@kici-dev/orchestrator 0.15.0 → 0.17.0

package/dist/__test-helpers__/scratch-db.d.ts

@@ -0,0 +1,16 @@
+/** Throwaway PostgreSQL databases for DB-gated tests, dropped by `cleanup`. */
+import pg from 'pg';
+import { Kysely } from 'kysely';
+export interface ScratchDb {
+    url: string;
+    pool: pg.Pool;
+    db: Kysely<any>;
+}
+/** Creates databases on `adminUrl`; `cleanup` drops every one of them. */
+export declare function scratchDbFactory(adminUrl: string): {
+    freshDb: (tag: string) => Promise<ScratchDb>;
+    cleanup: () => Promise<void>;
+};
+/** The applied migration names, sorted. */
+export declare function ledgerNames(db: Kysely<any>): Promise<string[]>;
+//# sourceMappingURL=scratch-db.d.ts.map

package/dist/agent/registry.d.ts

@@ -9,7 +9,7 @@
  * No persistence needed -- agents re-register on reconnect.
  */
 import { type CanonicalLabel, type LabelMatcher } from '@kici-dev/engine';
-import type { AgentCapabilities, WsLike } from '@kici-dev/engine';
+import type { WsLike } from '@kici-dev/engine';
 /**
  * The longest a busy rejection holds an agent out of routing when no evidence
  * of a free slot lifts the hold first: an `agent.status` capacity report, or a
@@ -108,11 +108,6 @@ export interface AgentEntry {
     registeredAt: number;
     /** Self-reported agent version (e.g. "0.0.1"). Null if not reported. */
     version: string | null;
-    /**
-     * Optional behaviours the agent advertised on `agent.register`. Null for an
-     * agent that advertised none, which is read as supporting none.
-     */
-    capabilities: AgentCapabilities | null;
     /**
      * The `agent_tokens.id` row used to authenticate this connection, or
      * `null` when auth mode is `none`. Indexed by `tokenIdIndex` so a
@@ -180,8 +175,6 @@ interface AgentMetadata {
      * any operator-declared properties). Undefined ⇒ the agent reported none.
      */
     properties?: Record<string, string | number | boolean>;
-    /** Optional behaviours the agent advertised on `agent.register`. */
-    capabilities?: AgentCapabilities;
 }
 /**
  * Subset of `HostRosterStore` the registry reconciles into. Optional — when no

package/dist/app-on-error.d.ts

@@ -3,7 +3,7 @@
  *
  * Without one, Hono answers an unhandled throw with a bare, unstructured 500:
  * no JSON body, no route context, and nothing written to our own logs. Every
- * admin router already catches inside its handlers (routes/admin-errors.ts),
+ * admin sub-app answers its own errors through its own onError (routes/admin-env.ts),
  * and the auth path catches inside its middleware (routes/admin-auth.ts) -- this
  * covers whatever neither does.
  *

package/dist/approvals/apply-decision.d.ts

@@ -1,8 +1,19 @@
-import { ApprovalDecision } from '@kici-dev/engine';
+import { AccessLogAction, ApprovalDecision } from '@kici-dev/engine';
 import type { HeldRun } from '../db/types.js';
 import { HoldOutcome } from '../pipeline/security-hold-check.js';
 import type { HeldRunStore, ReleaseSignal } from '../contexts/held-runs.js';
 import { type TeamMembershipLookup } from './approval-resolver.js';
+/**
+ * The access-log action a held-run decision is audited under.
+ *
+ * A `kici run --approve-all` breakglass approval audits as
+ * `held_run.auto_approve`, so the trail shows "auto-approved by the dispatcher"
+ * apart from an interactive approve. The marker only renames the record:
+ * eligibility is enforced the same way for both. It never applies to a reject.
+ * Every approving surface takes its action from here, so the Platform-relayed
+ * and the direct admin-route approvals cannot audit the same act two ways.
+ */
+export declare function heldRunDecisionAction(decision: ApprovalDecision, autoApprove: boolean): AccessLogAction;
 /** Whether a decision's post-commit consequence ran to completion. */
 export interface DecisionConsequenceResult {
     /** True when the whole consequence chain ran; false when a step of it threw. */

