@kici-dev/engine 0.1.27 → 0.3.0

package/dist/protocol/messages/orchestrator-agent.js

@@ -1,7 +1,9 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { ExecutionJobStatus, ExecutionStepStatus, StepConcurrencyKind } from "./execution-status.js";
 import { dsseEnvelopeSchema } from "../../provenance/dsse.js";
-import { approverClauseSchema } from "../../approval/types.js";
+import { approvalTimeoutSecondsSchema, approverClauseSchema } from "../../approval/types.js";
+import { orchAgentCapabilitiesSchema } from "./capabilities.js";
+import { LogStream } from "./log-stream.js";
 import { z } from "zod";
 //#region src/protocol/messages/orchestrator-agent.ts
 /**
@@ -83,6 +85,12 @@ const jobDispatchSchema = z.object({
 	namespacedSecrets: z.record(z.string(), z.record(z.string(), z.string())).optional(),
 	/** Max log size per step in bytes. Agent falls back to its own config default (10MB). */
 	maxLogSizeBytes: z.coerce.number().optional(),
+	/**
+	* Orchestrator-resolved concurrency-slot wait timeout (ms), from the
+	* fleet-wide `cluster_settings.concurrency_wait_timeout_ms`. Agent falls
+	* back to its own env/config default (1h) when absent (older orchestrators).
+	*/
+	concurrencyWaitTimeoutMs: z.coerce.number().optional(),
 	/** URL or file:// path to a pre-packed `.kici/` source tarball. If present, agent extracts it into workDir instead of cloning the repo. */
 	sourceTarUrl: z.string().optional(),
 	/** SHA-256 hash of the source tarball bytes for integrity verification on download. */
@@ -194,7 +202,13 @@ const registerAckSchema = z.object({
 	* If the dispatch never arrives (orchestrator crash, etc.) the agent's
 	* KICI_SCALER_PENDING_DISPATCH_TIMEOUT (default 60s) acts as a safety net.
 	*/
-	pendingDispatch: z.boolean().optional()
+	pendingDispatch: z.boolean().optional(),
+	/**
+	* Optional agent-facing capabilities this orchestrator supports (absent on
+	* pre-capability orchestrators). The agent reads it to decide whether to
+	* await optional acks like `artifacts.upload.complete.ack`.
+	*/
+	capabilities: orchAgentCapabilitiesSchema.optional()
 });
 /** Agent registration with capabilities and capacity. */
 const agentRegisterSchema = z.object({
@@ -327,7 +341,12 @@ const agentLogChunkSchema = z.object({
 	jobId: z.string(),
 	stepIndex: z.number(),
 	lines: z.array(z.string()),
-	timestamp: z.number()
+	timestamp: z.number(),
+	/**
+	* Which stream these lines came from. Optional for backward compatibility
+	* with agents that do not send it; absent is read as `stdout`.
+	*/
+	stream: LogStream.optional()
 });
 /** Step-level execution state report (agent -> orchestrator). */
 const agentStepStatusSchema = z.object({
@@ -559,6 +578,146 @@ const provenanceUploadDeferSchema = z.object({
 	/** Ephemeral public key JWK the envelope was signed with. */
 	publicKey: z.record(z.string(), z.unknown())
 });
+/**
+* Outcome of an artifact upload grant: the orchestrator either mints a
+* presigned PUT (`granted`) or refuses with a named reason (`rejected`).
+*/
+const ArtifactUploadOutcome = z.enum(["granted", "rejected"]);
+/**
+* Why an artifact upload was refused. Each value maps to an enforcement gate
+* checked BEFORE a presigned PUT is minted; the agent surfaces the reason
+* verbatim in the step error.
+*/
+const ArtifactRejectReason = z.enum([
+	"duplicate_name",
+	"size_cap",
+	"run_cap",
+	"org_quota"
+]);
+/** Outcome of an artifact download lookup: the named artifact exists or not. */
+const ArtifactDownloadOutcome = z.enum(["found", "not_found"]);
+/** Agent -> Orchestrator: request a presigned PUT for a named artifact upload. */
+const artifactsUploadRequestSchema = z.object({
+	type: z.literal("artifacts.upload.request"),
+	messageId: z.string(),
+	/** Job producing the artifact (ownership-checked; run + org resolved server-side). */
+	jobId: z.string(),
+	/** Artifact name (immutability + storage-key discriminator within the run). */
+	name: z.string(),
+	/** Packed tarball size in bytes — drives the size/run/quota enforcement gates. */
+	declaredSizeBytes: z.number().int().nonnegative()
+});
+/**
+* Orchestrator -> Agent: a presigned PUT (`granted`) or a named refusal
+* (`rejected`). All enforcement (duplicate name, per-artifact/per-run cap, org
+* quota) happens before minting, so a `granted` URL is safe to upload to.
