@kici-dev/engine 0.1.9 → 0.1.11

package/dist/audit/retention-policy.js

@@ -176,12 +176,11 @@ function groupByDays(map) {
 function accessLogWarmSqlCase() {
 	const groups = groupByDays(ACCESS_LOG_WARM_DAYS);
 	const sortedDays = [...groups.keys()].sort((a, b) => b - a);
-	const defaultDays = Math.min(...groups.keys());
+	const defaultDays = UNKNOWN_ACTION_WARM_DAYS;
 	const whenClauses = [];
 	whenClauses.push(`WHEN outcome IN ('denied','error') THEN INTERVAL '${FORENSIC_OUTCOME_DAYS} days'`);
 	whenClauses.push(`WHEN actor_type = 'platform_operator' THEN INTERVAL '${PLATFORM_OPERATOR_DAYS} days'`);
 	for (const days of sortedDays) {
-		if (days === defaultDays) continue;
 		const actions = groups.get(days);
 		whenClauses.push(`WHEN action IN (${quoteList(actions)}) THEN INTERVAL '${days} days'`);
 	}

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from './protocol/messages/auth.js';
 export * from './protocol/messages/capabilities.js';
 export { webhookRelaySchema, webhookRelayStartSchema, webhookRelayChunkSchema, webhookAckSchema, WebhookRelayResult, WEBHOOK_RELAY_MAX_BODY_BYTES, WEBHOOK_RELAY_CHUNK_SIZE, executionEventSchema, logChunkSchema, peerDiscoverSchema, peerUpdateSchema, cacheStatsSchema, orchMetricsSchema, platformToOrchestratorMessageSchema, orchestratorToPlatformMessageSchema, type WebhookRelay, type WebhookRelayStart, type WebhookRelayChunk, type WebhookAck, type LogChunk, type PeerDiscover, type PeerUpdate, type CacheStats, type OrchMetrics, trustPolicyUpdateSchema, type TrustPolicyUpdate, staleCheckrunCleanupSchema, type StaleCheckrunCleanup, type PlatformToOrchestratorMessage, type OrchestratorToPlatformMessage, } from './protocol/messages/platform-orchestrator.js';
 export * from './protocol/messages/execution-status.js';
+export * from './protocol/messages/scaler-event.js';
 export * from './protocol/messages/event-log.js';
 export * from './protocol/messages/access-log.js';
 export * from './audit/access-log-policy.js';
@@ -44,7 +45,7 @@ export type { RateLimiterConfig, RateLimitResult } from './ws/rate-limiter.js';
 export * from './env/environment-allowlist.js';
 export * from './secrets/index.js';
 export * from './environment/index.js';
-export { deriveOsArchLabels, hostLabel, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, } from './labels.js';
+export { deriveOsArchLabels, hostLabel, agentTypeLabel, scalerLabel, mergeAutoLabels, normalizeRunsOn, KNOWN_ROLES, resolveRoleLabels, validateNoReservedLabels, scalerAgentLabels, isSelfReportedLabel, SELF_REPORTED_LABEL_PREFIXES, } from './labels.js';
 export type { NormalizedRunsOn } from './labels.js';
 export type { AgentRole } from './labels.js';
 export * from './scaler/scaler-backend-type.js';