package/dist/artifacts/artifact-store.d.ts

@@ -207,8 +207,6 @@ export declare class ArtifactStore {
         runId: string;
         name: string;
     }): Promise<ArtifactDownloadResult>;
-    /** ISO string for a row's created_at (Date or already-string). */
-    private createdAtIso;
     /** Load a run's non-expired artifact rows, newest first, given the org TTL. */
     private loadRunRows;
     /**

package/dist/audit/access-log.d.ts

@@ -105,7 +105,7 @@ export declare class AccessLogWriter {
      * synthetic `__orchestrator__` tenant is scanned (matches the
      * NULL-org_id rows the orchestrator itself emits via
      * `cold-store-archive` / `cold-store-purge`). The CLI exposes this as
-     * `kici-admin access-log show <id> --org-id <orgId>`.
+     * `kici-admin access-log show <id> --org <orgId>`.
      *
      * Best-effort contract: a cold-store error logs a warn line and
      * returns null, matching `loadAccessLogRange` and

package/dist/cache/source-cache.d.ts

@@ -32,7 +32,7 @@
  * defect this layout closes — so serving it would serve the bug. For a v6 lock
  * the fallback is unreachable anyway, since the schema bump moves every hash.
  * Old objects are orphaned. The cache TTL is enforced lazily on access, so
- * nothing here removes them; `kici-admin cache purge-legacy` does.
+ * nothing here removes them.
  */
 import type { CacheStorage } from '../storage/types.js';
 /**

package/dist/cache/user-cache.d.ts

@@ -24,26 +24,6 @@ export interface UserCacheOrgLimits {
 }
 /** Resolves the per-org cache limits for an org id (e.g. an `org_settings` read). */
 export type UserCacheOrgLimitsReader = (orgId: string) => Promise<UserCacheOrgLimits>;
-/**
- * Stem prefix of an in-flight upload, `.tmp-<uuid>.tar.gz`: the presigned PUT
- * target a save lands on before commit copies it to its final key. Shared with
- * the retired-layout classifier so both agree on what an upload looks like.
- */
-export declare const TEMP_UPLOAD_STEM = ".tmp-";
-/**
- * Sanitize a path segment so a key can never escape its org/repo/scope
- * namespace. Beyond stripping disallowed characters, a segment consisting
- * only of dots (`.`, `..`, …) is replaced wholesale: such a segment is a
- * dot-segment that HTTP/S3 path canonicalization collapses (`a/./b` → `a/b`,
- * `a/../b` → `b`), which both corrupts the namespace and breaks the SigV4
- * signature on a pre-signed PUT/GET. Repo identifiers like `.` (the internal
- * provider's repo id) hit exactly this case, so the all-dots guard keeps the
- * object key canonical and the namespace boundary intact.
- *
- * Exported so an operator tool that addresses an org's prefix from a raw org id
- * (`kici-admin cache purge-legacy --org`) lands on the segment the writer used.
- */
-export declare function sanitizeSegment(s: string): string;
 /** Identifies the org + repo + write scope a cache operation targets. */
 export interface UserCacheRef {
     org: string;
@@ -65,14 +45,6 @@ export interface UserCacheBeginSaveResult {
     uploadUrl?: string;
     tempKey?: string;
 }
-/**
- * The object key a committed save under `key` lands on for this ref. This is
- * the writer's own path — `beginSave` and `commitSave` address the entry
- * through it — so anything that must recognise a current-layout key (the
- * legacy-layout classifier tests) takes it from here rather than restating
- * the format.
- */
-export declare function userCacheEntryKey(ref: UserCacheRef, key: string): string;
 export declare class UserCache {
     private readonly storage;
     /** Cluster-wide default quota (the `KICI_USER_CACHE_QUOTA_BYTES` value). */

