@kici-dev/orchestrator 0.14.2 → 0.16.0

package/dist/routes/admin-sources.d.ts

@@ -9,56 +9,59 @@
  * the admin auth middleware in admin.ts.
  */
 import { Hono } from 'hono';
-import { OrchestratorMode } from '@kici-dev/engine';
 import type { SourceStore } from '../sources/source-store.js';
-import type { Role } from '../secrets/rbac.js';
+import { type WebhookUrlResolution } from '../sources/webhook-url-resolvers.js';
 import { type RedeliverWindowResult } from '../providers/github/deliveries.js';
-import { type FetchGithubAppIdentity } from '../github-app-name-refresher/github-app-name-refresher.js';
+import { type FetchGithubAppIdentity, type FetchGithubAppInstallations } from '../github-app-name-refresher/github-app-name-refresher.js';
+import { type AdminEnv } from './admin-env.js';
 interface SourceRouteDeps {
     sourceStore: SourceStore;
     /**
      * Resolve the public webhook URL for a freshly added source so the CLI can
-     * print it. Platform/hybrid mode registers the source with the Platform and
-     * reads the URL from the `source.register.ack`; independent mode returns a
-     * null URL with an explanatory `webhookNote`. Omitted in deployments with no
+     * print it, by mode: platform and hybrid read the Platform's URL from the
+     * `source.register.ack` (hybrid falls back to its own URL); observed and
+     * independent return this orchestrator's own per-source URL. A null URL
+     * carries a `webhookNote` that says why. Omitted in deployments with no
      * resolver wired (the route then returns `webhookUrl: null`).
      */
     resolveSourceWebhookUrl?: (params: {
         routingKey: string;
         provider: string;
         sourceId: string;
-    }) => Promise<{
-        webhookUrl: string | null;
-        webhookNote?: string;
-    }>;
+    }) => Promise<WebhookUrlResolution>;
     /**
      * Resolve the org-scoped GitHub webhook URL for the manifest setup flow
      * BEFORE any App exists. The GitHub webhook URL is org-scoped
      * (`<base>/webhook/<orgId>/github`), not app-scoped, so it can be computed
      * up front and baked into the App manifest. Returns null + a note when the
-     * orchestrator cannot yet resolve a public base or its org id.
+     * orchestrator cannot resolve it for its mode.
      */
-    resolveGithubWebhookUrl?: () => Promise<{
-        webhookUrl: string | null;
-        webhookNote?: string;
-    }>;
+    resolveGithubWebhookUrl?: () => Promise<WebhookUrlResolution>;
     /**
-     * Fetch a GitHub App's authoritative `{ name, slug }` from GitHub. Injectable
-     * for tests; defaults to the real `fetchGithubAppIdentity`. Used by the
-     * `source refresh` route.
+     * Build this orchestrator's own direct-ingress URL for a listed GitHub
+     * source, or null: platform mode serves no direct ingress, and without a
+     * public base or a known org there is no URL to print.
+     */
+    resolveSourceIngressUrl?: (row: {
+        id: string;
+        customerId: string | null;
+    }) => string | null;
+    /**
+     * Fetch a GitHub App's authoritative `{ name, slug }`, events and permissions
+     * from GitHub. Injectable for tests; defaults to the real
+     * `fetchGithubAppIdentity`. Used by the `source refresh` route.
      */
     fetchAppIdentity?: FetchGithubAppIdentity;
+    /**
+     * List a GitHub App's installations. Injectable for tests; defaults to
+     * `listGithubAppInstallations`. Used by the `source refresh` route.
+     */
+    fetchAppInstallations?: FetchGithubAppInstallations;
     /**
      * Replay a window of GitHub webhook deliveries for one App. Injectable for
      * tests; defaults to the real `redeliverWindow`.
      */
     redeliverDeliveries?: RedeliverDeliveries;
-    /**
-     * Orchestrator operating mode. `observed` refuses GitHub-App source creation:
-     * those sources are ingested through the Platform relay, and an observed
-     * orchestrator never accepts a relay. Omitted (undefined) behaves as before.
-     */
-    mode?: OrchestratorMode;
 }
 /** Replay a delivery window for a GitHub App. Matches `redeliverWindow`. */
 export type RedeliverDeliveries = (app: {
@@ -69,13 +72,6 @@ export type RedeliverDeliveries = (app: {
     until: Date;
     dryRun?: boolean;
 }) => Promise<RedeliverWindowResult>;
-type AdminSourcesEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
-export declare function createSourceRoutes(deps: SourceRouteDeps): Hono<AdminSourcesEnv>;
+export declare function createSourceRoutes(deps: SourceRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-sources.d.ts.map

