@kici-dev/orchestrator 0.10.0 → 0.11.0

package/dist/cli.js

@@ -254,6 +254,32 @@ var AdminApiClient = class {
 		return this.request("DELETE", `/api/v1/admin/secrets/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}/${encodeURIComponent(key)}`);
 	}
 	/**
+	* Create an empty secret scope. A `<backend>:` qualifier selects the
+	* backend; an unqualified scope targets the PG backend. Creating a scope
+	* that already exists succeeds and changes nothing.
+	*/
+	async createScope(orgId, scope) {
+		return this.request("POST", "/api/v1/admin/secrets/scopes", {
+			orgId,
+			scope
+		});
+	}
+	/**
+	* Rename a secret scope inside its backend. The route refuses a move between
+	* backends and a rename onto a scope that already exists.
+	*/
+	async renameScope(orgId, oldScope, newScope) {
+		return this.request("PUT", "/api/v1/admin/secrets/scopes/rename", {
+			orgId,
+			oldScope,
+			newScope
+		});
+	}
+	/** Delete a secret scope and every secret in it. */
+	async deleteScope(orgId, scope) {
+		return this.request("DELETE", `/api/v1/admin/secrets/scopes/${encodeURIComponent(orgId)}/${encodeURIComponent(scope)}`);
+	}
+	/**
 	* Create (or upsert) a deployment context. `allowLocalExecution` lets
 	* CLI-initiated / local runs resolve secrets through this context.
 	*/
@@ -1284,7 +1310,7 @@ var AuditLogger = class {
 	* engine's `shouldRecordSecretResolve` helper) since they're written
 	* once per JOB-step secret resolution and dwarf every other action's
 	* volume. Denied resolves and every other action (`setSecret`,
-	* `deleteSecret`, `rotateKey`, `secret-outputs.reveal`) bypass the
+	* `deleteSecret`, the scope writes, `rotateKey`, `secret-outputs.reveal`) bypass the
 	* sampler — they are transactional with the mutation and must always
 	* land.
 	*
@@ -1494,6 +1520,48 @@ async function warnIfContextUnbound(args) {
 	if (found && type?.success && found.bindings.length === 0) (args.warn ?? console.error)(unboundContextWarning(args.orgId, args.name, type.data));
 }
 //#endregion
+//#region src/cli/commands/shared/confirm.ts
+/**
+* Yes/no confirmation prompt for the `kici-admin` verbs that change or destroy
+* state unless the operator passes `--yes`.
+*/
+/** Message of the error raised when stdin ends before the operator answers. */
+const NO_CONFIRMATION_ANSWER = "no answer to the confirmation prompt: stdin closed before a line arrived. Pass --yes to run without the prompt.";
+/**
+* Write `prompt` and read one line of answer.
+*
+* Resolves true when the line is `y` or `yes` (any case, surrounding spaces
+* ignored) and false for any other line. Rejects with
+* {@link NO_CONFIRMATION_ANSWER} when stdin ends before a line arrives, as it
+* does for a script, a cron job or a `< /dev/null` redirect. Resolving false
+* there would let a verb run without `--yes` exit 0 having done nothing, and
+* the script that ran it would read that as success.
+*/
+function confirmPrompt(prompt, io = {
+	input: process.stdin,
+	output: process.stderr
+}) {
+	const rl = createInterface({
+		input: io.input,
+		output: io.output
+	});
+	return new Promise((resolve, reject) => {
+		let answered = false;
+		const settle = (answer) => {
+			if (answered) return;
+			answered = true;
+			rl.close();
+			const normalized = answer.trim().toLowerCase();
+			resolve(normalized === "y" || normalized === "yes");
+		};
+		rl.once("close", () => {
+			if (!answered) reject(/* @__PURE__ */ new Error(NO_CONFIRMATION_ANSWER));
+		});
+		rl.once("line", settle);
+		rl.question(prompt, settle);
+	});
+}
+//#endregion
 //#region src/cli/commands/secret.ts
 function resolveDirectDbUrl$10(explicit) {
 	return explicit ?? process.env.KICI_DATABASE_URL ?? null;
@@ -1658,7 +1726,7 @@ function registerSecretCommands(program, getClient) {
 	sec.command("delete <orgId> <scope> <key>").description("Delete a secret").option("--yes", "Skip confirmation prompt").action(async (orgId, scope, key, opts) => {
 		try {
 			if (!opts.yes) {
-				if (!await confirm$4(`Are you sure you want to delete secret '${key}' from scope '${scope}'?`)) {
+				if (!await confirmPrompt(`Are you sure you want to delete secret '${key}' from scope '${scope}'? [y/N] `)) {
 					console.log("Aborted.");
 					return;
 				}
@@ -1670,6 +1738,7 @@ function registerSecretCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	registerSecretScopeCommands(sec, getClient);
 	sec.command("fix-prefixed-scopes <orgId>").description("Repair PG-backend secret scopes stored with a stale pg: qualifier (direct-DB). Each affected scope is renamed to its bare path, re-encrypting every secret under the corrected AAD. Exits 2 when any scope needs manual repair.").option("--dry-run", "Print the plan and exit without writing").option("--database-url <url>", "Orchestrator DB URL (or KICI_DATABASE_URL)").action(async (orgId, opts) => {
 		const dbUrl = resolveDirectDbUrl$10(opts.databaseUrl);
 		if (!dbUrl) {
@@ -1720,17 +1789,48 @@ function registerSecretCommands(program, getClient) {
 		if (skipped > 0) process.exit(2);
 	});
 }
-async function confirm$4(message) {
-	const { createInterface } = await import("node:readline");
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stderr
+/**
+* `secret scope create|rename|delete` — the operator path for the dashboard's
+* scope writes (`secrets.scope.*` in the dashboard-write policy). HTTP only,
+* like `secret scopes`: each verb calls the orchestrator admin API.