package/dist/cli/api-client.d.ts

@@ -5,7 +5,7 @@
  * All methods are thin wrappers around fetch() that handle JSON serialization,
  * error formatting, and URL construction.
  */
-import type { PeerForgetOutcome, ScalerLiveVm, ScalerVmStopResult } from '@kici-dev/engine';
+import type { PeerForgetOutcome, ScalerLiveVm, ScalerReloadAnswer, ScalerReloadInstanceResult, ScalerVmStopResult } from '@kici-dev/engine';
 /** `POST /api/v1/admin/peers/forget`: one result per coordinator, this one first. */
 export interface PeerForgetResponseBody {
     instanceId: string;
@@ -18,6 +18,11 @@ export interface PeerForgetResponseBody {
     acknowledgementRequired?: boolean;
     error?: string;
 }
+/** The answer of `POST /api/v1/admin/scaler/reload`: one result per orchestrator, this one first. */
+export interface ScalerReloadResponseBody {
+    scope: 'cluster' | 'single';
+    results: ScalerReloadInstanceResult[];
+}
 /** The node a scaler orphans request answered for. */
 export interface ScalerOrphansNode {
     instanceId: string;
@@ -138,7 +143,11 @@ export declare function firstCauseMessage(err: unknown): string;
  * opening a connection.
  */
 export declare function isTransportFailure(err: unknown): boolean;
+/** The admin API address kici-admin dials when neither --url nor KICI_ADMIN_URL is set. */
+export declare const DEFAULT_ADMIN_URL = "http://localhost:4000";
 export declare function fetchAdminApi(url: string, init: RequestInit, baseUrl: string): Promise<Response>;
+/** Build a `?a=1&b=2` query string, skipping undefined, null and empty-string values. */
+export declare function toQuery(params: Record<string, string | number | boolean | undefined | null>): string;
 export declare class AdminApiClient {
     private readonly baseUrl;
     private readonly token;
@@ -409,6 +418,7 @@ export declare class AdminApiClient {
         success: boolean;
         version?: number;
         errors?: string[];
+        scaler?: ScalerReloadAnswer;
     }>;
     /** Flip the coordinator drain flag on ('drain') or off ('resume'). */
     drain(action: 'drain' | 'resume'): Promise<{
@@ -432,6 +442,22 @@ export declare class AdminApiClient {
         timeoutMs?: number;
         acknowledgeBackstop?: boolean;
     }): Promise<PeerForgetResponseBody>;
+    /**
+     * POST `body` and parse the answer whatever its status, for a route that
+     * reports per-instance results on a non-2xx status too. An unparseable body
+     * reads as `{}`.
+     */
+    private postForBody;
+    /**
+     * Reload the scaler config on this orchestrator and, unless `single`, on every
+     * peer it is connected to. A response where an instance refused its file or
+     * was not reached (422) is returned like a success, so the caller can show
+     * every instance; a 404 means the orchestrator predates the route.
+     */
+    scalerReload(body: {
+        single?: boolean;
+        timeoutMs?: number;
+    }): Promise<ScalerReloadResponseBody>;
     /** List the live Firecracker VMs on this coordinator, or on the `target` peer. */
     listScalerOrphans(opts?: {
         target?: string;
@@ -443,6 +469,10 @@ export declare class AdminApiClient {
         vmIds: string[];
         timeoutMs?: number;
     }): Promise<ScalerOrphansStopResponse>;
+    /**
+     * @deprecated No KiCI server serves `/api/v1/api-keys`; use `createToken`
+     * (`kici-admin token create`). Removed in v1.0.0.
+     */
     createApiKey(opts: {
         label?: string;
         routingKeys?: string[];
@@ -451,6 +481,10 @@ export declare class AdminApiClient {
         key: string;
         routingKeys: string[];
     }>;
+    /**
+     * @deprecated No KiCI server serves `/api/v1/api-keys`; use `createToken`
+     * with `routingKey` (`kici-admin token create --routing-key`). Removed in v1.0.0.
+     */
     addRoutingKeyPermission(keyId: string, pattern: string): Promise<{
         id: string;
         pattern: string;

package/dist/cli/commands/access-log.d.ts

@@ -10,7 +10,7 @@
  *   access-log show   Show a single entry by id
  *
  * Filter flags for `list`:
- *   --org-id          -> ?orgId=
+ *   --org             -> ?orgId=
  *   --actor-type      -> ?actorType=
  *   --actor-id        -> ?actorId=
  *   --action          -> ?action=

package/dist/cli/commands/api-key.d.ts

@@ -1,12 +1,19 @@
 /**
- * Platform API key management commands for kici-admin.
+ * `kici-admin api-key` — deprecated.
  *
- * These commands target the Platform admin API for managing API keys
- * and routing key permissions. Uses the same --url flag (point to Platform URL).
+ * The group targeted `/api/v1/api-keys`, which no KiCI server serves, so it
+ * never worked. Both subcommands stay registered until v1.0.0 and exit with a
+ * message that points at `kici-admin token create`, the per-person
+ * orchestrator token a developer passes to `kici connect`.
  *
  *   api-key create, add-routing-key
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
-export declare function registerApiKeyCommands(program: Command, getClient: () => AdminApiClient): void;
+export declare const API_KEY_DEPRECATED_MESSAGE: string;
+/**
+ * Register the deprecated `api-key` group. `getClient` is accepted for the
+ * registration signature every command group shares and is never called.
+ */
+export declare function registerApiKeyCommands(program: Command, _getClient: () => AdminApiClient): void;
 //# sourceMappingURL=api-key.d.ts.map

