@webpresso/agent-kit 3.1.28 → 3.1.30

package/dist/esm/ci/act-runner.d.ts

@@ -6,6 +6,7 @@ export interface PublicCiActOptions {
     readonly workflow?: string;
     readonly workflowPath?: string;
     readonly job?: string;
+    readonly matrix?: readonly string[];
     readonly eventName?: CiActEventName;
     readonly eventPath?: string;
     readonly envProfile?: string;
@@ -22,6 +23,7 @@ export interface PublicCiActCommand {
     readonly actArgs: readonly string[];
 }
 export interface PreparedPublicCiActExecution {
+    readonly cwd: string;
     readonly command: PublicCiActCommand;
     readonly mode: CiActExecutionMode;
     readonly nonSecurityEquivalent: boolean;
@@ -36,5 +38,7 @@ export declare function buildPublicCiActArgs(options?: PublicCiActOptions, workf
 export declare function buildPublicCiActCommand(options?: PublicCiActOptions): PublicCiActCommand;
 export declare function preparePublicCiActExecution(options?: PublicCiActOptions): PreparedPublicCiActExecution;
 export declare function resolveCiActSecretEnvProfile(options?: PublicCiActOptions): string | undefined;
+export declare function shouldForceCiActSecretGate(envProfile: string | undefined): boolean;
 export declare function sanitizePublicCiActArgv(command: PublicCiActCommand): PublicCiActCommand;
 export declare function assertNoForbiddenCiActArgs(args: readonly string[]): void;
+export declare function normalizeCiActMatrixSelectors(selectors: readonly string[] | undefined): readonly string[];