+*/
+function registerSecretScopeCommands(sec, getClient) {
+	const scope = sec.command("scope").description("Create, rename or delete a secret scope");
+	scope.command("create <orgId> <scope>").description("Create an empty secret scope. A <backend>: qualifier selects the backend; an unqualified scope targets the PG backend. An existing scope stays unchanged.").option("--json", "Emit JSON output").action(async (orgId, scopeName, opts) => {
+		try {
+			const result = await getClient().createScope(orgId, scopeName);
+			if (opts.json) console.log(JSON.stringify(result));
+			else console.log(`Secret scope '${scopeName}' created for org ${orgId}.`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
 	});
-	return new Promise((resolve) => {
-		rl.question(`${message} [y/N] `, (answer) => {
-			rl.close();
-			resolve(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
-		});
+	scope.command("rename <orgId> <oldScope> <newScope>").description("Rename a secret scope inside its backend. Refuses a move between backends and a rename onto a scope that already exists.").option("--json", "Emit JSON output").action(async (orgId, oldScope, newScope, opts) => {
+		try {
+			const result = await getClient().renameScope(orgId, oldScope, newScope);
+			if (opts.json) console.log(JSON.stringify(result));
+			else console.log(`Secret scope '${oldScope}' renamed to '${newScope}' for org ${orgId}.`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	scope.command("delete <orgId> <scope>").description("Delete a secret scope and every secret in it").option("--yes", "Skip confirmation prompt").option("--json", "Emit JSON output").action(async (orgId, scopeName, opts) => {
+		try {
+			if (!opts.yes) {
+				if (!await confirmPrompt(`Are you sure you want to delete scope '${scopeName}' and every secret in it? [y/N] `)) {
+					console.log("Aborted.");
+					return;
+				}
+			}
+			const result = await getClient().deleteScope(orgId, scopeName);
+			if (opts.json) console.log(JSON.stringify(result));
+			else console.log(`Secret scope '${scopeName}' deleted for org ${orgId}.`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
 	});
 }
 //#endregion
@@ -1808,7 +1908,7 @@ function formatAuditTable(entries) {
 	].join("\n");
 }
 function registerAuditCommands(program, getClient) {
-	program.command("audit").description("Query the secrets audit log").option("--context <name>", "Filter by context name").option("--routing-key <rk>", "Filter by routing key (required for cold-store scan)").option("--action <action>", "Filter by action type").option("--from <date>", "From date (ISO 8601)").option("--to <date>", "To date (ISO 8601)").option("--limit <n>", "Max entries to return", "100").option("--offset <n>", "Offset for pagination").option("--include-archived", "Include rows from cold storage (Phase D)", false).action(async (opts) => {
+	program.command("audit").description("Query the secrets audit log").option("--context <name>", "Filter by context name").option("--routing-key <rk>", "Filter by routing key (required for cold-store scan)").option("--action <action>", "Filter by action type").option("--from <date>", "From date (ISO 8601)").option("--to <date>", "To date (ISO 8601)").option("--limit <n>", "Max entries to return", "100").option("--offset <n>", "Offset for pagination").option("--include-archived", "Include rows from cold storage", false).action(async (opts) => {
 		try {
 			const entries = await getClient().queryAudit({
 				contextName: opts.context,
@@ -13768,7 +13868,7 @@ function resolveDatabaseUrl$7(explicit) {
 	if (!url) throw new Error("Database URL required. Pass --database-url or set KICI_DATABASE_URL.");
 	return url;
 }
-async function confirmInteractive$4(prompt, expected) {
+async function confirmInteractive$1(prompt, expected) {
 	if (!process.stdin.isTTY) return false;
 	process.stderr.write(prompt);
 	const rl = createInterface({
@@ -13896,7 +13996,7 @@ function registerDbCommands(program, getClient) {
 			const url = resolveDatabaseUrl$7(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			if (!opts.yes) {
-				if (!await confirmInteractive$4(`About to DROP + RECREATE database "${dbName}". Type "${dbName}" to confirm: `, dbName)) {
