@kici-dev/compiler 0.4.0 → 0.6.0

package/dist/commands/report/upload.js

@@ -0,0 +1,64 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { DashboardClient } from "../../remote/dashboard-client.js";
+import * as fs$1 from "node:fs";
+import { createHash } from "node:crypto";
+//#region src/commands/report/upload.ts
+/**
+* Upload a report bundle privately to KiCI.
+*
+* Three steps, and the split is the point: the Platform mints a presigned PUT,
+* the bytes go straight from this machine to object storage, and a confirm call
+* lets the Platform verify what actually landed. The bundle never transits the
+* control plane, and the Platform never takes the client's word for the size.
+*
+* Upload is always opt-in (`--upload`). A bundle contains diagnostic data from
+* the customer's own machine, so sending it is a separate, explicit act from
+* producing it.
+*/
+/** sha256 of the file, which the Platform records alongside the report. */
+function sha256Of(body) {
+	return createHash("sha256").update(body).digest("hex");
+}
+async function defaultPutBytes(url, body) {
+	const res = await fetch(url, {
+		method: "PUT",
+		body: new Uint8Array(body),
+		headers: { "Content-Length": String(body.byteLength) }
+	});
+	if (!res.ok) throw new Error(`Bundle upload failed (${res.status} ${res.statusText}).`);
+}
+async function defaultDeps() {
+	const client = await DashboardClient.load();
+	return {
+		createIssueReport: client.createIssueReport.bind(client),
+		confirmIssueReport: client.confirmIssueReport.bind(client),
+		putBytes: defaultPutBytes
+	};
+}
+/**
+* Upload one bundle and return the reference id to quote to support.
+*
+* Reads the file once and derives both the size and the digest from those same
+* bytes, so what is promised at presign time is necessarily what is uploaded —
+* a stat-then-read would race a file still being written.
+*/
+async function uploadReportBundle(zipPath, meta, deps) {
+	const resolved = deps ?? await defaultDeps();
+	const body = fs$1.readFileSync(zipPath);
+	const { ref, uploadUrl } = await resolved.createIssueReport({
+		bundleId: meta.bundleId,
+		byteSize: body.byteLength,
+		sha256: sha256Of(body),
+		message: meta.message,
+		email: meta.email
+	});
+	await resolved.putBytes(uploadUrl, body);
+	return {
+		ref,
+		status: (await resolved.confirmIssueReport(ref)).status
+	};
+}
+//#endregion
+export { sha256Of, uploadReportBundle };
+
+//# sourceMappingURL=upload.js.map

package/dist/commands/run-hold-watch.js

@@ -66,7 +66,7 @@ async function handleNewHolds(args) {
 		printHold(action.hold, out);
 		ctx = ctx ?? await resolveCtx();
 		if (!ctx) {
-			out(pc.dim(`Run held; approve via \`kici approve ${action.hold.runId}\`.`));
+			out(pc.dim(`Run held; approve via \`kici approve ${action.hold.runId} --hold ${action.hold.id}\`.`));
 			continue;
 		}
 		if (args.approveAll) {
@@ -74,7 +74,7 @@ async function handleNewHolds(args) {
 			continue;
 		}
 		if (action.kind === "notify") {
-			out(pc.dim(`Run held; approve via the dashboard or \`kici approve ${action.hold.runId}\`.`));
+			out(pc.dim(`Run held; approve via the dashboard or \`kici approve ${action.hold.runId} --hold ${action.hold.id}\`.`));
 			continue;
 		}
 		const approved = await args.confirm("Approve this gate?");

package/dist/commands/run.js

@@ -303,8 +303,10 @@ async function renderResults(results, options) {
 		const junitXml = formatJunitResult(runResults);
 		await writeFile(options.junit, junitXml);
 		if (!options.quiet) logger.info(pc.green(`JUnit XML written to ${options.junit}`));
-	} else if (!options.quiet || results.some((r) => r.status !== "success" && r.status !== "accepted")) if (runResults.length > 1) logger.info(formatMultiFixtureSummary(runResults));
-	else displayRemoteResults(results);
+	} else if (!options.quiet || results.some((r) => r.status !== "success" && r.status !== "accepted")) {
+		if (runResults.length > 1) logger.info(formatMultiFixtureSummary(runResults));
+		else displayRemoteResults(results);
+	}
 	return results.every((r) => r.status === "accepted" || r.status === "success");
 }
 /**
@@ -537,10 +539,11 @@ async function watchRunHolds(runId, seenHolds, getCtx, setCtx, options) {
 		const holds = await listHeldRunsForRun(ctx, runId);
 		if (holds.length === 0) return;
 		const quiet = Boolean(options.quiet);
+		const isTty = quiet ? false : Boolean(process.stdin.isTTY && process.stdout.isTTY);
 		await handleNewHolds({
 			holds,
 			seen: seenHolds,
-			isTty: quiet ? false : Boolean(process.stdin.isTTY && process.stdout.isTTY),
+			isTty,
 			output: quiet ? (line) => void process.stderr.write(line + "\n") : (line) => logger.info(line),
 			approveAll: Boolean(options.approveAll),
 			confirm: (message) => confirm({

