@kici-dev/sdk 0.8.0 → 0.9.0

package/dist/agent-cloud-init.d.ts

@@ -1,22 +1,12 @@
-/**
- * @deprecated Pass a claim code (ClaimCodeCredentials) so the token never
- * transits cloud-init. Removed at v1.0.0.
- */
-export interface CloudInitCredentials {
-    agentToken: string;
-    agentId: string;
-    orchestratorUrl: string;
-    labels: string[];
-}
-/** Preferred: the agent self-claims from a single-use code; the token is minted in-instance. */
+/** The agent self-claims from a single-use code; the token is minted in-instance. */
 export interface ClaimCodeCredentials {
     claimCode: string;
     agentId: string;
     orchestratorUrl: string;
     labels: string[];
 }
-/** Either credential shape accepted by `buildAgentCloudInit`. */
-export type AgentCloudInitCredentials = CloudInitCredentials | ClaimCodeCredentials;
+/** The credential shape accepted by `buildAgentCloudInit`. */
+export type AgentCloudInitCredentials = ClaimCodeCredentials;
 /** How the agent binary is delivered onto the instance. */
 export type AgentDeliveryMode = 'container' | 'payload';
 /** How the rendered `user_data` string is encoded before it is returned. */
@@ -58,9 +48,9 @@ export interface AgentCloudInitOptions {
     userDataEncoding?: UserDataEncoding;
 }
 /**
- * Build the cloud-config `user_data` string. In the token form the agent token
- * appears only in the reserved env-file write entry (`0600`, root-only); the
- * claim-code form keeps the token off the provisioning channel entirely.
+ * Build the cloud-config `user_data` string. The claim code appears only in the
+ * reserved env-file write entry (`0600`, root-only), and the agent token the
+ * instance exchanges it for stays off the provisioning channel entirely.
  */
 export declare function buildAgentCloudInit(creds: AgentCloudInitCredentials, options: AgentCloudInitOptions): string;
 //# sourceMappingURL=agent-cloud-init.d.ts.map

package/dist/agent-cloud-init.js

@@ -4,33 +4,27 @@ import { parse, stringify } from "yaml";
 /**
 * Cloud-init `user_data` builder for a scaler-provisioned KiCI agent.
 *
-* Renders a `#cloud-config` that installs + starts the agent with the claimed
-* ephemeral credentials, plus teardown layer L2 — an in-instance max-lifetime
-* self-poweroff. The agent token is written ONLY into a root-only `0600` env
-* file; it never appears in a comment, a process argument, or any other file.
+* Renders a `#cloud-config` that installs + starts the agent from a single-use
+* claim code, plus teardown layer L2 — an in-instance max-lifetime
+* self-poweroff. The claim code is written ONLY into a root-only `0600` env
+* file; it never appears in a comment, a process argument, or any other file,
+* and the agent token it is exchanged for never transits cloud-init at all.
 */
 const AGENT_ENV_FILE = "/etc/kici-agent.env";
 const DEFAULT_AGENT_IMAGE = "quay.io/kici-dev/kici-agent:latest";
 /**
-* The credential-specific env lines. The claim-code form emits a single-use
-* code the agent exchanges for its own token in-instance; the token form emits
-* the token directly (the ONLY place the token appears).
+* The credential env lines: the single-use claim code the agent exchanges for
+* its own token in-instance, plus the identity the exchange is made under.
 */
 function credentialEnvLines(creds) {
-	if ("claimCode" in creds) return [
-		`KICI_ORCHESTRATOR_URL=${creds.orchestratorUrl}`,
-		`KICI_SCALER_CLAIM_CODE=${creds.claimCode}`,
-		`KICI_AGENT_ID=${creds.agentId}`,
-		`KICI_LABELS=${creds.labels.join(",")}`
-	];
 	return [
 		`KICI_ORCHESTRATOR_URL=${creds.orchestratorUrl}`,
-		`KICI_AGENT_TOKEN=${creds.agentToken}`,
+		`KICI_SCALER_CLAIM_CODE=${creds.claimCode}`,
 		`KICI_AGENT_ID=${creds.agentId}`,
 		`KICI_LABELS=${creds.labels.join(",")}`
 	];
 }
-/** Render the agent env-file content (the ONLY place the token appears, in the token form). */
+/** Render the agent env-file content (the ONLY place the claim code appears). */
 function renderEnvFileContent(creds, agentEnv) {
 	return `${[
 		...credentialEnvLines(creds),
@@ -81,9 +75,9 @@ function renderStartCommand(opts) {
 	return `docker run -d --restart=no --name kici-agent --network host --env-file ${AGENT_ENV_FILE} ${image}`;
 }
 /**
-* Build the cloud-config `user_data` string. In the token form the agent token
-* appears only in the reserved env-file write entry (`0600`, root-only); the
-* claim-code form keeps the token off the provisioning channel entirely.
+* Build the cloud-config `user_data` string. The claim code appears only in the
+* reserved env-file write entry (`0600`, root-only), and the agent token the
+* instance exchanges it for stays off the provisioning channel entirely.
 */
 function buildAgentCloudInit(creds, options) {
 	validateAgentEnv(options.agentEnv);

