@kici-dev/engine 0.14.2 → 0.16.0

package/dist/protocol/messages/peer.js

@@ -1,7 +1,7 @@
 import "../../rolldown-runtime-ClRpJifh.js";
+import { LogStream } from "./log-stream.js";
 import { ExecutionJobStatus } from "./execution-status.js";
 import { LabelMatcher } from "../../labels-match.js";
-import { LogStream } from "./log-stream.js";
 import { ScalerEventType } from "./scaler-event.js";
 import { z } from "zod";
 //#region src/protocol/messages/peer.ts
@@ -67,13 +67,29 @@ const scalerCapacitySummarySchema = z.object({
 	*/
 	labelSetMandatoryLabels: z.array(z.array(z.string()))
 }).strict();
-/** Peer hello: initiator sends ephemeral X25519 public key and nonce. */
+/** Peer authentication schemes. A server lists the ones it accepts in `peer.hello`. */
+const PeerAuthScheme = z.enum(["mutual-v2"]);
+/** How a peer proves itself: with its persisted credential, or with a join token on first join. */
+const PeerAuthMode = z.enum(["credential", "token"]);
+/**
+* The reason a server gives a peer that authenticates without mutual-v2 (a
+* proof or token field, or no scheme). It is none of the credential-divergence
+* reasons, so that peer keeps its credential file.
+*/
+const PEER_MUTUAL_AUTH_REQUIRED_REASON = "Mutual peer authentication required";
+/** Peer hello: the server sends its ephemeral X25519 public key, a nonce and its schemes. */
 const peerHelloSchema = z.object({
 	type: z.literal("peer.hello"),
 	/** Base64-encoded X25519 DER SPKI ephemeral public key. */
 	ephemeralPublicKey: z.string(),
 	/** Base64-encoded 32-byte random nonce (HKDF salt). */
-	nonce: z.string()
+	nonce: z.string(),
+	/**
+	* The authentication schemes this server accepts. Strings rather than an
+	* enum, so a hello naming a scheme this build does not know still parses.
+	* Optional so a hello naming none reaches the client's explicit refusal.
+	*/
+	authSchemes: z.array(z.string()).optional()
 });
 /** Peer hello response: responder sends their ephemeral X25519 public key. */
 const peerHelloResponseSchema = z.object({
@@ -81,19 +97,21 @@ const peerHelloResponseSchema = z.object({
 	/** Base64-encoded X25519 DER SPKI ephemeral public key. */
 	ephemeralPublicKey: z.string()
 });
-/** Peer auth request sent after ECDH handshake (encrypted channel established). */
+/** Peer auth request sent after the ECDH handshake, under the handshake key. */
 const peerAuthRequestSchema = z.object({
 	type: z.literal("peer.auth.request"),
 	instanceId: z.string(),
-	/** Join token (first connection via token-based auth). */
-	token: z.string().optional(),
-	/** HMAC proof of credential ownership (reconnection). */
-	proof: z.string().optional(),
 	protocolVersion: z.number(),
-	/** Software version of the connecting peer (for version compat check). */
+	/** Software version of the connecting peer (logged). */
 	softwareVersion: z.string().optional(),
-	/** Role of the connecting peer. */
-	role: z.enum(["coordinator", "worker"]).optional()
+	/** Role of the connecting peer, as it declares it. */
+	role: z.enum(["coordinator", "worker"]).optional(),
+	scheme: PeerAuthScheme,
+	mode: PeerAuthMode,
+	/** Hex HMAC-SHA256 proof bound to the handshake transcript. */
+	clientProof: z.string(),
+	/** The join token's base64url routing segment. The server requires it in token mode. */
+	tokenRouting: z.string().optional()
 });
 /** Peer auth response indicating whether the connection was accepted. */
 const peerAuthResponseSchema = z.object({
@@ -101,6 +119,8 @@ const peerAuthResponseSchema = z.object({
 	accepted: z.boolean(),
