@kici-dev/compiler 0.4.0 → 0.5.0

package/dist/lockfile/generator.js

@@ -5,13 +5,13 @@ import "../errors/index.js";
 import { BREAKING_FLOOR as BREAKING_FLOOR$1, SCHEMA_VERSION as SCHEMA_VERSION$1 } from "../types.js";
 import { computeContentHash } from "./hasher.js";
 import { resolveHashFiles } from "./hash-files.js";
-import { analyzePurity } from "./purity-analyzer.js";
 import path from "node:path";
 import { readFileSync } from "node:fs";
 import { getDynamicJobGroup, getDynamicJobNeeds, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject, normalizeApproval, normalizeCacheSpecs } from "@kici-dev/sdk";
 import { sha256 } from "@kici-dev/core";
 import { PackageManager, detectPackageManagerSync, detectYarnFlavorSync } from "@kici-dev/core/package-manager";
-import { assertScheduleInputsSatisfiable, extractInputsDescriptorMap, resolveWhenToRunOn, validateResourceRequest } from "@kici-dev/engine";
+import { assertScheduleInputsSatisfiable, extractInputsDescriptorMap, resolveContentFormat, resolveWhenToRunOn, validateResourceRequest } from "@kici-dev/engine";
+import { assertSafeRegex } from "@kici-dev/engine/safe-regex";
 import { normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, runsOnPickFromInput } from "@kici-dev/engine/labels/compile";
 import { execSync } from "node:child_process";
 //#region src/lockfile/generator.ts
@@ -178,7 +178,8 @@ function transformWorkflow(workflow, sourceFile, exportRef, bundleSource, gitRoo
 			...workflow.concurrency.max !== void 0 && { max: workflow.concurrency.max }
 		} },
 		...workflow.timeout !== void 0 && { timeout: workflow.timeout },
-		...workflow.approval !== void 0 && { approval: (assertNonStepApprovalScope(workflow.approval, "workflow", locationForWorkflow(sourceFile)), toLockApproval(workflow.approval)) }
+		...workflow.approval !== void 0 && { approval: (assertNonStepApprovalScope(workflow.approval, "workflow", locationForWorkflow(sourceFile)), toLockApproval(workflow.approval)) },
+		...typeof workflow.filter === "function" && { hasFilter: true }
 	};
 }
 /**
@@ -189,6 +190,114 @@ function transformWorkflow(workflow, sourceFile, exportRef, bundleSource, gitRoo
 function reposField(trigger) {
 	return trigger.repos && trigger.repos.length > 0 ? { repos: transformBranchPatterns(trigger.repos) } : {};
 }
+/** Normalize a scalar-or-array SDK value to an array. */
+function toArray(v) {
+	if (v === void 0) return [];
+	return Array.isArray(v) ? v : [v];
+}
+/**
+* Normalize one regex entry to the lock's `/pattern/flags` form, rejecting an
+* invalid or ReDoS-prone pattern at compile time so a catastrophic pattern fails
+* `kici compile` with author feedback instead of reaching the orchestrator.
+*/
+function serializeRegexEntry(entry, ctx) {
+	const source = entry instanceof RegExp ? `/${entry.source}/${entry.flags}` : entry;
+	const wrapped = /^\/(.+)\/([gimsuy]*)$/.exec(source);
+	const pattern = wrapped ? wrapped[1] : source;
+	const flags = wrapped ? wrapped[2] : "";
+	let re;
+	try {
+		re = new RegExp(pattern, flags);
+	} catch (err) {
+		throw compilerError("E123", `${ctx}: invalid regex — ${err instanceof Error ? err.message : String(err)}`);
+	}
+	try {
+		assertSafeRegex(re.source, re.flags, ctx);
+	} catch (err) {
+		throw compilerError("E123", `${ctx}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return `/${re.source}/${re.flags}`;
+}
+/**
+* Serialize a {@link TextMatch} to its lock form: every key normalized to a flat
+* array, every regex to `/pattern/flags`, every degenerate shape rejected.
+*
+* `ctx` is a human label woven into any thrown error (e.g. `push trigger
+* 'commitMessage'`, `requires 'Dockerfile'`).
+*/
+function serializeTextMatch(m, ctx) {
+	const contains = toArray(m.contains);
+	const notContains = toArray(m.notContains);
+	const matches = toArray(m.matches);
+	const notMatches = toArray(m.notMatches);
