@songsid/agend 2.1.6-beta.6 → 2.1.6-beta.7

package/dist/fleet-manager.d.ts

@@ -21,6 +21,8 @@ import { type AgentEndpointContext } from "./agent-endpoint.js";
 import { ClassicChannelManager } from "./classic-channel-manager.js";
 import { type ExplicitInstanceRemoval } from "./instance-removal.js";
 import type { InstanceState } from "./backend/types.js";
+import { type ConnectionMetadata, type ConnectionBinding, type BindingProbe, type SecretApplyJob, type ProviderSecretApplyJob } from "./connection-secrets.js";
+import { type ProviderSecretStatus } from "./provider-secret-registry.js";
 import { ApplyJobStore, type ApplyJob, type ApplyTargetKind, type SelfRestartResult } from "./apply-job.js";
 import { StormWindow } from "./storm-window.js";
 import { SpawnGate } from "./spawn-gate.js";
@@ -243,6 +245,40 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private ipcReconnectInFlight;
     private adapterRestarting;
     private adapterState;
+    /** Web Settings secret rotation is deliberately separate from reconnect
+     * recovery: a rotation must build a fresh provider client with the new token,
+     * and stale callbacks from the old client must not win. */
+    private connectionSecretChallenges;
+    private connectionSecretChallengesByKey;
+    private connectionSecretJobs;
+    private connectionSecretJobSession;
+    private connectionSecretInFlight;
+    private connectionSecretGenerations;
+    /** Local epoch that fences a challenge across adapter replacement and
+     * provider reconnect generations. The adapter's own generation can reset
+     * when a new adapter object is constructed, so keep an independent epoch. */
+    private connectionSecretAdapterRefs;
+    private connectionSecretHealthGenerations;
+    /** Generic API-key verifier/apply state.  The challenge scope contains the
+     * resolved spec/env key, so a request can never retarget another provider. */
+    private providerSecretChallenges;
+    private providerSecretChallengesByKey;
+    private providerSecretJobs;
+    private providerSecretJobSession;
+    private providerSecretInFlight;
+    private providerSecretGenerations;
+    /** Test seam only; production always uses the fixed HTTPS client. */
+    private providerSecretHttpClient?;
+    /** Code-owned activation hooks; never populated from a request. */
+    private providerSecretReloadHooks;
+    /** In-memory snapshots for narrow hot consumers (currently Groq voice). */
+    private providerSecretHotSnapshots;
+    /** Web Settings connection-binding step-up challenges and apply jobs. */
+    private connectionBindingChallenges;
+    private connectionBindingChallengesByKey;
+    private connectionBindingJobs;
+    private connectionBindingJobSession;
+    private connectionBindingInFlight;
     private collabInstances;
     private healthServer;
     private healthPortRetried;
@@ -255,6 +291,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private fullRestartLauncher;
     private eventLogPruneTimer;
     private logRotateTimer;
+    private discordPresenceTimer;
+    private discordPresenceInFlight;
+    private static readonly DISCORD_PRESENCE_REFRESH_MS;
     /** Days of event/activity history to keep. */
     private static readonly EVENT_LOG_RETENTION_DAYS;
     private watchdogTimer;
@@ -344,6 +383,13 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     getSysInfo(): import("./fleet-context.js").SysInfo;
     /** Load fleet.yaml and build routing table */
     loadConfig(configPath: string): FleetConfig;
+    /**
+     * A channel's configurable bot_token_env is an env-key writer too.  Refuse
+     * an overlap with a registry API key (or a process-reserved key) before the
+     * config becomes live; otherwise a Discord token could be written into
+     * GROQ_API_KEY by a perfectly valid-looking rotation request.
