@kici-dev/orchestrator 0.5.0 → 0.6.0

package/dist/approvals/independent-wiring.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The approval subsystem an INDEPENDENT orchestrator runs on.
+ *
+ * `server.ts` composes this inline for the three Platform-attached modes. An
+ * independent orchestrator has no Platform and therefore none of that hook, so
+ * every gate that raises a hold was inert there: a fork PR the org policy said
+ * to HOLD was dropped instead of held, an SDK `requireApproval` job ran
+ * UNGATED (the dispatch site logged an error and dispatched anyway), and the
+ * stale detector had no store through which to expire an overdue hold,
+ * terminalize its `KiCI Security` check, or drop the pending dispatch context
+ * it would have replayed.
+ *
+ * It lives here rather than inside `standalone.ts` because that module is an
+ * entry point: it runs `guardStartup` at import time, so nothing can construct
+ * its wiring in a test. A factory can be constructed, and the fields it
+ * produces can be asserted — which is the whole point, since every defect this
+ * closes was a missing field rather than a wrong algorithm.
+ *
+ * What it deliberately does NOT produce is a `stepApprovalBridge`. A
+ * step-scoped hold is opened by the agent WS `onStepApproval` seam and answered
+ * by the dashboard applier, which is Platform-relayed and has no
+ * independent-mode equivalent — so wiring the bridge would let an agent open a
+ * hold nothing could resolve short of expiry.
+ */
+import type { Kysely } from 'kysely';
+import type { Database } from '../db/types.js';
+import { HeldRunStore, type ReleaseSignal } from '../contexts/held-runs.js';
+import { type ProcessingDeps, type ReadyDispatchContextRow } from '../pipeline/processor.js';
+import type { Dispatcher } from '../agent/dispatcher.js';
+import type { ExecutionTracker } from '../reporting/execution-tracker.js';
+import type { RunCoordinator } from '../cluster/coordinator.js';
+import type { InvokeGateDeps } from '../pipeline/invoke-gate.js';
+/** The subsystem fields the composition reads. A subset of `OrchestratorSubsystems`. */
+export interface IndependentApprovalSubsystems {
+    db: Kysely<Database>;
+    dispatcher: Dispatcher;
+    executionTracker?: ExecutionTracker | undefined;
+    coordinator?: RunCoordinator | undefined;
+    invokeGateDeps?: InvokeGateDeps | undefined;
+    /**
+     * The live direct-ingress deps bag. Read lazily inside the release callbacks:
+     * it is populated by `createApp`, which runs after the mode hook, and reading
+     * it at wiring time throws.
+     */
+    buildProcessingDeps: () => ProcessingDeps;
+}
+/** What the independent mode hook merges into `appDepsExtras`. */
+export interface IndependentApprovalExtras {
+    heldRunStore: HeldRunStore;
+    onWorkflowRelease: (signal: ReleaseSignal) => Promise<void>;
+    onJobRelease: (signal: ReleaseSignal) => Promise<void>;
+    matchContext: (orgId: string, name: string) => Promise<ReadyDispatchContextRow | null>;
+}
+export declare function createIndependentApprovalExtras(sub: IndependentApprovalSubsystems): IndependentApprovalExtras;
+//# sourceMappingURL=independent-wiring.d.ts.map

package/dist/approvals/resume-router.d.ts

@@ -0,0 +1,9 @@
+import type { ReleaseSignal } from '../contexts/held-runs.js';
+/** The three resume paths a released hold can take. */
+export interface ResumeHandlers {
+    onStepRelease?: (signal: ReleaseSignal) => Promise<void>;
+    onWorkflowRelease?: (signal: ReleaseSignal) => Promise<void>;
+    onJobRelease: (signal: ReleaseSignal) => Promise<void>;
+}
+export declare function routeRelease(signal: ReleaseSignal, handlers: ResumeHandlers): Promise<void>;
+//# sourceMappingURL=resume-router.d.ts.map

