@kici-dev/compiler 0.1.26 → 0.2.0

package/dist/{local-executor → remote}/secret-loader.js

@@ -3,7 +3,7 @@ import { loadSecretsFile } from "../test-runner/secrets-file.js";
 import path from "node:path";
 import { readFile } from "node:fs/promises";
 import { parse } from "yaml";
-//#region src/local-executor/secret-loader.ts
+//#region src/remote/secret-loader.ts
 /**
 * Parse a dotenv-style file (.env.local) into flat key-value pairs.
 * Lines starting with # are comments. Blank lines are ignored.
@@ -24,8 +24,8 @@ function parseDotenv(content) {
 }
 /**
 * Parse a secrets.yaml file.
-* Expected format: top-level keys are environment names, values are key-value maps.
-* For local execution, all environments are merged flat (no environment resolution).
+* Expected format: top-level keys are context names, values are key-value maps.
+* For local execution, all contexts are merged flat (no context resolution).
 */
 function parseSecretsYaml(content) {
 	const parsed = parse(content);
@@ -66,7 +66,7 @@ async function readFileOrNull(filePath) {
 * Merge order (lowest to highest priority):
 * 1. .kici/.secrets (INI-style, backward compat)
 * 2. .kici/.env.local (dotenv format)
-* 3. .kici/secrets.yaml (YAML with environment scopes, merged flat)
+* 3. .kici/secrets.yaml (YAML with context scopes, merged flat)
 * 4. --env KEY=VALUE CLI flags
 *
 * Note: process.env is NOT merged here -- it's handled at step-context level.

package/dist/remote/secret-upload.d.ts

@@ -6,7 +6,7 @@
  */
 export declare function parseContextFlags(flags: string[] | undefined): Record<string, Record<string, string>>;
 /**
- * Load the developer's local secrets (same sources as `kici run local`: the
+ * Load the developer's local secrets (same sources as `kici run --local`: the
  * `.kici` secret files plus `--env` flat flags) and `--context` namespaced
  * flags, and encrypt them to the orchestrator's per-upload X25519 public key.
  * `--context` values override `.kici/.secrets` file contexts for the same key.

package/dist/remote/secret-upload.js

@@ -1,5 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
-import { loadLocalSecrets } from "../local-executor/secret-loader.js";
+import { loadLocalSecrets } from "./secret-loader.js";
 import { encryptJson } from "@kici-dev/core";
 //#region src/remote/secret-upload.ts
 /**
@@ -25,7 +25,7 @@ function parseContextFlags(flags) {
 	return contexts;
 }
 /**
-* Load the developer's local secrets (same sources as `kici run local`: the
+* Load the developer's local secrets (same sources as `kici run --local`: the
 * `.kici` secret files plus `--env` flat flags) and `--context` namespaced
 * flags, and encrypt them to the orchestrator's per-upload X25519 public key.
 * `--context` values override `.kici/.secrets` file contexts for the same key.

package/dist/remote/uploader.d.ts

@@ -82,7 +82,7 @@ export interface OverlaySelection {
  * When `fullWorkingTree` is set (the `kici run remote` path), the entire
  * `.git` directory is additively included so the extracted overlay is a real
  * git repository on the agent — workflow steps that shell out to git then work
- * exactly as they do under `kici run local`. The `.git` files are added after
+ * exactly as they do under `kici run --local`. The `.git` files are added after
  * `.kiciignore` filtering (git internals are never subject to working-tree
  * ignore globs).
  *

