@kici-dev/orchestrator 0.6.1 → 0.7.0

package/dist/cli/commands/db-backup.d.ts

@@ -20,8 +20,44 @@ export interface BackupManifest {
     clusterId: string | null;
     hostname: string;
 }
+export interface CreateDbBackupOptions {
+    /** libpq connection URL of the database to dump. */
+    databaseUrl: string;
+    /** Absolute or relative path the `.dump` archive is written to. */
+    outputPath: string;
+    /** Handle used to insert the `backup_runs` row. */
+    db: Kysely<Database>;
+    /** Pool used to read the server version, key generation, and cluster id. */
+    pool: import('pg').Pool;
+    /** Timestamp stamped into the manifest. */
+    now: Date;
+}
+export interface CreateDbBackupResult {
+    outputPath: string;
+    byteSize: number;
+    manifest: BackupManifest;
+}
 export declare function manifestPath(dumpPath: string): string;
+/** `kici-orchestrator-backup-<timestamp>.dump` — no directory component. */
+export declare function dumpFileName(now: Date): string;
 export declare function defaultDumpPath(now: Date): string;
+/** Timestamped dump path inside a retention directory. */
+export declare function dumpPathIn(dir: string, now: Date): string;
+export interface PruneIo {
+    readdir: (dir: string) => Promise<string[]>;
+    mtimeMs: (p: string) => Promise<number>;
+    unlink: (p: string) => Promise<void>;
+}
+/**
+ * Keep the newest {@link keep} `.dump` files in {@link dir} and delete the
+ * rest, each with its `.manifest.json` sidecar. Newest is decided by
+ * modification time, with the filename as a tiebreak because the timestamped
+ * names sort chronologically. Returns every path removed.
+ *
+ * A `keep` of 0 or less disables pruning: retention is opt-in, so a
+ * misconfigured value must never empty the directory.
+ */
+export declare function pruneBackupDir(dir: string, keep: number, io?: PruneIo): Promise<string[]>;
 export declare function parsePgToolMajor(versionOutput: string): number;
 export declare function serverVersionMajor(numStr: string): number;
 export declare function assertToolVersionCompatible(toolMajor: number, serverMajor: number, tool: 'pg_dump' | 'pg_restore'): void;
@@ -57,6 +93,16 @@ export declare function buildBackupManifest(input: {
     migrationsHash: string;
     hostname: string;
 }): BackupManifest;
+/**
+ * Take one orchestrator database backup: pre-flight the `pg_dump` version,
+ * dump to {@link CreateDbBackupOptions.outputPath}, write the sidecar manifest,
+ * and record the `backup_runs` row.
+ *
+ * Prints nothing and never exits the process — every failure surfaces as a
+ * thrown Error so the caller decides how to report it. That is what lets both
+ * `kici-admin db backup` and the pre-upgrade hook share one implementation.
+ */
+export declare function createDbBackup(opts: CreateDbBackupOptions): Promise<CreateDbBackupResult>;
 /**
  * Message to print after a restore about the secret-key requirement. Returns
  * null when the dump carried no encrypted secrets (nothing to warn about),

package/dist/cli/commands/held-run.d.ts

@@ -16,6 +16,15 @@
  * one is. That refusal is surfaced verbatim rather than reworded here, so the
  * CLI cannot drift from what the server actually said.
  *
+ * A decision answers as the admin token by default, whose `service:` subject
+ * satisfies no `{user}` or `{team}` clause — enough for a hold that names
+ * nobody, and nothing at all for one that does. `--as <user-id>` answers as a
+ * member of the approval directory instead, the one `kici-admin trust-policy
+ * directory-set` writes, so a clause-bearing hold on an independent
+ * orchestrator has an answer rather than only an expiry. An id the directory
+ * does not carry is refused: an unvalidated subject would let a token satisfy
+ * any clause by naming it.
+ *
  * A hold is named the same way `kici approve` names one — `--job` / `--step` /
  * `--hold-type` / `--hold`, resolved by the shared `resolveHeldRunId` — so an
  * operator disambiguating a doubly-held job types the same flags on either