package/dist/approvals/triggerer-subject.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The `service:` namespace both approving surfaces use for a non-human
+ * principal: `kici-admin`'s token identity (its only subject), and the
+ * dashboard's rendering of a `service_account` actor.
+ */
+export declare const SERVICE_SUBJECT_PREFIX = "service:";
+/** Render an admin-token user id in the shared `service:` namespace. */
+export declare function adminActorSub(tokenUserId: string): string;
+/**
+ * Resolve the subject of whoever triggered a run, in the approver vocabulary.
+ *
+ * | `triggered_by` | Returns | Why |
+ * |---|---|---|
+ * | `user:<sub>` | `<sub>` | what a `{user}` clause and both surfaces' own subject use |
+ * | `platform_operator:<sub>` | `<sub>` | same Keycloak subject as a `user` |
+ * | `service_account:<id>` | `service:<id>` | the namespace {@link adminActorSub} and the dashboard both produce |
+ * | `system:<component>` | `system:<component>` | the dashboard renders a system actor with its prefix intact |
+ * | `api_key:<keyId>` | `<keyId>` | see the residual below |
+ * | anything else | unchanged | no other actor type reaches these surfaces |
+ *
+ * The agent suffix is stripped first. `stringifyActor` renders a `user` or
+ * `api_key` who acted through an agent as `user:<sub> via agent:<label>`, and a
+ * reader splitting on the first colon gets `<sub> via agent:<label>` — which
+ * matches no live subject, so the gate was inert for every agent-mediated
+ * trigger. That is the `user` case, i.e. the common one.
+ *
+ * **Residual: `api_key`.** A key's persisted identifier is its `keyId`, while
+ * both surfaces render a live `api_key` actor as its owner's Keycloak subject
+ * (`ownerSub`). Those are different identifiers for the same principal and no
+ * string transform bridges them — closing it needs a keyId → ownerSub lookup,
+ * which is a store this pure function does not have. So an owner approving a
+ * hold on a run their own key triggered is still admitted. Recorded rather than
+ * papered over: returning the bare keyId is at least honest about what was
+ * stored.
+ */
+export declare function triggererSubjectFor(triggeredBy: string | null | undefined): string | undefined;
+//# sourceMappingURL=triggerer-subject.d.ts.map

package/dist/cache/dep-cache.d.ts

@@ -1,14 +1,40 @@
 /**
  * Dependency-specific cache layer wrapping CacheStorage.
  *
- * Stores and retrieves dependency tarballs keyed by lockfileHash + platform + arch.
- * Shared CacheStorage backend with SourceCache (same S3 bucket).
- * Refreshes TTL on reads (touch-on-read).
+ * Stores dependency tarballs under their own content hash, with a small pointer
+ * resolving lockfileHash + platform + arch to that hash. Shared CacheStorage
+ * backend with SourceCache (same S3 bucket). Refreshes TTL on reads
+ * (touch-on-read).
  *
- * Cache key format: deps/{platform}-{arch}/{lockfileHash}.tar.gz
+ * Keys: `deps/{platform}-{arch}/{depsHash}.tar.gz` (immutable) and
+ * `deps/{platform}-{arch}/{lockfileHash}.hash` (the pointer).
  */
 import type { CacheStorage } from '../storage/types.js';
 import type { ClusterSettingsReader } from '../cluster/cluster-settings-reader.js';
+/**
+ * Cache key for a dependency tarball, addressed by the tarball's OWN content
+ * hash: `deps/{platform}-{arch}/{depsHash}.tar.gz`.
+ *
+ * Content-addressing is what makes a mismatched pair unrepresentable. When the
+ * tarball lived at a lockfile-derived name, it and its companion `.hash` were
+ * two independently-written objects under keys that any two builds sharing a
+ * lockfile + platform + arch also share — so concurrent builders could leave the
+ * `.tar.gz` from one and the `.hash` from the other, and the reader failed
+ * verification durably. Naming the object by its own hash means every pair a
+ * reader can observe is self-consistent, and the bytes at a given key can never
+ * change after a URL is signed for it.
+ */
+export declare function depTarballKey(depsHash: string, platform: string, arch: string): string;
+/**
+ * Cache key for the pointer that resolves a lockfile to the content hash of the
+ * tarball built from it: `deps/{platform}-{arch}/{lockfileHash}.hash`.
+ *
+ * This is the one mutable object in the scheme. A concurrent write replaces a
+ * pointer wholesale — there is no window in which it is half-written — so the
+ * worst a racing pair of builders can do is leave whichever pointer landed last,
+ * and both tarballs remain valid and fetchable.
+ */
+export declare function depPointerKey(lockfileHash: string, platform: string, arch: string): string;
 export declare class DepCache {
     private readonly storage;
     private readonly maxTarballBytes;
@@ -30,7 +56,17 @@ export declare class DepCache {
      * `cache_ttl_days` change takes effect on the next lookup.
      */
     private resolveTtlMsOverride;
-    /** Check if a dep tarball exists in cache. */
+    /**
+     * Resolve a lockfile to the content hash of the tarball built from it, or
+     * null when no pointer exists. The single place the indirection is read.
+     */
+    private resolvePointer;
+    /**
+     * Check if a dep tarball exists in cache.
+     *
+     * Both halves must be present: a pointer whose tarball has aged out is a miss,
+     * not a hit, or the caller skips a rebuild and dispatches a URL that 404s.
+     */
     has(lockfileHash: string, platform: string, arch: string): Promise<boolean>;
     /**
      * Get a pre-signed download URL for the dep tarball (for agent delivery).
@@ -38,9 +74,10 @@ export declare class DepCache {
      */
     getUrl(lockfileHash: string, platform: string, arch: string): Promise<string | null>;
     /**
-     * Get a pre-signed download URL and the tarball content hash (if available).
-     * Returns null on cache miss. Hash may be undefined for old entries stored
-     * before integrity tracking was added.
+     * Get a pre-signed download URL and the tarball content hash.
+     *
+     * Returns null on cache miss — including an entry with no pointer, which is
+     * unverifiable and so is deliberately not served.
      */
     getUrlAndHash(lockfileHash: string, platform: string, arch: string): Promise<{
         url: string;
@@ -49,7 +86,14 @@ export declare class DepCache {
     /**
      * Get a pre-signed upload URL for direct agent-to-S3 upload.
      */
-    getUploadUrl(lockfileHash: string, platform: string, arch: string): Promise<string>;
+    getUploadUrl(depsHash: string, platform: string, arch: string): Promise<string>;
+    /**
+     * Publish the pointer that makes an uploaded tarball discoverable by lockfile.
+     *
+     * Called only after the agent confirms its upload completed. Publishing before
+     * the bytes land would let a reader follow the pointer to a missing object.
+     */
+    publishPointer(lockfileHash: string, platform: string, arch: string, depsHash: string): Promise<void>;
     /**
      * Store a dep tarball in cache.
      * Throws if tarball exceeds max size (per user decision).
@@ -60,7 +104,7 @@ export declare class DepCache {
      * Used by build agents to compute the hash for depsHash protocol field.
      */
     static computeHash(data: Buffer): string;
-    /** Remove a dep tarball from cache. */
+    /** Remove a dep tarball and its pointer from cache. */
     remove(lockfileHash: string, platform: string, arch: string): Promise<boolean>;
 }
 //# sourceMappingURL=dep-cache.d.ts.map