+     */
+    private assertProviderSecretEnvKeys;
     /** User-authored fleet.yaml, before defaults are merged into instances. */
     getRawFleetConfig(): RawFleetConfig;
     /** Build topic routing table: { topicId -> RouteTarget } */
@@ -631,6 +677,9 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private startUpdateProgressMonitor;
     /** Start all instances from fleet config */
     startAll(configPath: string): Promise<void>;
+    /** Keep Discord profile activity aligned with the same cached usage source as /usage. */
+    private startDiscordUsagePresence;
+    private refreshDiscordUsagePresence;
     /**
      * Delete inbox files older than retentionDays (by mtime). Cleans the shared
      * inbox (`<dataDir>/inbox`) and every workspace inbox
@@ -1752,6 +1801,128 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private postSelfRestartNotice;
     /** Jobs outlive this process on purpose; see apply-job.ts. */
     get applyJobs(): ApplyJobStore;
+    /** The only channel metadata exposed to the Settings secret UI. */
+    listSecureConnections(): ConnectionMetadata[];
+    private secureConnectionChannel;
+    private secureConnectionGeneration;
+    /** Provider API-key rows exposed to Settings (never the env key or secret). */
+    providerSecretsEnabled(): boolean;
+    listProviderSecrets(): ProviderSecretStatus[];
+    private providerSecretStaleConsumers;
+    private providerSecretGeneration;
+    private providerSecretEnvAllowed;
+    verifyProviderSecret(input: {
+        specId: string;
+        secret: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        spec_id: string;
+        activation: "next_use" | "reload_hook";
+    } | {
+        ok: false;
+        status: "unsupported_verifier" | "provider_rejected" | "provider_unavailable" | "invalid";
+        error: string;
+    }>;
+    /** Naming aliases used by integrations that call this an API-key operation. */
+    verifyProviderApiKey(input: Parameters<FleetManager["verifyProviderSecret"]>[0]): ReturnType<FleetManager["verifyProviderSecret"]>;
+    startProviderSecretApply(input: {
+        specId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: ProviderSecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: ProviderSecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    startProviderApiKeyApply(input: Parameters<FleetManager["startProviderSecretApply"]>[0]): ReturnType<FleetManager["startProviderSecretApply"]>;
+    getProviderSecretApply(jobId: string, sessionBinding: string): ProviderSecretApplyJob | null;
+    getProviderApiKeyApply(jobId: string, sessionBinding: string): ProviderSecretApplyJob | null;
+    private runProviderSecretApply;
+    /** Groq is currently read from process.env per voice request, so the hook is
+     * intentionally a no-op. Keeping it as a named code-owned hook makes the
+     * hot activation contract explicit and gives tests a failure seam; no generic
+     * SIGHUP or caller-provided hook is ever executed. */
+    private runProviderSecretReloadHook;
+    private normalizeConnectionBinding;
+    private connectionBindingChannelConfig;
+    /** Verify a prospective group/guild binding without mutating fleet state. */
+    verifyConnectionBinding(input: {
+        connectionId: string;
+        binding: {
+            group_id?: unknown;
+            general_channel_id?: unknown;
+        };
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        binding: ConnectionBinding;
+        probe: BindingProbe;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    startConnectionBindingApply(input: {
+        connectionId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: SecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: SecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    getConnectionBindingApply(jobId: string, sessionBinding: string): SecretApplyJob | null;
+    private runConnectionBindingApply;
+    /** Stop, rebuild and wait for a new adapter before committing YAML binding. */
+    private rebuildAdapterForBinding;
+    verifyConnectionSecret(input: {
+        connectionId: string;
+        secret: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        identity?: {
+            id: string | null;
+            username: string | null;
+        };
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    startConnectionSecretApply(input: {
+        connectionId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: SecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: SecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    getConnectionSecretApply(jobId: string, sessionBinding: string): SecretApplyJob | null;
+    private runConnectionSecretApply;
+    /** Stop the old provider client and construct a new one from process.env. */
+    private rebuildAdapterForSecret;
     /**
      * What a reconcile is about to do, per target.
      *