+		field,
+		reason: result.reason ?? "unknown"
+	});
+}
+/**
+* Analyze a single static job's dynamic-value functions (context(s), env,
+* concurrencyGroup) for impurity. Returns one warning per impure function.
+*/
+function analyzeJobPurity(job, workflowName, sourceFile) {
+	const out = [];
+	const base = {
+		workflowName,
+		sourceFile,
+		jobName: job.name
+	};
+	const contextRefs = job.contexts ?? (job.context !== void 0 ? [job.context] : void 0);
+	if (contextRefs) for (const ref of contextRefs) pushIfImpure(out, ref, "context", base);
+	pushIfImpure(out, job.env, "env", base);
+	pushIfImpure(out, job.concurrencyGroup, "concurrencyGroup", base);
+	return out;
+}
+/**
+* Walk every workflow's static jobs and collect impurity warnings. Function-typed
+* jobs (dynamic job generators) are skipped — their purity is analyzed at dispatch.
+*/
+function collectWorkflowPurityWarnings(workflows) {
+	const out = [];
+	for (const { workflow, source } of workflows) for (const job of workflow.jobs) {
+		if (typeof job === "function") continue;
+		out.push(...analyzeJobPurity(job, workflow.name, source.file));
+	}
+	return out;
+}
+//#endregion
+export { DynamicValueField, analyzeJobPurity, collectWorkflowPurityWarnings };
+
+//# sourceMappingURL=purity-diagnostics.js.map

package/dist/postinstall.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { confirm } from "@inquirer/prompts";
+import { isCiEnvironment } from "@kici-dev/core/ci-env";
 //#region src/postinstall.ts
 /**
 * Post-install script for @kici-dev/compiler
@@ -33,7 +34,7 @@ async function detectDevelopmentMode() {
 }
 async function main() {
 	if (await detectDevelopmentMode()) return;
-	if (process.env.CI === "true" || !process.stdout.isTTY) return;
+	if (isCiEnvironment() || !process.stdout.isTTY) return;
 	const fs = await import("node:fs/promises");
 	try {
 		await fs.access(".kici");

package/dist/remote/artifact-extract.d.ts

@@ -0,0 +1,8 @@
+/** Sub-directory of the destination that home-anchored entries land under. */
+export declare const HOME_SUBDIR = "~home";
+/**
+ * Extract an artifact tarball under `destDir`, relocating the anchor groups so
+ * nothing escapes the destination.
+ */
+export declare function extractArtifactTarball(tarball: Buffer, destDir: string): Promise<void>;
+//# sourceMappingURL=artifact-extract.d.ts.map

package/dist/remote/artifact-extract.js

@@ -0,0 +1,58 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { join } from "node:path";
+import { cp, mkdir, readdir } from "node:fs/promises";
+import { HOME_ANCHOR, REPO_ANCHOR } from "@kici-dev/core";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { x } from "tar";
+import { makeTempDir } from "@kici-dev/core/tmp";
+//#region src/remote/artifact-extract.ts
+/**
+* CLI-side artifact extraction.
+*
+* Artifact tarballs are packed by the cache packer, so entries are anchored as
+* `__repo__/<rel>` (repo-root-relative) and `__home__/<rel>` (home-relative).
+* The in-workflow extractor restores those groups to the real repo root / home
+* dir; a CLI must NOT — that would scatter files across the user's filesystem.
+* This helper lands everything under a single destination dir instead:
+*
+*   `__repo__/<rel>` -> `<destDir>/<rel>`
+*   `__home__/<rel>` -> `<destDir>/~home/<rel>`  (kept separate so a
+*                       home-anchored file cannot clobber a repo-anchored one)
+*
+* Extraction goes through a scratch dir first and only relocates on success, so
+* a failed extraction never leaves a half-written output directory.
+*/
+/** Sub-directory of the destination that home-anchored entries land under. */
+const HOME_SUBDIR = "~home";
+/**
+* Extract an artifact tarball under `destDir`, relocating the anchor groups so
+* nothing escapes the destination.
+*/
+async function extractArtifactTarball(tarball, destDir) {
+	const scratch = await makeTempDir("artifact-extract");
+	try {
+		await pipeline(Readable.from(tarball), x({
+			cwd: scratch.path,
+			gzip: true
+		}));
+		await mkdir(destDir, { recursive: true });
+		for (const top of await readdir(scratch.path)) {
+			const from = join(scratch.path, top);
+			if (top === REPO_ANCHOR) await relocateGroup(from, destDir);
+			else if (top === HOME_ANCHOR) await relocateGroup(from, join(destDir, HOME_SUBDIR));
+			else await cp(from, join(destDir, top), { recursive: true });
+		}
+	} finally {
+		await scratch.cleanup();
+	}
+}
+/** Copy the contents of an anchor group dir into `into`, merging trees. */
+async function relocateGroup(groupDir, into) {
+	await mkdir(into, { recursive: true });
+	for (const entry of await readdir(groupDir)) await cp(join(groupDir, entry), join(into, entry), { recursive: true });
+}
+//#endregion
+export { HOME_SUBDIR, extractArtifactTarball };
+
+//# sourceMappingURL=artifact-extract.js.map