package/dist/esm/ci/act-runner.js

@@ -2,6 +2,7 @@ import { resolve } from "node:path";
 import { buildSecretGateCommand } from "#secret-gate/runner.js";
 import { resolveSecretsConfigProfileEnvironment } from "#runtime/secrets-config.js";
 import { createReplayWorkflow, GENERATED_REPLAY_WORKFLOW_PLACEHOLDER, } from "./act-replay.js";
+import { prepareActGitWorkspace } from "./act-worktree-git.js";
 export { GENERATED_REPLAY_WORKFLOW_PLACEHOLDER } from "./act-replay.js";
 const DEFAULT_WORKFLOW = "ci-e2e";
 export const DEFAULT_PLATFORM_IMAGE = "ghcr.io/catthehacker/ubuntu:full-latest";
@@ -43,6 +44,7 @@ export function buildPublicCiActArgs(options = {}, workflowPathOverride) {
         "--rm",
     ];
     pushOption(args, "-j", options.job);
+    pushRepeatableOption(args, "--matrix", normalizeCiActMatrixSelectors(options.matrix));
     pushOption(args, "-e", options.eventPath ? resolve(cwd, options.eventPath) : undefined);
     pushOption(args, "--container-architecture", containerArchitecture);
     return args;
@@ -57,7 +59,7 @@ export function buildPublicCiActCommand(options = {}) {
         sink: "act",
         profile: secretEnvProfile,
         envProfile: options.envProfile ?? "secrets-only",
-        forceSecretGate: true,
+        forceSecretGate: shouldForceCiActSecretGate(options.envProfile),
         command: "act",
         args: actArgs,
     });
@@ -65,32 +67,63 @@ export function buildPublicCiActCommand(options = {}) {
 }
 export function preparePublicCiActExecution(options = {}) {
     const cwd = options.cwd ?? process.cwd();
-    const mode = resolveCiActExecutionMode(options);
-    const replay = mode === "replay"
-        ? createReplayWorkflow({
-            cwd,
-            workflowPath: resolveCiActWorkflowPath(options),
-            eventName: options.eventName ?? "pull_request",
-        })
-        : null;
-    const actArgs = buildPublicCiActArgs({ ...options, cwd }, replay ? replay.workflowPath : undefined);
-    const secretEnvProfile = resolveCiActSecretEnvProfile({ ...options, cwd }) ?? "preview";
-    const wrapped = buildSecretGateCommand({
-        sink: "act",
-        profile: secretEnvProfile,
-        envProfile: options.envProfile ?? "secrets-only",
-        forceSecretGate: true,
-        command: "act",
-        args: actArgs,
-    });
-    return {
-        command: { command: wrapped.command, args: wrapped.args, actArgs },
-        mode,
-        nonSecurityEquivalent: mode === "replay",
-        cleanup() {
+    let gitWorkspace = null;
+    let replay = null;
+    try {
+        gitWorkspace = prepareActGitWorkspace(cwd);
+        const executionCwd = gitWorkspace.cwd;
+        const mode = resolveCiActExecutionMode(options);
+        const sourceWorkflowPath = resolve(cwd, resolveCiActWorkflowPath(options));
+        replay =
+            mode === "replay"
+                ? createReplayWorkflow({
+                    cwd,
+                    workflowPath: sourceWorkflowPath,
+                    eventName: options.eventName ?? "pull_request",
+                })
+                : null;
+        const executionOptions = {
+            ...options,
+            cwd: executionCwd,