package/dist/cli/commands/cold-store-impl.d.ts

@@ -1,101 +1,24 @@
-export declare function archiveNow(opts: {
-    databaseUrl: string;
+export declare const archiveNow: (opts: import("@kici-dev/shared").ColdStoreAdminStoreOpts & {
     table: string;
-    instanceId?: string;
-}): Promise<void>;
-export declare function dryRunArchive(opts: {
-    databaseUrl: string;
+}) => Promise<void>, dryRunArchive: (opts: import("@kici-dev/shared").ColdStoreAdminStoreOpts & {
     table: string;
     tenant?: string;
     from?: string;
     to?: string;
-    instanceId?: string;
-}): Promise<void>;
-export interface ChunkListing {
-    chunkId: string;
-    tenantId: string;
-    partitionDate: string;
-    dataKey: string | null;
-    manifestKey: string | null;
-}
-export declare function listChunks(opts: {
-    databaseUrl: string;
+}) => Promise<void>, listChunks: (opts: import("@kici-dev/shared").ColdStoreAdminStoreOpts & {
     table: string;
     tenant?: string;
     missingData?: boolean;
     missingManifest?: boolean;
     from?: string;
     to?: string;
-    instanceId?: string;
-}): Promise<void>;
-export declare function verifyChunk(opts: {
-    databaseUrl: string;
-    chunkId: string;
-    table: string;
-    tenant: string;
-    partitionDate: string;
-    instanceId?: string;
-}): Promise<'match' | 'mismatch'>;
-export declare function replayChunk(opts: {
-    databaseUrl: string;
-    chunkId: string;
-    table: string;
-    tenant: string;
-    partitionDate: string;
-    instanceId?: string;
-}): Promise<void>;
-/**
- * Promote a chunk's rows back into the orchestrator PG.
- * Mirrors the Platform-side `replayIntoPg`. Adapter must implement
- * `replayInsert` — currently only `execution_runs`.
- */
-export declare function replayIntoPg(opts: {
-    databaseUrl: string;
-    chunkId: string;
-    table: string;
-    tenant: string;
-    partitionDate: string;
-    instanceId?: string;
-}): Promise<void>;
-export declare function reconcile(opts: {
-    databaseUrl: string;
+}) => Promise<void>, verifyChunk: (opts: import("@kici-dev/shared").ColdStoreAdminChunkOpts) => Promise<"match" | "mismatch">, replayChunk: (opts: import("@kici-dev/shared").ColdStoreAdminChunkOpts) => Promise<void>, replayIntoPg: (opts: import("@kici-dev/shared").ColdStoreAdminChunkOpts) => Promise<void>, reconcile: (opts: import("@kici-dev/shared").ColdStoreAdminStoreOpts & {
     table: string;
     tenant?: string;
     confirmCleanup?: boolean;
-    instanceId?: string;
-}): Promise<void>;
-/**
- * List chunks past their cold-retention horizon. Read-only;
- * no S3 or PG mutation. Emits one JSON line per row so the output is
- * easy to pipe through `jq` / `column -t` / etc.
- */
-export declare function listPurgeable(opts: {
-    databaseUrl: string;
-    table?: string;
-    bucket?: string;
-    limit?: number;
-    instanceId?: string;
-}): Promise<void>;
-/**
- * Delete S3 objects + clean up PG bookkeeping for chunks
- * past their cold-retention horizon. Defaults to dry-run; pass
- * `--apply` to actually delete.
- */
-export declare function purgeNow(opts: {
-    databaseUrl: string;
-    table?: string;
-    bucket?: string;
-    limit?: number;
+}) => Promise<void>, listPurgeable: (opts: import("@kici-dev/shared").ColdStoreAdminPurgeOpts) => Promise<void>, purgeNow: (opts: import("@kici-dev/shared").ColdStoreAdminPurgeOpts & {
     apply?: boolean;
-    instanceId?: string;
-}): Promise<void>;
-export declare function peekChunk(opts: {
-    databaseUrl: string;
-    chunkId: string;
-    table: string;
-    tenant: string;
-    partitionDate: string;
+}) => Promise<void>, peekChunk: (opts: import("@kici-dev/shared").ColdStoreAdminChunkOpts & {
     limit: number;
-    instanceId?: string;
-}): Promise<void>;
+}) => Promise<void>;
 //# sourceMappingURL=cold-store-impl.d.ts.map