+*/
+const artifactsUploadResponseSchema = z.object({
+	type: z.literal("artifacts.upload.response"),
+	requestId: z.string(),
+	outcome: ArtifactUploadOutcome,
+	/** Presigned PUT URL. Present only on `granted`. */
+	uploadUrl: z.string().optional(),
+	/** Final storage key the agent echoes back on complete. Present only on `granted`. */
+	storageKey: z.string().optional(),
+	/** Enforcement-gate refusal reason. Present only on `rejected` at an enforcement gate. */
+	reason: ArtifactRejectReason.optional(),
+	/**
+	* Failure detail. Present only on `rejected` when no enforcement `reason`
+	* applies — the requested name violates the artifact-name contract, artifact
+	* uploads are not configured on the orchestrator, the job's run could not be
+	* resolved, the job is not owned by this agent, or the orchestrator hit an
+	* internal error. A safe, fixed,
+	* human-readable string; never a raw exception. Older agents ignore the field
+	* and fall back to a generic rejection message.
+	*/
+	error: z.string().optional()
+});
+/** Agent -> Orchestrator: confirm an artifact upload finished; records the DB row. */
+const artifactsUploadCompleteSchema = z.object({
+	type: z.literal("artifacts.upload.complete"),
+	messageId: z.string(),
+	jobId: z.string(),
+	name: z.string(),
+	/**
+	* Packed tarball size in bytes.
+	*
+	* @deprecated Advisory only — the orchestrator reads the real object size back
+	* from storage and records that instead. Still sent for backward compatibility
+	* with older orchestrators; removed at v1.0.0.
+	*/
+	sizeBytes: z.number().int().nonnegative(),
+	/** SHA-256 (hex) of the tarball bytes. */
+	sha256: z.string(),
+	/**
+	* Storage key echoed from the grant response.
+	*
+	* @deprecated Ignored server-side — the orchestrator derives the storage key
+	* from the server-resolved run and artifact name. Still sent for backward
+	* compatibility with older orchestrators; removed at v1.0.0.
+	*/
+	storageKey: z.string()
+});
+/**
+* Outcome the orchestrator reports for an artifact commit: the DB row was
+* written (`committed`) or the commit could not be completed (`failed`).
+*/
+const ArtifactCompleteAckOutcome = z.enum(["committed", "failed"]);
+/**
+* Orchestrator -> Agent: the outcome of committing an
+* `artifacts.upload.complete`. Sent by orchestrators that advertise the
+* `artifactCompleteAck` capability on `register.ack`; the agent awaits it and
+* fails the workflow step on `failed`/timeout, so a lost commit surfaces as a
+* failed step instead of a green run with a missing artifact. `requestId`
+* echoes the complete message's `messageId`.
+*/
+const artifactsUploadCompleteAckSchema = z.object({
+	type: z.literal("artifacts.upload.complete.ack"),
+	requestId: z.string(),
+	outcome: ArtifactCompleteAckOutcome,
+	/**
+	* Failure detail — present only on `failed`. A safe, fixed, human-readable
+	* string classifying the failure: artifact uploads are not configured, the
+	* job's run could not be resolved, the job is not owned by this agent, the
+	* uploaded object was missing at commit time, the name violates the
+	* artifact-name contract, or the commit failed internally.
+	*/
+	reason: z.string().optional()
+});
+/** Agent -> Orchestrator: request a presigned GET for a named artifact of this run. */
+const artifactsDownloadRequestSchema = z.object({
+	type: z.literal("artifacts.download.request"),
+	messageId: z.string(),
+	/** Job requesting the download (ownership-checked; run resolved server-side). */
+	jobId: z.string(),
+	/** Artifact name to resolve within the run. */
+	name: z.string()
+});
+/**
+* Orchestrator -> Agent: presigned GET + size/sha256 for the named artifact, or
+* `not_found` when the run never uploaded an artifact by that name.