package/dist/index.js

@@ -11,6 +11,7 @@ import { browserJobContextSchema, browserRunEventSchema, dashboardOrchLogsReques
 import { EventLogSource, EventLogStatus, PayloadOmittedReason } from "./protocol/messages/event-log.js";
 import { EventLogPayloadStreamError, HeldRunQueueType, HeldRunStatus, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserEventLogPayloadChunkSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, eventLogListItemSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, identityLinkItemSchema, identityLinkListResponseSchema, manualScheduleRequestSchema, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, orgMemberSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, runCancelRequestSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, trustPolicyResponseSchema } from "./protocol/messages/dashboard.js";
 import { WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WebhookRelayResult, cacheStatsSchema, executionEventSchema, logChunkSchema, orchMetricsSchema, orchestratorToPlatformMessageSchema, peerDiscoverSchema, peerUpdateSchema, platformToOrchestratorMessageSchema, staleCheckrunCleanupSchema, trustPolicyUpdateSchema, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema } from "./protocol/messages/platform-orchestrator.js";
+import { ScalerEventType } from "./protocol/messages/scaler-event.js";
 import { AccessLogPolicyKind, POLICY_BY_ACTION, fnv1a32, shouldRecordAccess, shouldRecordSecretResolve } from "./audit/access-log-policy.js";
 import { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, accessLogWarmSqlCase, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase } from "./audit/retention-policy.js";
 import { ActivityFilterSource, ActivityRowSource, activityCursorSchema, activityFilterSchema, activityRowSchema, decodeActivityCursor, encodeActivityCursor, resolveRunIdSugar } from "./audit/activity.js";
@@ -18,7 +19,7 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
+import { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema } from "./protocol/messages/peer.js";
 import { agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, gitAuthSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobStatusSchema, orchestratorToAgentMessageSchema, registerAckSchema } from "./protocol/messages/orchestrator-agent.js";
 import { testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema } from "./protocol/messages/test-run.js";
 import { observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema } from "./protocol/messages/observe.js";
@@ -36,10 +37,10 @@ import { AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, KICI_AGENT_ENV_PREFIX, S
 import "./secrets/index.js";
 import { matchScopePattern, resolveSecretsForEnvironment, stripScopePrefix } from "./environment/scope-resolver.js";
 import "./environment/index.js";
-import { KNOWN_ROLES, agentTypeLabel, deriveOsArchLabels, hostLabel, mergeAutoLabels, normalizeRunsOn, resolveRoleLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
+import { KNOWN_ROLES, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, resolveRoleLabels, scalerAgentLabels, scalerLabel, validateNoReservedLabels } from "./labels.js";
 import { ScalerBackendType } from "./scaler/scaler-backend-type.js";
 import { parseMemoryString, resourceRequestNestedSchema, resourceSpecSchema, validateResourceRequest } from "./scaler/resource-types.js";
 import { RegisterableTriggerType } from "./registration/registerable-trigger-type.js";
 import { createWorkflowBundleConfig } from "./bundler/rolldown-config.js";
 import "./bundler/index.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HeldRunQueueType, HeldRunStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, ScalerBackendType, SourceProvider, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isTerminal, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, CheckRunConclusion, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, HeldRunQueueType, HeldRunStatus, KICI_AGENT_ENV_PREFIX, KNOWN_ROLES, MIN_PROTOCOL_VERSION, NeedsEntrySchema, NeedsGroupEntrySchema, ORCH_CAPABILITIES, OrchRole, POLICY_BY_ACTION, PROTOCOL_VERSION, PayloadOmittedReason, RegisterableTriggerType, SANDBOX_DEFAULT_VARS, SCHEMA_VERSION, SELF_REPORTED_LABEL_PREFIXES, ScalerBackendType, ScalerEventType, SourceProvider, SourceSubtype, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_RUN_NOT_FOUND, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, apiKeyActorSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, cacheStatsSchema, configAckSchema, createTraceEntry, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, encodeActivityCursor, envBindingsListRequestSchema, envBindingsSetRequestSchema, envCreateRequestSchema, envDeleteRequestSchema, envGetRequestSchema, envHistoryRequestSchema, envListRequestSchema, envSecretDeleteRequestSchema, envSecretScopeCreateRequestSchema, envSecretScopeDeleteRequestSchema, envSecretScopeRenameRequestSchema, envSecretSetRequestSchema, envSecretsListRequestSchema, envSourceOverrideDeleteRequestSchema, envSourceOverrideSetRequestSchema, envSourceOverridesListRequestSchema, envUpdateRequestSchema, envVarDeleteRequestSchema, envVarSetRequestSchema, envVarsListRequestSchema, errorSchema, eventEmitResponseSchema, eventEmitSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, flattenActor, fnv1a32, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, gitAuthSchema, hasOrchCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostLabel, identityLinkItemSchema, identityLinkListResponseSchema, isLockDynamicJobFn, isLockInlineValue, isLockStaticJob, isSelfReportedLabel, isTerminal, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchWorkflowTriggers, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, normalizeRunsOn, observeCompleteSchema, observeLogSchema, observeStatusSchema, observeStepSchema, observeSubscribeSchema, orchCapabilitiesSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseMemoryString, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, resolveRoleLabels, resolveRunIdSugar, resolveSecretsForEnvironment, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runRerunRequestSchema, scalerAgentLabels, scalerLabel, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplaySchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, systemActorSchema, testCancelResponseSchema, testCancelSchema, testEventSchema, testTriggerResponseSchema, testTriggerSchema, transition, trustPolicyResponseSchema, trustPolicyUpdateSchema, userActorSchema, validateNoReservedLabels, validateResourceRequest, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema };

package/dist/labels.d.ts

@@ -87,6 +87,30 @@ export declare function roleToLabel(role: AgentRole): string;
  * - ['builder'] → specific role labels only
  */
 export declare function resolveRoleLabels(roles: readonly string[] | undefined): string[];
+/**
+ * The full label set a scaler injects into an agent it spawns: the base label
+ * set plus the scaler-assigned `kici:agent:`, `kici:scaler:`, and `kici:role:`
+ * labels. This is exactly what the scaler writes into `KICI_LABELS`, and it is
+ * the set an ephemeral agent token must be bound to — the agent then adds only
+ * the self-reported platform facts (`kici:os:`, `kici:arch:`, `kici:host:`) at
+ * registration, which the orchestrator's register-time scope gate exempts (see
+ * `isSelfReportedLabel`). Keep this aligned with the agent's wire-label
+ * construction in `orchestrator-client.ts#sendAgentRegister`.
+ */
+export declare function scalerAgentLabels(labelSet: string[], backendType: string, backendName: string, roles: readonly string[] | undefined): string[];
+/**
+ * Label-category prefixes the agent self-reports at registration from its own
+ * host (operating system, CPU architecture, hostname). They are immutable
+ * platform facts, not authorization grants, so the orchestrator's register-time
+ * label-scope gate does not require an ephemeral token to be bound to them.
+ */
+export declare const SELF_REPORTED_LABEL_PREFIXES: readonly ["kici:os:", "kici:arch:", "kici:host:"];
+/**
+ * True if a label is a self-reported platform fact (os/arch/host) rather than a
+ * scaler-assigned, authorization-bearing label. Used by the agent register-time
+ * scope gate to avoid flagging the agent's own platform labels as "elevated".
+ */
+export declare function isSelfReportedLabel(label: string): boolean;
 /**
  * Validate that no labels use the reserved kici: prefix.
  * Throws if any reserved labels are found (case-insensitive check).

