@wtfalch/foundry 0.59.0 → 0.61.0

package/dist/plan/entry-jobs.d.ts

@@ -0,0 +1,64 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+import type { DraftStep } from './diff.js';
+import type { OrgPlatformReadiness } from './platform-org.js';
+/**
+ * `uses.jobs`: the entry is a project of its own in a jobs scheduler: the owner company's (hq) for a company
+ * on shared services, the company's own for one that runs its own services. One `jobs:project` step
+ * per entry, keyed `<orgId>:<entry>`:
+ *
+ * 1. registers `<slug>-<entry>` with the scheduler (`POST /admin/projects`), which shows the signing secret
+ *    and the sync key once;
+ * 2. holds both under their refs before anything else is written: the id is recorded as undelivered first,
+ *    so a failure after the project exists never registers a second one;
+ * 3. writes `JOBS_SCHEDULER_URL` (the scheduler's public origin), `JOBS_SIGNING_SECRET` and `JOBS_SYNC_KEY`
+ *    to the entry's env and restarts the app.
+ *
+ * The secret and the key reach the held keys and the entry's env and nothing else: not a plan, a log, an
+ * error or a recorded id. A workspace (stage) gets no project: its copy of the app is built without
+ * `JOBS_*` (`stage-env.ts`), so a stage never schedules or receives a live job.
+ *
+ * Nothing removes the project when the entry drops `uses.jobs`: the admin API can deregister, but the
+ * scheduler port has no such call yet, so the project and its held credentials stay until a person
+ * deregisters it.
+ */
+type Blocked = Array<{
+    description: string;
+    key: string;
+}>;
+/** The project is registered, its credentials are not held yet: the id, never a credential. */
+export declare const entryJobsUndeliveredScopeKey: (entryKey: string) => string;
+/** What the entry's env was last written with (name, address, scheduler origin); a change replans the step. */
+export declare const entryJobsAppliedScopeKey: (entryKey: string) => string;
+/** The held-key refs of an entry's project: its signing secret and its sync key. */
+export declare const entryJobsRefs: (orgId: string, entryKey: string) => {
+    signingSecret: string;
+    syncKey: string;
+};
+/** The scheduler's name for the entry's project. */
+export declare const entryJobsProjectName: (org: Pick<DeclaredOrg, "slug">, entryKey: string) => string;
+/**
+ * What the project is registered with and the env is written with, or `null` while the entry has no public
+ * address for the scheduler to deliver to (a workspace-only entry has none).
+ */
+export declare function entryJobsWant(org: DeclaredOrg, entry: HostingEntry, schedulerUrl: string): {
+    name: string;
+    baseUrl: string;
+    schedulerUrl: string;
+} | null;
+/** The value `jobs_project_applied.<entry>` holds for a want. */
+export declare const entryJobsWantMarker: (want: {
+    name: string;
+    baseUrl: string;
+    schedulerUrl: string;
+}) => string;
+/**
+ * One step per `uses.jobs` entry whose project is not registered and written yet, or whose address changed.
+ * Blocked, not planned (rule 2), while the scheduler's public route is not recorded, no scheduler is usable
+ * (`schedulerUsable`), the host cannot hold secrets, the entry's app is not recorded, the entry has no public
+ * address, or a previous registration's credentials were never held.
+ */
+export declare function planEntryJobs(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], readiness: OrgPlatformReadiness, schedulerUsable: boolean): {
+    steps: DraftStep[];
+    blocked: Blocked;
+};
+export {};

package/dist/plan/entry-jobs.js

@@ -0,0 +1,92 @@
+import { entryHostnames } from './hostnames.js';
+import { appStepKey } from './platform-diff.js';
+/** The project is registered, its credentials are not held yet: the id, never a credential. */
+export const entryJobsUndeliveredScopeKey = (entryKey) => `jobs_project_undelivered.${entryKey}`;
+/** What the entry's env was last written with (name, address, scheduler origin); a change replans the step. */
+export const entryJobsAppliedScopeKey = (entryKey) => `jobs_project_applied.${entryKey}`;
+/** The held-key refs of an entry's project: its signing secret and its sync key. */
+export const entryJobsRefs = (orgId, entryKey) => ({
+    signingSecret: `jobs:project:${orgId}:${entryKey}:signingSecret`,
+    syncKey: `jobs:project:${orgId}:${entryKey}:syncKey`,
+});
+/** The scheduler's name for the entry's project. */
+export const entryJobsProjectName = (org, entryKey) => `${org.slug}-${entryKey}`;
+/**
+ * What the project is registered with and the env is written with, or `null` while the entry has no public
+ * address for the scheduler to deliver to (a workspace-only entry has none).
