@kici-dev/orchestrator 0.16.0 → 0.18.0

package/dist/cli/commands/trust-policy.d.ts

@@ -1,41 +1,24 @@
 /**
- * Org trust-policy commands for kici-admin.
+ * `kici-admin trust-policy` commands, against the orchestrator admin API
+ * (`routes/admin-trust-policy.ts`) so they work while the Platform is down.
  *
- * Subcommand namespace:
- * `kici-admin trust-policy <show|set|directory|directory-set|directory-remove>`.
+ * `show` and `directory` read in every mode. The writers work only on an
+ * independent orchestrator: an attached Platform owns the policy and the
+ * directory, and the route's 409 message is surfaced verbatim so the CLI
+ * cannot drift from the server.
  *
- * Talks to the orchestrator admin API directly (not the Platform dashboard
- * proxy), so the CLI stays operable even when Platform is unavailable. Backed
- * by `packages/orchestrator/src/routes/admin-trust-policy.ts`.
- *
- * `show` and `directory` read, in every mode. `set`, `directory-set`, and
- * `directory-remove` write, and only work on an independent orchestrator:
- * wherever a Platform is attached it owns both the policy and the approval
- * directory, and the route refuses with 409. That message is surfaced verbatim
- * rather than reworded here, so the CLI cannot drift from what the server
- * actually said.
- *
- * The two directory writers live in this namespace rather than one of their
- * own because they are the same org-trust concept as the policy, gated by the
- * same mode rule against the same `--org`, and reached through the same
- * admin route file. Splitting them out would put half of "who may approve" in a
- * second top-level command with its own copy of that story. They are siblings
- * of the `directory` reader rather than subcommands under it, because turning
- * that leaf into a group would break `kici-admin trust-policy directory` for
- * anyone already running it.
+ * The directory writers share this namespace because they are the same
+ * org-trust concept under the same mode rule and route file. They are siblings
+ * of `directory`, not subcommands: turning that leaf into a group would break
+ * `kici-admin trust-policy directory` for existing users.
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
 /**
- * The policy shape the admin route returns.
- *
- * The policy fields are OPTIONAL because a **v0.5.0 independent** orchestrator
- * omits them: there, and only there, no policy row and no attached Platform
- * meant no policy was resolved at all. A v0.5.0 Platform-attached orchestrator
- * with no row still sent the fail-closed values. This build's route always sends
- * them in every mode, so the `unknown` fallbacks below — and the `no policy
- * stored` provenance wording — render only against that older independent
- * orchestrator.
+ * The policy fields are optional because a v0.5.0 independent orchestrator with
+ * no policy row omits them (a v0.5.0 Platform-attached one still sent the
+ * fail-closed values). This build always sends them, so the `unknown` fallbacks
+ * and `no policy stored` wording render only against that older orchestrator.
  */
 export interface TrustPolicyView {
     customerId: string;
@@ -47,41 +30,30 @@ export interface TrustPolicyView {
     effectiveDefault?: boolean;
     platformManaged?: boolean;
 }
-/** Render the policy as an aligned table, or as JSON when asked. */
 export declare function formatPolicy(policy: TrustPolicyView, format: string): string;
 /**
- * Warn that the fork switch in force silently drops pull requests.
- *
- * `ignore` is the one verdict that leaves nothing behind: no run row, no check
- * status, and nothing on the pull request itself. A maintainer who does not
- * already know the switch exists has no way to connect a fork PR that CI never
- * touched to a policy they never set, so the reader of `trust-policy show`
- * is told outright — with where to look for each individual drop.
- *
- * Returns the lines rather than printing them so the check is unit-testable.
+ * Warn that the fork switch in force silently drops pull requests. `ignore`
+ * leaves no run row, no check and nothing on the PR, so a maintainer cannot
+ * otherwise connect an untouched fork PR to a policy they never set. Returns the
+ * lines rather than printing them, so the check is unit-testable.
  */
 export declare function forkDropWarnings(policy: TrustPolicyView): string[];
 /**
- * Render the enforced hold window in the duration spelling `--approval-expiry`
- * takes (`72h`, `1h30m`). A policy carrying no window is an orchestrator old
- * enough to have resolved no policy at all (see {@link TrustPolicyView}).
+ * In the `--approval-expiry` spelling (`72h`, `1h30m`); see {@link TrustPolicyView}
+ * for `unknown`.
  */
 export declare function formatExpiry(policy: TrustPolicyView): string;