package/dist/cli/commands/orchestrator-service/drain.d.ts

@@ -8,24 +8,7 @@
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../../api-client.js';
-type Snapshot = {
-    draining: boolean;
-    jobsRunning: number;
-};
-export interface WaitOpts {
-    timeoutMs: number;
-    intervalMs: number;
-    now?: () => number;
-    sleep?: (ms: number) => Promise<void>;
-}
-/**
- * Poll `poll` until jobsRunning hits 0 or the timeout elapses. Pure with an
- * injectable clock + sleep so it is testable without real time.
- */
-export declare function waitForQuiesce(poll: () => Promise<Snapshot>, opts: WaitOpts): Promise<{
-    quiesced: boolean;
-    jobsRunning: number;
-}>;
+import { waitForQuiesce } from '../shared/upgrade-safety.js';
+export { waitForQuiesce };
 export declare function registerOrchestratorDrain(orchestrator: Command, getClient: () => AdminApiClient): void;
-export {};
 //# sourceMappingURL=drain.d.ts.map

package/dist/cli/commands/orchestrator-service/index.d.ts

@@ -11,5 +11,13 @@
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../../api-client.js';
-export declare function registerOrchestratorServiceCommands(program: Command, getClient: () => AdminApiClient): void;
+export declare function registerOrchestratorServiceCommands(program: Command, getClient: () => AdminApiClient, 
+/**
+ * Non-exiting client factory for the upgrade command. Its drain and
+ * schema-guard steps improve on a path that previously did neither, so an
+ * install with no admin credentials must still be able to upgrade — and
+ * `getClient` exits the process rather than throwing, which a caller cannot
+ * catch.
+ */
+tryGetClient: () => AdminApiClient | null): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/cli/commands/orchestrator-service/install-env.d.ts