+	if (contains.length === 0 && notContains.length === 0 && matches.length === 0 && notMatches.length === 0) throw compilerError("E122", `${ctx}: no query key (contains/notContains/matches/notMatches) — nothing to check`);
+	for (const needle of [...contains, ...notContains]) if (needle === "") throw compilerError("E122", `${ctx}: an empty needle matches every text — remove it`);
+	if (m.ignoreCase !== void 0 && contains.length === 0 && notContains.length === 0) throw compilerError("E122", `${ctx}: 'ignoreCase' affects only contains/notContains — a regex carries its own flags`);
+	return {
+		...contains.length > 0 && { contains: [...contains] },
+		...notContains.length > 0 && { notContains: [...notContains] },
+		...matches.length > 0 && { matches: matches.map((e) => serializeRegexEntry(e, ctx)) },
+		...notMatches.length > 0 && { notMatches: notMatches.map((e) => serializeRegexEntry(e, ctx)) },
+		...m.ignoreCase !== void 0 && { ignoreCase: m.ignoreCase }
+	};
+}
+/** Emit the optional `commitMessage` field for a git-event lock trigger. */
+function commitMessageField(commitMessage, triggerLabel) {
+	if (commitMessage === void 0) return {};
+	return { commitMessage: serializeTextMatch(commitMessage, `${triggerLabel} 'commitMessage'`) };
+}
+/**
+* Serialize one SDK content requirement into its lock form, validating and
+* resolving `format: 'auto'` by extension at compile time. A malformed filter
+* throws (fails `kici compile`) rather than reaching the orchestrator.
+*/
+function serializeOneRequirement(req) {
+	const hasJsonQuery = req.exists !== void 0 && req.exists.length > 0 || req.match !== void 0 && Object.keys(req.match).length > 0 || req.not !== void 0 && Object.keys(req.not).length > 0;
+	const textKeys = {
+		...req.contains !== void 0 && { contains: req.contains },
+		...req.notContains !== void 0 && { notContains: req.notContains },
+		...req.matches !== void 0 && { matches: req.matches },
+		...req.notMatches !== void 0 && { notMatches: req.notMatches },
+		...req.ignoreCase !== void 0 && { ignoreCase: req.ignoreCase }
+	};
+	const hasTextQuery = req.contains !== void 0 || req.notContains !== void 0 || req.matches !== void 0 || req.notMatches !== void 0;
+	const hasAnyQuery = hasJsonQuery || hasTextQuery || req.ignoreCase !== void 0;
+	if (req.absent) {
+		if (hasAnyQuery) throw compilerError("E118", `requires '${req.file}': 'absent' is mutually exclusive with query keys (exists/match/not/contains/notContains/matches/notMatches)`);
+		return {
+			file: req.file,
+			absent: true
+		};
+	}
+	const format = resolveContentFormat(req.file, req.format);
+	if (format === "text" && hasJsonQuery) throw compilerError("E119", `requires '${req.file}': text format cannot carry a json/yaml query key (exists/match/not) — name a .json/.yaml file or set format: 'json' | 'yaml'`);
+	if (format !== "text" && (hasTextQuery || req.ignoreCase !== void 0)) throw compilerError("E119", `requires '${req.file}': '${format}' format cannot carry a raw-text key (contains/notContains/matches/notMatches/ignoreCase) — use format: 'text'`);
+	if (!hasAnyQuery) {
+		if (req.format !== void 0) throw compilerError("E122", `requires '${req.file}': format '${req.format}' declared with no query key — nothing to check`);
+		return { file: req.file };
+	}
+	const text = hasTextQuery ? serializeTextMatch(textKeys, `requires '${req.file}'`) : {};
+	return {
+		file: req.file,
+		format,
+		...req.exists !== void 0 && { exists: req.exists },
+		...req.match !== void 0 && { match: req.match },
+		...req.not !== void 0 && { not: req.not },
+		...text
+	};
+}
+/**
+* Serialize a trigger's `requires` list, or `undefined` when empty (so the lock
+* field stays absent). Each entry is validated + format-resolved at compile time.
+*/
+function serializeRequires(requires) {
+	if (!requires || requires.length === 0) return void 0;
+	return requires.map(serializeOneRequirement);
+}
+function requiresField(requires) {
+	const serialized = serializeRequires(requires);
