@kici-dev/engine 0.13.0 → 0.14.1

package/dist/audit/access-log-policy.js

@@ -120,6 +120,10 @@ const POLICY_BY_ACTION = {
 		kind: "rate_limit",
 		perMinutePerActor: 1
 	},
+	"scaler.orphans.read": {
+		kind: "rate_limit",
+		perMinutePerActor: 1
+	},
 	"fleet.read": {
 		kind: "rate_limit",
 		perMinutePerActor: 1
@@ -169,6 +173,8 @@ const POLICY_BY_ACTION = {
 	"trust_directory.updated": { kind: "always" },
 	"cluster_name.update": { kind: "always" },
 	"attestation.retry": { kind: "always" },
+	"scaler.orphan.stop": { kind: "always" },
+	"peer.forget": { kind: "always" },
 	"db.fresh": { kind: "always" },
 	"db.ensure": { kind: "always" },
 	"db.create_role": { kind: "always" },

package/dist/audit/retention-policy.js

@@ -34,6 +34,7 @@ const ACCESS_LOG_WARM_DAYS = {
 	"diagnostics.read": 30,
 	"scaler.capacity.read": 30,
 	"scaler.agents.read": 30,
+	"scaler.orphans.read": 30,
 	"fleet.read": 30,
 	"event_log.detail.read": 180,
 	"event_log.payload.read": 180,
@@ -76,6 +77,8 @@ const ACCESS_LOG_WARM_DAYS = {
 	"trust_directory.updated": 180,
 	"cluster_name.update": 180,
 	"attestation.retry": 180,
+	"scaler.orphan.stop": 180,
+	"peer.forget": 180,
 	"db.fresh": 180,
 	"db.ensure": 180,
 	"db.create_role": 180,
@@ -290,6 +293,7 @@ const ACCESS_LOG_COLD_DAYS = {
 	"diagnostics.read": 30,
 	"scaler.capacity.read": 30,
 	"scaler.agents.read": 30,
+	"scaler.orphans.read": 30,
 	"fleet.read": 30,
 	"event_log.detail.read": 730,
 	"event_log.payload.read": 730,
@@ -332,6 +336,8 @@ const ACCESS_LOG_COLD_DAYS = {
 	"trust_directory.updated": 730,
 	"cluster_name.update": 730,
 	"attestation.retry": 730,
+	"scaler.orphan.stop": 730,
+	"peer.forget": 730,
 	"db.fresh": 730,
 	"db.ensure": 730,
 	"db.create_role": 730,