package/dist/cli/commands/db.d.ts

@@ -7,6 +7,7 @@
  *   db create-role                CREATE ROLE LOGIN [CREATEDB] (direct DB)
  *   db create-readonly-user       Read-only role + GRANT SELECT (direct DB)
  *   db check-schema               Compare bundled migrations vs live schema (direct DB)
+ *   db schema-diff                Compare the live schema with the release snapshot (direct DB)
  *   db collation-check            Check pg_database.datcollversion vs running libc (direct DB)
  *   db reindex                    REINDEX DATABASE CONCURRENTLY (direct DB)
  *   db refresh-collation-version  ALTER DATABASE REFRESH COLLATION VERSION (direct DB)

package/dist/cli/commands/orchestrator-service/status.d.ts

@@ -4,6 +4,8 @@
  * Shows OS-level service status (state, PID, uptime) and queries the
  * running orchestrator's `/health` and `/ready` endpoints for its version,
  * build fingerprint, uptime and readiness (database reachable, boot finished).
+ * With an admin token (`--token` / KICI_ADMIN_TOKEN) it also asks the
+ * instance's admin API which org the Platform attached it to.
  *
  * Target resolution goes through resolveInstanceTarget — the same priority chain
  * every lifecycle command uses (--instance-dir > --name > CWD manifest >

package/dist/cli/commands/org.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `kici-admin org list` — every org id this orchestrator holds data for.
+ *
+ * Reads `GET /api/v1/admin/org-ids` by default. With `--database-url` (or
+ * KICI_DATABASE_URL) it runs the same query against the orchestrator database
+ * directly; that mode cannot see the live Platform connection, so it lists no
+ * `platform` source and says so.
+ */
+import type { Command } from 'commander';
+import type { AdminApiClient } from '../api-client.js';
+export declare function registerOrgCommands(program: Command, getClient: () => AdminApiClient): void;
+//# sourceMappingURL=org.d.ts.map

package/dist/cli/commands/scaler.d.ts

@@ -5,6 +5,9 @@
  *                         orchestrator does not track and, with --stop, stop
  *                         them. Goes through the admin HTTP API; `--target`
  *                         reaches a worker through the coordinator.
+ *   scaler reload         Re-read the scaler config on this orchestrator and
+ *                         every peer it is connected to (admin HTTP API);
+ *                         each one applies its file completely or not at all.
  *   scaler reap-orphans   Free leaked Firecracker/container resources WITHOUT a
  *                         running orchestrator (recovery for a wedged node whose
  *                         data disk is full).
@@ -49,6 +52,17 @@ export declare function formatAge(seconds: number): string;
  * @returns the process exit code
  */
 export declare function runScalerOrphans(client: OrphansClient, opts: ScalerOrphansOptions, io: ScalerOrphansIo): Promise<number>;
+export interface ScalerReloadOptions {
+    single: boolean;
+    timeout: string;
+    json: boolean;
+}
+/**
+ * `scaler reload`: reload the scaler config and print one block per instance.
+ * Resolves the exit code: 1 when any instance refused its file or was not
+ * reached, else 0. A bad `--timeout` throws before any request.
+ */
+export declare function runScalerReload(client: Pick<AdminApiClient, 'scalerReload'>, opts: ScalerReloadOptions, out: (line: string) => void): Promise<number>;
 export declare function registerScalerCommands(program: Command, getClient: () => AdminApiClient): void;
 export {};
 //# sourceMappingURL=scaler.d.ts.map

