@kici-dev/compiler 0.5.0 → 0.6.1

package/dist/remote/dashboard-client.d.ts

@@ -37,6 +37,18 @@ export declare const webhookActivitySchema: z.ZodObject<{
     orchestratorUnavailable: z.ZodBoolean;
 }, z.core.$strip>;
 export type WebhookActivity = z.infer<typeof webhookActivitySchema>;
+declare const issueReportListSchema: z.ZodObject<{
+    reports: z.ZodArray<z.ZodObject<{
+        ref: z.ZodString;
+        bundleId: z.ZodString;
+        byteSize: z.ZodNumber;
+        status: z.ZodString;
+        createdAt: z.ZodString;
+        userId: z.ZodString;
+        message: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type IssueReportListResponse = z.infer<typeof issueReportListSchema>;
 /** Result of {@link DashboardClient.listRegistrations}. */
 export interface RegistrationsListResult {
     registrations: RegistrationItem[];
@@ -104,6 +116,33 @@ export declare class DashboardClient {
      * relays it without re-signing, so the artifact bytes never transit Platform.
      */
     listArtifacts(runId: string): Promise<ArtifactsListResult>;
+    /**
+     * Reserve an issue-report upload slot.
+     *
+     * Returns a presigned PUT the caller uploads the bundle bytes to directly —
+     * the Platform never proxies them — plus the reference id the customer
+     * quotes to support.
+     */
+    createIssueReport(body: {
+        bundleId: string;
+        byteSize: number;
+        sha256: string;
+        message?: string;
+        email?: string;
+    }): Promise<{
+        ref: string;
+        uploadUrl: string;
+    }>;
+    /** Tell the Platform the bytes landed, so it can verify and mark the report received. */
+    confirmIssueReport(ref: string): Promise<{
+        ref: string;
+        status: string;
+    }>;
+    listIssueReports(): Promise<IssueReportListResponse>;
+    withdrawIssueReport(ref: string): Promise<{
+        ref: string;
+        deleted: boolean;
+    }>;
     rerunRun(runId: string): Promise<{
         newRunId: string;
     }>;

package/dist/remote/dashboard-client.js

@@ -31,6 +31,27 @@ const webhookActivitySchema = z.object({
 	lockfileMissing: z.number().optional(),
 	orchestratorUnavailable: z.boolean()
 });
+const issueReportCreateSchema = z.object({
+	ref: z.string(),
+	uploadUrl: z.string()
+});
+const issueReportConfirmSchema = z.object({
+	ref: z.string(),
+	status: z.string()
+});
+const issueReportDeleteSchema = z.object({
+	ref: z.string(),
+	deleted: z.boolean()
+});
+const issueReportListSchema = z.object({ reports: z.array(z.object({
+	ref: z.string(),
+	bundleId: z.string(),
+	byteSize: z.number(),
+	status: z.string(),
+	createdAt: z.string(),
+	userId: z.string(),
+	message: z.string().nullable()
+})) });
 const rerunResponseSchema = z.object({ newRunId: z.string() });
 const cancelResponseSchema = z.object({
 	cancelledJobs: z.number().optional(),
@@ -176,6 +197,26 @@ var DashboardClient = class DashboardClient {
 	async listArtifacts(runId) {
 		return artifactsListResultSchema.parse(await this.getJson(`/runs/${runId}/artifacts`));
 	}
+	/**
+	* Reserve an issue-report upload slot.
+	*
+	* Returns a presigned PUT the caller uploads the bundle bytes to directly —
+	* the Platform never proxies them — plus the reference id the customer
+	* quotes to support.
+	*/
+	async createIssueReport(body) {
+		return issueReportCreateSchema.parse(await this.postJson("/issue-reports", body));
+	}
+	/** Tell the Platform the bytes landed, so it can verify and mark the report received. */
+	async confirmIssueReport(ref) {
+		return issueReportConfirmSchema.parse(await this.postJson(`/issue-reports/${encodeURIComponent(ref)}/confirm`));
+	}
+	async listIssueReports() {
+		return issueReportListSchema.parse(await this.getJson("/issue-reports"));
+	}
+	async withdrawIssueReport(ref) {
+		return issueReportDeleteSchema.parse(await this.deleteJson(`/issue-reports/${encodeURIComponent(ref)}`));
+	}
 	async rerunRun(runId) {
 		return rerunResponseSchema.parse(await this.postJson(`/runs/${runId}/rerun`));
 	}