 /**
- * Turn CLI flags into a PATCH body, exiting on an unknown value.
- *
- * Validating here as well as on the route is deliberate: it turns a typo into a
- * clear local message naming the accepted values instead of a 400 from the API.
+ * Turn CLI flags into a PATCH body, exiting on an unknown value. It validates
+ * as well as the route so a typo names the accepted values instead of a 400.
  */
 export declare function buildPolicyPatch(opts: Record<string, string | undefined>): Record<string, string | number>;
-/** One identity link as the directory route reports it. */
 interface DirectoryIdentityLink {
     userId: string;
     provider: string;
     providerUsername: string;
     providerUserId?: string | null;
 }
-/** One operator-defined team as the directory route reports it. */
 interface DirectoryTeam {
     teamName: string;
     memberUserIds: string[];
@@ -98,56 +70,31 @@ interface DirectoryResponse {
     directory: TrustDirectoryView | null;
     platformManaged: boolean;
     /**
-     * Whether the orchestrator's Platform connection is up right now.
-     *
-     * Absent whenever there is no connection state to report, which never means
-     * "down": an independent orchestrator, the `PATCH` and `DELETE` responses,
-     * and an orchestrator that predates the field. {@link directoryStalenessNote}
-     * escalates only on an explicit `false`.
+     * Absent never means "down" (independent orchestrator, `PATCH`/`DELETE`
+     * responses, older orchestrator); {@link directoryStalenessNote} escalates
+     * only on an explicit `false`.
      */
     platformConnected?: boolean;
     /** Present on `directory-remove`: false when the member held nothing. */
     removed?: boolean;
 }
 /**
- * Say how long ago the directory was written, beside the timestamp itself.
- *
- * The absolute time is what the orchestrator stored and stays first, because it
- * is what correlates with a Platform-side change. The age is what an operator
- * would otherwise compute in their head at the exact moment they are least able
- * to — mid-incident, reading a refused approval.
- *
- * A timestamp this cannot parse renders alone rather than as `NaN`, and one in
- * the future renders as `0s` — the two clocks are different machines'.
+ * The stored timestamp stays first, since it correlates with Platform-side
+ * changes; the age saves the operator the math mid-incident. An unparsable
+ * timestamp renders alone, and a future one as `0s` (different machines' clocks).
  */
 export declare function formatDirectoryAge(updatedAt: string, now: number): string;
 /**
- * Explain what an old directory costs, and escalate when it cannot refresh.
- *
- * Only a Platform-attached orchestrator has an upstream to lag behind. An
- * independent one's directory is written by the operator reading this, so there
- * is nothing to be stale against and nothing to say.
- *
- * The connected wording is a `Note:` and the disconnected one a `Warning:`,
- * because the two ask for different things: one states a property of the design
- * the reader should know, the other names a condition they should act on. The
- * `Warning:` producer above, `forkDropWarnings`, is of the second kind.
- *
- * Returns the lines rather than printing them so the check is unit-testable,
- * matching `forkDropWarnings` above.
+ * Explain what an old directory costs, escalating when it cannot refresh. Only
+ * a Platform-attached orchestrator has an upstream to lag behind. Connected is a
+ * `Note:` (a design property); disconnected is a `Warning:` (act on it). Returns
+ * the lines, matching `forkDropWarnings`, so the check is unit-testable.
  */
 export declare function directoryStalenessNote(res: DirectoryResponse): string[];
 /**
- * Render the stored approval directory, or say why there is nothing to render.
- *
- * The directory is what `/kici approve` is resolved against: a commenter is
- * matched to a KiCI user through the identity links, that user's CI trust level
- * decides whether the approval counts, and a `{team}` clause is matched against
- * the team memberships. So the listing is per-entry rather than a set of counts
- * — "who can approve right now" is the question this command exists to answer.
- *
- * `now` is a parameter so the rendered age is deterministic under test; every
- * caller takes the default.
+ * `/kici approve` resolves against this directory (identity links → user, CI
+ * trust level → counts or not, teams → `{team}` clauses), so it lists per entry:
+ * the command answers "who can approve right now". `now` exists for tests.
  */
 export declare function formatDirectory(res: DirectoryResponse, format: string, now?: number): string;
 export declare function registerTrustPolicyCommands(program: Command, getClient: () => AdminApiClient): void;