+				if (!await confirmInteractive$1(`About to DROP + RECREATE database "${dbName}". Type "${dbName}" to confirm: `, dbName)) {
 					console.error("Aborted.");
 					process.exit(1);
 				}
@@ -13948,7 +14048,7 @@ function registerDbCommands(program, getClient) {
 			const url = resolveDatabaseUrl$7(opts.databaseUrl);
 			const { dbName } = parseDatabaseUrl(url);
 			if (!opts.yes) {
-				if (!await confirmInteractive$4(`About to RESTORE (--clean) into database "${dbName}", overwriting its contents. Type "${dbName}" to confirm: `, dbName)) {
+				if (!await confirmInteractive$1(`About to RESTORE (--clean) into database "${dbName}", overwriting its contents. Type "${dbName}" to confirm: `, dbName)) {
 					console.error("Aborted.");
 					process.exit(1);
 				}
@@ -16007,19 +16107,9 @@ function registerSourceCommands(program, getClient) {
 	});
 	src.command("remove <routingKey>").description("Remove a source (GitHub, or generic/local with --generic / --local)").option("--yes", "Skip confirmation").option("--generic", "Remove a generic source (routingKey is treated as source ID)").option("--local", "Remove a local (file://) source (routingKey is treated as source ID)").option("--hard", "Permanently delete a generic/local source (requires --generic or --local)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").action(async (routingKey, opts) => {
 		try {
-			if (!opts.yes) {
-				const rl = createInterface({
-					input: process.stdin,
-					output: process.stdout
-				});
-				const answer = await new Promise((resolve) => {
-					rl.question(`Remove source "${routingKey}"? (y/N) `, resolve);
-				});
-				rl.close();
-				if (answer.toLowerCase() !== "y") {
-					console.log("Cancelled.");
-					return;
-				}
+			if (!opts.yes && !await confirmPrompt(`Remove source "${routingKey}"? (y/N) `)) {
+				console.log("Cancelled.");
+				return;
 			}
 			const dbUrl = resolveDirectDbUrl$9(opts.databaseUrl);
 			if (dbUrl) {
@@ -18292,16 +18382,6 @@ function readAttestations(db) {
 }
 //#endregion
 //#region src/cli/commands/attestations.ts
-/**
-* `kici-admin attestations` — orchestrator-DB-direct provenance maintenance.
-*
-*   attestations reverify [--all]   Recompute stored verdicts (verify-at-ingest
-*                                   backfill). Default scope: pending /
-*                                   unverifiable rows; `--all` re-evaluates
-*                                   every row. Direct DB + object storage.
-*
-* Classified `kici-admin` (orchestrator DB plane) per .claude/rules/platform-admin.md.
-*/
 init_client();
 const logger$15 = createLogger({ prefix: "kici-admin-attestations" });
 function resolveDatabaseUrl$5(explicit) {
@@ -18330,18 +18410,6 @@ function buildStorage(config) {
 		signingSecret: "kici-admin-reverify"
 	});
 }
-async function confirmInteractive$3(prompt) {
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stderr
-	});
-	try {
-		const answer = await new Promise((resolve) => rl.question(prompt, resolve));
-		return answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes";
-	} finally {
-		rl.close();
-	}
-}
 /** Render attestation rows as a compact human table (stderr note when empty). */
 function printAttestationTable(rows) {
 	if (rows.length === 0) {
@@ -18371,7 +18439,7 @@ function registerAttestationsCommands(program, getClient) {
 			const config = loadConfig();
 			const url = resolveDatabaseUrl$5(opts.databaseUrl ?? (config.databaseUrl || void 0));
 			if (opts.all && !opts.yes) {
-				if (!await confirmInteractive$3("Re-evaluate the verdict of EVERY attestation (including already-verified)? [y/N] ")) {
+				if (!await confirmPrompt("Re-evaluate the verdict of EVERY attestation (including already-verified)? [y/N] ")) {
 					console.error("Aborted.");
 					process.exit(1);
 				}
@@ -18725,7 +18793,7 @@ var DbSigner = class DbSigner {
 *                                         halves ONLY — never private material.
 *
 * The PRIVATE key is non-exportable by design: there is no export of private
-* material and no import. Loss recovery is a routine rotation (§ H of the design).
+* material and no import. Loss recovery is a routine rotation.
