@kici-dev/compiler 0.5.0 → 0.6.0

package/dist/test-runner/dry-run.js

@@ -29,8 +29,10 @@ function displayDryRun(workflows, decisions, options) {
 			logger.info(pc.gray(`      runs-on: ${job.runsOn}`));
 			if (job.needs.length > 0) logger.info(pc.gray(`      needs: ${job.needs.join(", ")}`));
 			if (job.rules && job.rules.length > 0) logger.info(pc.gray(`      rules: ${job.rules.map((r) => r.label).join(", ")}`));
-			if (job.matrix) if (job.matrix._type === "static" && job.matrix.values) logger.info(pc.gray(`      matrix: ${JSON.stringify(job.matrix.values)}`));
-			else logger.info(pc.gray(`      matrix: [dynamic]`));
+			if (job.matrix) {
+				if (job.matrix._type === "static" && job.matrix.values) logger.info(pc.gray(`      matrix: ${JSON.stringify(job.matrix.values)}`));
+				else logger.info(pc.gray(`      matrix: [dynamic]`));
+			}
 			logger.info(pc.gray(`      steps (${job.steps.length}):`));
 			for (const step of job.steps) logger.info(pc.gray(`        - ${step.name}`));
 		}

package/dist/test-runner/git-detector.js

@@ -12,7 +12,8 @@ import { readFile } from "node:fs/promises";
 */
 async function detectRepoFromGit(cwd = process.cwd()) {
 	try {
-		const remoteMatch = (await readFile(path.join(cwd, ".git", "config"), "utf-8")).match(/\[remote "origin"\][^[]*url\s*=\s*(.+)/m);
+		const gitConfigPath = path.join(cwd, ".git", "config");
+		const remoteMatch = (await readFile(gitConfigPath, "utf-8")).match(/\[remote "origin"\][^[]*url\s*=\s*(.+)/m);
 		if (!remoteMatch) return null;
 		const match = remoteMatch[1].trim().match(/github\.com[:/]([^/]+)\/([^/\s]+?)(\.git)?$/);
 		if (!match) return null;

package/dist/test-runner/job-executor.js

@@ -18,7 +18,8 @@ import { logger } from "@kici-dev/core";
 */
 async function resolveSdkSetters(kiciDir) {
 	if (kiciDir) try {
-		const sdk = await import(pathToFileURL(path.join(kiciDir, "node_modules", "@kici-dev", "sdk", "dist", "index.js")).href);
+		const sdkPath = path.join(kiciDir, "node_modules", "@kici-dev", "sdk", "dist", "index.js");
+		const sdk = await import(pathToFileURL(sdkPath).href);
 		return {
 			setStepOutputsMap: sdk.setStepOutputsMap,
 			setStepRefMap: sdk.setStepRefMap,

package/dist/test-runner/payload-builder.js

@@ -9,8 +9,10 @@ import { readFile } from "node:fs/promises";
 */
 function deepMerge(base, overrides) {
 	const result = { ...base };
-	for (const [key, value] of Object.entries(overrides)) if (value !== void 0 && value !== null) if (typeof value === "object" && !Array.isArray(value) && result[key] && typeof result[key] === "object") result[key] = deepMerge(result[key], value);
-	else result[key] = value;
+	for (const [key, value] of Object.entries(overrides)) if (value !== void 0 && value !== null) {
+		if (typeof value === "object" && !Array.isArray(value) && result[key] && typeof result[key] === "object") result[key] = deepMerge(result[key], value);
+		else result[key] = value;
+	}
 	return result;
 }
 /**
@@ -51,9 +53,7 @@ async function buildEventPayload(eventArg, options) {
 		case "review_comment":
 			overrides.pull_request = { head: { sha: options.sha } };
 			break;
-		case "workflow_run":
-			overrides.workflow_run = { head_sha: options.sha };
-			break;
+		case "workflow_run": overrides.workflow_run = { head_sha: options.sha };
 	}
 	if (options.branch) switch (eventType.type) {
 		case "push":
@@ -77,12 +77,10 @@ async function buildEventPayload(eventArg, options) {
 		case "delete":
 			overrides.ref = options.branch;
 			break;
-		case "workflow_run":
-			overrides.workflow_run = {
-				...overrides.workflow_run ?? {},
-				head_branch: options.branch
-			};
-			break;
+		case "workflow_run": overrides.workflow_run = {
+			...overrides.workflow_run ?? {},
+			head_branch: options.branch
+		};
 	}
 	if (options.pr && (eventType.type === "pull_request" || eventType.type === "review" || eventType.type === "review_comment")) {
 		overrides.number = options.pr;
@@ -137,9 +135,7 @@ async function buildEventPayload(eventArg, options) {
 			break;
 		case "fork":
 		case "star":
-		case "watch":
-			targetBranch = defaultBranch;
-			break;
+		case "watch": targetBranch = defaultBranch;
 	}
 	return {
 		type: eventType.type,
@@ -206,9 +202,7 @@ async function buildInternalEventPayload(eventType, options) {
 				timezone: eventType.timezone ?? "UTC"
 			};
 			break;
-		case "lifecycle":
-			payload = { lifecycleEvent: eventType.lifecycleEvent };
-			break;
+		case "lifecycle": payload = { lifecycleEvent: eventType.lifecycleEvent };
 	}
 	return {
 		type: eventType.type,