package/dist/cli/commands/secret.d.ts

@@ -2,56 +2,12 @@
  * Secret management commands for kici-admin.
  *
  * Provides scoped secret operations:
- *   secret scopes, list, set, delete, fix-prefixed-scopes
+ *   secret scopes, list, set, delete
  *   secret scope create|rename|delete
  *
  * Secret values are write-only -- there is no "get value" command.
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
-/** One planned rename from a stored qualified scope to its bare path. */
-export interface PrefixedScopeRename {
-    from: string;
-    to: string;
-    backendName: string;
-}
-/** One stored scope that cannot be repaired automatically. */
-export interface PrefixedScopeSkip {
-    scope: string;
-    reason: string;
-}
-/** Outcome of planning the repair of legacy qualifier-bearing scopes. */
-export interface PrefixedScopeFixPlan {
-    renames: PrefixedScopeRename[];
-    skips: PrefixedScopeSkip[];
-}
-/**
- * Plan the repair of scopes stored with a `<backend>:` qualifier still attached.
- *
- * Before backend-qualified routing landed on the HTTP admin plane, a scope
- * written as `pg:production` was stored verbatim, so the stored name carries a
- * qualifier the resolver now strips before it reaches the store. Such a row is
- * unreachable: every read addresses the bare `production`.
- *
- * Only a `pg:` qualifier is repaired. The scopes handed in come out of the PG
- * store, so a row named `vault:foo` is a PG row wearing another backend's
- * name: renaming it to `foo` would turn it into a genuine PG secret, moving it
- * across a backend boundary and past a `pgCustomerSecrets: false` setting that
- * exists to keep customer secrets out of PG. That is the same cross-backend
- * move the rename route refuses, so it is reported as a skip instead.
- *
- * An unregistered head is left alone entirely -- it is an ordinary (if
- * unusual) scope path, not a stale qualifier.
- *
- * A repair whose bare target already exists is SKIPPED, never merged: merging
- * two scopes would silently overwrite whichever key the two share, and there
- * is no way to tell which value the operator meant to keep.
- *
- * Pure -- no I/O, so the decision table is unit-testable without a database.
- *
- * @param scopes - Scope names as currently stored in the PG backend.
- * @param backendNames - Names of the registered secret backends.
- */
-export declare function planPrefixedScopeFixes(scopes: string[], backendNames: string[]): PrefixedScopeFixPlan;
 export declare function registerSecretCommands(program: Command, getClient: () => AdminApiClient): void;
 //# sourceMappingURL=secret.d.ts.map

package/dist/cli/commands/service-health.d.ts

@@ -30,6 +30,26 @@ export interface LocalEndpoint {
 export declare function readLocalEndpoint(envContent: string, defaultPort: number): LocalEndpoint;
 /** The URL of `pathname` on `endpoint`, with an IPv6 host bracketed. */
 export declare function localUrl(endpoint: LocalEndpoint, pathname: string): string;
+/** What a local JSON request got: a body, a refusing status, or no answer at all. */
+export type LocalJsonResult<T> = {
+    kind: 'ok';
+    status: number;
+    body: T;
+} | {
+    kind: 'http-error';
+    status: number;
+} | {
+    kind: 'no-answer';
+};
+/**
+ * GET a JSON body from a service on this host. `acceptStatuses` names the
+ * non-2xx codes whose body is still an answer; `headers` carries credentials.
+ */
+export declare function requestLocalJson<T>(endpoint: LocalEndpoint, pathname: string, opts?: {
+    acceptStatuses?: readonly number[];
+    timeoutMs?: number;
+    headers?: Record<string, string>;
+}): Promise<LocalJsonResult<T>>;
 /**
  * GET a JSON body from a service on this host. `acceptStatuses` names the
  * non-2xx codes whose body is still an answer: `/ready` returns its checks
@@ -39,22 +59,10 @@ export declare function fetchLocalJson<T>(endpoint: LocalEndpoint, pathname: str
     acceptStatuses?: readonly number[];
     timeoutMs?: number;
 }): Promise<T | null>;
-/**
- * A `/health` body with its deprecated `buildCommit` replaced by its version.
- * A service older than this CLI reports a commit ID from KiCI's private
- * repository there, which a reader cannot resolve; `--json` keeps the key, a
- * string as before, and carries the release version in it. A body that reports
- * no `buildCommit` comes back unchanged.
- */
-export declare function hideBuildCommit<T extends {
-    version?: string;
-    buildCommit?: string;
-}>(health: T): T;
 /**
  * Rows for the build fingerprint and process uptime of a `/health` body. A
  * field the body lacks is skipped, so a service older than this CLI renders
- * the fields it does report. The version line never shows `buildCommit`
- * (see {@link hideBuildCommit}).
+ * the fields it does report.
  */
 export declare function buildInfoRows(health: Partial<LivenessBase & BuildFingerprint & {
     buildDate: string;