+*/
+const artifactsDownloadResponseSchema = z.object({
+	type: z.literal("artifacts.download.response"),
+	requestId: z.string(),
+	outcome: ArtifactDownloadOutcome,
+	/** Presigned GET URL. Present only on `found`. */
+	downloadUrl: z.string().optional(),
+	/** Artifact size in bytes. Present only on `found`. */
+	sizeBytes: z.number().int().nonnegative().optional(),
+	/** SHA-256 (hex) of the tarball bytes for integrity verification. Present only on `found`. */
+	sha256: z.string().optional(),
+	/**
+	* Internal-failure detail. Present only on `not_found` when the outcome
+	* reflects an orchestrator failure — artifact downloads are not configured,
+	* the job's run could not be resolved, the job is not owned by this agent, or
+	* the orchestrator hit an internal error — rather than a genuinely missing
+	* artifact. A safe, fixed,
+	* human-readable string; never a raw exception. Older agents ignore the field
+	* and render the plain not-found message.
+	*/
+	error: z.string().optional()
+});
 /** Agent -> Orchestrator: emit a custom event from a running workflow step. */
 const eventEmitSchema = z.object({
 	type: z.literal("event.emit"),
@@ -712,7 +871,7 @@ const stepApprovalRequestSchema = z.object({
 	* Absent ⇒ the orchestrator uses the org-default `approval_expiry_seconds`.
 	* The orchestrator owns the authoritative `expiresAt` computation.
 	*/
-	timeoutSeconds: z.number().int().positive().optional(),
+	timeoutSeconds: approvalTimeoutSecondsSchema.optional(),
 	/** Computed drift payload, present only for `when: 'drift'` gates. */
 	payload: stepApprovalPayloadSchema.optional()
 });
@@ -743,6 +902,9 @@ const orchestratorToAgentMessageSchema = z.discriminatedUnion("type", [
 	cacheUserRestoreResponseSchema,
 	cacheUserSaveResponseSchema,
 	provenanceUploadResponseSchema,
+	artifactsUploadResponseSchema,
+	artifactsUploadCompleteAckSchema,
+	artifactsDownloadResponseSchema,
 	eventEmitResponseSchema,
 	agentApiResponseSchema,
 	agentAuthSuccessSchema,
@@ -771,6 +933,9 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	provenanceUploadRequestSchema,
 	provenanceUploadCompleteSchema,
 	provenanceUploadDeferSchema,
+	artifactsUploadRequestSchema,
+	artifactsUploadCompleteSchema,
+	artifactsDownloadRequestSchema,
 	eventEmitSchema,
 	agentApiRequestSchema,
 	agentMetricsSchema,
@@ -780,6 +945,6 @@ const agentToOrchestratorMessageSchema = z.discriminatedUnion("type", [
 	stepApprovalRequestSchema
 ]);
 //#endregion
-export { CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
+export { ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, registerAckSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema };
 
 //# sourceMappingURL=orchestrator-agent.js.map

package/dist/protocol/messages/pat-kind.d.ts

@@ -9,8 +9,8 @@ import { z } from 'zod';
  *   credential the developer MCP server accepts.