+	return serialized ? { requires: serialized } : {};
+}
 function toLockPr(t) {
 	return {
 		_type: "pr",
@@ -196,19 +305,27 @@ function toLockPr(t) {
 		targetBranches: transformBranchPatterns(t.targetBranches),
 		sourceBranches: transformBranchPatterns(t.sourceBranches),
 		paths: t.paths,
-		...reposField(t)
+		...reposField(t),
+		...requiresField(t.requires),
+		...commitMessageField(t.commitMessage, "pr trigger")
 	};
 }
 function toLockPushAndTag(t) {
+	const requires = requiresField(t.requires);
+	const commitMessage = commitMessageField(t.commitMessage, "push trigger");
 	const results = [{
 		_type: "push",
 		branches: transformBranchPatterns(t.branches),
 		paths: t.paths,
-		...reposField(t)
+		...reposField(t),
+		...requires,
+		...commitMessage
 	}];
 	if (t.tags.length > 0) results.push({
 		_type: "tag",
-		patterns: transformBranchPatterns(t.tags)
+		patterns: transformBranchPatterns(t.tags),
+		...requires,
+		...commitMessage
 	});
 	return results;
 }
@@ -216,7 +333,9 @@ function toLockTag(t) {
 	return {
 		_type: "tag",
 		patterns: transformBranchPatterns(t.patterns),
-		...reposField(t)
+		...reposField(t),
+		...requiresField(t.requires),
+		...commitMessageField(t.commitMessage, "tag trigger")
 	};
 }
 function toLockComment(t) {
@@ -518,25 +637,15 @@ function validateRunsOn(runsOn, jobName, location) {
 }
 /**
 * Transform one context reference (static name or function) into a lock
-* `{ value, dynamic }` entry. A function element is analyzed for purity: a pure
-* function becomes an inline expression resolvable at two-phase eval; an impure
-* one carries only the `dynamic` flag (the agent runs an init job to resolve it).
+* `{ value, dynamic }` entry. A function element carries only the `dynamic`
+* flag (the agent resolves it in the init round); a static name carries its
+* literal value.
 */
 function transformContextRef(ref) {
-	if (typeof ref === "function") {
-		const fnSource = ref.toString();
-		if (analyzePurity(fnSource).pure) return {
-			value: {
-				_type: "inline",
-				expression: fnSource
-			},
-			dynamic: true
-		};
-		return {
-			value: "",
-			dynamic: true
-		};
-	}
+	if (typeof ref === "function") return {
+		value: "",
+		dynamic: true
+	};
 	return {
 		value: ref,
 		dynamic: false
@@ -567,15 +676,8 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 	if (contextRefs !== void 0 && contextRefs.length > 0) contextFields.contexts = contextRefs.map((ref) => transformContextRef(ref));
 	const envFields = {};
 	if (job.env !== void 0) {
-		if (typeof job.env === "function") {
-			const fnSource = job.env.toString();
-			const purity = analyzePurity(fnSource);
-			envFields.dynamicEnv = true;
-			if (purity.pure) envFields.env = {
-				_type: "inline",
-				expression: fnSource
-			};
-		} else if (typeof job.env === "object") envFields.env = { ...job.env };
+		if (typeof job.env === "function") envFields.dynamicEnv = true;
+		else if (typeof job.env === "object") envFields.env = { ...job.env };
 	}
 	if (job.resources !== void 0) try {
 		validateResourceRequest(job.resources);
@@ -588,15 +690,8 @@ function transformJob(job, configPath, index, gitRoot, uuidToName) {
 	}
 	const concurrencyFields = {};
 	if (job.concurrencyGroup !== void 0) {
-		if (typeof job.concurrencyGroup === "function") {
-			const fnSource = job.concurrencyGroup.toString();
-			const purity = analyzePurity(fnSource);
-			concurrencyFields.dynamicConcurrencyGroup = true;
-			if (purity.pure) concurrencyFields.concurrencyGroup = {
-				_type: "inline",
-				expression: fnSource
-			};
-		} else if (typeof job.concurrencyGroup === "string") concurrencyFields.concurrencyGroup = job.concurrencyGroup;
+		if (typeof job.concurrencyGroup === "function") concurrencyFields.dynamicConcurrencyGroup = true;
+		else if (typeof job.concurrencyGroup === "string") concurrencyFields.concurrencyGroup = job.concurrencyGroup;
 	}
 	return {
 		_type: "static",