 */
 init_client();
 const logger$14 = createLogger({ prefix: "kici-admin-signing-key" });
@@ -18766,18 +18834,6 @@ function resolveSecretKey$1() {
 	if (!config.secretKey) throw new Error("KICI_SECRET_KEY is required to generate a db-custody signing key (it wraps the private JWK).");
 	return config.secretKey;
 }
-async function confirmInteractive$2(prompt) {
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stderr
-	});
-	try {
-		const a = (await new Promise((resolve) => rl.question(prompt, resolve))).trim().toLowerCase();
-		return a === "y" || a === "yes";
-	} finally {
-		rl.close();
-	}
-}
 async function withRepo$1(databaseUrl, fn) {
 	const pool = createPool(resolveDatabaseUrl$4(databaseUrl));
 	const db = createDb$1(pool);
@@ -18869,7 +18925,7 @@ function registerSigningKeyCommands(program, tryGetClient) {
 						process.stderr.write(`Generated active signing key ${outcome.kid}.\n`);
 					}
 				}, {
-					confirm: confirmInteractive$2,
+					confirm: confirmPrompt,
 					yes: opts.yes,
 					dryRun: opts.dryRun
 				});
@@ -18893,7 +18949,7 @@ function registerSigningKeyCommands(program, tryGetClient) {
 						process.stderr.write(`Rotated: new active signing key ${kid}.\n`);
 					}
 				}, {
-					confirm: confirmInteractive$2,
+					confirm: confirmPrompt,
 					yes: opts.yes,
 					dryRun: opts.dryRun
 				});
@@ -18915,7 +18971,7 @@ function registerSigningKeyCommands(program, tryGetClient) {
 	signingKey.command("revoke <kid>").description("Distrust a compromised key (REMOVED from the JWKS; everything it signed is distrusted)").requiredOption("--reason <reason>", "Why the key is being revoked (audit)").option("--database-url <url>", "Orchestrator DB URL (else KICI_DATABASE_URL)").option("--yes", "Skip the confirmation prompt").action(async (kid, opts) => {
 		try {
 			if (!opts.yes) {
-				if (!await confirmInteractive$2(`Revoke signing key ${kid}? Everything it ever signed becomes UNVERIFIABLE. [y/N] `)) {
+				if (!await confirmPrompt(`Revoke signing key ${kid}? Everything it ever signed becomes UNVERIFIABLE. [y/N] `)) {
 					console.error("Aborted.");
 					process.exit(1);
 				}
@@ -19287,24 +19343,6 @@ async function generateDashboardEncryptionKey(secretKey) {
 }
 //#endregion
 //#region src/cli/commands/dashboard-encryption-key.ts
-/**
-* `kici-admin dashboard-encryption-key` — the orchestrator's X25519
-* dashboard-encryption key: the trust root a browser seals a secret / variable
-* value to under the `encrypted` dashboard-write posture, so the hosted control
-* plane relays only opaque ciphertext.
-*
-*   dashboard-encryption-key show     Print the active kid, its public JWK, where
-*                                     the JWKS is published, and the Verified-tier
-*                                     URL (when that tier is opted into).
-*   dashboard-encryption-key list     List every key on record (kid / status / created_at).
-*   dashboard-encryption-key rotate   Mint a new active key; the prior active key
-*                                     is retired from the published JWKS, but its
-*                                     private half stays on record so envelopes
-*                                     already sealed to it still decrypt.
-*
-* The PRIVATE half is master-key wrapped (`KICI_SECRET_KEY`) in the orchestrator
-* DB and is never exportable — recovery from a lost key is a routine rotation.
-*/
 init_client();
 const logger$9 = createLogger({ prefix: "kici-admin-dashboard-encryption-key" });
 function resolveDatabaseUrl$3(explicit) {
@@ -19317,18 +19355,6 @@ function resolveSecretKey() {
 	if (!config.secretKey) throw new Error("KICI_SECRET_KEY is required for the dashboard encryption key (it wraps the private key).");
 	return config.secretKey;
 }
-async function confirmInteractive$1(prompt) {
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stderr
-	});
-	try {
-		const a = (await new Promise((resolve) => rl.question(prompt, resolve))).trim().toLowerCase();
-		return a === "y" || a === "yes";
-	} finally {
-		rl.close();
-	}
-}
 async function withRepo(databaseUrl, fn) {
 	const pool = createPool(resolveDatabaseUrl$3(databaseUrl));
 	const db = createDb$1(pool);
@@ -19435,7 +19461,7 @@ function registerDashboardEncryptionKeyCommands(program) {
 						process.stderr.write(`Rotated: new active dashboard-encryption key ${kid}.\n`);
 					}
 				}, {
-					confirm: confirmInteractive$1,
+					confirm: confirmPrompt,
 					yes: opts.yes,
 					dryRun: opts.dryRun
 				});
@@ -19705,7 +19731,7 @@ function registerBackendCommands(program, getClient) {
 				try {
 					scopeInfo = ` has ${(await getClient().getBackend(name)).scopeCount ?? 0} discovered scopes -- they will become unavailable.`;
 				} catch {}
-				if (!await confirm$3(`Backend "${name}"${scopeInfo} Continue? [y/N] `)) {
+				if (!await confirmPrompt(`Backend "${name}"${scopeInfo} Continue? [y/N] `)) {
 					console.log("Aborted.");
 					return;
 				}
@@ -19892,21 +19918,6 @@ function printBackendSummary(b) {
 	console.log(`  Sync interval: ${Math.round(Number(b.syncIntervalMs) / 6e4)}m`);
 	console.log(`  Enabled:       ${b.enabled}`);
 }
-/**
-* Simple confirmation prompt.
