@kici-dev/compiler 0.6.1 → 0.7.0

package/dist/lockfile/hasher.js

@@ -1,22 +1,8 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { COMPILE_SCHEMA_VERSION } from "@kici-dev/core/kici-source-digest";
 import { normalizeLineEndings, sha256 } from "@kici-dev/core";
 //#region src/lockfile/hasher.ts
 /**
-* Compile schema version -- bump when compilation approach changes
-* (bundler change, bundling config, output format, etc.).
-* This is NOT the lock file schema version.
-*
-* Bumped 3 → 4: the agent artifact switched from a Rolldown-bundled
-* `.compiled.mjs` to a raw `.kici/` source tarball that the agent extracts
-* and imports via the shared oxc-transform ESM loader hook.
-*
-* Bumped 4 → 5: the hash input is now line-ending-normalized (CRLF → LF) so a
-* lockfile produced on Linux (LF) matches the agent's hash on Windows, where
-* Git's `core.autocrlf=true` system default rewrites checked-out text files to
-* CRLF. Old lockfiles must be regenerated via `kici compile`.
-*/
-const COMPILE_SCHEMA_VERSION = 5;
-/**
 * Compute content hash for a compiled workflow bundle, optionally including asset file contents.
 * Hash = SHA-256(schemaVersion + ":" + bundleSource + "\0" + assetDigest) when assetDigest is provided,
 * otherwise SHA-256(schemaVersion + ":" + bundleSource) for backward compatibility.

package/dist/lockfile/workspace-siblings.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Static resolution of the in-repo `workspace:` sibling closure `.kici` depends
+ * on, and a digest over its source.
+ *
+ * The deps tarball carries those sibling package directories **with their built
+ * output** (`packKiciDeps`), while the pointer that names it is keyed on
+ * `lockfileHash` — a hash of the package-manager lock file. Editing a sibling's
+ * source moves no package-manager lock file, so a repo whose `.kici` depends on
+ * an in-repo `workspace:` package restored that sibling's STALE build over the
+ * fresh clone on every warm-cache run. `siblingsDigest` closes that: it enters
+ * the dep pointer key, so a sibling edit is a pointer miss and the deps are
+ * rebuilt.
+ *
+ * Resolution is **static** — manifests and `git ls-files`, never an installed
+ * `node_modules`. The agent's own `collectInRepoSiblings` walks an installed
+ * tree, which cannot be used here: `kici compile` would then emit a different
+ * lock file before and after an install, and a lock file whose contents depend
+ * on whether you have installed is not hermetic.
+ */
+/**
+ * The workspace globs declared at the repo root — `pnpm-workspace.yaml`'s
+ * `packages:` first, then `package.json#workspaces` (npm / yarn / bun). Empty
+ * when the repo declares no workspace, in which case a `workspace:` specifier
+ * resolves to nothing and is skipped rather than guessed at.
+ */
+export declare function readWorkspaceGlobs(gitRoot: string): string[];
+/**
+ * Every in-repo sibling directory `.kici` depends on, transitively, as sorted
+ * repo-relative POSIX paths.
+ *
+ * `.kici` itself is excluded: its own source is already covered by
+ * `contentHash`, and including it here would make a `.kici` edit invalidate the
+ * dep cache for no reason.
+ */
+export declare function collectInRepoSiblings(gitRoot: string, kiciDir?: string): string[];
+/**
+ * SHA-256 over the git-tracked source of every resolved sibling directory, or
+ * null when `.kici` depends on none.
+ *
+ * `git ls-files` is install-independent and is already the compiler's world (it
+ * resolves `gitRoot` to generate the lock at all). Content is read as text and
+ * `\0`-delimited against its path, exactly as the `.kici/` tree digest is, so a
+ * rename cannot be disguised as a content edit.
+ */
+export declare function computeSiblingsDigest(gitRoot: string, kiciDir?: string): string | null;
+//# sourceMappingURL=workspace-siblings.d.ts.map

