@kici-dev/compiler 0.1.26 → 0.2.0

package/dist/remote/history.js

@@ -5,6 +5,7 @@ import path from "node:path";
 import pc from "picocolors";
 import fs from "node:fs/promises";
 import { formatDuration } from "@kici-dev/core";
+import { ExecutionJobStatus, ExecutionRunStatus, toCanonicalStatus } from "@kici-dev/engine";
 import picomatch from "picomatch";
 //#region src/remote/history.ts
 /**
@@ -95,7 +96,8 @@ var RunHistory = class {
 		for (const entry of entries) {
 			const id = entry.runId.padEnd(idWidth);
 			const fixture = entry.fixtureId.padEnd(fixtureWidth);
-			const status = formatStatus(entry.status).padEnd(12);
+			const statusPad = Math.max(0, 12 - statusLabelWidth(entry.status));
+			const status = formatStatus(entry.status) + " ".repeat(statusPad);
 			const duration = entry.durationMs ? formatDuration(entry.durationMs).padEnd(12) : "-".padEnd(12);
 			const started = formatRelativeTime(entry.startedAt);
 			lines.push(`${id}${fixture}${status}${duration}${started}`);
@@ -129,18 +131,85 @@ var RunHistory = class {
 	}
 };
 /**
-* Format a run status with appropriate color and symbol.
+* Short label and colour for every canonical status in the run-history table.
+*
+* Exhaustive by type, so a new engine status breaks this file's typecheck
+* rather than making the history table print the literal string `undefined`.
+*
+* `label` and `color` are stored separately so the table's column width can be
+* measured on the plain label: padding a colour-wrapped string measures the
+* ANSI escape bytes too, which silently collapses the column.
 */
-function formatStatus(status) {
-	switch (status) {
-		case "success": return pc.green("pass");
-		case "failed": return pc.red("fail");
-		case "cancelled": return pc.yellow("cancel");
-		case "running": return pc.blue("running");
-		case "queued": return pc.gray("queued");
+const STATUS_DISPLAY = Object.freeze({
+	[ExecutionRunStatus.enum.success]: {
+		label: "pass",
+		color: pc.green
+	},
+	[ExecutionRunStatus.enum.failed]: {
+		label: "fail",
+		color: pc.red
+	},
+	[ExecutionJobStatus.enum.timed_out_stale]: {
+		label: "timeout",
+		color: pc.red
+	},
+	[ExecutionJobStatus.enum.drift_dropped]: {
+		label: "dropped",
+		color: pc.red
+	},
+	[ExecutionJobStatus.enum.unroutable]: {
+		label: "unroutable",
+		color: pc.red
+	},
+	[ExecutionRunStatus.enum.cancelled]: {
+		label: "cancel",
+		color: pc.yellow
+	},
+	[ExecutionRunStatus.enum.cancelling]: {
+		label: "cancelling",
+		color: pc.yellow
+	},
+	[ExecutionJobStatus.enum.recovering]: {
+		label: "recovering",
+		color: pc.yellow
+	},
+	[ExecutionRunStatus.enum.held]: {
+		label: "held",
+		color: pc.yellow
+	},
+	[ExecutionRunStatus.enum.running]: {
+		label: "running",
+		color: pc.blue
+	},
+	[ExecutionJobStatus.enum.queued]: {
+		label: "queued",
+		color: pc.dim
+	},
+	[ExecutionRunStatus.enum.pending]: {
+		label: "pending",
+		color: pc.dim
+	},
+	[ExecutionJobStatus.enum.skipped]: {
+		label: "skipped",
+		color: pc.dim
 	}
+});
+/** The plain (uncoloured) width of a status cell, for column padding. */
+function statusLabelWidth(status) {
+	const canonical = toCanonicalStatus(status.toLowerCase());
+	return canonical === void 0 ? status.length : STATUS_DISPLAY[canonical].label.length;
+}
+/**
+* Format a run status with its colour and short label. A status this CLI does
+* not recognise — a history file written by a newer version — renders verbatim.
+*/
+function formatStatus(status) {
+	const canonical = toCanonicalStatus(status.toLowerCase());
+	if (canonical === void 0) return pc.gray(status);
+	const { label, color } = STATUS_DISPLAY[canonical];
+	return color(label);
 }
 //#endregion
-export { RunHistory };
+export { RunHistory, formatStatus, statusLabelWidth };
 