package/dist/remote/uploader.js

@@ -4,9 +4,9 @@ import path from "node:path";
 import fs from "node:fs/promises";
 import { formatBytes, sha256, sha256File } from "@kici-dev/core";
 import { execSync } from "node:child_process";
-import os from "node:os";
-import picomatch from "picomatch";
 import { create } from "tar";
+import { makeTempDir } from "@kici-dev/core/tmp";
+import picomatch from "picomatch";
 //#region src/remote/uploader.ts
 /** Size threshold for warning (50MB) */
 const SIZE_WARN_THRESHOLD = 50 * 1024 * 1024;
@@ -44,7 +44,7 @@ function isGitDirPath(relPath) {
 * clone on the agent — we enumerate the directory explicitly. Including the
 * whole `.git` directory (objects, refs, HEAD, index, config, packed-refs)
 * makes the extracted overlay a real git repository, so workflow steps that
-* shell out to git work exactly as they do under `kici run local`.
+* shell out to git work exactly as they do under `kici run --local`.
 */
 async function collectGitDirFiles(repoRoot) {
 	const gitRoot = path.join(repoRoot, ".git");
@@ -94,7 +94,7 @@ async function loadKiciIgnore(kiciIgnorePath) {
 * When `fullWorkingTree` is set (the `kici run remote` path), the entire
 * `.git` directory is additively included so the extracted overlay is a real
 * git repository on the agent — workflow steps that shell out to git then work
-* exactly as they do under `kici run local`. The `.git` files are added after
+* exactly as they do under `kici run --local`. The `.git` files are added after
 * `.kiciignore` filtering (git internals are never subject to working-tree
 * ignore globs).
 *
@@ -168,14 +168,15 @@ async function createOverlayTarball(repoRoot, options) {
 	const modifiedFiles = workingTreeFiles.filter((f) => !untrackedSet.has(f));
 	const checksums = {};
 	await Promise.all(existingFiles.map(async (file) => {
-		checksums[file] = await sha256File(path.join(repoRoot, file));
+		const fullPath = path.join(repoRoot, file);
+		checksums[file] = await sha256File(fullPath);
 	}));
 	const manifest = {
 		sha,
 		deletions: deletedFiles,
 		checksums
 	};
-	const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "kici-overlay-"));
+	const { path: tmpDir } = await makeTempDir("overlay", { persist: true });
 	const manifestPath = path.join(tmpDir, "manifest.json");
 	await fs.writeFile(manifestPath, JSON.stringify(manifest, null, 2));
 	const manifestRelDir = ".kici-overlay-tmp";

