@kici-dev/orchestrator 0.10.0 → 0.11.0

package/dist/cli/api-client.d.ts

@@ -158,6 +158,25 @@ export declare class AdminApiClient {
     }>;
     setSecret(orgId: string, scope: string, key: string, value: string): Promise<void>;
     deleteSecret(orgId: string, scope: string, key: string): Promise<void>;
+    /**
+     * Create an empty secret scope. A `<backend>:` qualifier selects the
+     * backend; an unqualified scope targets the PG backend. Creating a scope
+     * that already exists succeeds and changes nothing.
+     */
+    createScope(orgId: string, scope: string): Promise<{
+        created: boolean;
+    }>;
+    /**
+     * Rename a secret scope inside its backend. The route refuses a move between
+     * backends and a rename onto a scope that already exists.
+     */
+    renameScope(orgId: string, oldScope: string, newScope: string): Promise<{
+        renamed: boolean;
+    }>;
+    /** Delete a secret scope and every secret in it. */
+    deleteScope(orgId: string, scope: string): Promise<{
+        deleted: boolean;
+    }>;
     /**
      * Create (or upsert) a deployment context. `allowLocalExecution` lets
      * CLI-initiated / local runs resolve secrets through this context.
@@ -273,7 +292,7 @@ export declare class AdminApiClient {
         to?: string;
         limit?: number;
         offset?: number;
-        /** Phase D opt-in for cold-store read-through. */
+        /** Opt-in cold-store read-through. */
         includeArchived?: boolean;
     }): Promise<any[]>;
     createToken(data: {

package/dist/cli/commands/attestations.d.ts

@@ -1,3 +1,13 @@
+/**
+ * `kici-admin attestations` — orchestrator-DB-direct provenance maintenance.
+ *
+ *   attestations reverify [--all]   Recompute stored verdicts (verify-at-ingest
+ *                                   backfill). Default scope: pending /
+ *                                   unverifiable rows; `--all` re-evaluates
+ *                                   every row. Direct DB + object storage.
+ *
+ * Classified `kici-admin` (orchestrator DB plane) per .claude/rules/platform-admin.md.
+ */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
 export declare function registerAttestationsCommands(program: Command, getClient: () => AdminApiClient): void;

package/dist/cli/commands/cold-store-impl.d.ts

@@ -45,7 +45,7 @@ export declare function replayChunk(opts: {
     instanceId?: string;
 }): Promise<void>;
 /**
- * Phase F — promote a chunk's rows BACK into the orchestrator PG.
+ * Promote a chunk's rows back into the orchestrator PG.
  * Mirrors the Platform-side `replayIntoPg`. Adapter must implement
  * `replayInsert` — currently only `execution_runs`.
  */
@@ -65,7 +65,7 @@ export declare function reconcile(opts: {
     instanceId?: string;
 }): Promise<void>;
 /**
- * Phase 2 — list chunks past their cold-retention horizon. Read-only;
+ * List chunks past their cold-retention horizon. Read-only;
  * no S3 or PG mutation. Emits one JSON line per row so the output is
  * easy to pipe through `jq` / `column -t` / etc.
  */
@@ -77,7 +77,7 @@ export declare function listPurgeable(opts: {
     instanceId?: string;
 }): Promise<void>;
 /**
- * Phase 2 — delete S3 objects + clean up PG bookkeeping for chunks
+ * Delete S3 objects + clean up PG bookkeeping for chunks
  * past their cold-retention horizon. Defaults to dry-run; pass
  * `--apply` to actually delete.
  */

package/dist/cli/commands/cold-store.d.ts

@@ -1,9 +1,9 @@
 /**
  * Cold-store commands for kici-admin (orchestrator side).
  *
- * Phase C: every subcommand has a real implementation that builds an
- * `OrchestratorColdStore` against the orchestrator Postgres + S3 and
- * delegates to the helpers in `cold-store-impl.ts`. Mirrors
+ * Every subcommand builds an `OrchestratorColdStore` against the
+ * orchestrator Postgres + S3 and delegates to the helpers in
+ * `cold-store-impl.ts`. Mirrors
  * `kici-platform-admin cold-store …` on the Platform side.
  *
  *   cold-store archive-now <table>       Run one cycle for a single adapter
@@ -11,7 +11,10 @@
  *   cold-store list-chunks <table>       List chunks for a table
  *   cold-store verify-chunk <chunkId>    Recompute contentHash for a chunk
  *   cold-store replay-chunk <chunkId>    Re-run UPDATE+DELETE for a stuck chunk
+ *   cold-store replay-into-pg <chunkId>  Promote a chunk's rows back into PG
  *   cold-store reconcile <table>         Rebuild orphaned manifests from data
+ *   cold-store list-purgeable            List chunks past cold retention
+ *   cold-store purge-now                 Purge expired chunks (dry-run default)
  *   cold-store peek-chunk <chunkId>      Stream the first N rows of a chunk
  *
  * The CLI talks **directly** to the orchestrator Postgres (and the same

package/dist/cli/commands/context.d.ts

@@ -8,8 +8,10 @@
  *   context show           — show a single context with variables + bindings
  *   context delete         — delete a context (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)
  *   context create-template — create/update a context template + its seed variables
+ *   context source-override list|set|delete — per-source variable overrides (HTTP only)
  *
- * Each command supports two modes (stage-4 pattern from `maintenance.ts`):
+ * Each command except `source-override` supports two modes, the same split
+ * `maintenance.ts` uses:
  *
  *   HTTP mode (default): requires `--url` + `--token`, routes through the
  *   orchestrator admin HTTP API at /api/v1/admin/contexts.