package/dist/lockfile/workspace-siblings.js

@@ -0,0 +1,197 @@
+import "../rolldown-runtime-ClRpJifh.js";
+import path from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { sha256 } from "@kici-dev/core";
+import { execFileSync } from "node:child_process";
+import { parse } from "yaml";
+//#region src/lockfile/workspace-siblings.ts
+/**
+* Static resolution of the in-repo `workspace:` sibling closure `.kici` depends
+* on, and a digest over its source.
+*
+* The deps tarball carries those sibling package directories **with their built
+* output** (`packKiciDeps`), while the pointer that names it is keyed on
+* `lockfileHash` — a hash of the package-manager lock file. Editing a sibling's
+* source moves no package-manager lock file, so a repo whose `.kici` depends on
+* an in-repo `workspace:` package restored that sibling's STALE build over the
+* fresh clone on every warm-cache run. `siblingsDigest` closes that: it enters
+* the dep pointer key, so a sibling edit is a pointer miss and the deps are
+* rebuilt.
+*
+* Resolution is **static** — manifests and `git ls-files`, never an installed
+* `node_modules`. The agent's own `collectInRepoSiblings` walks an installed
+* tree, which cannot be used here: `kici compile` would then emit a different
+* lock file before and after an install, and a lock file whose contents depend
+* on whether you have installed is not hermetic.
+*/
+/** Dependency protocols that name a directory inside this repository. */
+const IN_REPO_PROTOCOLS = [
+	"workspace:",
+	"file:",
+	"link:",
+	"portal:"
+];
+function readManifest(dir) {
+	const file = path.join(dir, "package.json");
+	if (!existsSync(file)) return null;
+	try {
+		return JSON.parse(readFileSync(file, "utf-8"));
+	} catch {
+		return null;
+	}
+}
+/** Every dependency specifier in a manifest, across all four dependency maps. */
+function allSpecifiers(m) {
+	return Object.entries({
+		...m.dependencies,
+		...m.devDependencies,
+		...m.optionalDependencies,
+		...m.peerDependencies
+	});
+}
+/**
+* The workspace globs declared at the repo root — `pnpm-workspace.yaml`'s
+* `packages:` first, then `package.json#workspaces` (npm / yarn / bun). Empty
+* when the repo declares no workspace, in which case a `workspace:` specifier
+* resolves to nothing and is skipped rather than guessed at.
+*/
+function readWorkspaceGlobs(gitRoot) {
+	const pnpmFile = path.join(gitRoot, "pnpm-workspace.yaml");
+	if (existsSync(pnpmFile)) try {
+		const doc = parse(readFileSync(pnpmFile, "utf-8"));
+		if (Array.isArray(doc?.packages)) return doc.packages.filter((p) => typeof p === "string");
+	} catch {}
+	const ws = readManifest(gitRoot)?.workspaces;
+	if (Array.isArray(ws)) return ws;
+	if (ws && Array.isArray(ws.packages)) return ws.packages;
+	return [];
+}
+/**
+* Directories the workspace globs match, each carrying a manifest. Resolved with
+* `git ls-files` so the set is exactly what is tracked — the same authority the
+* digest itself uses, and one that needs no install.
+*/
+function workspacePackageDirs(gitRoot, globs) {
+	const byName = /* @__PURE__ */ new Map();
+	if (globs.length === 0) return byName;
+	let manifests;
+	try {
+		manifests = execFileSync("git", [
+			"ls-files",
+			"--",
+			"*package.json",
+			"package.json"
+		], {
+			cwd: gitRoot,
+			encoding: "utf-8",
+			maxBuffer: 33554432
+		}).split("\n").filter(Boolean);
+	} catch {
+		return byName;
+	}
+	for (const rel of manifests) {
+		const dir = path.dirname(rel);
