@kici-dev/compiler 0.6.1 → 0.8.0

package/dist/cli.js

@@ -7,7 +7,7 @@ import { realpathSync } from "node:fs";
 import { Argument, Command } from "commander";
 import pc from "picocolors";
 //#region src/cli.ts
-const version = "0.6.1";
+const version = "0.8.0";
 /**
 * Top-level commands that were removed, mapped to their current equivalent.
 * Consulted when the CLI hits an unknown command so the user gets a precise
@@ -312,7 +312,7 @@ Environment variables:
 		],
 		[
 			"logs",
-			"Print the local dev plane orchestrator log path",
+			"Print the local dev plane log paths and rotation policy",
 			"localLogsCommand"
 		],
 		[

package/dist/commands/compile.js

@@ -13,6 +13,7 @@ import path from "node:path";
 import { existsSync } from "node:fs";
 import pc from "picocolors";
 import fs$1 from "node:fs/promises";
+import { findDigestReproducibilityWarnings, loadKiciIgnoreRules } from "@kici-dev/core/kici-source-digest";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { PackageManager, detectPackageManagerSync } from "@kici-dev/core/package-manager";
 import { execSync } from "node:child_process";
@@ -80,6 +81,9 @@ async function compileCommand(options) {
 		const lockJson = serializeLockFile(lockFile);
 		const windowWarning = schemaWindowWarning(BREAKING_FLOOR, SCHEMA_VERSION);
 		if (windowWarning) logger.warn(pc.yellow(windowWarning));
+		const ignoreRules = await loadKiciIgnoreRules(absoluteKiciDir);
+		for (const warning of ignoreRules.warnings) logger.warn(pc.yellow(warning));
+		for (const warning of await findDigestReproducibilityWarnings(absoluteKiciDir, ignoreRules)) logger.warn(pc.yellow(warning));
 		if (!options.check) {
 			await fs$1.writeFile(lockPath, lockJson, "utf-8");
 			if (!options.quiet) logger.info(pc.green("✓") + ` Compiled workflows → .kici/kici.lock.json` + pc.dim(` (${workflowsWithSource.length} workflow${workflowsWithSource.length !== 1 ? "s" : ""})`));
@@ -91,7 +95,7 @@ async function compileCommand(options) {
 				if (hasToken && hasEndpoint && config.activeOrgId) {
 					const { typesCommand } = await import("./types.js");
 					await typesCommand({
-						kiciDir,
+						kiciDir: absoluteKiciDir,
 						quiet: options.quiet
 					});
 				}

package/dist/commands/doctor.js

@@ -8,7 +8,7 @@ import path from "node:path";
 import pc from "picocolors";
 import fs from "node:fs/promises";
 import { deriveDiagnoseOverall, diagnoseExitCode, toErrorMessage } from "@kici-dev/core";
-import { matcherSatisfiedBy } from "@kici-dev/engine";
+import { canonicalizeLabelSet, canonicalizeMatcher, matcherSatisfiedBy } from "@kici-dev/engine";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 //#region src/commands/doctor.ts
@@ -157,9 +157,15 @@ function checkLockFile(state) {
 * A label group satisfies a requirement only when it matches EVERY runsOn
 * matcher AND matches NONE of the excludeLabels — the same authority the
 * orchestrator's job queue applies (`runsOn.every` && `!exclude.some`).
+*
+* Both sides are folded first, and both arms of the check get the fold: the
+* probe reports canonical agent labels while lock matchers carry whatever case
+* the workflow author wrote, so comparing them raw would report a dispatchable
+* job unreachable and would let an excluded label slip past on case alone.
 */
 function requirementSatisfiedBy(req, labels) {
-	return req.runsOn.every((m) => matcherSatisfiedBy(m, labels)) && !req.exclude.some((m) => matcherSatisfiedBy(m, labels));
+	const canonical = canonicalizeLabelSet([...labels]);
+	return req.runsOn.every((m) => matcherSatisfiedBy(canonicalizeMatcher(m), canonical)) && !req.exclude.some((m) => matcherSatisfiedBy(canonicalizeMatcher(m), canonical));
 }
 function describeMatcher(m) {
 	return m.kind === "regex" ? `/${m.source}/${m.flags}` : m.value;