package/dist/remote/oauth.js

@@ -106,7 +106,7 @@ function describeListenFailure(err, listenPort) {
 * @returns OIDC access token
 */
 async function pkceFlow(opts) {
-	const { issuer, clientId, nudgeAfterMs = 9e4, timeoutMs = 300 * 1e3 } = opts;
+	const { issuer, clientId, nudgeAfterMs = 9e4, timeoutMs = 3e5 } = opts;
 	let listenPort = 0;
 	const callbackPortEnv = process.env.KICI_CALLBACK_PORT;
 	if (callbackPortEnv) {
@@ -211,10 +211,12 @@ async function pkceFlow(opts) {
 			if (browserCmd === "none") {
 				console.log(`KICI_AUTH_URL=${authUrl.toString()}`);
 				console.log(pc.cyan(`  Waiting for browser callback on port ${actualPort}...`));
-			} else if (browserCmd) exec(browserCmd.replace("{url}", authUrl.toString()), (err) => {
-				if (err) console.log(pc.yellow(`  Custom browser command failed: ${err.message}\n  Please visit:\n  ${authUrl.toString()}`));
-			});
-			else {
+			} else if (browserCmd) {
+				const cmd = browserCmd.replace("{url}", authUrl.toString());
+				exec(cmd, (err) => {
+					if (err) console.log(pc.yellow(`  Custom browser command failed: ${err.message}\n  Please visit:\n  ${authUrl.toString()}`));
+				});
+			} else {
 				console.log(pc.cyan("  Opening browser for authentication..."));
 				console.log(pc.dim(`  If it does not open, visit:\n  ${authUrl.toString()}`));
 				open(authUrl.toString()).catch(() => {

package/dist/remote/uploader.js

@@ -9,9 +9,9 @@ import { makeTempDir } from "@kici-dev/core/tmp";
 import picomatch from "picomatch";
 //#region src/remote/uploader.ts
 /** Size threshold for warning (50MB) */
-const SIZE_WARN_THRESHOLD = 50 * 1024 * 1024;
+const SIZE_WARN_THRESHOLD = 52428800;
 /** Size threshold for hard error (500MB) */
-const SIZE_ERROR_THRESHOLD = 500 * 1024 * 1024;
+const SIZE_ERROR_THRESHOLD = 524288e3;
 /** Maximum upload retry attempts */
 const MAX_RETRIES = 3;
 /**

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.5.0";
+const sdkVersion = "0.6.1";
 /**
 * The npm version range the scaffold pins `@kici-dev/sdk` to.
 *

package/dist/test-runner/dry-run.js

@@ -29,8 +29,10 @@ function displayDryRun(workflows, decisions, options) {
 			logger.info(pc.gray(`      runs-on: ${job.runsOn}`));
 			if (job.needs.length > 0) logger.info(pc.gray(`      needs: ${job.needs.join(", ")}`));
 			if (job.rules && job.rules.length > 0) logger.info(pc.gray(`      rules: ${job.rules.map((r) => r.label).join(", ")}`));
-			if (job.matrix) if (job.matrix._type === "static" && job.matrix.values) logger.info(pc.gray(`      matrix: ${JSON.stringify(job.matrix.values)}`));
-			else logger.info(pc.gray(`      matrix: [dynamic]`));
+			if (job.matrix) {
+				if (job.matrix._type === "static" && job.matrix.values) logger.info(pc.gray(`      matrix: ${JSON.stringify(job.matrix.values)}`));
+				else logger.info(pc.gray(`      matrix: [dynamic]`));
+			}
 			logger.info(pc.gray(`      steps (${job.steps.length}):`));
 			for (const step of job.steps) logger.info(pc.gray(`        - ${step.name}`));
 		}

package/dist/test-runner/git-detector.js

@@ -12,7 +12,8 @@ import { readFile } from "node:fs/promises";
 */
 async function detectRepoFromGit(cwd = process.cwd()) {
 	try {
-		const remoteMatch = (await readFile(path.join(cwd, ".git", "config"), "utf-8")).match(/\[remote "origin"\][^[]*url\s*=\s*(.+)/m);
+		const gitConfigPath = path.join(cwd, ".git", "config");
+		const remoteMatch = (await readFile(gitConfigPath, "utf-8")).match(/\[remote "origin"\][^[]*url\s*=\s*(.+)/m);
 		if (!remoteMatch) return null;
 		const match = remoteMatch[1].trim().match(/github\.com[:/]([^/]+)\/([^/\s]+?)(\.git)?$/);
 		if (!match) return null;

