@kici-dev/engine 0.1.21 → 0.1.23

package/dist/inputs/extract.js

@@ -0,0 +1,117 @@
+import "../chunk-BTugEXQM.js";
+//#region src/inputs/extract.ts
+/** Thrown when a declared dispatch input falls outside the closed Zod subset. */
+var UnsupportedDispatchInputError = class extends Error {
+	construct;
+	key;
+	constructor(construct, key) {
+		super(`Unsupported dispatch input${key ? ` "${key}"` : ""}: ${construct}. Allowed: z.string/number/boolean/enum/literal with .optional/.nullable/.default/.min/.max/.regex/.int.`);
+		this.construct = construct;
+		this.key = key;
+		this.name = "UnsupportedDispatchInputError";
+	}
+};
+const defOf = (s) => s?._zod?.def;
+const checkDefOf = (c) => c?._zod?.def;
+/** Pull string/number checks (min/max/int/regex) into descriptor fields. */
+function applyChecks(d, checks, key) {
+	for (const c of checks ?? []) {
+		const cd = checkDefOf(c);
+		switch (cd?.check) {
+			case "greater_than":
+				d.min = Number(cd.value);
+				break;
+			case "less_than":
+				d.max = Number(cd.value);
+				break;
+			case "min_length":
+				d.min = Number(cd.minimum);
+				break;
+			case "max_length":
+				d.max = Number(cd.maximum);
+				break;
+			case "string_format":
+				if (cd.format === "regex" && cd.pattern) d.pattern = String(typeof cd.pattern === "object" ? cd.pattern.source ?? cd.pattern : cd.pattern);
+				else throw new UnsupportedDispatchInputError(`string format:${cd.format ?? "unknown"}`, key);
+				break;
+			case "number_format":
+				if (cd.format === "safeint" || cd.format === "int") d.type = "integer";
+				else throw new UnsupportedDispatchInputError(`number format:${cd.format ?? "unknown"}`, key);
+				break;
+			default: throw new UnsupportedDispatchInputError(`check:${cd?.check ?? "unknown"}`, key);
+		}
+	}
+}
+/**
+* Walk a Zod schema's `_zod.def`, reject any construct outside the closed
+* subset, and extract a JSON-safe `InputDescriptor`.
+*/
+function extractInputDescriptor(schema, key) {
+	let cur = schema;
+	let optional = false;
+	let nullable = false;
+	let hasDefault = false;
+	let defaultValue;
+	for (;;) {
+		const d = defOf(cur);
+		if (!d) throw new UnsupportedDispatchInputError("non-zod value", key);
+		if (d.type === "optional") {
+			optional = true;
+			cur = d.innerType;
+			continue;
+		}
+		if (d.type === "nullable") {
+			nullable = true;
+			cur = d.innerType;
+			continue;
+		}
+		if (d.type === "default") {
+			hasDefault = true;
+			defaultValue = typeof d.defaultValue === "function" ? d.defaultValue() : d.defaultValue;
+			cur = d.innerType;
+			continue;
+		}
+		break;
+	}
+	const d = defOf(cur);
+	if (!d) throw new UnsupportedDispatchInputError("non-zod value", key);
+	const out = {
+		type: "string",
+		optional,
+		nullable
+	};
+	if (hasDefault) out.default = defaultValue;
+	switch (d.type) {
+		case "string":
+			out.type = "string";
+			applyChecks(out, d.checks, key);
+			break;
+		case "number":
+			out.type = "number";
+			applyChecks(out, d.checks, key);
+			break;
+		case "boolean":
+			out.type = "boolean";
+			break;
+		case "enum":
+			out.type = "enum";
+			out.values = Object.values(d.entries ?? {});
+			break;
+		case "literal":
+			out.type = "literal";
+			out.literal = d.values?.[0] ?? d.value;
+			break;
+		default: throw new UnsupportedDispatchInputError(`z.${d.type}`, key);
+	}
+	return out;
+}
+/** Extract a descriptor for every key in a `{ name: ZodSchema }` map. */
+function extractInputsDescriptorMap(map) {
+	const out = {};
+	for (const [k, v] of Object.entries(map)) out[k] = extractInputDescriptor(v, k);
+	return out;
+}
+//#endregion
+export { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap };
+
+//# sourceMappingURL=extract.js.map

package/dist/inputs/index.d.ts

@@ -0,0 +1,5 @@
+export * from './descriptor.js';
+export * from './extract.js';
+export * from './build.js';
+export * from './coerce.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/inputs/index.js