+            eventPath: options.eventPath ? resolve(cwd, options.eventPath) : undefined,
+        };
+        const actArgs = buildPublicCiActArgs(executionOptions, replay ? replay.workflowPath : sourceWorkflowPath);
+        if (gitWorkspace.prepared) {
+            actArgs.push("--bind");
+        }
+        const secretEnvProfile = resolveCiActSecretEnvProfile({ ...options, cwd }) ?? "preview";
+        const wrapped = buildSecretGateCommand({
+            sink: "act",
+            profile: secretEnvProfile,
+            envProfile: options.envProfile ?? "secrets-only",
+            forceSecretGate: shouldForceCiActSecretGate(options.envProfile),
+            command: "act",
+            args: actArgs,
+        });
+        return {
+            cwd: executionCwd,
+            command: { command: wrapped.command, args: wrapped.args, actArgs },
+            mode,
+            nonSecurityEquivalent: mode === "replay",
+            cleanup() {
+                try {
+                    replay?.cleanup();
+                }
+                finally {
+                    gitWorkspace?.cleanup();
+                }
+            },
+        };
+    }
+    catch (error) {
+        try {
             replay?.cleanup();
-        },
-    };
+        }
+        finally {
+            gitWorkspace?.cleanup();
+        }
+        throw error;
+    }
 }
 export function resolveCiActSecretEnvProfile(options = {}) {
     const secretEnvProfile = options.secretEnvProfile?.trim();
@@ -103,6 +136,9 @@ export function resolveCiActSecretEnvProfile(options = {}) {
     }
     return undefined;
 }
+export function shouldForceCiActSecretGate(envProfile) {
+    return envProfile !== "none" && envProfile !== "public";
+}
 export function sanitizePublicCiActArgv(command) {
     return {
         command: command.command,
@@ -126,11 +162,34 @@ export function assertNoForbiddenCiActArgs(args) {
     if (found)
         throw new Error(`Unsupported unsafe ci act argument: ${found}`);
 }
+export function normalizeCiActMatrixSelectors(selectors) {
+    if (!selectors)
+        return [];
+    return selectors.map((selector) => normalizeCiActMatrixSelector(selector));
+}
 function pushOption(args, flag, value) {
     if (value === undefined || value === "")
         return;
     args.push(flag, String(value));
 }
+function pushRepeatableOption(args, flag, values) {
+    for (const value of values) {
+        args.push(flag, value);
+    }
+}
+function normalizeCiActMatrixSelector(selector) {
+    const trimmed = selector.trim();
+    const delimiter = trimmed.indexOf(":");
+    if (trimmed.length === 0 || delimiter <= 0) {
+        throw new Error(`Invalid ci act matrix selector "${selector}". Use key:value with non-empty key and value.`);
+    }
+    const key = trimmed.slice(0, delimiter).trim();
+    const value = trimmed.slice(delimiter + 1).trim();
+    if (key.length === 0 || value.length === 0) {
+        throw new Error(`Invalid ci act matrix selector "${selector}". Use key:value with non-empty key and value.`);
+    }
+    return `${key}:${value}`;
+}
 function sanitizeArg(value) {
     if (/wp-ci-act-[^/\\]+[/\\]secrets\.env$/u.test(value))
         return "[INTERNAL_SECRET_FILE]";