package/dist/cache/global-eval-round-cache.d.ts

@@ -29,6 +29,12 @@ import type { GlobalEvalRoundResult } from '@kici-dev/engine';
  * reason `groupCandidates` keeps it in the group key — it selects the provider
  * bundle that mints the clone credentials.
  *
+ * `sourceRepoIdentifier` is its own component, placed next to `sourceSha` so the
+ * source repo and its commit stay adjacent. Every event already carries its
+ * source repo, so the event digest covers it too — but keying it explicitly
+ * makes that coverage structural rather than incidental: an event shape that
+ * stopped carrying the source repo could otherwise collide two repos' rounds.
+ *
  * The candidate list and the event are folded in as a SHA-256 digest of their
  * JSON, so the key stays a bounded string no matter how large a payload is. Both
  * are rebuilt by the same code from the same delivery, so a genuine redelivery
@@ -43,6 +49,7 @@ export declare function globalEvalRoundCacheKey(args: {
     workflowRepoIdentifier: string;
     workflowSha: string;
     workflowRoutingKey: string;
+    sourceRepoIdentifier: string;
     sourceSha: string;
     /** The exact per-candidate payload the round job carries. */
     candidates: unknown;

package/dist/cli/api-client.d.ts

@@ -84,6 +84,24 @@ export interface GenericSourceResponse {
  * print an empty one.
  */
 export declare function firstCauseMessage(err: unknown): string;
+/**
+ * True when a rejected `fetch` failed at the transport layer, as opposed to
+ * failing while the request was still being built.
+ *
+ * `fetch` uses a `TypeError` for both, so they are easy to conflate — but only
+ * a transport failure means the orchestrator was actually dialled. Measured
+ * against Node 24's undici:
+ *
+ *   closed port    → TypeError('fetch failed')                       cause: Error(ECONNREFUSED)
+ *   invalid header → TypeError('Headers.append: … invalid header …') cause: undefined
+ *   invalid URL    → TypeError('Failed to parse URL from …')         cause: Error(ERR_INVALID_URL)
+ *
+ * The discriminator is therefore the message, NOT the presence of a `cause`:
+ * the invalid-URL case carries one. undici uses exactly `fetch failed` for a
+ * transport failure and a descriptive message for everything it rejects before
+ * opening a connection.
+ */
+export declare function isTransportFailure(err: unknown): boolean;
 export declare function fetchAdminApi(url: string, init: RequestInit, baseUrl: string): Promise<Response>;
 export declare class AdminApiClient {
     private readonly baseUrl;

