@kici-dev/orchestrator 0.17.0 → 0.19.0

package/dist/cli/service/types.d.ts

@@ -1,15 +1,10 @@
 /**
- * Shared types for the service management system.
- *
- * Defines the ServiceManager interface contract and supporting types
- * used by all platform-specific service managers (systemd, launchd,
- * Windows Services, Docker/Podman Compose).
+ * The ServiceManager contract shared by every platform driver (systemd,
+ * launchd, Windows Services, Docker/Podman Compose).
  */
-/** Supported service platforms. */
 export type ServicePlatform = 'systemd' | 'launchd' | 'windows' | 'compose';
 /** Restart behavior on service failure. */
 export interface RestartPolicy {
-    /** Whether to restart on failure. */
     enabled: boolean;
     /** Backoff delays in seconds between restart attempts. */
     delays: number[];
@@ -21,199 +16,153 @@ export interface RestartPolicy {
 /** Default restart policy: backoff 1s, 5s, 15s, 30s; max 5 failures in 5 minutes. */
 export declare const DEFAULT_RESTART_POLICY: RestartPolicy;
 /**
- * The display name and description a component's service is registered with.
- * `install` and every upgrade that registers a service again use it, so an
- * upgraded registration carries the same text as a fresh one.
+ * Shared by `install` and every re-registering upgrade, so an upgraded
+ * registration carries the same text as a fresh one.
  */
 export declare const SERVICE_TEXT: Record<'orchestrator' | 'agent', {
     displayName: string;
     description: string;
 }>;
-/** Configuration for installing a service. */
 export interface ServiceConfig {
     /** Service identifier (e.g., "kici-orchestrator"). */
     name: string;
-    /** Human-readable display name. */
     displayName: string;
-    /** Service description. */
     description: string;
-    /** Path to the executable binary. */
     executablePath: string;
     /**
-     * Arguments passed to {@link executablePath} in the unit's run command.
-     * For a Node-launched server this is the resolved server script path
-     * (e.g. `["/opt/kici/dist/server.js"]`); empty for a self-launching binary.
+     * Arguments after {@link executablePath} in the unit's run command: the
+     * resolved server script path for a Node-launched server
+     * (e.g. `["/opt/kici/dist/server.js"]`), empty for a self-launching binary.
      */
     args?: string[];
     /**
-     * Node bin dir to guarantee on the generated unit's PATH.
-     *
-     * The bare-metal scaler spawns the kici-agent node script, so `node` must be
-     * findable on the orchestrator's PATH. When the service is installed with an
-     * explicit `--binary` (a wrapper script), {@link executablePath} points at the
-     * wrapper, not node — so its dirname is the wrong directory. The install path
-     * sets this to `path.dirname(process.execPath)` (the node actually running the
-     * install command), which is the correct node bin dir regardless of `--binary`.
-     * Optional: lifecycle commands that don't regenerate the unit leave it unset,
-     * and the unit generators fall back to `dirname(executablePath)`.
+     * Node bin dir to guarantee on the generated unit's PATH, because the
+     * bare-metal scaler spawns the kici-agent node script. With an explicit
+     * `--binary` wrapper, {@link executablePath} is the wrapper, so its dirname
+     * is wrong; install sets this to `path.dirname(process.execPath)`. Lifecycle
+     * commands that don't regenerate the unit leave it unset, and the generators
+     * fall back to `dirname(executablePath)`.
      */
     nodeBinDir?: string;
     /** Path to the environment file (.env). */
     envFilePath: string;
-    /** Working directory for the service process. */
     workingDirectory: string;
-    /** User to run the service as (Unix only). */
+    /** Unix only. */
     user?: string;
     /** Whether this is a user-level (non-root) service. */
     isUserLevel: boolean;
-    /** Restart policy configuration. */
     restartPolicy: RestartPolicy;
     /**
-     * Which KiCI component this service runs. Embedded in the unit (X-KiCI-Component
-     * for systemd, KiCIComponent for launchd, dev.kici.component label for compose,
-     * description prefix for Windows) so per-driver `list()` scans can classify
-     * a discovered unit without relying on naming conventions.
-     *
-     * Optional during lifecycle ops that don't regenerate the unit; required on install.
+     * Embedded in the unit (X-KiCI-Component for systemd, KiCIComponent for
+     * launchd, dev.kici.component label for compose, description prefix for
+     * Windows) so `list()` classifies a unit without naming conventions.
+     * Required on install; optional for ops that don't regenerate the unit.
      */
     component?: 'orchestrator' | 'agent';
     /**