package/dist/routes/admin-trust-policy.d.ts

@@ -23,8 +23,9 @@ import { Hono } from 'hono';
 import type { OrchestratorMode } from '@kici-dev/engine';
 import type { TrustPolicyStore } from '../security/trust-policy-store.js';
 import type { TrustDirectoryStore } from '../security/trust-directory-store.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
+import { type AdminEnv } from './admin-env.js';
 /**
  * Wording for the Platform-managed refusal. Shared with the CLI through the
  * response body — the CLI surfaces this verbatim rather than inventing its own.
@@ -76,13 +77,6 @@ interface TrustPolicyRouteDeps {
      */
     accessLog: AccessLogWriter;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createTrustPolicyRoutes(deps: TrustPolicyRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-trust-policy.d.ts.map

package/dist/routes/admin.d.ts

@@ -10,7 +10,7 @@
  */
 import { Hono } from 'hono';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { PgSecretStore } from '../secrets/pg-secret-store.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
 import type { AgentTokenStore } from '../agent/token-store.js';
@@ -21,6 +21,7 @@ import { type HeldRunReleaseWiring } from './admin-held-runs.js';
 import { type ClusterSettingsPropagationSource } from './admin-cluster-settings.js';
 import { type ScalerOrphansRouteDeps } from './admin-scaler-orphans.js';
 import { type PeerForgetRouteDeps } from './admin-peer-forget.js';
+import { type ScalerReloadRouteDeps } from './admin-scaler-reload.js';
 import type { DrainController } from '../drain/drain-controller.js';
 import type { SourceStore } from '../sources/source-store.js';
 import type { JoinTokenManager } from '../cluster/join-token.js';
@@ -30,9 +31,8 @@ import type { BackendSyncManager, OrchestratorMode } from '@kici-dev/engine';
 import type { Kysely } from 'kysely';
 import type pg from 'pg';
 import type { AccessLogWriter } from '../audit/access-log.js';
-/**
- * Dependencies for admin API routes.
- */
+import type { WebhookUrlResolution } from '../sources/webhook-url-resolvers.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminRouteDeps {
     tokenManager: TokenManager;
     /**
@@ -42,10 +42,8 @@ export interface AdminRouteDeps {
      */
     databaseUrl?: string;
     /**
-     * Orchestrator operating mode. Gates mode-specific admin behavior — today the
-     * `observed`-mode refusal of GitHub-App source creation (those sources are
-     * Platform-relayed by nature, and an observed orchestrator never accepts a
-     * relay). Optional so WS-only / test admins can omit it.
+     * Orchestrator operating mode. Gates mode-specific admin behavior. Optional so
+     * WS-only / test admins can omit it.
      */
     mode?: OrchestratorMode;
     /**
@@ -56,6 +54,12 @@ export interface AdminRouteDeps {
      * an independent orchestrator and on a test admin, which have no connection.
      */
     platformConnected?: () => boolean;
+    /**
+     * The org the Platform named on `auth.success`, read per request; `undefined`
+     * before the first authentication. Backs the attachment `GET /org-ids` reports.
+     * Absent on an independent orchestrator and on a test admin.
+     */
+    getPlatformOrgId?: () => string | undefined;
     rbac: RbacEnforcer;
     secretStore: PgSecretStore;
     auditLogger: AuditLogger;
@@ -104,26 +108,24 @@ export interface AdminRouteDeps {
     sourceStore?: SourceStore;
