@kici-dev/compiler 0.1.15 → 0.1.17

package/dist/commands/diagnostics.d.ts

@@ -0,0 +1,7 @@
+export interface DiagnosticsOptions {
+    json?: boolean;
+    verbose?: boolean;
+    orchestrator?: string;
+}
+export declare function diagnosticsCommand(options?: DiagnosticsOptions): Promise<boolean>;
+//# sourceMappingURL=diagnostics.d.ts.map

package/dist/commands/diagnostics.js

@@ -0,0 +1,58 @@
+import "../chunk-BTugEXQM.js";
+import { DashboardClient, DashboardClientError } from "../remote/dashboard-client.js";
+import { relativeTime } from "../remote/render.js";
+import pc from "picocolors";
+import { logger, toErrorMessage } from "@kici-dev/core";
+//#region src/commands/diagnostics.ts
+/** kici diagnostics — mirrors the dashboard Diagnostics page (infra tree). */
+async function diagnosticsCommand(options = {}) {
+	try {
+		const client = await DashboardClient.load();
+		const [summary, infra] = await Promise.all([client.getDiagnosticsSummary(), client.getInfrastructure()]);
+		let orchestrators = infra.orchestrators;
+		if (options.orchestrator) orchestrators = orchestrators.filter((o) => o.connectionId === options.orchestrator);
+		if (options.json) {
+			console.log(JSON.stringify({
+				summary,
+				orchestrators,
+				alerts: infra.alerts
+			}, null, 2));
+			return true;
+		}
+		printSummary(summary);
+		printAlerts(infra.alerts);
+		if (orchestrators.length === 0) {
+			console.log(pc.gray("\nNo orchestrators connected."));
+			return true;
+		}
+		for (const o of orchestrators) printOrchestrator(o, options.verbose ?? false);
+		return true;
+	} catch (err) {
+		logger.error(pc.red(err instanceof DashboardClientError ? err.message : toErrorMessage(err)));
+		return false;
+	}
+}
+function printSummary(s) {
+	const m = s.executionMetrics;
+	console.log(pc.bold("\nDiagnostics") + pc.gray(`  runs(24h)=${m.totalRuns} success=${m.successRate}% avg=${m.avgDurationSeconds}s queued=${m.queuedJobs} running=${m.runningJobs}` + (s.orphanedConnections > 0 ? ` orphaned=${s.orphanedConnections}` : "")));
+}
+function printAlerts(alerts) {
+	for (const a of alerts) {
+		const color = a.severity === "critical" ? pc.red : pc.yellow;
+		console.log(color(`  ! [${a.type}] ${a.message}`));
+	}
+}
+function printOrchestrator(o, verbose) {
+	const hb = o.lastHeartbeat ? relativeTime(new Date(o.lastHeartbeat).toISOString()) : "—";
+	const head = pc.bold(o.clusterName ?? o.connectionId) + pc.gray(` [${o.connectionId}] keys=${o.routingKeys.join(",") || "—"} ${o.connected ? pc.green("connected") : pc.red("disconnected")} raft=${o.raftRole ?? "—"} hb=${hb}`);
+	console.log(`\n${head}`);
+	for (const sc of o.scalers) console.log(pc.gray("  └─ ") + `${sc.name} (${sc.type}) ${sc.activeAgents}/${sc.maxAgents} ` + pc.gray(`labels=${sc.labelSets.map((set) => set.join("+")).join(" | ") || "—"}`));
+	for (const ag of o.agents) {
+		const extra = verbose ? ` host=${ag.hostname ?? "—"} node=${ag.nodeVersion ?? "—"} mem=${ag.memoryUsedMb ?? "—"}MB` : "";
+		console.log(pc.gray("     • ") + `${ag.agentId} ` + pc.cyan(`[${ag.labels.join(",")}]`) + pc.gray(` ${ag.platform}/${ag.arch} jobs=${ag.activeJobs}/${ag.maxConcurrency} hb=${relativeTime(new Date(ag.lastHeartbeatAt).toISOString())}${extra}`));
+	}
+}
+//#endregion
+export { diagnosticsCommand };
+
+//# sourceMappingURL=diagnostics.js.map