 	instanceId: z.string().optional(),
 	reason: z.string().optional(),
+	/** Hex proof that the server holds the same credential or token; present on every acceptance. */
+	serverProof: z.string().optional(),
 	/** Session credential issued on first join (worker stores for reconnection). */
 	sessionCredential: z.string().optional(),
 	/** Assigned role echoed back to the connecting peer. */
@@ -120,13 +140,13 @@ const peerHeartbeatSchema = z.object({
 	draining: z.boolean(),
 	agents: z.array(peerAgentSummarySchema),
 	capabilities: peerCapabilitiesSchema,
-	/** Optional scaler capacity data for on-demand backends (backward compatible). */
+	/** Scaler capacity data for on-demand backends. */
 	scalerCapacity: z.array(scalerCapacitySummarySchema).optional(),
-	/** Shared config version for cross-orchestrator config sync (backward compatible). */
+	/** Shared config version for cross-orchestrator config sync. */
 	configVersion: z.number().optional(),
-	/** Registry version for cross-orchestrator registration sync (backward compatible). */
+	/** Registry version for cross-orchestrator registration sync. */
 	registryVersion: z.number().optional(),
-	/** Cluster-settings version for the coordinator→worker settings pull (backward compatible). */
+	/** Cluster-settings version for the coordinator→worker settings pull. */
 	clusterSettingsVersion: z.number().optional(),
 	timestamp: z.number(),
 	hostname: z.string().optional(),
@@ -173,7 +193,7 @@ const jobRerouteSchema = z.object({
 	jobName: z.string(),
 	workflowName: z.string(),
 	runsOnLabels: z.array(z.array(z.string())),
-	/** Labels that the dispatched agent must NOT have (optional for backward compatibility). */
+	/** Labels that the dispatched agent must NOT have. Absent is `[]`. */
 	excludeLabels: z.array(z.string()).optional(),
 	/**
 	* Glob/regex include matchers the receiving peer's agent labels must
@@ -187,11 +207,8 @@ const jobRerouteSchema = z.object({
 	excludePatterns: z.array(LabelMatcher).optional(),
 	triedConnections: z.array(z.string()),
 	maxHops: z.number(),
-	/**
-	* The worker's spawn-retry budget for this job. Absent from an older sender:
-	* the worker applies its own configured default.
-	*/
-	spawnRetry: rerouteSpawnRetrySchema.optional(),
+	/** The worker's spawn-retry budget for this job. */
+	spawnRetry: rerouteSpawnRetrySchema,
 	coordinatorId: z.string(),
 	requestId: z.string().optional(),
 	traceId: z.string().optional(),
@@ -314,7 +331,7 @@ const peerLogChunkSchema = z.object({
 	lines: z.array(z.object({
 		text: z.string(),
 		timestamp: z.number(),
-		stream: LogStream.optional()
+		stream: LogStream
 	}))
 });
 /** Cache upload request: worker -> coordinator. Worker agent needs upload URL. */
@@ -336,6 +353,65 @@ const peerCacheUploadResponseSchema = z.object({
 	uploadUrl: z.string()
 });
 /**
+* What a scaler config reload did on one orchestrator. `rejected`: the file did
+* not load or validate, or an added scaler did not build, and nothing applied.
+* `not-configured`: the orchestrator runs without a scaler config, so there is
+* nothing to reload. `unreachable`: the request did not reach the orchestrator,
+* or it did not answer in time.
+*/
+const ScalerReloadOutcome = z.enum([
+	"applied",
+	"rejected",
+	"not-configured",
+	"unreachable"
+]);
+/**
+* What an applied scaler reload changed, as scaler names per bucket. `updated`
+* holds the kept scalers whose entry changed and `unchanged` the rest of them;
+* `global` names the changed top-level limits (`globalMaxAgents`,
+* `globalResourceCap`).