     /**
      * Optional -- resolves the public webhook URL for a newly added source so
-     * `kici-admin source add` can print it. Wired in platform/hybrid mode to
-     * register-and-await the Platform ack; independent mode returns a null URL
-     * with a note.
+     * `kici-admin source add` can print it. The rules per mode live in
+     * `sources/webhook-url-resolvers.ts`.
      */
     resolveSourceWebhookUrl?: (params: {
         routingKey: string;
         provider: string;
         sourceId: string;
-    }) => Promise<{
-        webhookUrl: string | null;
-        webhookNote?: string;
-    }>;
+    }) => Promise<WebhookUrlResolution>;
     /**
      * Optional -- resolves the org-scoped GitHub webhook URL for the manifest
-     * setup pre-flight (before any App exists). Wired in platform/hybrid mode.
-     */
-    resolveGithubWebhookUrl?: () => Promise<{
-        webhookUrl: string | null;
-        webhookNote?: string;
-    }>;
+     * setup pre-flight (before any App exists), by mode.
+     */
+    resolveGithubWebhookUrl?: () => Promise<WebhookUrlResolution>;
+    /** Optional — builds the direct-ingress URL `source list` prints per GitHub source. */
+    resolveSourceIngressUrl?: (row: {
+        id: string;
+        customerId: string | null;
+    }) => string | null;
     /** Optional -- for DB migration endpoints. */
     db?: Kysely<any>;
     /** Optional -- for DB migration endpoints. */
@@ -169,6 +171,12 @@ export interface AdminRouteDeps {
      * Bound by orchestrator-core once the cluster is up.
      */
     scalerOrphans?: ScalerOrphansRouteDeps;
+    /**
+     * Optional -- reload the scaler config here and on every connected peer.
+     * Backs `POST /api/v1/admin/scaler/reload` (`kici-admin scaler reload`).
+     * Bound by orchestrator-core once the cluster is up.
+     */
+    scalerReload?: ScalerReloadRouteDeps;
     /**
      * Optional -- forget a departed peer here and on every connected sibling
      * coordinator. Backs `POST /api/v1/admin/peers/forget` (`kici-admin peer
@@ -205,14 +213,6 @@ export interface AdminRouteDeps {
      */
     heldRunRelease?: HeldRunReleaseWiring;
 }
-/** Hono env type for admin routes with context variables. */
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * Create admin API routes with Bearer token authentication and RBAC.
  *
@@ -220,5 +220,4 @@ type AdminEnv = {
  * @returns Hono app with admin routes mounted at /api/v1/admin/*
  */
 export declare function createAdminRoutes(deps: AdminRouteDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin.d.ts.map

package/dist/routes/cluster-join.d.ts

@@ -0,0 +1,13 @@
+/**
+ * POST /api/v1/cluster/join: the direct transport of `kici-admin join --peer`.
+ *
+ * The body is the same join.request the Platform relays. Unauthenticated by design:
+ * the joiner proves it holds a join token inside the request. A version-1 body (one
+ * that carries the token) is refused with 426 and `Upgrade: kici-join-v2`.
+ */
+import { Hono } from 'hono';
+import { type JoinResponse } from '@kici-dev/engine';
+/** HTTP status for a join answer: a refusal without an error code is an internal failure. */
+export declare function joinResponseHttpStatus(response: JoinResponse): 200 | 400 | 401 | 426 | 500;
+export declare function createClusterJoinRoutes(onJoinRequest: (raw: unknown) => Promise<JoinResponse>): Hono;
+//# sourceMappingURL=cluster-join.d.ts.map

