@kici-dev/orchestrator 0.9.1 → 0.10.0

package/dist/cli/commands/shared/unbound-context-warning.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The warning `kici-admin context create` and `kici-admin secret set` print
+ * when a context's secrets cannot reach any job.
+ *
+ * A job that lists a context in its `contexts:` receives the context's
+ * secrets only through the context's scope bindings: the secret resolver reads
+ * the bindings of the context row the job's declared name matched — a fixed
+ * context by its exact name, a glob context by its pattern — and returns
+ * nothing when there are none. So such a context with no binding delivers no
+ * secret to those jobs, whatever its scopes hold, and nothing fails loudly — a
+ * workflow's `ctx.secrets.get()` throws at run time instead. A
+ * `<context>:<key>` git-credential or registry reference to a fixed context
+ * still reads the scope named after it, through a deprecated fallback; a glob
+ * context has no such fallback. The warning names the context, that fallback
+ * where it applies, and the `context bind` command that fixes it.
+ *
+ * Advisory only: the lookup runs after the command's own write succeeded, and
+ * a failed lookup prints nothing, so the command's exit code never changes.
+ */
+import { ContextType } from '@kici-dev/engine';
+/** The one admin API call the lookup needs, so any client shape satisfies it. */
+export interface ContextLookupClient {
+    get<T>(path: string): Promise<T>;
+}
+export interface WarnIfContextUnboundArgs {
+    orgId: string;
+    /** The context name; for `secret set` this is the scope the secret was written to. */
+    name: string;
+    /** Direct-DB mode when set; otherwise the admin API through `client`. */
+    dbUrl: string | null;
+    client?: ContextLookupClient;
+    /** Where the warning goes; stderr by default. */
+    warn?: (line: string) => void;
+}
+/** The warning line for a context of `type` with no binding. */
+export declare function unboundContextWarning(orgId: string, name: string, type: ContextType): string;
+/**
+ * Print the unbound-context warning when `name` is a context a job can resolve
+ * through (a fixed or glob context, `ContextType`) that has no binding. A
+ * template row is a seed for other contexts, not a job context, and stays silent.
+ */
+export declare function warnIfContextUnbound(args: WarnIfContextUnboundArgs): Promise<void>;
+//# sourceMappingURL=unbound-context-warning.d.ts.map

package/dist/cli/commands/signing-key.d.ts

@@ -1,3 +1,24 @@
 import type { Command } from 'commander';
-export declare function registerSigningKeyCommands(program: Command): void;
+import { OrchestratorSigningKeyRepo } from '../../db/repos/signing-keys-repo.js';
+import type { AdminApiClient } from '../api-client.js';
+/** Outcome of {@link generateInitialSigningKey}. */
+export type InitialSigningKeyOutcome = {
+    created: true;
+    kid: string;
+} | {
+    created: false;
+    activeKid: string;
+};
+/**
+ * Generate the initial db-custody key and activate it only while no key is
+ * active. Orchestrator nodes create the key on their own, so a node may win the
+ * race after the command's check; the node's key then stays active, because the
+ * nodes already sign with it, and its kid is returned.
+ */
+export declare function generateInitialSigningKey(repo: OrchestratorSigningKeyRepo, secretKey: string): Promise<InitialSigningKeyOutcome>;
+/**
+ * Register `kici-admin signing-key`. `tryGetClient` returns null when no admin
+ * token is configured, so `list` can name both of its data sources.
+ */
+export declare function registerSigningKeyCommands(program: Command, tryGetClient: () => AdminApiClient | null): void;
 //# sourceMappingURL=signing-key.d.ts.map