package/dist/cli/commands/shared/cli-action.d.ts

@@ -0,0 +1,17 @@
+/** Commander option flag and help text shared by every command that can bypass HTTP. */
+export declare const DIRECT_DB_URL_FLAG = "--database-url <url>";
+export declare const DIRECT_DB_URL_HELP = "Use direct DB access instead of HTTP (offline mode)";
+/** `--database-url`, else `KICI_DATABASE_URL`, else null (null = use the HTTP admin API). */
+export declare function resolveDirectDbUrl(explicit?: string): string | null;
+/** Like {@link resolveDirectDbUrl} but required: throws when neither source is set. */
+export declare function resolveDatabaseUrl(explicit?: string): string;
+/** Parse an optional integer flag; throws naming the flag on a non-integer. */
+export declare function parseIntOption(raw: string | undefined, label: string): number | undefined;
+/**
+ * Wrap a Commander action so any thrown error prints `Error: <message>` to
+ * stderr and exits 1.
+ */
+export declare function cliAction<A extends unknown[]>(fn: (...args: A) => Promise<void> | void): (...args: A) => Promise<void>;
+/** Print `value` as one JSON line when `json` is set, otherwise hand it to `render`. */
+export declare function printJsonOr<T>(json: boolean | undefined, value: T, render: (v: T) => void): void;
+//# sourceMappingURL=cli-action.d.ts.map

package/dist/cli/commands/shared/db.d.ts

@@ -1,16 +1,16 @@
 /**
  * Shared database helper for CLI commands that need direct DB access.
  *
- * Provides a withDb() wrapper that creates a database connection from
- * KICI_DATABASE_URL, runs a callback, and ensures cleanup.
+ * Provides a withDb() wrapper that creates a database connection from the
+ * URL it is given (or KICI_DATABASE_URL when none is passed), runs a callback,
+ * and ensures cleanup.
  */
 import pg from 'pg';
 import { Kysely } from 'kysely';
 /**
  * Execute a callback with a database connection, then clean up.
  *
- * Reads the database URL from KICI_DATABASE_URL.
- * Creates a connection pool, runs the callback, and destroys the pool.
+ * Connects to `databaseUrl`, or to KICI_DATABASE_URL when none is passed.
  */
-export declare function withDb<T>(fn: (db: Kysely<any>, pool: pg.Pool) => Promise<T>): Promise<T>;
+export declare function withDb<T>(fn: (db: Kysely<any>, pool: pg.Pool) => Promise<T>, databaseUrl?: string | undefined): Promise<T>;
 //# sourceMappingURL=db.d.ts.map

package/dist/cli/commands/shared/org-id.d.ts

@@ -0,0 +1,5 @@
+/** Where an operator finds an org id: appended to every org-id input's help. */
+export declare const ORG_LIST_HINT = "kici-admin org list prints the org ids";
+/** Help text of an org-id argument or `--org` option. */
+export declare const ORG_ID_HELP = "Org id (kici-admin org list prints the org ids)";
+//# sourceMappingURL=org-id.d.ts.map

package/dist/cli/commands/shared/service-verbs.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The service lifecycle verbs shared by `kici-admin agent` and `kici-admin orchestrator`:
+ * `uninstall`, `start`, `stop`, `restart` and `logs`.
+ *
+ * Target resolution goes through resolveInstanceTarget — the priority chain every
+ * lifecycle command uses (--instance-dir > --name > CWD manifest > refusal with
+ * candidate list). `--name` has no default.
+ */
+import type { Command } from 'commander';
+export type ServiceComponent = 'agent' | 'orchestrator';
+/**
+ * Register `uninstall`, `start`, `stop` and `restart` on a component's command group.
+ * Commander lists subcommands in registration order, so the caller places this
+ * between `install` and `status`.
+ */
+export declare function registerServiceLifecycleVerbs(parent: Command, component: ServiceComponent): void;
+/** Register `logs` on a component's command group (listed after `status`). */
+export declare function registerServiceLogsVerb(parent: Command, component: ServiceComponent): void;
+//# sourceMappingURL=service-verbs.d.ts.map

package/dist/cli/commands/shared/table.d.ts

@@ -0,0 +1,3 @@
+/** Render a left-aligned, two-space-gapped text table with a dashed separator row. */
+export declare function renderTable(headers: string[], rows: string[][]): string;
+//# sourceMappingURL=table.d.ts.map