package/dist/commands/init.d.ts

@@ -48,4 +48,13 @@ export declare function initCommand(options?: InitOptions): Promise<boolean>;
  * @param kiciDir - The resolved `.kici` directory path.
  */
 export declare function writeKiciGitignore(kiciDir: string): Promise<void>;
+/**
+ * Scaffold `.kici/.kiciignore` with the default exclusion set. Never overwrites
+ * an existing file — the customer may have tuned it — and never runs from
+ * `kici compile`: a compile that wrote into the tree it is hashing is the exact
+ * hazard the exclusion set exists to close.
+ *
+ * @param kiciDir - The resolved `.kici` directory path.
+ */
+export declare function writeKiciIgnore(kiciDir: string): Promise<void>;
 //# sourceMappingURL=init.d.ts.map

package/dist/commands/init.js

@@ -11,12 +11,13 @@ import { rewriteRunsOnForHost, shouldOfferFirstRun } from "./init-host-os.js";
 import path from "node:path";
 import pc from "picocolors";
 import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { KICI_DIGEST_DEFAULT_EXCLUSIONS, KICI_IGNORE_FILENAME } from "@kici-dev/core/kici-source-digest";
 import { $ } from "zx";
 import { initZx, logger, toErrorMessage } from "@kici-dev/core";
 import { detectPackageManager, detectWorkspaceRoot, installBuildPolicyArgs, installCommand, parsePackageManager } from "@kici-dev/core/package-manager";
+import os from "node:os";
 import { checkbox, confirm, select } from "@inquirer/prompts";
 import { isCiEnvironment } from "@kici-dev/core/ci-env";
-import os from "node:os";
 //#region src/commands/init.ts
 /**
 * kici init command
@@ -77,6 +78,7 @@ async function initCommand(options = {}) {
 			await writeFile(kiciIgnorePath, kiciIgnoreTemplate, "utf-8");
 		}
 		await writeKiciGitignore(kiciDir);
+		await writeKiciIgnore(kiciDir);
 		const devMode = await detectDevelopmentMode();
 		const mode = await resolveScaffoldMode(options);
 		const useVerdaccio = devMode;
@@ -230,8 +232,21 @@ async function resolvePackageManager(override, dir = process.cwd()) {
 	}
 	return detectPackageManager(dir);
 }
-/** The @kici-dev scope → local Verdaccio registry line written in dev mode. */
-const VERDACCIO_NPMRC = "@kici-dev:registry=http://verdaccio.local:4873\n";
+/**
+* The `@kici-dev` scope → local registry line written in dev mode, or `null`
+* when no dev registry is configured.
+*
+* The registry URL comes from `KICI_DEV_REGISTRY` rather than a literal in this
+* file. `init.ts` ships in the published `@kici-dev/compiler` source and
+* bundle, so a hard-coded internal hostname is published to every customer who
+* unpacks the tarball — a disclosure, not a reachable path (every write site is
+* behind the dev-mode gate), but an avoidable one. With dev mode on and the
+* variable unset there is nothing to point at, so no `.npmrc` is written.
+*/
+function devRegistryNpmrc() {
+	const registry = process.env.KICI_DEV_REGISTRY?.trim();
+	return registry ? `@kici-dev:registry=${registry}\n` : null;
+}
 /** Write .kici/tsconfig.json + the empty types/ dir (TypeScript mode only). */
 async function writeTsConfigAndTypesDir(kiciDir) {
 	logger.info(pc.gray("Writing .kici/tsconfig.json"));
@@ -254,13 +269,15 @@ async function runInstall(pm, dir) {
 async function wireStandaloneDeps(kiciDir, devMode, options) {
 	logger.info(pc.gray("Writing .kici/package.json"));
 	await writeFile(path.join(kiciDir, "package.json"), generatePackageJson(devMode), "utf-8");
-	if (devMode) {
-		logger.info(pc.yellow("Pointing @kici-dev to local Verdaccio registry."));
-		await writeFile(path.join(kiciDir, ".npmrc"), VERDACCIO_NPMRC, "utf-8");
+	const devNpmrc = devMode ? devRegistryNpmrc() : null;
+	if (devMode && !devNpmrc) logger.info(pc.yellow("Dev mode: KICI_DEV_REGISTRY is unset, writing no .npmrc."));
+	if (devNpmrc) {
+		logger.info(pc.yellow("Pointing @kici-dev to the dev registry."));
