@kici-dev/compiler 0.4.0 → 0.6.0

package/dist/commands/report/collect.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Build the `kici report` bundle.
+ *
+ * Writes the same archive layout the orchestrator's debug bundle uses, so
+ * `kici-admin inspect-bundle` reads either one, but collects from the workflow
+ * author's side: their config, their project, and the run they are reporting
+ * about — rather than an orchestrator's own logs and state.
+ *
+ * Every collector runs through `runCollector`, which turns a throw into a
+ * recorded `error` entry instead of losing the whole bundle. That matters twice
+ * over: a customer with one broken collector still gets a shareable report, and
+ * the per-collector outcome is itself a product feature — the manifest's
+ * `collectionReport` tells the reader which sections are trustworthy.
+ */
+import { z } from 'zod';
+import type { ProbeOutcome } from '../doctor.js';
+/** Outcome of one collector. */
+export declare const CollectionStatus: z.ZodEnum<{
+    empty: "empty";
+    error: "error";
+    ok: "ok";
+    skipped: "skipped";
+}>;
+export type CollectionStatus = z.infer<typeof CollectionStatus>;
+export interface CollectionEntry {
+    collector: string;
+    status: CollectionStatus;
+    note?: string;
+}
+/** Bundle-format version, bumped when the archive layout changes. */
+export declare const REPORT_BUNDLE_VERSION = "1.0";
+export interface ReportManifest {
+    version: string;
+    generated_at: string;
+    bundle_id: string;
+    node_version: string;
+    platform: string;
+    metadata: Record<string, string>;
+    redacted: boolean;
+    collectionReport: CollectionEntry[];
+}
+/** One run's diagnostic material, as the dashboard client returns it. */
+export interface RunMaterial {
+    detail: unknown;
+    logs: string;
+}
+/**
+ * Injectable seams, mirroring `DoctorDeps`, so every path is unit-testable
+ * without real IO or network.
+ */
+export interface ReportBundleDeps {
+    loadConfig: () => Promise<Record<string, unknown>>;
+    probe: () => Promise<ProbeOutcome | null>;
+    readProject: (kiciDir: string) => Promise<Record<string, unknown>>;
+    fetchRun: (runId: string) => Promise<RunMaterial>;
+    now: () => Date;
+}
+export interface ReportBundleOptions {
+    outputPath: string;
+    kiciDir: string;
+    runId?: string;
+    metadata: Record<string, string>;
+    /** When false the bundle is assembled without scrubbing free text. */
+    redact: boolean;
+    deps?: Partial<ReportBundleDeps>;
+}
+export interface ReportBundleResult {
+    path: string;
+    sha256: string;
+    bundleId: string;
+    fileCount: number;
+    collectionReport: CollectionEntry[];
+}
+/**
+ * Collect and write one report bundle.
+ *
+ * The body stays a narrative caller: each section is one `runCollector` call
+ * whose result is appended to the archive, so adding a collector never grows
+ * the control flow.
+ */
+export declare function createReportBundle(options: ReportBundleOptions): Promise<ReportBundleResult>;
+//# sourceMappingURL=collect.d.ts.map

package/dist/commands/report/collect.js

@@ -0,0 +1,234 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { collectIdentity } from "./identity.js";
+import * as path$1 from "node:path";
+import * as fs$1 from "node:fs";
+import * as os$1 from "node:os";
+import { z } from "zod";
+import { createHash, randomUUID } from "node:crypto";
+import { ZipArchive } from "archiver";
+import { redactConfig, scrubText } from "@kici-dev/core/diagnostics-redaction";
+//#region src/commands/report/collect.ts
+/**
+* Build the `kici report` bundle.
+*
+* Writes the same archive layout the orchestrator's debug bundle uses, so
+* `kici-admin inspect-bundle` reads either one, but collects from the workflow
+* author's side: their config, their project, and the run they are reporting
+* about — rather than an orchestrator's own logs and state.
+*
+* Every collector runs through `runCollector`, which turns a throw into a
+* recorded `error` entry instead of losing the whole bundle. That matters twice
+* over: a customer with one broken collector still gets a shareable report, and
+* the per-collector outcome is itself a product feature — the manifest's
+* `collectionReport` tells the reader which sections are trustworthy.