 //# sourceMappingURL=history.js.map

package/dist/remote/local-repo-identity.d.ts

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 /** Git hosts whose origin URL we can turn into a real `owner/repo` + web link. */
 export declare const RecognizedProvider: z.ZodEnum<{
+    bitbucket: "bitbucket";
     github: "github";
     gitlab: "gitlab";
-    bitbucket: "bitbucket";
 }>;
 export type RecognizedProvider = z.infer<typeof RecognizedProvider>;
 /** The literal provider value stamped when no recognized git origin exists. */

package/dist/remote/local-repo-identity.js

@@ -29,7 +29,8 @@ function parseGitOrigin(url) {
 	const urlStyle = /^[a-z]+:\/\/(?:[^@/]+@)?([^/]+)\/(.+?)(?:\.git)?$/.exec(trimmed);
 	const match = scp ?? urlStyle;
 	if (!match) return null;
-	const provider = HOST_PROVIDER[match[1].toLowerCase()];
+	const host = match[1].toLowerCase();
+	const provider = HOST_PROVIDER[host];
 	if (!provider) return null;
 	const repoIdentifier = match[2].replace(/^\/+|\/+$/g, "");
 	if (!repoIdentifier.includes("/")) return null;

package/dist/remote/notifications-client.d.ts

@@ -0,0 +1,149 @@
+/**
+ * Typed client for the Platform's org-scoped notification API — the routes the
+ * dashboard Notifications tab uses (channels, subscriptions, and the Layer 1
+ * Slack-identity roster). Authenticated with the stored PAT + active org,
+ * exactly like {@link DashboardClient}, and reachable programmatically via the
+ * `kici notifications …` CLI.
+ *
+ * It composes a {@link DashboardClient} (same auth / org-scoped-URL / error
+ * mapping) rather than re-implementing the transport: every path here is
+ * relative to `/api/v1/orgs/:orgId/notifications/…`.
+ */
+import { z } from 'zod';
+import { DashboardClientError } from './dashboard-client.js';
+/**
+ * Notification protocol enums mirrored from the hosted Platform's notification
+ * route contract. The public `kici` CLI cannot import the private Platform
+ * package, so these values are re-declared here and reused across the client,
+ * the command arg parsing, and their tests (the single source of truth on the
+ * CLI side).
+ */
+export declare const NotificationChannelKind: z.ZodEnum<{
+    email: "email";
+    slack: "slack";
+}>;
+export type NotificationChannelKind = z.infer<typeof NotificationChannelKind>;
+export declare const NotificationSubLevel: z.ZodEnum<{
+    job: "job";
+    run: "run";
+}>;
+export type NotificationSubLevel = z.infer<typeof NotificationSubLevel>;
+export declare const NotificationScopeKind: z.ZodEnum<{
+    actor: "actor";
+    org: "org";
+    team: "team";
+    user: "user";
+}>;
+export type NotificationScopeKind = z.infer<typeof NotificationScopeKind>;
+export declare const RosterSubjectKind: z.ZodEnum<{
+    email: "email";
+    git_login: "git_login";
+    kici_user: "kici_user";
+}>;
+export type RosterSubjectKind = z.infer<typeof RosterSubjectKind>;
+export declare const RosterInputForm: z.ZodEnum<{
+    email: "email";
+    id: "id";
+    username: "username";
+}>;
+export type RosterInputForm = z.infer<typeof RosterInputForm>;
+/** A notification channel row as returned by the channels list route. */
+export interface NotificationChannel {
+    id: string;
+    type: string;
+    name: string;
+    managed?: boolean;
+    created_at?: string;
+}