package/dist/cli/commands/variable.d.ts

@@ -6,11 +6,9 @@
  *   kici-admin variable set    <orgId> <context> <key> [--value | --from-stdin | --from-file | --from-env | --prompt]
  *   kici-admin variable delete <orgId> <context> <key>
  *
- * Org-level context variables are plaintext-at-rest in the
- * orchestrator's DB; the dashboard write path is gated by the
- * `variables.set` / `variables.delete` switches in the dashboard-write
- * policy. This CLI is the always-available authority path when the
- * dashboard is disabled for either switch.
+ * Context variables are plaintext at rest. The dashboard write path is gated
+ * by the `variables.set` / `variables.delete` dashboard-write switches; this
+ * CLI is the always-available path when either is off.
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';

package/dist/cli/commands/workflow.d.ts

@@ -1,30 +1,9 @@
 /**
- * Workflow registration commands for kici-admin.
- *
- * Provides operator-facing read access to the workflow_registrations table
- * via the orchestrator's admin HTTP API. Use it instead of querying the
- * registration table with psql: every CLI subcommand here goes through
- * AdminApiClient and the existing /api/v1/admin/registrations route.
- *
- *   workflow list                List registered workflows (table or JSON)
- *
- * Filter flags map 1:1 to the route's query string params:
- *   --org              -> ?customerId=<id>
- *   --routing-key      -> ?routingKey=<key>
- *   --repo             -> ?repoIdentifier=<owner/repo>
- *   --trigger-type     -> ?triggerType=<type>
- *   --event            -> ?event=<eventName>
- *
- * Output:
- *   default            Aligned ASCII table with id, repo_identifier,
- *                      workflow_name, trigger_types, events, disabled
- *                      (plus org_id when --org is omitted)
- *   --json             Raw JSON.stringify of the full response
+ * `kici-admin workflow`: workflow_registrations through the admin API
+ * (/api/v1/admin/registrations), instead of psql. `list` filter flags map 1:1
+ * to the route's query params.
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
-/**
- * Register the `workflow` command group with kici-admin.
- */
 export declare function registerWorkflowCommands(program: Command, getClient: () => AdminApiClient): void;
 //# sourceMappingURL=workflow.d.ts.map

package/dist/cli/join.d.ts

@@ -1,11 +1,8 @@
 /**
- * `kici-admin join` command.
+ * `kici-admin join`: bootstrap an orchestrator from an existing cluster, via
+ * Platform relay or a direct peer, by receiving the configuration bundle sealed
+ * to this host and writing the env file it boots from.
  *
- * Bootstraps a new orchestrator by connecting to an existing cluster via
- * Platform relay or direct peer, receiving the configuration bundle sealed to
- * this host, and writing an env file the orchestrator boots from.
- *
- * Usage:
  *   kici-admin join --token kici_join_v1.xxx.yyy --platform wss://api.kici.dev/ws --api-key KEY
  *   kici-admin join --token kici_join_v1.xxx.yyy --peer https://orch-1:8080
  */