+ */
+export function entryJobsWant(org, entry, schedulerUrl) {
+    const host = entryHostnames(org, entry)[0];
+    if (!host)
+        return null;
+    return {
+        name: entryJobsProjectName(org, entry.key),
+        baseUrl: `https://${host}`,
+        schedulerUrl,
+    };
+}
+/** The value `jobs_project_applied.<entry>` holds for a want. */
+export const entryJobsWantMarker = (want) => JSON.stringify([want.name, want.baseUrl, want.schedulerUrl]);
+/**
+ * One step per `uses.jobs` entry whose project is not registered and written yet, or whose address changed.
+ * Blocked, not planned (rule 2), while the scheduler's public route is not recorded, no scheduler is usable
+ * (`schedulerUsable`), the host cannot hold secrets, the entry's app is not recorded, the entry has no public
+ * address, or a previous registration's credentials were never held.
+ */
+export function planEntryJobs(org, recordedIds, plannedSteps, readiness, schedulerUsable) {
+    const steps = [];
+    const blocked = [];
+    if (!org.hosting.enabled)
+        return { steps, blocked };
+    const appPlanned = (stepKey) => plannedSteps.some((p) => p.action.system === 'coolify' && p.action.kind === 'app' && p.action.key === stepKey);
+    for (const entry of org.hosting.entries) {
+        if (!entry.uses?.jobs)
+            continue;
+        const stepKey = appStepKey(org, entry.key);
+        const key = `jobs:project:${stepKey}`;
+        const at = `${org.slug}'s ${entry.key} jobs`;
+        const block = (why) => blocked.push({ description: `${at} are blocked: ${why}`, key });
+        const undelivered = recordedIds[entryJobsUndeliveredScopeKey(entry.key)];
+        if (undelivered) {
+            block(`project ${undelivered} was registered but its credentials were never held, and the scheduler shows them once; deregister it (DELETE /admin/projects/${entryJobsProjectName(org, entry.key)}) and remove the recorded key ${entryJobsUndeliveredScopeKey(entry.key)}`);
+            continue;
+        }
+        if (!readiness.jobsPublicUrl) {
+            block("the jobs scheduler's public address is not recorded yet; the scheduler owner's jobs route must be applied first");
+            continue;
+        }
+        if (!schedulerUsable) {
+            block('there is no usable jobs scheduler (it is not applied, its admin token is not held, or the host supplies none)');
+            continue;
+        }
+        if (readiness.canHoldSecrets !== true) {
+            block("the host's held keys cannot hold the project's credentials");
+            continue;
+        }
+        if (!recordedIds[`coolify:app:${stepKey}`] && !appPlanned(stepKey)) {
+            block("the entry's app is not recorded yet");
+            continue;
+        }
+        const want = entryJobsWant(org, entry, readiness.jobsPublicUrl);
+        if (!want) {
+            block('the entry has no public address for the scheduler to deliver to');
+            continue;
+        }
+        if (recordedIds[entryJobsAppliedScopeKey(entry.key)] === entryJobsWantMarker(want))
+            continue;
+        steps.push({
+            action: {
+                system: 'jobs',
+                kind: 'project',
+                key: stepKey,
+                desired: { ...want },
+            },
+            step: {
+                description: `register ${org.slug}'s ${entry.key} as project ${want.name} in the jobs scheduler, hold its credentials, write JOBS_* env, restart the app`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    return { steps, blocked };
+}

package/dist/plan/entry-repo-key-apply.d.ts

@@ -0,0 +1,55 @@
+import { type GithubDeployKeysPort } from './github-deploy-keys.js';