+		if (dir.split("/").includes("node_modules")) continue;
+		const m = readManifest(path.join(gitRoot, dir));
+		if (m?.name) byName.set(m.name, dir);
+	}
+	return byName;
+}
+/**
+* Resolve one specifier to a repo-relative directory, or null when it does not
+* name one. `file:` / `link:` / `portal:` carry the path; `workspace:` carries a
+* version range, so the package NAME is resolved through the workspace globs.
+*/
+function resolveSpecifier(pkgName, spec, fromDir, gitRoot, workspacePkgs) {
+	if (spec.startsWith("workspace:")) return workspacePkgs.get(pkgName) ?? null;
+	for (const proto of [
+		"file:",
+		"link:",
+		"portal:"
+	]) {
+		if (!spec.startsWith(proto)) continue;
+		const target = spec.slice(proto.length);
+		const abs = path.resolve(gitRoot, fromDir, target);
+		const rel = path.relative(gitRoot, abs).replaceAll("\\", "/");
+		if (rel.startsWith("..") || path.isAbsolute(rel)) return null;
+		return rel;
+	}
+	return null;
+}
+/**
+* Every in-repo sibling directory `.kici` depends on, transitively, as sorted
+* repo-relative POSIX paths.
+*
+* `.kici` itself is excluded: its own source is already covered by
+* `contentHash`, and including it here would make a `.kici` edit invalidate the
+* dep cache for no reason.
+*/
+function collectInRepoSiblings(gitRoot, kiciDir = ".kici") {
+	const kiciManifest = readManifest(path.join(gitRoot, kiciDir));
+	if (!kiciManifest) return [];
+	const workspacePkgs = workspacePackageDirs(gitRoot, readWorkspaceGlobs(gitRoot));
+	const found = /* @__PURE__ */ new Set();
+	const queue = [{
+		dir: kiciDir,
+		manifest: kiciManifest
+	}];
+	const visited = /* @__PURE__ */ new Set([kiciDir]);
+	while (queue.length > 0) {
+		const { dir, manifest } = queue.shift();
+		for (const [name, spec] of allSpecifiers(manifest)) {
+			if (!IN_REPO_PROTOCOLS.some((p) => spec.startsWith(p))) continue;
+			const target = resolveSpecifier(name, spec, dir, gitRoot, workspacePkgs);
+			if (target === null || visited.has(target)) continue;
+			visited.add(target);
+			found.add(target);
+			const m = readManifest(path.join(gitRoot, target));
+			if (m) queue.push({
+				dir: target,
+				manifest: m
+			});
+		}
+	}
+	return [...found].sort();
+}
+/**
+* SHA-256 over the git-tracked source of every resolved sibling directory, or
+* null when `.kici` depends on none.
+*
+* `git ls-files` is install-independent and is already the compiler's world (it
+* resolves `gitRoot` to generate the lock at all). Content is read as text and
+* `\0`-delimited against its path, exactly as the `.kici/` tree digest is, so a
+* rename cannot be disguised as a content edit.
+*/
+function computeSiblingsDigest(gitRoot, kiciDir = ".kici") {
+	const siblings = collectInRepoSiblings(gitRoot, kiciDir);
+	if (siblings.length === 0) return null;
+	const parts = [];
+	for (const dir of siblings) {
+		let files;
+		try {
+			files = execFileSync("git", [
+				"ls-files",
+				"--",
+				dir
+			], {
+				cwd: gitRoot,
+				encoding: "utf-8",
+				maxBuffer: 67108864
+			}).split("\n").filter(Boolean).sort();
+		} catch {
+			continue;
+		}
+		for (const rel of files) {
+			let content = "";
+			try {
+				content = readFileSync(path.join(gitRoot, rel), "utf-8");
+			} catch {}
+			parts.push(`${rel}\0${content.replaceAll("\r\n", "\n")}\0`);
+		}
+	}
+	return parts.length > 0 ? sha256(parts.join("")) : null;
+}
+//#endregion
+export { collectInRepoSiblings, computeSiblingsDigest, readWorkspaceGlobs };
+
+//# sourceMappingURL=workspace-siblings.js.map

