@kici-dev/compiler 0.5.0 → 0.6.0

package/dist/cli.js

@@ -4,10 +4,10 @@ import { shouldSuppressBanner } from "./cli-banner.js";
 import { fileURLToPath } from "node:url";
 import { resolve } from "node:path";
 import { realpathSync } from "node:fs";
-import { Argument, Command, Option } from "commander";
+import { Argument, Command } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.5.0";
+const version = "0.6.0";
 /**
 * Top-level commands that were removed, mapped to their current equivalent.
 * Consulted when the CLI hits an unknown command so the user gets a precise
@@ -139,7 +139,7 @@ function buildProgram() {
 		const success = await previewCommand(event, options);
 		process.exit(success ? 0 : 1);
 	});
-	program.command("init").description("Initialize .kici/ directory with default workflows").option("--force", "Overwrite existing .kici/ directory", false).option("--skip-install", "Create files without installing dependencies", false).option("--package-manager <npm|pnpm|yarn>", "Force a package manager for the install step (default: auto-detect)").option("--mjs", "JavaScript-only mode (no TypeScript, no dependencies)", false).option("--workspace", "Integrate .kici/ into the detected pnpm/npm/yarn workspace so workflows can import sibling packages", false).option("--standalone", "Force a self-contained .kici/ even inside a workspace", false).option("--no-agents-md", "Skip writing .kici/AGENTS.md (LLM authoring context)").option("--private-registry <url>", "Scaffold a workflow registries: entry pointing at <url>").option("--private-registry-scope <scope>", "Optional npm package scope (e.g. @my-org) for the private registry").option("--private-registry-secret <ref>", "Qualified secret reference (env:NAME) the private registry token comes from", "production:NPM_TOKEN").addOption(new Option("--use-verdaccio-local").default(false).hideHelp()).action(async (options) => {
+	program.command("init").description("Initialize .kici/ directory with default workflows").option("--force", "Overwrite existing .kici/ directory", false).option("--skip-install", "Create files without installing dependencies", false).option("--package-manager <npm|pnpm|yarn>", "Force a package manager for the install step (default: auto-detect)").option("--mjs", "JavaScript-only mode (no TypeScript, no dependencies)", false).option("--workspace", "Integrate .kici/ into the detected pnpm/npm/yarn workspace so workflows can import sibling packages", false).option("--standalone", "Force a self-contained .kici/ even inside a workspace", false).option("--no-agents-md", "Skip writing .kici/AGENTS.md (LLM authoring context)").option("--private-registry <url>", "Scaffold a workflow registries: entry pointing at <url>").option("--private-registry-scope <scope>", "Optional npm package scope (e.g. @my-org) for the private registry").option("--private-registry-secret <ref>", "Qualified secret reference (env:NAME) the private registry token comes from", "production:NPM_TOKEN").action(async (options) => {
 		const { initCommand } = await import("./commands/index.js");
 		const success = await initCommand({
 			...options,
@@ -355,7 +355,7 @@ Environment variables:
 		const success = await runsListCommand(options);
 		process.exit(success ? 0 : 1);
 	});
-	runsCommand.command("show").argument("<run-id>", "Run ID to inspect").description("Show a run summary with its jobs and steps").option("--json", "Output raw JSON", false).action(async (runId, options) => {
+	runsCommand.command("show").argument("<run-id>", "Run ID to inspect").description("Show a run summary with its jobs and steps, why a job did not run, and any approval hold").option("--json", "Output raw JSON", false).action(async (runId, options) => {
 		const { runsShowCommand } = await import("./commands/index.js");
 		const success = await runsShowCommand(runId, { json: options.json });
 		process.exit(success ? 0 : 1);
@@ -396,19 +396,23 @@ Environment variables:
 		});
 		process.exit(success ? 0 : 1);
 	});
-	program.command("approve").argument("<run-id>", "Run ID whose approval gate to approve").description("Approve a held approval gate for a run").option("--job <name>", "Approve the hold for a specific job").option("--step <index>", "Approve a step-scoped hold (requires --job)").action(async (runId, options) => {