package/dist/templates/agents-md.d.ts

@@ -4,5 +4,5 @@
  * picked up by Claude Code, Cursor, Aider, and other coding agents that scan
  * the working tree for an authoring context file.
  */
-export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `matrix`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`node --version`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n             return { node: matrix.node };\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await $`./scripts/deploy.sh`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici preview pr:open --debug` | Preview which workflows match an event.   |\n| `pnpm kici run local push`      | Execute workflows locally with no orchestrator. |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici preview <event>` to preview matching.\n6. Run `kici run local <event>` to execute locally before pushing.\n";
+export declare const agentsMdTemplate = "# KiCI workflow authoring guide\n\nThis project uses KiCI \u2014 a TypeScript-native CI/CD workflow engine \u2014 instead\nof YAML-based CI. Workflows live in `.kici/workflows/*.ts`, are compiled\ninto a portable lock file, and executed by self-hosted agents.\n\n## Where the API surface lives\n\n- Public SDK types: `node_modules/@kici-dev/sdk/dist/index.d.ts` \u2014 read this\n  for the canonical signatures of `workflow`, `job`, `step`, `pr`,\n  `push`, `schedule`, `rule`, `dynamicJob`, etc.\n- Bundled offline reference for coding agents: `kici docs llm` prints the\n  full markdown documentation bundle to stdout. `kici docs llm --index`\n  prints just the curated link index (llms.txt format).\n- Online docs:\n  - <https://kici.dev/docs/> \u2014 published docs site.\n  - <https://kici.dev/llms.txt> \u2014 curated index for LLM consumers.\n  - <https://kici.dev/llms-full.txt> \u2014 full markdown bundle.\n  - Key pages: `user/sdk-reference`, `user/workflow-patterns`,\n    `user/testing-guide`, `user/hooks`, `user/secrets`.\n\n## The five core patterns\n\n1. **Push trigger** \u2014 `on: push({ branches: 'main' })`. Pair with `paths`\n   to scope to subtrees.\n\n   ```ts\n   import { workflow, job, step, push } from '@kici-dev/sdk';\n\n   export default workflow('build', {\n     on: push({ branches: 'main' }),\n     jobs: [\n       job('build', {\n         runsOn: 'kici:os:linux',\n         steps: [step('install', async ({ $ }) => { await $`pnpm install`; })],\n       }),\n     ],\n   });\n   ```\n\n   `kici:os:linux` targets any agent reporting that OS \u2014 every agent\n   self-reports `kici:os:` / `kici:arch:` / `kici:host:`. Use a custom label\n   (e.g. `'gpu'`, `'prod-pool'`) to target a specific agent pool your scaler\n   defines.\n\n2. **PR + matrix** \u2014 `pr({ target: 'main' })` plus a matrix over node\n   versions. The matrix expands at dispatch time.\n\n   ```ts\n   import { workflow, job, step, pr } from '@kici-dev/sdk';\n\n   export default workflow('test-matrix', {\n     on: pr({ target: 'main' }),\n     jobs: [\n       job('test', {\n         runsOn: 'kici:os:linux',\n         matrix: { node: ['20', '22', '24'] },\n         steps: [\n           step('test', async ({ $, matrix }) => {\n             await $`echo testing on node ${matrix!.node}`;\n             await $`pnpm install`;\n             await $`pnpm test`;\n           }),\n         ],\n       }),\n     ],\n   });\n   ```\n\n3. **Lifecycle hooks** \u2014 `onFailure` / `onSuccess` / `onCancel` on a\n   job or workflow run after the main steps in their own scope.\n\n4. **Secrets** \u2014 declared scopes resolve at dispatch:\n\n   ```ts\n   step('deploy', async ({ $, secrets }) => {\n     await secrets.expose('DEPLOY_TOKEN');\n     await $`./scripts/deploy.sh`;\n   });\n   ```\n\n   Run `kici secrets list` to enumerate the contexts available for testing.\n\n5. **Dynamic jobs** \u2014 `dynamicJob` and `dynamicGroup` build the DAG at\n   runtime from a step's outputs. Don't try to compute job names at top level;\n   the lock file would be wrong.\n\n## Anti-patterns\n\n- **Do NOT write `.yml` / `.yaml` CI files** \u2014 KiCI replaces that entire\n  layer. There is no compatibility shim.\n- **Do NOT `import` from any `@kici-dev/*` package's `/dist/...`\n  subpath** \u2014 those are not part of the public API and break across versions.\n  Import from the package root.\n- **Do NOT `await` outside step bodies.** The top-level workflow file is\n  loaded by the compiler synchronously; async I/O at module scope means the\n  lock file emits before it resolves and the workflow appears empty.\n- **Do NOT mutate shared variables between jobs.** Each job runs in its own\n  agent process. Use `needs` + step outputs to thread values.\n- **Do NOT hand-edit `kici.lock.json`.** Regenerate it via `kici compile`.\n\n## Local commands a coding agent should run\n\n| Command                         | Purpose                                     |\n| ------------------------------- | ------------------------------------------- |\n| `pnpm kici compile --check`     | Validate workflow source without writing.   |\n| `pnpm kici preview pr:open --debug` | Preview which workflows match an event.   |\n| `pnpm kici run push --local`    | Execute a workflow locally (this machine as an ephemeral agent). |\n| `pnpm kici docs llm`            | Print the full LLM documentation bundle.    |\n| `pnpm kici docs llm --index`    | Print the curated link index.               |\n\nIf `pnpm kici` isn't in scripts, fall back to `npx kici`.\n\n## Loop\n\n1. Read the SDK types from `node_modules/@kici-dev/sdk/dist/index.d.ts`.\n2. Pipe `kici docs llm` into the agent's context if it doesn't already have\n   the full bundle.\n3. Edit a workflow under `.kici/workflows/`.\n4. Run `kici compile --check` (zero exit means valid).\n5. Run `kici preview <event>` to preview matching.\n6. Run `kici run <event> --local` to execute locally before pushing.\n";
 //# sourceMappingURL=agents-md.d.ts.map

package/dist/templates/agents-md.js

@@ -16,7 +16,7 @@ into a portable lock file, and executed by self-hosted agents.
 
 - Public SDK types: \`node_modules/@kici-dev/sdk/dist/index.d.ts\` — read this
   for the canonical signatures of \`workflow\`, \`job\`, \`step\`, \`pr\`,
-  \`push\`, \`schedule\`, \`matrix\`, \`rule\`, \`dynamicJob\`, etc.
+  \`push\`, \`schedule\`, \`rule\`, \`dynamicJob\`, etc.
 - Bundled offline reference for coding agents: \`kici docs llm\` prints the
   full markdown documentation bundle to stdout. \`kici docs llm --index\`
   prints just the curated link index (llms.txt format).
@@ -55,20 +55,19 @@ into a portable lock file, and executed by self-hosted agents.
    versions. The matrix expands at dispatch time.
 