+*/
+/** Outcome of one collector. */
+const CollectionStatus = z.enum([
+	"ok",
+	"empty",
+	"error",
+	"skipped"
+]);
+/** Bundle-format version, bumped when the archive layout changes. */
+const REPORT_BUNDLE_VERSION = "1.0";
+/**
+* Read the project's own KiCI state: which workflows exist and what the lock
+* file says. Deliberately reads metadata rather than workflow source — the
+* source is the customer's code, and a diagnostic bundle should not ship it.
+*/
+async function defaultReadProject(kiciDir) {
+	const workflowsDir = path$1.join(kiciDir, "workflows");
+	const workflows = fs$1.existsSync(workflowsDir) ? fs$1.readdirSync(workflowsDir).sort() : [];
+	const lockPath = path$1.join(kiciDir, "kici.lock.json");
+	let lock = null;
+	if (fs$1.existsSync(lockPath)) {
+		const parsed = JSON.parse(fs$1.readFileSync(lockPath, "utf-8"));
+		lock = {
+			schemaVersion: parsed.schemaVersion ?? null,
+			generatedAt: parsed.generatedAt ?? null,
+			workflowCount: Array.isArray(parsed.workflows) ? parsed.workflows.length : null
+		};
+	}
+	return {
+		kiciDir,
+		exists: fs$1.existsSync(kiciDir),
+		workflows,
+		lock
+	};
+}
+const DEFAULT_DEPS = {
+	loadConfig: async () => {
+		const { loadGlobalConfig } = await import("../../remote/config.js");
+		return await loadGlobalConfig();
+	},
+	probe: async () => {
+		const { loadGlobalConfig } = await import("../../remote/config.js");
+		const { DashboardClient, DashboardClientError } = await import("../../remote/dashboard-client.js");
+		const config = await loadGlobalConfig();
+		if (!config.activeOrgId || !(config.pat ?? config.token)) return null;
+		try {
+			return {
+				ok: true,
+				infra: await DashboardClient.fromConfig(config).getInfrastructure()
+			};
+		} catch (err) {
+			if (err instanceof DashboardClientError) return {
+				ok: false,
+				kind: err.kind,
+				message: err.message
+			};
+			throw err;
+		}
+	},
+	readProject: defaultReadProject,
+	fetchRun: async (runId) => {
+		const { loadGlobalConfig } = await import("../../remote/config.js");
+		const { DashboardClient } = await import("../../remote/dashboard-client.js");
+		const detail = await DashboardClient.fromConfig(await loadGlobalConfig()).getRunDetail(runId);
+		return {
+			detail,
+			logs: JSON.stringify(detail, null, 2)
+		};
+	},
+	now: () => /* @__PURE__ */ new Date()
+};
+/**
+* Run one collector, recording its outcome instead of letting it abort the
+* bundle. `empty` and `error` are the two signals the dev-side gap filer reads.
+*/
+async function runCollector(report, collector, fn, scrub) {
+	try {
+		const value = await fn();
+		const isEmpty = value === null || value === void 0 || Array.isArray(value) && value.length === 0 || typeof value === "string" && value.length === 0;
+		report.push({
+			collector,
+			status: isEmpty ? "empty" : "ok"
+		});
+		return value;
+	} catch (err) {
+		report.push({
+			collector,
+			status: "error",
+			note: scrub(err instanceof Error ? err.message : String(err))
+		});
+		return;
+	}
+}
+/** Machine facts about the host the report was produced on. */
+function systemInfo() {
+	return {
+		platform: os$1.platform(),
+		release: os$1.release(),
+		arch: os$1.arch(),
+		nodeVersion: process.version,
+		cpuCount: os$1.cpus().length,
+		totalMemory: os$1.totalmem(),
+		freeMemory: os$1.freemem(),
+		hostname: os$1.hostname()
+	};
+}
+/** sha256 over the finished file, so the customer can quote a digest. */
+async function digestOf(file) {
+	const hash = createHash("sha256");
+	await new Promise((resolve, reject) => {
+		const stream = fs$1.createReadStream(file);
+		stream.on("data", (chunk) => hash.update(chunk));
+		stream.on("end", resolve);
+		stream.on("error", reject);
+	});
+	return hash.digest("hex");
+}
+/**
+* Collect and write one report bundle.