-     * The deploy folder that holds this instance's manifest. Embedded in the unit
+     * The deploy folder holding this instance's manifest. Embedded in the unit
      * (X-KiCI-InstanceDir for systemd, KiCIInstanceDir for launchd,
      * dev.kici.instance-dir for compose, a description suffix for Windows) so
-     * per-driver `list()` scans can recover the deploy folder straight from the
-     * init system — making the instance index a true rebuildable cache rather
-     * than the sole source of the name→folder mapping.
-     *
-     * Optional during lifecycle ops that don't regenerate the unit; set on install.
+     * `list()` recovers it from the init system, making the instance index a
+     * rebuildable cache rather than the sole name→folder mapping. Set on
+     * install; optional for ops that don't regenerate the unit.
      */
     instanceDir?: string;
 }
 /**
- * The launch command an installed init unit will actually execute, parsed
- * back out of the unit/plist/service registration. `execPath` is the binary
- * the init system runs (for a Node-launched server, the node binary); `args`
- * are everything after it (for a Node-launched server, the resolved entry
- * script path). Returned by {@link ServiceManager.readLaunchSpec}.
+ * The launch command an installed unit executes, parsed back out of the
+ * unit/plist/service registration. For a Node-launched server `execPath` is
+ * the node binary and `args` the resolved entry script path.
  */
 export interface LaunchSpec {
     execPath: string;
     args: string[];
 }
-/** Current state of a service. */
 export type ServiceState = 'running' | 'stopped' | 'failed' | 'unknown';
-/** Runtime status information for a service. */
 export interface ServiceStatus {
-    /** Current service state. */
     state: ServiceState;
-    /** Process ID if running. */
     pid?: number;
-    /** Uptime in seconds if running. */
+    /** Seconds. */
     uptime?: number;
-    /** ISO timestamp when the service last started. */
+    /** ISO timestamp of the last start. */
     startedAt?: string;
 }
-/** Options for the logs command. */
 export interface LogOptions {
-    /** Show logs since this duration (e.g., "1h", "30m"). */
+    /** A duration (e.g., "1h", "30m"). */
     since?: string;
-    /** Filter by log level. */
     level?: 'error' | 'warn' | 'info';
     /** Output as JSON lines. */
     json?: boolean;
-    /** Follow (tail -f) mode. */
+    /** Tail -f mode. */
     follow?: boolean;
 }
-/** Result of a per-driver discovery scan. */
 export interface DiscoveredInstance {
     name: string;
-    /** Always set; the driver knows its own platform. */
     platform: ServicePlatform;
     isUserLevel: boolean;
-    /** The component this unit belongs to, decoded from the unit's KiCI marker. */
+    /** Decoded from the unit's KiCI marker. */
     component: 'orchestrator' | 'agent';
     /**
-     * The deploy folder recovered from the unit's KiCI instance-dir marker, when
-     * the unit carries one. Undefined for units installed before the marker
-     * existed (the index cache remains the fallback for those).
+     * From the unit's instance-dir marker. Undefined for units installed before
+     * the marker existed; the index cache is their fallback.
      */
     instanceDir?: string;
 }
-/**
- * Interface that all platform-specific service managers must implement.
- *
- * Each method operates on a service identified by the ServiceConfig.
- */
 export interface ServiceManager {
     /**
-     * The platform this driver manages. Discovery scans several drivers at once
-     * (a host can hold both a systemd install and a compose install), and each
-     * driver's scan is authoritative only over its own platform's index rows —
-     * including when that scan comes back empty. An empty scan carries no row to
-     * read a platform off, so the driver states it here.
+     * Discovery scans several drivers at once, and each scan is authoritative
+     * only over its own platform's index rows, even when empty. An empty scan has
+     * no row to read a platform off, so the driver states it here.
      */
     readonly platform: ServicePlatform;
     /**
-     * Whether this driver can inspect its registry right now. A driver that
-     * answers `false` is excluded from discovery, and the index rows for its
-     * platform are left untouched — an empty scan from a driver whose registry is
-     * unreachable is not evidence that the instances are gone.
+     * Whether this driver can inspect its registry now. On `false` the driver is
+     * excluded from discovery and its platform's index rows are left untouched:
+     * an empty scan of an unreachable registry is not evidence the instances
+     * are gone.
      *
-     * Absent means always available: an init system a driver targets is either
