@kici-dev/compiler 0.1.26 → 0.2.0

package/dist/commands/login.d.ts

@@ -9,6 +9,8 @@ export interface LoginOptions {
     routingKey?: string;
     /** Force device authorization flow regardless of environment */
     device?: boolean;
+    /** Skip the post-login "attach the local dev plane?" prompt (scripted logins). */
+    noAttachPrompt?: boolean;
 }
 /**
  * Authenticate with KiCI.

package/dist/commands/login.js

@@ -2,6 +2,7 @@ import "../rolldown-runtime-ClRpJifh.js";
 import { getConfigPath, loadGlobalConfig, mergeGlobalConfig, saveGlobalConfig } from "../remote/config.js";
 import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
 import "../remote/prod-defaults.js";
+import { attachPlane, planeStatus } from "../local-plane/plane-manager.js";
 import { isHeadless } from "../auth/headless-detect.js";
 import pc from "picocolors";
 import { toErrorMessage } from "@kici-dev/core";
@@ -52,7 +53,7 @@ async function oauthLogin(options) {
 	const clientId = process.env.KICI_OIDC_CLIENT_ID || "kici-cli";
 	console.log(pc.cyan("\n  Step 1/4: Detecting environment..."));
 	const browserCmdSet = !!process.env.KICI_BROWSER_CMD;
-	const useDeviceFlow = options.device || !browserCmdSet && isHeadless();
+	const useDeviceFlow = options.device || !browserCmdSet && await isHeadless();
 	const flowName = useDeviceFlow ? "device authorization" : "PKCE (browser)";
 	console.log(pc.gray(`  Using ${flowName} flow`));
 	console.log(pc.cyan(`\n  Step 2/4: Authenticating with IdP (${flowName})...`));
@@ -92,9 +93,48 @@ async function oauthLogin(options) {
 	console.log(pc.gray(`  PAT expires: ${expiryDate}`));
 	console.log(pc.gray(`  Config saved to ${configPath}`));
 	checkPatExpiry(patResult.expiresAt);
+	await maybePromptAttach(options, {
+		apiBase: platformUrl,
+		pat: patResult.token,
+		orgId: next.activeOrgId
+	});
 	return true;
 }
 /**
+* After a successful login, prompt an interactive user to attach their local
+* dev plane to the Platform. Skipped entirely for non-TTY / piped input, when
+* `--no-attach` is set, when no org is selected (nothing to attach against), or
+* when a plane is already attached. Any failure here is non-fatal — login has
+* already succeeded.
+*/
+async function maybePromptAttach(options, ctx) {
+	try {
+		if (options.noAttachPrompt) return;
+		if (!process.stdin.isTTY) return;
+		if (!ctx.orgId) {
+			console.log(pc.gray("\n  Tip: select an org (`kici org use <org>`) then `kici local attach` to use real Platform identity for `kici run --local`."));
+			return;
+		}
+		if ((await planeStatus()).mode === "hybrid") return;
+		console.log("\n  You don't have your local dev plane attached to the Platform.\n  Attach it so `kici run --local` uses real Platform secrets & identity?");
+		const answer = (await promptInput("  Attach now? [Y/n] ")).toLowerCase();
+		if (answer === "n" || answer === "no") {
+			console.log(pc.gray("  Left offline. Re-attach later with `kici local attach`."));
+			return;
+		}
+		console.log(pc.cyan("\n  Attaching the local dev plane…"));
+		const status = await attachPlane({
+			apiBase: ctx.apiBase,
+			pat: ctx.pat,
+			orgId: ctx.orgId
+		});
+		console.log(pc.green(`  ✓ Attached (hybrid) at ${status.url ?? ""} — \`kici run --local\` is now connected.`));
+	} catch (err) {
+		console.log(pc.yellow(`  Could not attach the local dev plane: ${toErrorMessage(err)}`));
+		console.log(pc.gray("  Login succeeded; attach later with `kici local attach`."));
+	}
+}
+/**
 * Authenticate with KiCI.
 *
 * - With `--token`, saves the API key directly (legacy flow)