+*
+* The body stays a narrative caller: each section is one `runCollector` call
+* whose result is appended to the archive, so adding a collector never grows
+* the control flow.
+*/
+async function createReportBundle(options) {
+	const deps = {
+		...DEFAULT_DEPS,
+		...options.deps
+	};
+	const scrub = options.redact ? scrubText : (s) => s;
+	const report = [];
+	const bundleId = randomUUID().replace(/-/g, "").slice(0, 24);
+	const dir = path$1.dirname(options.outputPath);
+	if (!fs$1.existsSync(dir)) fs$1.mkdirSync(dir, { recursive: true });
+	const output = fs$1.createWriteStream(options.outputPath);
+	const archive = new ZipArchive({ zlib: { level: 6 } });
+	const finalized = new Promise((resolve, reject) => {
+		output.on("close", resolve);
+		archive.on("error", reject);
+		output.on("error", reject);
+	});
+	archive.pipe(output);
+	let fileCount = 0;
+	const append = (body, name) => {
+		archive.append(scrub(JSON.stringify(body, null, 2)), { name });
+		fileCount += 1;
+	};
+	let probe;
+	try {
+		probe = await deps.probe();
+		report.push(probe === null ? {
+			collector: "probe",
+			status: "skipped",
+			note: "not authenticated"
+		} : {
+			collector: "probe",
+			status: "ok"
+		});
+	} catch (err) {
+		report.push({
+			collector: "probe",
+			status: "error",
+			note: scrub(err instanceof Error ? err.message : String(err))
+		});
+	}
+	const identity = await runCollector(report, "identity", () => Promise.resolve(collectIdentity(probe ?? null)), scrub);
+	if (identity) append(identity, "identity.json");
+	const config = await runCollector(report, "config", () => deps.loadConfig(), scrub);
+	if (config !== void 0) append(options.redact ? redactConfig(config) : config, "config/config.json");
+	const project = await runCollector(report, "project", () => deps.readProject(options.kiciDir), scrub);
+	if (project !== void 0) append(project, "project/project.json");
+	const system = await runCollector(report, "system", () => Promise.resolve(systemInfo()), scrub);
+	if (system !== void 0) append(system, "system/info.json");
+	if (options.runId) {
+		const run = await runCollector(report, "run", () => deps.fetchRun(options.runId), scrub);
+		if (run !== void 0) {
+			append(run.detail, `runs/${options.runId}/detail.json`);
+			archive.append(scrub(run.logs), { name: `runs/${options.runId}/logs.txt` });
+			fileCount += 1;
+		}
+	} else report.push({
+		collector: "run",
+		status: "skipped",
+		note: "no --run given"
+	});
+	const manifest = {
+		version: "1.0",
+		generated_at: deps.now().toISOString(),
+		bundle_id: bundleId,
+		node_version: process.version,
+		platform: process.platform,
+		metadata: options.metadata,
+		redacted: options.redact,
+		collectionReport: report
+	};
+	archive.append(scrub(JSON.stringify(manifest, null, 2)), { name: "manifest.json" });
+	fileCount += 1;
+	await archive.finalize();
+	await finalized;
+	return {
+		path: options.outputPath,
+		sha256: await digestOf(options.outputPath),
+		bundleId,
+		fileCount,
+		collectionReport: report
+	};
+}
+//#endregion
+export { CollectionStatus, REPORT_BUNDLE_VERSION, createReportBundle };
+
+//# sourceMappingURL=collect.js.map

package/dist/commands/report/identity.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Version and environment context for an issue report.
+ *
+ * A report without version context costs a support round-trip before anyone can
+ * even reproduce the problem, so this is collected first and never fails: the
+ * client-side half always resolves, and the component versions are folded in
+ * only when the authenticated probe actually reached the Platform.