+*/
+const scalerReloadPlanSchema = z.object({
+	added: z.array(z.string()),
+	updated: z.array(z.string()),
+	unchanged: z.array(z.string()),
+	retired: z.array(z.string()),
+	resurrected: z.array(z.string()),
+	global: z.array(z.string())
+});
+/** One orchestrator's scaler reload outcome, its plan when applied, its errors when refused. */
+const scalerReloadAnswerSchema = z.object({
+	outcome: ScalerReloadOutcome,
+	plan: scalerReloadPlanSchema.optional(),
+	errors: z.array(z.string()).optional()
+});
+/** One orchestrator's answer to a scaler reload, as `kici-admin scaler reload` reports it. */
+const scalerReloadInstanceResultSchema = scalerReloadAnswerSchema.extend({
+	instanceId: z.string(),
+	role: z.enum([
+		"coordinator",
+		"worker",
+		"unknown"
+	]),
+	/** Why the outcome is what it is, for an instance that was not reached or did not answer. */
+	detail: z.string().optional()
+});
+/**
+* Scaler reload request: the orchestrator that received `kici-admin scaler
+* reload` asks each connected peer to re-read its own scaler config. The peer
+* answers with peer.scaler.reload.response.
+*/
+const peerScalerReloadRequestSchema = z.object({
+	type: z.literal("peer.scaler.reload.request"),
+	messageId: z.string()
+});
+/** Scaler reload response: the peer's outcome, its plan when applied, its errors when rejected. */
+const peerScalerReloadResponseSchema = scalerReloadAnswerSchema.extend({
+	type: z.literal("peer.scaler.reload.response"),
+	messageId: z.string(),
+	detail: z.string().optional()
+});
+/**
 * Config reload request: forwarded from one orchestrator to a specific peer
 * when an operator calls POST /admin/config/reload with a `target` parameter.
 * The receiving peer executes a local reload and replies with
@@ -358,7 +434,9 @@ const peerConfigReloadResponseSchema = z.object({
 	version: z.number().optional(),
 	errors: z.array(z.string()).optional(),
 	restartRequired: z.array(z.string()).optional(),
-	fieldsChanged: z.array(z.string()).optional()
+	fieldsChanged: z.array(z.string()).optional(),
+	/** The target peer's scaler config reload outcome, when it runs a scaler config. */
+	scaler: scalerReloadAnswerSchema.optional()
 });
 /** How a live Firecracker VM relates to the orchestrator on its host. */
 const ScalerVmStatus = z.enum([
@@ -478,12 +556,13 @@ const peerForgetResponseSchema = z.object({
 */
 const workerClusterSettingsSchema = z.object({
 	agentTokenTtlMs: z.number(),
+	/** How long a Firecracker spawn waits for the VM's API socket. */
+	firecrackerApiSocketWaitMs: z.number(),
 	/**
-	* How long a Firecracker spawn waits for the VM's API socket. Optional: a
-	* leader that predates the knob omits it, and the worker keeps its own
-	* configured default.
+	* The concurrency-slot wait timeout a worker sends on each `job.dispatch`,
+	* from `cluster_settings.concurrency_wait_timeout_ms`.
 	*/
-	firecrackerApiSocketWaitMs: z.number().optional()
+	concurrencyWaitTimeoutMs: z.number()
 });
 /**
 * Cluster-settings pull request: a DB-less worker asks a connected coordinator
@@ -578,13 +657,16 @@ const peerScalerEventSchema = z.object({
 	/**
 	* The worker's retry verdict on a `scaler.failed` for a job under its spawn-retry
 	* budget: false while attempts remain, true on the last one. Absent on a repeated
-	* report of one failed spawn, on every other relay, and from an older worker; the
-	* coordinator then keeps its spawn window running unchanged.
+	* report of one failed spawn and on every other relay; the coordinator then keeps
+	* its spawn window running unchanged.
 	*/
 	final: z.boolean().optional()
 });
-/** All peer-to-peer messages (outbound from this node). */
-const peerToPeerMessageSchema = z.discriminatedUnion("type", [
+/**
+* Every peer message type. Both directions carry the same set: each node sends
+* and receives every type, so one list backs both unions.