package/dist/agent-cloud-init.test-d.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-cloud-init.test-d.d.ts.map

package/dist/agent-cloud-init.test-d.js

@@ -0,0 +1,20 @@
+import "./rolldown-runtime-ClRpJifh.js";
+import { describe, expectTypeOf, it } from "vitest";
+//#region src/agent-cloud-init.test-d.ts
+describe("AgentCloudInitCredentials", () => {
+	it("rejects the removed agent-token credentials form", () => {
+		expectTypeOf({
+			agentToken: "t",
+			agentId: "a",
+			orchestratorUrl: "u",
+			labels: []
+		}).toBeObject();
+	});
+	it("is exactly the claim-code form", () => {
+		expectTypeOf().toEqualTypeOf();
+	});
+});
+//#endregion
+export {};
+
+//# sourceMappingURL=agent-cloud-init.test-d.js.map

package/dist/events/emit-typing.test-d.js

@@ -1,7 +1,7 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { defineEvent } from "./define-event.js";
-import { z } from "zod";
 import { describe, expectTypeOf, it } from "vitest";
+import { z } from "zod";
 //#region src/events/emit-typing.test-d.ts
 const deployComplete = defineEvent("deploy-complete", z.object({
 	env: z.string(),

package/dist/index.d.ts

@@ -2,23 +2,15 @@ export { step } from './step.js';
 export { job } from './job.js';
 export { workflow } from './workflow.js';
 export { parallel, isParallelGroup } from './parallel.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { flattenStepInputs } from './parallel.js';
 export type { ParallelGroup, ParallelOptions } from './parallel.js';
 export { invokeSource } from './invoke.js';
 export type { InvokeConfig } from './invoke.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { normalizeApproval } from './approval.js';
 export type { ApprovalConfig, ApprovalWhen, ApproverClause, NormalizedApproval, } from './approval.js';
 export { pr, push, tag, comment, review, reviewComment, release, dispatch, create, delete as delete, status, workflowRun, fork, star, watch, webhook, kiciEvent, workflowComplete, workflowsFailedBatch, jobComplete, genericWebhook, schedule, lifecycle, defineDispatchInputs, } from './triggers/index.js';
 export type { DefinedDispatchInputs, InferDispatchInputs, DispatchInputsMap, TriggerConfig, PrTriggerConfig, PushTriggerConfig, TagTriggerConfig, CommentTriggerConfig, ReviewTriggerConfig, ReviewCommentTriggerConfig, ReleaseTriggerConfig, DispatchTriggerConfig, CreateTriggerConfig, DeleteTriggerConfig, StatusTriggerConfig, WorkflowRunTriggerConfig, ForkTriggerConfig, StarTriggerConfig, WatchTriggerConfig, WebhookTriggerConfig, BranchPattern, BodyMatchPattern, PrEvent, PushEvent, PrConfigInput, PushConfigInput, TagConfigInput, CommentConfigInput, CommentAction, CommentSource, ReviewConfigInput, ReviewAction, ReviewState, ReviewCommentConfigInput, ReviewCommentAction, ReleaseConfigInput, ReleaseAction, DispatchConfigInput, CreateConfigInput, DeleteConfigInput, RefType, StatusConfigInput, StatusState, WorkflowRunConfigInput, WorkflowRunAction, ForkConfigInput, StarConfigInput, StarAction, WatchConfigInput, WatchAction, WebhookConfigInput, KiciEventConfigInput, KiciEventTriggerConfig, WorkflowCompleteConfigInput, WorkflowCompleteTriggerConfig, WorkflowCompleteStatus, WorkflowsFailedBatchConfigInput, WorkflowsFailedBatchTriggerConfig, JobCompleteConfigInput, JobCompleteTriggerConfig, JobCompleteStatus, GenericWebhookConfigInput, GenericWebhookTriggerConfig, GenericWebhookAuthMethod, GenericWebhookHmacAuth, GenericWebhookApiKeyAuth, GenericWebhookAuth, ScheduleConfigInput, ScheduleTriggerConfig, LifecycleEvent, LifecycleConfigInput, LifecycleTriggerConfig, } from './triggers/index.js';
 export { onCancel, cleanup, onSuccess, onFailure, beforeStep, afterStep } from './hooks/index.js';
 export type { HookConfig, HookFn, HookInput, HookContext, OutcomeMetadata } from './hooks/index.js';