@@ -7,6 +7,7 @@
  * command action stays small and the decision + stub content are unit-testable
  * without driving the whole install through Commander.
  */
+import { OrchestratorMode } from '@kici-dev/engine';
 import type { OrchestratorSourceHint } from '../../wizard/orchestrator-wizard.js';
 /** Which config source the install writes the env file from. */
 export type InstallEnvMode = 'wizard' | 'env-file' | 'stub';
@@ -17,6 +18,20 @@ export interface WriteInstallEnvResult {
 }
 /** Public compose quickstart, pointed at from the stub env file. */
 export declare const COMPOSE_QUICKSTART_URL = "https://docs.kici.dev/user/quickstart/compose/";
+/** Direct-ingress guide, pointed at from the stub env file's KICI_WEBHOOK_PUBLIC_URL line. */
+export declare const GITHUB_INGRESS_URL = "https://docs.kici.dev/operator/orchestrator/github-ingress/";
+/**
+ * Operating mode a fresh install writes when the operator names none.
+ *
+ * `hybrid` is a superset of `platform`: the orchestrator accepts every
+ * Platform-relayed webhook exactly as `platform` does, and additionally serves
+ * its own ingress route, which verifies the HMAC signature before it acts on a
+ * delivery. It requires no configuration beyond what `platform` requires, so an
+ * orchestrator whose port nothing reaches behaves identically to a `platform`
+ * one — while an operator who later exposes that port stops losing pushes to a
+ * relay outage.
+ */
+export declare const DEFAULT_INSTALL_MODE: OrchestratorMode;
 export interface WizardModeInput {
     /** --wizard=true / --no-wizard=false / undefined when neither is passed. */
     wizard?: boolean;
@@ -40,10 +55,12 @@ export declare function resolveWizardMode(input: WizardModeInput): InstallEnvMod
 /**
  * Build the stub env file: every required key with an inline explanation, a
  * generation command for the two secrets, and a pointer to the compose
- * quickstart. Fills KICI_DATABASE_URL from a --dev container URL when present.
+ * quickstart. Fills KICI_DATABASE_URL from a --dev container URL when present,
+ * and KICI_MODE from `--mode` when the operator named one.
  */
 export declare function buildStubEnv(opts: {
     devDbUrl?: string;
+    mode?: OrchestratorMode;
 }): string;
 export interface WriteInstallEnvArgs {
     mode: InstallEnvMode;
@@ -52,7 +69,31 @@ export interface WriteInstallEnvArgs {
     envFileSource?: string;
     /** Dev-provisioned DB URL, threaded into the stub / appended to an env file. */
     devDbUrl?: string;
+    /**
+     * Operating mode from `--mode`. Written into the stub, and preselected in the
+     * wizard's mode prompt. Unset falls back to {@link DEFAULT_INSTALL_MODE}.
+     */
+    orchestratorMode?: OrchestratorMode;
+    /**
+     * Whether the operator actually typed `--mode`, as opposed to Commander
+     * filling in {@link DEFAULT_INSTALL_MODE}.
+     *
+     * Only the env-file path needs the distinction. The file the operator hands
+     * in may already declare `KICI_MODE`, and the install bakes the service unit's
+     * entry point from that value — so a defaulted `hybrid` must never overwrite a
+     * joined cluster's `independent`, while a named `--mode` must.
+     */
+    modeExplicit?: boolean;
 }
-/** Materialise the env file for the resolved mode. */
+/**
+ * Materialise the env file for the resolved mode.
+ *
+ * Every write path ends at {@link ENV_FILE_MODE}: the file carries the secrets
+ * master key, so it must never be group- or world-readable. Each path that
+ * creates or replaces the file stages it through a sibling temporary at that
+ * mode, so the destination never exists more permissively even briefly. The
+ * trailing chmod tightens the one path that only appends — a file that was
+ * already there at looser permissions.
+ */
 export declare function writeInstallEnvFile(args: WriteInstallEnvArgs): Promise<WriteInstallEnvResult>;
 //# sourceMappingURL=install-env.d.ts.map

package/dist/cli/commands/orchestrator-service/logs.d.ts

@@ -5,7 +5,7 @@
  * and output format. Delegates to the platform-specific service
  * manager's logs() method.
  *
- * Target resolution goes through resolveInstance — the same priority chain
+ * Target resolution goes through resolveInstanceTarget — the same priority chain
  * every lifecycle command uses (--instance-dir > --name > CWD manifest >
  * refusal with candidate list).
  */

package/dist/cli/commands/orchestrator-service/restart.d.ts

@@ -2,7 +2,7 @@
  * `kici-admin orchestrator restart` command.
  *
  * Restarts the orchestrator service. Target resolution goes through
- * resolveInstance — the same priority chain every lifecycle command uses
+ * resolveInstanceTarget — the same priority chain every lifecycle command uses
  * (--instance-dir > --name > CWD manifest > refusal with candidate list).
  * `--name` has no default; every invocation must resolve via one of the
  * above paths.

package/dist/cli/commands/orchestrator-service/start.d.ts

@@ -2,7 +2,7 @@
  * `kici-admin orchestrator start` command.
  *
  * Starts the orchestrator service. Target resolution goes through
- * resolveInstance — the same priority chain every lifecycle command uses
+ * resolveInstanceTarget — the same priority chain every lifecycle command uses
  * (--instance-dir > --name > CWD manifest > refusal with candidate list).
  * `--name` has no default; every invocation must resolve via one of the
  * above paths.