-     * present or the driver is not a candidate for the host at all — which is
-     * why the two filesystem-backed drivers (systemd, launchd) omit it and let
-     * an unreadable unit directory throw out of `list()` instead. Compose and
-     * Windows implement it because their registry is a service that can be down
-     * or hung while the host and the client binary are fine.
+     * Absent means always available. systemd and launchd omit it and let an
+     * unreadable unit directory throw out of `list()`; compose and Windows
+     * implement it because their registry is a service that can be down or hung
+     * while the host and client binary are fine.
      *
-     * A driver that implements it MUST probe the registry itself, not the client
-     * that talks to it: `<runtime> compose version` and `where powershell` both
-     * answer on a host whose registry is down, which is the shape that reported
-     * available, scanned empty, and pruned live rows.
+     * An implementation MUST probe the registry itself, not its client:
+     * `<runtime> compose version` and `where powershell` both answer while the
+     * registry is down, which once reported available, scanned empty, and
+     * pruned live rows.
      *
-     * Discovery calls this INSIDE its own error handling, so a probe that
-     * rejects drops only this driver.
+     * Discovery calls this INSIDE its own error handling, so a rejecting probe
+     * drops only this driver.
      */
     available?(): Promise<boolean>;
-    /** Install and register the service with the init system. */
     install(config: ServiceConfig): Promise<void>;
     /** Remove the service registration (preserves config/data). */
     uninstall(config: ServiceConfig): Promise<void>;
-    /** Start the service. */
     start(config: ServiceConfig): Promise<void>;
-    /** Stop the service. */
     stop(config: ServiceConfig): Promise<void>;
-    /** Restart the service (stop + start). */
+    /** Stop + start. */
     restart(config: ServiceConfig): Promise<void>;
-    /** Get the current service status. */
     status(config: ServiceConfig): Promise<ServiceStatus>;
-    /** Stream or display service logs. */
     logs(config: ServiceConfig, options: LogOptions): Promise<void>;
-    /** Check if the service is currently installed/registered. */
     isInstalled(config: ServiceConfig): Promise<boolean>;
     /**
-     * Discover KiCI-managed services on this platform. The driver enumerates
-     * its native registry (systemctl/launchctl/sc/podman) and decodes each
-     * unit's component marker. Used by resolve.ts#listInstances to reconcile
-     * the index cache against ground truth.
-     *
-     * `isUserLevel` selects user vs system scope on platforms where that matters
-     * (systemd, launchd); ignored on Windows/compose.
+     * Enumerate KiCI-managed services in the native registry
+     * (systemctl/launchctl/sc/podman), decoding each unit's component marker.
+     * resolve.ts#listInstances reconciles the index cache against it.
+     * `isUserLevel` selects scope on systemd and launchd; ignored elsewhere.
      *
-     * An empty array means the registry answered and holds no KiCI services —
-     * the reconcile prunes this platform's index rows on that basis. A driver
-     * that could not read its registry must therefore throw rather than return
-     * `[]`; discovery drops a throwing driver exactly as it drops one whose
-     * `available()` said false.
+     * An empty array means the registry answered with no KiCI services, and the
+     * reconcile prunes this platform's index rows. A driver that could not read
+     * its registry must throw rather than return `[]`; discovery drops a
+     * throwing driver as it drops one whose `available()` said false.
      */
     list(isUserLevel: boolean): Promise<DiscoveredInstance[]>;
     /**
-     * Read the launch command the installed unit will actually execute, parsed
-     * back out of the init system's own record (systemd ExecStart, launchd
-     * ProgramArguments, windows service binPath). Returns null when the unit is
-     * not installed, its launch spec can't be parsed, or the platform has no
-     * node-launched entry to resolve (compose). Used by the npm-source upgrade to
-     * verify the version that will run before reporting success.
+     * Parse the launch command from the init system's own record (systemd
+     * ExecStart, launchd ProgramArguments, windows service binPath). Null when
+     * the unit is not installed, its spec can't be parsed, or the platform has
+     * no node-launched entry (compose). The npm-source upgrade verifies the
+     * version that will run with it before reporting success.
      */
     readLaunchSpec(config: ServiceConfig): Promise<LaunchSpec | null>;
 }