    \`\`\`ts
-   import { workflow, job, step, pr, matrix } from '@kici-dev/sdk';
+   import { workflow, job, step, pr } from '@kici-dev/sdk';
 
    export default workflow('test-matrix', {
      on: pr({ target: 'main' }),
      jobs: [
        job('test', {
          runsOn: 'kici:os:linux',
-         strategy: { matrix: matrix({ node: ['20', '22', '24'] }) },
+         matrix: { node: ['20', '22', '24'] },
          steps: [
            step('test', async ({ $, matrix }) => {
-             await $\`node --version\`;
+             await $\`echo testing on node \${matrix!.node}\`;
              await $\`pnpm install\`;
              await $\`pnpm test\`;
-             return { node: matrix.node };
            }),
          ],
        }),
@@ -83,7 +82,8 @@ into a portable lock file, and executed by self-hosted agents.
 
    \`\`\`ts
    step('deploy', async ({ $, secrets }) => {
-     await $\`./scripts/deploy.sh\`.env({ DEPLOY_TOKEN: secrets.production.DEPLOY_TOKEN });
+     await secrets.expose('DEPLOY_TOKEN');
+     await $\`./scripts/deploy.sh\`;
    });
    \`\`\`
 
@@ -113,7 +113,7 @@ into a portable lock file, and executed by self-hosted agents.
 | ------------------------------- | ------------------------------------------- |
 | \`pnpm kici compile --check\`     | Validate workflow source without writing.   |
 | \`pnpm kici preview pr:open --debug\` | Preview which workflows match an event.   |
-| \`pnpm kici run local push\`      | Execute workflows locally with no orchestrator. |
+| \`pnpm kici run push --local\`    | Execute a workflow locally (this machine as an ephemeral agent). |
 | \`pnpm kici docs llm\`            | Print the full LLM documentation bundle.    |
 | \`pnpm kici docs llm --index\`    | Print the curated link index.               |
 
@@ -127,7 +127,7 @@ If \`pnpm kici\` isn't in scripts, fall back to \`npx kici\`.
 3. Edit a workflow under \`.kici/workflows/\`.
 4. Run \`kici compile --check\` (zero exit means valid).
 5. Run \`kici preview <event>\` to preview matching.
-6. Run \`kici run local <event>\` to execute locally before pushing.
+6. Run \`kici run <event> --local\` to execute locally before pushing.
 `;
 //#endregion
 export { agentsMdTemplate };

package/dist/templates/index.d.ts

@@ -5,7 +5,7 @@
  */
 export { helloWorldWorkflow } from './workflows/hello-world.js';
 export { prChecksWorkflow } from './workflows/pr-checks.js';
-export { generatePackageJson } from './package-json.js';
+export { generatePackageJson, sdkDependencyRange } from './package-json.js';
 export { tsconfigTemplate } from './tsconfig-json.js';
 export { agentsMdTemplate } from './agents-md.js';
 /**

package/dist/templates/index.js

@@ -3,7 +3,7 @@ import { agentsMdTemplate } from "./agents-md.js";
 import { helloWorldWorkflow } from "./workflows/hello-world.js";
 import { prChecksWorkflow } from "./workflows/pr-checks.js";
 import { tsconfigTemplate } from "./tsconfig-json.js";
-import { generatePackageJson } from "./package-json.js";
+import { generatePackageJson, sdkDependencyRange } from "./package-json.js";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 //#region src/templates/index.ts
@@ -43,6 +43,6 @@ const templates = {
 	tsconfig: tsconfigTemplate
 };
 //#endregion
-export { agentsMdTemplate, generatePackageJson, helloWorldWorkflow, prChecksWorkflow, templates, tsconfigTemplate, workflowPaths, workflows };
+export { agentsMdTemplate, generatePackageJson, helloWorldWorkflow, prChecksWorkflow, sdkDependencyRange, templates, tsconfigTemplate, workflowPaths, workflows };
 
 //# sourceMappingURL=index.js.map

package/dist/templates/package-json.d.ts

@@ -6,6 +6,21 @@
  * (or a private Verdaccio instance when .npmrc scopes the registry).
  * The compiler is invoked via npx (not installed as a dependency).
  */
+/**
+ * The npm version range the scaffold pins `@kici-dev/sdk` to.
+ *
+ * @param devMode - When true, a prerelease-compatible range (`>=0.0.1-0`) so
+ *   npm resolves Verdaccio's prerelease builds (e.g. 0.0.1-2856). Semver
+ *   `^0.0.1` does NOT match prereleases, causing 404s on Verdaccio.
+ */
+export declare function sdkDependencyRange(devMode?: boolean): string;
+/**
+ * The TypeScript range scaffolded into a `.kici` workspace. Pinned to the major
+ * the compiler is built against so `kici compile --check` (and the `typecheck`
+ * script) run the same tsc the compiler expects. Same range in dev and prod
+ * mode — TypeScript is a public npm package, not a Verdaccio prerelease.
+ */
+export declare const TYPESCRIPT_RANGE = "^6.0.3";
 /**
  * Generate package.json content for .kici/ directory
  *

