@kici-dev/orchestrator 0.14.2 → 0.16.0

package/dist/__test-helpers__/peer-mutual-auth.d.ts

@@ -0,0 +1,42 @@
+export declare function refTranscriptHash(serverPub: Buffer, serverNonce: Buffer, authSchemes: readonly string[], clientPub: Buffer): Buffer;
+export declare function refClientProof(o: {
+    psk: Buffer;
+    th: Buffer;
+    mode: string;
+    instanceId: string;
+    role: string;
+    protocolVersion: number;
+    tokenRouting: string;
+}): Buffer;
+export declare function refServerProof(o: {
+    psk: Buffer;
+    th: Buffer;
+    clientProof: Buffer;
+    serverInstanceId: string;
+    grantedRole: string;
+    sessionCredential: string | null;
+}): Buffer;
+export declare function refAppKey(o: {
+    handshakeKey: Buffer;
+    psk: Buffer;
+    th: Buffer;
+    clientProof: Buffer;
+    serverProof: Buffer;
+}): Buffer;
+/** A join token in the production format, with its routing segment and stored hash. */
+export declare function makeTestJoinToken(routing: {
+    orgId: string;
+    routingKey: string;
+    expiry: number;
+    role: 'coordinator' | 'worker';
+}): {
+    token: string;
+    routingB64: string;
+    secretHex: string;
+    tokenHash: string;
+};
+/** The PSK a credential-mode peer proves with: the bytes of sha256(credential). */
+export declare function credentialPsk(credential: string): Buffer;
+/** The PSK a token-mode peer proves with: the bytes of the stored token hash. */
+export declare function tokenPsk(tokenHash: string): Buffer;
+//# sourceMappingURL=peer-mutual-auth.d.ts.map

package/dist/__test-helpers__/scratch-db.d.ts

@@ -0,0 +1,16 @@
+/** Throwaway PostgreSQL databases for DB-gated tests, dropped by `cleanup`. */
+import pg from 'pg';
+import { Kysely } from 'kysely';
+export interface ScratchDb {
+    url: string;
+    pool: pg.Pool;
+    db: Kysely<any>;
+}
+/** Creates databases on `adminUrl`; `cleanup` drops every one of them. */
+export declare function scratchDbFactory(adminUrl: string): {
+    freshDb: (tag: string) => Promise<ScratchDb>;
+    cleanup: () => Promise<void>;
+};
+/** The applied migration names, sorted. */
+export declare function ledgerNames(db: Kysely<any>): Promise<string[]>;
+//# sourceMappingURL=scratch-db.d.ts.map