+/** A notification subscription row as returned by the subscriptions list route. */
+export interface NotificationSubscription {
+    id: string;
+    level: string;
+    channel_id: string;
+    scope_type: string;
+    scope_id: string | null;
+    on_status: string[];
+    repo_glob: string | null;
+    workflow_glob: string | null;
+    job_glob: string | null;
+    mentions: string[] | null;
+    accumulate_for: number | null;
+    enabled: boolean;
+    source: string;
+}
+/** A Slack-identity roster row as returned by the roster list route. */
+export interface SlackIdentity {
+    id: string;
+    connection_id: string;
+    subject_kind: string;
+    subject_value: string;
+    slack_member_id: string;
+    input_form: string;
+    status: string;
+}
+/** Body for creating a Slack channel. */
+export interface CreateSlackChannelBody {
+    type: 'slack';
+    connection_id: string;
+    slack_channel_id: string;
+    name: string;
+}
+/** Body for creating an email channel. */
+export interface CreateEmailChannelBody {
+    type: 'email';
+    name: string;
+    from_name?: string;
+    reply_to?: string;
+}
+export type CreateChannelBody = CreateSlackChannelBody | CreateEmailChannelBody;
+/** Body for creating a subscription (mirrors the Platform create route schema). */
+export interface CreateSubscriptionBody {
+    level: NotificationSubLevel;
+    channel_id: string;
+    scope_type: NotificationScopeKind;
+    scope_id?: string | null;
+    on_status: string[];
+    repo_glob?: string | null;
+    workflow_glob?: string | null;
+    job_glob?: string | null;
+    mentions?: string[] | null;
+    recipient_override?: string[] | null;
+    on_failure_class?: string[] | null;
+    accumulate_for?: number | null;
+}
+/** Body for adding a roster identity (mirrors the Platform add route schema). */
+export interface AddIdentityBody {
+    connection_id: string;
+    subject_kind: RosterSubjectKind;
+    subject_value: string;
+    input_form: RosterInputForm;
+    value: string;
+}
+/**
+ * PAT + org-scoped client for the notification routes. Construct via
+ * {@link NotificationsClient.load}, which reads `~/.kici/config` and resolves
+ * the target org (`--org` override or the saved active org).
+ */
+export declare class NotificationsClient {
+    private readonly dashboard;
+    private constructor();
+    /**
+     * Load the authenticated client. `opts.org` overrides the saved active org
+     * for this invocation; otherwise the saved `activeOrgId` is used. Throws a
+     * {@link DashboardClientError} when the PAT / endpoint / org is missing.
+     */
+    static load(opts?: {
+        org?: string;
+    }): Promise<NotificationsClient>;
+    listChannels(): Promise<NotificationChannel[]>;
+    createChannel(body: CreateChannelBody): Promise<NotificationChannel>;
+    deleteChannel(id: string): Promise<void>;
+    listSubscriptions(): Promise<NotificationSubscription[]>;
+    createSubscription(body: CreateSubscriptionBody): Promise<NotificationSubscription>;
+    deleteSubscription(id: string): Promise<void>;
+    listIdentities(): Promise<SlackIdentity[]>;
+    addIdentity(body: AddIdentityBody): Promise<SlackIdentity>;
+    deleteIdentity(id: string): Promise<void>;
+}
+export { DashboardClientError };
+//# sourceMappingURL=notifications-client.d.ts.map