package/dist/cli/commands/cluster-settings.d.ts

@@ -71,6 +71,17 @@ export declare function buildClusterPatch(opts: Record<string, string | undefine
  * Returns the lines rather than printing them so the check is unit-testable.
  */
 export declare function unpairedEvalTimeoutWarnings(patch: PatchBody): string[];
+/**
+ * Warn for every deprecated knob the patch sets.
+ *
+ * The set still goes through — the column and the route field are a released
+ * operator surface and keep accepting writes — so the warning says what the
+ * stored value now does, which is nothing.
+ *
+ * Returns the lines rather than printing them so the check is unit-testable,
+ * matching {@link unpairedEvalTimeoutWarnings}.
+ */
+export declare function deprecatedKnobWarnings(patch: PatchBody): string[];
 /** Build the reset PATCH body: all knobs → null, or just the flagged ones. */
 export declare function buildClusterReset(opts: Record<string, boolean | undefined>): PatchBody;
 /**

package/dist/cli/commands/diagnose.d.ts

@@ -11,5 +11,11 @@
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
+/**
+ * Width of the table's Message column. A check message is cut at this many
+ * characters, so anything a check wants an operator to see in the default
+ * (non-`--json`) output has to fit inside it.
+ */
+export declare const DIAGNOSE_TABLE_MESSAGE_WIDTH = 42;
 export declare function registerDiagnoseCommand(program: Command, getClient: () => AdminApiClient): void;
 //# sourceMappingURL=diagnose.d.ts.map

package/dist/cli/commands/held-run.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Held-run commands for kici-admin.
+ *
+ * Subcommand namespace: `kici-admin held-run <list|approve|reject>`.
+ *
+ * The local answer to a held run, for an orchestrator that has no Platform.
+ * Every other release surface is Platform-relayed — the dashboard approval
+ * queue, `kici approve` / `kici reject`, and the developer MCP tools all reach
+ * the applier over the control-plane connection — and the one surface that is
+ * not, a `/kici approve` pull-request comment, releases the `security` queue
+ * only. So on an independent orchestrator an approval-queue hold had no answer
+ * at all and could only expire.
+ *
+ * These verbs are therefore the mirror image of `trust-policy set`: they work
+ * only where no Platform is attached, and the route refuses with 409 wherever
+ * one is. That refusal is surfaced verbatim rather than reworded here, so the
+ * CLI cannot drift from what the server actually said.
+ *
+ * A hold is named the same way `kici approve` names one — `--job` / `--step` /
+ * `--hold-type` / `--hold`, resolved by the shared `resolveHeldRunId` — so an
+ * operator disambiguating a doubly-held job types the same flags on either
+ * surface. That sharing is the point: a job gated by BOTH a reviewer hold and a
+ * security hold writes two pending rows requiring two decisions, and a second
+ * resolver would be free to disagree about which one `--job` means.
+ */
+import type { Command } from 'commander';
+import { ApprovalDecision, type HeldRunSummary } from '@kici-dev/engine';
+import type { AdminApiClient } from '../api-client.js';
+/** One held-run row as the admin route reports it, with the clause list it adds. */
+type AdminHeldRunSummary = HeldRunSummary & {
+    /** Approver clauses the hold's requirement carries; `[]` when it names nobody. */
+    clauses?: Array<{
+        team: string;
+    } | {
+        user: string;
+    }>;
+};
+/** The decision response the admin route returns. */
+interface DecisionResponse {
+    status: string;
+    remainingClauses?: number;
+}
+/**
+ * Render the pending holds for a run.
+ *
+ * Per-entry rather than a count: "which hold do I answer, and who may answer
+ * it" is the question this command exists to answer, and the hold id it prints
+ * is the `--hold <id>` disambiguator the resolver hands back when nothing else
+ * separates two holds.
+ */
+export declare function formatHeldRuns(res: {
+    heldRuns: AdminHeldRunSummary[];
+}, format: string): string;
+/** Say what the applier did, in the vocabulary `ApplyDecisionResult.status` uses. */
+export declare function formatDecision(res: DecisionResponse, decision: ApprovalDecision): string;
+export declare function registerHeldRunCommands(program: Command, getClient: () => AdminApiClient): void;
+export {};
+//# sourceMappingURL=held-run.d.ts.map