+	program.command("approve").argument("<run-id>", "Run ID whose approval gate to approve").description("Approve a held approval gate for a run").option("--job <name>", "Approve the hold for a specific job").option("--step <index>", "Approve a step-scoped hold (requires --job)").option("--hold-type <type>", "Approve the hold of this type (reviewer, timer, concurrency, security) — a job can carry two").option("--hold <id>", "Approve one hold by its id, as listed when nothing else separates them").action(async (runId, options) => {
 		const { approveCommand } = await import("./commands/index.js");
 		const success = await approveCommand(runId, {
 			job: options.job,
-			step: options.step
+			step: options.step,
+			hold: options.hold,
+			holdType: options.holdType
 		});
 		process.exit(success ? 0 : 1);
 	});
-	program.command("reject").argument("<run-id>", "Run ID whose approval gate to reject").description("Reject a held approval gate for a run").option("--job <name>", "Reject the hold for a specific job").option("--step <index>", "Reject a step-scoped hold (requires --job)").requiredOption("--reason <text>", "Reason for the rejection").action(async (runId, options) => {
+	program.command("reject").argument("<run-id>", "Run ID whose approval gate to reject").description("Reject a held approval gate for a run").option("--job <name>", "Reject the hold for a specific job").option("--step <index>", "Reject a step-scoped hold (requires --job)").option("--hold-type <type>", "Reject the hold of this type (reviewer, timer, concurrency, security) — a job can carry two").option("--hold <id>", "Reject one hold by its id, as listed when nothing else separates them").requiredOption("--reason <text>", "Reason for the rejection").action(async (runId, options) => {
 		const { rejectCommand } = await import("./commands/index.js");
 		const success = await rejectCommand(runId, {
 			job: options.job,
 			step: options.step,
+			hold: options.hold,
+			holdType: options.holdType,
 			reason: options.reason
 		});
 		process.exit(success ? 0 : 1);
@@ -440,6 +444,32 @@ Environment variables:
 		});
 		process.exit(success ? 0 : 1);
 	});
+	const reportCmd = program.command("report").description("Gather a redacted diagnostic bundle to share when reporting an issue");
+	reportCmd.enablePositionalOptions();
+	reportCmd.option("--run <id>", "Scope the bundle to a failing run").option("-o, --output <path>", "Where to write the bundle ZIP").option("--metadata <key=value>", "Attach metadata (repeatable)", (v, p) => [...p, v], []).option("--no-redact", "Do NOT redact secrets (prints a loud warning)").option("--upload", "Upload the bundle privately to KiCI and print a reference id").option("--message <text>", "Describe the problem (sent with --upload)").option("--email <address>", "Contact address for follow-up (sent with --upload)").option("--kici-dir <path>", "Path to the .kici directory", ".kici").action(async (options) => {
+		const { reportCommand } = await import("./commands/index.js");
+		const ok = await reportCommand({
+			output: options.output,
+			run: options.run,
+			metadata: options.metadata,
+			redact: options.redact !== false,
+			upload: options.upload,
+			message: options.message,
+			email: options.email,
+			kiciDir: options.kiciDir
+		});
+		process.exit(ok ? 0 : 1);
+	});
+	reportCmd.command("list").description("List the issue reports you have uploaded").option("--json", "Output raw JSON", false).action(async (options) => {
+		const { reportListCommand } = await import("./commands/index.js");
+		const ok = await reportListCommand({ json: options.json });
+		process.exit(ok ? 0 : 1);
+	});
+	reportCmd.command("withdraw").argument("<ref>", "Reference id of the report to withdraw").description("Withdraw an uploaded report and delete its bundle").action(async (ref) => {
+		const { reportWithdrawCommand } = await import("./commands/index.js");
+		const ok = await reportWithdrawCommand({ ref });
+		process.exit(ok ? 0 : 1);
+	});
 	program.command("workflows").description("Manage workflow registrations").command("list").description("List permanently registered workflows").option("--json", "Output as JSON", false).option("--stale <duration>", "Filter stale registrations (e.g., 30d, 7d)").option("--trigger-type <type>", "Filter by trigger type").option("--repo <repo>", "Filter by repository").action(async (options) => {
 		const { workflowsListCommand } = await import("./commands/index.js");
 		const success = await workflowsListCommand({