package/dist/remote/config.d.ts

@@ -32,13 +32,31 @@ export interface GlobalConfig {
 }
 /**
  * Returns the global KiCI config directory path.
- * Checks KICI_CONFIG_DIR env var first, falls back to ~/.kici.
+ *
+ * Resolution order:
+ *   1. `KICI_CONFIG_DIR`, when set to a non-empty value.
+ *   2. A hard refusal when `KICI_TEST_ISOLATION` is present. A developer
+ *      machine's `~/.kici/config` names a real endpoint and carries a live
+ *      PAT, so a test process that reads it authenticates against whatever
+ *      that config points at — in practice, production. Every test that needs
+ *      a config must name its own isolated directory.
+ *   3. `~/.kici`.
+ *
+ * `KICI_TEST_ISOLATION` is set by this repository's own vitest configs, via
+ * `hack/lib/vitest-isolation.ts`. It is deliberately a KiCI-owned name rather
+ * than the runner's `VITEST`: `kici` is a compat-protected CLI, and `VITEST`
+ * is a third-party marker that propagates into spawned children, so keying off
+ * it would break a customer whose vitest test shells out to `kici`.
+ *
+ * `env` is injectable so this module's own tests can exercise every branch.
+ * It is NOT an opt-out: production call sites pass no argument and inherit the
+ * guard.
  */
-export declare function getConfigDir(): string;
+export declare function getConfigDir(env?: NodeJS.ProcessEnv): string;
 /**
  * Returns the path to the global config file (~/.kici/config).
  */
-export declare function getConfigPath(): string;
+export declare function getConfigPath(env?: NodeJS.ProcessEnv): string;
 /**
  * Load the global KiCI config from ~/.kici/config.
  * Returns an empty object if the file does not exist.

package/dist/remote/config.js

@@ -30,17 +30,36 @@ function sanitizeConfig(raw) {
 }
 /**
 * Returns the global KiCI config directory path.
-* Checks KICI_CONFIG_DIR env var first, falls back to ~/.kici.
+*
+* Resolution order:
+*   1. `KICI_CONFIG_DIR`, when set to a non-empty value.
+*   2. A hard refusal when `KICI_TEST_ISOLATION` is present. A developer
+*      machine's `~/.kici/config` names a real endpoint and carries a live
+*      PAT, so a test process that reads it authenticates against whatever
+*      that config points at — in practice, production. Every test that needs
+*      a config must name its own isolated directory.
+*   3. `~/.kici`.
+*
+* `KICI_TEST_ISOLATION` is set by this repository's own vitest configs, via
+* `hack/lib/vitest-isolation.ts`. It is deliberately a KiCI-owned name rather
+* than the runner's `VITEST`: `kici` is a compat-protected CLI, and `VITEST`
+* is a third-party marker that propagates into spawned children, so keying off
+* it would break a customer whose vitest test shells out to `kici`.
+*
+* `env` is injectable so this module's own tests can exercise every branch.
+* It is NOT an opt-out: production call sites pass no argument and inherit the
+* guard.
 */
-function getConfigDir() {
-	if (process.env.KICI_CONFIG_DIR) return process.env.KICI_CONFIG_DIR;
+function getConfigDir(env = process.env) {
+	if (env.KICI_CONFIG_DIR) return env.KICI_CONFIG_DIR;
+	if (env.KICI_TEST_ISOLATION) throw new Error("Refusing to read the ambient ~/.kici config from a test process. Set KICI_CONFIG_DIR to an isolated directory for this run — the developer machine config may point at production.");
 	return path.join(os.homedir(), ".kici");
 }
 /**
 * Returns the path to the global config file (~/.kici/config).
 */
-function getConfigPath() {
-	return path.join(getConfigDir(), "config");
+function getConfigPath(env = process.env) {
+	return path.join(getConfigDir(env), "config");
 }
 /**
 * Load the global KiCI config from ~/.kici/config.