package/dist/cli/commands/orchestrator-service/status.d.ts

@@ -5,10 +5,26 @@
  * the running orchestrator's health API for KiCI-specific info
  * (mode, DB connectivity, agents, jobs, scaler).
  *
- * Target resolution goes through resolveInstance — the same priority chain
+ * Target resolution goes through resolveInstanceTarget — the same priority chain
  * every lifecycle command uses (--instance-dir > --name > CWD manifest >
  * refusal with candidate list).
  */
 import type { Command } from 'commander';
+import { type ServicePlatform } from '../../service/index.js';
+/**
+ * The config files this install owns, for an operator who wants to inspect
+ * them. Derived from the instance manifest and the env file on disk, not from
+ * the running service, so it answers just as well for a stopped one.
+ *
+ * No path is checked for existence: on bare metal such a check would pass, but
+ * a compose install names host paths the check would have to run against a
+ * container, blanking the answer for the shape that needs it most.
+ */
+export declare function formatConfigPaths(args: {
+    platform: ServicePlatform;
+    serviceName: string;
+    envFilePath: string;
+    envContent: string;
+}): string[];
 export declare function registerStatusCommand(parent: Command): void;
 //# sourceMappingURL=status.d.ts.map

package/dist/cli/commands/orchestrator-service/stop.d.ts

@@ -2,7 +2,7 @@
  * `kici-admin orchestrator stop` command.
  *
  * Stops the orchestrator service. Target resolution goes through
- * resolveInstance — the same priority chain every lifecycle command uses
+ * resolveInstanceTarget — the same priority chain every lifecycle command uses
  * (--instance-dir > --name > CWD manifest > refusal with candidate list).
  * `--name` has no default; every invocation must resolve via one of the
  * above paths.

package/dist/cli/commands/orchestrator-service/uninstall.d.ts

@@ -2,7 +2,7 @@
  * `kici-admin orchestrator uninstall` command.
  *
  * Removes the orchestrator service registration. Target resolution goes
- * through resolveInstance — the same priority chain every lifecycle command
+ * through resolveInstanceTarget — the same priority chain every lifecycle command
  * uses (--instance-dir > --name > CWD manifest > refusal with candidate list).
  * The manifest stays on disk so subsequent commands can still reference the
  * deploy folder; the host-wide index entry is dropped unconditionally so a

package/dist/cli/commands/orchestrator-service/upgrade.d.ts

@@ -17,5 +17,6 @@
  * of the above paths.
  */
 import type { Command } from 'commander';
-export declare function registerUpgradeCommand(parent: Command): void;
+import type { AdminApiClient } from '../../api-client.js';
+export declare function registerUpgradeCommand(parent: Command, tryGetClient: () => AdminApiClient | null): void;
 //# sourceMappingURL=upgrade.d.ts.map

package/dist/cli/commands/rotate.d.ts

@@ -1,7 +1,7 @@
 /**
  * Key rotation command for kici-admin.
  *
- * Re-encrypts all PG-stored secrets with the current master key.
+ * Re-encrypts every master-key-wrapped store with the current master key.
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';

package/dist/cli/commands/shared/env-file-mode.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Permissions for a service env file written by `kici-admin`.
+ *
+ * Both installers write a file that carries credentials — the orchestrator's
+ * holds KICI_SECRET_KEY, KICI_DATABASE_URL and KICI_PLATFORM_TOKEN, the
+ * agent's holds KICI_AGENT_TOKEN — so neither may be group- or
+ * world-readable. The same mode guards the temporary Postgres password file in
+ * `orchestrator-service/install.ts` and the peer credential file in
+ * `cluster/peer-credentials.ts`.
+ *
+ * The guarantee is POSIX-only. Node maps a mode onto Windows by toggling the
+ * read-only attribute and changes no ACL, so a Windows install must restrict
+ * the file itself.
+ */
+export declare const ENV_FILE_MODE = 384;
+//# sourceMappingURL=env-file-mode.d.ts.map