package/dist/agent/host-roster.d.ts

@@ -1,6 +1,6 @@
 import { type Kysely } from 'kysely';
-import { type CanonicalLabel, type HostInventoryEntry, type InventorySelector, type LabelMatcher } from '@kici-dev/engine';
-import type { Database, HostRosterRow } from '../db/types.js';
+import { type CanonicalLabel, type FleetHostEntry, FleetHostWriteRefusal, type HostInventoryEntry, type InventorySelector, type LabelMatcher } from '@kici-dev/engine';
+import { type Database, type HostRosterRow } from '../db/types.js';
 /** Typed host-vars bag carried by roster rows (`string | number | boolean`). */
 export type HostProperties = Record<string, string | number | boolean>;
 /**
@@ -10,15 +10,60 @@ export type HostProperties = Record<string, string | number | boolean>;
  */
 export declare const STAGED_AGENT_VERSION_KEY = "kici:staged-agent-version";
 /**
- * Drop every orchestrator-reserved `kici:`-namespaced key from an
- * agent-reported host-property bag. Agent-reported properties win the roster
- * shallow-merge, so without this an agent could FORGE reserved keys the
- * orchestrator trusts — the staged-version convergence gate and the
- * root-executed restart commands both read `kici:` keys. Only orchestrator
- * writes (`recordStagedVersion`) and operator declares (`declareStatic`) set
- * this namespace; a registering agent never may.
+ * True when a host label or property key is in the orchestrator-reserved
+ * `kici:` namespace. Trimmed and case-insensitive, matching how labels fold on
+ * read (`canonicalizeLabel`).
+ */
+export declare function isReservedHostKey(key: string): boolean;
+/**
+ * Drop every reserved `kici:` key from an agent-reported host-property bag.
+ * Agent-reported properties win the roster shallow-merge, and the staged-version
+ * convergence gate and the restart commands the re-stage runs over SSH both
+ * read `kici:` keys, so a registering agent must never set them. Reserved keys
+ * come only from orchestrator code (`recordStagedVersion`) and a local
+ * `kici-admin host declare`.
  */
 export declare function stripReservedProperties(props: HostProperties): HostProperties;
+/** Who is writing a static host declaration or removal. */
+export declare enum HostWriteAuthority {
+    /** A local `kici-admin` declare or remove. */
+    operator = "operator",
+    /** A Platform-relayed dashboard write. The default. */
+    platform = "platform"
+}
+/** A host write refused because of the writer's authority. */
+export declare class HostWriteRefusedError extends Error {
+    readonly code: FleetHostWriteRefusal;
+    readonly detail: string;
+    constructor(code: FleetHostWriteRefusal, detail: string, message: string);
+}
+/** A Platform write named a reserved `kici:` label or property key. */
+export declare class ReservedHostKeyError extends HostWriteRefusedError {
+    readonly keys: string[];
+    constructor(keys: string[]);
+}
+/** A Platform declare named a host that already exists. */
+export declare class HostExistsError extends HostWriteRefusedError {
+    constructor(agentId: string);
+}
+/** A Platform remove named a host an agent or operator confirmed. */
+export declare class HostConfirmedError extends HostWriteRefusedError {
+    constructor(agentId: string);
+}
+/** Input of {@link HostRosterStore.declareStatic}. */
+export interface DeclareStaticInput {
+    agentId: string;
+    labels?: string[];
+    hostname?: string;
+    properties?: HostProperties;
+    address?: string;
+    sshUser?: string;
+    sshPort?: number;
+    sshKeySecret?: string;
+    s3Reachable?: boolean;
+    /** Who is writing. Omitted ⇒ `platform`, the most restricted. */
+    authority?: HostWriteAuthority;
+}
 /**
  * Pre-agent reach metadata for a declared host — how to SSH to it for bootstrap
  * bring-up before it has a KiCI agent. All fields nullable: a host with no reach
@@ -144,31 +189,33 @@ export declare class HostRosterStore {
     /** Coarse heartbeat stamp — same owner-guard as markDisconnected. */
     stampLastSeen(agentId: string, instanceId: string): Promise<void>;
     /**
-     * Operator pre-declare of a static host. A re-declare of an existing agent_id
-     * converges the operator-owned columns (labels, hostname, reach,
-     * host_properties) to the newly-declared values while preserving the
-     * agent-reported liveness/identity columns (connected_instance_id, last_seen,
-     * platform, arch, lifecycle_class, token_id, reboot_pending_until). The
-     * optional reach fields (`address`/`sshUser`/`sshPort`/`sshKeySecret`) carry
-     * how to SSH to the host for bootstrap bring-up. Each operator field is
-     * preserve-on-omit: an omitted field keeps the existing column value.
-     *
-     * Returns `{ created: true }` when the declare inserted a new row,
-     * `{ created: false }` when it converged an existing one.
+     * Declare a static host. Under `operator` authority (a local `kici-admin`),
+     * it inserts or converges the row; under `platform` authority (a dashboard
+     * write, the default) it only creates a new, unconfirmed row. Returns
+     * `{ created: true }` when the declare inserted the row.
      */
-    declareStatic(input: {
-        agentId: string;
-        labels?: string[];