package/dist/index.js

@@ -49,7 +49,7 @@ import { logPullOrchToPlatformSchema, logPullPlatformToOrchSchema } from "./prot
 import { EVENT_LOG_PAYLOAD_CHUNK_BYTES } from "./protocol/event-log-payload.js";
 import { browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, platformToBrowserMessageSchema } from "./protocol/messages/browser.js";
 import { joinRequestSchema, joinResponseSchema } from "./protocol/messages/join.js";
-import { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
+import { PeerForgetOutcome, ScalerOrphansAction, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerVmStopResultSchema, workerClusterSettingsSchema } from "./protocol/messages/peer.js";
 import { AGENT_API_REQUEST_TIMEOUT_MS, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactRejectReason, ArtifactUploadOutcome, CacheRefScope, JobRejectReason, StepApprovalOutcome, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentLogChunkSchema, agentMetricsSchema, agentRegisterSchema, agentStatusSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, configAckSchema, eventEmitResponseSchema, eventEmitSchema, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetLogsRequestSchema, gitAuthSchema, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, invokeResultSchema, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobDispatchSchema, jobRejectSchema, jobStatusSchema, orchestratorToAgentMessageSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, rateLimitWarningSchema, registerAckSchema, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, upstreamSnapshotSchema } from "./protocol/messages/orchestrator-agent.js";
 import { KNOWN_LINUX_CAPABILITIES, canonicalizeCapability, isKnownCapability } from "./sandbox/capabilities.js";
 import { compileSafeRegex, describeTextMatch, evaluateTextMatch, textMatchHasQuery } from "./trigger/text-match.js";
@@ -96,4 +96,4 @@ import { ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, ArtifactNameSch
 import { PLAN_TYPES, PaidPlanType, PlanType, isPaidTier, planRank } from "./billing/plan-type.js";
 import { SUBSCRIPTION_EXISTS_CODE, StripeSubscriptionStatus, blocksNewCheckout } from "./billing/subscription-status.js";
 import { INFRA_ALERT_TYPES, InfraAlertSeverity, InfraAlertType, normalizeInfraAlertSeverity } from "./diagnostics/infra-alert.js";
-export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_CAPABILITIES, AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentCapabilityFlag, AgentFailureCategory, AgentFeature, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, ForkPolicy, GLOBAL_APPROVAL_MIN_READER, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JobKind, JobRejectReason, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnavailablePathsTrace, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentCapabilitiesSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentFeatureLabel, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, diffRangeKindSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isDeferrableRange, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, isZeroSha, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveDiffRange, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerPlatformSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };
+export { ACCESS_LOG_COLD_DAYS, ACCESS_LOG_WARM_DAYS, ACTOR_AGENT_SUFFIX, AGENT_API_REQUEST_TIMEOUT_MS, AGENT_CAPABILITIES, AGENT_FEATURE_LABELS, AGENT_FEATURE_LABEL_PREFIX, AGENT_REQUIRED_KICI_VARS, ALLOWED_SYSTEM_VARS, ARTIFACT_INVALID_NAME_PREFIX, ARTIFACT_NAME_MAX_LENGTH, AccessLogAction, AccessLogOutcome, AccessLogPolicyKind, AccessLogSource, AccessLogTargetType, ActivityFilterSource, ActivityRowSource, ActorType, AgentCapabilityFlag, AgentFailureCategory, AgentFeature, ApprovalDecision, ArtifactCompleteAckOutcome, ArtifactDownloadOutcome, ArtifactNameSchema, ArtifactRejectReason, ArtifactUploadOutcome, AttestationOrigin, BREAKING_FLOOR, CANONICAL_STATUSES, CAPABILITY_LABEL_PREFIX, CLUSTER_MEMBERSHIP_MAX_WORKERS, CONTAINER_BUILD_RUNTIME_LABEL, CONTEXTS_MAX, CacheOutcome, CacheRefScope, CacheRunEventType, CacheStepType, CheckMode, CheckRunConclusion, CheckStepOutcome, CiTrustLevel, ConcurrencyStrategy, ConfigPathsSchema, ContextDeleteErrorCode, ContextGateRejectReason, ContextType, DASHBOARD_REQUEST_TYPES, DASHBOARD_REQUEST_TYPE_SET, DEAD_ORCH_FAILURE_REASON, DEFAULT_APPROVAL_EXPIRY_HOURS, DEFAULT_APPROVAL_EXPIRY_SECONDS, DEFAULT_CONCURRENCY_STRATEGY, DEFAULT_HOLD_EXPIRY_SECONDS, DEFERRED_PATHS_SUMMARY_SUFFIX, DEVELOPER_OPERATIONS, DashboardResponseErrorCode, DeploymentContainerRuntimeSchema, DeploymentIdentitySchema, DeploymentModeSchema, DispatchInputError, DispatchInputType, EVENT_LOG_PAYLOAD_CHUNK_BYTES, EventLogPayloadStreamError, EventLogSource, EventLogStatus, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, FanoutCause, FanoutError, FleetHostDisposition, ForkPolicy, GLOBAL_APPROVAL_MIN_READER, GLOBAL_EVAL_SKIPS_RESULT_AWARE_LABEL, HEARTBEAT_CLOSE_MS, HEARTBEAT_DEGRADED_MS, HEARTBEAT_FRESH_MS, HEARTBEAT_STALE_THRESHOLD_SECONDS, HEARTBEAT_UNHEALTHY_MARK_MS, HOST_LABEL_PREFIX, HeldRunQueueType, HeldRunStatus, HoldScope, HoldType, HostInventoryEntry, HostPropertyValue, HostTargetSelector, HostTargetValue, ID_TOKEN_CLAIM_NAMES, INFRA_ALERT_TYPES, INIT_LABEL, INIT_RUNNER_ROLE_LABEL, INSTALL_JOB_ID_PREFIX, INTERNAL_EVENT_NAME_PREFIX, InfraAlertSeverity, InfraAlertType, InitFailureCategory, InputDescriptor, InputsDescriptorMapSchema, InventoryHostStatus, InventoryLifecycleClass, InventorySelectorSchema, JOB_IMAGE_RUNTIME_LABEL, JobKind, JobRejectReason, KICI_AGENT_ENV_PREFIX, KICI_EVENT_NAME_PREFIX, KNOWN_LINUX_CAPABILITIES, KNOWN_ROLES, LEGACY_STATUS_ALIASES, LabelMatcher, LockFileParseError, LogStream, MAX_APPROVAL_EXPIRY_HOURS, MAX_APPROVAL_EXPIRY_SECONDS, MAX_FANOUT_JOBS, MAX_JOBS_PER_RUN, MAX_MATRIX_MATERIALIZATION, MIN_APPROVAL_EXPIRY_SECONDS, MIN_PROTOCOL_VERSION, MatrixShapeError, MinimumTrustSchema, NACK_EXEMPT_MESSAGE_TYPES, NeedsEntrySchema, NeedsGroupEntrySchema, NeedsRunOn, NeedsWhen, ORCH_AGENT_CAPABILITIES, ORCH_CAPABILITIES, ORCH_TO_PLATFORM_RECOGNIZED_TYPES, OWN_INGRESS_MODES, OnUnreachableMode, OrchLogPhase, OrchRole, OrchestratorMode, PING_EVENT_TYPE, PLAN_TYPES, PLATFORM_CAPABILITIES, PLATFORM_CONNECTED_MODES, PLATFORM_TAINT_LABELS, PLATFORM_TO_ORCH_RECOGNIZED_TYPES, POLICY_BY_ACTION, PRIVILEGED_ROOT_LABEL, PROTOCOL_VERSION, PULL_REQUEST_FAMILY_TRIGGER_EVENTS, PaidPlanType, PatKind, PayloadOmittedReason, PeerForgetOutcome, PlanType, REDACTED_TRACE_FIELD, REGEX_NEGATIVE_ASSERTION, RELAY_INGRESS_MODES, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RUNTIME_LABEL_PREFIX, RegisterableTriggerType, RunFailureClass, RunsOnPick, RuntimeFact, SANDBOX_DEFAULT_VARS, SANDBOX_NETWORK_MODES, SCALER_EVENT_NAMES, SCHEMA_VERSION, SCOPE_NAME_MAX_LENGTH, SCOPE_SEGMENT_PATTERN, SECONDS_PER_HOUR, SECRET_KEY_MAX_LENGTH, SECRET_KEY_PATTERN, SECURITY_HOLD_JOB_IDS, SECURITY_HOLD_JOB_LABELS, SELF_REPORTED_LABEL_PREFIXES, SSH_TRANSPORT_CAPABILITY, STATE_REPLAY_MAX_RUNS, STATUS_EPOCH_MAX, STATUS_FAILURE_CLASS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, STATUS_PRECEDENCE, SUBSCRIBABLE_WEBHOOK_EVENT_TYPES, SUBSCRIPTION_EXISTS_CODE, ScaleDownReason, ScalerArch, ScalerBackendType, ScalerEventType, ScalerOrphansAction, ScalerOs, ScalerScaleDownPayload, ScalerScaleUpPayload, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, ScopeNameError, SecretKeyError, SetupStepType, SourceOrigin, SourceProvider, SourceSubtype, StatusFailureClass, StepApprovalOutcome, StepConcurrencyKind, StripeSubscriptionStatus, SubscribableWebhookEventType, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TRACE_TEXT_MAX, TRACE_TRUNCATION_WORKFLOW_NAME, TRIGGER_EVENT_META, TRIGGER_EVENT_TYPES, TRIGGER_TYPE_TO_EVENT_TYPES, TRUSTED_ENV_SCRUB_EXACT, TestRelayType, TimeoutReason, TraceCheck, TraceVerdict, TriggerSource, TrustTierSchema, UNRESOLVED_CLAIM, UnavailablePathsTrace, UnsupportedDispatchInputError, VariantKind, WEBHOOK_RELAY_CHUNK_SIZE, WEBHOOK_RELAY_MAX_BODY_BYTES, WORKFLOW_MODIFICATION_JOB_ID, WS_CLOSE_AGENT_AUTH_FAILED, WS_CLOSE_AUTH_TIMEOUT, WS_CLOSE_CLUSTER_NAME_CONFLICT, WS_CLOSE_DISPATCH_ACK_TIMEOUT, WS_CLOSE_GOING_AWAY, WS_CLOSE_HEARTBEAT_TIMEOUT, WS_CLOSE_INTERNAL_ERROR, WS_CLOSE_INVALID_MESSAGE, WS_CLOSE_PLAN_LIMIT, WS_CLOSE_PROTOCOL_ERROR, WS_CLOSE_REBALANCE, WS_CLOSE_SUPERSEDED_BY_RECONNECT, WS_CLOSE_UNAUTHORIZED, WS_MAX_PAYLOAD_BYTES, WebhookEventType, WebhookRelayResult, WsRateLimiter, accessLogFilterSchema, accessLogItemSchema, accessLogWarmSqlCase, ackSchema, activityCursorSchema, activityFilterSchema, activityRowSchema, actorPrincipalSchema, agentApiRequestSchema, agentApiResponseSchema, agentAuthFailureSchema, agentAuthRequestSchema, agentAuthSuccessSchema, agentCapabilitiesSchema, agentDiagnosticsConnectionSchema, agentDiagnosticsSchema, agentFeatureLabel, agentJobResultSchema, agentLabelOf, agentLogChunkSchema, agentMetricsSchema, agentOrchestratorSummarySchema, agentOrgSummarySchema, agentRegisterSchema, agentRunListItemSchema, agentRunResultSchema, agentSecretScopeSchema, agentStatusSchema, agentStepLogsSchema, agentStepResultSchema, agentStepStatusSchema, agentToOrchestratorMessageSchema, agentTypeLabel, agentWorkflowSummarySchema, apiKeyActorSchema, appendChecks, applyIncludeExclude, approvalExpiryHoursOf, approvalExpirySecondsOf, approvalRequirementSchema, approvalTimeoutSecondsSchema, approveRunToolSchema, approverClauseSchema, artifactInvalidNameError, artifactListItemSchema, artifactsDownloadRequestSchema, artifactsDownloadResponseSchema, artifactsUploadCompleteAckSchema, artifactsUploadCompleteSchema, artifactsUploadRequestSchema, artifactsUploadResponseSchema, assertScheduleInputsSatisfiable, assertValidScopeName, assertValidSecretKey, attestationListFiltersSchema, attestationListItemSchema, attestationListSummarySchema, attestationVerifyStatusSchema, auditLogColdDays, auditLogWarmDays, auditLogWarmSqlCase, authFailureSchema, authRequestSchema, authSuccessSchema, backendGetRequestSchema, backendGetResponseSchema, backendItemSchema, backendSyncRequestSchema, backendSyncResponseSchema, backendTestRequestSchema, backendTestResponseSchema, backendsListRequestSchema, backendsListResponseSchema, backendsSyncAllRequestSchema, backendsSyncAllResponseSchema, blocksNewCheckout, browserAuthFailureSchema, browserAuthRefreshSchema, browserAuthRequestSchema, browserAuthSuccessSchema, browserErrorSchema, browserEventLogPayloadChunkSchema, browserEventLogPayloadFetchSchema, browserGapSchema, browserJobContextSchema, browserJobNewSchema, browserJobStatusSchema, browserLogLinesSchema, browserLogStreamTerminatedReason, browserLogStreamTerminatedSchema, browserLogSubscribeSchema, browserLogUnsubscribeSchema, browserOrchLogLinesSchema, browserOrchLogSubscribeSchema, browserOrchLogUnsubscribeSchema, browserPingSchema, browserPongSchema, browserRunEventSchema, browserRunNewSchema, browserRunStatusSchema, browserStatusSubscribeSchema, browserStatusUnsubscribeSchema, browserStepStatusSchema, browserToPlatformMessageSchema, buildEventClaims, buildIdTokenSubject, buildTrustedPassthroughEnv, buildUnsupportedMessageNack, buildZodFromDescriptor, buildZodObjectFromMap, cacheStatsSchema, cacheUserRestoreRequestSchema, cacheUserRestoreResponseSchema, cacheUserSaveCompleteSchema, cacheUserSaveRequestSchema, cacheUserSaveResponseSchema, cancelRunToolSchema, cancelRunsByBranchToolSchema, canonicalizeCapability, canonicalizeLabel, canonicalizeLabelSet, canonicalizeLabels, canonicalizeMatcher, capabilityLabel, changedFilesStatusSchema, checkArtifactName, clusterMembershipSchema, coerceDispatchInputs, coerceHostPropertyValue, collectDiscriminatorTypes, compileRegexMatcher, compileSafeRegex, configAckSchema, connectionHealthStatusSchema, contextBindingEntrySchema, contextBindingsListRequestSchema, contextBindingsSetRequestSchema, contextCreateRequestSchema, contextDeleteRequestSchema, contextGetRequestSchema, contextHistoryRequestSchema, contextHistoryResponseSchema, contextListRequestSchema, contextSecretDeleteRequestSchema, contextSecretScopeCreateRequestSchema, contextSecretScopeDeleteRequestSchema, contextSecretScopeRenameRequestSchema, contextSecretSetRequestSchema, contextSecretsListRequestSchema, contextSourceOverrideDeleteRequestSchema, contextSourceOverrideSetRequestSchema, contextSourceOverridesListRequestSchema, contextTestAccessSetRequestSchema, contextUpdateRequestSchema, contextVarDeleteRequestSchema, contextVarSetRequestSchema, contextVarsListRequestSchema, createCommitMessageTraceEntry, createContentRequirementsTraceEntry, createDispatchFailureTraceEntry, createGlobalFilterTraceEntry, createTraceEntry, createTraceTruncationMarker, createWorkflowBundleConfig, createWorkflowDecision, dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema, dashboardAdminTokenSummarySchema, dashboardAdminTokensListRequestSchema, dashboardAdminTokensListResponseSchema, dashboardArtifactsListRequestSchema, dashboardArtifactsListResponseSchema, dashboardAttestationGetRequestSchema, dashboardAttestationGetResponseSchema, dashboardAttestationRetryRequestSchema, dashboardAttestationRetryResponseSchema, dashboardAttestationsApiResponseSchema, dashboardAttestationsListAllRequestSchema, dashboardAttestationsListAllResponseSchema, dashboardAttestationsListRequestSchema, dashboardAttestationsListResponseSchema, dashboardDiagnosticsRequestSchema, dashboardDiagnosticsResponseSchema, dashboardEventDlqCountRequestSchema, dashboardEventDlqDiscardRequestSchema, dashboardEventDlqListItemSchema, dashboardEventDlqListRequestSchema, dashboardEventDlqRetryRequestSchema, dashboardEventLogActivityRequestSchema, dashboardEventLogActivityResponseSchema, dashboardEventLogDetailRequestSchema, dashboardEventLogListRequestSchema, dashboardEventLogPayloadChunkSchema, dashboardEventLogPayloadStreamRequestSchema, dashboardFleetHostRequestSchema, dashboardFleetHostResponseSchema, dashboardFleetHostsRequestSchema, dashboardFleetHostsResponseSchema, dashboardFleetPreviewRequestSchema, dashboardFleetPreviewResponseSchema, dashboardFleetWorkflowsForHostRequestSchema, dashboardFleetWorkflowsForHostResponseSchema, dashboardJobDetailSchema, dashboardOrchLogsRequestSchema, dashboardOrchLogsResponseSchema, dashboardOrchToPlatformSchema, dashboardPayloadRequestSchema, dashboardPlatformToOrchSchema, dashboardRunDetailApiResponseSchema, dashboardRunDetailRequestSchema, dashboardRunDetailResponseSchema, dashboardRunStateRequestSchema, dashboardRunStateResponseSchema, dashboardRunStructuredRequestSchema, dashboardRunStructuredResponseSchema, dashboardRunSummarySchema, dashboardRunsFiltersRequestSchema, dashboardRunsFiltersResponseSchema, dashboardRunsListRequestSchema, dashboardRunsListResponseSchema, dashboardScalerAgentsRequestSchema, dashboardScalerAgentsResponseSchema, dashboardScalerCapacityRequestSchema, dashboardScalerCapacityResponseSchema, dashboardSourceSummarySchema, dashboardSourcesListRequestSchema, dashboardSourcesListResponseSchema, dashboardStepLogsApiResponseSchema, dashboardStepLogsRequestSchema, dashboardStepLogsResponseSchema, decodeActivityCursor, deriveOsArchLabels, derivePlatformTaints, describeTextMatch, developerOpsForEntrypoint, diagnosticsInfraAlertSchema, diagnosticsInfrastructureResponseSchema, diagnosticsSummaryResponseSchema, diffRangeKindSchema, encodeActivityCursor, errorSchema, evaluateTextMatch, eventEmitResponseSchema, eventEmitSchema, eventLogActivityCountsSchema, eventLogListItemSchema, executionEventSchema, executionStatusSchema, expandMatrix, expandMultiDimension, expandSingleDimension, extractInputDescriptor, extractInputsDescriptorMap, fanoutEnvelopeFields, findDuplicateCombination, flattenActor, fleetBundleChunkSchema, fleetBundleErrorSchema, fleetHostDeclareRequestSchema, fleetHostDeclareResponseSchema, fleetHostRemoveRequestSchema, fleetHostRemoveResponseSchema, fleetHostWorkflowSchema, fleetLogsRequestSchema, fleetPinnedRunSchema, fleetPreviewHostSchema, fleetSelectionSchema, fnv1a32, formatExpandedJobName, formatMatrixSuffix, getAccessLogColdDays, getAccessLogWarmDays, getAuditLogColdDays, getAuditLogWarmDays, getDiagnosticsToolSchema, getRepoGlobMatcher, getRunToolSchema, getSecretAuditLogColdDays, getSecretAuditLogWarmDays, getStepLogsToolSchema, gitAuthSchema, githubIngressPath, githubWebhookPath, globalEvalCandidateResultSchema, globalEvalRoundResultSchema, hasAgentCapability, hasOrchAgentCapability, hasOrchCapability, hasPlatformCapability, heartbeatSchema, heldRunApproveRequestSchema, heldRunRejectRequestSchema, heldRunsListRequestSchema, hostEnvelopeFields, hostLabel, hostSatisfiesTarget, hostToScalerPlatform, identityLinkItemSchema, identityLinkListResponseSchema, initFailureSchema, installGateJobId, invokeResultSchema, isDeferrableRange, isFailureStatus, isInputSatisfiableFromDefaults, isKnownCapability, isLockDynamicJobFn, isLockParallelStep, isLockStaticJob, isMintedRef, isNegatedPattern, isPaidTier, isPullRequestFamilyTriggerEvent, isSecurityHoldJobId, isSelfReportedLabel, isSetupStepType, isTrustedEnvScrubbed, isZeroSha, jobAckSchema, jobCancelSchema, jobConcurrencyAckSchema, jobConcurrencyReportSchema, jobContextMessageSchema, jobDispatchSchema, jobProgressAckSchema, jobProgressSchema, jobRejectSchema, jobRerouteAckSchema, jobRerouteSchema, jobStatusForwardSchema, jobStatusSchema, joinRequestSchema, joinResponseSchema, listOrchestratorsToolSchema, listOrgsToolSchema, listRunsToolSchema, listSecretsToolSchema, listWorkflowsToolSchema, logChunkSchema, logPullOrchToPlatformSchema, logPullPlatformToOrchSchema, manualScheduleRequestSchema, matchAllWorkflows, matchBranchPattern, matchPathPatterns, matchRepoPatterns, matchScopePattern, matchTrigger, matchWorkflowTriggers, matchWorkflowsForEvent, matcherMatches, matcherSatisfiedBy, materializeFanout, materializeResolvedHosts, materializeResolvedMatrix, matrixCombinationCount, matrixEnvelopeFields, memberIdentityLinkSchema, memberListResponseSchema, memberRoleAssignmentSchema, mergeAutoLabels, mergeOrderedMaps, minAccessLogWarmDays, minAuditLogWarmDays, minSecretAuditLogWarmDays, nackSchema, negatedPatternReason, nodeArchToScalerArch, nodePlatformToScalerOs, normalizeInfraAlertSeverity, normalizeMatrixInput, normalizePersistedHoldType, normalizeRegexFlags, normalizeRunsOn, orchAgentCapabilitiesSchema, orchCapabilitiesSchema, orchLogChunkSchema, orchMetricsSchema, orchestratorToAgentMessageSchema, orchestratorToPlatformMessageSchema, orgMemberSchema, parseActor, parseHostLabel, parseHostPropertyAssignments, parseInputPairs, parseMemoryString, partitionMatchers, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerDiscoverSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, peerUpdateSchema, persistedHoldTypeSpellings, planHeadroomSchema, planRank, platformCapabilitiesMessageSchema, platformCapabilitiesSchema, platformOperatorActorSchema, platformToBrowserMessageSchema, platformToOrchestratorMessageSchema, platformToOsArchLabels, platformToTaints, prepareEventBuckets, provenanceContextSchema, provenanceUploadCompleteSchema, provenanceUploadDeferSchema, provenanceUploadRequestSchema, provenanceUploadResponseSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rateLimitWarningSchema, registerAckSchema, registrationDeleteRequestSchema, registrationDisableRequestSchema, registrationItemSchema, registrationsListRequestSchema, registrationsListResponseSchema, rejectRunToolSchema, renderFenced, rerouteSpawnRetrySchema, rerunRunToolSchema, reservedEventNamePrefix, resolveContentFormat, resolveDiffRange, resolveHeldRunId, resolveRoleLabels, resolveRunIdSugar, resolveScheduleInputs, resolveSecretsForContext, resolveSecretsWithProvenance, resolveWhenToRunOn, resourceRequestNestedSchema, resourceSpecSchema, runCancelRequestSchema, runEventMessageSchema, runEventSchema, runLineageResponseSchema, runListItemSchema, runListResponseSchema, runRerunRequestSchema, runtimeLabel, scalerAgentLabels, scalerClaimCredentialsResponseSchema, scalerClaimCredentialsSchema, scalerLabel, scalerLiveVmSchema, scalerPlatformSchema, scalerVmStopResultSchema, scheduleTriggerKey, secretAuditLogColdDays, secretAuditLogWarmDays, secretAuditLogWarmSqlCase, serviceAccountActorSchema, shouldRecordAccess, shouldRecordSecretResolve, sourceDeregisterAckSchema, sourceDeregisterSchema, sourceRegistrationAckSchema, sourceRegistrationSchema, staleCheckrunCleanupSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepApprovalPayloadSchema, stepApprovalRequestSchema, stepApprovalResolvedSchema, stepStatusForwardSchema, stringifyActor, stripScopePrefix, stripStatefulRegexFlags, systemActorSchema, testRelayCancelRequestSchema, testRelayCancelResponseSchema, testRelayRunLogsRequestSchema, testRelayRunLogsResponseSchema, testRelayRunStatusRequestSchema, testRelayRunStatusResponseSchema, testRelayTriggerRequestSchema, testRelayTriggerResponseSchema, testRelayUploadsInitRequestSchema, testRelayUploadsInitResponseSchema, textMatchHasQuery, toCanonicalStatus, triggerRunToolSchema, truncateDecisionsToByteBudget, truncateTraceText, trustPolicyResponseSchema, trustPolicySchema, trustPolicyUpdateSchema, trustedContributorHoldReason, untrusted, upstreamSnapshotSchema, userActorSchema, utf8ByteLength, validateNoReservedLabels, validateResourceRequest, validateScopeName, validateSecretKey, webhookAckSchema, webhookRelayChunkSchema, webhookRelaySchema, webhookRelayStartSchema, workerClusterSettingsSchema, worstStatus, wrapUntrusted };