package/dist/remote/notifications-client.js

@@ -0,0 +1,103 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { loadGlobalConfig } from "./config.js";
+import { DashboardClient, DashboardClientError } from "./dashboard-client.js";
+import { z } from "zod";
+//#region src/remote/notifications-client.ts
+/**
+* Typed client for the Platform's org-scoped notification API — the routes the
+* dashboard Notifications tab uses (channels, subscriptions, and the Layer 1
+* Slack-identity roster). Authenticated with the stored PAT + active org,
+* exactly like {@link DashboardClient}, and reachable programmatically via the
+* `kici notifications …` CLI.
+*
+* It composes a {@link DashboardClient} (same auth / org-scoped-URL / error
+* mapping) rather than re-implementing the transport: every path here is
+* relative to `/api/v1/orgs/:orgId/notifications/…`.
+*/
+/**
+* Notification protocol enums mirrored from the hosted Platform's notification
+* route contract. The public `kici` CLI cannot import the private Platform
+* package, so these values are re-declared here and reused across the client,
+* the command arg parsing, and their tests (the single source of truth on the
+* CLI side).
+*/
+const NotificationChannelKind = z.enum(["slack", "email"]);
+const NotificationSubLevel = z.enum(["run", "job"]);
+const NotificationScopeKind = z.enum([
+	"org",
+	"team",
+	"user",
+	"actor"
+]);
+const RosterSubjectKind = z.enum([
+	"kici_user",
+	"git_login",
+	"email"
+]);
+const RosterInputForm = z.enum([
+	"id",
+	"username",
+	"email"
+]);
+const rowSchema = z.record(z.string(), z.unknown());
+const channelsListSchema = z.object({ channels: z.array(rowSchema).default([]) });
+const subscriptionsListSchema = z.object({ subscriptions: z.array(rowSchema).default([]) });
+const identitiesListSchema = z.object({ identities: z.array(rowSchema).default([]) });
+/**
+* PAT + org-scoped client for the notification routes. Construct via
+* {@link NotificationsClient.load}, which reads `~/.kici/config` and resolves
+* the target org (`--org` override or the saved active org).
+*/
+var NotificationsClient = class NotificationsClient {
+	dashboard;
+	constructor(dashboard) {
+		this.dashboard = dashboard;
+	}
+	/**
+	* Load the authenticated client. `opts.org` overrides the saved active org
+	* for this invocation; otherwise the saved `activeOrgId` is used. Throws a
+	* {@link DashboardClientError} when the PAT / endpoint / org is missing.
+	*/
+	static async load(opts = {}) {
+		const config = await loadGlobalConfig();
+		const effective = opts.org ? {
+			...config,
+			activeOrgId: opts.org
+		} : config;
+		return new NotificationsClient(DashboardClient.fromConfig(effective));
+	}
+	async listChannels() {
+		const { channels } = channelsListSchema.parse(await this.dashboard.getJson("notifications/channels"));
+		return channels;
+	}
+	async createChannel(body) {
+		return await this.dashboard.postJson("notifications/channels", body);
+	}
+	async deleteChannel(id) {
+		await this.dashboard.deleteJson(`notifications/channels/${encodeURIComponent(id)}`);
+	}
+	async listSubscriptions() {
+		const { subscriptions } = subscriptionsListSchema.parse(await this.dashboard.getJson("notifications/subscriptions"));
+		return subscriptions;
+	}
+	async createSubscription(body) {
+		return await this.dashboard.postJson("notifications/subscriptions", body);
+	}
+	async deleteSubscription(id) {
+		await this.dashboard.deleteJson(`notifications/subscriptions/${encodeURIComponent(id)}`);
+	}
+	async listIdentities() {
+		const { identities } = identitiesListSchema.parse(await this.dashboard.getJson("notifications/slack/identities"));
+		return identities;
+	}
+	async addIdentity(body) {
+		return await this.dashboard.postJson("notifications/slack/identities", body);
+	}
+	async deleteIdentity(id) {
+		await this.dashboard.deleteJson(`notifications/slack/identities/${encodeURIComponent(id)}`);
+	}
+};
+//#endregion
+export { DashboardClientError, NotificationChannelKind, NotificationScopeKind, NotificationSubLevel, NotificationsClient, RosterInputForm, RosterSubjectKind };
+
+//# sourceMappingURL=notifications-client.js.map

package/dist/remote/oauth.d.ts

@@ -4,6 +4,19 @@ interface PkceFlowOptions {
     issuer: string;
     /** OAuth client ID for the CLI application */
     clientId: string;
+    /**
+     * Delay before the "still waiting" nudge is printed. A testing seam, not a
+     * user-facing knob — no CLI flag or env var sets it.
+     */
+    nudgeAfterMs?: number;
+    /**
+     * How long to wait for the browser callback before giving up. A testing seam,
+     * not a user-facing knob — no CLI flag or env var sets it. The timeout message
+     * states five minutes literally, so a non-default value produces a message
+     * whose duration does not match; that is acceptable only because no user can
+     * set this. Promoting it to a real option means deriving the duration from it.
+     */
+    timeoutMs?: number;
 }
 /** Options for the RFC 8628 device authorization flow. */
 interface DeviceFlowOptions {

