@kici-dev/orchestrator 0.1.20 → 0.1.22

package/dist/routes/admin-sources.d.ts

@@ -11,6 +11,7 @@
 import { Hono } from 'hono';
 import type { SourceStore } from '../sources/source-store.js';
 import type { Role } from '../secrets/rbac.js';
+import { type FetchGithubAppIdentity } from '../github-app-name-refresher/github-app-name-refresher.js';
 interface SourceRouteDeps {
     sourceStore: SourceStore;
     /**
@@ -28,6 +29,23 @@ interface SourceRouteDeps {
         webhookUrl: string | null;
         webhookNote?: string;
     }>;
+    /**
+     * Resolve the org-scoped GitHub webhook URL for the manifest setup flow
+     * BEFORE any App exists. The GitHub webhook URL is org-scoped
+     * (`<base>/webhook/<orgId>/github`), not app-scoped, so it can be computed
+     * up front and baked into the App manifest. Returns null + a note when the
+     * orchestrator cannot yet resolve a public base or its org id.
+     */
+    resolveGithubWebhookUrl?: () => Promise<{
+        webhookUrl: string | null;
+        webhookNote?: string;
+    }>;
+    /**
+     * Fetch a GitHub App's authoritative `{ name, slug }` from GitHub. Injectable
+     * for tests; defaults to the real `fetchGithubAppIdentity`. Used by the
+     * `source refresh` route.
+     */
+    fetchAppIdentity?: FetchGithubAppIdentity;
 }
 type AdminSourcesEnv = {
     Variables: {

package/dist/routes/admin.d.ts

@@ -77,6 +77,14 @@ export interface AdminRouteDeps {
         webhookUrl: string | null;
         webhookNote?: string;
     }>;
+    /**
+     * Optional -- resolves the org-scoped GitHub webhook URL for the manifest
+     * setup pre-flight (before any App exists). Wired in platform/hybrid mode.
+     */
+    resolveGithubWebhookUrl?: () => Promise<{
+        webhookUrl: string | null;
+        webhookNote?: string;
+    }>;
     /** Optional -- for DB migration endpoints. */
     db?: Kysely<any>;
     /** Optional -- for DB migration endpoints. */

package/dist/secrets/pg-secret-store.d.ts

@@ -10,6 +10,15 @@ import { type Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { SecretStore } from '@kici-dev/engine';
 import type { AuditLogger } from './audit-logger.js';
+/**
+ * Thrown by `renameScope` when the named scope has no secret rows and no
+ * environment binding — i.e. there is nothing to rename. Consumers map this to
+ * a 404 (admin HTTP route) or a structured not-found response (dashboard path).
+ */
+export declare class SecretScopeNotFoundError extends Error {
+    readonly scope: string;
+    constructor(scope: string);
+}
 /**
  * PostgreSQL secret store with AES-256-GCM encryption.
  * Uses scoped_secrets table keyed by (org_id, scope, key).

package/dist/secrets/secret-resolver.d.ts

@@ -62,6 +62,21 @@ export interface ResolvedSecretMeta {
     backend: string;
     scope: string;
 }
+/**
+ * The public secret-resolution surface consumed by the dispatch path and the
+ * universal-git provider. `SecretResolver` implements this; the test adapter's
+ * `DecoratingSecretResolver` (CLI-secret overlay) implements it too, so either
+ * can flow through `ProcessingDeps.secretResolver`.
+ */
+export interface SecretResolverApi {
+    resolveForJob(orgId: string, environmentName: string): Promise<Record<string, string>>;
+    resolveNamed(orgId: string, scope: string, key: string, opts?: {
+        store?: string;
+        runId?: string;
+        jobId?: string;
+    }): Promise<string | null>;
+    resolveForJobWithMeta(orgId: string, environmentName: string): Promise<Record<string, ResolvedSecretMeta>>;
+}
 /**
  * Resolves secrets for a job by matching environment bindings against scoped secrets
  * from multiple backends.
@@ -71,7 +86,7 @@ export interface ResolvedSecretMeta {
  * are matched against binding patterns, and longest-path-wins uses the path AFTER
  * stripping the backend prefix.
  */
-export declare class SecretResolver {
+export declare class SecretResolver implements SecretResolverApi {
     private readonly environmentStore;
     private readonly bindingStore;
     private readonly backendStores;