 export { rule, skip, onlyOnFirstHost, onlyOnLastHost, onlyOnFanoutIndex } from './rules/index.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { evaluateRules } from './rules/index.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { createRuleContext } from './rules/index.js';
 export { ChangedFilesUnavailableError } from './rules/index.js';
 export type { CreateRuleContextInput } from './rules/index.js';
 export { isEventType } from './rules/index.js';
@@ -28,12 +20,8 @@ export type { DagNode, DagValidationResult } from './validation/index.js';
 export type { SourceLocation, OutputProxy, Step, StepOptions, StepOptionsBase, StepOptionsPlain, StepOptionsWithCheck, StepRunFn, RetryConfig, NormalizedRetry, BareStepFn, StepInput, OutputSchema, InferOutputs, Job, JobOptions, GenericInitConfig, MiseInitConfig, InitPreset, InitItem, InitConfig, ContainerConfig, RunsOnSelector, RunsOn, RunsOnPick, Workflow, WorkflowOptions, Registry, Trigger, DynamicJobFn, DynamicJobContext, JobOrFactory, } from './types.js';
 export { isDynamicJobFn, dynamicJob, getDynamicJobGroup, getDynamicJobNeeds, getDynamicJobGitCredentials, DYNAMIC_JOB_GROUP_TAG, DYNAMIC_JOB_NEEDS_TAG, DYNAMIC_JOB_GIT_CREDENTIALS_TAG, } from './types.js';
 export type { TaggedDynamicJobFn, ResultAwareDynamicJobConfig, ResultAwareDynamicJobFn, DynamicJobNeed, NeedsWhen, NeedsWhenInput, } from './types.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { buildNeedsContext } from './needs-context.js';
 export type { UpstreamSnapshot, NeedsContext, NeedEntry, GroupNeedEntry, InvokeNeedEntry, InvokeResult, } from './needs-context.js';
 export { CacheSpecSchema } from './cache-types.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { normalizeCacheSpecs } from './cache-types.js';
 export type { CacheSpec, CacheInput } from './cache-types.js';
 export type { CacheRestoreResult, CacheApi } from './cache-types.js';
 export { ArtifactNameSchema, ARTIFACT_NAME_MAX_LENGTH } from './artifacts-types.js';
@@ -45,25 +33,15 @@ export type { DynamicGroupRef } from './dynamic-group.js';
 export type { StepContext, Logger, WorkflowInfo, JobInfo, AgentInfo, MatrixJobOutputs, HostJobOutputs, RepoInfo, StepSecretsTyped, KnownSecretKeys, } from './context.js';
 export { isMatrixJobOutputs, isHostJobOutputs } from './context.js';
 export type { FilterContext, FilterFn } from './filter.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { createFilterContext } from './filter-context.js';
 export type { CreateFilterContextInput } from './filter-context.js';
 export type { FanoutPosition } from './fanout-context.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { buildKiciApi } from './api-types.js';
 export type { KiciApi, KiciApiTransport, InfrastructureApi, InfrastructureListResult, InventoryApi, HostApi, HostInventoryEntry, InventorySelector, } from './api-types.js';
 export { SecretNotFoundError } from './errors.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { createStepSecrets } from './secrets.js';
 export type { StepSecrets, TrackedStepSecrets, SecretMeta, SecretFileOptions, MountedFile, StepSecretsFileHost, StepSecretsFileWiring, StepSecretsHandle, StepSecretMountKind, StepSecretMountRecord, } from './secrets.js';
 export { createStepOutputProxy, createJobOutputProxy, createSnapshotOutputProxy, resolveStepOutputs, resolveJobOutputs, getStepOutputsMap, getJobOutputsMap, getStepRefMap, } from './outputs.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { setStepOutputsMap, setJobOutputsMap, setStepRefMap } from './outputs.js';
 export type { OutputsMap, StepRefMap } from './outputs.js';
 export type { StaticMatrixArray, StaticMatrixObject, DynamicMatrixFn, DynamicMatrixContext, Matrix, MatrixInclude, MatrixExclude, MatrixValues, } from './matrix/index.js';
 export { isStaticArray, isStaticObject, isDynamicFunction } from './matrix/index.js';
-/** @deprecated Moved to `@kici-dev/sdk/internal` — internal runtime API, not covered by semver. */