@@ -0,0 +1,6 @@
+import "../chunk-BTugEXQM.js";
+import { DispatchInputType, InputDescriptor, InputsDescriptorMapSchema } from "./descriptor.js";
+import { UnsupportedDispatchInputError, extractInputDescriptor, extractInputsDescriptorMap } from "./extract.js";
+import { buildZodFromDescriptor, buildZodObjectFromMap } from "./build.js";
+import { DispatchInputError, coerceDispatchInputs, parseInputPairs } from "./coerce.js";
+export { DispatchInputError, DispatchInputType, InputDescriptor, InputsDescriptorMapSchema, UnsupportedDispatchInputError, buildZodFromDescriptor, buildZodObjectFromMap, coerceDispatchInputs, extractInputDescriptor, extractInputsDescriptorMap, parseInputPairs };

package/dist/inventory.d.ts

@@ -30,8 +30,8 @@ export type InventoryLifecycleClass = z.infer<typeof InventoryLifecycleClass>;
  * awaiting reap).
  */
 export declare const InventoryHostStatus: z.ZodEnum<{
-    unreachable: "unreachable";
     ready: "ready";
+    unreachable: "unreachable";
     stale: "stale";
 }>;
 export type InventoryHostStatus = z.infer<typeof InventoryHostStatus>;
@@ -48,8 +48,8 @@ export declare const HostInventoryEntry: z.ZodObject<{
         ephemeral: "ephemeral";
     }>;
     status: z.ZodEnum<{
-        unreachable: "unreachable";
         ready: "ready";
+        unreachable: "unreachable";
         stale: "stale";
     }>;
     lastSeen: z.ZodString;

package/dist/labels/compile.d.ts

@@ -15,9 +15,12 @@ export declare function assertSafeRegex(source: string, flags: string, ctx: stri
  */
 export declare function toLabelMatcher(el: string | RegExp, ctx: string): LabelMatcher;
 export type SelectorEl = string | RegExp;
+/** Single-agent selection policy when multiple agents match a `runsOn` selector. */
+export type RunsOnPickInput = 'deterministic' | 'any';
 export type RunsOnAuthorInput = SelectorEl | readonly SelectorEl[] | {
     labels: SelectorEl | readonly SelectorEl[];
     exclude?: SelectorEl | readonly SelectorEl[];
+    pick?: RunsOnPickInput;
 };
 export type RunsOnAllAuthorInput = string | RegExp | readonly SelectorEl[] | {
     include: readonly {
@@ -30,6 +33,12 @@ export declare function normalizeRunsOnToMatchers(runsOn: RunsOnAuthorInput, ctx
     include: LabelMatcher[];
     exclude: LabelMatcher[];
 };
+/**
+ * Resolve a `runsOn` author value's single-agent selection policy, defaulting to
+ * `'deterministic'` for every form (string / array shorthand inherit the default
+ * after normalization; the selector object's explicit `pick` wins).
+ */
+export declare function runsOnPickFromInput(runsOn: RunsOnAuthorInput): RunsOnPickInput;
 /** Normalize a `runsOnAll` author value into include groups + exclude matchers. */
 export declare function normalizeRunsOnAllToMatchers(input: RunsOnAllAuthorInput, ctx: string): {
     include: LabelMatcher[][];