package/dist/cli/kici-admin.d.ts

@@ -1,14 +1,8 @@
 #!/usr/bin/env node
 /**
- * kici-admin CLI binary.
- *
- * Manages secrets, tokens, key rotation, and audit logs
- * through the orchestrator's admin HTTP API.
- *
- * Global options:
- *   --url / -u    Orchestrator URL (env: KICI_ADMIN_URL, default: http://localhost:4000)
- *   --token / -t  Admin API token (env: KICI_ADMIN_TOKEN, required)
- *   -V / --cli-version / --version  Print the CLI version (--version only before a command)
+ * kici-admin CLI binary. Global options: `--url`/`-u` (env KICI_ADMIN_URL,
+ * default http://localhost:4000), `--token`/`-t` (env KICI_ADMIN_TOKEN), and
+ * `-V`/`--cli-version`/`--version` (`--version` only before a command).
  *
  * A command that declares its own option under one of these flags (for
  * example `orchestrator upgrade --url`) owns that flag after its name; see
@@ -16,35 +10,23 @@
  */
 import { Command } from 'commander';
 /**
- * The version `kici-admin --version` reports.
- *
  * `scripts/build-service.mjs` defines `KICI_PKG_VERSION` for every orchestrator
- * build entry, `cli.js` included, so a shipped binary reports the package
- * version it was built from. The fallback covers a source run (tests, `tsx`),
- * where no bundler substituted the constant — the same shape `server.ts` and
- * `standalone.ts` use for `ORCHESTRATOR_VERSION`.
+ * build entry; the fallback covers a source run (tests, `tsx`), the same shape
+ * `server.ts` and `standalone.ts` use for `ORCHESTRATOR_VERSION`.
  */
 export declare const CLI_VERSION: string;
 /**
- * Build the kici-admin Commander program with every command group registered.
  * Exported so the surface registry can walk the real command tree without
- * parsing argv (no action runs during a tree walk, so `getClient` is
- * constructed but never invoked).
+ * parsing argv; no action runs, so `getClient` is never invoked.
  */
 export declare function buildProgram(): Command;
-/** Build the program and parse argv — the bin-shim entry point. */
+/** The bin-shim entry point. */
 export declare function runCli(argv?: string[]): void;
 /**
- * Canonicalize a path through any symlinks, falling back to a plain `resolve`
- * when the target does not exist on disk. The entry-point guard compares the
- * invoked script path against this module's own path; both sides must be fully
- * canonicalized or a symlinked invocation path silently fails the match. The
- * canonical example is the light-package launcher running
- * `node /tmp/.../kici-admin.cjs` on macOS, where `/tmp` is a symlink to
- * `/private/tmp`: `process.argv[1]` keeps the `/tmp` form while the bundle's
- * `import.meta.url` resolves to the real `/private/tmp` path, so an
- * un-canonicalized comparison is always false and the CLI exits 0 without
- * running any command.
+ * Resolve symlinks, falling back to `resolve` for a missing path. The
+ * entry-point guard needs both sides canonical: on macOS `/tmp` links to
+ * `/private/tmp`, so `process.argv[1]` and `import.meta.url` differ and the CLI
+ * would exit 0 without running any command.
  */
 export declare function canonicalize(p: string): string;
 //# sourceMappingURL=kici-admin.d.ts.map

package/dist/cli/lazy-deps/cache.d.ts

@@ -1,17 +1,4 @@
-/**
- * Cache directory management for lazy dependencies.
- *
- * Provides cache path resolution and cleanup.
- */
-/**
- * Get the base cache directory path for lazy dependencies.
- * Delegates to platform-detect's getCacheDir() for platform-appropriate paths.
- */
+/** Cache directory of the lazy dependencies. */
 export declare function getCacheBasePath(): string;
-/**
- * Remove all cached dependencies.
- *
- * @param cacheDir - Cache directory to clean (from getCacheBasePath())
- */
 export declare function cleanCache(cacheDir: string): void;
 //# sourceMappingURL=cache.d.ts.map

package/dist/cli/lazy-deps/downloader.d.ts

@@ -1,33 +1,10 @@
 /**
- * Lazy dependency downloader with integrity verification.
- *
- * Downloads, verifies SHA-256 integrity, extracts archives, and caches
- * dependencies for offline use. Uses atomic rename to prevent partial
- * downloads from polluting the cache.
+ * Lazy dependency downloader: SHA-256-verified, extracted and cached for
+ * offline use. An atomic rename keeps partial downloads out of the cache.
  */
 import type { LazyDep } from './registry.js';
-/**
- * Verify SHA-256 integrity of downloaded content.
- *
- * @param content - Downloaded file contents as a Buffer
- * @param expectedHash - Expected SHA-256 hex digest
- * @throws If the hash does not match
- */
+/** @throws If the SHA-256 hex digest does not match. */
 export declare function verifyIntegrity(content: Buffer, expectedHash: string): void;
-/**
- * Ensure a lazy dependency is available in the cache.
- *
- * Flow:
- * 1. Check if already cached -> return path immediately
- * 2. Download from URL to temp directory
- * 3. Verify SHA-256 integrity
- * 4. Extract archive
- * 5. Atomic rename to final cache location
- * 6. Return path to cached dependency
- *
- * @param dep - Dependency metadata from the registry
- * @param cacheDir - Base cache directory
- * @returns Path to the cached dependency
- */
+/** Return the cached path, downloading, verifying and extracting on a miss. */
 export declare function ensureDep(dep: LazyDep, cacheDir: string): Promise<string>;
 //# sourceMappingURL=downloader.d.ts.map