-export { expandMatrix, applyIncludeExclude } from './matrix/index.js';
 export { defineEvent, isEventDefinition } from './events/index.js';
 export type { EventDefinition } from './events/index.js';
 export type { EventEmitOptions } from './events/index.js';
@@ -80,7 +58,7 @@ export type { AgentVersionConvergeOptions, AgentVersionDrift, } from './fleet/ag
 export { z } from 'zod';
 export { SCALER_EVENT_NAMES, ScaleDownReason, ScalerScaleUpPayload, ScalerScaleDownPayload, } from '@kici-dev/engine';
 export { buildAgentCloudInit } from './agent-cloud-init.js';
-export type { CloudInitCredentials, ClaimCodeCredentials, AgentCloudInitCredentials, AgentDeliveryMode, UserDataEncoding, CloudInitWriteFile, AgentCloudInitOptions, } from './agent-cloud-init.js';
+export type { ClaimCodeCredentials, AgentCloudInitCredentials, AgentDeliveryMode, UserDataEncoding, CloudInitWriteFile, AgentCloudInitOptions, } from './agent-cloud-init.js';
 export { assertSecretName } from './git-types.js';
 export type { ForgeName, GitHubPermissions, WriteOptions, GitGrant, Sourced, ContainerRegistryAuth, GitCredentialRef, GitCredentialMap, RepoHandle, GitTokenResult, GitHubApi, GitApi, } from './git-types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,16 +1,13 @@
 import "./rolldown-runtime-ClRpJifh.js";
 import { buildAgentCloudInit } from "./agent-cloud-init.js";
-import { buildKiciApi } from "./api-types.js";
-import { normalizeApproval } from "./approval.js";
 import { ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSchema } from "./artifacts-types.js";
-import { CacheSpecSchema, normalizeCacheSpecs } from "./cache-types.js";
+import { CacheSpecSchema } from "./cache-types.js";
 import { isHostJobOutputs, isMatrixJobOutputs } from "./context.js";
 import { DYNAMIC_GROUP_TAG, dynamicGroup, isDynamicGroupRef } from "./dynamic-group.js";
 import { SecretNotFoundError } from "./errors.js";
 import { ChangedFilesUnavailableError } from "./rules/changed-files.js";
-import { createFilterContext } from "./filter-context.js";
 import { workflow } from "./workflow.js";
-import { createJobOutputProxy, createSnapshotOutputProxy, createStepOutputProxy, getJobOutputsMap, getStepOutputsMap, getStepRefMap, resolveJobOutputs, resolveStepOutputs, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "./outputs.js";
+import { createJobOutputProxy, createSnapshotOutputProxy, createStepOutputProxy, getJobOutputsMap, getStepOutputsMap, getStepRefMap, resolveJobOutputs, resolveStepOutputs } from "./outputs.js";
 import { assertSecretName } from "./git-types.js";
 import { job } from "./job.js";
 import { step } from "./step.js";
@@ -18,7 +15,7 @@ import { fixture } from "./fixture.js";
 import { WaitForTimeoutError, waitFor, waitForStep } from "./wait-for.js";
 import { restartHost, waitForHostAlive } from "./host-restart.js";
 import { checkStep, idempotent, idempotentStep } from "./idempotent.js";
-import { flattenStepInputs, isParallelGroup, parallel } from "./parallel.js";
+import { isParallelGroup, parallel } from "./parallel.js";
 import { invokeSource } from "./invoke.js";
 import { pr } from "./triggers/pr.js";
 import { push } from "./triggers/push.js";
@@ -47,22 +44,17 @@ import { defineDispatchInputs } from "./triggers/dispatch-inputs.js";
 import "./triggers/index.js";
 import { afterStep, beforeStep, cleanup, onCancel, onFailure, onSuccess } from "./hooks/index.js";
 import { onlyOnFanoutIndex, onlyOnFirstHost, onlyOnLastHost, rule, skip } from "./rules/rule.js";
-import { createRuleContext } from "./rules/context.js";
-import { evaluateRules } from "./rules/evaluator.js";
 import { isEventType } from "./events/event-payloads.js";
 import "./rules/index.js";
 import { validateDag } from "./validation/dag.js";
 import "./validation/index.js";
 import { DYNAMIC_JOB_GIT_CREDENTIALS_TAG, DYNAMIC_JOB_GROUP_TAG, DYNAMIC_JOB_NEEDS_TAG, dynamicJob, getDynamicJobGitCredentials, getDynamicJobGroup, getDynamicJobNeeds, isDynamicJobFn } from "./types.js";