package/dist/labels.js

@@ -130,6 +130,43 @@ function resolveRoleLabels(roles) {
 	return roles.map(roleToLabel);
 }
 /**
+* The full label set a scaler injects into an agent it spawns: the base label
+* set plus the scaler-assigned `kici:agent:`, `kici:scaler:`, and `kici:role:`
+* labels. This is exactly what the scaler writes into `KICI_LABELS`, and it is
+* the set an ephemeral agent token must be bound to — the agent then adds only
+* the self-reported platform facts (`kici:os:`, `kici:arch:`, `kici:host:`) at
+* registration, which the orchestrator's register-time scope gate exempts (see
+* `isSelfReportedLabel`). Keep this aligned with the agent's wire-label
+* construction in `orchestrator-client.ts#sendAgentRegister`.
+*/
+function scalerAgentLabels(labelSet, backendType, backendName, roles) {
+	return [
+		...labelSet,
+		agentTypeLabel(backendType),
+		scalerLabel(backendName),
+		...resolveRoleLabels(roles)
+	];
+}
+/**
+* Label-category prefixes the agent self-reports at registration from its own
+* host (operating system, CPU architecture, hostname). They are immutable
+* platform facts, not authorization grants, so the orchestrator's register-time
+* label-scope gate does not require an ephemeral token to be bound to them.
+*/
+const SELF_REPORTED_LABEL_PREFIXES = [
+	"kici:os:",
+	"kici:arch:",
+	"kici:host:"
+];
+/**
+* True if a label is a self-reported platform fact (os/arch/host) rather than a
+* scaler-assigned, authorization-bearing label. Used by the agent register-time
+* scope gate to avoid flagging the agent's own platform labels as "elevated".
+*/
+function isSelfReportedLabel(label) {
+	return SELF_REPORTED_LABEL_PREFIXES.some((p) => label.startsWith(p));
+}
+/**
 * Validate that no labels use the reserved kici: prefix.
 * Throws if any reserved labels are found (case-insensitive check).
 */
@@ -157,6 +194,6 @@ function separateLabels(labels) {
 	};
 }
 //#endregion
-export { KNOWN_ROLES, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, agentTypeLabel, deriveOsArchLabels, hostLabel, isAutoLabel, mergeAutoLabels, normalizeRunsOn, resolveRoleLabels, roleToLabel, scalerLabel, separateLabels, validateNoReservedLabels };
+export { KNOWN_ROLES, RESERVED_LABEL_PREFIX, ROLE_LABEL_PREFIX, SELF_REPORTED_LABEL_PREFIXES, agentTypeLabel, deriveOsArchLabels, hostLabel, isAutoLabel, isSelfReportedLabel, mergeAutoLabels, normalizeRunsOn, resolveRoleLabels, roleToLabel, scalerAgentLabels, scalerLabel, separateLabels, validateNoReservedLabels };
 
 //# sourceMappingURL=labels.js.map

package/dist/metrics/metric-catalog.generated.d.ts

@@ -47,6 +47,7 @@ export declare const MetricNames: {
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "kici_orch_scaler_config_reloads_total";
     readonly KICI_ORCH_SCALER_CPUS_USED: "kici_orch_scaler_cpus_used";
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: "kici_orch_scaler_memory_bytes_used";
+    readonly KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: "kici_orch_scaler_spawn_failures_total";
     readonly KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "kici_orch_scaler_spawn_refusals_total";
     readonly KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "kici_orch_source_cache_hits_total";
     readonly KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "kici_orch_source_cache_misses_total";
@@ -169,6 +170,7 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: readonly ["result"];
     readonly KICI_ORCH_SCALER_CPUS_USED: readonly ["scaler", "machinePool"];
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: readonly ["scaler", "machinePool"];
+    readonly KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: readonly ["backend", "bound"];
     readonly KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: readonly [];
     readonly KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: readonly [];
     readonly KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: readonly [];
@@ -290,6 +292,7 @@ export declare const MetricKind: {
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "counter";
     readonly KICI_ORCH_SCALER_CPUS_USED: "observableGauge";
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: "observableGauge";
+    readonly KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: "counter";
     readonly KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "observableGauge";
     readonly KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "counter";
     readonly KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "counter";
@@ -411,6 +414,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "Total number of scaler config reload operations";
     readonly KICI_ORCH_SCALER_CPUS_USED: "Current CPU reservations summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.";
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: "Current memory reservations (bytes) summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.";
+    readonly KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: "Total scaler agent spawn failures (job-bound and warm-pool)";
     readonly KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "Cumulative count of scaler spawn requests refused due to resource caps (maxAgents, resourceCap, globalResourceCap, machinePool).";
     readonly KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "Total number of source tarball cache hits";
     readonly KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "Total number of source tarball cache misses";
@@ -539,6 +543,7 @@ export declare const MetricService: {
     readonly KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "orchestrator";
     readonly KICI_ORCH_SCALER_CPUS_USED: "orchestrator";
     readonly KICI_ORCH_SCALER_MEMORY_BYTES_USED: "orchestrator";
+    readonly KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: "orchestrator";
     readonly KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "orchestrator";
     readonly KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "orchestrator";
     readonly KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "orchestrator";