package/dist/lockfile/index.d.ts

@@ -1,5 +1,3 @@
 export { generateLockFile, serializeLockFile, detectGitRoot, computeLockfileHash, schemaWindowWarning, } from './generator.js';
 export { computeContentHash, COMPILE_SCHEMA_VERSION } from './hasher.js';
-export { DynamicValueField, analyzeJobPurity, collectWorkflowPurityWarnings, } from './purity-diagnostics.js';
-export type { JobPurityWarning } from './purity-diagnostics.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/lockfile/index.js

@@ -1,5 +1,4 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { COMPILE_SCHEMA_VERSION, computeContentHash } from "./hasher.js";
 import { computeLockfileHash, detectGitRoot, generateLockFile, schemaWindowWarning, serializeLockFile } from "./generator.js";
-import { DynamicValueField, analyzeJobPurity, collectWorkflowPurityWarnings } from "./purity-diagnostics.js";
-export { COMPILE_SCHEMA_VERSION, DynamicValueField, analyzeJobPurity, collectWorkflowPurityWarnings, computeContentHash, computeLockfileHash, detectGitRoot, generateLockFile, schemaWindowWarning, serializeLockFile };
+export { COMPILE_SCHEMA_VERSION, computeContentHash, computeLockfileHash, detectGitRoot, generateLockFile, schemaWindowWarning, serializeLockFile };

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.4.0";
+const sdkVersion = "0.5.0";
 /**
 * The npm version range the scaffold pins `@kici-dev/sdk` to.
 *

package/dist/test-runner/dry-run.d.ts

@@ -1,5 +1,4 @@
 import type { LockWorkflow } from '../types.js';
-import type { JobPurityWarning } from '../lockfile/purity-diagnostics.js';
 import type { WorkflowDecision } from '@kici-dev/engine';
 interface DryRunOptions {
     workflow?: string;
@@ -8,6 +7,6 @@ interface DryRunOptions {
 /**
  * Display dry-run output showing what would execute.
  */
-export declare function displayDryRun(workflows: readonly LockWorkflow[], decisions: WorkflowDecision[], options: DryRunOptions, purityWarnings?: JobPurityWarning[]): void;
+export declare function displayDryRun(workflows: readonly LockWorkflow[], decisions: WorkflowDecision[], options: DryRunOptions): void;
 export {};
 //# sourceMappingURL=dry-run.d.ts.map

package/dist/test-runner/dry-run.js

@@ -3,26 +3,11 @@ import pc from "picocolors";
 import { logger } from "@kici-dev/core";
 //#region src/test-runner/dry-run.ts
 /**
-* Print the injected `__init__` job line for each impure dynamic value on a job,
-* so the ~5-10s init-job cost is visible before the first run. Returns the number
-* of lines rendered so the caller can count the jobs it actually surfaced.
-*/
-function renderJobInitWarnings(purityWarnings, workflowName, jobName) {
-	let rendered = 0;
-	for (const w of purityWarnings) {
-		if (w.workflowName !== workflowName || w.jobName !== jobName) continue;
-		logger.info(pc.yellow(`      ⚠ __init__ job required (~5-10s): ${w.field} is not pure — ${w.reason}`));
-		rendered++;
-	}
-	return rendered;
-}
-/**
 * Display dry-run output showing what would execute.
 */
-function displayDryRun(workflows, decisions, options, purityWarnings = []) {
+function displayDryRun(workflows, decisions, options) {
 	logger.info(pc.bold("\n🔍 DRY RUN - No commands will be executed\n"));
 	const matchedWorkflows = decisions.filter((d) => d.matched);
-	const injectedInitJobs = /* @__PURE__ */ new Set();
 	if (matchedWorkflows.length === 0) {
 		logger.info(pc.yellow("No workflows matched the event.\n"));
 		displayDecisionSummary(decisions);
@@ -48,7 +33,6 @@ function displayDryRun(workflows, decisions, options, purityWarnings = []) {
 			else logger.info(pc.gray(`      matrix: [dynamic]`));
 			logger.info(pc.gray(`      steps (${job.steps.length}):`));
 			for (const step of job.steps) logger.info(pc.gray(`        - ${step.name}`));
-			if (renderJobInitWarnings(purityWarnings, decision.workflowName, job.name) > 0) injectedInitJobs.add(`${decision.workflowName} ${job.name}`);
 		}
 		const dynamicJobs = workflow.jobs.filter((j) => j._type === "dynamic");
 		if (dynamicJobs.length > 0) {
@@ -57,7 +41,6 @@ function displayDryRun(workflows, decisions, options, purityWarnings = []) {
 		}
 		logger.info("");
 	}
-	if (injectedInitJobs.size > 0) logger.info(pc.yellow(`⚠ ${injectedInitJobs.size} __init__ job(s) will be injected for impure dynamic values (~5-10s each).`));
 	displayDecisionSummary(decisions);
 	logger.info(pc.green("✓ Dry run complete\n"));
 }