package/dist/commands/runs/show.js

@@ -2,6 +2,7 @@ import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { RunHistory } from "../../remote/history.js";
 import { colorStatus, formatDuration as formatDuration$1, relativeTime } from "../../remote/render.js";
+import { HeldRunRequestError, listHeldRunsForRun, resolveHeldRunContext } from "../held-run-client.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/runs/show.ts
@@ -17,33 +18,111 @@ async function runsShowCommand(runId, options = {}) {
 			throw err;
 		}
 		const detail = await client.getRunDetail(runId);
+		const holds = await loadHolds(runId);
 		if (options.json) {
 			console.log(JSON.stringify({
 				run,
-				detail
+				detail,
+				heldRuns: holds.holds,
+				...holds.unavailable && { heldRunsUnavailable: holds.unavailable }
 			}, null, 2));
 			return true;
 		}
 		printHeader(run);
+		printInitFailure(detail.initFailure);
 		printJobs(detail.jobs);
+		printHolds(holds);
 		return true;
 	} catch (err) {
 		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
 		return false;
 	}
 }
+/**
+* Read the approval holds recorded for a run.
+*
+* The holds are extra detail on a run this command can already display, so a
+* failure here degrades to a note rather than failing the command: an operator
+* asking why a job did not run still gets the run, its jobs and its init
+* failure. The auth context is resolved quietly for the same reason — a config
+* that cannot reach the held-runs API is not an error for `runs show`.
+*/
+async function loadHolds(runId) {
+	try {
+		const ctx = await resolveHeldRunContext({ quiet: true });
+		if (!ctx) return {
+			holds: [],
+			unavailable: "not authenticated for held-run lookup",
+			unavailableSilently: true
+		};
+		return { holds: await listHeldRunsForRun(ctx, runId) };
+	} catch (err) {
+		const denied = err instanceof HeldRunRequestError && err.isPermissionDenied;
+		return {
+			holds: [],
+			unavailable: toErrorMessage(err),
+			...denied && { unavailableSilently: true }
+		};
+	}
+}
 function printHeader(run) {
 	const f = (v) => v == null ? "—" : v;
 	console.log(pc.bold(`\nRun ${run.runId}`) + `  ${colorStatus(run.status)}`);
 	console.log(pc.gray(`  workflow=${f(run.workflowName)} repo=${f(run.repoIdentifier)} branch=${f(run.ref)} sha=${f(run.sha)} trigger=${f(run.triggerEvent)} by=${f(run.triggeredBy)}`));
 	console.log(pc.gray(`  started=${relativeTime(run.startedAt ?? void 0)}`));
 }
+/**
+* The run-scoped init failure — why the run never started a step (an
+* unresolvable lock file, a secret it could not read, a gate it never passed).
+* Nothing is printed when the run started normally.
+*/
+function printInitFailure(initFailure) {
+	if (!initFailure) return;
+	console.log(`\n  ${pc.yellow("Init failure")} ${pc.gray(`(${initFailure.category})`)}`);
+	console.log(`    ${initFailure.message}`);
+}
 function printJobs(jobs) {
 	for (const j of jobs) {
 		console.log(`\n  ${pc.bold(j.jobName)} ${colorStatus(j.status)} ` + pc.gray(j.durationMs ? formatDuration$1(j.durationMs) : ""));
+		printJobFailure(j);
 		for (const s of j.steps ?? []) console.log(pc.gray("    └─ ") + `${s.stepName} ${colorStatus(s.status)} ` + pc.gray(`${s.durationMs ? formatDuration$1(s.durationMs) : ""}${s.exitCode != null ? ` exit=${s.exitCode}` : ""}`));
 	}
 }
+/**
+* Why a single job failed: its job-scoped init failure (a job the context rules
+* rejected carries `context_rules` plus the context and rule that rejected it),
+* or its plain error message. The init failure wins when both are present —
+* the two carry the same text on a rejected job, and the category is the part
+* that tells the reader whether a gate or a step failed.
+*/
+function printJobFailure(job) {
+	if (job.initFailure) {
+		console.log(`    ${pc.yellow("init failure")} ${pc.gray(`(${job.initFailure.category})`)}: ` + job.initFailure.message);
+		return;
+	}
+	if (job.errorMessage) console.log(`    ${pc.red("error")}: ${job.errorMessage}`);
+}
+/** The approval holds recorded against the run, or a note when unreadable. */
+function printHolds(result) {
+	if (result.unavailable) {
+		if (!result.unavailableSilently) console.log(pc.gray(`\n  Approval-hold detail unavailable: ${result.unavailable}`));
+		return;
+	}
+	if (result.holds.length === 0) return;
+	console.log(`\n  ${pc.bold(`Approval holds (${result.holds.length})`)}`);
+	for (const h of result.holds) {
+		const parts = [
+			h.jobId || "(workflow)",
+			h.holdType ?? "—",
+			h.contextName ? `context=${h.contextName}` : void 0,
+			h.queueType ? `queue=${h.queueType}` : void 0,
+			colorStatus(h.status)
+		].filter((p) => p != null);
+		console.log(`    ${parts.join("  ")}`);
+		if (h.reason) console.log(pc.gray(`      reason: ${h.reason}`));
+		if (h.expiresAt) console.log(pc.gray(`      expires: ${relativeTime(h.expiresAt)}`));
+	}
+}
 async function showLocalFallback(runId, json) {
 	const history = new RunHistory();
 	await history.load();