package/dist/routes/github-webhook.d.ts

@@ -25,19 +25,21 @@ export interface GithubWebhookRoutesDeps {
  */
 export declare function shouldServeGithubIngress(mode: OrchestratorMode): boolean;
 /**
- * Direct GitHub-App webhook ingress: `POST /webhook/:orgId/github/:sourceId`.
+ * Direct GitHub webhook ingress, bypassing the Platform relay:
  *
- * Bypasses the Platform relay. Handles both operator topologies on one route:
- *  - App-level repoint: the App's single webhook URL points here, so GitHub
- *    sends `X-GitHub-Hook-Installation-Target-Type: integration` +
- *    `-Target-ID: <appId>` — validated against the source's routing key.
- *  - Classic per-repo webhook: a repo-level hook points here with no App
- *    target headers — `:sourceId` already identifies the source, so the
- *    App-header check is skipped.
+ *  - `POST /webhook/:orgId/github/:sourceId` (per-source) serves an App-level
+ *    repoint (GitHub sends `X-GitHub-Hook-Installation-Target-Type:
+ *    integration` + `-Target-ID: <appId>`, validated against the source's
+ *    routing key) and a classic repository hook (no App target headers;
+ *    `:sourceId` identifies the source).
+ *  - `POST /webhook/:orgId/github` (org-scoped) serves an App-level webhook:
+ *    the App's target id names the source. It is the URL the manifest flow
+ *    bakes into a new App in observed and independent mode.
  *
- * Verification is the existing local `verify-inbound.ts` GitHub path (secret
- * read from the orchestrator secret store; rotation-aware). Dedup + dispatch
- * are the universal `processWebhook` pipeline via `onWebhook`.
+ * Both routes share verification (the local `verify-inbound.ts` GitHub path,
+ * secret read from the orchestrator secret store, rotation-aware), dedup on the
+ * raw `X-GitHub-Delivery`, and ingest through the `processWebhook` pipeline via
+ * `onWebhook`.
  */
 export declare function createGithubWebhookRoutes(deps: GithubWebhookRoutesDeps): Hono;
 //# sourceMappingURL=github-webhook.d.ts.map

package/dist/scaler/bare-metal-backend.d.ts

@@ -49,6 +49,18 @@ export interface BareMetalScalerBackendOptions {
      * (`systemd-run` does not exist), with a one-time startup warning.
      */
     enforceCgroups?: boolean;
+    /**
+     * Run the `nft` calls of job-image mode (the scaler-level `requireSudo`)
+     * through `sudo -n`, for an orchestrator that runs as a non-root user with a
+     * NOPASSWD sudoers rule for nft. Process mode runs no nft. Default false.
+     */
+    requireSudo?: boolean;
+    /**
+     * Extra `host:address` mappings (the scaler-level `extraHosts`) for the agent
+     * containers of job-image mode, passed to the runtime as `ExtraHosts`.
+     * Process mode ignores them.
+     */
+    extraHosts?: string[];
 }
 export declare class BareMetalScalerBackend implements ScalerBackend {
     readonly type: "bare-metal";
@@ -71,7 +83,36 @@ export declare class BareMetalScalerBackend implements ScalerBackend {
     private readonly logCaptures;
     /** Container-mode agents' IPs on the isolated network, for nftables cleanup. */
     private readonly containerIps;
-    constructor(options: BareMetalScalerBackendOptions);
+    /** Whether job-image mode's nft calls run through `sudo -n`. */
+    private readonly requireSudo;
+    private readonly extraHosts?;
+    /**
+     * Why this host cannot run nft the way {@link requireSudo} asks, as `create`
+     * probed it; `null` when it can. `reload` is synchronous and reads it to
+     * refuse job-image label sets a reload adds.
+     */
+    private readonly nftFailure;
+    /**
+     * Build a backend and check, once, that this host can run nft the way the
+     * scaler asks. A scaler with a job-image label set is refused here when it
+     * cannot, so the orchestrator stops at startup (and a reload that adds the
+     * scaler fails) instead of failing every spawn. A process-only scaler is
+     * never refused: process mode runs no nft.
+     */
+    static create(options: BareMetalScalerBackendOptions): Promise<BareMetalScalerBackend>;
+    /**
+     * @param nftFailure - The `create` probe's answer. A backend built directly
+     * was not probed, and is treated as able to run nft.
+     */
+    constructor(options: BareMetalScalerBackendOptions, nftFailure?: string | null);
+    /**
+     * Why a reload's job-image label sets cannot run here. `reload` is
+     * synchronous and cannot probe nft, so it reads what `create` probed — which
+     * holds only for the `requireSudo` the backend was built with.
+     */
+    private jobImageReloadErrors;
+    /** How every nft call of job-image mode runs: through `sudo -n` or not. */
+    private nftOpts;
     /**
      * Warn about label sets whose `networkPolicy` this backend cannot enforce.
      *