package/dist/cli/commands/dashboard-encryption-key.d.ts

@@ -1,3 +1,21 @@
+/**
+ * `kici-admin dashboard-encryption-key` — the orchestrator's X25519
+ * dashboard-encryption key: the trust root a browser seals a secret / variable
+ * value to under the `encrypted` dashboard-write posture, so the hosted control
+ * plane relays only opaque ciphertext.
+ *
+ *   dashboard-encryption-key show     Print the active kid, its public JWK, where
+ *                                     the JWKS is published, and the Verified-tier
+ *                                     URL (when that tier is opted into).
+ *   dashboard-encryption-key list     List every key on record (kid / status / created_at).
+ *   dashboard-encryption-key rotate   Mint a new active key; the prior active key
+ *                                     is retired from the published JWKS, but its
+ *                                     private half stays on record so envelopes
+ *                                     already sealed to it still decrypt.
+ *
+ * The PRIVATE half is master-key wrapped (`KICI_SECRET_KEY`) in the orchestrator
+ * DB and is never exportable — recovery from a lost key is a routine rotation.
+ */
 import type { Command } from 'commander';
 export declare function registerDashboardEncryptionKeyCommands(program: Command): void;
 //# sourceMappingURL=dashboard-encryption-key.d.ts.map

package/dist/cli/commands/event-dlq.d.ts

@@ -6,8 +6,8 @@
  *   event-dlq retry <id>     — clear DLQ flag, schedule for retry, pg_notify
  *   event-dlq discard <id>   — permanently delete a DLQ event
  *
- * Operator dogfooding path for at-least-once event delivery (Phase 5 of the
- * event durability work). Customers should generally never see anything in
+ * Operator dogfooding path for at-least-once event delivery. Customers
+ * should generally never see anything in
  * the DLQ — when something lands here it usually means a workflow handler is
  * consistently failing and should be fixed at its root cause. This CLI is the
  * triage surface: inspect last_error, retry once a fix is deployed, or discard

package/dist/cli/commands/registration.d.ts

@@ -1,16 +1,20 @@
 /**
- * Workflow registration read CLI commands for kici-admin (5a #4).
+ * Workflow registration CLI commands for kici-admin.
  *
  *   registration list [--org <id>] [--routing-key <k>] [--repo <ident>] [--limit <n>]
  *   registration show <id>
+ *   registration disable <id> | enable <id>
+ *   registration delete <id> [--yes]
  *
  * A distinct namespace from `workflow list` — `workflow` is workflow-code,
  * `registration` is the registered-workflow-instance row in
- * workflow_registrations. Both coexist; the existing `workflow list` is
- * untouched by this plan.
+ * workflow_registrations. Both coexist.
  *
- * Dual-mode: HTTP (via AdminApiClient on the existing
+ * `list` and `show` are dual-mode: HTTP (via AdminApiClient on the
  * /api/v1/admin/registrations admin API) or `--database-url` (direct DB).
+ * `disable`, `enable` and `delete` are HTTP only: they are the operator path
+ * for the dashboard's registration writes, and the admin route bumps the
+ * registry version so every peer reloads.
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';

package/dist/cli/commands/secret.d.ts

@@ -3,6 +3,7 @@
  *
  * Provides scoped secret operations:
  *   secret scopes, list, set, delete, fix-prefixed-scopes
+ *   secret scope create|rename|delete
  *
  * Secret values are write-only -- there is no "get value" command.
  */

package/dist/cli/commands/shared/confirm.d.ts

@@ -0,0 +1,19 @@
+/** Message of the error raised when stdin ends before the operator answers. */
+export declare const NO_CONFIRMATION_ANSWER: string;
+/** The streams the prompt writes to and reads from. */
+export interface ConfirmIo {
+    input: NodeJS.ReadableStream;
+    output: NodeJS.WritableStream;
+}
+/**
+ * Write `prompt` and read one line of answer.
+ *
+ * Resolves true when the line is `y` or `yes` (any case, surrounding spaces
+ * ignored) and false for any other line. Rejects with
+ * {@link NO_CONFIRMATION_ANSWER} when stdin ends before a line arrives, as it
+ * does for a script, a cron job or a `< /dev/null` redirect. Resolving false
+ * there would let a verb run without `--yes` exit 0 having done nothing, and
+ * the script that ran it would read that as success.
+ */
+export declare function confirmPrompt(prompt: string, io?: ConfirmIo): Promise<boolean>;
+//# sourceMappingURL=confirm.d.ts.map