@kici-dev/orchestrator 0.1.26 → 0.2.0

package/dist/cli/commands/token.d.ts

@@ -6,5 +6,14 @@
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
+/**
+ * Parse a `--expires` value into an absolute expiry Date.
+ *
+ * Accepts either a duration shorthand relative to now (`<N>d` days,
+ * `<N>h` hours, `<N>m` minutes — e.g. `30d`, `12h`, `45m`) or an
+ * absolute ISO-8601 datetime (e.g. `2026-12-31T00:00:00Z`). Throws on any
+ * other input so a typo never silently creates a non-expiring token.
+ */
+export declare function parseExpiresAt(input: string, now?: Date): Date;
 export declare function registerTokenCommands(program: Command, getClient: () => AdminApiClient): void;
 //# sourceMappingURL=token.d.ts.map

package/dist/cli/commands/trust-policy.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Org trust-policy commands for kici-admin.
+ *
+ * Subcommand namespace: `kici-admin trust-policy <show|set>`.
+ *
+ * Talks to the orchestrator admin API directly (not the Platform dashboard
+ * proxy), so the CLI stays operable even when Platform is unavailable. Backed
+ * by `packages/orchestrator/src/routes/admin-trust-policy.ts`.
+ *
+ * `set` only works on an independent orchestrator. Wherever a Platform is
+ * attached the Platform owns the policy and the route refuses with 409; the
+ * message is surfaced verbatim rather than reworded here, so the CLI cannot
+ * drift from what the server actually said.
+ */
+import type { Command } from 'commander';
+import { TrustPolicyEnforcement } from '../../security/trust-policy-gate.js';
+import type { AdminApiClient } from '../api-client.js';
+/**
+ * The policy shape the admin route returns.
+ *
+ * The four policy fields are OPTIONAL because the route omits them under
+ * `enforcement: 'legacy'` — there they would be values nothing enforces, and
+ * printing them is the false assurance this feature exists to remove.
+ */
+export interface TrustPolicyView {
+    customerId: string;
+    forkPolicy?: string;
+    unknownContributorPolicy?: string;
+    workflowChangePolicy?: string;
+    approvalExpiryHours?: number;
+    /** `policy` = the values below are enforced; `legacy` = only the legacy rule. */
+    enforcement?: TrustPolicyEnforcement;
+    source: string | null;
+    updatedAt: string | null;
+    effectiveDefault?: boolean;
+    platformManaged?: boolean;
+}
+/** Render the policy as an aligned table, or as JSON when asked. */
+export declare function formatPolicy(policy: TrustPolicyView, format: string): string;
+/**
+ * Turn CLI flags into a PATCH body, exiting on an unknown value.
+ *
+ * Validating here as well as on the route is deliberate: it turns a typo into a
+ * clear local message naming the accepted values instead of a 400 from the API.
+ */
+export declare function buildPolicyPatch(opts: Record<string, string | undefined>): Record<string, string | number>;
+export declare function registerTrustPolicyCommands(program: Command, getClient: () => AdminApiClient): void;
+//# sourceMappingURL=trust-policy.d.ts.map

package/dist/cli/commands/variable.d.ts

@@ -1,12 +1,12 @@
 /**
- * Environment variable management commands for kici-admin.
+ * Context variable management commands for kici-admin.
  *
- *   kici-admin variable list   <orgId> <environment>
- *   kici-admin variable get    <orgId> <environment> <key>
- *   kici-admin variable set    <orgId> <environment> <key> [--value | --from-stdin | --from-file | --from-env | --prompt]
- *   kici-admin variable delete <orgId> <environment> <key>
+ *   kici-admin variable list   <orgId> <context>
+ *   kici-admin variable get    <orgId> <context> <key>
+ *   kici-admin variable set    <orgId> <context> <key> [--value | --from-stdin | --from-file | --from-env | --prompt]
+ *   kici-admin variable delete <orgId> <context> <key>
  *
- * Org-level environment variables are plaintext-at-rest in the
+ * Org-level context variables are plaintext-at-rest in the
  * orchestrator's DB; the dashboard write path is gated by the
  * `variables.set` / `variables.delete` switches in the dashboard-write
  * policy. This CLI is the always-available authority path when the