package/dist/types.d.ts

@@ -12,7 +12,7 @@
  * v15 adds per-job init config(s).
  * v17 widens per-job init to typed presets ('mise' / { mise }) and 'auto' detection.
  */
-import type { ResourceRequest, ApproverClause, RunsOnAllPredicate, OnUnreachableMode, LabelMatcher, ExecutionJobStatus, InputsDescriptorMap } from '@kici-dev/engine';
+import type { ResourceRequest, ApproverClause, RunsOnAllPredicate, OnUnreachableMode, LabelMatcher, ExecutionJobStatus, InputsDescriptorMap, LockContentRequirement } from '@kici-dev/engine';
 /**
  * Normalized approval config carried in the lock file. Mirrors the engine
  * `LockApproval` type. Produced by the compiler from an SDK `approval` config.
@@ -28,7 +28,7 @@ export interface LockApproval {
     readonly when: 'always' | 'drift';
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 32;
+export declare const SCHEMA_VERSION: 35;
 /** Lock compatibility-window floor - re-exported from engine as single source of truth */
 export declare const BREAKING_FLOOR: 30;
 /**
@@ -58,6 +58,8 @@ export interface LockPrTrigger {
     readonly sourceBranches: readonly LockBranchPattern[];
     readonly paths: readonly string[];
     readonly repos?: readonly LockBranchPattern[];
+    /** Declarative static content filter over source files at the event ref (AND-ed). */
+    readonly requires?: readonly LockContentRequirement[];
 }
 /**
  * Push trigger in lock file.
@@ -68,6 +70,8 @@ export interface LockPushTrigger {
     readonly branches: readonly LockBranchPattern[];
     readonly paths: readonly string[];
     readonly repos?: readonly LockBranchPattern[];
+    /** Declarative static content filter over source files at the event ref (AND-ed). */
+    readonly requires?: readonly LockContentRequirement[];
 }
 /**
  * Tag trigger in lock file.
@@ -77,6 +81,8 @@ export interface LockTagTrigger {
     readonly _type: 'tag';
     readonly patterns: readonly LockBranchPattern[];
     readonly repos?: readonly LockBranchPattern[];
+    /** Declarative static content filter over source files at the event ref (AND-ed). */
+    readonly requires?: readonly LockContentRequirement[];
 }
 /**
  * Comment trigger in lock file.
@@ -389,17 +395,27 @@ export type LockStepEntry = LockStep | LockParallelStep;
 /** Type guard distinguishing a parallel group from an ordinary lock step. */
 export declare function isLockParallelStep(entry: LockStepEntry): entry is LockParallelStep;
 /**
- * Inline expression value for pure dynamic functions.
- * The compiler serializes pure functions as { _type: 'inline', expression: '(event) => ...' }
- * and the orchestrator evaluates them via vm.runInNewContext at dispatch time.
- * struct with discriminant and expression field.
- * _type: 'inline' alongside existing 'static' and 'dynamic' discriminants.
+ * Serialized inline expression for a dynamic env/context/concurrencyGroup
+ * field, shaped as `{ _type: 'inline', expression: '(event) => ...' }`
+ * alongside the existing 'static' and 'dynamic' discriminants.
+ *
+ * @deprecated Schema v11 inline expressions are no longer evaluated in the
+ * orchestrator. Dynamic env/context/concurrencyGroup fields are resolved on the
+ * eval agent's init-runner. The compiler no longer emits this type; readers keep
+ * recognizing it only to defer an old lock's field to the init round. Removed at
+ * the next major (v1.0.0).
  */
 export interface LockInlineValue {
     readonly _type: 'inline';
     readonly expression: string;
 }
-/** Type guard for inline expression values */
+/**
+ * Type guard for inline expression values.
+ *
+ * @deprecated See {@link LockInlineValue}. Retained only so a reader can
+ * recognize an old lock's inline field and defer it to the eval agent's
+ * init-runner. Removed at the next major (v1.0.0).
+ */
 export declare function isLockInlineValue(value: unknown): value is LockInlineValue;
 /**
  * Static job in lock file.
@@ -589,6 +605,13 @@ export interface LockWorkflow {
     readonly timeout?: number;
     /** Normalized approval gate; when set the whole run is held before any job dispatches. */
     readonly approval?: LockApproval;
+    /**
+     * True when the workflow declares a `filter` predicate. A bare flag, not a
+     * source reference: `LockWorkflow.source` already identifies the module and
+     * export, so the eval agent loads it and reads `.filter` off the workflow
+     * object. Mirrors the `dynamicEnv` / `dynamicConcurrencyGroup` convention.
+     */
+    readonly hasFilter?: boolean;
 }
 /**
  * Complete lock file structure.
@@ -602,6 +625,7 @@ export interface LockWorkflow {
  * v8 adds runsOn polymorphic type (string | string[] | selector) and excludeLabels.
  * v11 adds LockInlineValue type for pure function inline evaluation.
  * v13 adds job-level and workflow-level timeout.
+ * v34 adds LockWorkflow.hasFilter (workflow-level pre-dispatch filter predicate).
  */
 export interface LockFile {
     readonly schemaVersion: typeof SCHEMA_VERSION;