package/dist/cli/service/windows-acl.d.ts

@@ -1,21 +1,16 @@
 /**
- * Restricting a Windows service's env file to the service account and to
- * Administrators.
+ * Restrict a Windows service's env file to LocalSystem and Administrators.
  *
- * Node maps a file mode onto Windows by toggling the read-only attribute and
- * changes no ACL, so ENV_FILE_MODE protects nothing there. The instance folder
- * under C:\ProgramData\kici\ inherits read access for BUILTIN\Users from
- * C:\ProgramData. Its ACL is replaced with full control for LocalSystem (the
- * account the shawl service runs as) and Administrators, inherited by
- * everything created in it: the env file, the temporary file a secure write
- * stages it through, and the service logs are unreadable to other accounts
- * from the moment they exist.
+ * On Windows a Node file mode only toggles the read-only attribute, so
+ * ENV_FILE_MODE protects nothing, and the instance folder under
+ * C:\ProgramData\kici\ inherits BUILTIN\Users read. The folder ACL becomes
+ * inherited full control for LocalSystem (the shawl service account) and
+ * Administrators, so the env file, a secure write's temp file and the logs are
+ * private from the moment they exist.
  *
- * Every call passes `/L` and none recurses, so icacls acts on the folder and on
- * the env file themselves and never on what a link there points at. A
- * recursive `/reset` or `/setowner` descends into the target of a junction or
- * of a symbolic link, even with `/L`, and rewrites the ACL of the files there.
- * The new folder ACL still reaches every entry that inherits from the folder.
+ * Every call passes `/L` and none recurses: a recursive `/reset` or
+ * `/setowner` follows a junction or symlink even with `/L` and rewrites the
+ * ACLs at its target. The folder ACL still reaches every inheriting entry.
  */
 /** NT AUTHORITY\SYSTEM, the account a shawl service runs as. */
 export declare const LOCAL_SYSTEM_SID = "S-1-5-18";
@@ -24,17 +19,15 @@ export declare const ADMINISTRATORS_SID = "S-1-5-32-544";
 /** Runs `icacls` with the given arguments; throws when it fails. */
 export type IcaclsRunner = (args: string[]) => void;
 /**
- * The icacls arguments that remove every inherited ACE from `dir` and grant
- * full control, inherited by files and folders, to LocalSystem and
- * Administrators. SIDs rather than names, so a localized Windows resolves them.
+ * Drop every inherited ACE from `dir` and grant inherited full control to
+ * LocalSystem and Administrators, by SID so a localized Windows resolves them.
  */
 export declare function restrictDirArgs(dir: string): string[];
 /** The icacls arguments that reset `file` to inherit only from its folder. */
 export declare function resetFileArgs(file: string): string[];
 /**
- * Restrict the folder that holds `envFilePath`, then reset an existing env
- * file to inherit only from it, which also drops any explicit ACE on the file.
- * Run it before the first secret is written into the folder.
+ * Restrict the env file's folder, then reset an existing env file to inherit
+ * only from it (dropping any explicit ACE). Run before the first secret is written.
  */
 export declare function restrictEnvFileAccess(envFilePath: string, run?: IcaclsRunner, exists?: (filePath: string) => boolean): void;
 //# sourceMappingURL=windows-acl.d.ts.map