package/dist/metrics/metric-catalog.generated.js

@@ -49,6 +49,7 @@ const MetricNames = {
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "kici_orch_scaler_config_reloads_total",
 	KICI_ORCH_SCALER_CPUS_USED: "kici_orch_scaler_cpus_used",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "kici_orch_scaler_memory_bytes_used",
+	KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: "kici_orch_scaler_spawn_failures_total",
 	KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "kici_orch_scaler_spawn_refusals_total",
 	KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "kici_orch_source_cache_hits_total",
 	KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "kici_orch_source_cache_misses_total",
@@ -174,6 +175,7 @@ const MetricLabels = {
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: ["result"],
 	KICI_ORCH_SCALER_CPUS_USED: ["scaler", "machinePool"],
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: ["scaler", "machinePool"],
+	KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: ["backend", "bound"],
 	KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: [],
 	KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: [],
 	KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: [],
@@ -299,6 +301,7 @@ const MetricKind = {
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "counter",
 	KICI_ORCH_SCALER_CPUS_USED: "observableGauge",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "observableGauge",
+	KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: "counter",
 	KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "observableGauge",
 	KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "counter",
 	KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "counter",
@@ -420,6 +423,7 @@ const MetricDescription = {
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "Total number of scaler config reload operations",
 	KICI_ORCH_SCALER_CPUS_USED: "Current CPU reservations summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "Current memory reservations (bytes) summed by scaler / pool. scaler=\"__global__\" is the orchestrator-wide total; machinePool=\"<name>\" rows reflect the on-disk ledger.",
+	KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: "Total scaler agent spawn failures (job-bound and warm-pool)",
 	KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "Cumulative count of scaler spawn requests refused due to resource caps (maxAgents, resourceCap, globalResourceCap, machinePool).",
 	KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "Total number of source tarball cache hits",
 	KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "Total number of source tarball cache misses",
@@ -548,6 +552,7 @@ const MetricService = {
 	KICI_ORCH_SCALER_CONFIG_RELOADS_TOTAL: "orchestrator",
 	KICI_ORCH_SCALER_CPUS_USED: "orchestrator",
 	KICI_ORCH_SCALER_MEMORY_BYTES_USED: "orchestrator",
+	KICI_ORCH_SCALER_SPAWN_FAILURES_TOTAL: "orchestrator",
 	KICI_ORCH_SCALER_SPAWN_REFUSALS_TOTAL: "orchestrator",
 	KICI_ORCH_SOURCE_CACHE_HITS_TOTAL: "orchestrator",
 	KICI_ORCH_SOURCE_CACHE_MISSES_TOTAL: "orchestrator",
@@ -670,6 +675,7 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_scaler_config_reloads_total",
 	"kici_orch_scaler_cpus_used",
 	"kici_orch_scaler_memory_bytes_used",
+	"kici_orch_scaler_spawn_failures_total",
 	"kici_orch_scaler_spawn_refusals_total",
 	"kici_orch_source_cache_hits_total",
 	"kici_orch_source_cache_misses_total",

package/dist/package-manager.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Package-manager wire identity for protocol schemas and the lock-file type.
+ *
+ * Engine has no internal `@kici-dev/*` dependencies (it is a leaf imported by
+ * the browser dashboard), so it owns the wire enum for the package manager
+ * rather than importing the detection enum from `@kici-dev/shared`. The three
+ * values are identical to `@kici-dev/shared`'s `PackageManager` enum; a
+ * compile-time assignability test in a package that imports both guards
+ * against drift.
+ */
+import { z } from 'zod';
+/** Wire schema for the package manager that resolves `.kici/` dependencies. */
+export declare const packageManagerSchema: z.ZodEnum<{
+    npm: "npm";
+    pnpm: "pnpm";
+    yarn: "yarn";
+}>;
+/** `'npm' | 'pnpm' | 'yarn'` — the package-manager identity on the wire. */
+export type PackageManagerId = z.infer<typeof packageManagerSchema>;
+//# sourceMappingURL=package-manager.d.ts.map