package/dist/remote/dashboard-client.d.ts

@@ -4,7 +4,7 @@
  * only place in the CLI that knows these routes.
  */
 import { z } from 'zod';
-import { type RunListResponse, type RunListItem, type DiagnosticsInfrastructureResponse, type DiagnosticsSummaryResponse, type DashboardRunDetailApiResponse, type DashboardStepLogsApiResponse, type RegistrationItem } from '@kici-dev/engine';
+import { type ArtifactListItem, type RunListResponse, type RunListItem, type DiagnosticsInfrastructureResponse, type DiagnosticsSummaryResponse, type DashboardRunDetailApiResponse, type DashboardStepLogsApiResponse, type RegistrationItem } from '@kici-dev/engine';
 import { type GlobalConfig } from './config.js';
 export type DashboardErrorKind = 'not_logged_in' | 'no_active_org' | 'unauthorized' | 'forbidden' | 'not_found' | 'conflict' | 'cooldown' | 'orchestrator_offline' | 'http';
 /** Typed error raised by every DashboardClient method on a non-2xx response. */
@@ -22,8 +22,21 @@ export interface RunsListFilters {
     trigger?: string;
     source?: string;
     since?: string;
-    page?: number;
+    /** Opaque keyset cursor (from a prior page's `nextCursor`). Absent = first page. */
+    cursor?: string;
 }
+export declare const webhookActivitySchema: z.ZodObject<{
+    windowMinutes: z.ZodNumber;
+    received: z.ZodNumber;
+    delivered: z.ZodNumber;
+    edgeRejected: z.ZodNumber;
+    failed: z.ZodNumber;
+    matched: z.ZodOptional<z.ZodNumber>;
+    unmatched: z.ZodOptional<z.ZodNumber>;
+    lockfileMissing: z.ZodOptional<z.ZodNumber>;
+    orchestratorUnavailable: z.ZodBoolean;
+}, z.core.$strip>;
+export type WebhookActivity = z.infer<typeof webhookActivitySchema>;
 /** Result of {@link DashboardClient.listRegistrations}. */
 export interface RegistrationsListResult {
     registrations: RegistrationItem[];
@@ -36,18 +49,26 @@ export interface RegistrationsListFilters {
     repoIdentifier?: string;
 }
 /**
- * A secret context (environment) as surfaced to the developer CLI's
+ * A secret context (context) as surfaced to the developer CLI's
  * `secrets list` / `types` commands. The orchestrator returns the per-env
  * secret key names (never values) when `includeSecrets` is requested.
  */
-declare const environmentContextSchema: z.ZodObject<{
+declare const contextContextSchema: z.ZodObject<{
     name: z.ZodString;
     enabled: z.ZodBoolean;
     allowLocalExecution: z.ZodBoolean;
     secretKeys: z.ZodDefault<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
-/** A secret context (environment) returned by {@link DashboardClient.listEnvironments}. */
-export type EnvironmentContext = z.infer<typeof environmentContextSchema>;
+/** A secret context (context) returned by {@link DashboardClient.listContexts}. */
+export type ContextContext = z.infer<typeof contextContextSchema>;
+/**
+ * Parsed shape of `GET /runs/:runId/artifacts` for the CLI. The per-artifact
+ * shape is reused from `@kici-dev/engine` so the CLI and the server cannot drift.
+ */
+export interface ArtifactsListResult {
+    artifacts: ArtifactListItem[];
+    downloadUrlExpiresInSeconds?: number;
+}
 export declare class DashboardClient {
     private readonly endpoint;
     private readonly token;
@@ -62,17 +83,33 @@ export declare class DashboardClient {
     getJson(path: string): Promise<unknown>;
     /** Generic POST helper used by typed methods (and tests). */
     postJson(path: string, body?: unknown): Promise<unknown>;
+    /** Generic DELETE helper used by typed methods (and tests). */
+    deleteJson(path: string): Promise<unknown>;
     getDiagnosticsSummary(): Promise<DiagnosticsSummaryResponse>;
     getInfrastructure(): Promise<DiagnosticsInfrastructureResponse>;
     listRuns(filters?: RunsListFilters): Promise<RunListResponse>;
     getRun(runId: string): Promise<RunListItem>;
+    /**
+     * Fetch the org's recent webhook-activity counts. Returns null on ANY error
+     * (older Platform without the route, a network blip, an unexpected shape) so
+     * the `kici runs` empty-window hint degrades silently to today's output — the
+     * hint is a nicety, never a hard dependency.
+     */
+    getWebhookActivity(windowMinutes?: number): Promise<WebhookActivity | null>;
     getRunDetail(runId: string): Promise<DashboardRunDetailApiResponse>;
     getStepLogs(runId: string, jobId: string, stepIndex: number): Promise<DashboardStepLogsApiResponse>;
+    /**
+     * List a run's artifacts (`GET /runs/:runId/artifacts`). Each entry carries a
+     * presigned `downloadUrl` minted by the customer's orchestrator; the Platform
+     * relays it without re-signing, so the artifact bytes never transit Platform.
+     */
+    listArtifacts(runId: string): Promise<ArtifactsListResult>;
     rerunRun(runId: string): Promise<{
         newRunId: string;
     }>;
     cancelRun(runId: string, force: boolean): Promise<{
         cancelledJobs?: number;
+        alreadyTerminal?: boolean;
     }>;
     cancelByBranch(branch: string): Promise<{
         cancelledRuns?: number;
@@ -80,13 +117,13 @@ export declare class DashboardClient {
     /** List the org's permanently registered workflows (GET /registrations). */
     listRegistrations(filters?: RegistrationsListFilters): Promise<RegistrationsListResult>;
     /**
-     * List the org's environments as secret contexts (GET /environments).
+     * List the org's contexts as secret contexts (GET /contexts).
      *
-     * Pass `includeSecrets` to have the orchestrator attach each environment's
+     * Pass `includeSecrets` to have the orchestrator attach each context's
      * reachable secret key names (never values). Used by `kici secrets list`
      * and `kici types`.
      */
-    listEnvironments(includeSecrets?: boolean): Promise<EnvironmentContext[]>;
+    listContexts(includeSecrets?: boolean): Promise<ContextContext[]>;
 }
 export {};
 //# sourceMappingURL=dashboard-client.d.ts.map