package/dist/labels/compile.js

@@ -59,6 +59,15 @@ function normalizeRunsOnToMatchers(runsOn, ctx) {
 		exclude: sel.exclude ? asArray(sel.exclude).map((e) => toLabelMatcher(e, ctx)) : []
 	};
 }
+/**
+* Resolve a `runsOn` author value's single-agent selection policy, defaulting to
+* `'deterministic'` for every form (string / array shorthand inherit the default
+* after normalization; the selector object's explicit `pick` wins).
+*/
+function runsOnPickFromInput(runsOn) {
+	if (typeof runsOn === "string" || runsOn instanceof RegExp || Array.isArray(runsOn)) return "deterministic";
+	return runsOn.pick ?? "deterministic";
+}
 /** Normalize a `runsOnAll` author value into include groups + exclude matchers. */
 function normalizeRunsOnAllToMatchers(input, ctx) {
 	if (typeof input === "string" || input instanceof RegExp) return {
@@ -86,6 +95,6 @@ function assertMatchersSafe(matchers, ctx) {
 	for (const m of matchers) if (m.kind === "regex") assertSafeRegex(m.source, m.flags, ctx);
 }
 //#endregion
-export { assertMatchersSafe, assertSafeRegex, normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, toLabelMatcher };
+export { assertMatchersSafe, assertSafeRegex, normalizeRunsOnAllToMatchers, normalizeRunsOnToMatchers, runsOnPickFromInput, toLabelMatcher };
 
 //# sourceMappingURL=compile.js.map

package/dist/labels-match.d.ts

@@ -24,6 +24,58 @@ export declare function compileRegexMatcher(m: {
 export declare function matcherMatches(m: LabelMatcher, label: string): boolean;
 /** Whether some label in the set satisfies the matcher. */
 export declare function matcherSatisfiedBy(m: LabelMatcher, labels: ReadonlySet<string>): boolean;
+export declare const HostTargetValue: z.ZodObject<{
+    include: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+    exclude: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"exact">;
+        value: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"regex">;
+        source: z.ZodString;
+        flags: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+}, z.core.$strip>;
+export type HostTargetValue = z.infer<typeof HostTargetValue>;
+/**
+ * A runtime host narrowing (`kici run --target`): each repeated value is an AND
+ * set; values AND-combine. Narrow-only — applied as a post-filter over the
+ * runsOnAll-matched roster. `allowEmpty` selects the zero-host outcome: skip
+ * (true) vs fail (false).
+ */
+export declare const HostTargetSelector: z.ZodObject<{
+    values: z.ZodArray<z.ZodObject<{
+        include: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"exact">;
+            value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"regex">;
+            source: z.ZodString;
+            flags: z.ZodString;
+        }, z.core.$strip>], "kind">>;
+        exclude: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"exact">;
+            value: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"regex">;
+            source: z.ZodString;
+            flags: z.ZodString;
+        }, z.core.$strip>], "kind">>;
+    }, z.core.$strip>>;
+    allowEmpty: z.ZodBoolean;
+}, z.core.$strip>;
+export type HostTargetSelector = z.infer<typeof HostTargetSelector>;
+/**
+ * True iff the host's labels satisfy EVERY target value: all of a value's
+ * include matchers match and none of its exclude matchers match.
+ */
+export declare function hostSatisfiesTarget(labels: ReadonlySet<string>, target: HostTargetSelector): boolean;
 /** Split a matcher list into exact label strings and the remaining regex matchers. */
 export declare function partitionMatchers(ms: readonly LabelMatcher[]): {
     exact: string[];