+/** Every call this module makes (GitHub, held keys, Coolify) is cut off after this long. */
+export declare const REPO_KEY_CALL_TIMEOUT_MS = 30000;
+export interface RepoKeyApplyDeps {
+    github: GithubDeployKeysPort;
+    heldKeys: {
+        resolve(ref: string): Promise<string | null | undefined>;
+        put(ref: string, value: string): Promise<void>;
+    };
+    coolify: {
+        bulkUpsertEnvs(appId: string, envs: Array<{
+            key: string;
+            value: string;
+            literal?: boolean;
+            multiline?: boolean;
+        }>): Promise<unknown>;
+        listEnvs(appId: string): Promise<Array<{
+            key: string;
+            uuid?: string;
+            is_preview?: boolean | undefined;
+        }>>;
+        deleteEnv(appId: string, envUuid: string): Promise<unknown>;
+        restart(appId: string): Promise<unknown>;
+    };
+    org: {
+        id: string;
+        slug: string;
+    };
+    entryKey: string;
+    /** The entry's Coolify app, when it is recorded. */
+    appId: string | undefined;
+    recorded: () => Readonly<Record<string, string>>;
+    record: (key: string, value: string) => void;
+    persist: () => Promise<void>;
+    /** Registers a value for redaction before anything else can see it. */
+    secret: (value: string) => void;
+    /** The installation of the company's GitHub App that owns `repo`, or undefined for a `wtfalch` repo. */
+    installationFor?: (repo: string) => number | undefined;
+    timeoutMs?: number;
+}
+/**
+ * Makes, holds and delivers the entry's deploy key (see `entry-repo-key.ts`). Errors are plain lines naming the
+ * repo, the key id or the ref: never a credential, a response body or a cause.
+ */
+export declare function ensureRepoKey(deps: RepoKeyApplyDeps, want: {
+    repo: string;
+    access: 'read' | 'write';
+    installationId?: number;
+}): Promise<void>;
+/**
+ * Removes the entry's key: every key of its title on the recorded repo (the recorded id first), both env names, the
+ * held private half, then both records. Each part is safe to repeat, so a run that died halfway is finished by the
+ * next. The records go last: while one remains the plan plans this again.
+ */
+export declare function removeRepoKey(deps: RepoKeyApplyDeps, repo: string): Promise<void>;

package/dist/plan/entry-repo-key-apply.js

@@ -0,0 +1,185 @@
+import { GIT_REPO_URL_ENV, GIT_SSH_KEY_ENV, parseRecordedRepoKey, repoGitUrl, repoKeyAppliedMarker, repoKeyAppliedScopeKey, repoKeyRef, repoKeyScopeKey, repoKeyTitle, } from './entry-repo-key.js';
+import { DeployKeysBlocked, deployKeysBlockedLine, generateRepoKeyPair, publicKeyOfPrivate, sameSshKey, } from './github-deploy-keys.js';
+/** Every call this module makes (GitHub, held keys, Coolify) is cut off after this long. */
+export const REPO_KEY_CALL_TIMEOUT_MS = 30_000;
+const isNotFound = (error) => error?.status === 404;
+async function timed(work, ms) {
+    let timer;
+    try {
+        return await Promise.race([
+            work(),
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error('timeout')), ms);
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** The text of a private key's body, so a log that holds only the middle of a key is scrubbed as well. */
+const secretsOf = (privateKey) => {
+    const body = privateKey
+        .replace(/-----(BEGIN|END) OPENSSH PRIVATE KEY-----/g, '')
+        .replace(/\s+/g, '');
+    return body ? [privateKey, privateKey.trim(), body] : [privateKey];
+};
+/**
+ * Makes, holds and delivers the entry's deploy key (see `entry-repo-key.ts`). Errors are plain lines naming the
+ * repo, the key id or the ref: never a credential, a response body or a cause.
