@kici-dev/orchestrator 0.9.1 → 0.11.0

package/dist/cli/commands/attestations.d.ts

@@ -1,3 +1,13 @@
+/**
+ * `kici-admin attestations` — orchestrator-DB-direct provenance maintenance.
+ *
+ *   attestations reverify [--all]   Recompute stored verdicts (verify-at-ingest
+ *                                   backfill). Default scope: pending /
+ *                                   unverifiable rows; `--all` re-evaluates
+ *                                   every row. Direct DB + object storage.
+ *
+ * Classified `kici-admin` (orchestrator DB plane) per .claude/rules/platform-admin.md.
+ */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
 export declare function registerAttestationsCommands(program: Command, getClient: () => AdminApiClient): void;

package/dist/cli/commands/cold-store-impl.d.ts

@@ -45,7 +45,7 @@ export declare function replayChunk(opts: {
     instanceId?: string;
 }): Promise<void>;
 /**
- * Phase F — promote a chunk's rows BACK into the orchestrator PG.
+ * Promote a chunk's rows back into the orchestrator PG.
  * Mirrors the Platform-side `replayIntoPg`. Adapter must implement
  * `replayInsert` — currently only `execution_runs`.
  */
@@ -65,7 +65,7 @@ export declare function reconcile(opts: {
     instanceId?: string;
 }): Promise<void>;
 /**
- * Phase 2 — list chunks past their cold-retention horizon. Read-only;
+ * List chunks past their cold-retention horizon. Read-only;
  * no S3 or PG mutation. Emits one JSON line per row so the output is
  * easy to pipe through `jq` / `column -t` / etc.
  */
@@ -77,7 +77,7 @@ export declare function listPurgeable(opts: {
     instanceId?: string;
 }): Promise<void>;
 /**
- * Phase 2 — delete S3 objects + clean up PG bookkeeping for chunks
+ * Delete S3 objects + clean up PG bookkeeping for chunks
  * past their cold-retention horizon. Defaults to dry-run; pass
  * `--apply` to actually delete.
  */

package/dist/cli/commands/cold-store.d.ts

@@ -1,9 +1,9 @@
 /**
  * Cold-store commands for kici-admin (orchestrator side).
  *
- * Phase C: every subcommand has a real implementation that builds an
- * `OrchestratorColdStore` against the orchestrator Postgres + S3 and
- * delegates to the helpers in `cold-store-impl.ts`. Mirrors
+ * Every subcommand builds an `OrchestratorColdStore` against the
+ * orchestrator Postgres + S3 and delegates to the helpers in
+ * `cold-store-impl.ts`. Mirrors
  * `kici-platform-admin cold-store …` on the Platform side.
  *
  *   cold-store archive-now <table>       Run one cycle for a single adapter
@@ -11,7 +11,10 @@
  *   cold-store list-chunks <table>       List chunks for a table
  *   cold-store verify-chunk <chunkId>    Recompute contentHash for a chunk
  *   cold-store replay-chunk <chunkId>    Re-run UPDATE+DELETE for a stuck chunk
+ *   cold-store replay-into-pg <chunkId>  Promote a chunk's rows back into PG
  *   cold-store reconcile <table>         Rebuild orphaned manifests from data
+ *   cold-store list-purgeable            List chunks past cold retention
+ *   cold-store purge-now                 Purge expired chunks (dry-run default)
  *   cold-store peek-chunk <chunkId>      Stream the first N rows of a chunk
  *
  * The CLI talks **directly** to the orchestrator Postgres (and the same

package/dist/cli/commands/context.d.ts

@@ -3,13 +3,15 @@
  *
  *   context create         — upsert a context
  *   context bind           — bind a scope pattern to a context
- *   context set-policy     — update policy fields (branch, reviewers, timers, trust)
+ *   context set-policy     — update policy fields (branch, repo patterns, reviewers, timers, trust)
  *   context list           — list contexts for an org
  *   context show           — show a single context with variables + bindings
  *   context delete         — delete a context (cascades bindings, variables, overrides; held-run history survives; pending held runs block with a clear error, resolved holds do not)
  *   context create-template — create/update a context template + its seed variables
+ *   context source-override list|set|delete — per-source variable overrides (HTTP only)
  *
- * Each command supports two modes (stage-4 pattern from `maintenance.ts`):
+ * Each command except `source-override` supports two modes, the same split
+ * `maintenance.ts` uses:
  *
  *   HTTP mode (default): requires `--url` + `--token`, routes through the
  *   orchestrator admin HTTP API at /api/v1/admin/contexts.
@@ -21,5 +23,7 @@
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
+/** `--enabled`: absent stays undefined (keep the stored flag); only `false` disables. */
+export declare function parseEnabledOption(raw: string | undefined): boolean | undefined;
 export declare function registerContextCommands(program: Command, getClient: () => AdminApiClient): void;
 //# sourceMappingURL=context.d.ts.map