package/dist/metrics/catalog-policy.js

@@ -212,6 +212,16 @@ const METRIC_LABEL_POLICY = {
 		event_name: { maxUniqueValues: 50 },
 		reason: { values: ["exhausted_retries"] }
 	},
+	kici_orch_event_unmatched_total: {
+		event_name: { maxUniqueValues: 50 },
+		reason: { values: [
+			"buffered",
+			"no-registration",
+			"no-target-repo",
+			"trust-blocked",
+			"no-trigger-match"
+		] }
+	},
 	kici_orch_event_attempts: {
 		event_name: { maxUniqueValues: 50 },
 		result: { values: ["success", "dlq"] }

package/dist/metrics/metric-catalog.generated.d.ts

@@ -52,6 +52,7 @@ export declare const MetricNames: {
     readonly KICI_ORCH_EVENT_DLQ_TOTAL: 'kici_orch_event_dlq_total';
     readonly KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: 'kici_orch_event_lease_expirations_total';
     readonly KICI_ORCH_EVENT_RETRY_TOTAL: 'kici_orch_event_retry_total';
+    readonly KICI_ORCH_EVENT_UNMATCHED_TOTAL: 'kici_orch_event_unmatched_total';
     readonly KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: 'kici_orch_excess_connections_closed_total';
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'kici_orch_execution_duration_seconds';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'kici_orch_executions_total';
@@ -301,6 +302,7 @@ export declare const MetricLabels: {
     readonly KICI_ORCH_EVENT_DLQ_TOTAL: readonly ['event_name', 'reason'];
     readonly KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: readonly [];
     readonly KICI_ORCH_EVENT_RETRY_TOTAL: readonly ['event_name'];
+    readonly KICI_ORCH_EVENT_UNMATCHED_TOTAL: readonly ['event_name', 'reason'];
     readonly KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: readonly ['org_id'];
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: readonly [];
     readonly KICI_ORCH_EXECUTIONS_TOTAL: readonly ['status'];
@@ -549,6 +551,7 @@ export declare const MetricKind: {
     readonly KICI_ORCH_EVENT_DLQ_TOTAL: 'counter';
     readonly KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: 'counter';
     readonly KICI_ORCH_EVENT_RETRY_TOTAL: 'counter';
+    readonly KICI_ORCH_EVENT_UNMATCHED_TOTAL: 'counter';
     readonly KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: 'counter';
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'histogram';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'counter';
@@ -797,6 +800,7 @@ export declare const MetricDescription: {
     readonly KICI_ORCH_EVENT_DLQ_TOTAL: 'Internal events moved to the DLQ after exhausting retries';
     readonly KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: 'Dispatch leases that timed out before the holding node finalised them (signals node crash mid-dispatch)';
     readonly KICI_ORCH_EVENT_RETRY_TOTAL: 'Internal-event dispatch failures that triggered a retry (lease released, next_retry_at scheduled)';
+    readonly KICI_ORCH_EVENT_UNMATCHED_TOTAL: 'Reserved kici.-prefixed internal events that matched no subscribing workflow';
     readonly KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: 'Total orchestrator connections closed for exceeding the org orchestrator cap';
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'Duration of execution runs in seconds';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'Total number of execution runs';
@@ -1052,6 +1056,7 @@ export declare const MetricService: {
     readonly KICI_ORCH_EVENT_DLQ_TOTAL: 'orchestrator';
     readonly KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: 'orchestrator';
     readonly KICI_ORCH_EVENT_RETRY_TOTAL: 'orchestrator';
+    readonly KICI_ORCH_EVENT_UNMATCHED_TOTAL: 'orchestrator';
     readonly KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: 'platform';
     readonly KICI_ORCH_EXECUTION_DURATION_SECONDS: 'orchestrator';
     readonly KICI_ORCH_EXECUTIONS_TOTAL: 'orchestrator';

package/dist/metrics/metric-catalog.generated.js

@@ -54,6 +54,7 @@ const MetricNames = {
 	KICI_ORCH_EVENT_DLQ_TOTAL: "kici_orch_event_dlq_total",
 	KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: "kici_orch_event_lease_expirations_total",
 	KICI_ORCH_EVENT_RETRY_TOTAL: "kici_orch_event_retry_total",
+	KICI_ORCH_EVENT_UNMATCHED_TOTAL: "kici_orch_event_unmatched_total",
 	KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: "kici_orch_excess_connections_closed_total",
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "kici_orch_execution_duration_seconds",
 	KICI_ORCH_EXECUTIONS_TOTAL: "kici_orch_executions_total",
@@ -302,6 +303,7 @@ const MetricLabels = {
 	KICI_ORCH_EVENT_DLQ_TOTAL: ["event_name", "reason"],
 	KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: [],
 	KICI_ORCH_EVENT_RETRY_TOTAL: ["event_name"],
+	KICI_ORCH_EVENT_UNMATCHED_TOTAL: ["event_name", "reason"],
 	KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: ["org_id"],
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: [],
 	KICI_ORCH_EXECUTIONS_TOTAL: ["status"],
@@ -566,6 +568,7 @@ const MetricKind = {
 	KICI_ORCH_EVENT_DLQ_TOTAL: "counter",
 	KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: "counter",
 	KICI_ORCH_EVENT_RETRY_TOTAL: "counter",
+	KICI_ORCH_EVENT_UNMATCHED_TOTAL: "counter",
 	KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: "counter",
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "histogram",
 	KICI_ORCH_EXECUTIONS_TOTAL: "counter",
@@ -814,6 +817,7 @@ const MetricDescription = {
 	KICI_ORCH_EVENT_DLQ_TOTAL: "Internal events moved to the DLQ after exhausting retries",
 	KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: "Dispatch leases that timed out before the holding node finalised them (signals node crash mid-dispatch)",
 	KICI_ORCH_EVENT_RETRY_TOTAL: "Internal-event dispatch failures that triggered a retry (lease released, next_retry_at scheduled)",
+	KICI_ORCH_EVENT_UNMATCHED_TOTAL: "Reserved kici.-prefixed internal events that matched no subscribing workflow",
 	KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: "Total orchestrator connections closed for exceeding the org orchestrator cap",
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "Duration of execution runs in seconds",
 	KICI_ORCH_EXECUTIONS_TOTAL: "Total number of execution runs",
@@ -1069,6 +1073,7 @@ const MetricService = {
 	KICI_ORCH_EVENT_DLQ_TOTAL: "orchestrator",
 	KICI_ORCH_EVENT_LEASE_EXPIRATIONS_TOTAL: "orchestrator",
 	KICI_ORCH_EVENT_RETRY_TOTAL: "orchestrator",
+	KICI_ORCH_EVENT_UNMATCHED_TOTAL: "orchestrator",
 	KICI_ORCH_EXCESS_CONNECTIONS_CLOSED_TOTAL: "platform",
 	KICI_ORCH_EXECUTION_DURATION_SECONDS: "orchestrator",
 	KICI_ORCH_EXECUTIONS_TOTAL: "orchestrator",
@@ -1318,6 +1323,7 @@ const ALL_METRIC_NAMES = [
 	"kici_orch_event_dlq_total",
 	"kici_orch_event_lease_expirations_total",
 	"kici_orch_event_retry_total",
+	"kici_orch_event_unmatched_total",
 	"kici_orch_excess_connections_closed_total",
 	"kici_orch_execution_duration_seconds",
 	"kici_orch_executions_total",