package/dist/labels-match.js

@@ -38,6 +38,27 @@ function matcherSatisfiedBy(m, labels) {
 	for (const label of labels) if (re.test(label)) return true;
 	return false;
 }
+const HostTargetValue = z.object({
+	include: z.array(LabelMatcher),
+	exclude: z.array(LabelMatcher)
+});
+/**
+* A runtime host narrowing (`kici run --target`): each repeated value is an AND
+* set; values AND-combine. Narrow-only — applied as a post-filter over the
+* runsOnAll-matched roster. `allowEmpty` selects the zero-host outcome: skip
+* (true) vs fail (false).
+*/
+const HostTargetSelector = z.object({
+	values: z.array(HostTargetValue).min(1),
+	allowEmpty: z.boolean()
+});
+/**
+* True iff the host's labels satisfy EVERY target value: all of a value's
+* include matchers match and none of its exclude matchers match.
+*/
+function hostSatisfiesTarget(labels, target) {
+	return target.values.every((v) => v.include.every((m) => matcherSatisfiedBy(m, labels)) && !v.exclude.some((m) => matcherSatisfiedBy(m, labels)));
+}
 /** Split a matcher list into exact label strings and the remaining regex matchers. */
 function partitionMatchers(ms) {
 	const exact = [];
@@ -51,6 +72,6 @@ function partitionMatchers(ms) {
 	};
 }
 //#endregion
-export { LabelMatcher, compileRegexMatcher, matcherMatches, matcherSatisfiedBy, partitionMatchers };
+export { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers };
 
 //# sourceMappingURL=labels-match.js.map

package/dist/labels.d.ts

@@ -79,6 +79,35 @@ export declare const KNOWN_ROLES: readonly ["builder", "init-runner"];
 export type AgentRole = (typeof KNOWN_ROLES)[number];
 /** Reserved label prefix — labels starting with this are system-managed. */
 export declare const RESERVED_LABEL_PREFIX = "kici:";
+/**
+ * Capability label prefix — `kici:capability:<name>` grants an agent a
+ * privileged capability beyond plain execution. Distinct from `kici:role:`
+ * (which gates which internal job kinds an agent runs).
+ */
+export declare const CAPABILITY_LABEL_PREFIX = "kici:capability:";
+/** Build a `kici:capability:<name>` label. */
+export declare function capabilityLabel(name: string): string;
+/**
+ * The `ssh-transport` capability: an agent holding this may run the bootstrap
+ * bring-up (`ctx.kici.bootstrap.ensureInitRunner` / `preBootSend`) — i.e. SSH
+ * to a declared-but-un-agented host. The orchestrator refuses to run a
+ * bring-up on an agent that lacks it. Prod-critical: such an agent custodies
+ * the bootstrap SSH key.
+ */
+export declare const SSH_TRANSPORT_CAPABILITY = "kici:capability:ssh-transport";
+/**
+ * The `kici:init` lifecycle label carried by a temporary init-runner agent
+ * brought up on a fresh box for bootstrap. Marks it as ephemeral + privileged;
+ * it dies on reboot and is reaped. Distinct from `kici:role:init-runner`
+ * (which is the per-job `__init__` workspace-init capability — a different
+ * concept entirely).
+ */
+export declare const INIT_LABEL = "kici:init";
+/**
+ * The `kici:privileged:root` label a bootstrap init-runner carries — it runs
+ * as root in the target's rescue env to partition / format / install.
+ */
+export declare const PRIVILEGED_ROOT_LABEL = "kici:privileged:root";
 /** Role label prefix — used to generate role-specific labels. */
 export declare const ROLE_LABEL_PREFIX = "kici:role:";
 /**