-*/
-async function confirm$3(message) {
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stderr
-	});
-	return new Promise((resolve) => {
-		rl.question(message, (answer) => {
-			rl.close();
-			resolve(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
-		});
-	});
-}
 //#endregion
 //#region src/cli/commands/diagnose.ts
 /** ANSI color codes for terminal output. */
@@ -20491,18 +20502,12 @@ async function resolveUpgradeTarget(args) {
 		platform
 	};
 }
-/** Prompt the user for confirmation (returns true if yes). */
-async function confirm$2(message) {
-	const rl = createInterface({
+/** Prompt the user for confirmation on stdout, beside the upgrade plan it follows. */
+function confirm$1(message) {
+	return confirmPrompt(`${message} [y/N] `, {
 		input: process.stdin,
 		output: process.stdout
 	});
-	return new Promise((resolve) => {
-		rl.question(`${message} [y/N] `, (answer) => {
-			rl.close();
-			resolve(answer.trim().toLowerCase() === "y" || answer.trim().toLowerCase() === "yes");
-		});
-	});
 }
 /** Download a file from a URL to a local path. */
 async function downloadArchive(url, destPath) {
@@ -20924,7 +20929,7 @@ async function performVersionedUpgrade(component, opts, hooks = {}) {
 			console.log(`  Install path: ${versionedDirPath}`);
 			console.log("  The service will be stopped during upgrade.");
 			console.log("");
-			if (!await confirm$2("Proceed with upgrade?")) {
+			if (!await confirm$1("Proceed with upgrade?")) {
 				console.log("Upgrade cancelled.");
 				return;
 			}
@@ -21037,7 +21042,7 @@ async function restartOnlyUpgrade(component, config, resolvedInstance, manager,
 		console.log(`This will restart "${config.name}" onto the npm-installed version ${verdict.version}.`);
 		console.log("  The service will be stopped briefly during the restart.");
 		console.log("");
-		if (!await confirm$2("Proceed with upgrade?")) {
+		if (!await confirm$1("Proceed with upgrade?")) {
 			console.log("Upgrade cancelled.");
 			return;
 		}
@@ -21063,7 +21068,7 @@ async function performSelfDrivingInstall(component, config, resolvedInstance, ma
 		console.log(`This will install ${target.owningPackage}@${version} using ${target.npmPath}`);
 		console.log(`  (node runtime: ${target.nodeExecPath}), then restart "${config.name}".`);
 		console.log("");
-		if (!await confirm$2("Proceed with upgrade?")) {
+		if (!await confirm$1("Proceed with upgrade?")) {
 			console.log("Upgrade cancelled.");
 			return;
 		}
@@ -21120,7 +21125,7 @@ async function handlePick(component, platform, installBase, config, manager, res
 		console.log(`  Install path: ${path.join(installBase, `${component}-${target}`)}`);
 		console.log("  The service will be stopped during the switch.");
 		console.log("");
-		if (!await confirm$2("Proceed with switch?")) {
+		if (!await confirm$1("Proceed with switch?")) {
 			console.log("Pick cancelled.");
 			return;
 		}
@@ -21168,7 +21173,7 @@ async function assertSchemaAllowsSwitch(args) {
 		console.log("");
 		console.log("  !!  The running service could not be reached, so the schema was not checked.");
 		console.log("");
-		return yes ? true : confirm$2("Proceed with the switch anyway?");
+		return yes ? true : confirm$1("Proceed with the switch anyway?");
 	}
 	const recordedHead = resolvedInstance.manifest.migrationHeads?.[targetVersion];
 	const verdict = schemaGuardVerdict({
@@ -21181,7 +21186,7 @@ async function assertSchemaAllowsSwitch(args) {
 		console.log("");
 		console.log(verdict.message);
 		console.log("");
-		return yes ? true : confirm$2("Proceed with the switch anyway?");
+		return yes ? true : confirm$1("Proceed with the switch anyway?");
 	}
 	if (!migrateDown) {
 		console.error("");
@@ -21276,7 +21281,7 @@ async function handleRollback(component, platform, installBase, config, manager,
 		console.log(`  Current version: ${currentVersion}`);
 		console.log(`  Rollback to: ${previousVersion}`);
 		console.log("");
-		if (!await confirm$2("Proceed with rollback?")) {
+		if (!await confirm$1("Proceed with rollback?")) {
 			console.log("Rollback cancelled.");
 			return;
 		}
@@ -22802,7 +22807,7 @@ init_manifest();
 const ALL_PLATFORMS = AgentPlatform.options;
 /** The orchestrator's own version (single-version invariant) = the packaged agent version. */
 function resolveKiciVersion() {
-	return "0.10.0";
+	return "0.11.0";
 }
 /** Parse the --platform value: default set | single | CSV | `all`. */
 function parsePlatforms(raw) {
@@ -26832,6 +26837,72 @@ function registerContextCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	registerSourceOverrideCommands(env, getClient);
+}
+function printSourceOverrides(rows) {
+	if (rows.length === 0) {
+		console.log("No source overrides found.");
+		return;
+	}
+	const header = [
+		"ROUTING KEY",
+		"KEY",
+		"VALUE"
+	];
+	const data = rows.map((r) => [
+		r.routing_key,
+		r.key,
+		r.value
+	]);
+	const widths = header.map((h, i) => Math.max(h.length, ...data.map((row) => row[i].length)));
+	const pad = (s, w) => s + " ".repeat(Math.max(0, w - s.length));
+	console.log(header.map((h, i) => pad(h, widths[i])).join("  "));
+	for (const row of data) console.log(row.map((c, i) => pad(c, widths[i])).join("  "));
+}
+/** Admin API path of one source override, every segment URI-encoded. */
+function sourceOverridePath(opts) {
+	const params = new URLSearchParams({ orgId: opts.org });