+ */
+export async function ensureRepoKey(deps, want) {
+    const at = `github:deploy-key for ${deps.org.slug} entry '${deps.entryKey}'`;
+    const ms = deps.timeoutMs ?? REPO_KEY_CALL_TIMEOUT_MS;
+    const target = {
+        repo: want.repo,
+        ...(want.installationId !== undefined ? { installationId: want.installationId } : {}),
+    };
+    const ref = repoKeyRef(deps.org.id, deps.entryKey);
+    const title = repoKeyTitle(deps.org, deps.entryKey);
+    const readOnly = want.access === 'read';
+    const github = (what, run, on = target) => callGithub(at, what, on, ms, run);
+    if (!deps.appId)
+        throw new Error(`${at}: the entry's app is not recorded yet`);
+    let held;
+    try {
+        held = await timed(() => deps.heldKeys.resolve(ref), ms);
+    }
+    catch {
+        throw new Error(`${at}: the held key ${ref} could not be read`);
+    }
+    if (held)
+        for (const s of secretsOf(held))
+            deps.secret(s);
+    const heldPub = held ? publicKeyOfPrivate(held) : null;
+    const keys = await github('listing deploy keys', () => deps.github.list(target));
+    const mine = keys.filter((k) => k.title === title);
+    let current = heldPub
+        ? mine.find((k) => sameSshKey(k.key, heldPub) && k.readOnly === readOnly)
+        : undefined;
+    let privateKey = held ?? '';
+    let publicKey = heldPub ?? '';
+    const previous = parseRecordedRepoKey(deps.recorded()[repoKeyScopeKey(deps.entryKey)]);
+    // A key on another repo stays recorded until it is deleted, so a run that dies in between still knows it.
+    const recordNow = previous === null || previous.repo === want.repo;
+    const recordKey = async (id) => {
+        deps.record(repoKeyScopeKey(deps.entryKey), JSON.stringify({ repo: want.repo, id, access: want.access, pub: publicKey }));
+        await deps.persist();
+    };
+    if (!current) {
+        const pair = generateRepoKeyPair();
+        for (const s of secretsOf(pair.privateKey))
+            deps.secret(s);
+        // The key is on GitHub before its private half is held. A failure between the two leaves a key nothing can use,
+        // which the next run finds by its title and deletes.
+        current = await github('making the deploy key', () => deps.github.create(target, { title, key: pair.publicKey, readOnly }));
+        try {
+            await timed(() => deps.heldKeys.put(ref, pair.privateKey), ms);
+        }
+        catch {
+            throw new Error(`${at}: deploy key ${current.id} was made on ${want.repo} but its private half could not be held at ${ref}; the next apply deletes that key and makes another`);
+        }
+        privateKey = pair.privateKey;
+        publicKey = pair.publicKey;
+        if (recordNow)
+            await recordKey(current.id);
+    }
+    else if (recordNow &&
+        (previous === null || previous.id !== current.id || previous.access !== want.access)) {
+        await recordKey(current.id);
+    }
+    try {
+        await timed(() => deps.coolify.bulkUpsertEnvs(deps.appId, [
+            { key: GIT_REPO_URL_ENV, value: repoGitUrl(want.repo), literal: true },
+            { key: GIT_SSH_KEY_ENV, value: privateKey, literal: true, multiline: true },
+        ]), ms);
+        await timed(() => deps.coolify.restart(deps.appId), ms);
+    }
+    catch {
+        // The error is dropped in case Coolify echoes the request body.
+        throw new Error(`${at}: deploy key ${current.id} is made and held but ${GIT_REPO_URL_ENV} and ${GIT_SSH_KEY_ENV} could not be written to the app's env; the next apply writes them again`);
+    }
+    // New first, old after: every other key of the title (an older access, a key a failed run made) goes now, and
+    // the recorded key of another repo.
+    for (const k of mine.filter((x) => x.id !== current?.id)) {
+        await github(`deleting deploy key ${k.id}`, () => deps.github.remove(target, k.id));
+    }
+    if (previous && previous.repo !== want.repo) {
+        const old = targetOf(deps, previous.repo);
+        await github(`deleting deploy key ${previous.id}`, () => deps.github.remove(old, previous.id), old);
+    }
+    if (!recordNow)
+        await recordKey(current.id);
+    deps.record(repoKeyAppliedScopeKey(deps.entryKey), repoKeyAppliedMarker(want.repo, want.access, current.id));
+    await deps.persist();
+}
+/**
+ * Removes the entry's key: every key of its title on the recorded repo (the recorded id first), both env names, the
+ * held private half, then both records. Each part is safe to repeat, so a run that died halfway is finished by the
+ * next. The records go last: while one remains the plan plans this again.