package/dist/labels.js

@@ -116,6 +116,37 @@ function normalizeRunsOn(runsOn) {
 const KNOWN_ROLES = ["builder", "init-runner"];
 /** Reserved label prefix — labels starting with this are system-managed. */
 const RESERVED_LABEL_PREFIX = "kici:";
+/**
+* Capability label prefix — `kici:capability:<name>` grants an agent a
+* privileged capability beyond plain execution. Distinct from `kici:role:`
+* (which gates which internal job kinds an agent runs).
+*/
+const CAPABILITY_LABEL_PREFIX = "kici:capability:";
+/** Build a `kici:capability:<name>` label. */
+function capabilityLabel(name) {
+	return `${CAPABILITY_LABEL_PREFIX}${name}`;
+}
+/**
+* The `ssh-transport` capability: an agent holding this may run the bootstrap
+* bring-up (`ctx.kici.bootstrap.ensureInitRunner` / `preBootSend`) — i.e. SSH
+* to a declared-but-un-agented host. The orchestrator refuses to run a
+* bring-up on an agent that lacks it. Prod-critical: such an agent custodies
+* the bootstrap SSH key.
+*/
+const SSH_TRANSPORT_CAPABILITY = "kici:capability:ssh-transport";
+/**
+* The `kici:init` lifecycle label carried by a temporary init-runner agent
+* brought up on a fresh box for bootstrap. Marks it as ephemeral + privileged;
+* it dies on reboot and is reaped. Distinct from `kici:role:init-runner`
+* (which is the per-job `__init__` workspace-init capability — a different
+* concept entirely).
+*/
+const INIT_LABEL = "kici:init";
+/**
+* The `kici:privileged:root` label a bootstrap init-runner carries — it runs
+* as root in the target's rescue env to partition / format / install.
+*/
+const PRIVILEGED_ROOT_LABEL = "kici:privileged:root";
 /** Role label prefix — used to generate role-specific labels. */
 const ROLE_LABEL_PREFIX = "kici:role:";
 /**
@@ -203,6 +234,6 @@ function separateLabels(labels) {
 	};
 }
 //#endregion
-export { HOST_LABEL_PREFIX, KNOWN_ROLES, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, separateLabels, validateNoReservedLabels };
+export { CAPABILITY_LABEL_PREFIX, HOST_LABEL_PREFIX, INIT_LABEL, KNOWN_ROLES, PRIVILEGED_ROOT_LABEL, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, agentTypeLabel, capabilityLabel, deriveOsArchLabels, hostLabel, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, parseHostLabel, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, separateLabels, validateNoReservedLabels };
 
 //# sourceMappingURL=labels.js.map

package/dist/metrics/catalog-policy.d.ts

@@ -52,6 +52,13 @@ export declare const OVERFLOW_LABEL_VALUE = "__overflow__";
  * so they are valid push payloads alongside `kici_orch_*`.
  */
 export declare const ORCH_PUSHED_METRIC_NAMES: ReadonlySet<MetricName>;
+/**
+ * Closed enum of scaler-backend TYPE values the orchestrator's own
+ * resource-usage gauges carry on their `scalerType` rollup label.
+ * `__global__` is the orchestrator-wide rollup row; the other four match
+ * `AGENT_SCALER_VALUES`. Exported so the policy tests can assert against it.
+ */
+export declare const ORCH_SCALER_VALUES: readonly ["__global__", "stateful", "container", "firecracker", "bare-metal"];
 /**
  * Per-metric, per-label value policy. Missing entries (or missing label
  * keys within an entry) mean "no value-level constraint" — the label key