-        hostname?: string;
-        properties?: HostProperties;
-        address?: string;
-        sshUser?: string;
-        sshPort?: number;
-        sshKeySecret?: string;
-        s3Reachable?: boolean;
-    }): Promise<{
+    declareStatic(input: DeclareStaticInput): Promise<{
         created: boolean;
     }>;
+    /**
+     * A Platform declare: create a new `platform` row, never touch an existing
+     * one. Reserved `kici:` labels or properties refuse the whole write before
+     * any SQL, and the insert-or-nothing statement leaves no check-then-write race.
+     */
+    private createPlaceholder;
+    /**
+     * An operator declare. A re-declare converges the operator-owned columns
+     * (labels, hostname, reach, host_properties) and preserves the agent-reported
+     * liveness and identity columns (connected_instance_id, last_seen, platform,
+     * arch, lifecycle_class, token_id, reboot_pending_until). Each operator field
+     * is preserve-on-omit, and properties shallow-merge — except on a row a
+     * dashboard declare created: there the operator's values replace labels,
+     * hostname and properties outright, so no Platform-chosen value survives the
+     * confirmation, and the row becomes `operator`. An `agent` row stays `agent`.
+     * PostgreSQL evaluates every SET expression against the existing row, so each
+     * CASE reads the source before this statement changes it.
+     */
+    private declareAsOperator;
     /**
      * Read a host's pre-agent reach metadata. Returns null when the host is not
      * in the roster; a host declared without reach fields reads back with nulls.
@@ -181,12 +228,14 @@ export declare class HostRosterStore {
      * reserved key so the convergence gate can compare it against the target
      * INDEPENDENTLY of the agent's own self-reported bundle version (two payloads
      * can carry the same self-report but different staged keys). Shallow-merged, so
-     * it survives agent re-register (the agent never reports this reserved key).
+     * it survives an agent re-register (the agent's reserved keys are stripped).
      */
     recordStagedVersion(agentId: string, version: string): Promise<void>;
     /** Read a host's recorded staged agent-payload version, or null when never staged. */
     getStagedVersion(agentId: string): Promise<string | null>;
     listAll(): Promise<HostRosterRow[]>;
+    /** Every confirmed roster row (agent- or operator-set identity), by agent id. */
+    private listConfirmed;
     /**
      * Resolve EVERY roster host matching a label predicate (OR-of-AND include
      * groups, minus exclude labels), tagged with its derived status. Returns
@@ -232,22 +281,36 @@ export declare class HostRosterStore {
      * Query the roster as canonical {@link HostInventoryEntry} records. With a
      * selector, reuses `findMatching`'s label filtering (server-side, glob/regex);
      * property filtering is done client-side in the workflow. Omit the selector ⇒
-     * every host.
+     * every host. Unconfirmed rows a dashboard declare created are omitted.
      */
     queryInventory(selector: InventorySelector | undefined, graceMs: number): Promise<HostInventoryEntry[]>;
-    /** Single-host inventory lookup; null when the agent is not in the roster. */
+    /** Single-host inventory lookup; null when the agent is absent or unconfirmed. */
     getInventory(agentId: string, graceMs: number): Promise<HostInventoryEntry | null>;
+    /** A roster row as the dashboard sees it: the inventory entry plus `confirmed`. */
+    toFleetEntry(row: HostRosterRow, graceMs: number): FleetHostEntry;
+    /** Every roster host for the dashboard, unconfirmed placeholders included. */
+    listFleetHosts(graceMs: number): Promise<FleetHostEntry[]>;
+    /** One roster host for the dashboard, or null when the agent id has no row. */
+    getFleetHost(agentId: string, graceMs: number): Promise<FleetHostEntry | null>;
     /**
      * Count `static` (declared) hosts whose derived status is `unreachable` —
      * the "declared-but-absent" alarm population. Reuses the single-source
      * {@link deriveHostStatus} so the count never diverges from what
      * `kici-admin host list` shows. A not-currently-connected static host reads
      * `unreachable` regardless of grace (only the connected-but-stale case
-     * depends on `graceMs`).
+     * depends on `graceMs`). An unconfirmed dashboard-created row never raises
+     * the alarm.
      */
     countStaticUnreachable(graceMs: number): Promise<number>;
-    /** Remove a host from the roster by agent id. Returns rows deleted. */
-    removeStatic(agentId: string): Promise<number>;
+    /**
+     * Remove a host from the roster by agent id. Returns rows deleted (0 when no
+     * row matches). Under `platform` authority (the default) only an unconfirmed
+     * row a dashboard declare created is removed; a confirmed row throws
+     * {@link HostConfirmedError}.
+     */
+    removeStatic(agentId: string, opts?: {
+        authority?: HostWriteAuthority;
+    }): Promise<number>;
     /** Delete ephemeral rows whose last_seen is older than ttl. Returns count. */
     reapEphemeralPastTtl(ttlMs: number): Promise<number>;
     /**