package/dist/cli/commands/shared/upgrade-hooks.d.ts

@@ -0,0 +1,32 @@
+import type { AdminApiClient } from '../../api-client.js';
+import type { UpgradeHooks } from './versioned-upgrade.js';
+/**
+ * Resolve the database URL the pre-upgrade dump connects with.
+ *
+ * The instance's env file is the authority — the same file the service itself
+ * is started from — so the dump is taken against exactly the database the
+ * running orchestrator uses, not whatever the operator's shell happens to
+ * export.
+ */
+export declare function readDatabaseUrlFromEnvFile(contents: string): string | null;
+export interface BuildUpgradeHooksIo {
+    readFile: (p: string) => string;
+    now?: () => Date;
+}
+/**
+ * Build the hook set for an orchestrator upgrade.
+ *
+ * `instanceDir` is resolved lazily, at the moment a hook runs, because the
+ * upgrade resolves its target after the command is registered.
+ */
+export declare function buildUpgradeHooks(tryGetClient: () => AdminApiClient | null, io?: BuildUpgradeHooksIo): UpgradeHooks;
+/**
+ * Read `KICI_DATABASE_URL` from the instance env file, falling back to the
+ * process environment.
+ *
+ * Throws rather than returning null: an upgrade that cannot find the database
+ * must refuse loudly, since a silent skip is exactly the failure this hook
+ * exists to prevent.
+ */
+export declare function resolveDatabaseUrl(envFilePath: string, readFile: (p: string) => string): string;
+//# sourceMappingURL=upgrade-hooks.d.ts.map

package/dist/cli/commands/shared/upgrade-safety.d.ts

@@ -0,0 +1,81 @@
+/** The drain snapshot both the CLI verb and this module poll. */
+export interface DrainSnapshot {
+    draining: boolean;
+    jobsRunning: number;
+}
+export interface WaitOpts {
+    timeoutMs: number;
+    intervalMs: number;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * Poll until no jobs are running, or the deadline passes.
+ *
+ * Extracted so the upgrade and `kici-admin orchestrator drain --wait` share one
+ * implementation rather than two that can disagree about what quiesced means.
+ */
+export declare function waitForQuiesce(poll: () => Promise<DrainSnapshot>, opts: WaitOpts): Promise<{
+    quiesced: boolean;
+    jobsRunning: number;
+}>;
+/** One entry of `GET /api/v1/admin/db/migrate/status`. */
+export interface MigrationStatusRow {
+    name: string;
+    status: string;
+}
+/**
+ * The last applied migration reported by a running service.
+ *
+ * Returns null when nothing has been applied — a fresh database — which the
+ * caller must not confuse with "could not read it".
+ */
+export declare function appliedHead(rows: readonly MigrationStatusRow[]): string | null;
+/** Migrations applied after `head`, in ledger order. */
+export declare function migrationsAfter(rows: readonly MigrationStatusRow[], head: string): string[];
+export type SchemaGuardVerdict = {
+    kind: 'ok';
+} | {
+    kind: 'unknown-head';
+    message: string;
+} | {
+    kind: 'ahead';
+    extra: string[];
+    message: string;
+};
+/**
+ * Decide whether the version pointer may move.
+ *
+ * Three outcomes, and the middle one is the compatibility shim: an instance
+ * installed before `migrationHeads` existed has no recorded head, and refusing
+ * there would break the documented `--rollback` on exactly the installs that
+ * predate the guard. So an unknown head warns loudly and falls through to the
+ * existing confirmation prompt; the map is populated at the next version
+ * change, arming the guard one upgrade later.
+ */
+export declare function schemaGuardVerdict(input: {
+    targetVersion: string;
+    recordedHead: string | null | undefined;
+    liveRows: readonly MigrationStatusRow[];
+}): SchemaGuardVerdict;
+/** Merge one version's head into the manifest map, never replacing it. */
+export declare function mergeMigrationHead(existing: Record<string, string> | undefined, version: string, head: string | null): Record<string, string> | undefined;
+/** Read the live applied head, returning null when the service cannot answer. */
+export declare function readLiveMigrationRows(fetchStatus: () => Promise<{
+    migrations: MigrationStatusRow[];
+}>): Promise<MigrationStatusRow[] | null>;
+/** Format the reason a pre-upgrade backup could not be taken. */
+export declare function backupRefusalMessage(reason: string): string;
+/**
+ * Format the drain-timeout refusal.
+ *
+ * The refusal leaves the coordinator draining — deliberately, so the in-flight
+ * jobs finish without new ones piling up behind them. But a drained
+ * coordinator accepts nothing, so the message has to say so and name the way
+ * back; an operator who reads only "wait and re-run" does not know their CI is
+ * stalled meanwhile.
+ */
+export declare function drainTimeoutMessage(jobsRunning: number, timeoutSeconds: number): string;
+/** Describe a failure to reach the admin API during the pre-stop phase. */
+export declare function adminApiUnavailable(action: string, err: unknown): string;
+//# sourceMappingURL=upgrade-safety.d.ts.map