package/dist/esm/ci/act-worktree-git.d.ts

@@ -0,0 +1,11 @@
+export interface PreparedActGitWorkspace {
+    readonly cwd: string;
+    readonly prepared: boolean;
+    cleanup(): void;
+}
+interface LinkedWorktreeGitMetadata {
+    readonly gitDir: string;
+}
+export declare function prepareActGitWorkspace(cwd: string): PreparedActGitWorkspace;
+export declare function readLinkedWorktreeGitMetadata(cwd: string): LinkedWorktreeGitMetadata | null;
+export {};

package/dist/esm/ci/act-worktree-git.js

@@ -0,0 +1,219 @@
+import { execFileSync } from "node:child_process";
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, rmSync, symlinkSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve, sep } from "node:path";
+export function prepareActGitWorkspace(cwd) {
+    const sourceCwd = resolve(cwd);
+    const linked = readLinkedWorktreeGitMetadata(sourceCwd);
+    if (!linked) {
+        return {
+            cwd: sourceCwd,
+            prepared: false,
+            cleanup() { },
+        };
+    }
+    assertExistingDirectory(linked.gitDir, "linked-worktree gitdir");
+    const commonDir = resolveGitCommonDir(linked.gitDir);
+    assertExistingDirectory(commonDir, "linked-worktree commondir");
+    const tempRoot = mkdtempSync(join(tmpdir(), "wp-ci-act-worktree-"));
+    const preparedCwd = join(tempRoot, "workspace");
+    try {
+        const head = git(sourceCwd, ["rev-parse", "HEAD"]);
+        git(sourceCwd, ["rev-parse", "--is-inside-work-tree"]);
+        execFileSync("git", [
+            "clone",
+            "--local",
+            "--no-hardlinks",
+            "--dissociate",
+            "--no-checkout",
+            sourceCwd,
+            preparedCwd,
+        ], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        syncOriginRemote(sourceCwd, preparedCwd);
+        git(preparedCwd, ["checkout", "--detach", "--quiet", head]);
+        overlayWorkingTreeChanges(sourceCwd, preparedCwd);
+        assertPreparedGitMetadataIsSelfContained(preparedCwd);
+        return {
+            cwd: preparedCwd,
+            prepared: true,
+            cleanup() {
+                rmSync(tempRoot, { recursive: true, force: true });
+            },
+        };
+    }
+    catch (error) {
+        rmSync(tempRoot, { recursive: true, force: true });
+        throw error;
+    }
+}
+export function readLinkedWorktreeGitMetadata(cwd) {
+    const gitPath = join(cwd, ".git");
+    if (!existsSync(gitPath)) {
+        return null;
+    }
+    const stat = lstatSync(gitPath);
+    if (stat.isDirectory())
+        return null;
+    if (!stat.isFile()) {
+        throw new Error(`Cannot prepare ci act workspace: ${gitPath} is not a file or directory.`);
+    }
+    const content = readFileSync(gitPath, "utf8").trim();
+    const match = /^gitdir:\s*(.+)$/u.exec(content);
+    if (!match?.[1]) {
+        throw new Error(`Cannot prepare ci act workspace: ${gitPath} is not a valid gitdir file.`);
+    }
+    return { gitDir: resolve(cwd, match[1]) };
+}
+function resolveGitCommonDir(gitDir) {
+    const commonDirPath = join(gitDir, "commondir");
+    if (!existsSync(commonDirPath))
+        return gitDir;
+    const raw = readFileSync(commonDirPath, "utf8").trim();
+    if (!raw)
+        throw new Error(`Cannot prepare ci act workspace: ${commonDirPath} is empty.`);
+    return resolve(gitDir, raw);
+}
+function overlayWorkingTreeChanges(sourceCwd, preparedCwd) {
+    const changed = parseGitDiffNameStatus(splitGitNullOutput(gitRaw(sourceCwd, ["diff", "--name-status", "--find-renames", "-z", "HEAD", "--"])));
+    const untracked = splitGitNullOutput(gitRaw(sourceCwd, ["ls-files", "--others", "--exclude-standard", "-z"]));
+    const copyPaths = new Set([...changed.copyPaths, ...untracked]);
+    for (const relativePath of changed.removePaths) {
+        assertSafeGitRelativePath(relativePath);
+        rmSync(join(preparedCwd, relativePath), { recursive: true, force: true });
+    }
+    for (const relativePath of copyPaths) {
+        assertSafeGitRelativePath(relativePath);
+        const sourcePath = join(sourceCwd, relativePath);
+        const preparedPath = join(preparedCwd, relativePath);
+        const sourceStat = tryLstat(sourcePath);
+        if (!sourceStat) {
+            rmSync(preparedPath, { recursive: true, force: true });
+            continue;
+        }
+        mkdirSync(dirname(preparedPath), { recursive: true });