+		await writeFile(path.join(kiciDir, ".npmrc"), devNpmrc, "utf-8");
 		const rootNpmrc = path.resolve(".npmrc");
 		if (!await checkExists(rootNpmrc)) {
-			logger.info(pc.gray("Writing .npmrc (Verdaccio scope)"));
-			await writeFile(rootNpmrc, VERDACCIO_NPMRC, "utf-8");
+			logger.info(pc.gray("Writing .npmrc (dev registry scope)"));
+			await writeFile(rootNpmrc, devNpmrc, "utf-8");
 		}
 	}
 	if (!options.mjs) {
@@ -276,11 +293,13 @@ async function wireStandaloneDeps(kiciDir, devMode, options) {
 */
 async function wireIntegrateDeps(kiciDir, workspaceRoot, devMode, options) {
 	await addSdkToRootManifest(workspaceRoot, devMode);
-	if (devMode) {
+	const devNpmrc = devMode ? devRegistryNpmrc() : null;
+	if (devMode && !devNpmrc) logger.info(pc.yellow("Dev mode: KICI_DEV_REGISTRY is unset, writing no .npmrc."));
+	if (devNpmrc) {
 		const rootNpmrc = path.join(workspaceRoot, ".npmrc");
 		if (!await checkExists(rootNpmrc)) {
-			logger.info(pc.gray("Writing workspace-root .npmrc (Verdaccio scope)"));
-			await writeFile(rootNpmrc, VERDACCIO_NPMRC, "utf-8");
+			logger.info(pc.gray("Writing workspace-root .npmrc (dev registry scope)"));
+			await writeFile(rootNpmrc, devNpmrc, "utf-8");
 		}
 	}
 	if (!options.mjs) await writeTsConfigAndTypesDir(kiciDir);
@@ -389,6 +408,52 @@ async function writeKiciGitignore(kiciDir) {
 	await writeFile(gitignorePath, KICI_GITIGNORE_TEMPLATE, "utf-8");
 }
 /**
+* Build the `.kici/.kiciignore` scaffold: the default exclusion set, annotated.
+*
+* Rendered from `KICI_DIGEST_DEFAULT_EXCLUSIONS` rather than a hand-typed list,
+* so a new default cannot ship with the seeded file silently short of it — the
+* file replaces the defaults rather than merging with them, which makes a stale
+* template an unstable hash rather than a cosmetic drift.
+*/
+function buildKiciIgnoreTemplate() {
+	return [
+		"# Paths the workflow source digest does NOT cover.",
+		"#",
+		"# This file IS the exclusion list: it replaces the built-in defaults rather",
+		"# than adding to them. The entries below are those defaults. Removing one",
+		"# re-includes that path in the hash — and node_modules/, .npmrc and",
+		"# package-lock.json are rewritten during a run, so dropping one makes the",
+		"# hash change on every run and the drift gate reject it. `kici compile`",
+		"# warns when that happens.",
+		"#",
+		"# Patterns are gitignore-style, relative to .kici/. Unrelated to the",
+		"# repo-root .kiciignore, which selects what `kici run --remote` uploads.",
+		"#",
+		"# This file is itself hashed: which files define a workflow identity is",
+		"# part of that identity, so editing it forces a recompile.",
+		"",
+		...KICI_DIGEST_DEFAULT_EXCLUSIONS,
+		""
+	].join("\n");
+}
+/**
+* Scaffold `.kici/.kiciignore` with the default exclusion set. Never overwrites
+* an existing file — the customer may have tuned it — and never runs from
+* `kici compile`: a compile that wrote into the tree it is hashing is the exact
+* hazard the exclusion set exists to close.
+*
+* @param kiciDir - The resolved `.kici` directory path.
+*/
+async function writeKiciIgnore(kiciDir) {
+	const kiciIgnorePath = path.join(kiciDir, KICI_IGNORE_FILENAME);
+	if (await checkExists(kiciIgnorePath)) {
+		logger.info(pc.gray(`Skipping .kici/${KICI_IGNORE_FILENAME} (already exists)`));
+		return;
+	}
+	logger.info(pc.gray(`Writing .kici/${KICI_IGNORE_FILENAME}`));
+	await writeFile(kiciIgnorePath, buildKiciIgnoreTemplate(), "utf-8");
+}
+/**
 * Update .gitignore with .kici/ entries
 *
 * Safely appends to .gitignore, checking for existing entries to avoid duplicates.
@@ -560,6 +625,6 @@ async function offerHookInstallation(useVerdaccio) {
 	} else logger.warn(pc.yellow(`Warning: ${result.message}`));
 }
 //#endregion
-export { initCommand, writeKiciGitignore };
+export { initCommand, writeKiciGitignore, writeKiciIgnore };
 