package/dist/scaler/config.d.ts

@@ -37,40 +37,16 @@ export declare const labelSetConfigSchema: z.ZodObject<{
         Never: "Never";
     }>>;
     binaryPath: z.ZodOptional<z.ZodString>;
-    resources: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodObject<{
+    resources: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
         requests: z.ZodOptional<z.ZodObject<{
-            memory: z.ZodOptional<z.ZodString>;
             cpus: z.ZodOptional<z.ZodNumber>;
+            memory: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         limits: z.ZodOptional<z.ZodObject<{
-            memory: z.ZodOptional<z.ZodString>;
             cpus: z.ZodOptional<z.ZodNumber>;
+            memory: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
-    }, z.core.$strict>, z.ZodObject<{
-        memory: z.ZodOptional<z.ZodString>;
-        cpus: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strict>]>, z.ZodTransform<{
-        requests?: {
-            cpus?: number;
-            memory?: string;
-        };
-        limits?: {
-            cpus?: number;
-            memory?: string;
-        };
-    }, {
-        memory?: string | undefined;
-        cpus?: number | undefined;
-    } | {
-        requests?: {
-            memory?: string | undefined;
-            cpus?: number | undefined;
-        } | undefined;
-        limits?: {
-            memory?: string | undefined;
-            cpus?: number | undefined;
-        } | undefined;
-    }>>>;
+    }, z.core.$strict>, unknown>>;
     volumes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     containerSocket: z.ZodDefault<z.ZodBoolean>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -109,40 +85,16 @@ export declare const scalerFileSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     globalMaxAgents: z.ZodDefault<z.ZodNumber>;
     defaults: z.ZodOptional<z.ZodObject<{
-        resources: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodObject<{
+        resources: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
             requests: z.ZodOptional<z.ZodObject<{
-                memory: z.ZodOptional<z.ZodString>;
                 cpus: z.ZodOptional<z.ZodNumber>;
+                memory: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             limits: z.ZodOptional<z.ZodObject<{
-                memory: z.ZodOptional<z.ZodString>;
                 cpus: z.ZodOptional<z.ZodNumber>;
+                memory: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
-        }, z.core.$strict>, z.ZodObject<{
-            memory: z.ZodOptional<z.ZodString>;
-            cpus: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$strict>]>, z.ZodTransform<{
-            requests?: {
-                cpus?: number;
-                memory?: string;
-            };
-            limits?: {
-                cpus?: number;
-                memory?: string;
-            };
-        }, {
-            memory?: string | undefined;
-            cpus?: number | undefined;
-        } | {
-            requests?: {
-                memory?: string | undefined;
-                cpus?: number | undefined;
-            } | undefined;
-            limits?: {
-                memory?: string | undefined;
-                cpus?: number | undefined;
-            } | undefined;
-        }>>>;
+        }, z.core.$strict>, unknown>>;
     }, z.core.$strip>>;
     globalResourceCap: z.ZodOptional<z.ZodPipe<z.ZodObject<{
         maxCpu: z.ZodOptional<z.ZodNumber>;
@@ -186,40 +138,16 @@ export declare const scalerFileSchema: z.ZodObject<{
                 Never: "Never";
             }>>;
             binaryPath: z.ZodOptional<z.ZodString>;
-            resources: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodObject<{
+            resources: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
                 requests: z.ZodOptional<z.ZodObject<{
-                    memory: z.ZodOptional<z.ZodString>;
                     cpus: z.ZodOptional<z.ZodNumber>;
+                    memory: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
                 limits: z.ZodOptional<z.ZodObject<{
-                    memory: z.ZodOptional<z.ZodString>;
                     cpus: z.ZodOptional<z.ZodNumber>;
+                    memory: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
-            }, z.core.$strict>, z.ZodObject<{
-                memory: z.ZodOptional<z.ZodString>;
-                cpus: z.ZodOptional<z.ZodNumber>;
-            }, z.core.$strict>]>, z.ZodTransform<{
-                requests?: {
-                    cpus?: number;
-                    memory?: string;
-                };
-                limits?: {
-                    cpus?: number;
-                    memory?: string;
-                };
-            }, {
-                memory?: string | undefined;
-                cpus?: number | undefined;
-            } | {
-                requests?: {
-                    memory?: string | undefined;
-                    cpus?: number | undefined;
-                } | undefined;
-                limits?: {
-                    memory?: string | undefined;
-                    cpus?: number | undefined;
-                } | undefined;
-            }>>>;
+            }, z.core.$strict>, unknown>>;
             volumes: z.ZodOptional<z.ZodArray<z.ZodString>>;
             containerSocket: z.ZodDefault<z.ZodBoolean>;
             env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

