@kici-dev/orchestrator 0.15.0 → 0.17.0

package/dist/cli/commands/shared/unbound-context-warning.d.ts

@@ -1,23 +1,3 @@
-/**
- * The warning `kici-admin context create` and `kici-admin secret set` print
- * when a context's secrets cannot reach any job.
- *
- * A job that lists a context in its `contexts:` receives the context's
- * secrets only through the context's scope bindings: the secret resolver reads
- * the bindings of the context row the job's declared name matched — a fixed
- * context by its exact name, a glob context by its pattern — and returns
- * nothing when there are none. So such a context with no binding delivers no
- * secret to those jobs, whatever its scopes hold, and nothing fails loudly — a
- * workflow's `ctx.secrets.get()` throws at run time instead. A
- * `<context>:<key>` git-credential or registry reference to a fixed context
- * still reads the scope named after it, through a deprecated fallback; a glob
- * context has no such fallback. The warning names the context, that fallback
- * where it applies, and the `context bind` command that fixes it.
- *
- * Advisory only: the lookup runs after the command's own write succeeded, and
- * a failed lookup prints nothing, so the command's exit code never changes.
- */
-import { ContextType } from '@kici-dev/engine';
 /** The one admin API call the lookup needs, so any client shape satisfies it. */
 export interface ContextLookupClient {
     get<T>(path: string): Promise<T>;
@@ -32,8 +12,8 @@ export interface WarnIfContextUnboundArgs {
     /** Where the warning goes; stderr by default. */
     warn?: (line: string) => void;
 }
-/** The warning line for a context of `type` with no binding. */
-export declare function unboundContextWarning(orgId: string, name: string, type: ContextType): string;
+/** The warning line for a context with no binding. */
+export declare function unboundContextWarning(orgId: string, name: string): string;
 /**
  * Print the unbound-context warning when `name` is a context a job can resolve
  * through (a fixed or glob context, `ContextType`) that has no binding. A

package/dist/cli/commands/trust-policy.d.ts

@@ -17,7 +17,7 @@
  *
  * The two directory writers live in this namespace rather than one of their
  * own because they are the same org-trust concept as the policy, gated by the
- * same mode rule against the same `--customer-id`, and reached through the same
+ * same mode rule against the same `--org`, and reached through the same
  * admin route file. Splitting them out would put half of "who may approve" in a
  * second top-level command with its own copy of that story. They are siblings
  * of the `directory` reader rather than subcommands under it, because turning
@@ -40,11 +40,7 @@ import type { AdminApiClient } from '../api-client.js';
 export interface TrustPolicyView {
     customerId: string;
     forkPolicy?: string;
-    approvalExpiryHours?: number;
-    /**
-     * The authoritative hold window. Absent from any orchestrator that predates
-     * it, in which case `approvalExpiryHours` is the only window on offer.
-     */
+    /** The hold window, in seconds. */
     approvalExpirySeconds?: number;
     source: string | null;
     updatedAt: string | null;
@@ -62,21 +58,13 @@ export declare function formatPolicy(policy: TrustPolicyView, format: string): s
  * touched to a policy they never set, so the reader of `trust-policy show`
  * is told outright — with where to look for each individual drop.
  *
- * Returns the lines rather than printing them so the check is unit-testable,
- * matching `policyExpiryWarnings` below.
+ * Returns the lines rather than printing them so the check is unit-testable.
  */
 export declare function forkDropWarnings(policy: TrustPolicyView): string[];
 /**
- * Render the enforced hold window.
- *
- * A whole number of hours still prints as `72 h`, exactly as it always did, so
- * no existing policy's output moves. Anything finer prints in seconds, because
- * the hours spelling cannot express it and rounding would report a window the
- * orchestrator is not applying.
- *
- * A policy carrying neither field is an orchestrator old enough to have
- * resolved no policy at all (see {@link TrustPolicyView}); one carrying only
- * hours is an orchestrator that predates the seconds window.
+ * Render the enforced hold window in the duration spelling `--approval-expiry`
+ * takes (`72h`, `1h30m`). A policy carrying no window is an orchestrator old
+ * enough to have resolved no policy at all (see {@link TrustPolicyView}).
  */
 export declare function formatExpiry(policy: TrustPolicyView): string;
 /**
@@ -86,17 +74,6 @@ export declare function formatExpiry(policy: TrustPolicyView): string;
  * clear local message naming the accepted values instead of a 400 from the API.
  */
 export declare function buildPolicyPatch(opts: Record<string, string | undefined>): Record<string, string | number>;
-/**
- * Warn when a patch names both spellings of the hold window.
- *
- * The route resolves this deterministically — the more specific seconds value
- * wins — but an operator who passed both asked for two different things, so the
- * one that is not applied is named rather than dropped in silence.
- *
- * Returns the lines rather than printing them so the check is unit-testable,
- * matching `forkDropWarnings` above.
- */
-export declare function policyExpiryWarnings(patch: Record<string, string | number>): string[];
 /** One identity link as the directory route reports it. */
 interface DirectoryIdentityLink {
     userId: string;
@@ -154,8 +131,7 @@ export declare function formatDirectoryAge(updatedAt: string, now: number): stri
  * The connected wording is a `Note:` and the disconnected one a `Warning:`,
  * because the two ask for different things: one states a property of the design
  * the reader should know, the other names a condition they should act on. The
- * `Warning:` producers above — `forkDropWarnings` and `policyExpiryWarnings` —
- * are both of the second kind.
+ * `Warning:` producer above, `forkDropWarnings`, is of the second kind.
  *
  * Returns the lines rather than printing them so the check is unit-testable,
  * matching `forkDropWarnings` above.

package/dist/cli/kici-admin.d.ts

@@ -6,7 +6,7 @@
  * through the orchestrator's admin HTTP API.
  *
  * Global options:
- *   --url / -u    Orchestrator URL (env: KICI_ADMIN_URL, default: http://localhost:8080)
+ *   --url / -u    Orchestrator URL (env: KICI_ADMIN_URL, default: http://localhost:4000)
  *   --token / -t  Admin API token (env: KICI_ADMIN_TOKEN, required)
  *   -V / --cli-version / --version  Print the CLI version (--version only before a command)
  *