package/dist/cli/join.d.ts

@@ -6,7 +6,7 @@
  * writing the local YAML config.
  *
  * Usage:
- *   kici-admin join --token kici_join_v1.xxx.yyy --platform wss://platform.kici.dev/ws --api-key KEY
+ *   kici-admin join --token kici_join_v1.xxx.yyy --platform wss://api.kici.dev/ws --api-key KEY
  *   kici-admin join --token kici_join_v1.xxx.yyy --peer https://orch-1:8080
  */
 import type { Command } from 'commander';

package/dist/cli/service/index.d.ts

@@ -12,9 +12,9 @@ export { detectPlatform, isRoot, kiciConfigRoot, getConfigDir, getLogDir, getCac
 export { resolveUserLevel, type PrivilegeOpts } from './privilege.js';
 export type { Component, InstanceManifest, IndexEntry, ResolveOptions, ResolvedInstance, } from './instance/types.js';
 export { COMPONENTS, isComponent } from './instance/types.js';
-export { manifestFilename, manifestPath, readManifest, writeManifest, readKiciVersion, resolveVersionFromLaunchSpec, } from './instance/manifest.js';
+export { manifestFilename, manifestPath, readManifest, writeManifest, readKiciVersion, resolveVersionFromLaunchSpec, resolveNpmInstallTarget, type NpmInstallTarget, } from './instance/manifest.js';
 export { indexPath, readIndex, writeIndex, appendIndexEntry, removeIndexEntry, } from './instance/index-file.js';
-export { listInstances, resolveInstance, formatRefusal } from './instance/resolve.js';
+export { listInstances, resolveInstance, formatRefusal, InstanceNotFoundError, } from './instance/resolve.js';
 export type { ListedInstance, ResolveArgs, ListInstancesArgs } from './instance/resolve.js';
 import type { ServiceManager, ServicePlatform } from './types.js';
 /**

package/dist/cli/service/instance/manifest.d.ts

@@ -39,4 +39,21 @@ export declare function readKiciVersion(): string;
  * stand behind.
  */
 export declare function resolveVersionFromLaunchSpec(spec: LaunchSpec, component: Component): string | null;
+/**
+ * The global npm package + node runtime an npm-source upgrade must install
+ * into, derived from a unit's launch spec. `owningPackage` is the top-level
+ * global package whose ExecStart the unit runs — `kici-admin` when the
+ * component is loaded through its nested node_modules, or `@kici-dev/<component>`
+ * for a standalone install. `npmPath` is the npm co-located with the unit's
+ * pinned node, so `npm install -g` with it lands in exactly the prefix
+ * ExecStart resolves from, regardless of the shell's active node.
+ */
+export interface NpmInstallTarget {
+    nodeExecPath: string;
+    npmPath: string;
+    owningPackage: string;
+}
+export declare function resolveNpmInstallTarget(spec: LaunchSpec, component: Component, opts: {
+    windows: boolean;
+}): NpmInstallTarget | null;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/cli/service/instance/resolve.d.ts

@@ -41,6 +41,17 @@ export interface ListInstancesArgs {
  * the requested component + isUserLevel.
  */
 export declare function listInstances(args: ListInstancesArgs): Promise<ListedInstance[]>;
+/**
+ * Thrown by resolveInstance when `--name <n>` is given but no installed
+ * instance matches. Lifecycle commands catch this to treat stop/uninstall of
+ * a never-installed instance as an idempotent no-op. Distinct from the
+ * ambiguous-refusal and missing-manifest errors, which stay hard failures.
+ */
+export declare class InstanceNotFoundError extends Error {
+    readonly component: Component;
+    readonly instanceName: string;
+    constructor(component: Component, instanceName: string, message: string);
+}
 export interface ResolveArgs {
     component: Component;
     opts: ResolveOptions;