-import { buildNeedsContext } from "./needs-context.js";
 import { provenanceSubjectIsPath } from "./provenance-types.js";
-import { createStepSecrets } from "./secrets.js";
 import { isDynamicFunction, isStaticArray, isStaticObject } from "./matrix/types.js";
-import { applyIncludeExclude, expandMatrix } from "./matrix/expand.js";
 import "./matrix/index.js";
 import { defineEvent, isEventDefinition } from "./events/define-event.js";
 import "./events/index.js";
 import { agentVersionConverge } from "./fleet/agent-version-converge.js";
 import { SCALER_EVENT_NAMES, ScaleDownReason, ScalerScaleDownPayload, ScalerScaleUpPayload } from "@kici-dev/engine";
 import { z } from "zod";
-export { ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSchema, CacheSpecSchema, ChangedFilesUnavailableError, DYNAMIC_GROUP_TAG, DYNAMIC_JOB_GIT_CREDENTIALS_TAG, DYNAMIC_JOB_GROUP_TAG, DYNAMIC_JOB_NEEDS_TAG, SCALER_EVENT_NAMES, ScaleDownReason, ScalerScaleDownPayload, ScalerScaleUpPayload, SecretNotFoundError, WaitForTimeoutError, afterStep, agentVersionConverge, applyIncludeExclude, assertSecretName, beforeStep, buildAgentCloudInit, buildKiciApi, buildNeedsContext, checkStep, cleanup, comment, create, createFilterContext, createJobOutputProxy, createRuleContext, createSnapshotOutputProxy, createStepOutputProxy, createStepSecrets, defineDispatchInputs, defineEvent, del as delete, dispatch, dynamicGroup, dynamicJob, evaluateRules, expandMatrix, fixture, flattenStepInputs, fork, genericWebhook, getDynamicJobGitCredentials, getDynamicJobGroup, getDynamicJobNeeds, getJobOutputsMap, getStepOutputsMap, getStepRefMap, idempotent, idempotentStep, invokeSource, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isEventDefinition, isEventType, isHostJobOutputs, isMatrixJobOutputs, isParallelGroup, isStaticArray, isStaticObject, job, jobComplete, kiciEvent, lifecycle, normalizeApproval, normalizeCacheSpecs, onCancel, onFailure, onSuccess, onlyOnFanoutIndex, onlyOnFirstHost, onlyOnLastHost, parallel, pr, provenanceSubjectIsPath, push, release, resolveJobOutputs, resolveStepOutputs, restartHost, review, reviewComment, rule, schedule, setJobOutputsMap, setStepOutputsMap, setStepRefMap, skip, star, status, step, tag, validateDag, waitFor, waitForHostAlive, waitForStep, watch, webhook, workflow, workflowComplete, workflowRun, workflowsFailedBatch, z };
+export { ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSchema, CacheSpecSchema, ChangedFilesUnavailableError, DYNAMIC_GROUP_TAG, DYNAMIC_JOB_GIT_CREDENTIALS_TAG, DYNAMIC_JOB_GROUP_TAG, DYNAMIC_JOB_NEEDS_TAG, SCALER_EVENT_NAMES, ScaleDownReason, ScalerScaleDownPayload, ScalerScaleUpPayload, SecretNotFoundError, WaitForTimeoutError, afterStep, agentVersionConverge, assertSecretName, beforeStep, buildAgentCloudInit, checkStep, cleanup, comment, create, createJobOutputProxy, createSnapshotOutputProxy, createStepOutputProxy, defineDispatchInputs, defineEvent, del as delete, dispatch, dynamicGroup, dynamicJob, fixture, fork, genericWebhook, getDynamicJobGitCredentials, getDynamicJobGroup, getDynamicJobNeeds, getJobOutputsMap, getStepOutputsMap, getStepRefMap, idempotent, idempotentStep, invokeSource, isDynamicFunction, isDynamicGroupRef, isDynamicJobFn, isEventDefinition, isEventType, isHostJobOutputs, isMatrixJobOutputs, isParallelGroup, isStaticArray, isStaticObject, job, jobComplete, kiciEvent, lifecycle, onCancel, onFailure, onSuccess, onlyOnFanoutIndex, onlyOnFirstHost, onlyOnLastHost, parallel, pr, provenanceSubjectIsPath, push, release, resolveJobOutputs, resolveStepOutputs, restartHost, review, reviewComment, rule, schedule, skip, star, status, step, tag, validateDag, waitFor, waitForHostAlive, waitForStep, watch, webhook, workflow, workflowComplete, workflowRun, workflowsFailedBatch, z };