+*/
+const peerMessageSchemas = [
 	peerHelloSchema,
 	peerHelloResponseSchema,
 	peerAuthRequestSchema,
@@ -605,6 +687,8 @@ const peerToPeerMessageSchema = z.discriminatedUnion("type", [
 	peerConfigReloadResponseSchema,
 	peerScalerOrphansRequestSchema,
 	peerScalerOrphansResponseSchema,
+	peerScalerReloadRequestSchema,
+	peerScalerReloadResponseSchema,
 	peerForgetRequestSchema,
 	peerForgetResponseSchema,
 	peerClusterSettingsRequestSchema,
@@ -615,41 +699,12 @@ const peerToPeerMessageSchema = z.discriminatedUnion("type", [
 	peerLeavingSchema,
 	peerAgentTokenRevokeSchema,
 	peerScalerEventSchema
-]);
+];
+/** All peer-to-peer messages (outbound from this node). */
+const peerToPeerMessageSchema = z.discriminatedUnion("type", peerMessageSchemas);
 /** All peer-to-peer messages (inbound to this node). */
-const peerFromPeerMessageSchema = z.discriminatedUnion("type", [
-	peerHelloSchema,
-	peerHelloResponseSchema,
-	peerAuthRequestSchema,
-	peerAuthResponseSchema,
-	peerHeartbeatSchema,
-	jobRerouteSchema,
-	jobRerouteAckSchema,
-	jobProgressSchema,
-	jobProgressAckSchema,
-	peerJobCancelSchema,
-	raftVoteRequestSchema,
-	raftVoteResponseSchema,
-	raftAppendEntriesSchema,
-	peerLogChunkSchema,
-	peerCacheUploadRequestSchema,
-	peerCacheUploadResponseSchema,
-	peerConfigReloadSchema,
-	peerConfigReloadResponseSchema,
-	peerScalerOrphansRequestSchema,
-	peerScalerOrphansResponseSchema,
-	peerForgetRequestSchema,
-	peerForgetResponseSchema,
-	peerClusterSettingsRequestSchema,
-	peerClusterSettingsResponseSchema,
-	peerLogsCollectRequestSchema,
-	peerLogsCollectChunkSchema,
-	peerLogsCollectErrorSchema,
-	peerLeavingSchema,
-	peerAgentTokenRevokeSchema,
-	peerScalerEventSchema
-]);
+const peerFromPeerMessageSchema = z.discriminatedUnion("type", peerMessageSchemas);
 //#endregion
-export { PeerForgetOutcome, ScalerOrphansAction, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerVmStopResultSchema, workerClusterSettingsSchema };
+export { PEER_MUTUAL_AUTH_REQUIRED_REASON, PeerAuthMode, PeerAuthScheme, PeerForgetOutcome, ScalerOrphansAction, ScalerReloadOutcome, ScalerVmStatus, ScalerVmStopOutcome, ScalerVmTracker, fleetSelectionSchema, jobProgressAckSchema, jobProgressSchema, jobRerouteAckSchema, jobRerouteSchema, peerAgentTokenRevokeSchema, peerAuthRequestSchema, peerAuthResponseSchema, peerCapabilitiesSchema, peerClusterSettingsRequestSchema, peerClusterSettingsResponseSchema, peerConfigReloadResponseSchema, peerConfigReloadSchema, peerForgetRequestSchema, peerForgetResponseSchema, peerFromPeerMessageSchema, peerHeartbeatSchema, peerHelloResponseSchema, peerHelloSchema, peerJobCancelSchema, peerLeavingSchema, peerLogsCollectChunkSchema, peerLogsCollectErrorSchema, peerLogsCollectRequestSchema, peerScalerEventSchema, peerScalerOrphansRequestSchema, peerScalerOrphansResponseSchema, peerScalerReloadRequestSchema, peerScalerReloadResponseSchema, peerToPeerMessageSchema, raftAppendEntriesSchema, raftVoteRequestSchema, raftVoteResponseSchema, rerouteSpawnRetrySchema, scalerLiveVmSchema, scalerReloadAnswerSchema, scalerReloadInstanceResultSchema, scalerReloadPlanSchema, scalerVmStopResultSchema, workerClusterSettingsSchema };
 
 //# sourceMappingURL=peer.js.map

package/dist/protocol/messages/platform-orchestrator.d.ts

@@ -5,20 +5,15 @@ import { z } from 'zod';
  * from the enclosing message so the orchestrator's evaluator and cache can type
  * against the policy alone.