  */
 export declare const PatKind: z.ZodEnum<{
-    user: "user";
     agent: "agent";
+    user: "user";
 }>;
 export type PatKind = z.infer<typeof PatKind>;
 //# sourceMappingURL=pat-kind.d.ts.map

package/dist/protocol/messages/peer.d.ts

@@ -3,8 +3,8 @@ import { z } from 'zod';
 export declare const peerCapabilitiesSchema: z.ZodObject<{
     s3LogAccess: z.ZodBoolean;
     logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-        direct: "direct";
         coordinator: "coordinator";
+        direct: "direct";
     }>>;
 }, z.core.$strip>;
 /** Scaler capacity summary included in peer heartbeat and auth response for routing decisions. */
@@ -72,8 +72,8 @@ export declare const peerAuthResponseSchema: z.ZodObject<{
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            direct: "direct";
             coordinator: "coordinator";
+            direct: "direct";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -97,8 +97,8 @@ export declare const peerHeartbeatSchema: z.ZodObject<{
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            direct: "direct";
             coordinator: "coordinator";
+            direct: "direct";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -112,6 +112,7 @@ export declare const peerHeartbeatSchema: z.ZodObject<{
     }, z.core.$strip>>>;
     configVersion: z.ZodOptional<z.ZodNumber>;
     registryVersion: z.ZodOptional<z.ZodNumber>;
+    clusterSettingsVersion: z.ZodOptional<z.ZodNumber>;
     timestamp: z.ZodNumber;
     hostname: z.ZodOptional<z.ZodString>;
     osRelease: z.ZodOptional<z.ZodString>;
@@ -214,17 +215,18 @@ export declare const jobProgressSchema: z.ZodObject<{
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
-        skipped: "skipped";
-        success: "success";
-        pending: "pending";
-        running: "running";
-        failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        drift_dropped: "drift_dropped";
+        failed: "failed";
+        pending: "pending";
         queued: "queued";
         recovering: "recovering";
+        running: "running";
+        skipped: "skipped";
+        success: "success";
         timed_out_stale: "timed_out_stale";
-        drift_dropped: "drift_dropped";
+        unroutable: "unroutable";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -240,17 +242,18 @@ export declare const jobProgressAckSchema: z.ZodObject<{
     runId: z.ZodString;
     jobId: z.ZodString;
     state: z.ZodEnum<{
-        skipped: "skipped";
-        success: "success";
-        pending: "pending";
-        running: "running";
-        failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        drift_dropped: "drift_dropped";
+        failed: "failed";
+        pending: "pending";
         queued: "queued";
         recovering: "recovering";
+        running: "running";
+        skipped: "skipped";
+        success: "success";
         timed_out_stale: "timed_out_stale";
-        drift_dropped: "drift_dropped";
+        unroutable: "unroutable";
     }>;
 }, z.core.$strip>;
 /** Request to cancel a job on a peer orchestrator. */
@@ -292,8 +295,8 @@ declare const peerLogChunkSchema: z.ZodObject<{
         text: z.ZodString;
         timestamp: z.ZodNumber;
         stream: z.ZodOptional<z.ZodEnum<{
-            stdout: "stdout";
             stderr: "stderr";
+            stdout: "stdout";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
@@ -304,8 +307,8 @@ declare const peerCacheUploadRequestSchema: z.ZodObject<{
     runId: z.ZodString;
     jobId: z.ZodString;
     cacheType: z.ZodEnum<{
-        source: "source";
         deps: "deps";
+        source: "source";
     }>;
     hash: z.ZodString;
     sizeBytes: z.ZodNumber;
@@ -342,6 +345,38 @@ export declare const peerConfigReloadResponseSchema: z.ZodObject<{
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
+/**
+ * Worker-relevant cluster settings a DB-less worker pulls from the leader.
+ *
+ * A typed, concrete snapshot (not an open key/value bus): each worker-consumed
+ * cluster knob is a field here. Adding the next worker-relevant knob is one
+ * field on this schema, not a new protocol message.
+ */
+export declare const workerClusterSettingsSchema: z.ZodObject<{
+    agentTokenTtlMs: z.ZodNumber;
+}, z.core.$strip>;
+/**
+ * Cluster-settings pull request: a DB-less worker asks the leader for the
+ * current worker-settings snapshot after observing the leader's advertised
+ * clusterSettingsVersion ahead of its own. The leader replies with
+ * peer.clusterSettings.response.
+ */
+export declare const peerClusterSettingsRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.clusterSettings.request">;
+    messageId: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Cluster-settings pull response: the leader resolves the snapshot from
+ * cluster_settings and replies with it plus the current version.