package/dist/commands/logout.js

@@ -1,5 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { getConfigPath, loadGlobalConfig, saveGlobalConfig } from "../remote/config.js";
+import { detachPlane, planeStatus } from "../local-plane/plane-manager.js";
 import pc from "picocolors";
 //#region src/commands/logout.ts
 /**
@@ -37,6 +38,12 @@ async function logoutCommand() {
 	} catch {
 		console.log(pc.yellow("Warning: could not revoke PAT on server (will expire automatically)."));
 	}
+	try {
+		if ((await planeStatus()).mode === "hybrid") {
+			await detachPlane({ pat: config.pat });
+			console.log(pc.gray("Local dev plane detached (back to offline)."));
+		}
+	} catch {}
 	const cleanConfig = { ...config };
 	delete cleanConfig.pat;
 	delete cleanConfig.patId;

package/dist/commands/notifications.d.ts

@@ -0,0 +1,61 @@
+/**
+ * kici notifications commands
+ *
+ * Customer self-service management of an org's notification configuration —
+ * channels, subscriptions, and the Layer 1 Slack-identity roster — under the
+ * logged-in user's PAT against the hosted Platform's org-scoped HTTP API. This
+ * is a tenant-plane developer operation, so it lives in the public `kici` CLI
+ * (like `kici org` / `kici verify-attestation`), never the DB-direct
+ * `kici-platform-admin`.
+ */
+/** Options common to every notifications subcommand. */
+export interface NotificationsCommonOptions {
+    /** Target organization id (overrides the saved active org). */
+    org?: string;
+}
+/** Options for the `list` leaves. */
+export interface NotificationsListOptions extends NotificationsCommonOptions {
+    json?: boolean;
+}
+/** Options for `channels add`. */
+export interface ChannelsAddOptions extends NotificationsCommonOptions {
+    type?: string;
+    name?: string;
+    connection?: string;
+    slackChannel?: string;
+    fromName?: string;
+    replyTo?: string;
+}
+/** Options for `subscriptions add`. */
+export interface SubscriptionsAddOptions extends NotificationsCommonOptions {
+    channel?: string;
+    level?: string;
+    scope?: string;
+    scopeId?: string;
+    onStatus?: string;
+    repoGlob?: string;
+    workflowGlob?: string;
+    jobGlob?: string;
+    mentions?: string;
+    recipientOverride?: string;
+    onFailureClass?: string;
+    accumulateFor?: string;
+}
+/** Options for `roster add`. */
+export interface RosterAddOptions extends NotificationsCommonOptions {
+    connection?: string;
+    subjectKind?: string;
+    subject?: string;
+    inputForm?: string;
+    value?: string;
+}
+export declare function notificationsChannelsListCommand(opts: NotificationsListOptions): Promise<boolean>;
+export declare function notificationsChannelsAddCommand(opts: ChannelsAddOptions): Promise<boolean>;
+export declare function notificationsChannelsRemoveCommand(id: string, opts: NotificationsCommonOptions): Promise<boolean>;
+export declare function notificationsSubscriptionsListCommand(opts: NotificationsListOptions): Promise<boolean>;
+export declare function notificationsSubscriptionsAddCommand(opts: SubscriptionsAddOptions): Promise<boolean>;
+export declare function notificationsSubscriptionsRemoveCommand(id: string, opts: NotificationsCommonOptions): Promise<boolean>;
+export declare function notificationsRosterListCommand(opts: NotificationsListOptions): Promise<boolean>;
+export declare function notificationsRosterAddCommand(opts: RosterAddOptions): Promise<boolean>;
+export declare function notificationsRosterRemoveCommand(id: string, opts: NotificationsCommonOptions): Promise<boolean>;
+//# sourceMappingURL=notifications.d.ts.map