+	return `/api/v1/admin/contexts/${encodeURIComponent(opts.env)}/source-overrides/${encodeURIComponent(opts.routingKey)}/${encodeURIComponent(opts.key)}?${params}`;
+}
+/**
+* `context source-override list|set|delete` — the operator path for the
+* dashboard's per-source override writes (`contexts.source_overrides.*` in the
+* dashboard-write policy). HTTP only: each verb calls the orchestrator admin API.
+*/
+function registerSourceOverrideCommands(context, getClient) {
+	const so = context.command("source-override").description("Per-source variable overrides in a context (HTTP only)");
+	so.command("list").description("List the source overrides in a context, for every source unless --routing-key").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Context name").option("--routing-key <key>", "Only list the overrides for this source routing key").option("--json", "Emit JSON output").action(async (opts) => {
+		try {
+			const params = new URLSearchParams({ orgId: opts.org });
+			if (opts.routingKey) params.set("routingKey", opts.routingKey);
+			const result = await getClient().get(`/api/v1/admin/contexts/${encodeURIComponent(opts.env)}/source-overrides?${params}`);
+			if (opts.json) console.log(JSON.stringify(result));
+			else printSourceOverrides(result.overrides);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	so.command("set").description("Set the value one source sees for a context variable key. A locked context variable keeps its own value.").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Context name").requiredOption("--routing-key <key>", "Routing key of the source the override applies to").requiredOption("--key <key>", "Variable key").requiredOption("--value <value>", "Override value").option("--json", "Emit JSON output").action(async (opts) => {
+		try {
+			const result = await getClient().put(sourceOverridePath(opts), { value: opts.value });
+			if (opts.json) console.log(JSON.stringify(result));
+			else console.log(`context source-override set: key=${opts.key} routing-key=${opts.routingKey} (env=${opts.env})`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
+	so.command("delete").description("Delete one source override, so the source resolves the key from the context variables").requiredOption("--org <id>", "Org ID").requiredOption("--env <name>", "Context name").requiredOption("--routing-key <key>", "Routing key of the source the override applies to").requiredOption("--key <key>", "Variable key").option("--json", "Emit JSON output").action(async (opts) => {
+		try {
+			const result = await getClient().delete(sourceOverridePath(opts));
+			if (opts.json) console.log(JSON.stringify(result));
+			else console.log(`context source-override delete: key=${opts.key} routing-key=${opts.routingKey} (env=${opts.env})`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 }
 //#endregion
 //#region src/cli/commands/variable.ts
@@ -26886,7 +26957,7 @@ function registerVariableCommands(program, getClient) {
 	vr.command("delete <orgId> <context> <key>").description("Delete a context variable").option("--yes", "Skip confirmation prompt").action(async (orgId, context, key, opts) => {
 		try {
 			if (!opts.yes) {
-				if (!await confirm$1(`Are you sure you want to delete variable '${key}' from context '${context}'?`)) {
+				if (!await confirmPrompt(`Are you sure you want to delete variable '${key}' from context '${context}'? [y/N] `)) {
 					console.log("Aborted.");
 					return;
 				}
@@ -26899,19 +26970,6 @@ function registerVariableCommands(program, getClient) {
 		}
 	});
 }
-async function confirm$1(message) {
-	const { createInterface } = await import("node:readline");
-	const rl = createInterface({
-		input: process.stdin,
-		output: process.stderr
-	});
-	return new Promise((resolve) => {
-		rl.question(`${message} [y/N] `, (answer) => {
-			rl.close();
-			resolve(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
-		});
-	});
-}
 //#endregion
 //#region src/cli/commands/queue.ts
 function resolveDirectDbUrl$3(explicit) {
@@ -27214,7 +27272,7 @@ function printRegistrationShow(res) {
 	console.log(`updated_at:    ${r.updated_at}`);
 }
 function registerRegistrationCommands(program, getClient) {
-	const reg = program.command("registration").description("Registered workflow instance read (workflow_registrations table)");
+	const reg = program.command("registration").description("Registered workflow instances (workflow_registrations table)");
 	reg.command("list").description("List workflow_registrations rows (also returns registry_version)").option("--org <id>", "Filter by customer_id").option("--routing-key <k>", "Filter by routing_key").option("--repo <ident>", "Filter by repo_identifier").option("--trigger-type <type>", "Filter by trigger type (in trigger_types[])").option("--limit <n>", "Max rows (default 100, max 1000)").option("--database-url <url>", "Use direct DB access instead of HTTP (offline mode)").option("--json", "Emit JSON output").action(async (opts) => {
 		try {
 			const limit = parseIntOption(opts.limit, "--limit");
@@ -27257,6 +27315,42 @@ function registerRegistrationCommands(program, getClient) {
 			process.exit(1);
 		}
 	});
+	registerRegistrationWriteCommands(reg, getClient);
+}
+/**
+* `registration disable|enable|delete` — the operator path for the dashboard's
+* `registration.disable` / `registration.delete` writes. `enable` is the same
+* admin route as `disable`, with the flag cleared.