package/dist/remote/oauth.js

@@ -78,6 +78,22 @@ const SUCCESS_HTML = `<!DOCTYPE html>
 </body>
 </html>`;
 /**
+* Turn a callback-server `listen` failure into an actionable message.
+*
+* The wording differs by cause on purpose: naming `KICI_CALLBACK_PORT` when the
+* port was ephemeral misdirects the user, and reporting "already in use" for a
+* permission error is a false diagnosis.
+*/
+function describeListenFailure(err, listenPort) {
+	const escapes = "Retry with `kici login --device` (no local callback needed), or set KICI_CALLBACK_PORT to a free port your firewall allows.";
+	if (err.code === "EADDRINUSE") {
+		if (listenPort === 0) return `No local port was available for the login callback server. ${escapes}`;
+		return `Port ${listenPort} (KICI_CALLBACK_PORT) is already in use, so the login callback server could not start. ${escapes}`;
+	}
+	if (err.code === "EACCES") return `Permission denied binding port ${listenPort} (KICI_CALLBACK_PORT) for the login callback server — ports below 1024 need elevated privileges. ${escapes}`;
+	return `Could not start the local callback server on port ${listenPort}: ${err.message}. ${escapes}`;
+}
+/**
 * PKCE authorization code flow with localhost callback.
 *
 * Spins up a temporary HTTP server on a random port, opens the browser
@@ -90,20 +106,20 @@ const SUCCESS_HTML = `<!DOCTYPE html>
 * @returns OIDC access token
 */
 async function pkceFlow(opts) {
-	const { issuer, clientId } = opts;
+	const { issuer, clientId, nudgeAfterMs = 9e4, timeoutMs = 300 * 1e3 } = opts;
 	let listenPort = 0;
 	const callbackPortEnv = process.env.KICI_CALLBACK_PORT;
 	if (callbackPortEnv) {
 		const parsed = parseInt(callbackPortEnv, 10);
-		if (isNaN(parsed) || parsed < 0) throw new Error(`KICI_CALLBACK_PORT must be a valid non-negative integer, got: "${callbackPortEnv}"`);
+		if (isNaN(parsed) || parsed < 0 || parsed > 65535) throw new Error(`KICI_CALLBACK_PORT must be a port number between 0 and 65535, got: "${callbackPortEnv}"`);
 		listenPort = parsed;
 	}
 	const endpoints = await discoverOidcEndpoints(issuer);
 	const { verifier, challenge } = generatePkceChallenge();
 	const state = randomBytes(16).toString("hex");
-	const TIMEOUT_MS = 300 * 1e3;
 	return new Promise((resolve, reject) => {
 		let timer;
+		let nudgeTimer;
 		const server = createServer(async (req, res) => {
 			const url = new URL(req.url, `http://127.0.0.1`);
 			if (url.pathname !== "/callback") {
@@ -111,6 +127,7 @@ async function pkceFlow(opts) {
 				res.end("Not found");
 				return;
 			}
+			if (nudgeTimer) clearTimeout(nudgeTimer);
 			const code = url.searchParams.get("code");
 			const returnedState = url.searchParams.get("state");
 			const error = url.searchParams.get("error");
@@ -167,8 +184,13 @@ async function pkceFlow(opts) {
 		});
 		function cleanup() {
 			if (timer) clearTimeout(timer);
+			if (nudgeTimer) clearTimeout(nudgeTimer);
 			if (server.listening) server.close();
 		}
+		server.on("error", (err) => {
+			cleanup();
+			reject(new Error(describeListenFailure(err, listenPort)));
+		});
 		server.listen(listenPort, "127.0.0.1", () => {
 			const actualPort = server.address().port;
 			const redirectUri = `http://127.0.0.1:${actualPort}/callback`;
@@ -194,15 +216,19 @@ async function pkceFlow(opts) {
 			});
 			else {
 				console.log(pc.cyan("  Opening browser for authentication..."));
+				console.log(pc.dim(`  If it does not open, visit:\n  ${authUrl.toString()}`));
 				open(authUrl.toString()).catch(() => {
 					console.log(pc.yellow(`  Could not open browser automatically. Please visit:\n  ${authUrl.toString()}`));
 				});
 			}
 		});
+		nudgeTimer = setTimeout(() => {
+			console.log(pc.yellow("  Still waiting for the browser callback...\n  If you are still signing in, ignore this. If your browser cannot reach the\n  callback, press Ctrl+C and retry with `kici login --device`."));
+		}, nudgeAfterMs);
 		timer = setTimeout(() => {
 			cleanup();
-			reject(/* @__PURE__ */ new Error("Authentication timed out after 5 minutes. Please try again with `kici login`."));
-		}, TIMEOUT_MS);
+			reject(/* @__PURE__ */ new Error("Authentication timed out after 5 minutes. If your browser cannot reach the local callback, retry with `kici login --device` to authenticate without one."));
+		}, timeoutMs);
 	});
 }
 /** Sleep helper for device flow polling. */