 //# sourceMappingURL=init.js.map

package/dist/commands/local.d.ts

@@ -5,7 +5,7 @@
  * orchestrator plus a local Postgres (embedded, with a podman fallback) that
  * `kici run --local` dispatches through. `up` boots or reuses the plane,
  * `status` reports it plus the control commands, `down` stops it, and `logs`
- * prints the orchestrator log path.
+ * prints the plane log paths and rotation policy.
  */
 import type { PlaneStatus, PlaneMode } from '../local-plane/plane-manager.js';
 import type { PlaneState } from '../local-plane/plane-liveness.js';
@@ -52,7 +52,14 @@ export declare function localStatusCommand(options?: {
 }): Promise<boolean>;
 /** Stop the local dev plane, reporting success only once the port is released. */
 export declare function localDownCommand(): Promise<boolean>;
-/** Print the local dev plane orchestrator log path. */
+/**
+ * Print the local dev plane orchestrator log path, plus the rotation policy.
+ *
+ * The path is the only line this command writes to stdout — the policy note
+ * goes to stderr — so a caller reading stdout never has to strip prose from
+ * it. The CLI version banner still precedes it, as for every command, so
+ * `$(kici local logs)` is NOT a bare path: read the last stdout line.
+ */
 export declare function localLogsCommand(): Promise<boolean>;
 /**
  * Attach the local dev plane to the hosted Platform so `kici run --local` uses

package/dist/commands/local.js

@@ -1,5 +1,6 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { loadGlobalConfig } from "../remote/config.js";
+import "../local-plane/plane-log.js";
 import { attachPlane, detachPlane, planeDown, planeLogPath, planeStatus } from "../local-plane/plane-manager.js";
 import { resolvePlaneForRun } from "../local-plane/resolve-plane.js";
 import pc from "picocolors";
@@ -12,14 +13,14 @@ import { toErrorMessage } from "@kici-dev/core";
 * orchestrator plus a local Postgres (embedded, with a podman fallback) that
 * `kici run --local` dispatches through. `up` boots or reuses the plane,
 * `status` reports it plus the control commands, `down` stops it, and `logs`
-* prints the orchestrator log path.
+* prints the plane log paths and rotation policy.
 */
 /** Print the control commands a user needs once the plane is running. */
 function printControlHints() {
 	console.log("");
 	console.log(pc.dim("Control commands:"));
 	console.log(`  ${pc.cyan("kici local status")}   Show plane status`);
-	console.log(`  ${pc.cyan("kici local logs")}     Print the orchestrator log path`);
+	console.log(`  ${pc.cyan("kici local logs")}     Print the plane log paths and rotation policy`);
 	console.log(`  ${pc.cyan("kici local down")}     Stop the plane`);
 }
 /**
@@ -147,9 +148,18 @@ async function localDownCommand() {
 	console.log(pc.green("✓") + " Local dev plane stopped.");
 	return true;
 }
-/** Print the local dev plane orchestrator log path. */
+/**
+* Print the local dev plane orchestrator log path, plus the rotation policy.
+*
+* The path is the only line this command writes to stdout — the policy note
+* goes to stderr — so a caller reading stdout never has to strip prose from
+* it. The CLI version banner still precedes it, as for every command, so
+* `$(kici local logs)` is NOT a bare path: read the last stdout line.
+*/
 async function localLogsCommand() {
-	console.log(planeLogPath());
+	const logFile = planeLogPath();
+	console.log(logFile);
+	console.error(pc.dim(`Rotated to ${logFile}.1 when it reaches 50 MB, at the next plane start. When the plane runs embedded PostgreSQL, its log sits beside it at ${logFile}.pg and rotates the same way.`));
 	return true;
 }
 /**

package/dist/commands/preview.js

@@ -9,10 +9,10 @@ import { loadSecretsFile } from "../test-runner/secrets-file.js";
 import path from "node:path";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
-import { flattenStepInputs } from "@kici-dev/sdk";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { matchAllWorkflows } from "@kici-dev/engine";
 import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
+import { flattenStepInputs } from "@kici-dev/sdk/internal";
 //#region src/commands/preview.ts
 /**
 * Main preview command entry point.