+        if (sourceStat.isSymbolicLink()) {
+            rmSync(preparedPath, { recursive: true, force: true });
+            symlinkSync(readlinkSync(sourcePath), preparedPath);
+            continue;
+        }
+        rmSync(preparedPath, { recursive: true, force: true });
+        cpSync(sourcePath, preparedPath, { recursive: true, force: true, errorOnExist: false });
+    }
+}
+function tryLstat(path) {
+    try {
+        return lstatSync(path);
+    }
+    catch (error) {
+        if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+            return null;
+        }
+        throw error;
+    }
+}
+function parseGitDiffNameStatus(entries) {
+    const copyPaths = new Set();
+    const removePaths = new Set();
+    for (let index = 0; index < entries.length;) {
+        const status = entries[index++];
+        if (!status)
+            continue;
+        if (status.startsWith("R")) {
+            const oldPath = entries[index++];
+            const newPath = entries[index++];
+            if (oldPath)
+                removePaths.add(oldPath);
+            if (newPath)
+                copyPaths.add(newPath);
+            continue;
+        }
+        if (status.startsWith("C")) {
+            index++;
+            const newPath = entries[index++];
+            if (newPath)
+                copyPaths.add(newPath);
+            continue;
+        }
+        const path = entries[index++];
+        if (!path)
+            continue;
+        if (status.startsWith("D")) {
+            removePaths.add(path);
+        }
+        else {
+            copyPaths.add(path);
+        }
+    }
+    return { copyPaths, removePaths };
+}
+function syncOriginRemote(sourceCwd, preparedCwd) {
+    const originUrl = tryGit(sourceCwd, ["remote", "get-url", "origin"]);
+    if (originUrl) {
+        git(preparedCwd, ["remote", "set-url", "origin", originUrl]);
+        return;
+    }
+    tryGit(preparedCwd, ["remote", "remove", "origin"]);
+}
+function assertPreparedGitMetadataIsSelfContained(preparedCwd) {
+    const gitPath = join(preparedCwd, ".git");
+    if (!existsSync(gitPath) || !lstatSync(gitPath).isDirectory()) {
+        throw new Error("Cannot prepare ci act workspace: prepared .git metadata is not a directory.");
+    }
+    const commonDir = resolve(preparedCwd, git(preparedCwd, ["rev-parse", "--git-common-dir"]));
+    const relative = commonDirRelativeToPrepared(preparedCwd, commonDir);
+    if (relative === null) {
+        throw new Error(`Cannot prepare ci act workspace: prepared git common dir escaped the execution workspace (${commonDir}).`);
+    }
+    const alternatesPath = join(commonDir, "objects", "info", "alternates");
+    if (existsSync(alternatesPath) && readFileSync(alternatesPath, "utf8").trim().length > 0) {
+        throw new Error(`Cannot prepare ci act workspace: prepared git objects still depend on alternates (${alternatesPath}).`);
+    }
+}
+function commonDirRelativeToPrepared(preparedCwd, commonDir) {
+    const normalizedRoot = resolve(preparedCwd);
+    const normalizedCommon = resolve(commonDir);
+    if (normalizedCommon === normalizedRoot)
+        return "";
+    if (normalizedCommon.startsWith(`${normalizedRoot}${sep}`)) {
+        return normalizedCommon.slice(normalizedRoot.length + 1);
+    }
+    return null;
+}
+function splitGitNullOutput(output) {
+    return output.split("\0").filter((entry) => entry.length > 0);
+}
+function assertSafeGitRelativePath(relativePath) {
+    if (relativePath.length === 0 ||
+        relativePath.startsWith("/") ||
+        relativePath === ".." ||
+        relativePath.startsWith("../") ||
+        relativePath.includes("/../")) {
+        throw new Error(`Unsafe git path returned while preparing ci act workspace: ${relativePath}`);
+    }
+}
+function assertExistingDirectory(path, label) {
+    if (!existsSync(path) || !lstatSync(path).isDirectory()) {
+        throw new Error(`Cannot prepare ci act workspace: ${label} is missing or unreadable: ${path}`);
+    }
+}
+function git(cwd, args) {
+    return gitRaw(cwd, args).trim();
+}
+function tryGit(cwd, args) {
+    try {
+        return git(cwd, args);
+    }
+    catch {
+        return null;
+    }
+}
+function gitRaw(cwd, args) {
+    return execFileSync("git", [...args], {
+        cwd,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+}