  */
+/** Seconds in an hour. */
+export declare const SECONDS_PER_HOUR = 3600;
 /**
- * Documented default hours a security hold stays open.
+ * Documented default window a security hold stays open: 72 hours.
  *
  * The single owner of the value: the fail-closed policy, the orchestrator's
  * stored-policy default, and the hold-sizing fallback all read it, so the
  * number cannot drift between the two packages that enforce it.
  */
-export declare const DEFAULT_APPROVAL_EXPIRY_HOURS = 72;
-/** Seconds in an hour — the one conversion between the two expiry spellings. */
-export declare const SECONDS_PER_HOUR = 3600;
-/**
- * The same documented default as {@link DEFAULT_APPROVAL_EXPIRY_HOURS}, in the
- * granularity the policy actually stores.
- */
 export declare const DEFAULT_APPROVAL_EXPIRY_SECONDS: number;
 /**
  * The shortest expressible security-hold window.
@@ -29,34 +24,8 @@ export declare const DEFAULT_APPROVAL_EXPIRY_SECONDS: number;
  * opinion that also puts the window back out of reach of a test.
  */
 export declare const MIN_APPROVAL_EXPIRY_SECONDS = 1;
-/** The longest window the Platform accepts: one year, the bound already applied to hours. */
-export declare const MAX_APPROVAL_EXPIRY_HOURS = 8760;
-/** {@link MAX_APPROVAL_EXPIRY_HOURS} in seconds, so neither spelling outranges the other. */
+/** The longest window the Platform accepts: one year. */
 export declare const MAX_APPROVAL_EXPIRY_SECONDS: number;
-/**
- * The window a policy actually means, in seconds.
- *
- * `approvalExpirySeconds` is the authority and `approvalExpiryHours` its coarse
- * spelling, so the more specific field wins whenever both are present — the
- * only rule that never discards what an operator asked for. A policy carrying
- * neither (an older peer that sent no window at all) falls back to the
- * documented default.
- */
-export declare function approvalExpirySecondsOf(policy: {
-    approvalExpiryHours?: number | null;
-    approvalExpirySeconds?: number | null;
-}): number;
-/**
- * The coarse `approvalExpiryHours` view of a window stored in seconds.
- *
- * Rounds UP, and never below one hour. A sub-hour window has no exact hours
- * spelling, and the peer reading this field is one that cannot express the real
- * value anyway — so the choice is which way to be wrong. Rounding up yields a
- * longer hold than asked for, which stays approvable; rounding down yields zero,
- * which is the already-expired hold `MIN_APPROVAL_EXPIRY_SECONDS` exists to
- * prevent.
- */
-export declare function approvalExpiryHoursOf(seconds: number): number;
 /**
  * The org-level fork switch: the setting an org's trust policy carries for how
  * fork pull requests are treated. Each value names what the operator is
@@ -102,8 +71,7 @@ export declare const trustPolicySchema: z.ZodObject<{
         hold: "hold";
         ignore: "ignore";
     }>;
-    approvalExpiryHours: z.ZodNumber;
-    approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
+    approvalExpirySeconds: z.ZodNumber;
 }, z.core.$strict>;
 export type TrustPolicy = z.infer<typeof trustPolicySchema>;
 /** Trust policy update pushed from Platform to orchestrator when policy or identity links change. */
@@ -116,8 +84,7 @@ export declare const trustPolicyUpdateSchema: z.ZodObject<{
             hold: "hold";
             ignore: "ignore";
         }>;
-        approvalExpiryHours: z.ZodNumber;
-        approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
+        approvalExpirySeconds: z.ZodNumber;
     }, z.core.$strict>;
     identityLinks: z.ZodArray<z.ZodObject<{
         userId: z.ZodString;
@@ -289,18 +256,12 @@ export declare const staleCheckrunCleanupSchema: z.ZodObject<{
 export type StaleCheckrunCleanup = z.infer<typeof staleCheckrunCleanupSchema>;
 /**
  * Platform capability advertisement, sent once by the Platform after the
- * orchestrator authenticates. The orchestrator caches it per connection and
- * pre-flight-checks its own feature-gated sends against it, so a self-hosted
- * orchestrator running ahead of the hosted Platform surfaces a diagnosable
- * capability gap instead of firing a frame the Platform would silently drop.
