@kici-dev/engine 0.4.0 → 0.6.0

package/dist/protocol/messages/execution-status.js

@@ -58,6 +58,17 @@ const ExecutionJobStatus = z.enum([
 	"unroutable"
 ]);
 /**
+* Job kind on the wire. `standard` runs steps on an agent; `gate` is an invoke
+* gate that summons source-repo runs instead of running steps; `proxy` mirrors
+* one summoned run's lifecycle. The orchestrator's DB `JobKind` enum mirrors
+* these members.
+*/
+const JobKind = z.enum([
+	"standard",
+	"gate",
+	"proxy"
+]);
+/**
 * The status values a notification subscription may target at the given level.
 *
 * A run-level subscription matches against an `ExecutionRunStatus`; a job-level
@@ -164,6 +175,27 @@ const RunFailureClass = z.enum([
 * dashboard can render it inline alongside the real steps.
 */
 const CacheStepType = z.enum(["cache:restore", "cache:save"]);
+/**
+* `step_type` values for pseudo-steps that run BEFORE a job's real steps.
+*
+* A run's step timeline is ordered by `step_index`, and every pseudo-step index
+* sits ABOVE the real steps (the wire schema requires a non-negative index, and
+* the in-sandbox allocators claim a high block). That is fine for the cache
+* pseudo-steps, which mostly bracket the work — but a job's image build runs
+* strictly first, and rendering it last reads as though it happened last.
+*
+* A reader therefore sorts these types ahead of everything else, by TYPE rather
+* than by index. Keeping the ordering rule here — rather than as a negative
+* index — is deliberate: `step.status` rejects a negative index outright, so an
+* agent that sent one to an older orchestrator would have its connection closed
+* mid-job, and two consumers (the check-run reporter's array write, the
+* dashboard's `stepIndex >= 0` log gate) treat a negative index as absent.
+*/
+const SetupStepType = z.enum(["container:build"]);
+/** True when a `step_type` names a pseudo-step that ran before the real steps. */
+function isSetupStepType(stepType) {
+	return stepType != null && SetupStepType.safeParse(stepType).success;
+}
 /** `run.event` types emitted for user-facing cache operations. */
 const CacheRunEventType = z.enum(["cache.restore", "cache.save"]);
 /**
@@ -239,6 +271,26 @@ const executionStatusSchema = z.object({
 	routingKey: z.string().max(128).optional(),
 	repoIdentifier: z.string().max(256).optional(),
 	/**
+	* The repository that DEFINES the workflow, when that is not
+	* `repoIdentifier` — a global workflow authored in one repository and
+	* dispatched against another. Absent for every per-repository run, where the
+	* two are the same repository, so "present" is a precise marker for a
+	* cross-repository global run. Optional for backward compatibility with an
+	* older orchestrator that never sends it.
+	*/
+	workflowRepoIdentifier: z.string().max(256).optional(),
+	/**
+	* True when this run records a global evaluation round rather than a
+	* workflow.
+	*
+	* The Platform mirrors it so its own re-run refusal can admit a round: a
+	* round is definitionally cross-repository, and re-running one re-evaluates
+	* the original event instead of resolving a workflow out of the acted-on
+	* repository's lock file. Absent means an ordinary run — optional for
+	* backward compatibility with an orchestrator that never sends it.
+	*/
+	isGlobalEvalRound: z.boolean().optional(),
+	/**
 	* Run-level repo provider (origin host: `github` / `gitlab` / `bitbucket` /
 	* `local`). Distinct from the routing-key-derived source provider; drives the
 	* dashboard's provider-aware repo links.
@@ -342,7 +394,15 @@ const jobStatusForwardSchema = z.object({
 	logBytes: z.number().int().nonnegative().optional(),
 	timestamp: z.number(),
 	/** Structured init-failure signal — set for synthetic rejected-* / init-failed-* jobs. */
-	initFailure: initFailureSchema.optional()
+	initFailure: initFailureSchema.optional(),
+	/**
+	* Job kind. Absent means an ordinary `standard` job. `gate`/`proxy` mark an
+	* invoke gate and its per-run proxy children. Additive/optional — an older
+	* peer ignores it.