package/dist/esm/cli/commands/audit.js

@@ -123,6 +123,9 @@ export const REPO_AUDIT_REGISTRY = {
     "secrets-config": async (root) => (await import("#audit/secrets-config")).auditSecretsConfig(root),
     "consumer-agent-kit-dependency": async (root) => (await import("#audit/consumer-agent-kit-dependency")).auditConsumerAgentKitDependency(root),
     "ci-test-perf": async (root) => (await import("#audit/ci-test-perf")).auditCiTestPerf(root),
+    "test-scan-perf": async (root, options) => (await import("#audit/test-scan-perf")).auditTestScanPerf(root, {
+        affectedFiles: options.affectedFiles,
+    }),
     "worktree-main-ownership": async (root) => (await import("#audit/worktree-main-ownership")).auditWorktreeMainOwnership(root),
     sast: async (root, options) => (await import("#audit/sast")).auditSast(root, {
         bin: options.bin,

package/dist/esm/cli/commands/blueprint/mutations.js

@@ -161,6 +161,31 @@ async function reIngestDb(cwd) {
         return;
     await reIngestProjection(cwd);
 }
+/**
+ * Force reingest of one blueprint document even when the stored content hash
+ * still matches. Used on complete so task-table lag cannot block finalize.
+ */
+async function forceReIngestBlueprint(cwd, slug, documentPath) {
+    const target = dbPath(cwd);
+    if (!existsSync(target))
+        return;
+    try {
+        const conn = openDb(target);
+        try {
+            // Invalidate hash so ingestAll's skip-if-unchanged path rewrites tasks.
+            conn.db.prepare(`UPDATE blueprints SET content_hash = NULL WHERE slug = ?`).run(slug);
+        }
+        finally {
+            conn.close();
+        }
+        await reIngestProjection(cwd);
+    }
+    catch {
+        // Projection is best-effort for complete; markdown gate already passed.
+        // Swallow so a broken local projection cannot block lifecycle completion.
+        void documentPath;
+    }
+}
 /**
  * Update `status:` in YAML frontmatter. Preserves everything else verbatim.
  */
@@ -306,7 +331,12 @@ async function promoteBlueprintLocked(cwd, slug, toState) {
         throw new Error(`Blueprint "${slug}" not found in any state directory under ${blueprintRoot}`);
     }
     const { dir: currentDir, documentPath: currentDocumentPath, shape, state: currentState } = found;
-    // Guard: refuse to complete if any tasks are not done/dropped
+    // Guard: refuse to complete if any tasks are not done/dropped.
+    // Markdown `_overview.md` is SSOT for task status + verification evidence.
+    // The projection DB is derived and can lag when agents edit task Status
+    // blocks without going through `task complete` (hash-skipping reingest then
+    // leaves stale todo rows). Do not fail completion on projection lag —
+    // reingest after the markdown gate so consumers see fresh rows.
     if (toState === "completed") {
         const markdown = readFileSync(currentDocumentPath, "utf8");
         const blueprint = parseBlueprint(markdown, slug);
@@ -319,23 +349,10 @@ async function promoteBlueprintLocked(cwd, slug, toState) {
             throw new Error(`Cannot promote "${slug}" to completed: the following tasks are not done/dropped: ${list}`);
         }
         assertAllTasksHaveCanonicalPassingEvidence(markdown, blueprint.tasks.filter((task) => task.status === "done").map((task) => task.id));
-        const target = dbPath(cwd);
-        if (existsSync(target)) {
-            const conn = openDb(target);
-            let openTasks;
-            try {
-                openTasks = conn.db
-                    .prepare(`SELECT task_id, status FROM tasks WHERE blueprint_slug = ? AND status NOT IN ('done', 'dropped')`)
-                    .all(slug);
-            }
-            finally {
-                conn.close();
-            }
-            if (openTasks.length > 0) {
-                const list = openTasks.map((t) => `${t.task_id} (${t.status})`).join(", ");
-                throw new Error(`Cannot promote "${slug}" to completed: the following tasks are not done: ${list}`);
-            }
-        }
+        // Best-effort projection refresh. Clear content hash first so a lagging
+        // tasks table is rewritten even when a prior corrupt UPDATE left the
+        // stored hash equal to current markdown.
+        await forceReIngestBlueprint(cwd, slug, currentDocumentPath);
     }
     // Platform freshness must be resolved before trust validation so the proof
     // applies to the current replica, not stale local markdown.