package/dist/commands/report/identity.d.ts

@@ -13,6 +13,17 @@ export interface OrchestratorIdentity {
     version: string | null;
     mode: string | null;
     connected: boolean;
+    /**
+     * Where this orchestrator's config files live on its host. Recorded so a
+     * support bundle names the files whoever reads it should ask for. Paths
+     * only — the bundle never carries their contents. Each is null when the
+     * orchestrator did not report it.
+     */
+    configPaths: {
+        envFile: string | null;
+        scalerConfig: string | null;
+        composeFile: string | null;
+    };
 }
 export interface ReportIdentity {
     kiciCliVersion: string;

package/dist/commands/report/identity.js

@@ -19,7 +19,7 @@ import { PROTOCOL_VERSION } from "@kici-dev/engine";
 */
 function collectIdentity(probe) {
 	const identity = {
-		kiciCliVersion: "0.6.1",
+		kiciCliVersion: "0.8.0",
 		nodeVersion: process.version,
 		platform: process.platform,
 		arch: process.arch,
@@ -38,7 +38,12 @@ function collectIdentity(probe) {
 		clusterName: o.clusterName ?? "(unnamed)",
 		version: o.version ?? null,
 		mode: o.mode ?? null,
-		connected: o.connected
+		connected: o.connected,
+		configPaths: {
+			envFile: o.configPaths?.envFile ?? null,
+			scalerConfig: o.configPaths?.scalerConfig ?? null,
+			composeFile: o.configPaths?.composeFile ?? null
+		}
 	}));
 	if (probe.infra.latestVersion) identity.latestKnownVersion = probe.infra.latestVersion;
 	return identity;

package/dist/commands/run-routed.js

@@ -129,6 +129,7 @@ async function runRouted(options) {
 		}
 		const seeded = await ensureLocalSource(plane.url, plane.adminToken, {
 			repoDir: workdir.dir,
+			...resolved.kind === "attached" && { orgId: resolved.orgId },
 			inPlace: Boolean(options.inPlace)
 		});
 		const seededSecrets = await seedLocalSecrets(plane.url, plane.adminToken, {
@@ -150,6 +151,9 @@ async function runRouted(options) {
 				action: dispatch.action,
 				clientPayload: dispatch.clientPayload
 			}
+		}, {
+			repoBasePath: workdir.dir,
+			logPath: planeLogPath()
 		});
 		if (!quiet) logger.info(pc.green(`Run started: ${runId}`));
 		const outcome = await followRun(plane.url, plane.adminToken, runId, {

package/dist/commands/run.js

@@ -9,6 +9,7 @@ import { buildEncryptedSecrets } from "../remote/secret-upload.js";
 import { createOverlayTarball, getSizeWarning, uploadTarball } from "../remote/uploader.js";
 import { formatJsonResult } from "../remote/output/json.js";
 import { formatJunitResult } from "../remote/output/junit.js";
+import { unwrapStoredLogLine } from "../remote/output/streaming.js";
 import { formatErrorHighlight, formatMultiFixtureSummary, formatSummary } from "../remote/output/summary.js";
 import { compileFixtures, filterFixtures } from "../fixtures/compiler.js";
 import { describeEvent } from "../fixtures/describe-event.js";
@@ -500,7 +501,8 @@ async function pollRunToCompletion(ctx, runId, fixtureId, options) {
 				throw err;
 			}
 			runSeen = true;
-			for (const line of logs.lines) {
+			for (const raw of logs.lines) {
+				const line = unwrapStoredLogLine(raw);
 				if (!options.quiet) process.stdout.write(line + "\n");
 				tailLines.push(line);
 				while (tailLines.length > MAX_TAIL) tailLines.shift();
@@ -585,7 +587,8 @@ function jobsFromStatus(status) {
 	if (!status) return [];
 	return status.jobs.map((j) => ({
 		name: j.jobName,
-		status: j.status
+		status: j.status,
+		...typeof j.durationMs === "number" && { durationMs: j.durationMs }
 	}));
 }
 /**