package/dist/cli/commands/shared/versioned-upgrade.d.ts

@@ -9,13 +9,14 @@
  */
 import { type NpmInstallTarget, type ResolvedInstance, type ServiceManager, type ServicePlatform } from '../../service/index.js';
 import type { LaunchSpec, ServiceConfig } from '../../service/types.js';
+import { type MigrationStatusRow } from './upgrade-safety.js';
 /** Component types that can be upgraded. */
 type UpgradeComponent = 'orchestrator' | 'agent';
 /** Options for the versioned upgrade command. */
 interface VersionedUpgradeOptions {
     platform?: ServicePlatform;
     /**
-     * Service name. No default — targeting flows through {@link resolveInstance}
+     * Service name. No default — targeting flows through {@link resolveInstanceTarget}
      * which consumes `name`, `instanceDir`, or the CWD manifest in priority order.
      */
     name?: string;
@@ -34,6 +35,50 @@ interface VersionedUpgradeOptions {
      * self-driving the npm install (the pre-staged / air-gapped path).
      */
     restartOnly?: boolean;
+    /** Skip the pre-upgrade dump. Loud: printed as a banner and echoed at the end. */
+    skipBackup?: boolean;
+    /** Where the pre-upgrade dump goes. Defaults to `<instanceDir>/backups`. */
+    backupDir?: string;
+    /** Skip quiescing the coordinator before the restart. */
+    noDrain?: boolean;
+    /** Seconds to wait for in-flight jobs to finish. Default 300. */
+    drainTimeout?: string;
+    /**
+     * On a rollback whose database is ahead of the target, revert the schema to
+     * the target's recorded head first, through the still-running newer service.
+     */
+    migrateDown?: boolean;
+}
+/**
+ * The orchestrator-only pre-stop steps, injected so the agent upgrade can pass
+ * none and stay unchanged, and so each is testable without a live service.
+ */
+export interface UpgradeHooks {
+    /** Read the live migration ledger from the running service. */
+    migrationStatus?: () => Promise<{
+        migrations: MigrationStatusRow[];
+    }>;
+    /** Put the coordinator into drain and poll until quiesced. */
+    drain?: (timeoutSeconds: number) => Promise<{
+        quiesced: boolean;
+        jobsRunning: number;
+    }>;
+    /** Revert the schema to `head` through the running service. */
+    migrateDown?: (head: string) => Promise<void>;
+    /**
+     * Take the pre-upgrade dump, returning where it landed.
+     *
+     * `envFilePath` comes from the instance manifest, so the dump is taken
+     * against exactly the database the running service uses rather than whatever
+     * the operator's shell exports.
+     */
+    backup?: (args: {
+        outputPath: string;
+        envFilePath: string;
+    }) => Promise<{
+        outputPath: string;
+        byteSize: number;
+    }>;
 }
 /**
  * Resolved upgrade target: the manifest-backed ServiceConfig the upgrade
@@ -44,12 +89,21 @@ export interface UpgradeTarget {
     config: ServiceConfig;
     installBase: string;
     resolvedInstance: ResolvedInstance;
+    /** The driver that manages this install — built for {@link UpgradeTarget.platform}. */
+    manager: ServiceManager;
+    /**
+     * The install's own platform: `platformOverride ?? manifest.platform`. Every
+     * downstream question the upgrade asks — the root check, the launcher name,
+     * whether the current version reads a symlink or a version file — is about
+     * the layout on disk, so it is answered from the install, not the host.
+     */
+    platform: ServicePlatform;