+ */
+export async function removeRepoKey(deps, repo) {
+    const at = `github:deploy-key for ${deps.org.slug} entry '${deps.entryKey}'`;
+    const ms = deps.timeoutMs ?? REPO_KEY_CALL_TIMEOUT_MS;
+    const recordedKey = parseRecordedRepoKey(deps.recorded()[repoKeyScopeKey(deps.entryKey)]);
+    const where = recordedKey?.repo ?? repo;
+    const target = targetOf(deps, where);
+    const title = repoKeyTitle(deps.org, deps.entryKey);
+    const ref = repoKeyRef(deps.org.id, deps.entryKey);
+    if (recordedKey) {
+        await callGithub(at, `deleting deploy key ${recordedKey.id}`, target, ms, () => deps.github.remove(target, recordedKey.id));
+    }
+    const left = await callGithub(at, 'listing deploy keys', target, ms, () => deps.github.list(target));
+    for (const k of left.filter((x) => x.title === title)) {
+        await callGithub(at, `deleting deploy key ${k.id}`, target, ms, () => deps.github.remove(target, k.id));
+    }
+    if (deps.appId) {
+        let removedEnv = false;
+        try {
+            for (const row of await timed(() => deps.coolify.listEnvs(deps.appId), ms)) {
+                if ((row.key !== GIT_REPO_URL_ENV && row.key !== GIT_SSH_KEY_ENV) ||
+                    row.is_preview ||
+                    !row.uuid) {
+                    continue;
+                }
+                try {
+                    await timed(() => deps.coolify.deleteEnv(deps.appId, row.uuid), ms);
+                    removedEnv = true;
+                }
+                catch (error) {
+                    if (!isNotFound(error))
+                        throw error;
+                }
+            }
+            if (removedEnv)
+                await timed(() => deps.coolify.restart(deps.appId), ms);
+        }
+        catch {
+            throw new Error(`${at}: the deploy key is deleted but ${GIT_REPO_URL_ENV} and ${GIT_SSH_KEY_ENV} could not be dropped from the app's env; the next apply drops them`);
+        }
+    }
+    try {
+        await timed(() => deps.heldKeys.put(ref, ''), ms);
+    }
+    catch {
+        throw new Error(`${at}: the held key ${ref} could not be forgotten; the next apply forgets it`);
+    }
+    deps.record(repoKeyScopeKey(deps.entryKey), '');
+    deps.record(repoKeyAppliedScopeKey(deps.entryKey), '');
+    await deps.persist();
+}
+function targetOf(deps, repo) {
+    const installationId = deps.installationFor?.(repo);
+    return installationId === undefined ? { repo } : { repo, installationId };
+}
+async function callGithub(at, what, target, ms, run) {
+    try {
+        return await timed(run, ms);
+    }
+    catch (error) {
+        if (error instanceof DeployKeysBlocked) {
+            throw new Error(`${at}: ${deployKeysBlockedLine(target, error.reason)}`);
+        }
+        throw new Error(`${at}: GitHub did not answer or refused while ${what} on ${target.repo}`);
+    }
+}

package/dist/plan/entry-repo-key.d.ts

@@ -0,0 +1,92 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+import type { DraftStep } from './diff.js';
+import { type DeployKeyTarget, type GithubDeployKey } from './github-deploy-keys.js';
+import type { OrgPlatformReadiness } from './platform-org.js';
+/**
+ * `uses.repo` (F12): the entry's app gets credentials for its own `entry.repo`. One `github:deploy-key` step per
+ * entry, keyed `<orgId>:<entry>`:
+ *
+ * 1. makes an ed25519 keypair and registers the public half on GitHub as a deploy key titled
+ *    `foundry <org slug> <entry key>`, read-only unless `access` is `write`;
+ * 2. holds the private half at {@link repoKeyRef} and records the key's GitHub id (`repo_key.<entry>`);
+ * 3. writes `GIT_REPO_URL` (`git@github.com:<owner>/<name>.git`) and `GIT_SSH_KEY` to the entry's env, restarts
+ *    the app, records `repo_key_applied.<entry>` last;
+ * 4. deletes every other key of that title (an older key after a change of access, or a key a failed run made).
+ *
+ * Halfway failures, and what the next apply does: a key made on GitHub whose private half was not held is found by
+ * its title and deleted, and another is made; a key held and on GitHub but not in the env is written; an env written
+ * and an old key not yet deleted is finished by step 4. No step leaves a key that nothing uses once an apply has
+ * run to its end. Removing the entry or `uses.repo` plans the same step in removal form: delete the recorded key and
+ * every key of the title, drop both env names, forget the held value, clear both markers.