package/dist/commands/docs.js

@@ -1,8 +1,8 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
 import pc from "picocolors";
 import { readFile, writeFile } from "node:fs/promises";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import open from "open";
 //#region src/commands/docs.ts

package/dist/commands/drain-worker.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import pc from "picocolors";
 import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/drain-worker.ts

package/dist/commands/endpoints.js

@@ -1,10 +1,10 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { resolveKiciDir } from "../execution/executor.js";
 import "../execution/index.js";
 import { loadGlobalConfig } from "../remote/config.js";
+import path from "node:path";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
-import path from "node:path";
 import { logger, toErrorMessage } from "@kici-dev/core";
 //#region src/commands/endpoints.ts
 /**

package/dist/commands/fixture.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { parseEventArg } from "../test-runner/event-types.js";
 import { detectRepoFromGit } from "../test-runner/git-detector.js";
 import { getDefaultFixture } from "../fixtures/defaults/index.js";

package/dist/commands/held-run-client.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Shared HTTP plumbing for the `kici approve` / `kici reject` held-run
+ * commands. Resolves auth + endpoint from the global config (PAT preferred,
+ * API key fallback; Platform endpoint preferred, orchestrator fallback) and
+ * exposes thin list / approve / reject helpers against the Platform dashboard
+ * API.
+ */
+import type { HeldRunSummary } from './held-run-resolve.js';
+/** Resolved auth context for a held-run command. */
+export interface HeldRunContext {
+    endpoint: string;
+    token: string;
+    orgId: string;
+}
+/**
+ * Resolve the auth context, printing a clear error and returning null when the
+ * CLI is not authenticated / no active org is set.
+ */
+export declare function resolveHeldRunContext(): Promise<HeldRunContext | null>;
+/** List the held runs for a single run id. */
+export declare function listHeldRunsForRun(ctx: HeldRunContext, runId: string): Promise<HeldRunSummary[]>;
+/** POST an approve decision for a held run. Returns true on success. */
+export declare function postApprove(ctx: HeldRunContext, heldRunId: string): Promise<boolean>;
+/** POST a reject decision (with reason) for a held run. Returns true on success. */
+export declare function postReject(ctx: HeldRunContext, heldRunId: string, reason: string): Promise<boolean>;
+//# sourceMappingURL=held-run-client.d.ts.map

package/dist/commands/held-run-client.js

@@ -0,0 +1,98 @@
+import "../chunk-BTugEXQM.js";
+import { loadGlobalConfig } from "../remote/config.js";
+import pc from "picocolors";
+import { logger } from "@kici-dev/core";
+//#region src/commands/held-run-client.ts
+/**
+* Shared HTTP plumbing for the `kici approve` / `kici reject` held-run
+* commands. Resolves auth + endpoint from the global config (PAT preferred,
+* API key fallback; Platform endpoint preferred, orchestrator fallback) and
+* exposes thin list / approve / reject helpers against the Platform dashboard
+* API.
+*/
+/**
+* Resolve the auth context, printing a clear error and returning null when the
+* CLI is not authenticated / no active org is set.
+*/
+async function resolveHeldRunContext() {
+	const config = await loadGlobalConfig();
+	const token = config.pat ?? config.token;
+	if (!token) {
+		logger.error(pc.red("Not authenticated. Run `kici login` to get started."));
+		return null;
+	}
+	const endpoint = config.platformEndpoint ?? config.endpoint;
+	if (!endpoint) {
+		logger.error(pc.red("No endpoint configured. Run `kici login` to configure."));
+		return null;
+	}
+	if (!config.activeOrgId) {
+		logger.error(pc.red("No active organization. Run `kici org use <name>` to set one."));
+		return null;
+	}
+	return {
+		endpoint,
+		token,
+		orgId: config.activeOrgId
+	};
+}
+function authHeaders(token) {
+	return {
+		"Content-Type": "application/json",
+		Authorization: `Bearer ${token}`
+	};
+}
+/** List the held runs for a single run id. */
+async function listHeldRunsForRun(ctx, runId) {
+	const url = `${ctx.endpoint}/api/v1/orgs/${ctx.orgId}/held-runs?runId=${encodeURIComponent(runId)}`;
+	const response = await fetch(url, {
+		method: "GET",
+		headers: authHeaders(ctx.token)
+	});
+	if (!response.ok) throw new Error(await describeError(response));
+	return (await response.json()).heldRuns ?? [];
+}
+/** POST an approve decision for a held run. Returns true on success. */
+async function postApprove(ctx, heldRunId) {
+	const url = `${ctx.endpoint}/api/v1/orgs/${ctx.orgId}/held-runs/${heldRunId}/approve`;
+	const response = await fetch(url, {
+		method: "POST",
+		headers: authHeaders(ctx.token)
+	});
+	if (!response.ok) {
+		logger.error(pc.red(await describeError(response)));
+		return false;
+	}
+	return true;
+}
+/** POST a reject decision (with reason) for a held run. Returns true on success. */
+async function postReject(ctx, heldRunId, reason) {
+	const url = `${ctx.endpoint}/api/v1/orgs/${ctx.orgId}/held-runs/${heldRunId}/reject`;
+	const response = await fetch(url, {
+		method: "POST",
+		headers: authHeaders(ctx.token),
+		body: JSON.stringify({ reason })
+	});
+	if (!response.ok) {
+		logger.error(pc.red(await describeError(response)));
+		return false;
+	}
+	return true;
+}
+/** Build a user-facing error string from a failed response. */
+async function describeError(response) {
+	let detail;
+	try {
+		detail = (await response.json()).error;
+	} catch {}
+	switch (response.status) {
+		case 401: return "Authentication failed. Run `kici login` to re-authenticate.";
+		case 403: return `Access denied${detail ? `: ${detail}` : ""}.`;
+		case 404: return `Held run not found${detail ? `: ${detail}` : ""}.`;
+		default: return detail ?? `Request failed with status ${response.status}.`;
+	}
+}
+//#endregion
+export { listHeldRunsForRun, postApprove, postReject, resolveHeldRunContext };
+
+//# sourceMappingURL=held-run-client.js.map