package/dist/remote/dashboard-client.js

@@ -1,6 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "./config.js";
-import { dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, registrationItemSchema, runListItemSchema, runListResponseSchema } from "@kici-dev/engine";
+import { artifactListItemSchema, dashboardRunDetailApiResponseSchema, dashboardStepLogsApiResponseSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, registrationItemSchema, runListItemSchema, runListResponseSchema } from "@kici-dev/engine";
 import { z } from "zod";
 //#region src/remote/dashboard-client.ts
 /**
@@ -20,8 +20,22 @@ var DashboardClientError = class extends Error {
 	}
 };
 const singleRunSchema = z.object({ run: runListItemSchema });
+const webhookActivitySchema = z.object({
+	windowMinutes: z.number(),
+	received: z.number(),
+	delivered: z.number(),
+	edgeRejected: z.number(),
+	failed: z.number(),
+	matched: z.number().optional(),
+	unmatched: z.number().optional(),
+	lockfileMissing: z.number().optional(),
+	orchestratorUnavailable: z.boolean()
+});
 const rerunResponseSchema = z.object({ newRunId: z.string() });
-const cancelResponseSchema = z.object({ cancelledJobs: z.number().optional() });
+const cancelResponseSchema = z.object({
+	cancelledJobs: z.number().optional(),
+	alreadyTerminal: z.boolean().optional()
+});
 const cancelByBranchResponseSchema = z.object({ cancelledRuns: z.number().optional() });
 const registrationsListSchema = z.object({
 	registrations: z.array(registrationItemSchema).default([]),
@@ -29,17 +43,21 @@ const registrationsListSchema = z.object({
 	registryUpdatedAt: z.string()
 });
 /**
-* A secret context (environment) as surfaced to the developer CLI's
+* A secret context (context) as surfaced to the developer CLI's
 * `secrets list` / `types` commands. The orchestrator returns the per-env
 * secret key names (never values) when `includeSecrets` is requested.
 */
-const environmentContextSchema = z.object({
+const contextContextSchema = z.object({
 	name: z.string(),
 	enabled: z.boolean(),
 	allowLocalExecution: z.boolean(),
 	secretKeys: z.array(z.string()).default([])
 });
-const environmentsListSchema = z.object({ environments: z.array(environmentContextSchema).default([]) });
+const contextsListSchema = z.object({ contexts: z.array(contextContextSchema).default([]) });
+const artifactsListResultSchema = z.object({
+	artifacts: z.array(artifactListItemSchema),
+	downloadUrlExpiresInSeconds: z.number().int().positive().optional()
+});
 const STATUS_ERROR_MAP = {
 	401: ["unauthorized", "Authentication failed. Run `kici login` to re-authenticate."],
 	403: ["forbidden", "Access denied."],
@@ -105,6 +123,10 @@ var DashboardClient = class DashboardClient {
 	async postJson(path, body) {
 		return this.request("POST", path, body);
 	}
+	/** Generic DELETE helper used by typed methods (and tests). */
+	async deleteJson(path) {
+		return this.request("DELETE", path);
+	}
 	async getDiagnosticsSummary() {