package/dist/remote/output/summary.js

@@ -1,6 +1,7 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { formatDuration } from "@kici-dev/core";
+import { ExecutionJobStatus, ExecutionRunStatus, toCanonicalStatus } from "@kici-dev/engine";
 //#region src/remote/output/summary.ts
 /**
 * Completion summary output formatters.
@@ -73,25 +74,86 @@ function formatMultiFixtureSummary(results) {
 	parts.push(`${total} total`);
 	return `Fixtures: ${parts.join(", ")}`;
 }
+/**
+* Icon-and-label text plus colour for every canonical job status in the
+* summary table.
+*
+* Exhaustive by type: a new engine status breaks this file's typecheck rather
+* than printing an uncoloured raw enum spelling, which carries no severity
+* signal for a status a user needs to spot (`timed_out_stale`, `drift_dropped`).
+*
+* One table, not two: the padding width reads the same `text` the renderer
+* prints, so the icon column and the width reserved for it cannot disagree.
+*/
+const JOB_STATUS_DISPLAY = Object.freeze({
+	[ExecutionRunStatus.enum.success]: {
+		text: "✓ pass",
+		color: pc.green
+	},
+	[ExecutionRunStatus.enum.failed]: {
+		text: "✗ fail",
+		color: pc.red
+	},
+	[ExecutionJobStatus.enum.timed_out_stale]: {
+		text: "✗ timeout",
+		color: pc.red
+	},
+	[ExecutionJobStatus.enum.drift_dropped]: {
+		text: "✗ dropped",
+		color: pc.red
+	},
+	[ExecutionJobStatus.enum.unroutable]: {
+		text: "✗ unroutable",
+		color: pc.red
+	},
+	[ExecutionRunStatus.enum.cancelled]: {
+		text: "! cancel",
+		color: pc.yellow
+	},
+	[ExecutionRunStatus.enum.cancelling]: {
+		text: "! cancelling",
+		color: pc.yellow
+	},
+	[ExecutionJobStatus.enum.recovering]: {
+		text: "~ recovering",
+		color: pc.yellow
+	},
+	[ExecutionRunStatus.enum.held]: {
+		text: "~ held",
+		color: pc.yellow
+	},
+	[ExecutionRunStatus.enum.running]: {
+		text: "> running",
+		color: pc.cyan
+	},
+	[ExecutionJobStatus.enum.queued]: {
+		text: "- queued",
+		color: pc.dim
+	},
+	[ExecutionRunStatus.enum.pending]: {
+		text: "- pending",
+		color: pc.dim
+	},
+	[ExecutionJobStatus.enum.skipped]: {
+		text: "- skip",
+		color: pc.dim
+	}
+});
+/** The status cell's plain text \u2014 the padding width and the rendered cell share it. */
+function statusDisplayText(status) {
+	const canonical = toCanonicalStatus(status.toLowerCase());
+	return canonical !== void 0 ? JOB_STATUS_DISPLAY[canonical].text : status;
+}
 /** Format a job status with icon and color. */
 function formatJobStatus(status) {
-	switch (status) {
-		case "success": return pc.green("✓ pass");
-		case "failed": return pc.red("✗ fail");
-		case "skipped": return pc.dim("- skip");
-		case "cancelled": return pc.yellow("! cancel");
-		default: return status;
-	}
+	const canonical = toCanonicalStatus(status.toLowerCase());
+	if (canonical === void 0) return status;
+	const { text, color } = JOB_STATUS_DISPLAY[canonical];
+	return color(text);
 }
 /** Get the visual text length for a status (for padding). */
 function statusTextLength(status) {
-	switch (status) {
-		case "success": return 6;
-		case "failed": return 6;
-		case "skipped": return 6;
-		case "cancelled": return 8;
-		default: return status.length;
-	}
+	return statusDisplayText(status).length;
 }
 //#endregion
 export { formatErrorHighlight, formatMultiFixtureSummary, formatSummary };