package/dist/commands/approve.d.ts

@@ -11,6 +11,18 @@ export interface ApproveOptions {
     job?: string;
     /** Match a step-scoped hold by its step index. */
     step?: string;
+    /**
+     * Match one hold by its own id. The escape hatch for an ambiguity nothing
+     * else resolves; the error listing prints the ids when it needs to.
+     */
+    hold?: string;
+    /**
+     * Narrow to holds of one type (`reviewer` / `timer` / `concurrency` /
+     * `security`). A job carrying an SDK `requireApproval` AND a security-typed
+     * context gate has two pending holds under one job name, and this is what
+     * separates them.
+     */
+    holdType?: string;
 }
 /**
  * Approve a held approval gate.

package/dist/commands/approve.js

@@ -22,9 +22,12 @@ async function approveCommand(runId, options = {}) {
 	try {
 		const ctx = await resolveHeldRunContext();
 		if (!ctx) return false;
-		const resolution = resolveHeldRunId(await listHeldRunsForRun(ctx, runId), {
+		const holds = await listHeldRunsForRun(ctx, runId);
+		const resolution = resolveHeldRunId(holds, {
 			job: options.job,
-			step: options.step
+			step: options.step,
+			holdId: options.hold,
+			holdType: options.holdType
 		});
 		if (!resolution.ok) {
 			logger.error(pc.red(resolution.error));

package/dist/commands/compile.js

@@ -60,7 +60,8 @@ async function compileCommand(options) {
 		if (existsSync(path.join(absoluteKiciDir, "package.json"))) {
 			const existingHash = await readExistingLockfileHash(lockPath);
 			if (existingHash) {
-				const currentHash = computeLockfileHash(detectGitRoot());
+				const gitRoot = detectGitRoot();
+				const currentHash = computeLockfileHash(gitRoot);
 				if (currentHash && currentHash !== existingHash) {
 					logger.info(pc.yellow("Dependencies changed") + " — reinstalling before compile...");
 					await reinstallDeps(absoluteKiciDir);
@@ -75,7 +76,8 @@ async function compileCommand(options) {
 			return false;
 		}
 		if (options.verbose) logger.debug(pc.dim("Validation passed"));
-		const lockJson = serializeLockFile(generateLockFile(workflowsWithSource));
+		const lockFile = generateLockFile(workflowsWithSource);
+		const lockJson = serializeLockFile(lockFile);
 		const windowWarning = schemaWindowWarning(BREAKING_FLOOR, SCHEMA_VERSION);
 		if (windowWarning) logger.warn(pc.yellow(windowWarning));
 		if (!options.check) {

package/dist/commands/doctor.js

@@ -20,7 +20,7 @@ import { promisify } from "node:util";
 * Platform API is required.
 */
 const execFileAsync = promisify(execFile);
-const SEVEN_DAYS_MS = 10080 * 60 * 1e3;
+const SEVEN_DAYS_MS = 6048e5;
 /** Is a stored token + endpoint present (regardless of expiry)? */
 function hasCredentials(config) {
 	return Boolean((config.pat ?? config.token) && (config.platformEndpoint ?? config.endpoint));
@@ -47,7 +47,7 @@ function checkLogin(config, now) {
 			if (expiresAt - now < SEVEN_DAYS_MS) return {
 				name,
 				status: "warn",
-				message: `Access token expires in ${Math.ceil((expiresAt - now) / (1440 * 60 * 1e3))} day(s).`,
+				message: `Access token expires in ${Math.ceil((expiresAt - now) / 864e5)} day(s).`,
 				nextCommand: "kici login"
 			};
 		}