package/dist/protocol/messages/access-log.d.ts

@@ -106,6 +106,7 @@ export declare const AccessLogAction: z.ZodEnum<{
     "held_run.request": "held_run.request";
     "job.cancel": "job.cancel";
     "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+    "peer.forget": "peer.forget";
     purge_chunk: "purge_chunk";
     "registration.delete": "registration.delete";
     "registration.disable": "registration.disable";
@@ -122,6 +123,8 @@ export declare const AccessLogAction: z.ZodEnum<{
     "runs.list.read": "runs.list.read";
     "scaler.agents.read": "scaler.agents.read";
     "scaler.capacity.read": "scaler.capacity.read";
+    "scaler.orphan.stop": "scaler.orphan.stop";
+    "scaler.orphans.read": "scaler.orphans.read";
     "secret.delete": "secret.delete";
     "secret.list.read": "secret.list.read";
     "secret.reveal": "secret.reveal";
@@ -212,6 +215,7 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "held_run.request": "held_run.request";
         "job.cancel": "job.cancel";
         "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+        "peer.forget": "peer.forget";
         purge_chunk: "purge_chunk";
         "registration.delete": "registration.delete";
         "registration.disable": "registration.disable";
@@ -228,6 +232,8 @@ export declare const accessLogItemSchema: z.ZodObject<{
         "runs.list.read": "runs.list.read";
         "scaler.agents.read": "scaler.agents.read";
         "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.orphan.stop": "scaler.orphan.stop";
+        "scaler.orphans.read": "scaler.orphans.read";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -345,6 +351,7 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "held_run.request": "held_run.request";
         "job.cancel": "job.cancel";
         "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+        "peer.forget": "peer.forget";
         purge_chunk: "purge_chunk";
         "registration.delete": "registration.delete";
         "registration.disable": "registration.disable";
@@ -361,6 +368,8 @@ export declare const accessLogFilterSchema: z.ZodObject<{
         "runs.list.read": "runs.list.read";
         "scaler.agents.read": "scaler.agents.read";
         "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.orphan.stop": "scaler.orphan.stop";
+        "scaler.orphans.read": "scaler.orphans.read";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -508,6 +517,7 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "held_run.request": "held_run.request";
         "job.cancel": "job.cancel";
         "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+        "peer.forget": "peer.forget";
         purge_chunk: "purge_chunk";
         "registration.delete": "registration.delete";
         "registration.disable": "registration.disable";
@@ -524,6 +534,8 @@ export declare const dashboardAccessLogListRequestSchema: z.ZodObject<{
         "runs.list.read": "runs.list.read";
         "scaler.agents.read": "scaler.agents.read";
         "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.orphan.stop": "scaler.orphan.stop";
+        "scaler.orphans.read": "scaler.orphans.read";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -652,6 +664,7 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "held_run.request": "held_run.request";
             "job.cancel": "job.cancel";
             "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+            "peer.forget": "peer.forget";
             purge_chunk: "purge_chunk";
             "registration.delete": "registration.delete";
             "registration.disable": "registration.disable";
@@ -668,6 +681,8 @@ export declare const dashboardAccessLogListResponseSchema: z.ZodObject<{
             "runs.list.read": "runs.list.read";
             "scaler.agents.read": "scaler.agents.read";
             "scaler.capacity.read": "scaler.capacity.read";
+            "scaler.orphan.stop": "scaler.orphan.stop";
+            "scaler.orphans.read": "scaler.orphans.read";
             "secret.delete": "secret.delete";
             "secret.list.read": "secret.list.read";
             "secret.reveal": "secret.reveal";

package/dist/protocol/messages/access-log.js

@@ -107,6 +107,7 @@ const AccessLogAction = z.enum([
 	"diagnostics.read",
 	"scaler.capacity.read",
 	"scaler.agents.read",
+	"scaler.orphans.read",
 	"fleet.read",
 	"fleet.host.declare",
 	"fleet.host.remove",
@@ -124,6 +125,8 @@ const AccessLogAction = z.enum([
 	"trust_directory.updated",
 	"cluster_name.update",
 	"attestation.retry",
+	"scaler.orphan.stop",
+	"peer.forget",
 	"access_log.list.read",
 	"event_dlq.list.read",
 	"event_dlq.retry",

package/dist/protocol/messages/dashboard.d.ts

@@ -6851,6 +6851,7 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "held_run.request": "held_run.request";
         "job.cancel": "job.cancel";
         "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+        "peer.forget": "peer.forget";
         purge_chunk: "purge_chunk";
         "registration.delete": "registration.delete";
         "registration.disable": "registration.disable";
@@ -6867,6 +6868,8 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         "runs.list.read": "runs.list.read";
         "scaler.agents.read": "scaler.agents.read";
         "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.orphan.stop": "scaler.orphan.stop";
+        "scaler.orphans.read": "scaler.orphans.read";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -8592,6 +8595,7 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "held_run.request": "held_run.request";
             "job.cancel": "job.cancel";
             "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+            "peer.forget": "peer.forget";
             purge_chunk: "purge_chunk";
             "registration.delete": "registration.delete";
             "registration.disable": "registration.disable";
@@ -8608,6 +8612,8 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             "runs.list.read": "runs.list.read";
             "scaler.agents.read": "scaler.agents.read";
             "scaler.capacity.read": "scaler.capacity.read";
+            "scaler.orphan.stop": "scaler.orphan.stop";
+            "scaler.orphans.read": "scaler.orphans.read";
             "secret.delete": "secret.delete";
             "secret.list.read": "secret.list.read";
             "secret.reveal": "secret.reveal";