+ */
+import type { ProbeOutcome } from '../doctor.js';
+/** One orchestrator the caller's org has connected, and what it is running. */
+export interface OrchestratorIdentity {
+    clusterName: string;
+    version: string | null;
+    mode: string | null;
+    connected: boolean;
+}
+export interface ReportIdentity {
+    kiciCliVersion: string;
+    nodeVersion: string;
+    platform: string;
+    arch: string;
+    /** The wire protocol this CLI speaks. */
+    protocolVersion: number;
+    /**
+     * Every orchestrator the probe saw, not just the first: a report about a
+     * routing problem is usually about which of several answered.
+     */
+    orchestrators: OrchestratorIdentity[];
+    /**
+     * The newest KiCI version the Platform knows about, when it told us. This is
+     * an upgrade hint, NOT the Platform's own version — the diagnostics response
+     * carries no such field, and inventing one would put a fabricated value in a
+     * bundle a human will read as fact.
+     */
+    latestKnownVersion?: string;
+    /** Why component versions are missing, when the probe could not run. */
+    probeError?: string;
+}
+/**
+ * Build the identity block.
+ *
+ * `probe` is the same `ProbeOutcome` `kici doctor` already performs — one
+ * authenticated infrastructure read — passed in rather than re-fetched so a
+ * report never issues a second round trip for data the caller may already
+ * hold, and so every path is testable without network.
+ */
+export declare function collectIdentity(probe: ProbeOutcome | null): ReportIdentity;
+//# sourceMappingURL=identity.d.ts.map

package/dist/commands/report/identity.js

@@ -0,0 +1,49 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { PROTOCOL_VERSION } from "@kici-dev/engine";
+//#region src/commands/report/identity.ts
+/**
+* Version and environment context for an issue report.
+*
+* A report without version context costs a support round-trip before anyone can
+* even reproduce the problem, so this is collected first and never fails: the
+* client-side half always resolves, and the component versions are folded in
+* only when the authenticated probe actually reached the Platform.
+*/
+/**
+* Build the identity block.
+*
+* `probe` is the same `ProbeOutcome` `kici doctor` already performs — one
+* authenticated infrastructure read — passed in rather than re-fetched so a
+* report never issues a second round trip for data the caller may already
+* hold, and so every path is testable without network.
+*/
+function collectIdentity(probe) {
+	const identity = {
+		kiciCliVersion: "0.6.0",
+		nodeVersion: process.version,
+		platform: process.platform,
+		arch: process.arch,
+		protocolVersion: PROTOCOL_VERSION,
+		orchestrators: []
+	};
+	if (probe === null) {
+		identity.probeError = "not authenticated; component versions unavailable";
+		return identity;
+	}
+	if (!probe.ok) {
+		identity.probeError = `${probe.kind}: ${probe.message}`;
+		return identity;
+	}
+	identity.orchestrators = probe.infra.orchestrators.map((o) => ({
+		clusterName: o.clusterName ?? "(unnamed)",
+		version: o.version ?? null,
+		mode: o.mode ?? null,
+		connected: o.connected
+	}));
+	if (probe.infra.latestVersion) identity.latestKnownVersion = probe.infra.latestVersion;
+	return identity;
+}
+//#endregion
+export { collectIdentity };
+
+//# sourceMappingURL=identity.js.map

package/dist/commands/report/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * `kici report` — produce a redacted diagnostic bundle to share when reporting
+ * an issue, and optionally upload it privately to KiCI.
+ *
+ * Writing and sending are separate acts. The default writes a ZIP next to you
+ * and tells you where it is, so you can open it and see exactly what you would
+ * be sharing; `--upload` is the explicit second step.