package/dist/cli/commands/trust-policy.d.ts

@@ -1,26 +1,47 @@
 /**
  * Org trust-policy commands for kici-admin.
  *
- * Subcommand namespace: `kici-admin trust-policy <show|set>`.
+ * Subcommand namespace:
+ * `kici-admin trust-policy <show|set|directory|directory-set|directory-remove>`.
  *
  * Talks to the orchestrator admin API directly (not the Platform dashboard
  * proxy), so the CLI stays operable even when Platform is unavailable. Backed
  * by `packages/orchestrator/src/routes/admin-trust-policy.ts`.
  *
- * `set` only works on an independent orchestrator. Wherever a Platform is
- * attached the Platform owns the policy and the route refuses with 409; the
- * message is surfaced verbatim rather than reworded here, so the CLI cannot
- * drift from what the server actually said.
+ * `show` and `directory` read, in every mode. `set`, `directory-set`, and
+ * `directory-remove` write, and only work on an independent orchestrator:
+ * wherever a Platform is attached it owns both the policy and the approval
+ * directory, and the route refuses with 409. That message is surfaced verbatim
+ * rather than reworded here, so the CLI cannot drift from what the server
+ * actually said.
+ *
+ * The two directory writers live in this namespace rather than one of their
+ * own because they are the same org-trust concept as the policy, gated by the
+ * same mode rule against the same `--customer-id`, and reached through the same
+ * admin route file. Splitting them out would put half of "who may approve" in a
+ * second top-level command with its own copy of that story. They are siblings
+ * of the `directory` reader rather than subcommands under it, because turning
+ * that leaf into a group would break `kici-admin trust-policy directory` for
+ * anyone already running it.
  */
 import type { Command } from 'commander';
-import { TrustPolicyEnforcement } from '../../security/trust-policy-gate.js';
 import type { AdminApiClient } from '../api-client.js';
 /**
  * The policy shape the admin route returns.
  *
- * The four policy fields are OPTIONAL because the route omits them under
- * `enforcement: 'legacy'` — there they would be values nothing enforces, and
- * printing them is the false assurance this feature exists to remove.
+ * The four policy fields are OPTIONAL because a **v0.5.0 independent**
+ * orchestrator omits them: there, and only there, no policy row and no attached
+ * Platform meant no policy was resolved at all, and it reported
+ * `enforcement: 'legacy'` with the fields absent. A v0.5.0 Platform-attached
+ * orchestrator with no row still sent the fail-closed values. This build's route
+ * always sends them in every mode, so the `unknown` fallbacks below — and the
+ * `no policy stored` provenance wording — render only against that older
+ * independent orchestrator.
+ *
+ * The route also sends a deprecated `enforcement` field. Nothing here reads it —
+ * on this build it is always `policy` — so it is absent from this shape;
+ * `--format json` stringifies the parsed policy object, so the field still
+ * reaches the operator verbatim.
  */
 export interface TrustPolicyView {
     customerId: string;
@@ -28,15 +49,39 @@ export interface TrustPolicyView {
     unknownContributorPolicy?: string;
     workflowChangePolicy?: string;
     approvalExpiryHours?: number;
-    /** `policy` = the values below are enforced; `legacy` = only the legacy rule. */
-    enforcement?: TrustPolicyEnforcement;
+    /**
+     * The authoritative hold window. Absent from any orchestrator that predates
+     * it, in which case `approvalExpiryHours` is the only window on offer.
+     */
+    approvalExpirySeconds?: number;
     source: string | null;
     updatedAt: string | null;
     effectiveDefault?: boolean;
     platformManaged?: boolean;
 }
-/** Render the policy as an aligned table, or as JSON when asked. */
+/**
+ * Render the policy as an aligned table, or as JSON when asked.
+ *
+ * The two deprecated arms are deliberately absent from the table: no dispatch
+ * decision reads either one, so a row claiming `Unknown contributor policy:
+ * hold` would assert an enforcement that is not happening. They are still
+ * stored and still echoed back, and `--format json` prints the policy object the
+ * route returned, so the values remain reachable for anyone who needs them.
+ */
 export declare function formatPolicy(policy: TrustPolicyView, format: string): string;
+/**
+ * Render the enforced hold window.
+ *