package/dist/agent/registry.d.ts

@@ -9,7 +9,7 @@
  * No persistence needed -- agents re-register on reconnect.
  */
 import { type CanonicalLabel, type LabelMatcher } from '@kici-dev/engine';
-import type { AgentCapabilities, WsLike } from '@kici-dev/engine';
+import type { WsLike } from '@kici-dev/engine';
 /**
  * The longest a busy rejection holds an agent out of routing when no evidence
  * of a free slot lifts the hold first: an `agent.status` capacity report, or a
@@ -108,11 +108,6 @@ export interface AgentEntry {
     registeredAt: number;
     /** Self-reported agent version (e.g. "0.0.1"). Null if not reported. */
     version: string | null;
-    /**
-     * Optional behaviours the agent advertised on `agent.register`. Null for an
-     * agent that advertised none, which is read as supporting none.
-     */
-    capabilities: AgentCapabilities | null;
     /**
      * The `agent_tokens.id` row used to authenticate this connection, or
      * `null` when auth mode is `none`. Indexed by `tokenIdIndex` so a
@@ -180,8 +175,6 @@ interface AgentMetadata {
      * any operator-declared properties). Undefined ⇒ the agent reported none.
      */
     properties?: Record<string, string | number | boolean>;
-    /** Optional behaviours the agent advertised on `agent.register`. */
-    capabilities?: AgentCapabilities;
 }
 /**
  * Subset of `HostRosterStore` the registry reconciles into. Optional — when no

package/dist/app-on-error.d.ts

@@ -3,7 +3,7 @@
  *
  * Without one, Hono answers an unhandled throw with a bare, unstructured 500:
  * no JSON body, no route context, and nothing written to our own logs. Every
- * admin router already catches inside its handlers (routes/admin-errors.ts),
+ * admin sub-app answers its own errors through its own onError (routes/admin-env.ts),
  * and the auth path catches inside its middleware (routes/admin-auth.ts) -- this
  * covers whatever neither does.
  *

package/dist/app.d.ts

@@ -278,6 +278,8 @@ export interface AppDependencies {
      * pre-flight (before any App exists). Passed into the admin source routes.
      */
     resolveGithubWebhookUrl?: AdminRouteDeps['resolveGithubWebhookUrl'];
+    /** Builds the direct-ingress URL for `source list`. Passed into the admin source routes. */
+    resolveSourceIngressUrl?: AdminRouteDeps['resolveSourceIngressUrl'];
     /** Config admin API route dependencies. Optional -- mounted when config management is available. */
     configRouteDeps?: ConfigRouteDeps;
     /** Event router for internal event delivery. Optional -- if not set, event routing is inactive. */
@@ -367,8 +369,8 @@ export interface AppDependencies {
         sendToPeer: (targetInstanceId: string, msg: PeerToPeerMessage) => boolean;
         getConnectionCount: () => number;
     };
-    /** Optional join handler for direct peer join requests. */
-    onJoinRequest?: (msg: import('@kici-dev/engine').JoinRequest) => Promise<import('@kici-dev/engine').JoinResponse>;
+    /** Optional join handler for direct peer join requests; answers any join.request frame. */
+    onJoinRequest?: (raw: unknown) => Promise<import('@kici-dev/engine').JoinResponse>;
     /** Optional callback when agent inventory changes (connect/disconnect). Triggers peer heartbeat broadcast. */
     onAgentInventoryChanged?: () => void;
     /** Run coordinator for multi-orch claim/reroute. Optional -- if not set, jobs dispatch locally. */