package/dist/commands/notifications.js

@@ -0,0 +1,274 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import { DashboardClientError } from "../remote/dashboard-client.js";
+import { NotificationChannelKind, NotificationScopeKind, NotificationSubLevel, NotificationsClient, RosterInputForm, RosterSubjectKind } from "../remote/notifications-client.js";
+import pc from "picocolors";
+import { toErrorMessage } from "@kici-dev/core";
+//#region src/commands/notifications.ts
+/**
+* kici notifications commands
+*
+* Customer self-service management of an org's notification configuration —
+* channels, subscriptions, and the Layer 1 Slack-identity roster — under the
+* logged-in user's PAT against the hosted Platform's org-scoped HTTP API. This
+* is a tenant-plane developer operation, so it lives in the public `kici` CLI
+* (like `kici org` / `kici verify-attestation`), never the DB-direct
+* `kici-platform-admin`.
+*/
+/** Split a comma-separated flag value into a trimmed, non-empty list. */
+function parseCsv(value) {
+	if (!value) return [];
+	return value.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/** Print a simple padded table. */
+function printTable(headers, rows) {
+	if (rows.length === 0) {
+		console.log(pc.gray("None."));
+		return;
+	}
+	const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+	console.log(pc.bold(headers.map((h, i) => h.padEnd(widths[i])).join("   ")));
+	for (const row of rows) console.log(row.map((c, i) => c.padEnd(widths[i])).join("   "));
+}
+/**
+* Load the client and run `fn`, turning any {@link DashboardClientError} into a
+* red console message and a `false` return (the CLI exit-code convention).
+*/
+async function withClient(opts, fn) {
+	try {
+		return await fn(await NotificationsClient.load({ org: opts.org }));
+	} catch (err) {
+		if (err instanceof DashboardClientError) {
+			console.error(pc.red(err.message));
+			return false;
+		}
+		console.error(pc.red(`Notifications command failed: ${toErrorMessage(err)}`));
+		return false;
+	}
+}
+/** Validate a value against a Zod enum, printing an actionable error on miss. */
+function requireEnum(label, value, options) {
+	if (value === void 0) {
+		console.error(pc.red(`--${label} is required (one of: ${options.join(", ")})`));
+		return null;
+	}
+	if (!options.includes(value)) {
+		console.error(pc.red(`Invalid --${label} "${value}" (one of: ${options.join(", ")})`));
+		return null;
+	}
+	return value;
+}
+async function notificationsChannelsListCommand(opts) {
+	return withClient(opts, async (client) => {
+		const channels = await client.listChannels();
+		if (opts.json) {
+			console.log(JSON.stringify(channels, null, 2));
+			return true;
+		}
+		printTable([
+			"ID",
+			"TYPE",
+			"NAME",
+			"MANAGED"
+		], channels.map((c) => [
+			c.id,
+			c.type,
+			c.name,
+			c.managed ? "yes" : "no"
+		]));
+		return true;
+	});
+}
+async function notificationsChannelsAddCommand(opts) {
+	const type = requireEnum("type", opts.type, NotificationChannelKind.options);
+	if (!type) return false;
+	if (!opts.name) {
+		console.error(pc.red("--name is required"));
+		return false;
+	}
+	let body;
+	if (type === NotificationChannelKind.enum.slack) {
+		if (!opts.connection || !opts.slackChannel) {
+			console.error(pc.red("slack channels require --connection <id> and --slack-channel <id>"));
+			return false;
+		}
+		body = {
+			type: "slack",
+			connection_id: opts.connection,
+			slack_channel_id: opts.slackChannel,
+			name: opts.name
+		};
+	} else body = {
+		type: "email",
+		name: opts.name,
+		...opts.fromName ? { from_name: opts.fromName } : {},
+		...opts.replyTo ? { reply_to: opts.replyTo } : {}
+	};
+	return withClient(opts, async (client) => {
+		const channel = await client.createChannel(body);
+		console.log(pc.green(`Channel created: ${channel.id}`));
+		return true;
+	});
+}
+async function notificationsChannelsRemoveCommand(id, opts) {
+	return withClient(opts, async (client) => {
+		await client.deleteChannel(id);
+		console.log(pc.green(`Channel removed: ${id}`));
+		return true;
+	});
+}
+async function notificationsSubscriptionsListCommand(opts) {
+	return withClient(opts, async (client) => {
+		const subs = await client.listSubscriptions();
+		if (opts.json) {
+			console.log(JSON.stringify(subs, null, 2));
+			return true;
+		}
+		printTable([
+			"ID",
+			"LEVEL",
+			"SCOPE",
+			"CHANNEL",
+			"ON STATUS",
+			"ENABLED"
+		], subs.map((s) => [
+			s.id,
+			s.level,
+			s.scope_id ? `${s.scope_type}:${s.scope_id}` : s.scope_type,
+			s.channel_id,