package/dist/test-runner/job-executor.js

@@ -18,7 +18,8 @@ import { logger } from "@kici-dev/core";
 */
 async function resolveSdkSetters(kiciDir) {
 	if (kiciDir) try {
-		const sdk = await import(pathToFileURL(path.join(kiciDir, "node_modules", "@kici-dev", "sdk", "dist", "index.js")).href);
+		const sdkPath = path.join(kiciDir, "node_modules", "@kici-dev", "sdk", "dist", "index.js");
+		const sdk = await import(pathToFileURL(sdkPath).href);
 		return {
 			setStepOutputsMap: sdk.setStepOutputsMap,
 			setStepRefMap: sdk.setStepRefMap,

package/dist/test-runner/payload-builder.js

@@ -9,8 +9,10 @@ import { readFile } from "node:fs/promises";
 */
 function deepMerge(base, overrides) {
 	const result = { ...base };
-	for (const [key, value] of Object.entries(overrides)) if (value !== void 0 && value !== null) if (typeof value === "object" && !Array.isArray(value) && result[key] && typeof result[key] === "object") result[key] = deepMerge(result[key], value);
-	else result[key] = value;
+	for (const [key, value] of Object.entries(overrides)) if (value !== void 0 && value !== null) {
+		if (typeof value === "object" && !Array.isArray(value) && result[key] && typeof result[key] === "object") result[key] = deepMerge(result[key], value);
+		else result[key] = value;
+	}
 	return result;
 }
 /**
@@ -51,9 +53,7 @@ async function buildEventPayload(eventArg, options) {
 		case "review_comment":
 			overrides.pull_request = { head: { sha: options.sha } };
 			break;
-		case "workflow_run":
-			overrides.workflow_run = { head_sha: options.sha };
-			break;
+		case "workflow_run": overrides.workflow_run = { head_sha: options.sha };
 	}
 	if (options.branch) switch (eventType.type) {
 		case "push":
@@ -77,12 +77,10 @@ async function buildEventPayload(eventArg, options) {
 		case "delete":
 			overrides.ref = options.branch;
 			break;
-		case "workflow_run":
-			overrides.workflow_run = {
-				...overrides.workflow_run ?? {},
-				head_branch: options.branch
-			};
-			break;
+		case "workflow_run": overrides.workflow_run = {
+			...overrides.workflow_run ?? {},
+			head_branch: options.branch
+		};
 	}
 	if (options.pr && (eventType.type === "pull_request" || eventType.type === "review" || eventType.type === "review_comment")) {
 		overrides.number = options.pr;
@@ -137,9 +135,7 @@ async function buildEventPayload(eventArg, options) {
 			break;
 		case "fork":
 		case "star":
-		case "watch":
-			targetBranch = defaultBranch;
-			break;
+		case "watch": targetBranch = defaultBranch;
 	}
 	return {
 		type: eventType.type,
@@ -206,9 +202,7 @@ async function buildInternalEventPayload(eventType, options) {
 				timezone: eventType.timezone ?? "UTC"
 			};
 			break;
-		case "lifecycle":
-			payload = { lifecycleEvent: eventType.lifecycleEvent };
-			break;
+		case "lifecycle": payload = { lifecycleEvent: eventType.lifecycleEvent };
 	}
 	return {
 		type: eventType.type,

package/dist/types.d.ts

@@ -28,7 +28,7 @@ export interface LockApproval {
     readonly when: 'always' | 'drift';
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 35;
+export declare const SCHEMA_VERSION: 39;
 /** Lock compatibility-window floor - re-exported from engine as single source of truth */
 export declare const BREAKING_FLOOR: 30;
 /**
@@ -464,10 +464,40 @@ export interface LockJob {
     readonly checkout?: boolean;
     /** Declarative cache specs (normalized to an array). Restored before steps / saved after the job. */
     readonly cache?: readonly import('@kici-dev/sdk').CacheSpec[];
-    /** Docker image for job execution. All steps run inside the container. */
+    /**
+     * Container for job execution. All steps run inside it.
+     *
+     * A bare image string, or an object naming exactly one image source: a
+     * finalized `image`, or a `dockerfile` the agent builds from the cloned tree
+     * before the job starts.
+     *
+     * Kept in step with `LockJob.container` in `@kici-dev/engine` and
+     * `ContainerConfig` in `@kici-dev/sdk` — three mirrors of one shape, and a
+     * field added to one has to be added to all three or the generator stops
+     * typechecking.
+     */
     readonly container?: string | {
-        image: string;
+        /** Finalized image to pull. Exactly one of `image` / `dockerfile` is set. */
+        image?: string;
+        /** Repo-relative Dockerfile the agent builds before the job runs. */
+        dockerfile?: string;
+        /** Repo-relative build context. Defaults to the repository root. */
+        context?: string;
+        /** Build stage to stop at. */
+        target?: string;
+        /** Build arguments. Plain strings — never secret references. */
+        args?: Record<string, string>;
         env?: Record<string, string>;
+        /** Private-registry credentials for pulling the image (flattened Sourced pairs). */
+        auth?: {
+            username?: string;
+            usernameSecret?: string;
+            usernameValue?: string;
+            tokenSecret?: string;
+            tokenValue?: string;
+            /** Registry host. Required when `dockerfile` is set. */
+            registry?: string;
+        };
     };
     /**
      * Bound contexts in merge order. Each entry is a static name or inline