package/dist/commands/types.js

@@ -8,6 +8,32 @@ import fs from "node:fs/promises";
 import { toErrorMessage } from "@kici-dev/core";
 //#region src/commands/types.ts
 /**
+* Error kinds meaning the Platform is genuinely unreachable or the CLI is not
+* configured to reach it — not authenticated, no active org, network down, or
+* orchestrator offline. For these, `kici types` writes a valid empty stub so
+* the declaration file always exists (typecheck degrades to "no known keys"
+* rather than "module has no exported member") instead of failing.
+*
+* An authenticated-but-rejected response (`unauthorized`, `forbidden`, …) is
+* deliberately excluded: that is a real credential/permission problem the user
+* must see, and writing a stub would mask it.
+*/
+const UNREACHABLE_ERROR_KINDS = [
+	"not_logged_in",
+	"no_active_org",
+	"orchestrator_offline",
+	"http"
+];
+/** True if `p` exists (any type). Used to avoid clobbering a real snapshot. */
+async function fileExists(p) {
+	try {
+		await fs.access(p);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
 * Generate TypeScript declarations for context secrets.
 *
 * Fetches context metadata (with secret key names) through the Platform
@@ -18,24 +44,40 @@ import { toErrorMessage } from "@kici-dev/core";
 * @returns true on success, false on error
 */
 async function typesCommand(options = {}) {
+	const kiciDir = options.kiciDir ?? ".kici";
+	const typesDir = path.join(kiciDir, "types");
+	const outputPath = path.join(typesDir, "secrets.d.ts");
 	try {
 		const config = await loadGlobalConfig();
+		const metadata = (await DashboardClient.fromConfig(config).listContexts(true)).map((e) => ({
+			name: e.name,
+			keys: e.secretKeys ?? []
+		}));
+		const source = config.platformEndpoint ?? config.endpoint ?? "kici Platform";
 		const dtsContent = generateSecretsDts({
-			contexts: (await DashboardClient.fromConfig(config).listContexts(true)).map((e) => ({
-				name: e.name,
-				keys: e.secretKeys ?? []
-			})),
-			endpoint: (config.platformEndpoint ?? config.endpoint ?? "kici Platform").replace(/\/+$/, ""),
-			generatedAt: /* @__PURE__ */ new Date()
+			contexts: metadata,
+			endpoint: source.replace(/\/+$/, "")
 		});
-		const kiciDir = options.kiciDir ?? ".kici";
-		const typesDir = path.join(kiciDir, "types");
 		await fs.mkdir(typesDir, { recursive: true });
-		const outputPath = path.join(typesDir, "secrets.d.ts");
 		await fs.writeFile(outputPath, dtsContent, "utf-8");
 		if (!options.quiet) console.log(pc.green("Types generated") + pc.dim(` ${outputPath}`));
 		return true;
 	} catch (err) {
+		if (err instanceof DashboardClientError && UNREACHABLE_ERROR_KINDS.includes(err.kind)) {
+			if (await fileExists(outputPath)) {
+				console.error(pc.yellow(`${err.message} Keeping the existing ${outputPath}; run \`kici types\` when authenticated to refresh it.`));
+				return true;
+			}
+			const stub = generateSecretsDts({
+				contexts: [],
+				endpoint: "",
+				offline: true
+			});
+			await fs.mkdir(typesDir, { recursive: true });
+			await fs.writeFile(outputPath, stub, "utf-8");
+			console.error(pc.yellow(`${err.message} Wrote an offline type stub to ${outputPath}; run \`kici types\` when authenticated to populate it.`));
+			return true;
+		}
 		if (err instanceof DashboardClientError) {
 			console.error(pc.red(err.message));
 			return false;