+*/
+function registerRegistrationWriteCommands(reg, getClient) {
+	const setDisabled = async (id, disabled, json) => {
+		try {
+			const result = await getClient().patch(`/api/v1/admin/registrations/${encodeURIComponent(id)}/disable`, { disabled });
+			if (json) console.log(JSON.stringify(result));
+			else console.log(`registration ${disabled ? "disable" : "enable"}: id=${id} disabled=${result.disabled} registry_version=${result.registryVersion}`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	};
+	reg.command("disable <id>").description("Disable a workflow registration: it stays registered, but its triggers stop dispatching").option("--json", "Emit JSON output").action(async (id, opts) => setDisabled(id, true, opts.json));
+	reg.command("enable <id>").description("Re-enable a disabled workflow registration").option("--json", "Emit JSON output").action(async (id, opts) => setDisabled(id, false, opts.json));
+	reg.command("delete <id>").description("Delete a workflow registration by id").option("--yes", "Skip confirmation prompt").option("--json", "Emit JSON output").action(async (id, opts) => {
+		try {
+			if (!opts.yes) {
+				if (!await confirmPrompt(`Are you sure you want to delete registration '${id}'? [y/N] `)) {
+					console.log("Aborted.");
+					return;
+				}
+			}
+			const result = await getClient().delete(`/api/v1/admin/registrations/${encodeURIComponent(id)}`);
+			if (opts.json) console.log(JSON.stringify(result));
+			else console.log(`registration delete: id=${id} deleted=${result.deleted} registry_version=${result.registryVersion}`);
+		} catch (err) {
+			console.error(`Error: ${toErrorMessage(err)}`);
+			process.exit(1);
+		}
+	});
 }
 //#endregion
 //#region src/cli/commands/event.ts
@@ -28770,7 +28864,7 @@ var init_orchestrator_cold_store = __esmMin((() => {
 //#endregion
 //#region src/cli/commands/cold-store-impl.ts
 /**
-* Phase C implementations for `kici-admin cold-store` subcommands.
+* Implementations for `kici-admin cold-store` subcommands.
 *
 * Mirrors the Platform-side implementation in
 * `packages/platform/src/admin/cold-store-commands.ts` — same shape,
@@ -28785,9 +28879,8 @@ var init_orchestrator_cold_store = __esmMin((() => {
 *   - prints results to stdout (JSON Lines for list-chunks, JSONL for
 *     peek-chunk, free-form for the others)
 *
-* Audit emission lives one level up in the command registration so we
-* can write one `access_log` breadcrumb row per CLI invocation in the
-* same shape the Platform admin CLI uses for `audit_log`.
+* No per-invocation breadcrumb row is written: the Platform admin CLI's
+* `audit_log` breadcrumb has no `access_log` counterpart here.
 */
 var cold_store_impl_exports = /* @__PURE__ */ __exportAll({
 	archiveNow: () => archiveNow,
@@ -29050,7 +29143,7 @@ async function replayChunk(opts) {
 	}
 }
 /**
-* Phase F — promote a chunk's rows BACK into the orchestrator PG.
+* Promote a chunk's rows back into the orchestrator PG.
 * Mirrors the Platform-side `replayIntoPg`. Adapter must implement
 * `replayInsert` — currently only `execution_runs`.
 */
@@ -29182,7 +29275,7 @@ async function reconcile(opts) {
 	}
 }
 /**
-* Phase 2 — list chunks past their cold-retention horizon. Read-only;
+* List chunks past their cold-retention horizon. Read-only;
 * no S3 or PG mutation. Emits one JSON line per row so the output is
 * easy to pipe through `jq` / `column -t` / etc.