package/dist/protocol/messages/peer.d.ts

@@ -314,6 +314,30 @@ export declare const peerAgentTokenRevokeSchema: z.ZodObject<{
     tokenId: z.ZodString;
     senderInstanceId: z.ZodString;
 }, z.core.$strip>;
+/**
+ * A scaler provisioning event a worker forwards to the owning coordinator.
+ *
+ * Workers have no database, so they cannot persist a provisioning failure
+ * themselves. When a worker's scaler emits an event correlated to a queued
+ * job (e.g. a failed agent spawn), the worker relays it to the coordinator
+ * that owns the run; the coordinator's ExecutionTracker writes it to the
+ * provisioning log and the dispatch queue's last-error column.
+ */
+export declare const peerScalerEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"scaler.event">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    agentId: z.ZodString;
+    eventType: z.ZodEnum<{
+        "scaler.provisioning": "scaler.provisioning";
+        "scaler.network": "scaler.network";
+        "scaler.ready": "scaler.ready";
+        "scaler.failed": "scaler.failed";
+        "agent.connecting": "agent.connecting";
+    }>;
+    detail: z.ZodString;
+    timestampMs: z.ZodNumber;
+}, z.core.$strip>;
 /** All peer-to-peer messages (outbound from this node). */
 export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"peer.hello">;
@@ -543,6 +567,20 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     type: z.ZodLiteral<"peer.agent-token.revoke">;
     tokenId: z.ZodString;
     senderInstanceId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"scaler.event">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    agentId: z.ZodString;
+    eventType: z.ZodEnum<{
+        "scaler.provisioning": "scaler.provisioning";
+        "scaler.network": "scaler.network";
+        "scaler.ready": "scaler.ready";
+        "scaler.failed": "scaler.failed";
+        "agent.connecting": "agent.connecting";
+    }>;
+    detail: z.ZodString;
+    timestampMs: z.ZodNumber;
 }, z.core.$strip>], "type">;
 /** All peer-to-peer messages (inbound to this node). */
 export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -773,12 +811,27 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     type: z.ZodLiteral<"peer.agent-token.revoke">;
     tokenId: z.ZodString;
     senderInstanceId: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"scaler.event">;
+    runId: z.ZodString;
+    jobId: z.ZodString;
+    agentId: z.ZodString;
+    eventType: z.ZodEnum<{
+        "scaler.provisioning": "scaler.provisioning";
+        "scaler.network": "scaler.network";
+        "scaler.ready": "scaler.ready";
+        "scaler.failed": "scaler.failed";
+        "agent.connecting": "agent.connecting";
+    }>;
+    detail: z.ZodString;
+    timestampMs: z.ZodNumber;
 }, z.core.$strip>], "type">;
 export type PeerCapabilities = z.infer<typeof peerCapabilitiesSchema>;
 export type ScalerCapacitySummary = z.infer<typeof scalerCapacitySummarySchema>;
 export type PeerHeartbeat = z.infer<typeof peerHeartbeatSchema>;
 export type JobReroute = z.infer<typeof jobRerouteSchema>;
 export type JobProgress = z.infer<typeof jobProgressSchema>;
+export type PeerScalerEvent = z.infer<typeof peerScalerEventSchema>;
 export type PeerJobCancel = z.infer<typeof peerJobCancelSchema>;
 export type RaftVoteRequest = z.infer<typeof raftVoteRequestSchema>;
 export type RaftVoteResponse = z.infer<typeof raftVoteResponseSchema>;