package/dist/esm/cli/commands/blueprint/router.js

@@ -5,7 +5,9 @@ import { parseBlueprintForDb } from "#db/parser/blueprint-db-parser";
 import { blueprintToSpecKit } from "#export/spec-kit/index";
 import { getProjectRoot } from "#cli/utils";
 import { commandExists as defaultCommandExists } from "#runtime/command-exists.js";
-import { clearBlueprintWorktreeOwnership, ensureBlueprintOwnerWorktree, } from "#worktrees/manager.js";
+import { adoptBlueprintOwnerWorktree, clearBlueprintWorktreeOwnership, ensureBlueprintOwnerWorktree, } from "#worktrees/manager.js";
+import { resolveCurrentManagedWorktreeContext } from "#worktrees/current.js";
+import { canonicalizeWorktreePath, WORKTREE_PROBE_TIMEOUT_MS } from "#worktrees/identity.js";
 import { resolveBlueprintRoot } from "#utils/blueprint-root";
 import { getBlueprintDocumentPaths } from "#utils/document-paths.js";
 import { applyBlueprintLifecycleToFile, BlueprintCreationService, BlueprintService, complexitySchema, relativeBlueprintSlug, parseBlueprint, planStatusSchema, runBlueprintAudit, resolveBlueprintFile, serializeBlueprint, validateAllTasksDone, } from "#local";
@@ -392,7 +394,16 @@ export async function startBlueprint(slug, options = {}) {
     if (source.blueprint.status !== "planned") {
         throw new Error(`Blueprint ${source.slug} must be planned before start (current: ${source.blueprint.status}).`);
     }
-    const binding = ensureBlueprintOwnerWorktree(projectRoot, relativeBlueprintSlug(slug));
+    const relativeSlug = relativeBlueprintSlug(slug);
+    const currentManaged = resolveCurrentManagedWorktreeContext(projectRoot);
+    const canonicalProjectRoot = canonicalizeWorktreePath(projectRoot);
+    const currentBranch = readCurrentGitBranch(projectRoot);
+    const binding = currentManaged &&
+        currentManaged.kind === "owner" &&
+        currentManaged.worktreePath === canonicalProjectRoot &&
+        currentBranch === `bp/${relativeSlug}`
+        ? adoptBlueprintOwnerWorktree(currentManaged.repoRoot, relativeSlug, currentManaged.worktreePath)
+        : ensureBlueprintOwnerWorktree(projectRoot, relativeSlug);
     const result = await applyLifecycleMutation(slug, {
         type: "start",
         worktreeOwnerId: binding.id,
@@ -404,6 +415,20 @@ export async function startBlueprint(slug, options = {}) {
         ownerWorktreePath: binding.path,
     };
 }
+function readCurrentGitBranch(cwd) {
+    try {
+        const branch = execFileSync("git", ["branch", "--show-current"], {
+            cwd,
+            encoding: "utf8",
+            timeout: WORKTREE_PROBE_TIMEOUT_MS,
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+        return branch.length > 0 ? branch : null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function parkBlueprint(slug, options = {}) {
     const projectRoot = resolveProjectRoot(options.projectRoot);
     const result = await applyLifecycleMutation(slug, { type: "park" }, projectRoot);

package/dist/esm/cli/commands/ci.d.ts

@@ -2,12 +2,14 @@ import type { CAC } from "cac";
 import type { SecretGateCommandOptions, SecretGateRunResult } from "#secret-gate/runner.js";
 import { type CiActEventName, type CiActExecutionMode } from "#ci/act-runner.js";
 export declare const DEFAULT_CI_ACT_TIMEOUT_MS: number;
+export declare const SMOKE_CI_ACT_TIMEOUT_MS = 30000;
 export declare const MAX_CI_ACT_TIMEOUT_MS: number;
 export declare const CI_COMMAND_HELP: string;
 export interface CiActOptions {
     readonly workflow?: string;
     readonly workflowPath?: string;
     readonly job?: string;
+    readonly matrix?: readonly string[];
     readonly eventName?: CiActEventName;
     readonly eventPath?: string;
     readonly envProfile?: string;
@@ -17,6 +19,7 @@ export interface CiActOptions {
     readonly platformImage?: string;
     readonly execute?: boolean;
     readonly timeoutMs?: number;
+    readonly smoke?: boolean;
 }
 export interface CiCommandConfig {
     readonly command: string;
@@ -32,5 +35,9 @@ export declare function registerCiCommand(cli: CAC): void;
 export declare function buildCiActCommand(options?: CiActOptions, cwd?: string): CiCommandConfig;
 export declare function validateCiActCommand(..._legacyArgs: readonly unknown[]): string | null;
 export declare function runCiActCommand(options?: CiActOptions, deps?: CiCommandDeps): Promise<number>;
-export declare function normalizeCiActTimeoutMs(value: number | undefined): number;
+export declare function normalizeCiActTimeoutMs(value: number | undefined, options?: {
+    readonly smoke?: boolean;
+}): number;
 export declare function parseCiActTimeoutMs(value: unknown): number | undefined;
+export declare function parseCiActExecutionMode(value: unknown): CiActExecutionMode | undefined;
+export declare function parseCiActEventName(value: unknown): CiActEventName | undefined;