package/dist/commands/held-run-resolve.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared held-run resolution for the `kici approve` / `kici reject` commands.
+ *
+ * Both commands first list the pending holds for a run, then resolve the one
+ * the user named via `--job` / `--step` (or the sole pending hold when there is
+ * exactly one and no filter is given). The resolution is a pure function so it
+ * can be unit-tested without HTTP.
+ */
+/** Hold scope, mirroring the engine `HoldScope` enum. */
+export type HeldRunScope = 'workflow' | 'job' | 'step';
+/** A pending-hold row as returned by `GET /orgs/:orgId/held-runs`. */
+export interface HeldRunSummary {
+    id: string;
+    runId: string;
+    jobId?: string;
+    holdScope?: HeldRunScope;
+    stepIndex?: number | null;
+    status: string;
+}
+/** Filters supplied on the command line. */
+export interface HeldRunFilter {
+    /** Match a hold by its job name. */
+    job?: string;
+    /** Match a step-scoped hold by its step index (compared as a string). */
+    step?: string;
+}
+/** Resolution result: either a held-run id or a user-facing error message. */
+export type ResolveResult = {
+    ok: true;
+    heldRunId: string;
+    hold: HeldRunSummary;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Resolve the held-run id matching the filter from a list of pending holds.
+ *
+ * - `--step` requires `--job` and matches a `step`-scoped hold whose step index
+ *   equals the given value.
+ * - `--job` alone matches a `job`/`workflow`-scoped hold for that job.
+ * - With no filter, the sole pending hold is used; ambiguity is an error.
+ */
+export declare function resolveHeldRunId(holds: readonly HeldRunSummary[], filter: HeldRunFilter): ResolveResult;
+//# sourceMappingURL=held-run-resolve.d.ts.map