+ */
+import { type ReportBundleDeps } from './collect.js';
+import { type UploadDeps } from './upload.js';
+export interface ReportOptions {
+    output?: string;
+    run?: string;
+    /** Repeatable `key=value` pairs. */
+    metadata: string[];
+    redact: boolean;
+    upload?: boolean;
+    message?: string;
+    email?: string;
+    kiciDir: string;
+    deps?: Partial<ReportBundleDeps>;
+    uploadDeps?: UploadDeps;
+}
+export interface ReportListOptions {
+    json?: boolean;
+    deps?: {
+        listIssueReports: () => Promise<{
+            reports: ReportRow[];
+        }>;
+    };
+}
+export interface ReportRow {
+    ref: string;
+    bundleId: string;
+    byteSize: number;
+    status: string;
+    createdAt: string;
+    userId: string;
+    message: string | null;
+}
+export interface ReportWithdrawOptions {
+    ref: string;
+    deps?: {
+        withdrawIssueReport: (ref: string) => Promise<{
+            ref: string;
+            deleted: boolean;
+        }>;
+    };
+}
+/**
+ * Parse repeatable `--metadata key=value` into a record.
+ *
+ * The accumulator is null-prototyped so a `__proto__=x` pair is stored as an
+ * ordinary key rather than silently vanishing into the prototype — a dropped
+ * pair in a diagnostic bundle is a lie about what the reporter attached.
+ */
+export declare function parseMetadata(pairs: string[]): Record<string, string>;
+/** Default bundle path: timestamped, in the working directory. */
+export declare function defaultOutputPath(now: Date): string;
+export declare function reportCommand(options: ReportOptions): Promise<boolean>;
+export declare function reportListCommand(options: ReportListOptions): Promise<boolean>;
+export declare function reportWithdrawCommand(options: ReportWithdrawOptions): Promise<boolean>;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/report/index.js

@@ -0,0 +1,119 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { DashboardClientError } from "../../remote/dashboard-client.js";
+import { createReportBundle } from "./collect.js";
+import { uploadReportBundle } from "./upload.js";
+import * as path$1 from "node:path";
+import pc from "picocolors";
+import { createLogger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/report/index.ts
+/**
+* `kici report` — produce a redacted diagnostic bundle to share when reporting
+* an issue, and optionally upload it privately to KiCI.
+*
+* Writing and sending are separate acts. The default writes a ZIP next to you
+* and tells you where it is, so you can open it and see exactly what you would
+* be sharing; `--upload` is the explicit second step.
+*/
+const logger$1 = createLogger({ prefix: "report" });
+/**
+* Parse repeatable `--metadata key=value` into a record.
+*
+* The accumulator is null-prototyped so a `__proto__=x` pair is stored as an
+* ordinary key rather than silently vanishing into the prototype — a dropped
+* pair in a diagnostic bundle is a lie about what the reporter attached.
+*/
+function parseMetadata(pairs) {
+	const out = Object.create(null);
+	for (const pair of pairs) {
+		const eq = pair.indexOf("=");
+		if (eq <= 0) throw new Error(`Invalid --metadata "${pair}": expected key=value.`);
+		out[pair.slice(0, eq)] = pair.slice(eq + 1);
+	}
+	return { ...out };
+}
+/** Default bundle path: timestamped, in the working directory. */
+function defaultOutputPath(now) {
+	const stamp = now.toISOString().replace(/[:.]/g, "-").replace(/Z$/, "");
+	return path$1.resolve(`./kici-report-${stamp}.zip`);
+}
+async function reportCommand(options) {
+	try {
+		const metadata = parseMetadata(options.metadata);
+		const now = options.deps?.now?.() ?? /* @__PURE__ */ new Date();
+		const outputPath = options.output ? path$1.resolve(options.output) : defaultOutputPath(now);
+		if (!options.redact && options.upload) throw new Error("--no-redact cannot be combined with --upload: that would send unredacted secrets to KiCI. Write the bundle locally, review it, and share it yourself.");
+		if (!options.redact) console.warn(pc.yellow("WARNING: --no-redact was given. This bundle keeps secrets in plain text. Review it carefully and do not share it unless you are certain."));
+		const result = await createReportBundle({
+			outputPath,
+			kiciDir: options.kiciDir,
+			runId: options.run,
+			metadata,
+			redact: options.redact,
+			deps: options.deps
+		});