package/dist/artifacts/artifact-store.d.ts

@@ -207,8 +207,6 @@ export declare class ArtifactStore {
         runId: string;
         name: string;
     }): Promise<ArtifactDownloadResult>;
-    /** ISO string for a row's created_at (Date or already-string). */
-    private createdAtIso;
     /** Load a run's non-expired artifact rows, newest first, given the org TTL. */
     private loadRunRows;
     /**

package/dist/audit/access-log.d.ts

@@ -105,7 +105,7 @@ export declare class AccessLogWriter {
      * synthetic `__orchestrator__` tenant is scanned (matches the
      * NULL-org_id rows the orchestrator itself emits via
      * `cold-store-archive` / `cold-store-purge`). The CLI exposes this as
-     * `kici-admin access-log show <id> --org-id <orgId>`.
+     * `kici-admin access-log show <id> --org <orgId>`.
      *
      * Best-effort contract: a cold-store error logs a warn line and
      * returns null, matching `loadAccessLogRange` and

package/dist/cache/source-cache.d.ts

@@ -32,7 +32,7 @@
  * defect this layout closes — so serving it would serve the bug. For a v6 lock
  * the fallback is unreachable anyway, since the schema bump moves every hash.
  * Old objects are orphaned. The cache TTL is enforced lazily on access, so
- * nothing here removes them; `kici-admin cache purge-legacy` does.
+ * nothing here removes them.
  */
 import type { CacheStorage } from '../storage/types.js';
 /**

package/dist/cache/user-cache.d.ts

@@ -24,26 +24,6 @@ export interface UserCacheOrgLimits {
 }
 /** Resolves the per-org cache limits for an org id (e.g. an `org_settings` read). */
 export type UserCacheOrgLimitsReader = (orgId: string) => Promise<UserCacheOrgLimits>;
-/**
- * Stem prefix of an in-flight upload, `.tmp-<uuid>.tar.gz`: the presigned PUT
- * target a save lands on before commit copies it to its final key. Shared with
- * the retired-layout classifier so both agree on what an upload looks like.
- */
-export declare const TEMP_UPLOAD_STEM = ".tmp-";
-/**
- * Sanitize a path segment so a key can never escape its org/repo/scope
- * namespace. Beyond stripping disallowed characters, a segment consisting
- * only of dots (`.`, `..`, …) is replaced wholesale: such a segment is a
- * dot-segment that HTTP/S3 path canonicalization collapses (`a/./b` → `a/b`,
- * `a/../b` → `b`), which both corrupts the namespace and breaks the SigV4
- * signature on a pre-signed PUT/GET. Repo identifiers like `.` (the internal
- * provider's repo id) hit exactly this case, so the all-dots guard keeps the
- * object key canonical and the namespace boundary intact.
- *
- * Exported so an operator tool that addresses an org's prefix from a raw org id
- * (`kici-admin cache purge-legacy --org`) lands on the segment the writer used.
- */
-export declare function sanitizeSegment(s: string): string;
 /** Identifies the org + repo + write scope a cache operation targets. */
 export interface UserCacheRef {
     org: string;
@@ -65,14 +45,6 @@ export interface UserCacheBeginSaveResult {
     uploadUrl?: string;
     tempKey?: string;
 }
-/**
- * The object key a committed save under `key` lands on for this ref. This is
- * the writer's own path — `beginSave` and `commitSave` address the entry
- * through it — so anything that must recognise a current-layout key (the
- * legacy-layout classifier tests) takes it from here rather than restating
- * the format.
- */
-export declare function userCacheEntryKey(ref: UserCacheRef, key: string): string;
 export declare class UserCache {
     private readonly storage;
     /** Cluster-wide default quota (the `KICI_USER_CACHE_QUOTA_BYTES` value). */