package/dist/commands/held-run-resolve.js

@@ -0,0 +1,53 @@
+import "../chunk-BTugEXQM.js";
+//#region src/commands/held-run-resolve.ts
+/**
+* Resolve the held-run id matching the filter from a list of pending holds.
+*
+* - `--step` requires `--job` and matches a `step`-scoped hold whose step index
+*   equals the given value.
+* - `--job` alone matches a `job`/`workflow`-scoped hold for that job.
+* - With no filter, the sole pending hold is used; ambiguity is an error.
+*/
+function resolveHeldRunId(holds, filter) {
+	const pending = holds.filter((h) => h.status === "pending");
+	if (pending.length === 0) return {
+		ok: false,
+		error: "No pending approval holds found for this run."
+	};
+	if (filter.step !== void 0) {
+		if (!filter.job) return {
+			ok: false,
+			error: "--step requires --job to identify the held step."
+		};
+		return pickSingle(pending.filter((h) => h.holdScope === "step" && h.jobId === filter.job && String(h.stepIndex ?? "") === filter.step), `step ${filter.step} of job '${filter.job}'`);
+	}
+	if (filter.job !== void 0) return pickSingle(pending.filter((h) => h.jobId === filter.job && h.holdScope !== "step"), `job '${filter.job}'`);
+	if (pending.length > 1) return {
+		ok: false,
+		error: "Multiple pending holds for this run. Use --job <name> (and --step <index>) to choose one."
+	};
+	return {
+		ok: true,
+		heldRunId: pending[0].id,
+		hold: pending[0]
+	};
+}
+function pickSingle(matches, label) {
+	if (matches.length === 0) return {
+		ok: false,
+		error: `No pending hold found for ${label}.`
+	};
+	if (matches.length > 1) return {
+		ok: false,
+		error: `Multiple pending holds match ${label}; cannot disambiguate.`
+	};
+	return {
+		ok: true,
+		heldRunId: matches[0].id,
+		hold: matches[0]
+	};
+}
+//#endregion
+export { resolveHeldRunId };
+
+//# sourceMappingURL=held-run-resolve.js.map

package/dist/commands/hook.js

@@ -1,10 +1,10 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { detectHookTools, findGitDir } from "../hooks/detector.js";
 import { installHook } from "../hooks/installer.js";
 import "../hooks/index.js";
+import path from "node:path";
 import pc from "picocolors";
 import { readFile } from "node:fs/promises";
-import path from "node:path";
 import { logger, toErrorMessage } from "@kici-dev/core";
 import { select } from "@inquirer/prompts";
 //#region src/commands/hook.ts

package/dist/commands/index.d.ts

@@ -14,20 +14,36 @@ export { loginCommand } from './login.js';
 export type { LoginOptions } from './login.js';
 export { secretsListCommand } from './secrets-list.js';
 export type { SecretsListOptions } from './secrets-list.js';
-export { statusCommand } from './status.js';
-export type { StatusOptions } from './status.js';
+export { runsListCommand } from './runs/list.js';
+export type { RunsListOptions } from './runs/list.js';
+export { runsShowCommand } from './runs/show.js';
+export type { RunsShowOptions } from './runs/show.js';
+export { runsLogsCommand } from './runs/logs.js';
+export type { RunsLogsOptions } from './runs/logs.js';
+export { runsRerunCommand } from './runs/rerun.js';
+export type { RunsRerunOptions } from './runs/rerun.js';
+export { runsCancelCommand } from './runs/cancel.js';
+export type { RunsCancelOptions } from './runs/cancel.js';
 export { typesCommand } from './types.js';
 export type { TypesOptions } from './types.js';
 export { endpointsCommand } from './endpoints.js';
 export type { EndpointsOptions } from './endpoints.js';
+export { diagnosticsCommand } from './diagnostics.js';
+export type { DiagnosticsOptions } from './diagnostics.js';
 export { orgListCommand, orgUseCommand, orgCurrentCommand } from './org.js';
+export { orchestratorsListCommand, orchestratorsUseCommand } from './orchestrators.js';
+export type { OrchestratorsOptions } from './orchestrators.js';
 export { logoutCommand } from './logout.js';
-export { cancelCommand } from './cancel.js';
-export type { CancelOptions } from './cancel.js';
+export { approveCommand } from './approve.js';
+export type { ApproveOptions } from './approve.js';
+export { rejectCommand } from './reject.js';
+export type { RejectOptions } from './reject.js';
 export { workflowsListCommand } from './workflows.js';
 export type { WorkflowsListOptions } from './workflows.js';
 export { drainWorkerCommand } from './drain-worker.js';
 export type { DrainWorkerOptions } from './drain-worker.js';
 export { docsCommand, docsLlmCommand } from './docs.js';
 export type { DocsOptions, DocsLlmOptions } from './docs.js';
+export { verifyAttestationCommand } from './verify-attestation.js';
+export type { VerifyAttestationOptions } from './verify-attestation.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/commands/index.js