package/dist/protocol/messages/peer.d.ts

@@ -131,6 +131,15 @@ export declare const peerHeartbeatSchema: z.ZodObject<{
     runningAsUid: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
     version: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * The spawn-retry budget a worker applies to one rerouted job: how many agent
+ * spawns it attempts, and how long it waits after a failed one. The sending
+ * coordinator resolves it per org and enforces the same budget on its side.
+ */
+export declare const rerouteSpawnRetrySchema: z.ZodObject<{
+    maxAttempts: z.ZodNumber;
+    backoffMs: z.ZodNumber;
+}, z.core.$strip>;
 /** Request to reroute a job to another orchestrator (no local agent can handle it). */
 export declare const jobRerouteSchema: z.ZodObject<{
     type: z.ZodLiteral<"job.reroute">;
@@ -164,6 +173,10 @@ export declare const jobRerouteSchema: z.ZodObject<{
     }, z.core.$strip>], "kind">>>;
     triedConnections: z.ZodArray<z.ZodString>;
     maxHops: z.ZodNumber;
+    spawnRetry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodNumber;
+        backoffMs: z.ZodNumber;
+    }, z.core.$strip>>;
     coordinatorId: z.ZodString;
     requestId: z.ZodOptional<z.ZodString>;
     traceId: z.ZodOptional<z.ZodString>;
@@ -351,8 +364,177 @@ export declare const peerConfigReloadResponseSchema: z.ZodObject<{
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
+/** How a live Firecracker VM relates to the orchestrator on its host. */
+export declare const ScalerVmStatus: z.ZodEnum<{
+    orphaned: "orphaned";
+    tracked: "tracked";
+    unverified: "unverified";
+}>;
+export type ScalerVmStatus = z.infer<typeof ScalerVmStatus>;
+/** What tracks a live VM. `bound-job` is answered from a coordinator's dispatch queue. */
+export declare const ScalerVmTracker: z.ZodEnum<{
+    backend: "backend";
+    "bound-job": "bound-job";
+    registered: "registered";
+    spawning: "spawning";
+}>;
+export type ScalerVmTracker = z.infer<typeof ScalerVmTracker>;
+/** What a stop did to one VM. Only `stopped` signalled anything. */
+export declare const ScalerVmStopOutcome: z.ZodEnum<{
+    error: "error";
+    "not-found": "not-found";
+    "not-live": "not-live";
+    stopped: "stopped";
+    tracked: "tracked";
+    unverified: "unverified";
+}>;
+export type ScalerVmStopOutcome = z.infer<typeof ScalerVmStopOutcome>;
+/** What a scaler orphan request asks the target node to do. */
+export declare const ScalerOrphansAction: z.ZodEnum<{
+    list: "list";
+    stop: "stop";
+}>;
+export type ScalerOrphansAction = z.infer<typeof ScalerOrphansAction>;
+/** One live Firecracker VM on a node, as its orchestrator sees it. */
+export declare const scalerLiveVmSchema: z.ZodObject<{
+    vmId: z.ZodString;
+    scaler: z.ZodString;
+    pid: z.ZodNumber;
+    startedAt: z.ZodString;
+    ageSeconds: z.ZodNumber;
+    chrootDir: z.ZodString;
+    status: z.ZodEnum<{
+        orphaned: "orphaned";
+        tracked: "tracked";
+        unverified: "unverified";
+    }>;
+    trackedBy: z.ZodArray<z.ZodEnum<{
+        backend: "backend";
+        "bound-job": "bound-job";
+        registered: "registered";
+        spawning: "spawning";
+    }>>;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type ScalerLiveVm = z.infer<typeof scalerLiveVmSchema>;
+/** The result of stopping one VM. `pid` is the process that was (or would be) signalled. */
+export declare const scalerVmStopResultSchema: z.ZodObject<{
+    vmId: z.ZodString;
+    outcome: z.ZodEnum<{
+        error: "error";
+        "not-found": "not-found";
+        "not-live": "not-live";
+        stopped: "stopped";
+        tracked: "tracked";
+        unverified: "unverified";
+    }>;
+    pid: z.ZodOptional<z.ZodNumber>;
+    detail: z.ZodString;
+}, z.core.$strip>;
+export type ScalerVmStopResult = z.infer<typeof scalerVmStopResultSchema>;
+/**
+ * Scaler orphan request: forwarded by a coordinator to the node an operator
+ * targeted with `kici-admin scaler orphans --target`. The node answers from
+ * its own host and its own tracking with peer.scaler.orphans.response.
+ */
+export declare const peerScalerOrphansRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.scaler.orphans.request">;
+    messageId: z.ZodString;
+    action: z.ZodEnum<{
+        list: "list";
+        stop: "stop";
+    }>;
+    vmIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * Scaler orphan response. `vms` answers a `list`, `results` answers a `stop`;
+ * `ok: false` carries the node's `error` instead.
+ */
+export declare const peerScalerOrphansResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.scaler.orphans.response">;
+    messageId: z.ZodString;
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    firecrackerScalers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    vms: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        vmId: z.ZodString;
+        scaler: z.ZodString;
+        pid: z.ZodNumber;
+        startedAt: z.ZodString;
+        ageSeconds: z.ZodNumber;
+        chrootDir: z.ZodString;
+        status: z.ZodEnum<{
+            orphaned: "orphaned";
+            tracked: "tracked";
+            unverified: "unverified";
+        }>;
+        trackedBy: z.ZodArray<z.ZodEnum<{
+            backend: "backend";
+            "bound-job": "bound-job";
+            registered: "registered";
+            spawning: "spawning";
+        }>>;
+        reason: z.ZodString;
+    }, z.core.$strip>>>;
+    results: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        vmId: z.ZodString;
+        outcome: z.ZodEnum<{
+            error: "error";
+            "not-found": "not-found";
+            "not-live": "not-live";
+            stopped: "stopped";
+            tracked: "tracked";
+            unverified: "unverified";
+        }>;
+        pid: z.ZodOptional<z.ZodNumber>;
+        detail: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * What forgetting a departed peer did on one coordinator. `recent`: the peer
+ * was heard from inside the window this coordinator still treats it as alive
+ * for (the longer of the stale window and the reroute flap grace, or the
+ * backstop grace of a peer that adopted provisions), so it may be partitioned
+ * rather than gone. `acknowledgement-required`: forgetting it would switch this
+ * coordinator's event-provision backstop back on, and the request did not
+ * acknowledge that. Every outcome but `forgotten` keeps the peer.
+ */
+export declare const PeerForgetOutcome: z.ZodEnum<{
+    "acknowledgement-required": "acknowledgement-required";
+    connected: "connected";
+    error: "error";
+    forgotten: "forgotten";
+    "not-found": "not-found";
+    recent: "recent";
+}>;
+export type PeerForgetOutcome = z.infer<typeof PeerForgetOutcome>;
+/**
+ * Forget request: a coordinator that forgot a departed peer (`kici-admin peer
+ * forget`) asks each connected sibling coordinator to drop it from its own
+ * live peer registry too.
+ */
+export declare const peerForgetRequestSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.forget.request">;
+    messageId: z.ZodString;
+    instanceId: z.ZodString;
+    acknowledgeBackstop: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/** Forget response: what the sibling did with the request. */
+export declare const peerForgetResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"peer.forget.response">;
+    messageId: z.ZodString;
+    outcome: z.ZodEnum<{
+        "acknowledgement-required": "acknowledgement-required";
+        connected: "connected";
+        error: "error";
+        forgotten: "forgotten";
+        "not-found": "not-found";
+        recent: "recent";
+    }>;
+    detail: z.ZodString;
+}, z.core.$strip>;
 /**
- * Worker-relevant cluster settings a DB-less worker pulls from the leader.
+ * Worker-relevant cluster settings a DB-less worker pulls from a coordinator.
  *
  * A typed, concrete snapshot (not an open key/value bus): each worker-consumed
  * cluster knob is a field here. Adding the next worker-relevant knob is one
@@ -360,11 +542,12 @@ export declare const peerConfigReloadResponseSchema: z.ZodObject<{
  */
 export declare const workerClusterSettingsSchema: z.ZodObject<{
     agentTokenTtlMs: z.ZodNumber;
+    firecrackerApiSocketWaitMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 /**
- * Cluster-settings pull request: a DB-less worker asks the leader for the
- * current worker-settings snapshot after observing the leader's advertised
- * clusterSettingsVersion ahead of its own. The leader replies with
+ * Cluster-settings pull request: a DB-less worker asks a connected coordinator
+ * for the current worker-settings snapshot after a coordinator advertised a
+ * clusterSettingsVersion ahead of its own. The coordinator replies with
  * peer.clusterSettings.response.
  */
 export declare const peerClusterSettingsRequestSchema: z.ZodObject<{
@@ -372,7 +555,7 @@ export declare const peerClusterSettingsRequestSchema: z.ZodObject<{
     messageId: z.ZodString;
 }, z.core.$strip>;
 /**