package/dist/cli/service/windows-env-file.d.ts

@@ -1,45 +1,27 @@
 /**
  * Whether a Windows service launch runs a release that reads KICI_ENV_FILE.
  *
- * A Windows service is registered with the path of its env file in
- * KICI_ENV_FILE, never with the values in the file: any local account reads the
- * command line of a service with `sc.exe qc`. A release from before
- * KICI_ENV_FILE ignores the path and starts without its configuration, and the
- * only registration that would run it puts the values back on the command line.
- * So every command that registers a Windows service, or switches one to another
- * release, refuses such a release before it changes anything.
- */
-/**
- * The `@kici-dev/shared` export that loads the env file KICI_ENV_FILE names. A
- * release publishes it, and imports it first in each entry, only when it reads
- * KICI_ENV_FILE.
+ * A Windows service gets its env file's path, never its values: any local
+ * account reads a service command line with `sc.exe qc`. An older release
+ * ignores the path, and running it would put the values back on the command
+ * line, so every command that registers or switches a Windows service refuses
+ * such a release before it changes anything.
  */
+/** Published, and imported first in each entry, only by a release that reads KICI_ENV_FILE. */
 export declare const ENV_FILE_LOADER_EXPORT = "./load-service-env-file";
-/**
- * The file that names a launch's release: the npm entry among its arguments,
- * or else the executable itself.
- */
+/** The npm entry among the arguments, or else the executable itself. */
 export declare function launchedRelease(launch: {
     executablePath: string;
     args?: string[];
 }): string;
 /**
- * Whether the process a Windows service launch starts reads KICI_ENV_FILE.
- *
- * A KiCI package runs as `<dir>\<name>.cmd` beside its bundle
- * `<dir>\lib\<name>.cjs`, which names KICI_ENV_FILE when the release reads it.
- * An npm install runs node with the `@kici-dev/<component>/dist/<entry>.js`
- * entry, which then imports the env-file loader. Any other launch, such as a
- * batch file with no KiCI bundle beside it or a custom executable, is taken to
- * read it.
+ * A KiCI package runs `<dir>\<name>.cmd` beside the bundle `<dir>\lib\<name>.cjs`;
+ * an npm install runs node with `@kici-dev/<component>/dist/<entry>.js`. Any
+ * other launch (no KiCI bundle beside it, a custom executable) is taken to read it.
  */
 export declare function launchReadsEnvFile(launch: {
     executablePath: string;
     args?: string[];
 }): boolean;
-/**
- * Why a Windows service may not run `release`, a release from before
- * KICI_ENV_FILE, and what the operator can do instead.
- */
 export declare function envFileRefusal(release: string, envFilePath: string): string;
 //# sourceMappingURL=windows-env-file.d.ts.map