package/dist/templates/package-json.js

@@ -1,6 +1,23 @@
 import "../rolldown-runtime-ClRpJifh.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.1.26";
+const sdkVersion = "0.2.0";
+/**
+* The npm version range the scaffold pins `@kici-dev/sdk` to.
+*
+* @param devMode - When true, a prerelease-compatible range (`>=0.0.1-0`) so
+*   npm resolves Verdaccio's prerelease builds (e.g. 0.0.1-2856). Semver
+*   `^0.0.1` does NOT match prereleases, causing 404s on Verdaccio.
+*/
+function sdkDependencyRange(devMode = false) {
+	return devMode ? ">=0.0.1-0" : `^${sdkVersion}`;
+}
+/**
+* The TypeScript range scaffolded into a `.kici` workspace. Pinned to the major
+* the compiler is built against so `kici compile --check` (and the `typecheck`
+* script) run the same tsc the compiler expects. Same range in dev and prod
+* mode — TypeScript is a public npm package, not a Verdaccio prerelease.
+*/
+const TYPESCRIPT_RANGE = "^6.0.3";
 /**
 * Generate package.json content for .kici/ directory
 *
@@ -10,7 +27,7 @@ const sdkVersion = "0.1.26";
 * @returns JSON string with proper formatting (2-space indent, trailing newline)
 */
 function generatePackageJson(devMode = false) {
-	return JSON.stringify({
+	const pkg = {
 		name: "@kici-dev/workflows",
 		private: true,
 		type: "module",
@@ -18,10 +35,14 @@ function generatePackageJson(devMode = false) {
 			compile: "npx --yes kici@latest compile",
 			typecheck: "tsc --noEmit"
 		},
-		devDependencies: { "@kici-dev/sdk": devMode ? ">=0.0.1-0" : `^${sdkVersion}` }
-	}, null, 2) + "\n";
+		devDependencies: {
+			"@kici-dev/sdk": sdkDependencyRange(devMode),
+			typescript: TYPESCRIPT_RANGE
+		}
+	};
+	return JSON.stringify(pkg, null, 2) + "\n";
 }
 //#endregion
-export { generatePackageJson };
+export { TYPESCRIPT_RANGE, generatePackageJson, sdkDependencyRange };
 
 //# sourceMappingURL=package-json.js.map

package/dist/test-runner/dry-run.d.ts

@@ -1,4 +1,5 @@
 import type { LockWorkflow } from '../types.js';
+import type { JobPurityWarning } from '../lockfile/purity-diagnostics.js';
 import type { WorkflowDecision } from '@kici-dev/engine';
 interface DryRunOptions {
     workflow?: string;
@@ -7,6 +8,6 @@ interface DryRunOptions {
 /**
  * Display dry-run output showing what would execute.
  */
-export declare function displayDryRun(workflows: readonly LockWorkflow[], decisions: WorkflowDecision[], options: DryRunOptions): void;
+export declare function displayDryRun(workflows: readonly LockWorkflow[], decisions: WorkflowDecision[], options: DryRunOptions, purityWarnings?: JobPurityWarning[]): void;
 export {};
 //# sourceMappingURL=dry-run.d.ts.map