- * Cluster-settings pull response: the leader resolves the snapshot from
+ * Cluster-settings pull response: the coordinator resolves the snapshot from
  * cluster_settings and replies with it plus the current version.
  */
 export declare const peerClusterSettingsResponseSchema: z.ZodObject<{
@@ -381,6 +564,7 @@ export declare const peerClusterSettingsResponseSchema: z.ZodObject<{
     version: z.ZodNumber;
     settings: z.ZodObject<{
         agentTokenTtlMs: z.ZodNumber;
+        firecrackerApiSocketWaitMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 /** Which of THIS peer's downstream nodes to gather. all=true ignores the id lists. */
@@ -455,6 +639,7 @@ export declare const peerScalerEventSchema: z.ZodObject<{
     }>;
     detail: z.ZodString;
     timestampMs: z.ZodNumber;
+    final: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 /** All peer-to-peer messages (outbound from this node). */
 export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -588,6 +773,10 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     }, z.core.$strip>], "kind">>>;
     triedConnections: z.ZodArray<z.ZodString>;
     maxHops: z.ZodNumber;
+    spawnRetry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodNumber;
+        backoffMs: z.ZodNumber;
+    }, z.core.$strip>>;
     coordinatorId: z.ZodString;
     requestId: z.ZodOptional<z.ZodString>;
     traceId: z.ZodOptional<z.ZodString>;
@@ -718,6 +907,70 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     errors: z.ZodOptional<z.ZodArray<z.ZodString>>;
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.scaler.orphans.request">;
+    messageId: z.ZodString;
+    action: z.ZodEnum<{
+        list: "list";
+        stop: "stop";
+    }>;
+    vmIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.scaler.orphans.response">;
+    messageId: z.ZodString;
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    firecrackerScalers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    vms: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        vmId: z.ZodString;
+        scaler: z.ZodString;
+        pid: z.ZodNumber;
+        startedAt: z.ZodString;
+        ageSeconds: z.ZodNumber;
+        chrootDir: z.ZodString;
+        status: z.ZodEnum<{
+            orphaned: "orphaned";
+            tracked: "tracked";
+            unverified: "unverified";
+        }>;
+        trackedBy: z.ZodArray<z.ZodEnum<{
+            backend: "backend";
+            "bound-job": "bound-job";
+            registered: "registered";
+            spawning: "spawning";
+        }>>;
+        reason: z.ZodString;
+    }, z.core.$strip>>>;
+    results: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        vmId: z.ZodString;
+        outcome: z.ZodEnum<{
+            error: "error";
+            "not-found": "not-found";
+            "not-live": "not-live";
+            stopped: "stopped";
+            tracked: "tracked";
+            unverified: "unverified";
+        }>;
+        pid: z.ZodOptional<z.ZodNumber>;
+        detail: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.forget.request">;
+    messageId: z.ZodString;
+    instanceId: z.ZodString;
+    acknowledgeBackstop: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.forget.response">;
+    messageId: z.ZodString;
+    outcome: z.ZodEnum<{
+        "acknowledgement-required": "acknowledgement-required";
+        connected: "connected";
+        error: "error";
+        forgotten: "forgotten";
+        "not-found": "not-found";
+        recent: "recent";
+    }>;
+    detail: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.clusterSettings.request">;
     messageId: z.ZodString;
@@ -727,6 +980,7 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     version: z.ZodNumber;
     settings: z.ZodObject<{
         agentTokenTtlMs: z.ZodNumber;
+        firecrackerApiSocketWaitMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.logs.collect.request">;
@@ -770,6 +1024,7 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     }>;
     detail: z.ZodString;
     timestampMs: z.ZodNumber;
+    final: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>], "type">;
 /** All peer-to-peer messages (inbound to this node). */
 export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -903,6 +1158,10 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     }, z.core.$strip>], "kind">>>;
     triedConnections: z.ZodArray<z.ZodString>;
     maxHops: z.ZodNumber;
+    spawnRetry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodNumber;
+        backoffMs: z.ZodNumber;
+    }, z.core.$strip>>;
     coordinatorId: z.ZodString;
     requestId: z.ZodOptional<z.ZodString>;
     traceId: z.ZodOptional<z.ZodString>;
@@ -1033,6 +1292,70 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     errors: z.ZodOptional<z.ZodArray<z.ZodString>>;
     restartRequired: z.ZodOptional<z.ZodArray<z.ZodString>>;
     fieldsChanged: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.scaler.orphans.request">;
+    messageId: z.ZodString;
+    action: z.ZodEnum<{
+        list: "list";
+        stop: "stop";
+    }>;
+    vmIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.scaler.orphans.response">;
+    messageId: z.ZodString;
+    ok: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    firecrackerScalers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    vms: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        vmId: z.ZodString;
+        scaler: z.ZodString;
+        pid: z.ZodNumber;
+        startedAt: z.ZodString;
+        ageSeconds: z.ZodNumber;
+        chrootDir: z.ZodString;
+        status: z.ZodEnum<{
+            orphaned: "orphaned";
+            tracked: "tracked";
+            unverified: "unverified";
+        }>;
+        trackedBy: z.ZodArray<z.ZodEnum<{
+            backend: "backend";
+            "bound-job": "bound-job";
+            registered: "registered";
+            spawning: "spawning";
+        }>>;
+        reason: z.ZodString;
+    }, z.core.$strip>>>;
+    results: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        vmId: z.ZodString;
+        outcome: z.ZodEnum<{
+            error: "error";
+            "not-found": "not-found";
+            "not-live": "not-live";
+            stopped: "stopped";
+            tracked: "tracked";
+            unverified: "unverified";
+        }>;
+        pid: z.ZodOptional<z.ZodNumber>;
+        detail: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.forget.request">;
+    messageId: z.ZodString;
+    instanceId: z.ZodString;
+    acknowledgeBackstop: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"peer.forget.response">;
+    messageId: z.ZodString;
+    outcome: z.ZodEnum<{
+        "acknowledgement-required": "acknowledgement-required";
+        connected: "connected";
+        error: "error";
+        forgotten: "forgotten";
+        "not-found": "not-found";
+        recent: "recent";
+    }>;
+    detail: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.clusterSettings.request">;
     messageId: z.ZodString;
@@ -1042,6 +1365,7 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     version: z.ZodNumber;
     settings: z.ZodObject<{
         agentTokenTtlMs: z.ZodNumber;
+        firecrackerApiSocketWaitMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"peer.logs.collect.request">;
@@ -1085,11 +1409,13 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     }>;
     detail: z.ZodString;
     timestampMs: z.ZodNumber;
+    final: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>], "type">;
 export type PeerCapabilities = z.infer<typeof peerCapabilitiesSchema>;
 export type ScalerCapacitySummary = z.infer<typeof scalerCapacitySummarySchema>;
 export type PeerHeartbeat = z.infer<typeof peerHeartbeatSchema>;
 export type JobReroute = z.infer<typeof jobRerouteSchema>;
+export type RerouteSpawnRetry = z.infer<typeof rerouteSpawnRetrySchema>;
 export type JobProgress = z.infer<typeof jobProgressSchema>;
 export type JobProgressAck = z.infer<typeof jobProgressAckSchema>;
 export type PeerScalerEvent = z.infer<typeof peerScalerEventSchema>;
@@ -1102,6 +1428,10 @@ export type PeerCacheUploadRequest = z.infer<typeof peerCacheUploadRequestSchema
 export type PeerCacheUploadResponse = z.infer<typeof peerCacheUploadResponseSchema>;
 export type PeerConfigReload = z.infer<typeof peerConfigReloadSchema>;
 export type PeerConfigReloadResponse = z.infer<typeof peerConfigReloadResponseSchema>;
+export type PeerScalerOrphansRequest = z.infer<typeof peerScalerOrphansRequestSchema>;
+export type PeerScalerOrphansResponse = z.infer<typeof peerScalerOrphansResponseSchema>;
+export type PeerForgetRequest = z.infer<typeof peerForgetRequestSchema>;
+export type PeerForgetResponse = z.infer<typeof peerForgetResponseSchema>;
 export type WorkerClusterSettings = z.infer<typeof workerClusterSettingsSchema>;
 export type PeerClusterSettingsRequest = z.infer<typeof peerClusterSettingsRequestSchema>;
 export type PeerClusterSettingsResponse = z.infer<typeof peerClusterSettingsResponseSchema>;