+			(s.on_status ?? []).join(","),
+			s.enabled ? "yes" : "no"
+		]));
+		return true;
+	});
+}
+/** Build a create-subscription body from parsed flags (null on validation error). */
+function buildSubscriptionBody(opts) {
+	if (!opts.channel) {
+		console.error(pc.red("--channel <id> is required"));
+		return null;
+	}
+	const level = requireEnum("level", opts.level ?? "run", NotificationSubLevel.options);
+	if (!level) return null;
+	const scope = requireEnum("scope", opts.scope ?? "org", NotificationScopeKind.options);
+	if (!scope) return null;
+	const onStatus = parseCsv(opts.onStatus);
+	if (onStatus.length === 0) {
+		console.error(pc.red("--on-status <csv> is required (e.g. failed,success)"));
+		return null;
+	}
+	const needsScopeId = scope === NotificationScopeKind.enum.team || scope === NotificationScopeKind.enum.user;
+	if (needsScopeId && !opts.scopeId) {
+		console.error(pc.red(`--scope-id is required for ${scope} scope`));
+		return null;
+	}
+	let accumulateFor = null;
+	if (opts.accumulateFor !== void 0) {
+		accumulateFor = Number(opts.accumulateFor);
+		if (!Number.isFinite(accumulateFor)) {
+			console.error(pc.red("--accumulate-for must be a number of milliseconds"));
+			return null;
+		}
+	}
+	const mentions = parseCsv(opts.mentions);
+	const recipientOverride = parseCsv(opts.recipientOverride);
+	const onFailureClass = parseCsv(opts.onFailureClass);
+	return {
+		level,
+		channel_id: opts.channel,
+		scope_type: scope,
+		scope_id: needsScopeId ? opts.scopeId : null,
+		on_status: onStatus,
+		repo_glob: opts.repoGlob ?? null,
+		workflow_glob: opts.workflowGlob ?? null,
+		job_glob: opts.jobGlob ?? null,
+		mentions: mentions.length > 0 ? mentions : null,
+		recipient_override: recipientOverride.length > 0 ? recipientOverride : null,
+		on_failure_class: onFailureClass.length > 0 ? onFailureClass : null,
+		accumulate_for: accumulateFor
+	};
+}
+async function notificationsSubscriptionsAddCommand(opts) {
+	const body = buildSubscriptionBody(opts);
+	if (!body) return false;
+	return withClient(opts, async (client) => {
+		const sub = await client.createSubscription(body);
+		console.log(pc.green(`Subscription created: ${sub.id}`));
+		return true;
+	});
+}
+async function notificationsSubscriptionsRemoveCommand(id, opts) {
+	return withClient(opts, async (client) => {
+		await client.deleteSubscription(id);
+		console.log(pc.green(`Subscription removed: ${id}`));
+		return true;
+	});
+}
+async function notificationsRosterListCommand(opts) {
+	return withClient(opts, async (client) => {
+		const identities = await client.listIdentities();
+		if (opts.json) {
+			console.log(JSON.stringify(identities, null, 2));
+			return true;
+		}
+		printTable([
+			"ID",
+			"SUBJECT KIND",
+			"SUBJECT",
+			"SLACK MEMBER",
+			"STATUS"
+		], identities.map((r) => [
+			r.id,
+			r.subject_kind,
+			r.subject_value,
+			r.slack_member_id,
+			r.status
+		]));
+		return true;
+	});
+}
+/** Build an add-identity body from parsed flags (null on validation error). */
+function buildIdentityBody(opts) {
+	if (!opts.connection) {
+		console.error(pc.red("--connection <id> is required"));
+		return null;
+	}
+	const subjectKind = requireEnum("subject-kind", opts.subjectKind, RosterSubjectKind.options);
+	if (!subjectKind) return null;
+	if (!opts.subject) {
+		console.error(pc.red("--subject <value> is required (the KiCI user sub, git login, or email)"));
+		return null;
+	}
+	const inputForm = requireEnum("input-form", opts.inputForm ?? "id", RosterInputForm.options);
+	if (!inputForm) return null;
+	if (!opts.value) {
+		console.error(pc.red("--value <slack id | email | @handle> is required"));
+		return null;
+	}
+	return {
+		connection_id: opts.connection,
+		subject_kind: subjectKind,
+		subject_value: opts.subject,
+		input_form: inputForm,
+		value: opts.value
+	};
+}
+async function notificationsRosterAddCommand(opts) {
+	const body = buildIdentityBody(opts);
+	if (!body) return false;
+	return withClient(opts, async (client) => {
+		const row = await client.addIdentity(body);
+		console.log(pc.green(`Roster identity added: ${row.id} → ${row.slack_member_id}`));
+		return true;
+	});
+}
+async function notificationsRosterRemoveCommand(id, opts) {
+	return withClient(opts, async (client) => {
+		await client.deleteIdentity(id);
+		console.log(pc.green(`Roster identity removed: ${id}`));
+		return true;
+	});
+}
+//#endregion
+export { notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand };
+
+//# sourceMappingURL=notifications.js.map