package/dist/types.js

@@ -23,7 +23,13 @@ const BREAKING_FLOOR = BREAKING_FLOOR$1;
 function isLockParallelStep(entry) {
 	return entry.kind === "parallel";
 }
-/** Type guard for inline expression values */
+/**
+* Type guard for inline expression values.
+*
+* @deprecated See {@link LockInlineValue}. Retained only so a reader can
+* recognize an old lock's inline field and defer it to the eval agent's
+* init-runner. Removed at the next major (v1.0.0).
+*/
 function isLockInlineValue(value) {
 	return typeof value === "object" && value !== null && value._type === "inline";
 }

package/dist/validation/validator.js

@@ -75,6 +75,46 @@ function validateWorkflow(workflow, workflowFile) {
 		const matrixErrors = validateStaticMatrix(job, workflow.name, workflowFile);
 		errors.push(...matrixErrors);
 	}
+	errors.push(...validateGlobalApproval(workflow, staticJobs, workflowFile));
+	return errors;
+}
+/** True when any trigger carries `repos:`, which is what makes a workflow global. */
+function isGlobalWorkflow(workflow) {
+	return (Array.isArray(workflow.on) ? workflow.on : workflow.on ? [workflow.on] : []).some((trigger) => {
+		const repos = trigger.repos;
+		return Array.isArray(repos) && repos.length > 0;
+	});
+}
+/**
+* Refuse an `approval` gate on an organization-wide workflow.
+*
+* The approval hold is applied by the per-repository dispatch path. The global
+* path builds its job inputs and dispatches them without ever consulting the
+* gate, so an `approval` declared on a global workflow is **silently ignored**:
+* the job runs immediately and the author believes a human had to release it.
+*
+* Failing the compile rather than warning is the right direction for a gate an
+* author is relying on. A silently-ignored approval is not a cosmetic problem —
+* it is a security control the workflow claims to have and does not.
+*
+* Only static jobs and the workflow level are reachable here; a generated job
+* carrying `approval` is caught at dispatch, which is the only place it exists.
+*/
+function validateGlobalApproval(workflow, staticJobs, workflowFile) {
+	if (!isGlobalWorkflow(workflow)) return [];
+	const errors = [];
+	const suggestion = "Approval gates are supported on per-repository workflows only. Drop `approval`, or move the gated jobs into a workflow whose triggers carry no `repos:`.";
+	if (workflow.approval) errors.push(compilerError("E124", `Workflow "${workflow.name}" declares \`approval\` and is organization-wide (a trigger carries \`repos:\`). The approval would never be enforced.`, {
+		location: locationForWorkflow(workflowFile),
+		suggestion
+	}));
+	for (const job of staticJobs) {
+		if (!job.approval) continue;
+		errors.push(compilerError("E124", `Job "${job.name}" in organization-wide workflow "${workflow.name}" declares \`approval\`. The approval would never be enforced.`, {
+			location: locationForJob(job, workflowFile),
+			suggestion
+		}));
+	}
 	return errors;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -61,13 +61,13 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/agent": "0.4.0",
-    "@kici-dev/core": "0.4.0",
-    "@kici-dev/engine": "0.4.0",
-    "@kici-dev/orchestrator": "0.4.0"
+    "@kici-dev/agent": "0.5.0",
+    "@kici-dev/core": "0.5.0",
+    "@kici-dev/engine": "0.5.0",
+    "@kici-dev/orchestrator": "0.5.0"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.4.0"
+    "@kici-dev/sdk": "0.5.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",