+ * A whole number of hours still prints as `72 h`, exactly as it always did, so
+ * no existing policy's output moves. Anything finer prints in seconds, because
+ * the hours spelling cannot express it and rounding would report a window the
+ * orchestrator is not applying.
+ *
+ * A policy carrying neither field is an orchestrator old enough to have
+ * resolved no policy at all (see {@link TrustPolicyView}); one carrying only
+ * hours is an orchestrator that predates the seconds window.
+ */
+export declare function formatExpiry(policy: TrustPolicyView): string;
 /**
  * Turn CLI flags into a PATCH body, exiting on an unknown value.
  *
@@ -44,5 +89,65 @@ export declare function formatPolicy(policy: TrustPolicyView, format: string): s
  * clear local message naming the accepted values instead of a 400 from the API.
  */
 export declare function buildPolicyPatch(opts: Record<string, string | undefined>): Record<string, string | number>;
+/**
+ * Warn when a patch names both spellings of the hold window.
+ *
+ * The route resolves this deterministically — the more specific seconds value
+ * wins — but an operator who passed both asked for two different things, so the
+ * one that is not applied is named rather than dropped in silence.
+ *
+ * Returns the lines rather than printing them so the check is unit-testable,
+ * matching `policyDeprecationWarnings` below.
+ */
+export declare function policyExpiryWarnings(patch: Record<string, string | number>): string[];
+/**
+ * Warn about deprecated flags and deprecated values in an already-built patch.
+ *
+ * Every one of these still PATCHes through unchanged — the orchestrator stores
+ * what it is given, and an older Platform or CLI keeps seeing the value it
+ * expects. The warning says what the value does now, which for all three is
+ * nothing the fork switch reads.
+ *
+ * Returns the lines rather than printing them so the check is unit-testable,
+ * matching `unpairedEvalTimeoutWarnings` in `cluster-settings.ts`.
+ */
+export declare function policyDeprecationWarnings(patch: Record<string, string | number>): string[];
+/** One identity link as the directory route reports it. */
+interface DirectoryIdentityLink {
+    userId: string;
+    provider: string;
+    providerUsername: string;
+    providerUserId?: string | null;
+}
+/** One operator-defined team as the directory route reports it. */
+interface DirectoryTeam {
+    teamName: string;
+    memberUserIds: string[];
+}
+/** The cached approval directory as the admin route returns it. */
+export interface TrustDirectoryView {
+    customerId: string;
+    identityLinks: DirectoryIdentityLink[];
+    memberCiTrustLevels: Record<string, string>;
+    teamMemberships: DirectoryTeam[];
+    updatedAt: string;
+}
+interface DirectoryResponse {
+    directory: TrustDirectoryView | null;
+    platformManaged: boolean;
+    /** Present on `directory-remove`: false when the member held nothing. */
+    removed?: boolean;
+}
+/**
+ * Render the stored approval directory, or say why there is nothing to render.
+ *
+ * The directory is what `/kici approve` is resolved against: a commenter is
+ * matched to a KiCI user through the identity links, that user's CI trust level
+ * decides whether the approval counts, and a `{team}` clause is matched against
+ * the team memberships. So the listing is per-entry rather than a set of counts
+ * — "who can approve right now" is the question this command exists to answer.
+ */
+export declare function formatDirectory(res: DirectoryResponse, format: string): string;
 export declare function registerTrustPolicyCommands(program: Command, getClient: () => AdminApiClient): void;
+export {};
 //# sourceMappingURL=trust-policy.d.ts.map

package/dist/cli/kici-admin.d.ts

@@ -10,6 +10,16 @@
  *   --token / -t  Admin API token (env: KICI_ADMIN_TOKEN, required)
  */
 import { Command } from 'commander';
+/**
+ * The version `kici-admin --version` reports.
+ *
+ * `scripts/build-service.mjs` defines `KICI_PKG_VERSION` for every orchestrator
+ * build entry, `cli.js` included, so a shipped binary reports the package
+ * version it was built from. The fallback covers a source run (tests, `tsx`),
+ * where no bundler substituted the constant — the same shape `server.ts` and
+ * `standalone.ts` use for `ORCHESTRATOR_VERSION`.
+ */
+export declare const CLI_VERSION: string;
 /**
  * Build the kici-admin Commander program with every command group registered.
  * Exported so the surface registry can walk the real command tree without