package/dist/templates/package-json.js

@@ -1,6 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 //#region src/templates/package-json.ts
-const sdkVersion = "0.6.1";
+const sdkVersion = "0.7.0";
 /**
 * The npm version range the scaffold pins `@kici-dev/sdk` to.
 *

package/dist/test-runner/job-executor.js

@@ -6,8 +6,8 @@ import { localRunsOnString } from "./runs-on-display.js";
 import { pathToFileURL } from "node:url";
 import path from "node:path";
 import pc from "picocolors";
-import { setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
 import { logger } from "@kici-dev/core";
+import { setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk/internal";
 //#region src/test-runner/job-executor.ts
 /**
 * Resolve SDK output setter functions from the workflow's module instance.

package/dist/test-runner/rule-evaluator.js

@@ -1,7 +1,7 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { formatter } from "./output-formatter.js";
-import { createRuleContext as createRuleContext$1, evaluateRules } from "@kici-dev/sdk";
 import { initZx } from "@kici-dev/core";
+import { createRuleContext as createRuleContext$1, evaluateRules } from "@kici-dev/sdk/internal";
 //#region src/test-runner/rule-evaluator.ts
 initZx();
 /**

package/dist/types.d.ts

@@ -28,7 +28,7 @@ export interface LockApproval {
     readonly when: 'always' | 'drift';
 }
 /** Schema version - re-exported from engine as single source of truth */
-export declare const SCHEMA_VERSION: 39;
+export declare const SCHEMA_VERSION: 41;
 /** Lock compatibility-window floor - re-exported from engine as single source of truth */
 export declare const BREAKING_FLOOR: 30;
 /**
@@ -570,6 +570,11 @@ export interface LockDynamicJobFn {
     readonly needs?: readonly (string | LockNeedsEntry | LockNeedsGroupEntry)[];
     /** True when this dynamic entry was authored as dynamicJob(group, { needs, generate }). */
     readonly resultAware?: boolean;
+    /**
+     * Named git credentials the generator declares, inherited by every job it
+     * generates. Mirrors the engine `LockDynamicJobFn.gitCredentials`.
+     */
+    readonly gitCredentials?: Readonly<Record<string, Readonly<Record<string, string>>>>;
 }
 /** Job or dynamic job generator */
 export type LockJobOrFactory = LockJob | LockDynamicJobFn;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/compiler",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Compiler and CLI for KiCI workflows. Compiles `.kici/workflows/*.ts` to a `kici.lock.json` file consumed by the orchestrator and agents, and runs workflows locally or against a remote orchestrator.",
   "keywords": [
     "ci",
@@ -33,7 +33,6 @@
   "files": [
     "dist",
     "!dist/**/*.map",
-    "hack/postinstall.mjs",
     "sbom.spdx.json"
   ],
   "main": "dist/index.js",
@@ -62,24 +61,23 @@
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
     "zx": "^8.8.5",
-    "@kici-dev/agent": "0.6.1",
-    "@kici-dev/core": "0.6.1",
-    "@kici-dev/engine": "0.6.1",
-    "@kici-dev/orchestrator": "0.6.1"
+    "@kici-dev/agent": "0.7.0",
+    "@kici-dev/orchestrator": "0.7.0",
+    "@kici-dev/core": "0.7.0",
+    "@kici-dev/engine": "0.7.0"
   },
   "devDependencies": {
     "@types/archiver": "^8.0.0",
     "jszip": "^3.10.1"
   },
   "peerDependencies": {
-    "@kici-dev/sdk": "0.6.1"
+    "@kici-dev/sdk": "0.7.0"
   },
   "scripts": {
     "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",
     "postbuild": "zx hack/postbuild.mjs",
     "typecheck": "tsgo --noEmit",
     "test": "vitest run",
-    "test:watch": "vitest",
-    "postinstall": "node hack/postinstall.mjs"
+    "test:watch": "vitest"
   }
 }