package/dist/commands/endpoints.js

@@ -119,12 +119,10 @@ function categorizeTrigger(workflowName, trigger, groups) {
 				eventName: `workflows_failed_batch${trigger.name ? `:${trigger.name}` : ""}`
 			});
 			break;
-		case "job_complete":
-			groups.kiciEvent.push({
-				workflowName,
-				eventName: `job_complete${trigger.workflow ? `:${trigger.workflow}` : ""}${trigger.job ? `.${trigger.job}` : ""}`
-			});
-			break;
+		case "job_complete": groups.kiciEvent.push({
+			workflowName,
+			eventName: `job_complete${trigger.workflow ? `:${trigger.workflow}` : ""}${trigger.job ? `.${trigger.job}` : ""}`
+		});
 	}
 }
 /**

package/dist/commands/held-run-client.d.ts

@@ -6,6 +6,19 @@
  * API.
  */
 import type { HeldRunSummary } from '@kici-dev/engine';
+/**
+ * A failed held-runs request, carrying the HTTP status so a caller can tell a
+ * caller who will NEVER have the data (401 / 403 — no permission on the
+ * held-runs surface) from a transport or server failure that may succeed next
+ * time. `kici runs show` reads holds as optional detail, and reminding such a
+ * caller on every single invocation is noise, not information.
+ */
+export declare class HeldRunRequestError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+    /** True when the caller lacks permission — retrying changes nothing. */
+    get isPermissionDenied(): boolean;
+}
 /** Resolved auth context for a held-run command. */
 export interface HeldRunContext {
     endpoint: string;
@@ -15,8 +28,15 @@ export interface HeldRunContext {
 /**
  * Resolve the auth context, printing a clear error and returning null when the
  * CLI is not authenticated / no active org is set.
+ *
+ * `quiet` suppresses the error output for a caller whose own command does not
+ * depend on the held-run surface — `kici runs show` reads holds as extra
+ * detail on a run it can already display, so an unresolvable context must not
+ * make it print an authentication error for a command that worked.
  */
-export declare function resolveHeldRunContext(): Promise<HeldRunContext | null>;
+export declare function resolveHeldRunContext(options?: {
+    quiet?: boolean;
+}): Promise<HeldRunContext | null>;
 /** List the held runs for a single run id. */
 export declare function listHeldRunsForRun(ctx: HeldRunContext, runId: string): Promise<HeldRunSummary[]>;
 /**