 		return diagnosticsSummaryResponseSchema.parse(await this.getJson("/diagnostics"));
 	}
@@ -120,19 +142,40 @@ var DashboardClient = class DashboardClient {
 		if (filters.trigger) qs.set("triggerType", filters.trigger);
 		if (filters.source) qs.set("source", filters.source);
 		if (filters.since) qs.set("since", filters.since);
-		if (filters.page) qs.set("page", String(filters.page));
+		if (filters.cursor) qs.set("cursor", filters.cursor);
 		const suffix = qs.toString() ? `?${qs.toString()}` : "";
 		return runListResponseSchema.parse(await this.getJson(`/runs${suffix}`));
 	}
 	async getRun(runId) {
 		return singleRunSchema.parse(await this.getJson(`/runs/${runId}`)).run;
 	}
+	/**
+	* Fetch the org's recent webhook-activity counts. Returns null on ANY error
+	* (older Platform without the route, a network blip, an unexpected shape) so
+	* the `kici runs` empty-window hint degrades silently to today's output — the
+	* hint is a nicety, never a hard dependency.
+	*/
+	async getWebhookActivity(windowMinutes = 60) {
+		try {
+			return webhookActivitySchema.parse(await this.getJson(`/webhook-activity?windowMinutes=${windowMinutes}`));
+		} catch {
+			return null;
+		}
+	}
 	async getRunDetail(runId) {
 		return dashboardRunDetailApiResponseSchema.parse(await this.getJson(`/runs/${runId}/detail`));
 	}
 	async getStepLogs(runId, jobId, stepIndex) {
 		return dashboardStepLogsApiResponseSchema.parse(await this.getJson(`/runs/${runId}/jobs/${jobId}/steps/${stepIndex}/logs`));
 	}
+	/**
+	* List a run's artifacts (`GET /runs/:runId/artifacts`). Each entry carries a
+	* presigned `downloadUrl` minted by the customer's orchestrator; the Platform
+	* relays it without re-signing, so the artifact bytes never transit Platform.
+	*/
+	async listArtifacts(runId) {
+		return artifactsListResultSchema.parse(await this.getJson(`/runs/${runId}/artifacts`));
+	}
 	async rerunRun(runId) {
 		return rerunResponseSchema.parse(await this.postJson(`/runs/${runId}/rerun`));
 	}
@@ -151,18 +194,18 @@ var DashboardClient = class DashboardClient {
 		return registrationsListSchema.parse(await this.getJson(`/registrations${suffix}`));
 	}
 	/**
-	* List the org's environments as secret contexts (GET /environments).
+	* List the org's contexts as secret contexts (GET /contexts).
 	*
-	* Pass `includeSecrets` to have the orchestrator attach each environment's
+	* Pass `includeSecrets` to have the orchestrator attach each context's
 	* reachable secret key names (never values). Used by `kici secrets list`
 	* and `kici types`.
 	*/
-	async listEnvironments(includeSecrets = false) {
+	async listContexts(includeSecrets = false) {
 		const suffix = includeSecrets ? "?includeSecrets=true" : "";
-		return environmentsListSchema.parse(await this.getJson(`/environments${suffix}`)).environments;
+		return contextsListSchema.parse(await this.getJson(`/contexts${suffix}`)).contexts;
 	}
 };
 //#endregion
-export { DashboardClient, DashboardClientError };
+export { DashboardClient, DashboardClientError, webhookActivitySchema };
 