- * Payload is `platformCapabilitiesSchema` (`.passthrough()`, absent =
- * unsupported).
+ * orchestrator authenticates. Payload is `platformCapabilitiesSchema`, which
+ * defines no flag at protocol 4.
  */
 export declare const platformCapabilitiesMessageSchema: z.ZodObject<{
     type: z.ZodLiteral<"platform.capabilities">;
-    capabilities: z.ZodObject<{
-        orchMetrics: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>;
+    capabilities: z.ZodObject<{}, z.core.$loose>;
 }, z.core.$strip>;
 export type PlatformCapabilitiesMessage = z.infer<typeof platformCapabilitiesMessageSchema>;
 /**
@@ -388,22 +349,21 @@ export type PlanHeadroom = z.infer<typeof planHeadroomSchema>;
 /**
  * Acknowledgment that a webhook was received and processing started.
  *
- * Under the chunked relay protocol the orchestrator also reports the HMAC
- * verification outcome here via `result`, and may include a non-secret-bearing
- * diagnostic in `reason` when result is a rejection. Both fields are optional
- * for backward compatibility during the rollout: pre-cutover senders omit them.
+ * The orchestrator reports the HMAC verification outcome via `result`, and may
+ * include a non-secret-bearing diagnostic in `reason` when result is a
+ * rejection.
  */
 export declare const webhookAckSchema: z.ZodObject<{
     type: z.ZodLiteral<"webhook.ack">;
     messageId: z.ZodString;
     deliveryId: z.ZodString;
-    result: z.ZodOptional<z.ZodEnum<{
+    result: z.ZodEnum<{
         accepted: "accepted";
         rejected_misconfigured: "rejected_misconfigured";
         rejected_signature: "rejected_signature";
         rejected_unknown_source: "rejected_unknown_source";
         shed_retry_later: "shed_retry_later";
-    }>>;
+    }>;
     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 /** Execution lifecycle event reported back to Platform. */
@@ -429,10 +389,10 @@ export declare const logChunkSchema: z.ZodObject<{
     stepIndex: z.ZodNumber;
     lines: z.ZodArray<z.ZodString>;
     timestamp: z.ZodNumber;
-    stream: z.ZodOptional<z.ZodEnum<{
+    stream: z.ZodEnum<{
         stderr: "stderr";
         stdout: "stdout";
-    }>>;
+    }>;
 }, z.core.$strip>;
 /**
  * Phase of an orchestration/provisioning log line. Mirrors the phases the
@@ -486,67 +446,6 @@ export declare const cacheStatsSchema: z.ZodObject<{
     hit: z.ZodBoolean;
 }, z.core.$strip>;
 export type CacheStats = z.infer<typeof cacheStatsSchema>;
-/**
- * Runtime broadcast of an updated dashboard-write policy. Carries the
- * orch's full capabilities object (same shape as `orchCapabilitiesSchema`
- * via `auth.request`) so Platform's per-org cache can be replaced
- * wholesale rather than merged. Emitted by the orch whenever an
- * operator flips a switch via `kici-admin org-settings dashboard-writes`;
- * Platform receives it, updates its cache, and re-broadcasts the
- * relevant subset to any connected dashboard SPA sessions.