package/dist/metrics/catalog-policy.js

@@ -1,4 +1,5 @@
 import "../chunk-BTugEXQM.js";
+import { ExecutionRunStatus } from "../protocol/messages/execution-status.js";
 import { MetricNames, MetricService } from "./metric-catalog.generated.js";
 //#region src/metrics/catalog-policy.ts
 /**
@@ -48,9 +49,10 @@ const AGENT_SCALER_VALUES = [
 	"bare-metal"
 ];
 /**
-* Closed enum of scaler values the orchestrator's own resource-usage
-* gauges emit. `__global__` is the orchestrator-wide rollup row; the
-* other four match `AGENT_SCALER_VALUES`.
+* Closed enum of scaler-backend TYPE values the orchestrator's own
+* resource-usage gauges carry on their `scalerType` rollup label.
+* `__global__` is the orchestrator-wide rollup row; the other four match
+* `AGENT_SCALER_VALUES`. Exported so the policy tests can assert against it.
 */
 const ORCH_SCALER_VALUES = ["__global__", ...AGENT_SCALER_VALUES];
 /** Closed enum of the five scheduled jobs the orchestrator runs (mirrors `OrchestratorScheduledJobName`). */
@@ -94,12 +96,7 @@ const METRIC_LABEL_POLICY = {
 		"handled",
 		"dispatched"
 	] } },
-	kici_orch_executions_total: { status: { values: [
-		"running",
-		"success",
-		"failed",
-		"cancelled"
-	] } },
+	kici_orch_executions_total: { status: { values: ExecutionRunStatus.options } },
 	kici_orch_steps_total: { status: { values: [
 		"running",
 		"success",
@@ -130,11 +127,13 @@ const METRIC_LABEL_POLICY = {
 		] }
 	},
 	kici_orch_scaler_cpus_used: {
-		scaler: { values: ORCH_SCALER_VALUES },
+		scaler: { maxUniqueValues: 50 },
+		scalerType: { values: ORCH_SCALER_VALUES },
 		machinePool: { maxUniqueValues: 50 }
 	},
 	kici_orch_scaler_memory_bytes_used: {
-		scaler: { values: ORCH_SCALER_VALUES },
+		scaler: { maxUniqueValues: 50 },
+		scalerType: { values: ORCH_SCALER_VALUES },
 		machinePool: { maxUniqueValues: 50 }
 	},
 	kici_orch_install_secrets_decisions_total: {
@@ -278,6 +277,6 @@ const METRIC_LABEL_POLICY = {
 	}
 };
 //#endregion
-export { METRIC_LABEL_POLICY, ORCH_PUSHED_METRIC_NAMES, OVERFLOW_LABEL_VALUE };
+export { METRIC_LABEL_POLICY, ORCH_PUSHED_METRIC_NAMES, ORCH_SCALER_VALUES, OVERFLOW_LABEL_VALUE };
 
 //# sourceMappingURL=catalog-policy.js.map

package/dist/metrics/metric-catalog.generated.d.ts

@@ -183,8 +183,8 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: readonly [];
     readonly KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: readonly ["source"];
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: readonly ["result"];
-    readonly KICI_ORCH_SCALER_CPUS_USED: readonly ["scaler", "machinePool"];
-    readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: readonly ["scaler", "machinePool"];
+    readonly KICI_ORCH_SCALER_CPUS_USED: readonly ["scaler", "scalerType", "machinePool"];
+    readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: readonly ["scaler", "scalerType", "machinePool"];
     readonly KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: readonly ["backend", "bound"];
     readonly KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: readonly [];
     readonly KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: readonly [];

package/dist/metrics/metric-catalog.generated.js

@@ -188,8 +188,16 @@ const MetricLabels = {
 	KICI_ORCH_LOG_CHUNKS_RECEIVED_TOTAL: [],
 	KICI_ORCH_PG_POOL_CLIENT_ERRORS_TOTAL: ["source"],
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: ["result"],
-	KICI_ORCH_SCALER_CPUS_USED: ["scaler", "machinePool"],
-	KICI_ORCH_SCALER_MEMORY_BYTES_USED: ["scaler", "machinePool"],
+	KICI_ORCH_SCALER_CPUS_USED: [
+		"scaler",
+		"scalerType",
+		"machinePool"
+	],
+	KICI_ORCH_SCALER_MEMORY_BYTES_USED: [
+		"scaler",
+		"scalerType",
+		"machinePool"
+	],
 	KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: ["backend", "bound"],
 	KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: [],
 	KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: [],