+ *
+ * The private key reaches the held keys and the app's env and nothing else: not a plan, a log, a note, an error or a
+ * recorded id. A workspace copy (stage) is given none.
+ *
+ * Blocked, not failing (a plan line each): GitHub cannot be asked (no client wired), the credential is not held or
+ * lacks "Administration: Read and write" (the line names it and says it is William's step), no held key store that
+ * can put, the app is not recorded yet.
+ */
+export declare const GIT_REPO_URL_ENV = "GIT_REPO_URL";
+export declare const GIT_SSH_KEY_ENV = "GIT_SSH_KEY";
+/** What GitHub made for the entry: `{repo, id, access, pub}` as JSON. No secret. Cleared when the key is removed. */
+export declare const repoKeyScopeKey: (entryKey: string) => string;
+export declare const REPO_KEY_PREFIX = "repo_key.";
+/** What the env was last written with (repo, access, key id); a change replans the step. */
+export declare const repoKeyAppliedScopeKey: (entryKey: string) => string;
+/** The held-key ref of an entry's private key. */
+export declare const repoKeyRef: (orgId: string, entryKey: string) => string;
+/** GitHub's title for the entry's key. */
+export declare const repoKeyTitle: (org: Pick<DeclaredOrg, "slug">, entryKey: string) => string;
+/** `git@github.com:<owner>/<name>.git`. */
+export declare const repoGitUrl: (repo: string) => string;
+export interface RecordedRepoKey {
+    repo: string;
+    id: number;
+    access: 'read' | 'write';
+    /** The public key line: not a secret. */
+    pub: string;
+}
+export declare function parseRecordedRepoKey(value: string | undefined): RecordedRepoKey | null;
+export declare const repoKeyAppliedMarker: (repo: string, access: string, id: number) => string;
+/** The repo and, under the company's installation, its id. */
+export declare function repoKeyTarget(org: Pick<DeclaredOrg, 'hosting'>, repo: string): DeployKeyTarget;
+/**
+ * The entries that declare `uses.repo` with a repo, in declared order. An entry that is not live (`live: false`)
+ * has no app, so it counts as none: a key it had is removed, and made again when it goes live.
+ */
+export declare const repoKeyEntries: (org: Pick<DeclaredOrg, "hosting">) => HostingEntry[];
+/** Entry keys that were given a key and no longer declare `uses.repo` (or are gone, or hosting is off). */
+export declare function repoKeysToRemove(org: Pick<DeclaredOrg, 'hosting'>, recorded: Readonly<Record<string, string>>): string[];
+/** What the plan learnt from GitHub about one repo, or why it could not ask. Lines only, never a credential. */
+export type RepoKeyProbe = {
+    ok: true;
+    keys: readonly GithubDeployKey[];
+} | {
+    ok: false;
+    line: string;
+};
+/** Asks GitHub for the repo's deploy keys; a refusal or silence becomes a plain line. Never throws. */
+export declare function probeRepoKeys(port: {
+    list(target: DeployKeyTarget): Promise<GithubDeployKey[]>;
+}, target: DeployKeyTarget): Promise<RepoKeyProbe>;
+type Blocked = Array<{
+    description: string;
+    key: string;
+}>;
+/**
+ * One step per `uses.repo` entry whose key is not made, held and written yet (or is gone from GitHub, or has the
+ * wrong access), and one removal step per recorded key whose entry no longer declares it. Every other path says why
+ * in `blocked` (reported in `unmanaged`).
+ */
+export declare function planEntryRepoKeys(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], readiness: OrgPlatformReadiness): {
+    steps: DraftStep[];
+    blocked: Blocked;
+};
+/** The entries whose repo GitHub should be asked about now: those that declare the flag and those with a key to remove. */
+export declare function repoKeyProbeTargets(org: DeclaredOrg, recorded: Readonly<Record<string, string>>): Array<{
+    entryKey: string;
+    target: DeployKeyTarget;
+}>;
+/** True when an entry of the org needs anything from GitHub: a key to make, check or remove. */
+export declare const repoKeysInPlay: (org: DeclaredOrg, recorded: Readonly<Record<string, string>>) => boolean;
+export {};