package/dist/cli/lazy-deps/registry.d.ts

@@ -1,42 +1,22 @@
-/**
- * Metadata registry for lazy dependencies.
- *
- * Each entry describes a downloadable dependency with platform/arch variants,
- * URLs, SHA-256 integrity hashes, and extraction details.
- */
-/** Metadata for a single lazy dependency variant. */
+/** Metadata registry for lazy dependencies, one entry per platform/arch variant. */
 export interface LazyDep {
-    /** Dependency name (e.g., "rolldown", "shawl"). */
     name: string;
-    /** Version string. */
     version: string;
-    /** Target Node.js platform. */
     platform: NodeJS.Platform;
-    /** Target architecture (x64, arm64). */
     arch: string;
-    /** Download URL. */
     url: string;
-    /** Expected SHA-256 hash of the downloaded archive. */
+    /** Of the downloaded archive. */
     sha256: string;
     /** Relative path inside the archive to the binary/directory. */
     extractPath: string;
-    /** Archive type for extraction. */
     archiveType: 'tar.gz' | 'zip' | 'binary';
 }
-/**
- * Platform+arch key used for variant lookup.
- * Format: `${platform}-${arch}` (e.g., "linux-x64", "darwin-arm64").
- */
 type VariantKey = `${NodeJS.Platform}-${string}`;
-/** Registry of all lazy dependencies keyed by name, then platform-arch. */
+/** Keyed by name, then platform-arch. */
 export declare const LAZY_DEPS: Record<string, Record<VariantKey, LazyDep>>;
 /**
- * Get dependency metadata for the current (or specified) platform and architecture.
- *
- * @param name - Dependency name (e.g., "rolldown", "shawl")
- * @param platform - Override platform (default: os.platform())
- * @param arch - Override arch (default: process.arch)
- * @throws If the dependency or variant is not found in the registry
+ * Platform and arch default to the running process.
+ * @throws If the dependency or variant is not in the registry.
  */
 export declare function getDepMetadata(name: string, platform?: NodeJS.Platform, arch?: string): LazyDep;
 export {};

package/dist/cli/local-github-ingress-url.d.ts

@@ -1,14 +1,12 @@
 /**
- * Build the orchestrator's OWN direct GitHub ingress URL for a source, from
- * the configured public base (`KICI_WEBHOOK_PUBLIC_URL`). Returns null when no
- * public base is configured (the CLI then prints an honest "set
- * KICI_WEBHOOK_PUBLIC_URL" note instead of a fabricated URL).
+ * The orchestrator's OWN per-source GitHub ingress URL under
+ * `KICI_WEBHOOK_PUBLIC_URL`. Null without it, so the CLI prints a "set
+ * KICI_WEBHOOK_PUBLIC_URL" note instead of a fabricated URL.
  */
 export declare function buildLocalGithubIngressUrl(webhookPublicUrl: string | undefined, orgId: string, sourceId: string): string | null;
 /**
- * Build the orchestrator's OWN org-scoped GitHub App ingress URL
- * (`<base>/webhook/<orgId>/github`), served by the org-scoped direct route.
- * Null when no public base is configured.
+ * The orchestrator's OWN org-scoped GitHub App ingress URL
+ * (`<base>/webhook/<orgId>/github`). Null without a public base.
  */
 export declare function buildLocalGithubAppIngressUrl(webhookPublicUrl: string | undefined, orgId: string): string | null;
 //# sourceMappingURL=local-github-ingress-url.d.ts.map

package/dist/cli/loopback-callback.d.ts

@@ -1,14 +1,13 @@
 /**
- * Ephemeral localhost server that backs the GitHub App manifest setup flow.
- * Serves the auto-submitting manifest form at `/` and catches GitHub's redirect
- * (`/cb?code=…&state=…`). The setup code is exchanged for credentials in the
- * CLI, never on the Platform — this loopback keeps the whole flow on the
- * orchestrator host (mirrors the `kici login` browser-OAuth loopback).
+ * Ephemeral localhost server for the GitHub App manifest flow: serves the
+ * auto-submitting form at `/` and catches GitHub's `/cb?code=…&state=…`
+ * redirect. The setup code is exchanged in the CLI, never on the Platform, so
+ * the whole flow stays on the orchestrator host (like `kici login`'s loopback).
  */
 export interface ManifestLoopback {
-    /** http://127.0.0.1:<port>/cb — GitHub redirect target. */
+    /** http://127.0.0.1:<port>/cb */
     redirectUrl: string;
-    /** http://127.0.0.1:<port>/ — serves the manifest form. */
+    /** http://127.0.0.1:<port>/ */
     formUrl: string;
     waitForCode(timeoutMs: number): Promise<{
         code: string;