package/dist/cli/api-client.d.ts

@@ -5,7 +5,7 @@
  * All methods are thin wrappers around fetch() that handle JSON serialization,
  * error formatting, and URL construction.
  */
-import type { PeerForgetOutcome, ScalerLiveVm, ScalerVmStopResult } from '@kici-dev/engine';
+import type { PeerForgetOutcome, ScalerLiveVm, ScalerReloadAnswer, ScalerReloadInstanceResult, ScalerVmStopResult } from '@kici-dev/engine';
 /** `POST /api/v1/admin/peers/forget`: one result per coordinator, this one first. */
 export interface PeerForgetResponseBody {
     instanceId: string;
@@ -18,6 +18,11 @@ export interface PeerForgetResponseBody {
     acknowledgementRequired?: boolean;
     error?: string;
 }
+/** The answer of `POST /api/v1/admin/scaler/reload`: one result per orchestrator, this one first. */
+export interface ScalerReloadResponseBody {
+    scope: 'cluster' | 'single';
+    results: ScalerReloadInstanceResult[];
+}
 /** The node a scaler orphans request answered for. */
 export interface ScalerOrphansNode {
     instanceId: string;
@@ -138,7 +143,11 @@ export declare function firstCauseMessage(err: unknown): string;
  * opening a connection.
  */
 export declare function isTransportFailure(err: unknown): boolean;
+/** The admin API address kici-admin dials when neither --url nor KICI_ADMIN_URL is set. */
+export declare const DEFAULT_ADMIN_URL = "http://localhost:4000";
 export declare function fetchAdminApi(url: string, init: RequestInit, baseUrl: string): Promise<Response>;
+/** Build a `?a=1&b=2` query string, skipping undefined, null and empty-string values. */
+export declare function toQuery(params: Record<string, string | number | boolean | undefined | null>): string;
 export declare class AdminApiClient {
     private readonly baseUrl;
     private readonly token;
@@ -409,6 +418,7 @@ export declare class AdminApiClient {
         success: boolean;
         version?: number;
         errors?: string[];
+        scaler?: ScalerReloadAnswer;
     }>;
     /** Flip the coordinator drain flag on ('drain') or off ('resume'). */
     drain(action: 'drain' | 'resume'): Promise<{
@@ -432,6 +442,22 @@ export declare class AdminApiClient {
         timeoutMs?: number;
         acknowledgeBackstop?: boolean;
     }): Promise<PeerForgetResponseBody>;
+    /**
+     * POST `body` and parse the answer whatever its status, for a route that
+     * reports per-instance results on a non-2xx status too. An unparseable body
+     * reads as `{}`.
+     */
+    private postForBody;
+    /**
+     * Reload the scaler config on this orchestrator and, unless `single`, on every
+     * peer it is connected to. A response where an instance refused its file or
+     * was not reached (422) is returned like a success, so the caller can show
+     * every instance; a 404 means the orchestrator predates the route.
+     */
+    scalerReload(body: {
+        single?: boolean;
+        timeoutMs?: number;
+    }): Promise<ScalerReloadResponseBody>;
     /** List the live Firecracker VMs on this coordinator, or on the `target` peer. */
     listScalerOrphans(opts?: {
         target?: string;

package/dist/cli/commands/access-log.d.ts

@@ -10,7 +10,7 @@
  *   access-log show   Show a single entry by id
  *
  * Filter flags for `list`:
- *   --org-id          -> ?orgId=
+ *   --org             -> ?orgId=
  *   --actor-type      -> ?actorType=
  *   --actor-id        -> ?actorId=
  *   --action          -> ?action=