package/dist/commands/held-run-client.js

@@ -11,25 +11,44 @@ import { logger } from "@kici-dev/core";
 * API.
 */
 /**
+* A failed held-runs request, carrying the HTTP status so a caller can tell a
+* caller who will NEVER have the data (401 / 403 — no permission on the
+* held-runs surface) from a transport or server failure that may succeed next
+* time. `kici runs show` reads holds as optional detail, and reminding such a
+* caller on every single invocation is noise, not information.
+*/
+var HeldRunRequestError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "HeldRunRequestError";
+	}
+	/** True when the caller lacks permission — retrying changes nothing. */
+	get isPermissionDenied() {
+		return this.status === 401 || this.status === 403;
+	}
+};
+/**
 * Resolve the auth context, printing a clear error and returning null when the
 * CLI is not authenticated / no active org is set.
+*
+* `quiet` suppresses the error output for a caller whose own command does not
+* depend on the held-run surface — `kici runs show` reads holds as extra
+* detail on a run it can already display, so an unresolvable context must not
+* make it print an authentication error for a command that worked.
 */
-async function resolveHeldRunContext() {
+async function resolveHeldRunContext(options = {}) {
 	const config = await loadGlobalConfig();
-	const token = config.pat ?? config.token;
-	if (!token) {
-		logger.error(pc.red("Not authenticated. Run `kici login` to get started."));
+	const fail = (message) => {
+		if (!options.quiet) logger.error(pc.red(message));
 		return null;
-	}
+	};
+	const token = config.pat ?? config.token;
+	if (!token) return fail("Not authenticated. Run `kici login` to get started.");
 	const endpoint = config.platformEndpoint ?? config.endpoint;
-	if (!endpoint) {
-		logger.error(pc.red("No endpoint configured. Run `kici login` to configure."));
-		return null;
-	}
-	if (!config.activeOrgId) {
-		logger.error(pc.red("No active organization. Run `kici org use <name>` to set one."));
-		return null;
-	}
+	if (!endpoint) return fail("No endpoint configured. Run `kici login` to configure.");
+	if (!config.activeOrgId) return fail("No active organization. Run `kici org use <name>` to set one.");
 	return {
 		endpoint,
 		token,
@@ -49,7 +68,7 @@ async function listHeldRunsForRun(ctx, runId) {
 		method: "GET",
 		headers: authHeaders(ctx.token)
 	});
-	if (!response.ok) throw new Error(await describeError(response));
+	if (!response.ok) throw new HeldRunRequestError(await describeError(response), response.status);
 	return (await response.json()).heldRuns ?? [];
 }
 /**
@@ -99,6 +118,6 @@ async function describeError(response) {
 	}
 }
 //#endregion
-export { listHeldRunsForRun, postApprove, postReject, resolveHeldRunContext };
+export { HeldRunRequestError, listHeldRunsForRun, postApprove, postReject, resolveHeldRunContext };
 
 //# sourceMappingURL=held-run-client.js.map

package/dist/commands/hook.js

@@ -31,27 +31,28 @@ async function hookInstallCommand(options = {}) {
 		if (options.git) selectedTool = "git";
 		else {
 			const tools = await detectHookTools();
-			if (tools.length === 0) if (process.stdout.isTTY && !isCiEnvironment()) {
-				const choice = await select({
-					message: "No pre-commit tool detected. How would you like to install the hook?",
-					choices: [{
-						name: "Raw git hook (.git/hooks/pre-commit)",
-						value: "git"
-					}, {
-						name: "Skip installation",
-						value: "skip"
-					}]
-				});
-				if (choice === "skip") {
-					logger.info(pc.yellow("Hook installation skipped."));
+			if (tools.length === 0) {
+				if (process.stdout.isTTY && !isCiEnvironment()) {
+					const choice = await select({
+						message: "No pre-commit tool detected. How would you like to install the hook?",
+						choices: [{
+							name: "Raw git hook (.git/hooks/pre-commit)",
+							value: "git"
+						}, {
+							name: "Skip installation",
+							value: "skip"
+						}]
+					});
+					if (choice === "skip") {
+						logger.info(pc.yellow("Hook installation skipped."));
+						return true;
+					}
+					selectedTool = choice;
+				} else {
+					logger.info(pc.yellow("No pre-commit tool detected. Use --git to install raw git hook."));
 					return true;
 				}
-				selectedTool = choice;
-			} else {
-				logger.info(pc.yellow("No pre-commit tool detected. Use --git to install raw git hook."));
-				return true;
-			}
-			else if (tools.length === 1) {
+			} else if (tools.length === 1) {
 				selectedTool = tools[0].name;
 				logger.info(pc.gray(`Detected ${selectedTool}, installing hook...`));
 			} else if (process.stdout.isTTY && !isCiEnvironment()) selectedTool = await select({
@@ -87,7 +88,8 @@ async function hookInstallCommand(options = {}) {
 */
 async function detectVerdaccioNpmrc() {
 	try {
-		return (await readFile(path.resolve(".kici", ".npmrc"), "utf-8")).includes("verdaccio");
+		const npmrcPath = path.resolve(".kici", ".npmrc");
+		return (await readFile(npmrcPath, "utf-8")).includes("verdaccio");
 	} catch {
 		return false;
 	}