+	*/
+	jobKind: JobKind.optional(),
+	/** For a `proxy` job, the summoned run it mirrors. Additive/optional. */
+	summonedRunId: z.string().max(128).optional()
 });
 /** State replay sent on orchestrator reconnection -- full snapshot of active runs and jobs. */
 /**
@@ -359,6 +419,13 @@ const stateReplayRunSchema = z.object({
 	status: ExecutionRunStatus,
 	routingKey: z.string().max(128).optional(),
 	repoIdentifier: z.string().max(256).optional(),
+	/**
+	* The repository that DEFINES the workflow, when that is not
+	* `repoIdentifier`. Same meaning and same absent-for-per-repository-runs
+	* contract as on `execution.status`; carried here so a run that reaches the
+	* Platform only through the reconnect replay keeps its attribution.
+	*/
+	workflowRepoIdentifier: z.string().max(256).optional(),
 	sha: z.string().max(128).optional(),
 	ref: z.string().max(128).optional(),
 	triggerEvent: z.string().max(128).optional(),
@@ -395,6 +462,6 @@ const stateReplaySchema = z.object({
 	timestamp: z.number()
 });
 //#endregion
-export { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema };
+export { CONTEXTS_MAX, CacheOutcome, CacheRunEventType, CacheStepType, DEAD_ORCH_FAILURE_REASON, ExecutionJobStatus, ExecutionRunStatus, ExecutionStepStatus, InitFailureCategory, JobKind, MAX_JOBS_PER_RUN, REPO_IDENTIFIER_MAX, RUNS_ON_LABELS_MAX, RunFailureClass, STATE_REPLAY_MAX_RUNS, STATUS_FREE_TEXT_MAX, STATUS_ID_MAX, SetupStepType, StepConcurrencyKind, TERMINAL_JOB_STATES, TERMINAL_RUN_STATES, TERMINAL_STEP_STATES, TimeoutReason, executionStatusSchema, initFailureSchema, isSetupStepType, jobStatusForwardSchema, stateReplayRunSchema, stateReplaySchema, statusOptionsForLevel, stepStatusForwardSchema };
 
 //# sourceMappingURL=execution-status.js.map

package/dist/protocol/messages/git-credential-relay.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Agent → orchestrator relay for git credentials.
+ *
+ * The agent's credential helper calls this on every git network operation, so
+ * a token is always minted seconds before use — which is what defeats the
+ * one-hour GitHub App installation-token expiry for arbitrarily long jobs.
+ *
+ * Mirrors the browser-safe types in `provider/git-credential.ts`; this module
+ * is the validating half and is the only one that imports Zod.
+ */
+import { z } from 'zod';
+/** Method name on the agent private API registry. */
+export declare const GIT_CREDENTIAL_REQUEST_METHOD = "git.credential.request";
+export declare const gitCredentialRefSchema: z.ZodUnion<readonly [z.ZodIntersection<z.ZodIntersection<z.ZodIntersection<z.ZodObject<{
+    kind: z.ZodLiteral<"app">;
+}, z.core.$strip>, z.ZodObject<{
+    [x: string]: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>, z.ZodObject<{
+    [x: string]: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>, z.ZodObject<{
+    [x: string]: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>, z.ZodIntersection<z.ZodObject<{
+    kind: z.ZodLiteral<"token">;
+    user: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    [x: string]: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>, z.ZodIntersection<z.ZodObject<{
+    kind: z.ZodLiteral<"ssh">;
+}, z.core.$strip>, z.ZodObject<{
+    [x: string]: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>>]>;
+export declare const gitCredentialRequestParamsSchema: z.ZodObject<{
+    jobId: z.ZodString;
+    repositories: z.ZodArray<z.ZodString>;
+    ref: z.ZodOptional<z.ZodUnion<readonly [z.ZodIntersection<z.ZodIntersection<z.ZodIntersection<z.ZodObject<{
+        kind: z.ZodLiteral<"app">;
+    }, z.core.$strip>, z.ZodObject<{
+        [x: string]: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>, z.ZodObject<{
+        [x: string]: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>, z.ZodObject<{
+        [x: string]: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>, z.ZodIntersection<z.ZodObject<{
+        kind: z.ZodLiteral<"token">;
+        user: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        [x: string]: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>, z.ZodIntersection<z.ZodObject<{
+        kind: z.ZodLiteral<"ssh">;
+    }, z.core.$strip>, z.ZodObject<{
+        [x: string]: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>]>>;