+		const problems = result.collectionReport.filter((e) => e.status === "error" || e.status === "empty");
+		console.log(`Report bundle written to ${result.path}`);
+		console.log(`  sha256: ${result.sha256}`);
+		console.log(`  ${result.fileCount} file(s) collected`);
+		if (problems.length > 0) console.log(`  incomplete: ${problems.map((p) => `${p.collector} (${p.status})`).join(", ")}`);
+		if (options.redact) console.log(pc.dim("  Redaction is best effort. Review the bundle before sharing it — unknown secret formats can survive."));
+		if (options.upload) {
+			const upload = await uploadReportBundle(result.path, {
+				bundleId: result.bundleId,
+				message: options.message,
+				email: options.email
+			}, options.uploadDeps);
+			console.log("");
+			console.log(`Report uploaded. Quote reference ${pc.bold(upload.ref)} to KiCI support.`);
+		} else {
+			console.log("");
+			console.log(pc.dim("Send it with `kici report --upload`, or attach the file yourself."));
+		}
+		return true;
+	} catch (err) {
+		logger$1.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+async function reportListCommand(options) {
+	try {
+		const list = options.deps ? await options.deps.listIssueReports() : await (async () => {
+			const { DashboardClient } = await import("../../remote/dashboard-client.js");
+			return (await DashboardClient.load()).listIssueReports();
+		})();
+		if (options.json) {
+			console.log(JSON.stringify(list, null, 2));
+			return true;
+		}
+		if (list.reports.length === 0) {
+			console.log("No issue reports uploaded.");
+			return true;
+		}
+		for (const r of list.reports) console.log(`${r.ref}  ${r.status.padEnd(8)}  ${r.byteSize} bytes  ${r.createdAt}  ${r.bundleId}`);
+		return true;
+	} catch (err) {
+		logger$1.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+async function reportWithdrawCommand(options) {
+	try {
+		if (!(await (options.deps ? options.deps.withdrawIssueReport : await (async () => {
+			const { DashboardClient } = await import("../../remote/dashboard-client.js");
+			const client = await DashboardClient.load();
+			return client.withdrawIssueReport.bind(client);
+		})())(options.ref)).deleted) {
+			logger$1.error(pc.red(`Report ${options.ref} was NOT deleted. Try again, or contact KiCI.`));
+			return false;
+		}
+		console.log(`Report ${options.ref} withdrawn. The uploaded bundle has been deleted.`);
+		return true;
+	} catch (err) {
+		logger$1.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+//#endregion
+export { defaultOutputPath, parseMetadata, reportCommand, reportListCommand, reportWithdrawCommand };
+
+//# sourceMappingURL=index.js.map

package/dist/commands/report/upload.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Upload a report bundle privately to KiCI.
+ *
+ * Three steps, and the split is the point: the Platform mints a presigned PUT,
+ * the bytes go straight from this machine to object storage, and a confirm call
+ * lets the Platform verify what actually landed. The bundle never transits the
+ * control plane, and the Platform never takes the client's word for the size.
+ *
+ * Upload is always opt-in (`--upload`). A bundle contains diagnostic data from
+ * the customer's own machine, so sending it is a separate, explicit act from
+ * producing it.
+ */
+import { DashboardClient } from '../../remote/dashboard-client.js';
+export interface UploadMeta {
+    bundleId: string;
+    message?: string;
+    email?: string;
+}
+export interface UploadDeps {
+    createIssueReport: DashboardClient['createIssueReport'];
+    confirmIssueReport: DashboardClient['confirmIssueReport'];
+    /** PUT the bundle bytes at the presigned URL. */
+    putBytes: (url: string, body: Buffer) => Promise<void>;
+}
+/** sha256 of the file, which the Platform records alongside the report. */
+export declare function sha256Of(body: Buffer): string;
+/**
+ * Upload one bundle and return the reference id to quote to support.
+ *
+ * Reads the file once and derives both the size and the digest from those same
+ * bytes, so what is promised at presign time is necessarily what is uploaded —
+ * a stat-then-read would race a file still being written.
+ */
+export declare function uploadReportBundle(zipPath: string, meta: UploadMeta, deps?: UploadDeps): Promise<{
+    ref: string;
+    status: string;
+}>;
+//# sourceMappingURL=upload.d.ts.map