- */
-export declare const orchCapabilitiesUpdateSchema: z.ZodObject<{
-    type: z.ZodLiteral<"orch.capabilities.update">;
-    capabilities: z.ZodObject<{
-        orchRole: z.ZodOptional<z.ZodEnum<{
-            coordinator: "coordinator";
-            worker: "worker";
-        }>>;
-        dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
-            "attestations.retry": "attestations.retry";
-            "backends.sync": "backends.sync";
-            "backends.sync_one": "backends.sync_one";
-            "backends.test": "backends.test";
-            "contexts.bindings.set": "contexts.bindings.set";
-            "contexts.create": "contexts.create";
-            "contexts.delete": "contexts.delete";
-            "contexts.source_overrides.delete": "contexts.source_overrides.delete";
-            "contexts.source_overrides.set": "contexts.source_overrides.set";
-            "contexts.test_access.set": "contexts.test_access.set";
-            "contexts.update": "contexts.update";
-            "event_dlq.discard": "event_dlq.discard";
-            "event_dlq.retry": "event_dlq.retry";
-            "fleet.host.declare": "fleet.host.declare";
-            "fleet.host.remove": "fleet.host.remove";
-            "global_workflows.update": "global_workflows.update";
-            "held_runs.approve": "held_runs.approve";
-            "held_runs.reject": "held_runs.reject";
-            "registration.delete": "registration.delete";
-            "registration.disable": "registration.disable";
-            "secrets.delete": "secrets.delete";
-            "secrets.scope.create": "secrets.scope.create";
-            "secrets.scope.delete": "secrets.scope.delete";
-            "secrets.scope.rename": "secrets.scope.rename";
-            "secrets.set": "secrets.set";
-            "variables.delete": "variables.delete";
-            "variables.set": "variables.set";
-        }> & z.core.$partial, z.ZodEnum<{
-            disabled: "disabled";
-            encrypted: "encrypted";
-            permissive: "permissive";
-        }>>>;
-        supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
-            kty: z.ZodLiteral<"OKP">;
-            crv: z.ZodLiteral<"X25519">;
-            x: z.ZodString;
-            kid: z.ZodString;
-            use: z.ZodOptional<z.ZodLiteral<"enc">>;
-        }, z.core.$loose>>;
-        dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, z.core.$loose>;
-}, z.core.$strip>;
-export type OrchCapabilitiesUpdate = z.infer<typeof orchCapabilitiesUpdateSchema>;
 /** All messages that flow from Platform to Orchestrator.
  *
  * The single-frame `webhookRelaySchema` is intentionally NOT a member of this
@@ -587,8 +486,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
             hold: "hold";
             ignore: "ignore";
         }>;
-        approvalExpiryHours: z.ZodNumber;
-        approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
+        approvalExpirySeconds: z.ZodNumber;
     }, z.core.$strict>;
     identityLinks: z.ZodArray<z.ZodObject<{
         userId: z.ZodString;
@@ -630,9 +528,9 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"auth.success">;
     connectionId: z.ZodString;
-    orgPublicAlias: z.ZodOptional<z.ZodString>;
-    orgId: z.ZodOptional<z.ZodString>;
-    provenanceIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    orgPublicAlias: z.ZodString;
+    orgId: z.ZodString;
+    githubWebhookUrl: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"auth.failure">;
     reason: z.ZodString;
@@ -670,9 +568,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"platform.capabilities">;
-    capabilities: z.ZodObject<{
-        orchMetrics: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>;
+    capabilities: z.ZodObject<{}, z.core.$loose>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"plan.headroom">;
     maxWorkerPeers: z.ZodNumber;
@@ -1124,7 +1020,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         component: z.ZodString;
     }, z.core.$strip>], "type">;
     runId: z.ZodString;
-    routingKey: z.ZodOptional<z.ZodString>;
+    routingKey: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"run.manual_schedule.request">;
     requestId: z.ZodString;
@@ -2961,6 +2857,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "db.create_role": "db.create_role";
         "db.ensure": "db.ensure";
         "db.fresh": "db.fresh";
+        "db.migrate": "db.migrate";
         "db.refresh_collation_version": "db.refresh_collation_version";
         "db.reindex": "db.reindex";
         "diagnostics.read": "diagnostics.read";
@@ -3004,6 +2901,7 @@ export declare const platformToOrchestratorMessageSchema: z.ZodDiscriminatedUnio