@@ -1,6 +1,7 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { compileCommand } from "./compile.js";
-import { cancelCommand } from "./cancel.js";
+import { approveCommand } from "./approve.js";
+import { diagnosticsCommand } from "./diagnostics.js";
 import { docsCommand, docsLlmCommand } from "./docs.js";
 import { drainWorkerCommand } from "./drain-worker.js";
 import { endpointsCommand } from "./endpoints.js";
@@ -12,9 +13,16 @@ import { runLocalCommand, runRemoteCommand } from "./run.js";
 import { initCommand } from "./init.js";
 import { loginCommand } from "./login.js";
 import { secretsListCommand } from "./secrets-list.js";
-import { statusCommand } from "./status.js";
+import { runsListCommand } from "./runs/list.js";
+import { runsShowCommand } from "./runs/show.js";
+import { runsLogsCommand } from "./runs/logs.js";
+import { runsRerunCommand } from "./runs/rerun.js";
+import { runsCancelCommand } from "./runs/cancel.js";
 import { typesCommand } from "./types.js";
 import { orgCurrentCommand, orgListCommand, orgUseCommand } from "./org.js";
+import { orchestratorsListCommand, orchestratorsUseCommand } from "./orchestrators.js";
 import { logoutCommand } from "./logout.js";
+import { rejectCommand } from "./reject.js";
 import { workflowsListCommand } from "./workflows.js";
-export { cancelCommand, compileCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orgCurrentCommand, orgListCommand, orgUseCommand, runLocalCommand, runRemoteCommand, secretsListCommand, statusCommand, testCommand, testDryRun, typesCommand, watchCommand, workflowsListCommand };
+import { verifyAttestationCommand } from "./verify-attestation.js";
+export { approveCommand, compileCommand, diagnosticsCommand, docsCommand, docsLlmCommand, drainWorkerCommand, endpointsCommand, fixtureCommand, hookInstallCommand, initCommand, loginCommand, logoutCommand, orchestratorsListCommand, orchestratorsUseCommand, orgCurrentCommand, orgListCommand, orgUseCommand, rejectCommand, runLocalCommand, runRemoteCommand, runsCancelCommand, runsListCommand, runsLogsCommand, runsRerunCommand, runsShowCommand, secretsListCommand, testCommand, testDryRun, typesCommand, verifyAttestationCommand, watchCommand, workflowsListCommand };

package/dist/commands/init.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { agentsMdTemplate } from "../templates/agents-md.js";
 import { tsconfigTemplate } from "../templates/tsconfig-json.js";
 import { generatePackageJson } from "../templates/package-json.js";
@@ -7,9 +7,9 @@ import { detectHookTools, findGitDir } from "../hooks/detector.js";
 import { installHook } from "../hooks/installer.js";
 import "../hooks/index.js";
 import { getTypeScriptPaths } from "../execution/sdk-alias.js";
+import path from "node:path";
 import pc from "picocolors";
 import { access, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import path from "node:path";
 import { initZx, logger, toErrorMessage } from "@kici-dev/core";
 import { detectPackageManager, installBuildPolicyArgs, installCommand, parsePackageManager } from "@kici-dev/core/package-manager";
 import { checkbox, confirm, select } from "@inquirer/prompts";
@@ -292,7 +292,7 @@ export default workflow('private-registry-example', {
   ],
   jobs: [
     job('build', {
-      runsOn: 'linux',
+      runsOn: 'kici:os:linux',
       steps: [step('install', async () => { /* deps install with auth */ })],
     }),
   ],

package/dist/commands/login.d.ts

@@ -1,8 +1,6 @@
 export interface LoginOptions {
     /** API key for non-interactive authentication */
     token?: string;
-    /** Orchestrator URL for direct connection */
-    endpoint?: string;
     /** Platform relay URL */
     platformEndpoint?: string;
     /** Routing key for webhook source identification */