 //# sourceMappingURL=dashboard-client.js.map

package/dist/remote/fs-case.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Report whether `dir` lives on a filesystem that ignores case in path lookups.
+ *
+ * Case sensitivity is a property of the mounted filesystem, not of the platform
+ * — a Linux host can mount a case-insensitive volume and macOS can format a
+ * case-sensitive one — so it is measured rather than inferred: an empty file is
+ * written under a random name and the same name is stat'd upper-cased. The
+ * directory is created if it is missing, and the probe file is removed on every
+ * path, including a throw.
+ *
+ * Rejects whenever the probe cannot produce an answer: the probe file cannot be
+ * written, or the twin lookup fails for any reason other than the twin's
+ * absence. Only `ENOENT` means "case-sensitive" — a permission or I/O error says
+ * nothing about case folding, and reporting it as case-sensitive would let a
+ * colliding set overwrite itself, so it is surfaced to the caller instead.
+ *
+ * It is its own module so callers can be tested against both answers with a
+ * cross-module spy, rather than against whatever filesystem the test runs on.
+ */
+export declare function isCaseInsensitiveDir(dir: string): Promise<boolean>;
+//# sourceMappingURL=fs-case.d.ts.map

package/dist/remote/fs-case.js

@@ -0,0 +1,45 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { join } from "node:path";
+import { mkdir, rm, stat, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+//#region src/remote/fs-case.ts
+/** Filesystem case-sensitivity probe for a target output directory. */
+/**
+* Report whether `dir` lives on a filesystem that ignores case in path lookups.
+*
+* Case sensitivity is a property of the mounted filesystem, not of the platform
+* — a Linux host can mount a case-insensitive volume and macOS can format a
+* case-sensitive one — so it is measured rather than inferred: an empty file is
+* written under a random name and the same name is stat'd upper-cased. The
+* directory is created if it is missing, and the probe file is removed on every
+* path, including a throw.
+*
+* Rejects whenever the probe cannot produce an answer: the probe file cannot be
+* written, or the twin lookup fails for any reason other than the twin's
+* absence. Only `ENOENT` means "case-sensitive" — a permission or I/O error says
+* nothing about case folding, and reporting it as case-sensitive would let a
+* colliding set overwrite itself, so it is surfaced to the caller instead.
+*
+* It is its own module so callers can be tested against both answers with a
+* cross-module spy, rather than against whatever filesystem the test runs on.
+*/
+async function isCaseInsensitiveDir(dir) {
+	await mkdir(dir, { recursive: true });
+	const probe = `.kici-case-probe-${randomUUID()}`;
+	const twin = probe.toUpperCase();
+	const probePath = join(dir, probe);
+	await writeFile(probePath, "");
+	try {
+		await stat(join(dir, twin));
+		return true;
+	} catch (err) {
+		if (err?.code === "ENOENT") return false;
+		throw err;
+	} finally {
+		await rm(probePath, { force: true });
+	}
+}
+//#endregion
+export { isCaseInsensitiveDir };
+
+//# sourceMappingURL=fs-case.js.map

package/dist/remote/history.d.ts

@@ -5,8 +5,7 @@
  * can review past runs (kici run remote --history) and inspect specific runs
  * (kici status <run-id>).
  */
-/** Status of a test run */
-type RunStatus = 'queued' | 'running' | 'success' | 'failed' | 'cancelled';
+import { type CanonicalStatus } from '@kici-dev/engine';
 /** A single run history entry */
 export interface HistoryEntry {
     /** Unique run identifier */
@@ -14,7 +13,7 @@ export interface HistoryEntry {
     /** Fixture that was run */
     fixtureId: string;
     /** Current status of the run */
-    status: RunStatus;
+    status: CanonicalStatus;
     /** ISO timestamp when the run started */
     startedAt: string;
     /** ISO timestamp when the run completed (if finished) */
@@ -87,5 +86,12 @@ export declare class RunHistory {
      */
     private save;
 }
+/** The plain (uncoloured) width of a status cell, for column padding. */
+export declare function statusLabelWidth(status: string): number;
+/**
+ * Format a run status with its colour and short label. A status this CLI does
+ * not recognise — a history file written by a newer version — renders verbatim.
+ */
+export declare function formatStatus(status: string): string;
 export {};
 //# sourceMappingURL=history.d.ts.map