         "scaler.capacity.read": "scaler.capacity.read";
         "scaler.orphan.stop": "scaler.orphan.stop";
         "scaler.orphans.read": "scaler.orphans.read";
+        "scaler.reload": "scaler.reload";
         "secret.delete": "secret.delete";
         "secret.list.read": "secret.list.read";
         "secret.reveal": "secret.reveal";
@@ -3271,13 +3169,13 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     type: z.ZodLiteral<"webhook.ack">;
     messageId: z.ZodString;
     deliveryId: z.ZodString;
-    result: z.ZodOptional<z.ZodEnum<{
+    result: z.ZodEnum<{
         accepted: "accepted";
         rejected_misconfigured: "rejected_misconfigured";
         rejected_signature: "rejected_signature";
         rejected_unknown_source: "rejected_unknown_source";
         shed_retry_later: "shed_retry_later";
-    }>>;
+    }>;
     reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"execution.event">;
@@ -3299,10 +3197,10 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     stepIndex: z.ZodNumber;
     lines: z.ZodArray<z.ZodString>;
     timestamp: z.ZodNumber;
-    stream: z.ZodOptional<z.ZodEnum<{
+    stream: z.ZodEnum<{
         stderr: "stderr";
         stdout: "stdout";
-    }>>;
+    }>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"orch-log.chunk">;
     runId: z.ZodString;
@@ -3382,7 +3280,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
         step_failure: "step_failure";
         timed_out: "timed_out";
     }>>;
-    statusEpoch: z.ZodOptional<z.ZodNumber>;
+    statusEpoch: z.ZodNumber;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"step.status.forward">;
     messageId: z.ZodString;
@@ -3504,7 +3402,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             step_failure: "step_failure";
             timed_out: "timed_out";
         }>>;
-        statusEpoch: z.ZodOptional<z.ZodNumber>;
+        statusEpoch: z.ZodNumber;
         jobs: z.ZodArray<z.ZodObject<{
             jobId: z.ZodString;
             jobName: z.ZodString;
@@ -3522,10 +3420,10 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"orch.capabilities.update">;
     capabilities: z.ZodObject<{
-        orchRole: z.ZodOptional<z.ZodEnum<{
+        orchRole: z.ZodEnum<{
             coordinator: "coordinator";
             worker: "worker";
-        }>>;
+        }>;
         dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
@@ -3559,7 +3457,6 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             encrypted: "encrypted";
             permissive: "permissive";
         }>>>;
-        supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;
             crv: z.ZodLiteral<"X25519">;
@@ -3639,11 +3536,11 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
     type: z.ZodLiteral<"auth.request">;
     token: z.ZodString;
     protocolVersion: z.ZodNumber;
-    capabilities: z.ZodOptional<z.ZodObject<{
-        orchRole: z.ZodOptional<z.ZodEnum<{
+    capabilities: z.ZodObject<{
+        orchRole: z.ZodEnum<{
             coordinator: "coordinator";
             worker: "worker";
-        }>>;
+        }>;
         dashboardWrites: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             "attestations.retry": "attestations.retry";
             "backends.sync": "backends.sync";
@@ -3677,7 +3574,6 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             encrypted: "encrypted";
             permissive: "permissive";
         }>>>;
-        supportedDashboardRequests: z.ZodOptional<z.ZodArray<z.ZodString>>;
         dashboardEncryptionKey: z.ZodOptional<z.ZodObject<{
             kty: z.ZodLiteral<"OKP">;
             crv: z.ZodLiteral<"X25519">;
@@ -3686,7 +3582,7 @@ export declare const orchestratorToPlatformMessageSchema: z.ZodDiscriminatedUnio
             use: z.ZodOptional<z.ZodLiteral<"enc">>;
         }, z.core.$loose>>;
         dashboardVerifiedIssuer: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    }, z.core.$loose>>;
+    }, z.core.$loose>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"heartbeat">;
     timestamp: z.ZodNumber;
@@ -3808,7 +3704,6 @@ export declare const ORCH_TO_PLATFORM_RECOGNIZED_TYPES: ReadonlySet<string>;
 export declare const PLATFORM_TO_ORCH_RECOGNIZED_TYPES: ReadonlySet<string>;
 export type WebhookRelay = z.infer<typeof webhookRelaySchema>;
 export type WebhookAck = z.infer<typeof webhookAckSchema>;
-export type ExecutionEvent = z.infer<typeof executionEventSchema>;
 export type LogChunk = z.infer<typeof logChunkSchema>;
 export type PeerDiscover = z.infer<typeof peerDiscoverSchema>;
 export type PeerUpdate = z.infer<typeof peerUpdateSchema>;