package/dist/cli/commands/dashboard-encryption-key.d.ts

@@ -1,3 +1,21 @@
+/**
+ * `kici-admin dashboard-encryption-key` — the orchestrator's X25519
+ * dashboard-encryption key: the trust root a browser seals a secret / variable
+ * value to under the `encrypted` dashboard-write posture, so the hosted control
+ * plane relays only opaque ciphertext.
+ *
+ *   dashboard-encryption-key show     Print the active kid, its public JWK, where
+ *                                     the JWKS is published, and the Verified-tier
+ *                                     URL (when that tier is opted into).
+ *   dashboard-encryption-key list     List every key on record (kid / status / created_at).
+ *   dashboard-encryption-key rotate   Mint a new active key; the prior active key
+ *                                     is retired from the published JWKS, but its
+ *                                     private half stays on record so envelopes
+ *                                     already sealed to it still decrypt.
+ *
+ * The PRIVATE half is master-key wrapped (`KICI_SECRET_KEY`) in the orchestrator
+ * DB and is never exportable — recovery from a lost key is a routine rotation.
+ */
 import type { Command } from 'commander';
 export declare function registerDashboardEncryptionKeyCommands(program: Command): void;
 //# sourceMappingURL=dashboard-encryption-key.d.ts.map

package/dist/cli/commands/event-dlq.d.ts

@@ -6,8 +6,8 @@
  *   event-dlq retry <id>     — clear DLQ flag, schedule for retry, pg_notify
  *   event-dlq discard <id>   — permanently delete a DLQ event
  *
- * Operator dogfooding path for at-least-once event delivery (Phase 5 of the
- * event durability work). Customers should generally never see anything in
+ * Operator dogfooding path for at-least-once event delivery. Customers
+ * should generally never see anything in
  * the DLQ — when something lands here it usually means a workflow handler is
  * consistently failing and should be fixed at its root cause. This CLI is the
  * triage surface: inspect last_error, retry once a fix is deployed, or discard

package/dist/cli/commands/registration.d.ts

@@ -1,16 +1,20 @@
 /**
- * Workflow registration read CLI commands for kici-admin (5a #4).
+ * Workflow registration CLI commands for kici-admin.
  *
  *   registration list [--org <id>] [--routing-key <k>] [--repo <ident>] [--limit <n>]
  *   registration show <id>
+ *   registration disable <id> | enable <id>
+ *   registration delete <id> [--yes]
  *
  * A distinct namespace from `workflow list` — `workflow` is workflow-code,
  * `registration` is the registered-workflow-instance row in
- * workflow_registrations. Both coexist; the existing `workflow list` is
- * untouched by this plan.
+ * workflow_registrations. Both coexist.
  *
- * Dual-mode: HTTP (via AdminApiClient on the existing
+ * `list` and `show` are dual-mode: HTTP (via AdminApiClient on the
  * /api/v1/admin/registrations admin API) or `--database-url` (direct DB).
+ * `disable`, `enable` and `delete` are HTTP only: they are the operator path
+ * for the dashboard's registration writes, and the admin route bumps the
+ * registry version so every peer reloads.
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';

package/dist/cli/commands/runs.d.ts

@@ -28,6 +28,13 @@
  */
 import type { Command } from 'commander';
 import type { AdminApiClient } from '../api-client.js';
+import { type AgentStepLogs } from '@kici-dev/engine';
+/**
+ * The note `runs logs` prints when a step has no lines: whether no log was ever
+ * recorded, or a log is stored and holds nothing. `null` when the step has
+ * lines, or when the orchestrator does not report which case applies.
+ */
+export declare function emptyStepLogNote(stepIndex: number, logs: Pick<AgentStepLogs, 'totalLines' | 'recorded'>): string | null;
 /**
  * Register the `runs` command group with kici-admin.
  */

package/dist/cli/commands/secret.d.ts

@@ -3,6 +3,7 @@
  *
  * Provides scoped secret operations:
  *   secret scopes, list, set, delete, fix-prefixed-scopes
+ *   secret scope create|rename|delete
  *
  * Secret values are write-only -- there is no "get value" command.
  */