package/dist/protocol/messages/peer.js

@@ -126,7 +126,7 @@ const peerHeartbeatSchema = z.object({
 	configVersion: z.number().optional(),
 	/** Registry version for cross-orchestrator registration sync (backward compatible). */
 	registryVersion: z.number().optional(),
-	/** Shared cluster-settings version for leader→worker settings pull (backward compatible). */
+	/** Cluster-settings version for the coordinator→worker settings pull (backward compatible). */
 	clusterSettingsVersion: z.number().optional(),
 	timestamp: z.number(),
 	hostname: z.string().optional(),
@@ -141,6 +141,15 @@ const peerHeartbeatSchema = z.object({
 	runningAsUid: z.number().nullable().optional(),
 	version: z.string().optional()
 });
+/**
+* The spawn-retry budget a worker applies to one rerouted job: how many agent
+* spawns it attempts, and how long it waits after a failed one. The sending
+* coordinator resolves it per org and enforces the same budget on its side.
+*/
+const rerouteSpawnRetrySchema = z.object({
+	maxAttempts: z.number().int().min(1),
+	backoffMs: z.number().int().min(0)
+});
 /** Request to reroute a job to another orchestrator (no local agent can handle it). */
 const jobRerouteSchema = z.object({
 	type: z.literal("job.reroute"),
@@ -178,6 +187,11 @@ const jobRerouteSchema = z.object({
 	excludePatterns: z.array(LabelMatcher).optional(),
 	triedConnections: z.array(z.string()),
 	maxHops: z.number(),
+	/**
+	* The worker's spawn-retry budget for this job. Absent from an older sender:
+	* the worker applies its own configured default.
+	*/
+	spawnRetry: rerouteSpawnRetrySchema.optional(),
 	coordinatorId: z.string(),
 	requestId: z.string().optional(),
 	traceId: z.string().optional(),
@@ -346,18 +360,135 @@ const peerConfigReloadResponseSchema = z.object({
 	restartRequired: z.array(z.string()).optional(),
 	fieldsChanged: z.array(z.string()).optional()
 });
+/** How a live Firecracker VM relates to the orchestrator on its host. */
+const ScalerVmStatus = z.enum([
+	"orphaned",
+	"unverified",
+	"tracked"
+]);
+/** What tracks a live VM. `bound-job` is answered from a coordinator's dispatch queue. */
+const ScalerVmTracker = z.enum([
+	"backend",
+	"spawning",
+	"registered",
+	"bound-job"
+]);
+/** What a stop did to one VM. Only `stopped` signalled anything. */
+const ScalerVmStopOutcome = z.enum([
+	"stopped",
+	"tracked",
+	"unverified",
+	"not-live",
+	"not-found",
+	"error"
+]);
+/** What a scaler orphan request asks the target node to do. */
+const ScalerOrphansAction = z.enum(["list", "stop"]);
+/** One live Firecracker VM on a node, as its orchestrator sees it. */
+const scalerLiveVmSchema = z.object({
+	vmId: z.string(),
+	scaler: z.string(),
+	pid: z.number().int().positive(),
+	startedAt: z.string(),
+	ageSeconds: z.number().nonnegative(),
+	chrootDir: z.string(),
+	status: ScalerVmStatus,
+	trackedBy: z.array(ScalerVmTracker),
+	reason: z.string()
+});
+/** The result of stopping one VM. `pid` is the process that was (or would be) signalled. */
+const scalerVmStopResultSchema = z.object({
+	vmId: z.string(),
+	outcome: ScalerVmStopOutcome,
+	pid: z.number().int().positive().optional(),
+	detail: z.string()
+});
+/**
+* Scaler orphan request: forwarded by a coordinator to the node an operator
+* targeted with `kici-admin scaler orphans --target`. The node answers from
+* its own host and its own tracking with peer.scaler.orphans.response.
+*/
+const peerScalerOrphansRequestSchema = z.object({
+	type: z.literal("peer.scaler.orphans.request"),
+	messageId: z.string(),
+	action: ScalerOrphansAction,
+	/** `stop` only: the VM ids the operator approved. */
+	vmIds: z.array(z.string()).optional()
+});
+/**
+* Scaler orphan response. `vms` answers a `list`, `results` answers a `stop`;
+* `ok: false` carries the node's `error` instead.
+*/
+const peerScalerOrphansResponseSchema = z.object({
+	type: z.literal("peer.scaler.orphans.response"),
+	messageId: z.string(),
+	ok: z.boolean(),
+	error: z.string().optional(),
+	/** The node's Firecracker scaler names; empty when it runs none. */
+	firecrackerScalers: z.array(z.string()).optional(),
+	vms: z.array(scalerLiveVmSchema).optional(),
+	results: z.array(scalerVmStopResultSchema).optional()
+});
 /**
-* Worker-relevant cluster settings a DB-less worker pulls from the leader.
+* What forgetting a departed peer did on one coordinator. `recent`: the peer
+* was heard from inside the window this coordinator still treats it as alive
+* for (the longer of the stale window and the reroute flap grace, or the
+* backstop grace of a peer that adopted provisions), so it may be partitioned
+* rather than gone. `acknowledgement-required`: forgetting it would switch this
+* coordinator's event-provision backstop back on, and the request did not
+* acknowledge that. Every outcome but `forgotten` keeps the peer.
+*/
+const PeerForgetOutcome = z.enum([
+	"forgotten",
+	"not-found",
+	"connected",
+	"recent",
+	"acknowledgement-required",
+	"error"
+]);
+/**
+* Forget request: a coordinator that forgot a departed peer (`kici-admin peer
+* forget`) asks each connected sibling coordinator to drop it from its own
+* live peer registry too.
+*/
+const peerForgetRequestSchema = z.object({
+	type: z.literal("peer.forget.request"),
+	messageId: z.string(),
+	/** The departed peer's instance id. */
+	instanceId: z.string(),
+	/**
+	* The operator acknowledged that forgetting the peer may switch the
+	* event-provision backstop back on. Absent means not acknowledged.
+	*/
+	acknowledgeBackstop: z.boolean().optional()
+});
+/** Forget response: what the sibling did with the request. */
+const peerForgetResponseSchema = z.object({
+	type: z.literal("peer.forget.response"),
+	messageId: z.string(),
+	outcome: PeerForgetOutcome,
+	detail: z.string()
+});
+/**
+* Worker-relevant cluster settings a DB-less worker pulls from a coordinator.
 *
 * A typed, concrete snapshot (not an open key/value bus): each worker-consumed
 * cluster knob is a field here. Adding the next worker-relevant knob is one
 * field on this schema, not a new protocol message.
 */
-const workerClusterSettingsSchema = z.object({ agentTokenTtlMs: z.number() });
+const workerClusterSettingsSchema = z.object({
+	agentTokenTtlMs: z.number(),
+	/**
+	* How long a Firecracker spawn waits for the VM's API socket. Optional: a
+	* leader that predates the knob omits it, and the worker keeps its own
+	* configured default.
+	*/
+	firecrackerApiSocketWaitMs: z.number().optional()
+});
 /**
-* Cluster-settings pull request: a DB-less worker asks the leader for the
-* current worker-settings snapshot after observing the leader's advertised
-* clusterSettingsVersion ahead of its own. The leader replies with
+* Cluster-settings pull request: a DB-less worker asks a connected coordinator
+* for the current worker-settings snapshot after a coordinator advertised a
+* clusterSettingsVersion ahead of its own. The coordinator replies with
 * peer.clusterSettings.response.
 */
 const peerClusterSettingsRequestSchema = z.object({
@@ -365,7 +496,7 @@ const peerClusterSettingsRequestSchema = z.object({
 	messageId: z.string()
 });
 /**
-* Cluster-settings pull response: the leader resolves the snapshot from
+* Cluster-settings pull response: the coordinator resolves the snapshot from
 * cluster_settings and replies with it plus the current version.
 */
 const peerClusterSettingsResponseSchema = z.object({
@@ -443,7 +574,14 @@ const peerScalerEventSchema = z.object({
 	/** Human-readable detail, including any captured spawn stderr tail. */
 	detail: z.string(),
 	/** Event timestamp in epoch milliseconds. */
-	timestampMs: z.number()
+	timestampMs: z.number(),
+	/**
+	* The worker's retry verdict on a `scaler.failed` for a job under its spawn-retry
+	* budget: false while attempts remain, true on the last one. Absent on a repeated
+	* report of one failed spawn, on every other relay, and from an older worker; the
+	* coordinator then keeps its spawn window running unchanged.
+	*/
+	final: z.boolean().optional()
 });
 /** All peer-to-peer messages (outbound from this node). */
 const peerToPeerMessageSchema = z.discriminatedUnion("type", [
@@ -465,6 +603,10 @@ const peerToPeerMessageSchema = z.discriminatedUnion("type", [
 	peerCacheUploadResponseSchema,
 	peerConfigReloadSchema,
 	peerConfigReloadResponseSchema,
+	peerScalerOrphansRequestSchema,
+	peerScalerOrphansResponseSchema,
+	peerForgetRequestSchema,
+	peerForgetResponseSchema,
 	peerClusterSettingsRequestSchema,
 	peerClusterSettingsResponseSchema,
 	peerLogsCollectRequestSchema,
@@ -494,6 +636,10 @@ const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
 	peerCacheUploadResponseSchema,
 	peerConfigReloadSchema,
 	peerConfigReloadResponseSchema,
+	peerScalerOrphansRequestSchema,
+	peerScalerOrphansResponseSchema,
+	peerForgetRequestSchema,
+	peerForgetResponseSchema,
 	peerClusterSettingsRequestSchema,
 	peerClusterSettingsResponseSchema,
 	peerLogsCollectRequestSchema,
@@ -504,6 +650,6 @@ const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
 	peerScalerEventSchema
 ]);
 //#endregion
-export { fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, workerClusterSettingsSchema };
+export { PeerForgetOutcome, ScalerOrphansAction, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerVmStopResultSchema, workerClusterSettingsSchema };
 
 //# sourceMappingURL=peer.js.map

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -2985,6 +2985,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "held_run.request": "held_run.request";
         "job.cancel": "job.cancel";
         "org_settings.dashboard_write_policy.update": "org_settings.dashboard_write_policy.update";
+        "peer.forget": "peer.forget";
         purge_chunk: "purge_chunk";
         "registration.delete": "registration.delete";
         "registration.disable": "registration.disable";
@@ -3001,6 +3002,8 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "runs.list.read": "runs.list.read";
         "scaler.agents.read": "scaler.agents.read";
         "scaler.capacity.read": "scaler.capacity.read";
+        "scaler.orphan.stop": "scaler.orphan.stop";
+        "scaler.orphans.read": "scaler.orphans.read";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kici-dev/engine",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",
   "keywords": [
     "ci",

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@kici-dev/engine@0.13.0",
-  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.13.0/4b96027f-523a-4ba7-ab05-2b81a6793c87",
+  "name": "@kici-dev/engine@0.14.1",
+  "documentNamespace": "https://kici.dev/sbom/%40kici-dev%2Fengine/0.14.1/bdf9966d-24d2-432a-b69d-6100cb893919",
   "creationInfo": {
-    "created": "2026-09-30T15:38:56Z",
+    "created": "2026-10-02T17:53:08Z",
     "creators": [
       "Tool: kici-sbom-generator"
     ]
@@ -54,7 +54,7 @@
     {
       "SPDXID": "SPDXRef-RootPackage",
       "name": "@kici-dev/engine",
-      "versionInfo": "0.13.0",
+      "versionInfo": "0.14.1",
       "downloadLocation": "NOASSERTION",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
@@ -65,7 +65,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.13.0"
+          "referenceLocator": "pkg:npm/%40kici-dev/engine@0.14.1"
         }
       ],
       "description": "Shared business logic for the KiCI CI/CD stack: protocol, triggers, state machine, and provider interfaces used by the Platform relay, orchestrator, and compiler.",