+    permissions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type GitCredentialRequestParams = z.infer<typeof gitCredentialRequestParamsSchema>;
+export declare const gitCredentialGrantSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    scoped: z.ZodLiteral<false>;
+}, z.core.$strip>, z.ZodObject<{
+    scoped: z.ZodLiteral<true>;
+    permissions: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>], "scoped">;
+export declare const gitCredentialResultSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        basic: "basic";
+        ssh: "ssh";
+    }>;
+    user: z.ZodOptional<z.ZodString>;
+    secret: z.ZodString;
+    grant: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        scoped: z.ZodLiteral<false>;
+    }, z.core.$strip>, z.ZodObject<{
+        scoped: z.ZodLiteral<true>;
+        permissions: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>], "scoped">;
+    expiresAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type GitCredentialRelayResult = z.infer<typeof gitCredentialResultSchema>;
+//# sourceMappingURL=git-credential-relay.d.ts.map

package/dist/protocol/messages/git-credential-relay.js

@@ -0,0 +1,86 @@
+import "../../rolldown-runtime-ClRpJifh.js";
+import { z } from "zod";
+//#region src/protocol/messages/git-credential-relay.ts
+/**
+* Agent → orchestrator relay for git credentials.
+*
+* The agent's credential helper calls this on every git network operation, so
+* a token is always minted seconds before use — which is what defeats the
+* one-hour GitHub App installation-token expiry for arbitrarily long jobs.
+*
+* Mirrors the browser-safe types in `provider/git-credential.ts`; this module
+* is the validating half and is the only one that imports Zod.
+*/
+/** Method name on the agent private API registry. */
+const GIT_CREDENTIAL_REQUEST_METHOD = "git.credential.request";
+/**
+* A repository must be named explicitly — no wildcards, no "every repo in the
+* installation". A write grant is therefore always a specific repository
+* written down in the workflow source and reviewable in a diff.
+*/
+const repositorySchema = z.string().min(1).max(512).refine((v) => !v.includes("*") && !v.includes("?"), { message: "repository must be explicit — wildcards are not accepted" });
+/**
+* Requested permissions.
+*
+* Deliberate carve-out from the enums-over-hardcoded-strings rule: GitHub adds
+* permissions over time, and a closed enum would mean a permission GitHub
+* shipped yesterday needs an SDK release before anyone can use it. Known keys
+* are typed in the SDK for autocomplete; here they pass through verbatim for
+* the forge itself to accept or reject.
+*/
+const permissionsSchema = z.record(z.string().min(1), z.string().min(1));
+/**
+* Exactly one of `<name>Secret` / `<name>Value` per pair.
+*
+* `*Secret` is a qualified `<context>:<secret-name>` reference — the same form
+* `packages/sdk/src/workflow.ts` validates with `isQualifiedSecretRef` — so the
+* context travels with the reference and nothing has to infer a scope.
+* `*Value` is material supplied at runtime.
+*/
+function sourced(name) {
+	const qualified = z.string().min(1).refine((v) => {
+		const i = v.indexOf(":");
+		return i > 0 && i < v.length - 1 && !v.slice(i + 1).includes(":");
+	}, { message: `${name}Secret must be a qualified <context>:<secret-name> reference` }).refine((v) => !v.startsWith("-----BEGIN") && !/^gh[pousr]_/.test(v) && !v.startsWith("github_pat_"), { message: `${name}Secret looks like the credential itself, not the name of a secret holding it. Use ${name}Value if you genuinely have runtime material.` });
+	return z.object({
+		[`${name}Secret`]: qualified.optional(),
+		[`${name}Value`]: z.string().min(1).optional()
+	}).refine((o) => Boolean(o[`${name}Secret`]) !== Boolean(o[`${name}Value`]), { message: `exactly one of ${name}Secret or ${name}Value must be set` });
+}
+const gitCredentialRefSchema = z.union([
+	z.object({ kind: z.literal("app") }).and(sourced("appId")).and(sourced("installationId")).and(sourced("privateKey")),
+	z.object({
+		kind: z.literal("token"),
+		user: z.string().optional()
+	}).and(sourced("token")),
+	z.object({ kind: z.literal("ssh") }).and(sourced("privateKey"))
+]);
+const gitCredentialRequestParamsSchema = z.object({
+	jobId: z.string().min(1),
+	/**
+	* Every repository the credential must cover, most-specific first.