package/dist/test-runner/dry-run.js

@@ -3,11 +3,26 @@ import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/dry-run.ts
 /**
+* Print the injected `__init__` job line for each impure dynamic value on a job,
+* so the ~5-10s init-job cost is visible before the first run. Returns the number
+* of lines rendered so the caller can count the jobs it actually surfaced.
+*/
+function renderJobInitWarnings(purityWarnings, workflowName, jobName) {
+	let rendered = 0;
+	for (const w of purityWarnings) {
+		if (w.workflowName !== workflowName || w.jobName !== jobName) continue;
+		logger.info(pc.yellow(`      ⚠ __init__ job required (~5-10s): ${w.field} is not pure — ${w.reason}`));
+		rendered++;
+	}
+	return rendered;
+}
+/**
 * Display dry-run output showing what would execute.
 */
-function displayDryRun(workflows, decisions, options) {
+function displayDryRun(workflows, decisions, options, purityWarnings = []) {
 	logger.info(pc.bold("\n🔍 DRY RUN - No commands will be executed\n"));
 	const matchedWorkflows = decisions.filter((d) => d.matched);
+	const injectedInitJobs = /* @__PURE__ */ new Set();
 	if (matchedWorkflows.length === 0) {
 		logger.info(pc.yellow("No workflows matched the event.\n"));
 		displayDecisionSummary(decisions);
@@ -33,6 +48,7 @@ function displayDryRun(workflows, decisions, options) {
 			else logger.info(pc.gray(`      matrix: [dynamic]`));
 			logger.info(pc.gray(`      steps (${job.steps.length}):`));
 			for (const step of job.steps) logger.info(pc.gray(`        - ${step.name}`));
+			if (renderJobInitWarnings(purityWarnings, decision.workflowName, job.name) > 0) injectedInitJobs.add(`${decision.workflowName} ${job.name}`);
 		}
 		const dynamicJobs = workflow.jobs.filter((j) => j._type === "dynamic");
 		if (dynamicJobs.length > 0) {
@@ -41,6 +57,7 @@ function displayDryRun(workflows, decisions, options) {
 		}
 		logger.info("");
 	}
+	if (injectedInitJobs.size > 0) logger.info(pc.yellow(`⚠ ${injectedInitJobs.size} __init__ job(s) will be injected for impure dynamic values (~5-10s each).`));
 	displayDecisionSummary(decisions);
 	logger.info(pc.green("✓ Dry run complete\n"));
 }

package/dist/test-runner/event-types.d.ts

@@ -51,6 +51,8 @@ export type EventType = {
     type: 'workflow_complete';
     workflowName: string;
     status: string;
+} | {
+    type: 'workflows_failed_batch';
 } | {
     type: 'job_complete';
     workflowName: string;

package/dist/test-runner/event-types.js

@@ -169,6 +169,7 @@ function parseEventArg(arg) {
 			workflowName: "test",
 			status: "cancelled"
 		};
+		case "workflows_failed_batch": return { type: "workflows_failed_batch" };
 		case "job_complete": return {
 			type: "job_complete",
 			workflowName: "test",
@@ -256,6 +257,7 @@ function triggerToEventArg(trigger) {
 			const status = trigger.status?.[0];
 			return status ? `workflow_complete:${status}` : "workflow_complete";
 		}
+		case "workflows_failed_batch": return "workflows_failed_batch";
 		case "job_complete": {
 			const status = trigger.status?.[0];
 			return status ? `job_complete:${status}` : "job_complete";
@@ -317,6 +319,7 @@ function triggerSummary(trigger) {
 		case "webhook": return `webhook(${joinList(trigger.events)})`;
 		case "kici_event": return `kici_event(${trigger.eventName})`;
 		case "workflow_complete": return `workflow_complete(${trigger.name ? `${trigger.name}` : "*"}${trigger.status?.length ? `, ${joinList(trigger.status)}` : ""})`;
+		case "workflows_failed_batch": return `workflows_failed_batch(${trigger.name ? `${trigger.name}` : "*"}, ${trigger.accumulateFor}ms)`;
 		case "job_complete": return `job_complete(${trigger.workflow ?? "*"}${trigger.job ? `.${trigger.job}` : ""}${trigger.status?.length ? `, ${joinList(trigger.status)}` : ""})`;
 		case "generic_webhook": return `webhook(${trigger.source})`;
 		case "schedule": return `schedule('${trigger.cronExpression}')`;

package/dist/test-runner/job-executor.d.ts

@@ -39,6 +39,7 @@ interface WorkflowResult {
     durationMs: number;
     jobs: JobResult[];
     ruleResults?: RuleResult[];
+    error?: Error;
 }
 /**
  * Execute a job sequentially (steps run in order).