package/dist/commands/index.d.ts

@@ -40,6 +40,8 @@ export { diagnosticsCommand } from './diagnostics.js';
 export type { DiagnosticsOptions } from './diagnostics.js';
 export { doctorCommand } from './doctor.js';
 export type { DoctorOptions } from './doctor.js';
+export { reportCommand, reportListCommand, reportWithdrawCommand } from './report/index.js';
+export type { ReportOptions } from './report/index.js';
 export { orgListCommand, orgUseCommand, orgCurrentCommand } from './org.js';
 export { orchestratorsListCommand, orchestratorsUseCommand } from './orchestrators.js';
 export type { OrchestratorsOptions } from './orchestrators.js';

package/dist/commands/index.js

@@ -24,6 +24,7 @@ import { runsCancelCommand } from "./runs/cancel.js";
 import { runsArtifactsListCommand } from "./runs/artifacts/list.js";
 import { runsArtifactsDownloadCommand } from "./runs/artifacts/download.js";
 import { typesCommand } from "./types.js";
+import { reportCommand, reportListCommand, reportWithdrawCommand } from "./report/index.js";
 import { orgCurrentCommand, orgListCommand, orgUseCommand } from "./org.js";
 import { orchestratorsListCommand, orchestratorsUseCommand } from "./orchestrators.js";
 import { localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localUpCommand } from "./local.js";
@@ -33,4 +34,4 @@ import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
 import { verifyAttestationCommand } from "./verify-attestation.js";
 import { notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand } from "./notifications.js";
-export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, doctorCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localTrustRootCommand, localUpCommand, loginCommand, logoutCommand, notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, runRemoteCommand, runRoutedCommand, runsArtifactsDownloadCommand, runsArtifactsListCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };
+export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, doctorCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, localAttachCommand, localDetachCommand, localDownCommand, localLogsCommand, localStatusCommand, localTrustRootCommand, localUpCommand, loginCommand, logoutCommand, notificationsChannelsAddCommand, notificationsChannelsListCommand, notificationsChannelsRemoveCommand, notificationsRosterAddCommand, notificationsRosterListCommand, notificationsRosterRemoveCommand, notificationsSubscriptionsAddCommand, notificationsSubscriptionsListCommand, notificationsSubscriptionsRemoveCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, patCreateCommand, previewCommand, previewEvent, rejectCommand, reportCommand, reportListCommand, reportWithdrawCommand, runRemoteCommand, runRoutedCommand, runsArtifactsDownloadCommand, runsArtifactsListCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.d.ts

@@ -19,8 +19,6 @@ export interface InitOptions {
     packageManager?: string;
     /** JavaScript-only mode (no TypeScript, no dependencies) */
     mjs?: boolean;
-    /** Write .npmrc pointing @kici-dev scope to local Verdaccio */
-    useVerdaccioLocal?: boolean;
     /** Private registry URL to scaffold a `registries:` entry for. */
     privateRegistry?: string;
     /** Optional npm scope (e.g. `@my-org`) the private registry serves. */
@@ -41,4 +39,13 @@ export interface InitOptions {
  * @returns true on success, false on error
  */
 export declare function initCommand(options?: InitOptions): Promise<boolean>;
+/**
+ * Scaffold `.kici/.gitignore` so the generated `types/` declarations stay
+ * untracked. Never overwrites an existing file — the customer may have edited
+ * it. Deliberately ignores only `types/`, NOT `kici.lock.json` (the
+ * orchestrator fetches the lock from the repo, so it genuinely is source).
+ *
+ * @param kiciDir - The resolved `.kici` directory path.
+ */
+export declare function writeKiciGitignore(kiciDir: string): Promise<void>;
 //# sourceMappingURL=init.d.ts.map