package/dist/commands/login.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { getConfigPath, mergeGlobalConfig } from "../remote/config.js";
 import { deviceFlow, exchangeTokenForPat, pkceFlow } from "../remote/oauth.js";
 import "../remote/prod-defaults.js";
@@ -75,7 +75,6 @@ async function oauthLogin(options) {
 		patId: patResult.id,
 		patExpiresAt: patResult.expiresAt
 	};
-	if (options.endpoint) configUpdate.endpoint = options.endpoint;
 	if (options.platformEndpoint) configUpdate.platformEndpoint = options.platformEndpoint;
 	if (options.routingKey) configUpdate.routingKey = options.routingKey;
 	await mergeGlobalConfig(configUpdate);
@@ -117,7 +116,6 @@ async function legacyTokenLogin(options) {
 		return false;
 	}
 	const update = { token };
-	if (options.endpoint) update.endpoint = options.endpoint;
 	if (options.platformEndpoint) update.platformEndpoint = options.platformEndpoint;
 	if (options.routingKey) update.routingKey = options.routingKey;
 	await mergeGlobalConfig(update);

package/dist/commands/logout.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { getConfigPath, loadGlobalConfig, saveGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/logout.ts

package/dist/commands/orchestrators.d.ts

@@ -0,0 +1,25 @@
+/**
+ * kici orchestrators commands
+ *
+ * Inspect the org's connected orchestrator clusters and pick a per-org default
+ * for `kici run remote`. `list` reads the Platform orchestrators index;
+ * `use <name>` records `config.defaultClusters[orgId]` so a developer with a
+ * preferred cluster types no `--orchestrator` flag.
+ */
+/** Options shared by the orchestrators subcommands. */
+export interface OrchestratorsOptions {
+    /** Target organization id (overrides config.activeOrgId). */
+    org?: string;
+}
+/**
+ * List the org's connected orchestrator clusters, marking the per-org default.
+ */
+export declare function orchestratorsListCommand(options: OrchestratorsOptions): Promise<boolean>;
+/**
+ * Set the per-org default orchestrator cluster.
+ *
+ * Validates the cluster name against the org's connected clusters before
+ * writing it to `config.defaultClusters[orgId]`.
+ */
+export declare function orchestratorsUseCommand(clusterName: string, options: OrchestratorsOptions): Promise<boolean>;
+//# sourceMappingURL=orchestrators.d.ts.map