package/dist/internal.d.ts

@@ -15,10 +15,10 @@
  * dual-shape window — for a function no customer ever called. Every internal
  * refactor of the runtime would pay the public-API tax forever.
  *
- * Each symbol also stays on the root barrel, marked `@deprecated`, for the whole
- * 0.x line. The agent resolves the customer's own SDK copy at run time
- * (`workflow-loader.ts`), so a tree carrying an SDK older than this subpath must
- * keep working.
+ * These symbols live only here. The agent and the compiler test runner resolve
+ * the customer's own SDK copy at run time (`workflow-loader.ts`,
+ * `job-executor.ts`) through this subpath, so an SDK that predates it cannot
+ * drive a workflow on a current agent.
  *
  * Do not import this from a workflow. It carries no compatibility promise and
  * may change shape in any release.

package/dist/internal.js

@@ -8,8 +8,8 @@ import { flattenStepInputs } from "./parallel.js";
 import { createRuleContext } from "./rules/context.js";
 import { evaluateRules } from "./rules/evaluator.js";
 import "./rules/index.js";
-import { buildNeedsContext } from "./needs-context.js";
-import { createStepSecrets } from "./secrets.js";
 import { applyIncludeExclude, expandMatrix } from "./matrix/expand.js";
 import "./matrix/index.js";
+import { buildNeedsContext } from "./needs-context.js";
+import { createStepSecrets } from "./secrets.js";
 export { applyIncludeExclude, buildKiciApi, buildNeedsContext, createFilterContext, createRuleContext, createStepSecrets, evaluateRules, expandMatrix, flattenStepInputs, normalizeApproval, normalizeCacheSpecs, setJobOutputsMap, setStepOutputsMap, setStepRefMap };

package/dist/testing/step-context.js

@@ -1,7 +1,7 @@
 import "../rolldown-runtime-ClRpJifh.js";
 import { resolveJobOutputs, resolveStepOutputs } from "../outputs.js";
-import { createStepSecrets } from "../secrets.js";
 import { isEventDefinition } from "../events/define-event.js";
+import { createStepSecrets } from "../secrets.js";
 import { $ } from "zx";
 import { initZx } from "@kici-dev/core";
 import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/sdk",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "TypeScript SDK for defining KiCI workflows. Import into `.kici/workflows/*.ts` to declare workflows, jobs, steps, triggers, rules, and matrix configurations.",
   "keywords": [
     "ci",
@@ -57,18 +57,18 @@
   },
   "dependencies": {
     "micromatch": "^4.0.8",
-    "yaml": "^2.9.0",
-    "zod": "^4.4.3",
+    "yaml": "^2.9.1",
+    "zod": "^4.6.5",
     "zx": "^8.8.5",
-    "@kici-dev/core": "0.8.0",
-    "@kici-dev/engine": "0.8.0"
+    "@kici-dev/core": "0.9.0",
+    "@kici-dev/engine": "0.9.0"
   },
   "devDependencies": {
     "@types/micromatch": "^4.0.10"
   },
   "scripts": {
-    "build": "node ../../scripts/build-ts.mjs && tsgo --emitDeclarationOnly",
-    "typecheck": "tsgo --noEmit",
+    "build": "node ../../scripts/build-ts.mjs && tsc --emitDeclarationOnly",
+    "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "test:watch": "vitest"
   }