@kici-dev/orchestrator 0.1.20 → 0.1.22

package/dist/environments/held-runs.d.ts

@@ -4,7 +4,7 @@
  * Manages the lifecycle: pending -> approved/rejected/expired.
  */
 import { type Kysely } from 'kysely';
-import { type ApprovalRequirement, type ApproverClause, ApprovalDecision, HoldScope, TriggerSource } from '@kici-dev/engine';
+import { type ApprovalRequirement, type ApproverClause, type StepApprovalPayload, ApprovalDecision, HoldScope, TriggerSource } from '@kici-dev/engine';
 import type { Database, HeldRun, HeldRunApproval } from '../db/types.js';
 /** Status values for held runs (held_runs table). */
 export declare enum HeldRunStatus {
@@ -51,6 +51,12 @@ export interface CreateHoldData {
      * the automated release sweeps can find their rows.
      */
     holdType?: string;
+    /**
+     * Drift payload `{ summaryMarkdown, drift }` captured for a `when: 'drift'`
+     * step gate; persisted to `held_runs.payload` and surfaced in the dashboard
+     * approval queue + the CLI. Omit for non-drift holds.
+     */
+    payload?: StepApprovalPayload;
 }
 /** A single decision to record against a hold. */
 export interface RecordDecisionData {

package/dist/github-app-name-refresher/github-app-name-refresher.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Daily refresh of every GitHub source's display name + slug from GitHub.
+ *
+ * GitHub is the source of truth for a GitHub-App source's display name and
+ * slug. They are captured at creation, but an operator can rename the App in
+ * the GitHub UI afterwards — this periodic task re-fetches `GET /app` for each
+ * GitHub source and, when the name or slug drifted, writes the new values to
+ * the `sources` row. The `sources_change` DB trigger then fans the change out
+ * (SourceManager reload → `platformClient.updateSources()` → re-register), so
+ * the Platform `webhook_sources` row and the dashboard Sources tab pick up the
+ * new name/slug without any extra plumbing here.
+ *
+ * Lifecycle mirrors `StaleRunDetector`: `start()` runs an immediate refresh
+ * (so a rename made while the orchestrator was down propagates on next boot)
+ * then a `setInterval`; `stop()` clears it. Per-source errors are logged and
+ * never abort the loop.
+ */
+/** The slice of {@link SourceStore} this module needs. */
+export interface RefreshableSourceStore {
+    listSources(): Promise<Array<{
+        routing_key: string;
+        provider: string;
+        name: string;
+        slug: string | null;
+    }>>;
+    getSourceWithSecrets(routingKey: string): Promise<{
+        provider: string;
+        config: string;
+        privateKey: string;
+    } | null>;
+    updateSource(routingKey: string, updates: {
+        name?: string;
+        slug?: string | null;
+    }): Promise<unknown>;
+}
+/** Fetch a GitHub App's authoritative identity. Matches `fetchGithubAppIdentity`. */
+export type FetchGithubAppIdentity = (creds: {
+    appId: string;
+    privateKey: string;
+}) => Promise<{
+    name: string;
+    slug: string;
+}>;
+/** Outcome of a single source refresh. */
+export interface RefreshResult {
+    routingKey: string;
+    changed: boolean;
+    oldName: string;
+    newName: string;
+    oldSlug: string | null;
+    newSlug: string;
+}
+/**
+ * Re-fetch one GitHub source's identity from GitHub and persist it when the
+ * name or slug drifted. Shared by the daily task and `kici-admin source
+ * refresh`. Throws for a missing or non-GitHub routing key.
+ */
+export declare function refreshGithubSourceIdentity(sourceStore: RefreshableSourceStore, routingKey: string, fetchIdentity: FetchGithubAppIdentity): Promise<RefreshResult>;
+export interface GithubAppNameRefresherDeps {
+    sourceStore: RefreshableSourceStore;
+    fetchIdentity: FetchGithubAppIdentity;
+    /** Refresh cadence in ms. Default cluster value: 24h (`config.githubAppNameRefreshIntervalMs`). */
+    scanIntervalMs: number;
+}
+export declare class GithubAppNameRefresher {
+    private readonly sourceStore;
+    private readonly fetchIdentity;
+    private readonly scanIntervalMs;
+    private interval;
+    constructor(deps: GithubAppNameRefresherDeps);
+    /** Immediate refresh then periodic scans. */
+    start(): Promise<void>;
+    stop(): void;
+    /** Refresh every GitHub source once. Per-source failures are isolated. */
+    refresh(): Promise<void>;
+}
+//# sourceMappingURL=github-app-name-refresher.d.ts.map

package/dist/index.d.ts

@@ -4,5 +4,9 @@ export { createCacheStorage } from './storage/index.js';
 export { SourceCache } from './cache/source-cache.js';
 export { DepCache } from './cache/dep-cache.js';
 export { UserCache, DEFAULT_USER_CACHE_QUOTA_BYTES, DEFAULT_USER_CACHE_TTL_MS, type UserCacheRef, type UserCacheRestoreResult, type UserCacheBeginSaveResult, } from './cache/user-cache.js';
-export { PeerCredentialStore, createPeerCredentialStoreFromUrl, type PeerCredential, } from './cluster/peer-credentials.js';
+export { PeerCredentialStore, createPeerCredentialStoreFromUrl, type PeerCredential, type CredentialFileData, } from './cluster/peer-credentials.js';
+export { PeerAuthCoordinator, type AuthDecision, type RejectionAction, } from './cluster/peer-auth-coordinator.js';
+export { JoinTokenManager, createJoinTokenManagerFromUrl } from './cluster/join-token.js';
+export { AdminApiClient } from './cli/api-client.js';
+export { runGithubManifestSetup, type ManifestSetupOptions, type ManifestSetupDeps, } from './cli/commands/source-manifest.js';
 //# sourceMappingURL=index.d.ts.map