package/dist/commands/init.js

@@ -76,7 +76,8 @@ async function initCommand(options = {}) {
 			logger.info(pc.gray("Writing .kiciignore"));
 			await writeFile(kiciIgnorePath, kiciIgnoreTemplate, "utf-8");
 		}
-		const devMode = options.useVerdaccioLocal || await detectDevelopmentMode();
+		await writeKiciGitignore(kiciDir);
+		const devMode = await detectDevelopmentMode();
 		const mode = await resolveScaffoldMode(options);
 		const useVerdaccio = devMode;
 		if (mode.kind === "integrate") {
@@ -204,7 +205,8 @@ async function detectDefaultBranch() {
 async function detectDevelopmentMode() {
 	if (process.env.KICI_DEV === "true") return true;
 	try {
-		const content = await readFile(path.resolve(process.cwd(), "package.json"), "utf-8");
+		const rootPkgPath = path.resolve(process.cwd(), "package.json");
+		const content = await readFile(rootPkgPath, "utf-8");
 		return JSON.parse(content).kici?.development === true;
 	} catch {
 		return false;
@@ -234,7 +236,8 @@ const VERDACCIO_NPMRC = "@kici-dev:registry=http://verdaccio.local:4873\n";
 async function writeTsConfigAndTypesDir(kiciDir) {
 	logger.info(pc.gray("Writing .kici/tsconfig.json"));
 	await writeFile(path.join(kiciDir, "tsconfig.json"), await generateTsConfig(), "utf-8");
-	await mkdir(path.join(kiciDir, "types"), { recursive: true });
+	const typesDir = path.join(kiciDir, "types");
+	await mkdir(typesDir, { recursive: true });
 	logger.info(pc.gray("Created .kici/types/ for generated type declarations"));
 }
 /** Run the given package manager's install in `dir`, with pnpm's build-gate flag. */
@@ -363,6 +366,28 @@ async function generateTsConfig() {
 	baseConfig.compilerOptions.paths = typeScriptPaths;
 	return JSON.stringify(baseConfig, null, 2) + "\n";
 }
+/** The single entry `kici init` scaffolds into `.kici/.gitignore`. */
+const KICI_GITIGNORE_TEMPLATE = `# Generated type declarations (\`kici types\` / authenticated \`kici compile\`).
+# A snapshot of one org's secret keys — a local development aid, not source.
+types/
+`;
+/**
+* Scaffold `.kici/.gitignore` so the generated `types/` declarations stay
+* untracked. Never overwrites an existing file — the customer may have edited
+* it. Deliberately ignores only `types/`, NOT `kici.lock.json` (the
+* orchestrator fetches the lock from the repo, so it genuinely is source).
+*
+* @param kiciDir - The resolved `.kici` directory path.
+*/
+async function writeKiciGitignore(kiciDir) {
+	const gitignorePath = path.join(kiciDir, ".gitignore");
+	if (await checkExists(gitignorePath)) {
+		logger.info(pc.gray("Skipping .kici/.gitignore (already exists)"));
+		return;
+	}
+	logger.info(pc.gray("Writing .kici/.gitignore"));
+	await writeFile(gitignorePath, KICI_GITIGNORE_TEMPLATE, "utf-8");
+}
 /**
 * Update .gitignore with .kici/ entries
 *
@@ -504,17 +529,18 @@ async function writeAgentsMd(kiciDir) {
 async function offerHookInstallation(useVerdaccio) {
 	const tools = await detectHookTools();
 	let selectedTool;
-	if (tools.length === 0) if (!await confirm({
-		message: "No pre-commit tool found. Install husky for git hooks?",
-		default: false
-	})) {
+	if (tools.length === 0) {
 		if (!await confirm({
-			message: "Add kici compile to .git/hooks/pre-commit instead?",
+			message: "No pre-commit tool found. Install husky for git hooks?",
 			default: false
-		})) return;
-		selectedTool = "git";
-	} else selectedTool = "husky";
-	else if (tools.length === 1) {
+		})) {
+			if (!await confirm({
+				message: "Add kici compile to .git/hooks/pre-commit instead?",
+				default: false
+			})) return;
+			selectedTool = "git";
+		} else selectedTool = "husky";
+	} else if (tools.length === 1) {
 		if (!await confirm({
 			message: `Found ${tools[0].name}. Add kici compile hook?`,
 			default: true
@@ -528,11 +554,12 @@ async function offerHookInstallation(useVerdaccio) {
 		}))
 	});
 	const result = await installHook(selectedTool, { useVerdaccio });
-	if (result.success) if (result.action === "skipped") logger.info(pc.yellow(`Hook already installed: ${result.message}`));
-	else logger.info(pc.green(`Hook installed: ${result.message}`));
-	else logger.warn(pc.yellow(`Warning: ${result.message}`));
+	if (result.success) {
+		if (result.action === "skipped") logger.info(pc.yellow(`Hook already installed: ${result.message}`));
+		else logger.info(pc.green(`Hook installed: ${result.message}`));
+	} else logger.warn(pc.yellow(`Warning: ${result.message}`));
 }
 //#endregion
-export { initCommand };
+export { initCommand, writeKiciGitignore };
 