package/dist/cli/open-browser.d.ts

@@ -1,12 +1,8 @@
 /**
- * Open a URL in the operator's default browser, best-effort. Used by the GitHub
- * App manifest setup flow to launch the create / install pages. Failure is
- * non-fatal — the caller always prints the URL too, so a headless host (or a
- * blocked launcher) just falls back to copy-paste.
- *
- * `KICI_BROWSER_CMD` overrides the launcher: `none` suppresses it entirely
- * (automated tests / headless capture), any other value is run with `{url}` substituted —
- * mirroring the `kici login` convention.
+ * Best-effort: the caller always prints the URL too, so a headless host falls
+ * back to copy-paste. `KICI_BROWSER_CMD` overrides the launcher as in
+ * `kici login`: `none` suppresses it (tests, headless capture), any other
+ * value runs with `{url}` substituted.
  */
 export declare function openBrowserBestEffort(url: string): void;
 //# sourceMappingURL=open-browser.d.ts.map

package/dist/cli/root-option-routing.d.ts

@@ -1,33 +1,25 @@
 /**
- * Decide which command each root-option token in a kici-admin argv belongs to.
+ * Decides which command each root-option token in a kici-admin argv belongs to.
  *
- * Commander matches a program option anywhere in argv: the root's own
- * `parseOptions` consumes `-u, --url`, `-t, --token` and `-V, --cli-version`
- * even after a command name. That lets an operator put a global option after
- * the command (`kici-admin runs list -u <url>`), but on its own it would also
- * take an option away from any command that declares one with the same flag,
- * such as `orchestrator upgrade --url <archive-url>` or
- * `join --token <join-token>`.
+ * Commander's root `parseOptions` consumes `-u, --url`, `-t, --token` and
+ * `-V, --cli-version` anywhere in argv. That allows `kici-admin runs list -u
+ * <url>`, but would also steal a same-named command option such as
+ * `orchestrator upgrade --url <archive-url>` or `join --token <join-token>`.
  *
- * {@link routeRootArgs} prepares the argv for the root's `parseOptions`:
+ * {@link routeRootArgs} prepares the argv for the root:
  *
- * - A flag that the command being run declares, and that also names a root
- *   option, belongs to that command when it comes after the command's name. It
- *   is hidden from the root behind an opaque stand-in token, which the root
- *   classifies as an unknown option and so hands on to the subcommand; the
- *   stand-ins are mapped back to the original tokens before the subcommand
- *   parses them.
- * - `--version` before the first command name is the root's version flag. The
- *   root cannot register `--version` itself (`orchestrator upgrade` and
- *   `agent upgrade` own `--version <version>`), so it is rewritten to the
- *   registered `--cli-version`. After a command name it is left alone.
- *
- * - The value of a command option, when it is shaped like an option (`-uP4ss`,
- *   `--url`), is hidden from the root the same way, so the root does not read
- *   it as one of its own flags.
+ * - A root-named flag that the running command declares, after the command's
+ *   name, belongs to the command. An opaque stand-in hides it; the root treats
+ *   the stand-in as unknown and passes it on, and it is restored before the
+ *   subcommand parses.
+ * - `--version` before the first command name becomes `--cli-version`: the
+ *   root cannot register `--version` (`orchestrator upgrade` and
+ *   `agent upgrade` own `--version <version>`). After a command name it stays.
+ * - An option-shaped command option value (`-uP4ss`, `--url`) is hidden the
+ *   same way.
  *
  * Every other token reaches the root unchanged, so a root option after a
- * command that does not declare that flag still sets the global option.
+ * command that does not declare it still sets the global option.
  */
 import type { Command } from 'commander';
 /** The flag the root registers its version option under. */
@@ -35,12 +27,8 @@ export declare const ROOT_VERSION_FLAG = "--cli-version";
 /** The root's argv, routed, and the map from each stand-in back to its token. */
 export interface RoutedRootArgs {
     readonly args: string[];
-    /** Map a token from the root's parse result back to the original token. */
     readonly restore: (token: string) => string;
 }
-/**
- * Route a kici-admin argv (the user arguments, without `node` and the script)
- * for the root command's `parseOptions`. See the module comment.
- */
+/** `args` excludes `node` and the script. See the module comment. */
 export declare function routeRootArgs(root: Command, args: readonly string[]): RoutedRootArgs;
 //# sourceMappingURL=root-option-routing.d.ts.map