+ */
+export declare const peerClusterSettingsResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.clusterSettings.response">;
+    messageId: z.ZodString;
+    version: z.ZodNumber;
+    settings: z.ZodObject<{
+        agentTokenTtlMs: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 /** Which of THIS peer's downstream nodes to gather. all=true ignores the id lists. */
 export declare const fleetSelectionSchema: z.ZodObject<{
     all: z.ZodBoolean;
@@ -406,11 +441,11 @@ export declare const peerScalerEventSchema: z.ZodObject<{
     jobId: z.ZodString;
     agentId: z.ZodString;
     eventType: z.ZodEnum<{
-        "scaler.provisioning": "scaler.provisioning";
+        "agent.connecting": "agent.connecting";
+        "scaler.failed": "scaler.failed";
         "scaler.network": "scaler.network";
+        "scaler.provisioning": "scaler.provisioning";
         "scaler.ready": "scaler.ready";
-        "scaler.failed": "scaler.failed";
-        "agent.connecting": "agent.connecting";
     }>;
     detail: z.ZodString;
     timestampMs: z.ZodNumber;
@@ -464,8 +499,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            direct: "direct";
             coordinator: "coordinator";
+            direct: "direct";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -487,8 +522,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            direct: "direct";
             coordinator: "coordinator";
+            direct: "direct";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -502,6 +537,7 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     }, z.core.$strip>>>;
     configVersion: z.ZodOptional<z.ZodNumber>;
     registryVersion: z.ZodOptional<z.ZodNumber>;
+    clusterSettingsVersion: z.ZodOptional<z.ZodNumber>;
     timestamp: z.ZodNumber;
     hostname: z.ZodOptional<z.ZodString>;
     osRelease: z.ZodOptional<z.ZodString>;
@@ -579,17 +615,18 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
-        skipped: "skipped";
-        success: "success";
-        pending: "pending";
-        running: "running";
-        failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        drift_dropped: "drift_dropped";
+        failed: "failed";
+        pending: "pending";
         queued: "queued";
         recovering: "recovering";
+        running: "running";
+        skipped: "skipped";
+        success: "success";
         timed_out_stale: "timed_out_stale";
-        drift_dropped: "drift_dropped";
+        unroutable: "unroutable";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -598,17 +635,18 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     runId: z.ZodString;
     jobId: z.ZodString;
     state: z.ZodEnum<{
-        skipped: "skipped";
-        success: "success";
-        pending: "pending";
-        running: "running";
-        failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        drift_dropped: "drift_dropped";
+        failed: "failed";
+        pending: "pending";
         queued: "queued";
         recovering: "recovering";
+        running: "running";
+        skipped: "skipped";
+        success: "success";
         timed_out_stale: "timed_out_stale";
-        drift_dropped: "drift_dropped";
+        unroutable: "unroutable";
     }>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.job.cancel">;
@@ -640,8 +678,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         text: z.ZodString;
         timestamp: z.ZodNumber;
         stream: z.ZodOptional<z.ZodEnum<{
-            stdout: "stdout";
             stderr: "stderr";
+            stdout: "stdout";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -650,8 +688,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     runId: z.ZodString;
     jobId: z.ZodString;
     cacheType: z.ZodEnum<{
-        source: "source";
         deps: "deps";
+        source: "source";
     }>;
     hash: z.ZodString;
     sizeBytes: z.ZodNumber;
@@ -673,6 +711,16 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     errors: z.ZodOptional<z.ZodArray<z.ZodString>>;
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.clusterSettings.request">;
+    messageId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.clusterSettings.response">;
+    messageId: z.ZodString;
+    version: z.ZodNumber;
+    settings: z.ZodObject<{
+        agentTokenTtlMs: z.ZodNumber;
+    }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.logs.collect.request">;
     messageId: z.ZodString;
@@ -707,11 +755,11 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     jobId: z.ZodString;
     agentId: z.ZodString;
     eventType: z.ZodEnum<{
-        "scaler.provisioning": "scaler.provisioning";
+        "agent.connecting": "agent.connecting";
+        "scaler.failed": "scaler.failed";
         "scaler.network": "scaler.network";
+        "scaler.provisioning": "scaler.provisioning";
         "scaler.ready": "scaler.ready";
-        "scaler.failed": "scaler.failed";
-        "agent.connecting": "agent.connecting";
     }>;
     detail: z.ZodString;
     timestampMs: z.ZodNumber;