package/dist/commands/preview.js

@@ -2,6 +2,8 @@ import "../rolldown-runtime-ClRpJifh.js";
 import { discoverWorkflows, resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { transformTriggers } from "../lockfile/generator.js";
+import { analyzeJobPurity } from "../lockfile/purity-diagnostics.js";
+import "../lockfile/index.js";
 import { displayDryRun } from "../test-runner/dry-run.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { buildEventPayload } from "../test-runner/payload-builder.js";
@@ -35,7 +37,7 @@ async function previewCommand(event, options) {
 			logger.info(pc.gray("  kici preview schedule"));
 			logger.info(pc.gray("  kici preview lifecycle:workflow_complete\n"));
 			logger.info(pc.gray("For remote fixture execution, use: kici run remote [fixture] [options]"));
-			logger.info(pc.gray("For local workflow execution, use: kici run local <event> [options]\n"));
+			logger.info(pc.gray("For local workflow execution, use: kici run <event> --local\n"));
 			return true;
 		}
 		if (!isKnownEventArg(event)) {
@@ -88,10 +90,15 @@ async function previewEvent(event, options) {
 				return false;
 			}
 		}
+		const purityWarnings = [];
+		for (const w of workflows) for (const j of w.jobs) {
+			if (typeof j === "function") continue;
+			purityWarnings.push(...analyzeJobPurity(j, w.name));
+		}
 		displayDryRun(lockWorkflows, decisions, {
 			workflow: options.workflow,
 			job: options.job
-		});
+		}, purityWarnings);
 		return true;
 	} catch (error) {
 		const message = toErrorMessage(error);

package/dist/commands/run-banner.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Always-on startup banner for a routed `kici run --local` invocation. States
+ * the selected plane, where the agent runs, the secret + identity source, the
+ * control commands, and the flags that force a different behavior — so a
+ * developer always knows which plane a run used and why (design §5).
+ *
+ * Three variants:
+ * - `offline`  — independent plane, local secrets, dev-signed identity.
+ * - `attached` — hybrid plane, real Platform-minted OIDC + attestation.
+ * - `fallback` — wanted attached but the Platform was unreachable, so the run
+ *   fell back to offline; a LOUD first line makes the degradation obvious.
+ */
+export type RunBannerMode = 'offline' | 'attached' | 'fallback';
+export interface RunBannerInput {
+    mode: RunBannerMode;
+    /** Plane orchestrator URL (surfaced on the control line). */
+    planeUrl: string;
+    /** Org id (attached variant). */
+    orgId?: string;
+    /** Why the run fell back to offline (fallback variant). */
+    fallbackReason?: string;
+    /**
+     * Trusted fleet-agent profile (`--trusted`): the run routes to the trusted
+     * label set, so steps see the ambient host env (minus the agent's own KiCI
+     * identity secrets). Surfaced as a loud line so a trusted run is never silent.
+     */
+    trusted?: boolean;
+}
+/** Render the boxed run banner as a plain (uncolored) multi-line string. */
+export declare function renderRunBanner(input: RunBannerInput): string;
+//# sourceMappingURL=run-banner.d.ts.map