package/dist/commands/runs/logs.js

@@ -1,6 +1,7 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { DashboardClient, DashboardClientError } from "../../remote/dashboard-client.js";
 import { colorStatus } from "../../remote/render.js";
+import { unwrapStoredLogLine } from "../../remote/output/streaming.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { TERMINAL_RUN_STATES } from "@kici-dev/engine";
@@ -31,7 +32,7 @@ async function printAllLogs(client, runId, jobs, jobFilter) {
 	for (const j of selectJobs(jobs, jobFilter)) for (const s of j.steps ?? []) {
 		console.log(pc.bold(`\n=== ${j.jobName} › ${s.stepName} `) + colorStatus(s.status) + pc.bold(" ==="));
 		const logs = await client.getStepLogs(runId, j.jobId, s.stepIndex);
-		for (const line of logs.lines) console.log(line);
+		for (const line of logs.lines) console.log(unwrapStoredLogLine(line));
 	}
 }
 async function collectAllLogs(client, runId, jobs, jobFilter) {
@@ -50,7 +51,7 @@ async function followLogs(client, runId, jobFilter) {
 			const seen = printed[key] ?? 0;
 			if (logs.lines.length > seen) {
 				if (seen === 0) console.log(pc.bold(`\n=== ${j.jobName} › ${s.stepName} ===`));
-				for (const line of logs.lines.slice(seen)) console.log(line);
+				for (const line of logs.lines.slice(seen)) console.log(unwrapStoredLogLine(line));
 				printed[key] = logs.lines.length;
 			}
 		}

package/dist/commands/types.d.ts

@@ -1,5 +1,10 @@
 export interface TypesOptions {
-    /** Path to .kici directory (defaults to .kici) */
+    /**
+     * Path to the `.kici` directory (defaults to `.kici`). Resolved through
+     * `resolveKiciDir`, the same resolver every other command uses, so a
+     * relative value is interpreted against the project rather than against
+     * whatever directory the CLI happened to be invoked from.
+     */
     kiciDir?: string;
     /** Suppress the success line on stdout (so machine-readable output stays pure). */
     quiet?: boolean;

package/dist/commands/types.js

@@ -1,4 +1,5 @@
 import "../rolldown-runtime-ClRpJifh.js";
+import { resolveKiciDir } from "../execution/executor.js";
 import { loadGlobalConfig } from "../remote/config.js";
 import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
 import { generateSecretsDts } from "../generators/secrets-dts.js";
@@ -44,7 +45,7 @@ async function fileExists(p) {
 * @returns true on success, false on error
 */
 async function typesCommand(options = {}) {
-	const kiciDir = options.kiciDir ?? ".kici";
+	const kiciDir = resolveKiciDir(options.kiciDir);
 	const typesDir = path.join(kiciDir, "types");
 	const outputPath = path.join(typesDir, "secrets.d.ts");
 	try {

package/dist/execution/executor.js

@@ -6,6 +6,7 @@ import { pathToFileURL } from "node:url";
 import path from "node:path";
 import { existsSync } from "node:fs";
 import fs$1 from "node:fs/promises";
+import { findKiciDir, hashKiciSourceTree } from "@kici-dev/core/kici-source-digest";
 //#region src/execution/executor.ts
 /**
 * Map a caught runtime error's stack to a `SourceLocation` in the entry file.
@@ -46,7 +47,12 @@ function locateInEntry(stack, entryPoint) {
 */
 async function loadModule(entryPoint, errorContext) {
 	let hashBundleSource;
-	try {
+	const kiciDir = findKiciDir(entryPoint);
+	if (kiciDir) {
+		const digest = await hashKiciSourceTree(kiciDir);
+		if (digest) hashBundleSource = digest;
+	}
+	if (hashBundleSource === void 0) try {
 		hashBundleSource = await fs$1.readFile(entryPoint, "utf-8");
 	} catch {}
 	try {