package/dist/test-runner/job-executor.js

@@ -1,8 +1,8 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { formatter } from "./output-formatter.js";
 import { createStepContext } from "./step-context.js";
-import { createRuleContext, evaluateRules as evaluateRulesWithFormatting } from "./rule-evaluator.js";
-import { localRunsOnString } from "../local-executor/runs-on-display.js";
+import { createRuleContext as createRuleContext$1, evaluateRules as evaluateRulesWithFormatting } from "./rule-evaluator.js";
+import { localRunsOnString } from "./runs-on-display.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
 import pc from "picocolors";
@@ -73,11 +73,23 @@ async function executeJob(job, workflowName, event, repoRoot, testSecrets, sdkSe
 	const stepResults = [];
 	let ruleResults;
 	if (job.rules && job.rules.length > 0) {
-		const ruleContext = createRuleContext(event, event.changedFiles);
+		const ruleContext = createRuleContext$1({
+			event,
+			changedFiles: event.changedFiles,
+			changedFilesStatus: event.changedFilesStatus ?? "fetched"
+		});
 		const ruleEval = await evaluateRulesWithFormatting(job.rules, ruleContext, job.name);
 		ruleResults = ruleEval.results;
 		if (!ruleEval.allPassed) {
 			const durationMs = Date.now() - startTime;
+			if (ruleEval.evaluationError) return {
+				name: job.name,
+				status: "failure",
+				durationMs,
+				steps: [],
+				ruleResults,
+				error: /* @__PURE__ */ new Error(`rule '${ruleEval.evaluationError.label}' errored: ${ruleEval.evaluationError.message}`)
+			};
 			return {
 				name: job.name,
 				status: "skipped",
@@ -93,51 +105,61 @@ async function executeJob(job, workflowName, event, repoRoot, testSecrets, sdkSe
 	setters.setStepRefMap(refMap);
 	setStepOutputsMap(outputsMap);
 	setStepRefMap(refMap);
-	const ctx = createStepContext({ name: workflowName }, {
+	const { ctx, dispose } = createStepContext({ name: workflowName }, {
 		name: job.name,
 		runsOn: localRunsOnString(job.runsOn)
 	}, repoRoot, void 0, void 0, testSecrets, void 0, event.payload, event.provider);
-	let stepCounter = 0;
-	for (const stepOrFn of job.steps) {
-		let normalizedStep;
-		if (typeof stepOrFn === "function") {
-			stepCounter++;
-			const name = `step-${stepCounter}`;
-			refMap.set(stepOrFn, name);
-			normalizedStep = {
-				_tag: "Step",
-				name,
-				run: stepOrFn
-			};
-		} else {
-			normalizedStep = stepOrFn;
-			if (!normalizedStep.name) stepCounter++;
-		}
-		const result = await executeStep(normalizedStep, ctx, job.name);
-		if (result.status === "success" && result.outputs != null) outputsMap.set(normalizedStep.name, result.outputs);
-		stepResults.push(result);
-		if (result.status === "failure") {
-			const durationMs = Date.now() - startTime;
-			formatter.logJobFailure(job.name, durationMs, result.error);
-			return {
-				name: job.name,
-				status: "failure",
-				durationMs,
-				steps: stepResults,
-				ruleResults,
-				error: result.error
-			};
+	try {
+		let stepCounter = 0;
+		for (const stepOrFn of job.steps) {
+			let normalizedStep;
+			if (typeof stepOrFn === "function") {
+				stepCounter++;
+				const name = `step-${stepCounter}`;
+				refMap.set(stepOrFn, name);
+				normalizedStep = {
+					_tag: "Step",
+					name,
+					run: stepOrFn
+				};
+			} else {
+				normalizedStep = stepOrFn;
+				if (!normalizedStep.name) {
+					stepCounter++;
+					normalizedStep.name = `step-${stepCounter}`;
+				}
+			}
+			const result = await executeStep(normalizedStep, ctx, job.name);
+			if (result.status === "success" && result.outputs != null) outputsMap.set(normalizedStep.name, result.outputs);
+			stepResults.push(result);
+			if (result.status === "failure") {
+				const durationMs = Date.now() - startTime;
+				formatter.logJobFailure(job.name, durationMs, result.error);
+				return {
+					name: job.name,
+					status: "failure",
+					durationMs,
+					steps: stepResults,
+					ruleResults,
+					error: result.error
+				};
+			}
 		}
+		const durationMs = Date.now() - startTime;
+		formatter.logJobComplete(job.name, durationMs);
+		return {
+			name: job.name,
+			status: "success",
+			durationMs,
+			steps: stepResults,
+			ruleResults
+		};
+	} finally {
+		await dispose().catch((err) => {
+			const message = err instanceof Error ? err.message : String(err);
+			logger.warn(`local job temp scope cleanup failed: ${message}`);
+		});
 	}
-	const durationMs = Date.now() - startTime;
-	formatter.logJobComplete(job.name, durationMs);
-	return {
-		name: job.name,
-		status: "success",
-		durationMs,
-		steps: stepResults,
-		ruleResults
-	};
 }
 /**
 * Execute a workflow with parallel job execution.
@@ -149,11 +171,27 @@ async function executeWorkflow(workflow, event, repoRoot, testSecrets, kiciDir)
 	const sdkSetters = await resolveSdkSetters(kiciDir);
 	let ruleResults;
 	if (workflow.rules && workflow.rules.length > 0) {
-		const ruleContext = createRuleContext(event, event.changedFiles);
+		const ruleContext = createRuleContext$1({
+			event,
+			changedFiles: event.changedFiles,
+			changedFilesStatus: event.changedFilesStatus ?? "fetched"
+		});
 		const ruleEval = await evaluateRulesWithFormatting(workflow.rules, ruleContext, workflow.name);
 		ruleResults = ruleEval.results;
 		if (!ruleEval.allPassed) {
 			const durationMs = Date.now() - startTime;
+			if (ruleEval.evaluationError) {
+				const error = /* @__PURE__ */ new Error(`rule '${ruleEval.evaluationError.label}' errored: ${ruleEval.evaluationError.message}`);
+				logger.info(pc.red(`\n✗ Workflow failed: ${error.message}\n`));
+				return {
+					name: workflow.name,
+					status: "failure",
+					durationMs,
+					jobs: [],
+					ruleResults,
+					error
+				};
+			}
 			logger.info(pc.yellow(`\n⚠ Workflow skipped due to rule failure\n`));
 			return {
 				name: workflow.name,