 }
 /**
  * Resolve the upgrade target via the folder-anchored model and build the
  * ServiceConfig + installBase the rest of the upgrade flow needs.
  *
- * Priority chain (delegated to {@link resolveInstance}):
+ * Priority chain (delegated to {@link resolveInstanceTarget}):
  *   1. `opts.instanceDir` — read manifest at that path.
  *   2. `opts.name`        — match against listInstances() output.
  *   3. CWD manifest       — read `./.kici-<component>.json`.
@@ -65,9 +119,12 @@ export declare function resolveUpgradeTarget(args: {
         instanceDir?: string;
         name?: string;
     };
-    manager: ServiceManager;
+    /** The `--platform` flag. When set it forces the driver, as it always has. */
+    platformOverride?: ServicePlatform;
     isUserLevel: boolean;
     kiciRoot: string;
+    /** Driver factory. Defaults to the service barrel's createServiceManager. */
+    createManager?: (platform: ServicePlatform) => Promise<ServiceManager>;
 }): Promise<UpgradeTarget>;
 /**
  * Install base for a KiCI component instance.
@@ -220,15 +277,7 @@ export declare function installGlobalPackage(target: NpmInstallTarget, version:
     ok: boolean;
     stderr: string;
 };
-export declare function performVersionedUpgrade(component: UpgradeComponent, opts: VersionedUpgradeOptions): Promise<void>;
-/**
- * Stop the service, switch the active version pointer to an already-installed
- * versioned directory (atomic symlink on Unix; uninstall→install + version file
- * on Windows), restart, and persist the new `kiciVersion` into the manifest.
- *
- * Shared by `--rollback` (switch to the previous version) and `--pick` (switch
- * to any chosen installed version).
- */
+export declare function performVersionedUpgrade(component: UpgradeComponent, opts: VersionedUpgradeOptions, hooks?: UpgradeHooks): Promise<void>;
 export declare function switchToInstalledVersion(args: {
     component: UpgradeComponent;
     platform: ServicePlatform;
@@ -237,6 +286,12 @@ export declare function switchToInstalledVersion(args: {
     manager: ServiceManager;
     resolvedInstance: ResolvedInstance;
     targetVersion: string;
+    /** Orchestrator-only pre-stop capabilities. Omitted by the agent upgrade. */
+    hooks?: UpgradeHooks;
+    /** Revert the schema to the target's recorded head before switching. */
+    migrateDown?: boolean;
+    /** Skip the confirmation the unknown-head warning falls through to. */
+    yes?: boolean;
 }): Promise<void>;
 export {};
 //# sourceMappingURL=versioned-upgrade.d.ts.map

package/dist/cli/commands/source.d.ts

@@ -9,6 +9,7 @@
  *   source update <routingKey> Update a GitHub source
  *   source update-generic <id> Update a generic source
  *   source remove <routingKey> Remove a source (GitHub or generic with --generic flag)
+ *   source redeliver <routingKey> Replay a window of GitHub webhook deliveries
  *   source enable <id>        Enable a generic source
  *   source disable <id>       Disable a generic source
  *

package/dist/cli/commands/token.d.ts

@@ -15,5 +15,9 @@ import type { AdminApiClient } from '../api-client.js';
  * other input so a typo never silently creates a non-expiring token.
  */
 export declare function parseExpiresAt(input: string, now?: Date): Date;
+/**
+ * Format tokens as a table.
+ */
+export declare function formatTokenTable(tokens: any[]): string;
 export declare function registerTokenCommands(program: Command, getClient: () => AdminApiClient): void;
 //# sourceMappingURL=token.d.ts.map