package/dist/protocol/dashboard-write-operations.d.ts

@@ -44,6 +44,8 @@ export declare const DashboardWriteOperation: z.ZodEnum<{
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "fleet.host.declare": "fleet.host.declare";
+    "fleet.host.remove": "fleet.host.remove";
 }>;
 export type DashboardWriteOperation = z.infer<typeof DashboardWriteOperation>;
 /** Stable list of every operation in enum-declaration order. */
@@ -57,6 +59,7 @@ export declare const DashboardWriteCategory: z.ZodEnum<{
     DLQ: "DLQ";
     Registrations: "Registrations";
     Topology: "Topology";
+    Fleet: "Fleet";
 }>;
 export type DashboardWriteCategory = z.infer<typeof DashboardWriteCategory>;
 export declare const DashboardWriteSensitivity: z.ZodEnum<{
@@ -130,6 +133,8 @@ export declare const dashboardWritePolicyMap: z.ZodRecord<z.ZodEnum<{
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "fleet.host.declare": "fleet.host.declare";
+    "fleet.host.remove": "fleet.host.remove";
 }> & z.core.$partial, z.ZodBoolean>;
 export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.ZodEnum<{
     "secrets.set": "secrets.set";
@@ -156,6 +161,8 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
     "backends.sync": "backends.sync";
     "backends.sync_one": "backends.sync_one";
     "backends.test": "backends.test";
+    "fleet.host.declare": "fleet.host.declare";
+    "fleet.host.remove": "fleet.host.remove";
 }> & z.core.$partial, z.ZodBoolean>>;
 /**
  * Resolve the effective state of an operation given a (possibly sparse)
@@ -164,7 +171,7 @@ export declare const dashboardWritePolicyMapSchema: z.ZodDefault<z.ZodRecord<z.Z
 export declare function isDashboardWriteOperationEnabled(policy: DashboardWritePolicyMap | null | undefined, op: DashboardWriteOperation): boolean;
 /**
  * Expand a (possibly sparse) policy map into the full effective state
- * for all 24 operations. Operations the policy doesn't mention come
+ * for all 26 operations. Operations the policy doesn't mention come
  * back as `true` (permissive). Used by the orch HTTP admin response,
  * the WS `orch.capabilities` broadcast, and the dashboard's policy
  * page so consumers see the full picture, not the sparse storage shape.

package/dist/protocol/dashboard-write-operations.js

@@ -45,7 +45,9 @@ const DashboardWriteOperation = z.enum([
 	"global_workflows.update",
 	"backends.sync",
 	"backends.sync_one",
-	"backends.test"
+	"backends.test",
+	"fleet.host.declare",
+	"fleet.host.remove"
 ]);
 /** Stable list of every operation in enum-declaration order. */
 const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
@@ -72,7 +74,9 @@ const DASHBOARD_WRITE_OPERATION_VALUES = Object.freeze([
 	"global_workflows.update",
 	"backends.sync",
 	"backends.sync_one",
-	"backends.test"
+	"backends.test",
+	"fleet.host.declare",
+	"fleet.host.remove"
 ]);
 const DashboardWriteCategory = z.enum([
 	"Secrets",
@@ -82,7 +86,8 @@ const DashboardWriteCategory = z.enum([
 	"Held runs",
 	"DLQ",
 	"Registrations",
-	"Topology"
+	"Topology",
+	"Fleet"
 ]);
 const DashboardWriteSensitivity = z.enum([
 	"plaintext",
@@ -281,6 +286,22 @@ const DASHBOARD_WRITE_OPERATIONS = Object.freeze([
 		label: "Test scaler backend",
 		sensitivity: "dispatch",
 		cliEquivalent: "kici-admin backend test"
+	},
+	{
+		name: "fleet.host.declare",
+		wireMessageType: "dashboard.fleet.host.declare",
+		category: "Fleet",
+		label: "Declare a static host",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin host declare"
+	},
+	{
+		name: "fleet.host.remove",
+		wireMessageType: "dashboard.fleet.host.remove",
+		category: "Fleet",
+		label: "Remove a host from the roster",
+		sensitivity: "dispatch",
+		cliEquivalent: "kici-admin host remove"
 	}
 ]);
 /** O(1) lookup of a descriptor by operation name. */
@@ -318,7 +339,7 @@ function isDashboardWriteOperationEnabled(policy, op) {
 }
 /**
 * Expand a (possibly sparse) policy map into the full effective state
-* for all 24 operations. Operations the policy doesn't mention come
+* for all 26 operations. Operations the policy doesn't mention come
 * back as `true` (permissive). Used by the orch HTTP admin response,
 * the WS `orch.capabilities` broadcast, and the dashboard's policy
 * page so consumers see the full picture, not the sparse storage shape.