 */
@@ -29206,7 +29299,7 @@ async function listPurgeable(opts) {
 	}
 }
 /**
-* Phase 2 — delete S3 objects + clean up PG bookkeeping for chunks
+* Delete S3 objects + clean up PG bookkeeping for chunks
 * past their cold-retention horizon. Defaults to dry-run; pass
 * `--apply` to actually delete.
 */
@@ -29358,7 +29451,7 @@ function registerColdStoreCommands(program, _getClient) {
 			process.exit(2);
 		}
 	});
-	coldStore.command("replay-into-pg <chunkId>").description("Phase F: promote every row in a chunk BACK into orchestrator PG (clear archived_at, write replay audit)").option("--database-url <url>", "Orchestrator Postgres URL (else KICI_DATABASE_URL)").requiredOption("--table <table>", "Adapter table name (currently: execution_runs)").requiredOption("--tenant <rk>", "Routing key for the chunk").requiredOption("--partition-date <YYYY-MM-DD>", "Partition date for the chunk").action(async (chunkId, opts) => {
+	coldStore.command("replay-into-pg <chunkId>").description("Promote every row in a chunk back into orchestrator PG (clear archived_at, write a replay audit row)").option("--database-url <url>", "Orchestrator Postgres URL (else KICI_DATABASE_URL)").requiredOption("--table <table>", "Adapter table name (currently: execution_runs)").requiredOption("--tenant <rk>", "Routing key for the chunk").requiredOption("--partition-date <YYYY-MM-DD>", "Partition date for the chunk").action(async (chunkId, opts) => {
 		try {
 			const databaseUrl = resolveDatabaseUrl(opts);
 			const { replayIntoPg } = await Promise.resolve().then(() => (init_cold_store_impl(), cold_store_impl_exports));
@@ -29389,7 +29482,7 @@ function registerColdStoreCommands(program, _getClient) {
 			process.exit(2);
 		}
 	});
-	coldStore.command("list-purgeable").description("Phase 2: list chunks past their cold-retention horizon (read-only)").option("--database-url <url>", "Orchestrator Postgres URL (else KICI_DATABASE_URL)").option("--table <table>", "Filter to a single adapter table (else all)").option("--bucket <bucket>", "Filter to a single cold-bucket (30d / 180d / 1y / 2y)").option("--limit <n>", "Max candidates to inspect", "1000").action(async (opts) => {
+	coldStore.command("list-purgeable").description("List chunks past their cold-retention horizon (read-only)").option("--database-url <url>", "Orchestrator Postgres URL (else KICI_DATABASE_URL)").option("--table <table>", "Filter to a single adapter table (else all)").option("--bucket <bucket>", "Filter to a single cold-bucket (30d / 180d / 1y / 2y)").option("--limit <n>", "Max candidates to inspect", "1000").action(async (opts) => {
 		try {
 			const databaseUrl = resolveDatabaseUrl(opts);
 			const { listPurgeable } = await Promise.resolve().then(() => (init_cold_store_impl(), cold_store_impl_exports));
@@ -29404,7 +29497,7 @@ function registerColdStoreCommands(program, _getClient) {
 			process.exit(2);
 		}
 	});
-	coldStore.command("purge-now").description("Phase 2: purge expired chunks from S3 + PG bookkeeping. DRY-RUN by default — pass --apply to actually delete.").option("--database-url <url>", "Orchestrator Postgres URL (else KICI_DATABASE_URL)").option("--table <table>", "Filter to a single adapter table (else all)").option("--bucket <bucket>", "Filter to a single cold-bucket (30d / 180d / 1y / 2y)").option("--limit <n>", "Max candidates to process", "1000").option("--apply", "Actually delete (default is dry-run)").action(async (opts) => {
+	coldStore.command("purge-now").description("Purge expired chunks from S3 + PG bookkeeping. DRY-RUN by default — pass --apply to actually delete.").option("--database-url <url>", "Orchestrator Postgres URL (else KICI_DATABASE_URL)").option("--table <table>", "Filter to a single adapter table (else all)").option("--bucket <bucket>", "Filter to a single cold-bucket (30d / 180d / 1y / 2y)").option("--limit <n>", "Max candidates to process", "1000").option("--apply", "Actually delete (default is dry-run)").action(async (opts) => {
 		try {
 			const databaseUrl = resolveDatabaseUrl(opts);
 			const { purgeNow } = await Promise.resolve().then(() => (init_cold_store_impl(), cold_store_impl_exports));
@@ -33902,7 +33995,7 @@ Token vocabulary:
 * where no bundler substituted the constant — the same shape `server.ts` and
 * `standalone.ts` use for `ORCHESTRATOR_VERSION`.
 */
-const CLI_VERSION = "0.10.0";
+const CLI_VERSION = "0.11.0";
 /**
 * Build the kici-admin Commander program with every command group registered.
 * Exported so the surface registry can walk the real command tree without