 //# sourceMappingURL=init.js.map

package/dist/commands/login.js

@@ -31,7 +31,7 @@ async function promptInput(prompt) {
 function checkPatExpiry(expiresAt) {
 	const expiryDate = new Date(expiresAt);
 	const now = /* @__PURE__ */ new Date();
-	const daysUntilExpiry = (expiryDate.getTime() - now.getTime()) / (1e3 * 60 * 60 * 24);
+	const daysUntilExpiry = (expiryDate.getTime() - now.getTime()) / 864e5;
 	if (daysUntilExpiry <= 7 && daysUntilExpiry > 0) {
 		console.log(pc.yellow(`\n  Warning: your personal access token expires in ${Math.ceil(daysUntilExpiry)} day(s) (${expiryDate.toLocaleDateString()}).`));
 		console.log(pc.yellow("  Run `kici login` again to refresh it."));

package/dist/commands/orchestrators.js

@@ -102,10 +102,11 @@ async function orchestratorsUseCommand(clusterName, options) {
 		}
 		return false;
 	}
-	await mergeGlobalConfig({ defaultClusters: {
+	const defaultClusters = {
 		...ctx.config.defaultClusters ?? {},
 		[ctx.orgId]: clusterName
-	} });
+	};
+	await mergeGlobalConfig({ defaultClusters });
 	console.log(pc.green(`Default orchestrator for ${ctx.orgId} set to: ${clusterName}`));
 	return true;
 }

package/dist/commands/reject.d.ts

@@ -11,6 +11,18 @@ export interface RejectOptions {
     job?: string;
     /** Match a step-scoped hold by its step index. */
     step?: string;
+    /**
+     * Match one hold by its own id. The escape hatch for an ambiguity nothing
+     * else resolves; the error listing prints the ids when it needs to.
+     */
+    hold?: string;
+    /**
+     * Narrow to holds of one type (`reviewer` / `timer` / `concurrency` /
+     * `security`). A job carrying an SDK `requireApproval` AND a security-typed
+     * context gate has two pending holds under one job name, and this is what
+     * separates them.
+     */
+    holdType?: string;
     /** Required rejection reason. */
     reason?: string;
 }

package/dist/commands/reject.js

@@ -26,9 +26,12 @@ async function rejectCommand(runId, options = {}) {
 		}
 		const ctx = await resolveHeldRunContext();
 		if (!ctx) return false;
-		const resolution = resolveHeldRunId(await listHeldRunsForRun(ctx, runId), {
+		const holds = await listHeldRunsForRun(ctx, runId);
+		const resolution = resolveHeldRunId(holds, {
 			job: options.job,
-			step: options.step
+			step: options.step,
+			holdId: options.hold,
+			holdType: options.holdType
 		});
 		if (!resolution.ok) {
 			logger.error(pc.red(resolution.error));