package/dist/types.d.ts

@@ -28,7 +28,7 @@ export interface LockApproval {
     readonly when: 'always' | 'drift';
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 35;
+export declare const SCHEMA_VERSION: 39;
 /** Lock compatibility-window floor - re-exported from engine as single source of truth */
 export declare const BREAKING_FLOOR: 30;
 /**
@@ -464,10 +464,40 @@ export interface LockJob {
     readonly checkout?: boolean;
     /** Declarative cache specs (normalized to an array). Restored before steps / saved after the job. */
     readonly cache?: readonly import('@kici-dev/sdk').CacheSpec[];
-    /** Docker image for job execution. All steps run inside the container. */
+    /**
+     * Container for job execution. All steps run inside it.
+     *
+     * A bare image string, or an object naming exactly one image source: a
+     * finalized `image`, or a `dockerfile` the agent builds from the cloned tree
+     * before the job starts.
+     *
+     * Kept in step with `LockJob.container` in `@kici-dev/engine` and
+     * `ContainerConfig` in `@kici-dev/sdk` — three mirrors of one shape, and a
+     * field added to one has to be added to all three or the generator stops
+     * typechecking.
+     */
     readonly container?: string | {
-        image: string;
+        /** Finalized image to pull. Exactly one of `image` / `dockerfile` is set. */
+        image?: string;
+        /** Repo-relative Dockerfile the agent builds before the job runs. */
+        dockerfile?: string;
+        /** Repo-relative build context. Defaults to the repository root. */
+        context?: string;
+        /** Build stage to stop at. */
+        target?: string;
+        /** Build arguments. Plain strings — never secret references. */
+        args?: Record<string, string>;
         env?: Record<string, string>;
+        /** Private-registry credentials for pulling the image (flattened Sourced pairs). */
+        auth?: {
+            username?: string;
+            usernameSecret?: string;
+            usernameValue?: string;
+            tokenSecret?: string;
+            tokenValue?: string;
+            /** Registry host. Required when `dockerfile` is set. */
+            registry?: string;
+        };
     };
     /**
      * Bound contexts in merge order. Each entry is a static name or inline

package/dist/validation/validator.js

@@ -75,9 +75,28 @@ function validateWorkflow(workflow, workflowFile) {
 		const matrixErrors = validateStaticMatrix(job, workflow.name, workflowFile);
 		errors.push(...matrixErrors);
 	}
+	for (const job of staticJobs) errors.push(...validateInvokeJob(job, jobLoc(job.name)));
 	errors.push(...validateGlobalApproval(workflow, staticJobs, workflowFile));
 	return errors;
 }
+/**
+* Validate an invoke-gate job. A gate is mutually exclusive with step code and
+* must name a non-empty event. Defense-in-depth: the SDK `job()` factory already
+* enforces these, but a generated job could reach the compiler carrying them.
+*/
+function validateInvokeJob(job, location) {
+	if (!job.invoke) return [];
+	const errors = [];
+	if ((job.steps?.length ?? 0) > 0) errors.push(compilerError("E125", `job '${job.name}': 'invoke' cannot be combined with 'steps'`, {
+		location,
+		suggestion: "An invoke gate never runs steps — remove `steps`/`run`, or drop `invoke`."
+	}));
+	if (typeof job.invoke.event !== "string" || job.invoke.event.trim().length === 0) errors.push(compilerError("E126", `job '${job.name}': invoke.event must be a non-empty event name`, {
+		location,
+		suggestion: "Pass a kici event name to invokeSource(), e.g. invokeSource(\"myorg.repo-tests\")."
+	}));
+	return errors;
+}
 /** True when any trigger carries `repos:`, which is what makes a workflow global. */
 function isGlobalWorkflow(workflow) {
 	return (Array.isArray(workflow.on) ? workflow.on : workflow.on ? [workflow.on] : []).some((trigger) => {
@@ -152,12 +171,10 @@ function validateJobDag(jobs, workflowName, jobLoc, dynamicGroupNames) {
 				suggestion: "Remove the self-dependency"
 			}));
 			break;
-		case "missing-dependency":
-			errors.push(compilerError("E101", `Job "${result.nodeId}" in workflow "${workflowName}" depends on non-existent job "${result.missingDep}"`, {
-				location: dagNodeLocation(result.nodeId, jobLoc),
-				suggestion: `Create a job named "${result.missingDep}" or fix the dependency name`
-			}));
-			break;
+		case "missing-dependency": errors.push(compilerError("E101", `Job "${result.nodeId}" in workflow "${workflowName}" depends on non-existent job "${result.missingDep}"`, {
+			location: dagNodeLocation(result.nodeId, jobLoc),
+			suggestion: `Create a job named "${result.missingDep}" or fix the dependency name`
+		}));
 	}
 	return errors;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -46,28 +46,33 @@
     "./cli": "./dist/cli.js"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.5.2",
+    "@inquirer/prompts": "^8.7.0",
+    "archiver": "^8.0.0",
     "chokidar": "^5.0.0",
     "commander": "^15.0.0",
     "embedded-postgres": "18.4.0-beta.17",
     "fast-glob": "^3.3.3",
-    "open": "^11.0.0",
+    "open": "11.0.0",
     "picocolors": "^1.1.1",
-    "picomatch": "^4.0.5",
-    "tar": "^7.5.20",
+    "picomatch": "^4.0.7",
+    "tar": "^7.5.22",
     "typescript": "^6.0.3",
-    "ws": "^8.21.1",
+    "ws": "^8.21.3",
     "wsl-utils": "^0.3.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/agent": "0.5.0",
-    "@kici-dev/core": "0.5.0",
-    "@kici-dev/engine": "0.5.0",
-    "@kici-dev/orchestrator": "0.5.0"
+    "@kici-dev/agent": "0.6.0",
+    "@kici-dev/core": "0.6.0",
+    "@kici-dev/engine": "0.6.0",
+    "@kici-dev/orchestrator": "0.6.0"
+  },
+  "devDependencies": {
+    "@types/archiver": "^8.0.0",
+    "jszip": "^3.10.1"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.5.0"
+    "@kici-dev/sdk": "0.6.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",