package/dist/test-runner/output-formatter.d.ts

@@ -1,3 +1,4 @@
+import type { RuleResult } from '@kici-dev/sdk';
 type ColorFn = (text: string) => string;
 /**
  * Output formatter that prefixes messages with colored job labels.
@@ -38,9 +39,11 @@ declare class OutputFormatter {
      */
     logJobFailure(jobName: string, durationMs: number, error: Error): void;
     /**
-     * Log rule evaluation.
+     * Log rule evaluation. A rule whose `check()` threw carries an `error`; it
+     * prints `✗ errored: <message>` so the author sees the crash reason instead of
+     * a bare `✗ failed`. A clean pass/false prints `✓ passed` / `✗ failed`.
      */
-    logRuleResult(jobName: string, ruleLabel: string, passed: boolean): void;
+    logRuleResult(jobName: string, result: RuleResult): void;
 }
 export declare const formatter: OutputFormatter;
 export {};

package/dist/test-runner/output-formatter.js

@@ -77,12 +77,14 @@ var OutputFormatter = class {
 		logger.error(color(`[${jobName}]`) + pc.red(` ✗ Failed: ${error.message}`) + pc.gray(` (${durationMs}ms)`));
 	}
 	/**
-	* Log rule evaluation.
+	* Log rule evaluation. A rule whose `check()` threw carries an `error`; it
+	* prints `✗ errored: <message>` so the author sees the crash reason instead of
+	* a bare `✗ failed`. A clean pass/false prints `✓ passed` / `✗ failed`.
 	*/
-	logRuleResult(jobName, ruleLabel, passed) {
+	logRuleResult(jobName, result) {
 		const color = this.getJobColor(jobName);
-		const status = passed ? pc.green("✓ passed") : pc.red("✗ failed");
-		logger.info(color(`[${jobName}]`) + pc.gray(` rule "${ruleLabel}": `) + status);
+		const status = result.error ? pc.red(`✗ errored: ${result.error}`) : result.passed ? pc.green("✓ passed") : pc.red("✗ failed");
+		logger.info(color(`[${jobName}]`) + pc.gray(` rule "${result.label}": `) + status);
 	}
 };
 const formatter = new OutputFormatter();

package/dist/test-runner/payload-builder.d.ts

@@ -1,4 +1,4 @@
-import type { SimulatedEvent } from '@kici-dev/engine';
+import type { SimulatedEvent, ChangedFilesStatus } from '@kici-dev/engine';
 export interface PayloadOptions {
     /** Path to custom fixture file */
     payload?: string;
@@ -12,6 +12,12 @@ export interface PayloadOptions {
     sha?: string;
     /** Simulate changed file paths for onChangedFiles trigger matching */
     files?: string[];
+    /**
+     * Simulate `changedFiles` availability for rule evaluation. Defaults to
+     * `'fetched'` (the author's file list is a genuine diff); set `'unavailable'`
+     * to test a rule's `ctx.changedFilesStatus` guard on a diff-less event.
+     */
+    changedFilesStatus?: ChangedFilesStatus;
 }
 /**
  * Build event payload from default fixture, custom file, and CLI overrides.