package/dist/cli/commands/shared/confirm.d.ts

@@ -0,0 +1,19 @@
+/** Message of the error raised when stdin ends before the operator answers. */
+export declare const NO_CONFIRMATION_ANSWER: string;
+/** The streams the prompt writes to and reads from. */
+export interface ConfirmIo {
+    input: NodeJS.ReadableStream;
+    output: NodeJS.WritableStream;
+}
+/**
+ * Write `prompt` and read one line of answer.
+ *
+ * Resolves true when the line is `y` or `yes` (any case, surrounding spaces
+ * ignored) and false for any other line. Rejects with
+ * {@link NO_CONFIRMATION_ANSWER} when stdin ends before a line arrives, as it
+ * does for a script, a cron job or a `< /dev/null` redirect. Resolving false
+ * there would let a verb run without `--yes` exit 0 having done nothing, and
+ * the script that ran it would read that as success.
+ */
+export declare function confirmPrompt(prompt: string, io?: ConfirmIo): Promise<boolean>;
+//# sourceMappingURL=confirm.d.ts.map

package/dist/cli/commands/shared/unbound-context-warning.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The warning `kici-admin context create` and `kici-admin secret set` print
+ * when a context's secrets cannot reach any job.
+ *
+ * A job that lists a context in its `contexts:` receives the context's
+ * secrets only through the context's scope bindings: the secret resolver reads
+ * the bindings of the context row the job's declared name matched — a fixed
+ * context by its exact name, a glob context by its pattern — and returns
+ * nothing when there are none. So such a context with no binding delivers no
+ * secret to those jobs, whatever its scopes hold, and nothing fails loudly — a
+ * workflow's `ctx.secrets.get()` throws at run time instead. A
+ * `<context>:<key>` git-credential or registry reference to a fixed context
+ * still reads the scope named after it, through a deprecated fallback; a glob
+ * context has no such fallback. The warning names the context, that fallback
+ * where it applies, and the `context bind` command that fixes it.
+ *
+ * Advisory only: the lookup runs after the command's own write succeeded, and
+ * a failed lookup prints nothing, so the command's exit code never changes.
+ */
+import { ContextType } from '@kici-dev/engine';
+/** The one admin API call the lookup needs, so any client shape satisfies it. */
+export interface ContextLookupClient {
+    get<T>(path: string): Promise<T>;
+}
+export interface WarnIfContextUnboundArgs {
+    orgId: string;
+    /** The context name; for `secret set` this is the scope the secret was written to. */
+    name: string;
+    /** Direct-DB mode when set; otherwise the admin API through `client`. */
+    dbUrl: string | null;
+    client?: ContextLookupClient;
+    /** Where the warning goes; stderr by default. */
+    warn?: (line: string) => void;
+}
+/** The warning line for a context of `type` with no binding. */
+export declare function unboundContextWarning(orgId: string, name: string, type: ContextType): string;
+/**
+ * Print the unbound-context warning when `name` is a context a job can resolve
+ * through (a fixed or glob context, `ContextType`) that has no binding. A
+ * template row is a seed for other contexts, not a job context, and stays silent.
+ */
+export declare function warnIfContextUnbound(args: WarnIfContextUnboundArgs): Promise<void>;
+//# sourceMappingURL=unbound-context-warning.d.ts.map

package/dist/cli/commands/signing-key.d.ts

@@ -1,3 +1,24 @@
 import type { Command } from 'commander';
-export declare function registerSigningKeyCommands(program: Command): void;
+import { OrchestratorSigningKeyRepo } from '../../db/repos/signing-keys-repo.js';
+import type { AdminApiClient } from '../api-client.js';
+/** Outcome of {@link generateInitialSigningKey}. */
+export type InitialSigningKeyOutcome = {
+    created: true;
+    kid: string;
+} | {
+    created: false;
+    activeKid: string;
+};
+/**
+ * Generate the initial db-custody key and activate it only while no key is
+ * active. Orchestrator nodes create the key on their own, so a node may win the
+ * race after the command's check; the node's key then stays active, because the
+ * nodes already sign with it, and its kid is returned.
+ */
+export declare function generateInitialSigningKey(repo: OrchestratorSigningKeyRepo, secretKey: string): Promise<InitialSigningKeyOutcome>;
+/**
+ * Register `kici-admin signing-key`. `tryGetClient` returns null when no admin
+ * token is configured, so `list` can name both of its data sources.
+ */
+export declare function registerSigningKeyCommands(program: Command, tryGetClient: () => AdminApiClient | null): void;
 //# sourceMappingURL=signing-key.d.ts.map