package/dist/errors/formatter.d.ts

@@ -1,7 +1,7 @@
 /**
  * Error code string. Thrown compile errors use `E<digits>` (e.g. 'E001', 'E102');
- * advisory, render-only diagnostics use `W<digits>` (e.g. 'W101'). `isCompilerError`
- * only matches the `E<digits>` family — warning codes are never thrown, only rendered.
+ * advisory, render-only diagnostics use `W<digits>`. `isCompilerError` only
+ * matches the `E<digits>` family — warning codes are never thrown, only rendered.
  */
 type ErrorCode = string;
 /** Diagnostic severity. Errors abort compilation; warnings are advisory (compile still succeeds). */
@@ -9,8 +9,6 @@ export declare enum DiagnosticSeverity {
     Error = "error",
     Warning = "warning"
 }
-/** Warning code for the impure dynamic-value → init-job fallback. */
-export declare const PURITY_FALLBACK_CODE = "W101";
 /** Source location for error reporting */
 export interface SourceLocation {
     readonly file: string;

package/dist/errors/formatter.js

@@ -7,8 +7,6 @@ let DiagnosticSeverity = /* @__PURE__ */ function(DiagnosticSeverity) {
 	DiagnosticSeverity["Warning"] = "warning";
 	return DiagnosticSeverity;
 }({});
-/** Warning code for the impure dynamic-value → init-job fallback. */
-const PURITY_FALLBACK_CODE = "W101";
 /**
 * Format error in GNU standard format: file:line:column: error [CODE]: message
 *
@@ -40,6 +38,6 @@ function isCompilerError(error) {
 	return typeof error === "object" && error !== null && "code" in error && "message" in error && typeof error.code === "string" && /^E\d+$/.test(error.code);
 }
 //#endregion
-export { DiagnosticSeverity, PURITY_FALLBACK_CODE, compilerError, formatError, isCompilerError };
+export { DiagnosticSeverity, compilerError, formatError, isCompilerError };
 
 //# sourceMappingURL=formatter.js.map

package/dist/errors/index.d.ts

@@ -1,4 +1,4 @@
-export { formatError, compilerError, isCompilerError, DiagnosticSeverity, PURITY_FALLBACK_CODE, } from './formatter.js';
+export { formatError, compilerError, isCompilerError, DiagnosticSeverity } from './formatter.js';
 export type { SourceLocation, CompilerError } from './formatter.js';
 export { CapabilityGapError, formatCapabilityGapError } from './capability-gap.js';
 export type { CapabilityGapInfo } from './capability-gap.js';

package/dist/errors/index.js

@@ -1,5 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
-import { DiagnosticSeverity, PURITY_FALLBACK_CODE, compilerError, formatError, isCompilerError } from "./formatter.js";
+import { DiagnosticSeverity, compilerError, formatError, isCompilerError } from "./formatter.js";
 import { CapabilityGapError, formatCapabilityGapError } from "./capability-gap.js";
 import { firstStepLocation, locationForJob, locationForWorkflow } from "./source-location.js";
-export { CapabilityGapError, DiagnosticSeverity, PURITY_FALLBACK_CODE, compilerError, firstStepLocation, formatCapabilityGapError, formatError, isCompilerError, locationForJob, locationForWorkflow };
+export { CapabilityGapError, DiagnosticSeverity, compilerError, firstStepLocation, formatCapabilityGapError, formatError, isCompilerError, locationForJob, locationForWorkflow };