package/dist/cli/commands/cold-store-impl.d.ts

@@ -1,101 +1,24 @@
-export declare function archiveNow(opts: {
-    databaseUrl: string;
+export declare const archiveNow: (opts: import("@kici-dev/shared").ColdStoreAdminStoreOpts & {
     table: string;
-    instanceId?: string;
-}): Promise<void>;
-export declare function dryRunArchive(opts: {
-    databaseUrl: string;
+}) => Promise<void>, dryRunArchive: (opts: import("@kici-dev/shared").ColdStoreAdminStoreOpts & {
     table: string;
     tenant?: string;
     from?: string;
     to?: string;
-    instanceId?: string;
-}): Promise<void>;
-export interface ChunkListing {
-    chunkId: string;
-    tenantId: string;
-    partitionDate: string;
-    dataKey: string | null;
-    manifestKey: string | null;
-}
-export declare function listChunks(opts: {
-    databaseUrl: string;
+}) => Promise<void>, listChunks: (opts: import("@kici-dev/shared").ColdStoreAdminStoreOpts & {
     table: string;
     tenant?: string;
     missingData?: boolean;
     missingManifest?: boolean;
     from?: string;
     to?: string;
-    instanceId?: string;
-}): Promise<void>;
-export declare function verifyChunk(opts: {
-    databaseUrl: string;
-    chunkId: string;
-    table: string;
-    tenant: string;
-    partitionDate: string;
-    instanceId?: string;
-}): Promise<'match' | 'mismatch'>;
-export declare function replayChunk(opts: {
-    databaseUrl: string;
-    chunkId: string;
-    table: string;
-    tenant: string;
-    partitionDate: string;
-    instanceId?: string;
-}): Promise<void>;
-/**
- * Promote a chunk's rows back into the orchestrator PG.
- * Mirrors the Platform-side `replayIntoPg`. Adapter must implement
- * `replayInsert` — currently only `execution_runs`.
- */
-export declare function replayIntoPg(opts: {
-    databaseUrl: string;
-    chunkId: string;
-    table: string;
-    tenant: string;
-    partitionDate: string;
-    instanceId?: string;
-}): Promise<void>;
-export declare function reconcile(opts: {
-    databaseUrl: string;
+}) => Promise<void>, verifyChunk: (opts: import("@kici-dev/shared").ColdStoreAdminChunkOpts) => Promise<"match" | "mismatch">, replayChunk: (opts: import("@kici-dev/shared").ColdStoreAdminChunkOpts) => Promise<void>, replayIntoPg: (opts: import("@kici-dev/shared").ColdStoreAdminChunkOpts) => Promise<void>, reconcile: (opts: import("@kici-dev/shared").ColdStoreAdminStoreOpts & {
     table: string;
     tenant?: string;
     confirmCleanup?: boolean;
-    instanceId?: string;
-}): Promise<void>;
-/**
- * List chunks past their cold-retention horizon. Read-only;
- * no S3 or PG mutation. Emits one JSON line per row so the output is
- * easy to pipe through `jq` / `column -t` / etc.
- */
-export declare function listPurgeable(opts: {
-    databaseUrl: string;
-    table?: string;
-    bucket?: string;
-    limit?: number;
-    instanceId?: string;
-}): Promise<void>;
-/**
- * Delete S3 objects + clean up PG bookkeeping for chunks
- * past their cold-retention horizon. Defaults to dry-run; pass
- * `--apply` to actually delete.
- */
-export declare function purgeNow(opts: {
-    databaseUrl: string;
-    table?: string;
-    bucket?: string;
-    limit?: number;
+}) => Promise<void>, listPurgeable: (opts: import("@kici-dev/shared").ColdStoreAdminPurgeOpts) => Promise<void>, purgeNow: (opts: import("@kici-dev/shared").ColdStoreAdminPurgeOpts & {
     apply?: boolean;
-    instanceId?: string;
-}): Promise<void>;
-export declare function peekChunk(opts: {
-    databaseUrl: string;
-    chunkId: string;
-    table: string;
-    tenant: string;
-    partitionDate: string;
+}) => Promise<void>, peekChunk: (opts: import("@kici-dev/shared").ColdStoreAdminChunkOpts & {
     limit: number;
-    instanceId?: string;
-}): Promise<void>;
+}) => Promise<void>;
 //# sourceMappingURL=cold-store-impl.d.ts.map