package/dist/cli/service/windows.d.ts

@@ -1,34 +1,21 @@
 /**
- * Windows service manager using shawl + sc.exe.
- *
- * Uses shawl (https://github.com/mtkennerly/shawl) to wrap the KiCI
- * executable as a Windows service. Shawl is downloaded as a lazy
- * dependency on first use. Service configuration (auto-start, recovery)
- * is handled via sc.exe.
+ * Windows service manager: shawl (https://github.com/mtkennerly/shawl), a lazy
+ * dependency downloaded on first use, wraps the executable as a service, and
+ * sc.exe configures auto-start and recovery.
  */
 import type { ServiceManager, ServiceConfig, ServiceStatus, LogOptions, DiscoveredInstance, LaunchSpec } from './types.js';
 export declare class WindowsServiceManager implements ServiceManager {
     readonly platform: 'windows';
     /**
-     * True when the service registry this driver reads actually answers.
-     *
-     * Probes the same subsystem `list()` reads — CIM's `Win32_Service` — with a
-     * filter that cannot match, so a healthy host answers with an empty result
-     * set and exits 0. It deliberately does NOT probe for the presence of
-     * `powershell` or `sc.exe`: a client-only probe is exactly the defect this
-     * driver's compose sibling had, where the client answered on a host whose
-     * registry was down and the empty scan then pruned live rows.
-     *
-     * A name filter rather than a well-known service name: no service is assumed
-     * to exist, and no display string is parsed, so the probe carries no locale
-     * or Windows-edition assumption.
+     * True when the service registry `list()` reads (CIM `Win32_Service`)
+     * answers: a filter that cannot match returns an empty set and exit 0.
+     * It does NOT probe for `powershell` or `sc.exe`: a client-only probe let the
+     * compose sibling answer while its registry was down, and the empty scan
+     * then pruned live rows. A name filter assumes no service exists and parses
+     * no display string, so the probe has no locale or edition assumption.
      */
     available(): Promise<boolean>;
-    /**
-     * Check whether a Windows service is currently registered.
-     * `sc.exe query` exits non-zero (execSync throws) when the service does
-     * not exist; exit 0 means it exists (possibly pending-delete).
-     */
+    /** `sc.exe query` exits 0 when the service exists, possibly pending-delete. */
     private serviceExists;
     /** The service's STATE code from `sc.exe query`, or undefined when the query fails. */
     private queryStateCode;
@@ -42,14 +29,11 @@ export declare class WindowsServiceManager implements ServiceManager {
     isInstalled(config: ServiceConfig): Promise<boolean>;
     list(isUserLevel: boolean): Promise<DiscoveredInstance[]>;
     /**
-     * The command line a service is registered with.
-     *
-     * `sc.exe qc` answers most registrations, but it fails (error 1734) once the
-     * line is longer than about 4000 characters, as an older CLI's registration
-     * with every env-file value on it can be. It also prints in the console code
-     * page, so a path outside ASCII, such as one under the profile of a user
-     * named Jürgen, decodes to U+FFFD. In either case the registry value it reads
-     * (`ImagePath`) is read through PowerShell, printed as UTF-8.
+     * The registered command line. `sc.exe qc` fails (error 1734) past about
+     * 4000 characters, as an older CLI's registration with every env-file value
+     * can be, and prints in the console code page, so a non-ASCII path (a user
+     * named Jürgen) decodes to U+FFFD. Either case reads the `ImagePath`
+     * registry value through PowerShell as UTF-8.
      */
     private registeredCommandLine;
     readLaunchSpec(config: ServiceConfig): Promise<LaunchSpec | null>;

package/dist/cli/webhook-url-notes.d.ts

@@ -1,13 +1,11 @@
 /**
- * The text the CLI prints when the orchestrator returns no webhook URL. Shared
- * by `kici-admin source add` and the manifest setup flow, so each
- * `WebhookUrlNote` reads the same in both.
+ * Text for a missing webhook URL, shared by `kici-admin source add` and the
+ * manifest setup flow.
  */
 import { WebhookUrlNote } from '../sources/webhook-url-resolvers.js';
 /**
- * Short reason shown in `(unavailable — <reason>)` when no webhook URL could be
- * resolved. Takes a plain string too, because an orchestrator of another
- * version can send a note this CLI does not know.
+ * The reason in `(unavailable — <reason>)`. Takes a plain string: another
+ * orchestrator version can send a note this CLI does not know.
  */
 export declare function webhookNoteReason(note: WebhookUrlNote | string | undefined): string;
 /** Actionable next-step hint paired with {@link webhookNoteReason}. */

package/dist/cli/wizard/agent-wizard.d.ts

@@ -1,24 +1,13 @@
 /**
- * Interactive wizard for agent service setup.
- *
- * Walks the user through essential agent configuration
- * (orchestrator URL, token, labels). Returns a config object
- * that the install command uses to write the env file.
+ * Interactive agent setup: the install command writes the env file from the
+ * result.
  */
-/** Config produced by the agent wizard. */
 interface AgentInstallConfig {
     orchestratorUrl: string;
     agentToken: string;
     labels: string[];
 }
-/**
- * Run the interactive agent setup wizard.
- *
- * Asks only essential questions:
- * 1. Orchestrator URL
- * 2. Agent authentication token
- * 3. Labels (optional, comma-separated)
- */
+/** Asks only for the orchestrator URL, the agent token and optional comma-separated labels. */
 export declare function runAgentWizard(): Promise<AgentInstallConfig>;
 export {};
 //# sourceMappingURL=agent-wizard.d.ts.map