package/dist/commands/run-banner.js

@@ -0,0 +1,25 @@
+import "../rolldown-runtime-ClRpJifh.js";
+//#region src/commands/run-banner.ts
+/** Render the boxed run banner as a plain (uncolored) multi-line string. */
+function renderRunBanner(input) {
+	const title = input.mode === "attached" ? "kici run --local (connected)" : "kici run --local";
+	const rows = [];
+	if (input.mode === "fallback") rows.push(["⚠", `Platform unreachable — fell back to OFFLINE${input.fallbackReason ? ` (${input.fallbackReason})` : ""}`]);
+	if (input.mode === "attached") rows.push(["plane", "local dev orchestrator (hybrid, attached)"], ["agent", "this machine (bare-metal)"], ["secrets", `REAL scoped${input.orgId ? ` (org: ${input.orgId})` : ""}`], ["identity", "real Platform OIDC + attestation"], ["control", `kici local status | logs | detach   (${input.planeUrl})`], ["force", "--offline (local plane) · --in-place (ambient)"]);
+	else rows.push(["plane", "local dev orchestrator (independent, offline)"], ["agent", "this machine (bare-metal)"], ["secrets", "LOCAL files (.kici/.secrets, .env.local, --env)"], ["identity", "DEV-SIGNED (iss=kici-local — NOT prod)"], ["control", `kici local status | logs | down   (${input.planeUrl})`], ["force", "--connected (attach to Platform) · --in-place (ambient)"]);
+	if (input.trusted) rows.push(["execution", "TRUSTED — host env passthrough (NOT sandboxed)"]);
+	const labelWidth = Math.max(...rows.map(([label]) => label.length));
+	const bodyLines = rows.map(([label, value]) => `${(label + ":").padEnd(labelWidth + 1)} ${value}`);
+	const contentWidth = Math.max(title.length + 2, ...bodyLines.map((l) => l.length));
+	const top = `┌ ${title} ${"─".repeat(Math.max(0, contentWidth - title.length))}┐`;
+	const bottom = `└${"─".repeat(contentWidth + 2)}┘`;
+	return [
+		top,
+		...bodyLines.map((l) => `│ ${l.padEnd(contentWidth)} │`),
+		bottom
+	].join("\n");
+}
+//#endregion
+export { renderRunBanner };
+
+//# sourceMappingURL=run-banner.js.map

package/dist/commands/run-routed.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `kici run --local [event]` — a real routed dispatch with this machine as the
+ * ephemeral agent, through the warm local dev plane. In this phase only the
+ * offline (independent) plane is wired; Platform attachment (`--connected` /
+ * auto-select hybrid) lands with the attachment work.
+ *
+ * The offline path reuses the real orchestrator + agent pipeline end-to-end, so
+ * the execution parity dividend (emit / cache / needs / parallel / `KICI_SOURCE_*`)
+ * holds by construction — there is no second engine.
+ */
+export interface RunRoutedOptions {
+    event?: string;
+    local?: boolean;
+    offline?: boolean;
+    connected?: boolean;
+    inPlace?: boolean;
+    /**
+     * Trusted fleet-agent profile: route this run to the plane's trusted label
+     * set so steps run with the ambient host env passed through (minus the
+     * agent's own KiCI identity secrets). Selects a PRE-CONFIGURED trusted scaler
+     * label set by appending the `self-hosted` routing label to the run's job
+     * `runsOn` — it never injects `KICI_TRUSTED_ENV` onto a dispatch payload.
+     */
+    trusted?: boolean;
+    /** Flat per-run secrets (`--env KEY=VALUE`); delivery lands with the secret path. */
+    env?: string[];
+    /**
+     * Path to a dispatch payload JSON `{ action?, client_payload? }`. Only read
+     * when the event is `dispatch`: `action` becomes the dispatch `types` matcher
+     * key and `client_payload` reaches the workflow. This is how `packages/ci`
+     * targets a single `dispatch()` workflow (e.g. deploy-stg) on the routed path.
+     */
+    payload?: string;
+    kiciDir?: string;
+    quiet?: boolean;
+    debug?: boolean;
+}
+/**
+ * Entry point for the action-bearing `kici run`. Validates the routing flags and
+ * drives the offline routed run. Returns true on run success.
+ */
+export declare function runRoutedCommand(options: RunRoutedOptions): Promise<boolean>;
+/**
+ * Read a dispatch payload file `{ action?, client_payload? }`. Returns the
+ * action + client_payload the routed dispatch trigger carries. An absent
+ * `--payload` yields an empty action (a bare `dispatch()` workflow still
+ * matches); a present file is parsed as JSON.
+ */
+export declare function readDispatchPayload(payloadPath?: string): {
+    action?: string;
+    clientPayload?: unknown;
+};
+//# sourceMappingURL=run-routed.d.ts.map