package/dist/commands/orchestrators.js

@@ -0,0 +1,115 @@
+import "../chunk-BTugEXQM.js";
+import { loadGlobalConfig, mergeGlobalConfig } from "../remote/config.js";
+import pc from "picocolors";
+//#region src/commands/orchestrators.ts
+/**
+* kici orchestrators commands
+*
+* Inspect the org's connected orchestrator clusters and pick a per-org default
+* for `kici run remote`. `list` reads the Platform orchestrators index;
+* `use <name>` records `config.defaultClusters[orgId]` so a developer with a
+* preferred cluster types no `--orchestrator` flag.
+*/
+/**
+* Resolve the authenticated config + the target org id, printing an actionable
+* error and returning null when either is missing.
+*/
+async function resolveOrgContext(options) {
+	const config = await loadGlobalConfig();
+	if (!config.pat) {
+		console.error(pc.red("Not logged in. Run `kici login` first."));
+		return null;
+	}
+	if (!config.platformEndpoint) {
+		console.error(pc.red("No Platform endpoint configured. Run `kici login` to set up your Platform."));
+		return null;
+	}
+	const orgId = options.org ?? config.activeOrgId;
+	if (!orgId) {
+		console.error(pc.red("No target organization. Select one with `kici org use <org>` or pass `--org <id>`."));
+		return null;
+	}
+	return {
+		config,
+		orgId
+	};
+}
+/**
+* Fetch the org's connected orchestrator clusters from the Platform index.
+* Returns null on an auth/HTTP failure (after printing an error).
+*/
+async function fetchOrchestrators(config, orgId) {
+	const url = `${config.platformEndpoint}/api/v1/orgs/${orgId}/orchestrators`;
+	const response = await fetch(url, { headers: {
+		Authorization: `Bearer ${config.pat}`,
+		"Content-Type": "application/json"
+	} });
+	if (!response.ok) {
+		if (response.status === 401) {
+			console.error(pc.red("Authentication failed. Your token may be expired. Run `kici login` to re-authenticate."));
+			return null;
+		}
+		console.error(pc.red(`Failed to list orchestrators: HTTP ${response.status}`));
+		return null;
+	}
+	return (await response.json()).orchestrators ?? [];
+}
+/**
+* List the org's connected orchestrator clusters, marking the per-org default.
+*/
+async function orchestratorsListCommand(options) {
+	const ctx = await resolveOrgContext(options);
+	if (!ctx) return false;
+	const orchestrators = await fetchOrchestrators(ctx.config, ctx.orgId);
+	if (orchestrators === null) return false;
+	if (orchestrators.length === 0) {
+		console.log(pc.gray("No orchestrators are connected for this organization."));
+		return true;
+	}
+	const defaultCluster = ctx.config.defaultClusters?.[ctx.orgId];
+	console.log(pc.bold("\nOrchestrators:\n"));
+	const names = orchestrators.map((o) => o.clusterName ?? "(unnamed)");
+	const nameWidth = Math.max(12, ...names.map((n) => n.length)) + 2;
+	for (const orch of orchestrators) {
+		const name = orch.clusterName ?? "(unnamed)";
+		const isDefault = orch.clusterName !== null && orch.clusterName === defaultCluster;
+		const marker = isDefault ? pc.green("* ") : "  ";
+		const display = isDefault ? pc.bold(name) : name;
+		const version = orch.orchVersion ? pc.gray(`v${orch.orchVersion}`) : pc.gray("(unknown)");
+		console.log(`  ${marker}${display.padEnd(nameWidth)} ${version}`);
+	}
+	console.log("");
+	console.log(pc.gray("Set a default with `kici orchestrators use <name>`."));
+	return true;
+}
+/**
+* Set the per-org default orchestrator cluster.
+*
+* Validates the cluster name against the org's connected clusters before
+* writing it to `config.defaultClusters[orgId]`.
+*/
+async function orchestratorsUseCommand(clusterName, options) {
+	const ctx = await resolveOrgContext(options);
+	if (!ctx) return false;
+	const orchestrators = await fetchOrchestrators(ctx.config, ctx.orgId);
+	if (orchestrators === null) return false;
+	if (!orchestrators.find((o) => o.clusterName === clusterName)) {
+		console.error(pc.red(`Orchestrator cluster not found: ${clusterName}`));
+		const named = orchestrators.map((o) => o.clusterName).filter((n) => !!n);
+		if (named.length > 0) {
+			console.error(pc.gray("Connected clusters:"));
+			for (const n of named) console.error(pc.gray(`  - ${n}`));
+		}
+		return false;
+	}
+	await mergeGlobalConfig({ defaultClusters: {
+		...ctx.config.defaultClusters ?? {},
+		[ctx.orgId]: clusterName
+	} });
+	console.log(pc.green(`Default orchestrator for ${ctx.orgId} set to: ${clusterName}`));
+	return true;
+}
+//#endregion
+export { orchestratorsListCommand, orchestratorsUseCommand };
+
+//# sourceMappingURL=orchestrators.js.map

package/dist/commands/org.js

@@ -1,4 +1,4 @@
-import "../chunk-gOLHoazu.js";
+import "../chunk-BTugEXQM.js";
 import { loadGlobalConfig, mergeGlobalConfig } from "../remote/config.js";
 import pc from "picocolors";
 //#region src/commands/org.ts

package/dist/commands/reject.d.ts

@@ -0,0 +1,25 @@
+/**
+ * kici reject command
+ *
+ * Rejects a held approval gate for a run (requires `--reason`). Resolves the
+ * held element by `--job` / `--step` (or the sole pending hold), then records
+ * the rejection via the Platform dashboard API (PAT auth).
+ */
+/** Options for the reject command. */
+export interface RejectOptions {
+    /** Match a hold by its job name. */
+    job?: string;
+    /** Match a step-scoped hold by its step index. */
+    step?: string;
+    /** Required rejection reason. */
+    reason?: string;
+}
+/**
+ * Reject a held approval gate.
+ *
+ * @param runId - The run whose hold to reject.
+ * @param options - Job/step filters plus the required reason.
+ * @returns true on success, false on error.
+ */
+export declare function rejectCommand(runId: string, options?: RejectOptions): Promise<boolean>;
+//# sourceMappingURL=reject.d.ts.map