package/dist/protocol/messages/peer.js

@@ -1,5 +1,6 @@
 import "../../chunk-gOLHoazu.js";
 import { ExecutionJobStatus } from "./execution-status.js";
+import { ScalerEventType } from "./scaler-event.js";
 import { z } from "zod";
 //#region src/protocol/messages/peer.ts
 /** Agent summary included in peer heartbeat and auth response messages. */
@@ -322,6 +323,28 @@ const peerAgentTokenRevokeSchema = z.object({
 	/** Originating peer's instanceId — for log correlation across the cluster. */
 	senderInstanceId: z.string().min(1)
 });
+/**
+* A scaler provisioning event a worker forwards to the owning coordinator.
+*
+* Workers have no database, so they cannot persist a provisioning failure
+* themselves. When a worker's scaler emits an event correlated to a queued
+* job (e.g. a failed agent spawn), the worker relays it to the coordinator
+* that owns the run; the coordinator's ExecutionTracker writes it to the
+* provisioning log and the dispatch queue's last-error column.
+*/
+const peerScalerEventSchema = z.object({
+	type: z.literal("scaler.event"),
+	runId: z.string(),
+	jobId: z.string(),
+	/** The scaler-managed agent id the event is about. */
+	agentId: z.string(),
+	/** Scaler event type (one of the ScalerEventType enum members). */
+	eventType: ScalerEventType,
+	/** Human-readable detail, including any captured spawn stderr tail. */
+	detail: z.string(),
+	/** Event timestamp in epoch milliseconds. */
+	timestampMs: z.number()
+});
 /** All peer-to-peer messages (outbound from this node). */
 const peerToPeerMessageSchema = z.discriminatedUnion("type", [
 	peerHelloSchema,
@@ -342,7 +365,8 @@ const peerToPeerMessageSchema = z.discriminatedUnion("type", [
 	peerConfigReloadSchema,
 	peerConfigReloadResponseSchema,
 	peerLeavingSchema,
-	peerAgentTokenRevokeSchema
+	peerAgentTokenRevokeSchema,
+	peerScalerEventSchema
 ]);
 /** All peer-to-peer messages (inbound to this node). */
 const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
@@ -364,9 +388,10 @@ const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
 	peerConfigReloadSchema,
 	peerConfigReloadResponseSchema,
 	peerLeavingSchema,
-	peerAgentTokenRevokeSchema
+	peerAgentTokenRevokeSchema,
+	peerScalerEventSchema
 ]);
 //#endregion
-export { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema };
+export { jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema };
 
 //# sourceMappingURL=peer.js.map

package/dist/protocol/messages/scaler-event.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+/**
+ * Standardized scaler lifecycle event types emitted by all backends.
+ *
+ * Stored in the event_log table for timeline rendering and relayed
+ * worker→coordinator via the scaler.event peer message. The values are dotted
+ * (e.g. "scaler.failed") because that is the on-wire form the event_log row
+ * name and the dashboard timeline depend on — access members with bracket
+ * notation: `ScalerEventType.enum['scaler.failed']`.
+ */
+export declare const ScalerEventType: z.ZodEnum<{
+    "scaler.provisioning": "scaler.provisioning";
+    "scaler.network": "scaler.network";
+    "scaler.ready": "scaler.ready";
+    "scaler.failed": "scaler.failed";
+    "agent.connecting": "agent.connecting";
+}>;
+export type ScalerEventType = z.infer<typeof ScalerEventType>;
+//# sourceMappingURL=scaler-event.d.ts.map

package/dist/protocol/messages/scaler-event.js

@@ -0,0 +1,23 @@
+import "../../chunk-gOLHoazu.js";
+import { z } from "zod";
+//#region src/protocol/messages/scaler-event.ts
+/**
+* Standardized scaler lifecycle event types emitted by all backends.
+*
+* Stored in the event_log table for timeline rendering and relayed
+* worker→coordinator via the scaler.event peer message. The values are dotted
+* (e.g. "scaler.failed") because that is the on-wire form the event_log row
+* name and the dashboard timeline depend on — access members with bracket
+* notation: `ScalerEventType.enum['scaler.failed']`.
+*/
+const ScalerEventType = z.enum([
+	"scaler.provisioning",
+	"scaler.network",
+	"scaler.ready",
+	"scaler.failed",
+	"agent.connecting"
+]);
+//#endregion
+export { ScalerEventType };
+
+//# sourceMappingURL=scaler-event.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "kici",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.1.9",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.9/3e25cc51-ba69-499f-b8b0-27a923ffc2ea",
+  "name": "@kici-dev/engine@0.1.11",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.1.11/2b46d5de-8b1f-4f79-b887-3b373c19012e",
   "creationInfo": {
-    "created": "2026-05-26T16:49:00Z",
+    "created": "2026-05-27T16:18:17Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.1.9",
+      "versionInfo": "0.1.11",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.9"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.1.11"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",