package/dist/remote/platform-client.d.ts

@@ -94,7 +94,7 @@ export interface PlatformTriggerResponse {
     status: 'accepted' | 'rejected';
     reason?: string;
     jobIds?: string[];
-    /** User-visible warnings on acceptance (e.g. skipped non-test bound environments). */
+    /** User-visible warnings on acceptance (e.g. skipped non-test bound contexts). */
     warnings?: string[];
 }
 export interface PlatformRunStatusResponse {

package/dist/remote/render.js

@@ -1,6 +1,7 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import pc from "picocolors";
 import { formatDuration } from "@kici-dev/core";
+import { ExecutionJobStatus, ExecutionRunStatus, toCanonicalStatus } from "@kici-dev/engine";
 //#region src/remote/render.ts
 /** Shared terminal-render helpers for the diagnostics + runs commands. */
 const ANSI_SGR = /\[[0-9;]*m/g;
@@ -21,18 +22,38 @@ function relativeTime(iso, now = Date.now()) {
 	if (hr < 24) return `${hr}h ago`;
 	return `${Math.round(hr / 24)}d ago`;
 }
+/**
+* Terminal colour for every canonical status.
+*
+* Exhaustive by type: a new engine status breaks this file's typecheck rather
+* than falling through to gray, which in a bare terminal reads as "nothing
+* happened".
+*
+* `drift_dropped` is red here although the dashboard badges it gray. The
+* dashboard pairs its colour with a "Drift dropped" label that carries the
+* meaning; the CLI prints the bare status word, so colour is the only severity
+* signal and a dropped job is a failure.
+*/
+const STATUS_COLORIZER = Object.freeze({
+	[ExecutionRunStatus.enum.success]: pc.green,
+	[ExecutionRunStatus.enum.failed]: pc.red,
+	[ExecutionJobStatus.enum.timed_out_stale]: pc.red,
+	[ExecutionJobStatus.enum.drift_dropped]: pc.red,
+	[ExecutionJobStatus.enum.unroutable]: pc.red,
+	[ExecutionRunStatus.enum.running]: pc.cyan,
+	[ExecutionJobStatus.enum.recovering]: pc.yellow,
+	[ExecutionRunStatus.enum.cancelling]: pc.yellow,
+	[ExecutionRunStatus.enum.cancelled]: pc.yellow,
+	[ExecutionRunStatus.enum.held]: pc.yellow,
+	[ExecutionRunStatus.enum.pending]: pc.dim,
+	[ExecutionJobStatus.enum.queued]: pc.dim,
+	[ExecutionJobStatus.enum.skipped]: pc.dim
+});
 /** Color a run/job/step status. picocolors disables itself for NO_COLOR / non-TTY. */
 function colorStatus(status) {
 	if (!pc.isColorSupported) return status;
-	switch (status) {
-		case "success": return pc.green(status);
-		case "failed":
-		case "error":
-		case "timed_out": return pc.red(status);
-		case "running": return pc.cyan(status);
-		case "cancelled": return pc.yellow(status);
-		default: return pc.gray(status);
-	}
+	const canonical = toCanonicalStatus(status.toLowerCase());
+	return canonical !== void 0 ? STATUS_COLORIZER[canonical](status) : pc.gray(status);
 }
 /** Width-aligned ASCII table with a bold header row. */
 function renderTable(headers, rows) {

package/dist/{local-executor → remote}/secret-loader.d.ts

@@ -5,7 +5,7 @@ import type { ParsedSecrets } from '../test-runner/secrets-file.js';
  * Merge order (lowest to highest priority):
  * 1. .kici/.secrets (INI-style, backward compat)
  * 2. .kici/.env.local (dotenv format)
- * 3. .kici/secrets.yaml (YAML with environment scopes, merged flat)
+ * 3. .kici/secrets.yaml (YAML with context scopes, merged flat)
  * 4. --env KEY=VALUE CLI flags
  *
  * Note: process.env is NOT merged here -- it's handled at step-context level.