@@ -765,8 +813,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            direct: "direct";
             coordinator: "coordinator";
+            direct: "direct";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -788,8 +836,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     capabilities: z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
-            direct: "direct";
             coordinator: "coordinator";
+            direct: "direct";
         }>>;
     }, z.core.$strip>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -803,6 +851,7 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     }, z.core.$strip>>>;
     configVersion: z.ZodOptional<z.ZodNumber>;
     registryVersion: z.ZodOptional<z.ZodNumber>;
+    clusterSettingsVersion: z.ZodOptional<z.ZodNumber>;
     timestamp: z.ZodNumber;
     hostname: z.ZodOptional<z.ZodString>;
     osRelease: z.ZodOptional<z.ZodString>;
@@ -880,17 +929,18 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     stepIndex: z.ZodNumber;
     stepName: z.ZodString;
     state: z.ZodEnum<{
-        skipped: "skipped";
-        success: "success";
-        pending: "pending";
-        running: "running";
-        failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        drift_dropped: "drift_dropped";
+        failed: "failed";
+        pending: "pending";
         queued: "queued";
         recovering: "recovering";
+        running: "running";
+        skipped: "skipped";
+        success: "success";
         timed_out_stale: "timed_out_stale";
-        drift_dropped: "drift_dropped";
+        unroutable: "unroutable";
     }>;
     timestamp: z.ZodNumber;
     data: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -899,17 +949,18 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     runId: z.ZodString;
     jobId: z.ZodString;
     state: z.ZodEnum<{
-        skipped: "skipped";
-        success: "success";
-        pending: "pending";
-        running: "running";
-        failed: "failed";
         cancelled: "cancelled";
         cancelling: "cancelling";
+        drift_dropped: "drift_dropped";
+        failed: "failed";
+        pending: "pending";
         queued: "queued";
         recovering: "recovering";
+        running: "running";
+        skipped: "skipped";
+        success: "success";
         timed_out_stale: "timed_out_stale";
-        drift_dropped: "drift_dropped";
+        unroutable: "unroutable";
     }>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.job.cancel">;
@@ -941,8 +992,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
         text: z.ZodString;
         timestamp: z.ZodNumber;
         stream: z.ZodOptional<z.ZodEnum<{
-            stdout: "stdout";
             stderr: "stderr";
+            stdout: "stdout";
         }>>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
@@ -951,8 +1002,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     runId: z.ZodString;
     jobId: z.ZodString;
     cacheType: z.ZodEnum<{
-        source: "source";
         deps: "deps";
+        source: "source";
     }>;
     hash: z.ZodString;
     sizeBytes: z.ZodNumber;
@@ -974,6 +1025,16 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     errors: z.ZodOptional<z.ZodArray<z.ZodString>>;
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.clusterSettings.request">;
+    messageId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.clusterSettings.response">;
+    messageId: z.ZodString;
+    version: z.ZodNumber;
+    settings: z.ZodObject<{
+        agentTokenTtlMs: z.ZodNumber;
+    }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.logs.collect.request">;
     messageId: z.ZodString;
@@ -1008,11 +1069,11 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     jobId: z.ZodString;
     agentId: z.ZodString;
     eventType: z.ZodEnum<{
-        "scaler.provisioning": "scaler.provisioning";
+        "agent.connecting": "agent.connecting";
+        "scaler.failed": "scaler.failed";
         "scaler.network": "scaler.network";
+        "scaler.provisioning": "scaler.provisioning";
         "scaler.ready": "scaler.ready";
-        "scaler.failed": "scaler.failed";
-        "agent.connecting": "agent.connecting";
     }>;
     detail: z.ZodString;
     timestampMs: z.ZodNumber;
@@ -1033,6 +1094,9 @@ export type PeerCacheUploadRequest = z.infer<typeof peerCacheUploadRequestSchema
 export type PeerCacheUploadResponse = z.infer<typeof peerCacheUploadResponseSchema>;
 export type PeerConfigReload = z.infer<typeof peerConfigReloadSchema>;
 export type PeerConfigReloadResponse = z.infer<typeof peerConfigReloadResponseSchema>;
+export type WorkerClusterSettings = z.infer<typeof workerClusterSettingsSchema>;
+export type PeerClusterSettingsRequest = z.infer<typeof peerClusterSettingsRequestSchema>;
+export type PeerClusterSettingsResponse = z.infer<typeof peerClusterSettingsResponseSchema>;
 export type PeerLeaving = z.infer<typeof peerLeavingSchema>;
 export type PeerAgentTokenRevoke = z.infer<typeof peerAgentTokenRevokeSchema>;
 export type FleetSelection = z.infer<typeof fleetSelectionSchema>;