package/dist/cli/service/windows.d.ts

@@ -8,6 +8,12 @@
  */
 import type { ServiceManager, ServiceConfig, ServiceStatus, LogOptions, DiscoveredInstance, LaunchSpec } from './types.js';
 export declare class WindowsServiceManager implements ServiceManager {
+    /**
+     * Check whether a Windows service is currently registered.
+     * `sc.exe query` exits non-zero (execSync throws) when the service does
+     * not exist; exit 0 means it exists (possibly pending-delete).
+     */
+    private serviceExists;
     install(config: ServiceConfig): Promise<void>;
     uninstall(config: ServiceConfig): Promise<void>;
     start(config: ServiceConfig): Promise<void>;

package/dist/cli/wizard/orchestrator-wizard.d.ts

@@ -5,34 +5,62 @@
  * port, secrets key) with sensible defaults. Returns a config
  * object that the install command uses to write the env file.
  */
+import { OrchestratorMode } from '@kici-dev/engine';
+/** A GitHub App source the wizard collected, to be added once the orchestrator is running. */
+export interface OrchestratorSourceHint {
+    name: string;
+    appId: string;
+    /** Filesystem path to the App private key (.pem) — NOT the key contents. */
+    privateKeyPath: string;
+    webhookSecret?: string;
+}
 /** Config produced by the orchestrator wizard. */
 interface OrchestratorInstallConfig {
-    mode: 'platform' | 'hybrid' | 'independent';
+    mode: OrchestratorMode;
     databaseUrl: string;
     port: number;
     secretsKey: string;
     bootstrapAdminToken: string;
     platformUrl?: string;
     platformToken?: string;
-    /** Source to add after orchestrator is running. */
-    source?: {
-        provider: string;
-        name: string;
-        appId: string;
-        privateKey: string;
-        webhookSecret?: string;
-    };
+    /** Public base URL of this orchestrator's own ingress (required in observed mode). */
+    webhookPublicUrl?: string;
+    /** GitHub App source to add after the orchestrator is running. */
+    source?: OrchestratorSourceHint;
 }
+/**
+ * Render the post-install next-step lines for adding the collected GitHub App
+ * source. The primary command inlines the webhook secret (copy-paste-runnable);
+ * when a secret is present a "Secure alternative" pipes it via stdin so the
+ * secret stays out of the process argument list (printf is a shell builtin, and
+ * kici-admin receives the value on stdin — so it never appears in `ps`). Returns
+ * indented lines for the install "Next steps" block.
+ */
+export declare function formatSourceAddHint(hint: OrchestratorSourceHint): string[];
+/**
+ * Check that the private-key path the operator gave is readable. Returns a
+ * warning string when it is not, so the wizard can surface it without aborting
+ * the whole install — the source is opt-in and secondary to the orchestrator.
+ */
+export declare function checkPrivateKeyReadable(keyPath: string): Promise<string | null>;
+/**
+ * Default Platform relay URL offered by the install wizard. Kept in lockstep
+ * with the quickstart compose `KICI_PLATFORM_URL` value (`wss://api.kici.dev/ws`)
+ * — the single hosted KiCI Platform relay endpoint. Pinned by
+ * orchestrator-wizard.test.ts so the two surfaces cannot drift.
+ */
+export declare const DEFAULT_PLATFORM_RELAY_URL = "wss://api.kici.dev/ws";
 /**
  * Run the interactive orchestrator setup wizard.
  *
  * Asks only essential questions per the user decision:
- * 1. Mode (platform/hybrid/independent)
+ * 1. Mode (platform/hybrid/observed/independent)
  * 2. Database URL
  * 3. Port
  * 4. Secrets encryption key
  * 5. Bootstrap admin token (for kici-admin authentication)
- * 6. Platform URL + token (if platform/hybrid mode)
+ * 6. Platform URL + token (if platform/hybrid/observed mode), plus the public
+ *    webhook base URL when observed
  * 7. Webhook secret (if hybrid/independent mode)
  */
 export declare function runOrchestratorWizard(): Promise<OrchestratorInstallConfig>;