+	*
+	* A list rather than one name because a GitHub App token is minted per
+	* installation and can name several repositories at once — which is the
+	* point of `getToken({ repositories })`. The credential helper, which is
+	* asked about one URL at a time, sends a one-element list.
+	*/
+	repositories: z.array(repositorySchema).min(1),
+	ref: gitCredentialRefSchema.optional(),
+	permissions: permissionsSchema.optional()
+});
+const gitCredentialGrantSchema = z.discriminatedUnion("scoped", [z.object({ scoped: z.literal(false) }), z.object({
+	scoped: z.literal(true),
+	permissions: permissionsSchema
+})]);
+const gitCredentialResultSchema = z.object({
+	kind: z.enum(["basic", "ssh"]),
+	user: z.string().optional(),
+	secret: z.string(),
+	grant: gitCredentialGrantSchema,
+	expiresAt: z.string().nullable()
+});
+//#endregion
+export { GIT_CREDENTIAL_REQUEST_METHOD, gitCredentialGrantSchema, gitCredentialRefSchema, gitCredentialRequestParamsSchema, gitCredentialResultSchema };
+
+//# sourceMappingURL=git-credential-relay.js.map

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type { LockJob } from '../../trigger/types.js';
 /**
  * Cache write scope for a job's user-facing cache.
  *
@@ -24,7 +25,17 @@ export type CacheRefScope = z.infer<typeof CacheRefScope>;
  * - `groups` maps a dynamic group name to its ordered member job names.
  * - `statuses` maps an upstream job name to its terminal status, so the
  *   generator's `ctx.needs.<job>.status` reflects the frozen upstream outcome.
+ * - `invokeResults` maps an invoke-gate job name to its ordered per-run results,
+ *   so the generator's `ctx.needs.<gate>.result` reflects each summoned run.
  */
+export declare const invokeResultSchema: z.ZodObject<{
+    repo: z.ZodString;
+    workflow: z.ZodString;
+    runId: z.ZodString;
+    status: z.ZodString;
+    outputs: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export type InvokeResult = z.infer<typeof invokeResultSchema>;
 export declare const upstreamSnapshotSchema: z.ZodObject<{
     jobs: z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     groups: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
@@ -42,6 +53,13 @@ export declare const upstreamSnapshotSchema: z.ZodObject<{
         timed_out_stale: "timed_out_stale";
         unroutable: "unroutable";
     }>>>;
+    invokeResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        repo: z.ZodString;
+        workflow: z.ZodString;
+        runId: z.ZodString;
+        status: z.ZodString;
+        outputs: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>>>;
 }, z.core.$strip>;
 export type UpstreamSnapshot = z.infer<typeof upstreamSnapshotSchema>;
 /**
@@ -110,6 +128,13 @@ export declare const jobDispatchSchema: z.ZodObject<{
         timed_out_stale: "timed_out_stale";
         unroutable: "unroutable";
     }>>>;
+    upstreamInvokeResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        repo: z.ZodString;
+        workflow: z.ZodString;
+        runId: z.ZodString;
+        status: z.ZodString;
+        outputs: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>>>;
     sourceAuth: z.ZodOptional<z.ZodObject<{
         kind: z.ZodEnum<{
             basic: "basic";
@@ -142,6 +167,11 @@ export declare const jobDispatchSchema: z.ZodObject<{
         alwaysAuth: z.ZodBoolean;
         token: z.ZodString;
     }, z.core.$strip>>>;
+    containerRegistryAuth: z.ZodOptional<z.ZodObject<{
+        username: z.ZodString;
+        password: z.ZodString;
+        serveraddress: z.ZodString;
+    }, z.core.$strip>>;
     installEnvSecrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     orgId: z.ZodOptional<z.ZodString>;
     repoId: z.ZodOptional<z.ZodString>;
@@ -166,6 +196,7 @@ export declare const registerAckSchema: z.ZodObject<{
     labels: z.ZodArray<z.ZodString>;
     scalerManaged: z.ZodDefault<z.ZodBoolean>;
     pendingDispatch: z.ZodOptional<z.ZodBoolean>;
+    warmPool: z.ZodOptional<z.ZodBoolean>;
     capabilities: z.ZodOptional<z.ZodObject<{
         artifactCompleteAck: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
@@ -232,6 +263,54 @@ export declare const jobStatusSchema: z.ZodObject<{
         encrypted: z.ZodString;
     }, z.core.$strip>>>;
 }, z.core.$strip>;
+/**
+ * One candidate workflow's verdict from the pre-run global eval round — the
+ * job the agent runs once per (event × workflow repo) before any run row
+ * exists, evaluating each candidate's `filter` and then its `DynamicJobFn`s on
+ * a single dual checkout.