package/dist/validation/validator.js

@@ -75,9 +75,28 @@ function validateWorkflow(workflow, workflowFile) {
 		const matrixErrors = validateStaticMatrix(job, workflow.name, workflowFile);
 		errors.push(...matrixErrors);
 	}
+	for (const job of staticJobs) errors.push(...validateInvokeJob(job, jobLoc(job.name)));
 	errors.push(...validateGlobalApproval(workflow, staticJobs, workflowFile));
 	return errors;
 }
+/**
+* Validate an invoke-gate job. A gate is mutually exclusive with step code and
+* must name a non-empty event. Defense-in-depth: the SDK `job()` factory already
+* enforces these, but a generated job could reach the compiler carrying them.
+*/
+function validateInvokeJob(job, location) {
+	if (!job.invoke) return [];
+	const errors = [];
+	if ((job.steps?.length ?? 0) > 0) errors.push(compilerError("E125", `job '${job.name}': 'invoke' cannot be combined with 'steps'`, {
+		location,
+		suggestion: "An invoke gate never runs steps — remove `steps`/`run`, or drop `invoke`."
+	}));
+	if (typeof job.invoke.event !== "string" || job.invoke.event.trim().length === 0) errors.push(compilerError("E126", `job '${job.name}': invoke.event must be a non-empty event name`, {
+		location,
+		suggestion: "Pass a kici event name to invokeSource(), e.g. invokeSource(\"myorg.repo-tests\")."
+	}));
+	return errors;
+}
 /** True when any trigger carries `repos:`, which is what makes a workflow global. */
 function isGlobalWorkflow(workflow) {
 	return (Array.isArray(workflow.on) ? workflow.on : workflow.on ? [workflow.on] : []).some((trigger) => {
@@ -152,12 +171,10 @@ function validateJobDag(jobs, workflowName, jobLoc, dynamicGroupNames) {
 				suggestion: "Remove the self-dependency"
 			}));
 			break;
-		case "missing-dependency":
-			errors.push(compilerError("E101", `Job "${result.nodeId}" in workflow "${workflowName}" depends on non-existent job "${result.missingDep}"`, {
-				location: dagNodeLocation(result.nodeId, jobLoc),
-				suggestion: `Create a job named "${result.missingDep}" or fix the dependency name`
-			}));
-			break;
+		case "missing-dependency": errors.push(compilerError("E101", `Job "${result.nodeId}" in workflow "${workflowName}" depends on non-existent job "${result.missingDep}"`, {
+			location: dagNodeLocation(result.nodeId, jobLoc),
+			suggestion: `Create a job named "${result.missingDep}" or fix the dependency name`
+		}));
 	}
 	return errors;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -46,28 +46,33 @@
     "./cli": "./dist/cli.js"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.5.2",
+    "@inquirer/prompts": "^8.7.0",
+    "archiver": "^8.0.0",
     "chokidar": "^5.0.0",
     "commander": "^15.0.0",
     "embedded-postgres": "18.4.0-beta.17",
     "fast-glob": "^3.3.3",
-    "open": "^11.0.0",
+    "open": "11.0.0",
     "picocolors": "^1.1.1",
-    "picomatch": "^4.0.5",
-    "tar": "^7.5.20",
+    "picomatch": "^4.0.7",
+    "tar": "^7.5.22",
     "typescript": "^6.0.3",
-    "ws": "^8.21.1",
+    "ws": "^8.21.3",
     "wsl-utils": "^0.3.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/agent": "0.5.0",
-    "@kici-dev/core": "0.5.0",
-    "@kici-dev/engine": "0.5.0",
-    "@kici-dev/orchestrator": "0.5.0"
+    "@kici-dev/agent": "0.6.1",
+    "@kici-dev/core": "0.6.1",
+    "@kici-dev/engine": "0.6.1",
+    "@kici-dev/orchestrator": "0.6.1"
+  },
+  "devDependencies": {
+    "@types/archiver": "^8.0.0",
+    "jszip": "^3.10.1"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.5.0"
+    "@kici-dev/sdk": "0.6.1"
   },
   "scripts": {
     "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",