package/dist/cli/wizard/orchestrator-wizard.d.ts

@@ -1,10 +1,4 @@
-/**
- * Interactive wizard for orchestrator service setup.
- *
- * Walks the user through essential configuration (mode, DB URL,
- * port, secrets key) with sensible defaults. Returns a config
- * object that the install command uses to write the env file.
- */
+/** Interactive orchestrator setup wizard; install writes its result to the env file. */
 import { OrchestratorMode } from '@kici-dev/engine';
 /** A GitHub App source the wizard collected, to be added once the orchestrator is running. */
 export interface OrchestratorSourceHint {
@@ -14,16 +8,13 @@ export interface OrchestratorSourceHint {
     privateKeyPath: string;
     webhookSecret?: string;
 }
-/** Inputs the install command threads into the wizard. */
 export interface OrchestratorWizardOptions {
     /**
-     * Preselect the operating-mode prompt (from `orchestrator install --mode`).
-     * Defaults to `hybrid`, the recommended shape: the Platform relay plus this
-     * orchestrator's own direct webhook ingress.
+     * Preselected mode (`orchestrator install --mode`). Defaults to `hybrid`:
+     * the Platform relay plus this orchestrator's own direct webhook ingress.
      */
     defaultMode?: OrchestratorMode;
 }
-/** Config produced by the orchestrator wizard. */
 interface OrchestratorInstallConfig {
     mode: OrchestratorMode;
     databaseUrl: string;
@@ -34,43 +25,27 @@ interface OrchestratorInstallConfig {
     platformToken?: string;
     /** Public base URL of this orchestrator's own ingress (required in observed mode). */
     webhookPublicUrl?: string;
-    /** GitHub App source to add after the orchestrator is running. */
     source?: OrchestratorSourceHint;
 }
 /**
- * Render the post-install next-step lines for adding the collected GitHub App
- * source. The primary command inlines the webhook secret (copy-paste-runnable);
- * when a secret is present a "Secure alternative" pipes it via stdin so the
- * secret stays out of the process argument list (printf is a shell builtin, and
- * kici-admin receives the value on stdin — so it never appears in `ps`). Returns
- * indented lines for the install "Next steps" block.
+ * "Next steps" lines for adding the collected GitHub App source. The primary
+ * command inlines the webhook secret; a "Secure alternative" pipes it through
+ * stdin from the `printf` builtin, so it never appears in `ps`.
  */
 export declare function formatSourceAddHint(hint: OrchestratorSourceHint): string[];
 /**
- * Check that the private-key path the operator gave is readable. Returns a
- * warning string when it is not, so the wizard can surface it without aborting
- * the whole install — the source is opt-in and secondary to the orchestrator.
+ * A warning when the private-key path is unreadable, so the wizard surfaces it
+ * without aborting the install (the source is opt-in and secondary).
  */
 export declare function checkPrivateKeyReadable(keyPath: string): Promise<string | null>;
 /**
- * Default Platform relay URL offered by the install wizard. Kept in lockstep
- * with the quickstart compose `KICI_PLATFORM_URL` value (`wss://api.kici.dev/ws`)
- * — the single hosted KiCI Platform relay endpoint. Pinned by
- * orchestrator-wizard.test.ts so the two surfaces cannot drift.
+ * Default Platform relay URL; kept in lockstep with the quickstart compose
+ * `KICI_PLATFORM_URL`, pinned by orchestrator-wizard.test.ts.
  */
 export declare const DEFAULT_PLATFORM_RELAY_URL = "wss://api.kici.dev/ws";
 /**
- * Run the interactive orchestrator setup wizard.
- *
- * Asks only essential questions per the user decision:
- * 1. Mode (hybrid/platform/observed/independent)
- * 2. Database URL
- * 3. Port
- * 4. Secrets encryption key
- * 5. Bootstrap admin token (for kici-admin authentication)
- * 6. Platform URL + token (if platform/hybrid/observed mode), plus the public
- *    webhook base URL -- required in observed mode, optional in hybrid
- * 7. Webhook secret (if hybrid/independent mode)
+ * Asks only the essential questions. The public webhook base URL is required in
+ * observed mode and optional in hybrid.
  */
 export declare function runOrchestratorWizard(opts?: OrchestratorWizardOptions): Promise<OrchestratorInstallConfig>;
 export {};