package/dist/cli/commands/db.d.ts

@@ -7,6 +7,7 @@
  *   db create-role                CREATE ROLE LOGIN [CREATEDB] (direct DB)
  *   db create-readonly-user       Read-only role + GRANT SELECT (direct DB)
  *   db check-schema               Compare bundled migrations vs live schema (direct DB)
+ *   db schema-diff                Compare the live schema with the release snapshot (direct DB)
  *   db collation-check            Check pg_database.datcollversion vs running libc (direct DB)
  *   db reindex                    REINDEX DATABASE CONCURRENTLY (direct DB)
  *   db refresh-collation-version  ALTER DATABASE REFRESH COLLATION VERSION (direct DB)

package/dist/cli/commands/host.d.ts

@@ -4,9 +4,12 @@
  *   host list      List all roster hosts with derived status
  *   host get       Show one roster host
  *   host declare   Pre-declare a static host before its agent connects
+ *   host remove    Remove a host from the roster
  *
  * Reads/writes the orchestrator DB directly (via withDb), so this lives in
  * kici-admin — never in the public `kici` or the Platform `kici-platform-admin`.
+ * Writes run as the operator: they may set reserved `kici:` labels and
+ * properties, change any host, and confirm a host the dashboard created.
  */
 import type { Command } from 'commander';
 export declare function registerHostCommands(program: Command): void;

package/dist/cli/commands/orchestrator-service/status.d.ts

@@ -4,6 +4,8 @@
  * Shows OS-level service status (state, PID, uptime) and queries the
  * running orchestrator's `/health` and `/ready` endpoints for its version,
  * build fingerprint, uptime and readiness (database reachable, boot finished).
+ * With an admin token (`--token` / KICI_ADMIN_TOKEN) it also asks the
+ * instance's admin API which org the Platform attached it to.
  *
  * Target resolution goes through resolveInstanceTarget — the same priority chain
  * every lifecycle command uses (--instance-dir > --name > CWD manifest >

package/dist/cli/commands/org.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `kici-admin org list` — every org id this orchestrator holds data for.
+ *
+ * Reads `GET /api/v1/admin/org-ids` by default. With `--database-url` (or
+ * KICI_DATABASE_URL) it runs the same query against the orchestrator database
+ * directly; that mode cannot see the live Platform connection, so it lists no
+ * `platform` source and says so.
+ */
+import type { Command } from 'commander';
+import type { AdminApiClient } from '../api-client.js';
+export declare function registerOrgCommands(program: Command, getClient: () => AdminApiClient): void;
+//# sourceMappingURL=org.d.ts.map

package/dist/cli/commands/scaler.d.ts

@@ -5,6 +5,9 @@
  *                         orchestrator does not track and, with --stop, stop
  *                         them. Goes through the admin HTTP API; `--target`
  *                         reaches a worker through the coordinator.
+ *   scaler reload         Re-read the scaler config on this orchestrator and
+ *                         every peer it is connected to (admin HTTP API);
+ *                         each one applies its file completely or not at all.
  *   scaler reap-orphans   Free leaked Firecracker/container resources WITHOUT a
  *                         running orchestrator (recovery for a wedged node whose
  *                         data disk is full).
@@ -49,6 +52,17 @@ export declare function formatAge(seconds: number): string;
  * @returns the process exit code
  */
 export declare function runScalerOrphans(client: OrphansClient, opts: ScalerOrphansOptions, io: ScalerOrphansIo): Promise<number>;
+export interface ScalerReloadOptions {
+    single: boolean;
+    timeout: string;
+    json: boolean;
+}
+/**
+ * `scaler reload`: reload the scaler config and print one block per instance.
+ * Resolves the exit code: 1 when any instance refused its file or was not
+ * reached, else 0. A bad `--timeout` throws before any request.
+ */
+export declare function runScalerReload(client: Pick<AdminApiClient, 'scalerReload'>, opts: ScalerReloadOptions, out: (line: string) => void): Promise<number>;
 export declare function registerScalerCommands(program: Command, getClient: () => AdminApiClient): void;
 export {};
 //# sourceMappingURL=scaler.d.ts.map