package/dist/execution/sdk-alias.js

@@ -19,7 +19,8 @@ import { readFile } from "node:fs/promises";
 */
 async function getSdkPathFromPackageJson() {
 	try {
-		const content = await readFile(path.resolve(process.cwd(), ".kici", "package.json"), "utf-8");
+		const pkgPath = path.resolve(process.cwd(), ".kici", "package.json");
+		const content = await readFile(pkgPath, "utf-8");
 		const sdkPath = JSON.parse(content).kici?.sdkPath;
 		if (!sdkPath) return null;
 		return path.resolve(sdkPath);
@@ -36,7 +37,8 @@ async function getSdkPathFromPackageJson() {
 */
 async function isInKiciRepo() {
 	try {
-		const content = await readFile(path.resolve(process.cwd(), "package.json"), "utf-8");
+		const rootPkgPath = path.resolve(process.cwd(), "package.json");
+		const content = await readFile(rootPkgPath, "utf-8");
 		return JSON.parse(content).kici?.development === true;
 	} catch {
 		return false;

package/dist/fixtures/compiler.js

@@ -119,7 +119,8 @@ async function ensureRuntimeSymlinks(filePath) {
 			continue;
 		} catch {}
 		try {
-			const pkgDir = await findPackageRoot(fileURLToPath(import.meta.resolve(pkg)));
+			const entry = import.meta.resolve(pkg);
+			const pkgDir = await findPackageRoot(fileURLToPath(entry));
 			const linkParent = path.dirname(linkPath);
 			if (linkParent !== nodeModulesDir) await fs.mkdir(linkParent, { recursive: true });
 			await fs.symlink(pkgDir, linkPath);

package/dist/format.js

@@ -6,12 +6,12 @@ import "./rolldown-runtime-ClRpJifh.js";
 function formatRelativeTime(isoDate) {
 	const ms = Date.now() - new Date(isoDate).getTime();
 	if (ms < 0) return "just now";
-	const minutes = Math.floor(ms / (60 * 1e3));
+	const minutes = Math.floor(ms / 6e4);
 	if (minutes < 1) return "just now";
 	if (minutes < 60) return `${minutes} minute${minutes === 1 ? "" : "s"} ago`;
-	const hours = Math.floor(ms / (3600 * 1e3));
+	const hours = Math.floor(ms / 36e5);
 	if (hours < 24) return `${hours} hour${hours === 1 ? "" : "s"} ago`;
-	const days = Math.floor(ms / (1440 * 60 * 1e3));
+	const days = Math.floor(ms / 864e5);
 	return `${days} day${days === 1 ? "" : "s"} ago`;
 }
 //#endregion

package/dist/generators/secrets-dts.d.ts

@@ -10,10 +10,16 @@ export interface ContextMetadata {
     name: string;
     keys: string[];
 }
-interface GenerateSecretsDtsOptions {
+export interface GenerateSecretsDtsOptions {
     contexts: ContextMetadata[];
     endpoint: string;
-    generatedAt: Date;
+    /**
+     * Mark the output as an offline stub written when the Platform could not be
+     * reached (unauthenticated, offline, or no active org). The header names it a
+     * stub instead of a source URL so a reader can tell it from a real snapshot,
+     * and the caller passes `contexts: []` so it augments no known keys.
+     */
+    offline?: boolean;
 }
 /**
  * Generate a .d.ts string from context metadata.
@@ -25,5 +31,4 @@ interface GenerateSecretsDtsOptions {
  * @returns The .d.ts file content as a string
  */
 export declare function generateSecretsDts(options: GenerateSecretsDtsOptions): string;
-export {};
 //# sourceMappingURL=secrets-dts.d.ts.map

package/dist/generators/secrets-dts.js

@@ -34,11 +34,11 @@ function buildKeySourceMap(contexts) {
 * @returns The .d.ts file content as a string
 */
 function generateSecretsDts(options) {
-	const { contexts, endpoint, generatedAt } = options;
+	const { contexts, endpoint, offline } = options;
 	const lines = [];
 	lines.push("// @generated by kici types -- DO NOT EDIT");
-	lines.push(`// Source: ${endpoint}`);
-	lines.push(`// Generated: ${generatedAt.toISOString()}`);
+	if (offline) lines.push("// Source: offline stub -- Platform unreachable, no known secret keys");
+	else lines.push(`// Source: ${endpoint}`);
 	lines.push("// Run `kici types` to refresh");
 	lines.push("");
 	lines.push("declare module '@kici-dev/sdk' {");

package/dist/hooks/installer.js

@@ -252,7 +252,8 @@ repos:
 */
 async function resolveCommonGitDir(gitDir) {
 	try {
-		const commondir = (await readFile(path.join(gitDir, "commondir"), "utf-8")).trim();
+		const commondirPath = path.join(gitDir, "commondir");
+		const commondir = (await readFile(commondirPath, "utf-8")).trim();
 		return path.resolve(gitDir, commondir);
 	} catch {
 		return gitDir;