package/dist/scaler/file-reload.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The one scaler config reload: re-read the scaler file, hand it to the
+ * manager (which validates everything before it applies anything), and report
+ * what happened.
+ *
+ * `SIGHUP` (through `ConfigReloader`), the `POST /admin/scaler/reload` route
+ * and a peer's `peer.scaler.reload.request` all run this function, so each of
+ * them applies a file the same way.
+ */
+import { type Logger } from '@kici-dev/shared';
+import { type ScalerReloadAnswer } from '@kici-dev/engine';
+import type { ScalerManager } from './manager.js';
+import type { ScalerConfig } from './types.js';
+export interface ScalerFileReloadDeps {
+    /** Null when the orchestrator runs without a scaler config. */
+    manager: Pick<ScalerManager, 'reload'> | null;
+    /** Re-reads the scaler config from disk; throws on a missing or invalid file. */
+    load: () => Promise<ScalerConfig>;
+    /** Runs after a reload applied (the dashboard diagnostics snapshot). */
+    onApplied?: (config: ScalerConfig) => void;
+    logger: Logger;
+}
+/**
+ * One orchestrator's scaler reload outcome: `applied` with its plan, `rejected`
+ * with its errors (nothing applied), or `not-configured`.
+ */
+export type ScalerFileReloadResult = ScalerReloadAnswer;
+/** Runs one scaler file reload; see `createScalerFileReload`. */
+export type ScalerFileReload = () => Promise<ScalerFileReloadResult>;
+/**
+ * Build the reload function. Calls run one after the other: a reload that
+ * arrives while another runs (a `SIGHUP` during an HTTP reload) waits, then
+ * reads the file again, and each caller gets the outcome of its own run.
+ */
+export declare function createScalerFileReload(deps: ScalerFileReloadDeps): ScalerFileReload;
+/** The part of `process` the signal listener needs, injectable for tests. */
+export interface SignalSource {
+    on(signal: 'SIGHUP', listener: () => void): unknown;
+    off(signal: 'SIGHUP', listener: () => void): unknown;
+}
+/**
+ * Run `reload` on `SIGHUP`, debounced like the coordinator's `ConfigReloader`
+ * so a burst of signals reloads once. A Node.js process with no `SIGHUP`
+ * listener exits on the signal, so a host that reloads only its scaler config
+ * (a worker) installs this one. Returns the disposer that removes the listener.
+ */
+export declare function installScalerReloadSignal(reload: ScalerFileReload, logger: Logger, signals?: SignalSource): () => void;
+//# sourceMappingURL=file-reload.d.ts.map