+ *
+ * `jobs` carries `LockJob[]` as an unvalidated pass-through, the same shape and
+ * for the same reason as `jobDispatchSchema.jobConfig`: the lock-file job shape
+ * has no Zod mirror anywhere in this package, its single source of truth is the
+ * `LockJob` interface in `trigger/types.ts`, and a hand-written Zod copy would
+ * drift and start rejecting legitimate generated jobs.
+ *
+ * Every field beyond the verdict itself is `.optional()` so an older peer
+ * tolerates the message unchanged.
+ */
+export declare const globalEvalCandidateResultSchema: z.ZodObject<{
+    workflowName: z.ZodString;
+    run: z.ZodBoolean;
+    jobs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    indeterminate: z.ZodOptional<z.ZodBoolean>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/** Every candidate's verdict from one global eval round, in candidate order. */
+export declare const globalEvalRoundResultSchema: z.ZodObject<{
+    candidates: z.ZodArray<z.ZodObject<{
+        workflowName: z.ZodString;
+        run: z.ZodBoolean;
+        jobs: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+        indeterminate: z.ZodOptional<z.ZodBoolean>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Typed view of {@link globalEvalCandidateResultSchema}. Declared rather than
+ * inferred so `jobs` is the real `LockJob[]` on both sides of the wire; the Zod
+ * schema stays the loose validator (see its doc comment).
+ */
+export interface GlobalEvalCandidateResult {
+    workflowName: string;
+    run: boolean;
+    jobs?: LockJob[];
+    indeterminate?: boolean;
+    reason?: string;
+}
+/** Typed view of {@link globalEvalRoundResultSchema}. */
+export interface GlobalEvalRoundResult {
+    candidates: GlobalEvalCandidateResult[];
+}
 /** Reasons an agent can refuse a job.dispatch. */
 export declare const JobRejectReason: z.ZodEnum<{
     busy: "busy";
@@ -597,6 +676,35 @@ export declare const eventEmitResponseSchema: z.ZodObject<{
     deliveryId: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * Agent -> Orchestrator: exchanges a single-use claim code (delivered on a
+ * `kici.scaler.scale-up` event) for freshly minted ephemeral agent credentials.
+ * A provisioned agent normally sends this itself to self-bootstrap — the claim
+ * code is the authorization, so it may send it before it authenticates or
+ * registers. A provisioning workflow can also send it to obtain the token
+ * directly. Additive/negotiated by presence — older peers that never emit it
+ * are unaffected, so it needs no `PROTOCOL_VERSION` bump of its own.
+ */
+export declare const scalerClaimCredentialsSchema: z.ZodObject<{
+    type: z.ZodLiteral<"scaler.claim-credentials">;
+    requestId: z.ZodString;
+    claimCode: z.ZodString;
+}, z.core.$strip>;
+/**
+ * Orchestrator -> Agent: minted ephemeral credentials for a claimed provision,
+ * or an error. The token appears only here — never in the persisted event log.
+ */
+export declare const scalerClaimCredentialsResponseSchema: z.ZodObject<{
+    type: z.ZodLiteral<"scaler.claim-credentials.response">;
+    requestId: z.ZodString;
+    credentials: z.ZodOptional<z.ZodObject<{
+        agentToken: z.ZodString;
+        agentId: z.ZodString;
+        orchestratorUrl: z.ZodString;
+        labels: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
 /** Periodic metrics push from agent to orchestrator. */
 export declare const agentMetricsSchema: z.ZodObject<{
     type: z.ZodLiteral<"agent.metrics">;
@@ -781,6 +889,13 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
         timed_out_stale: "timed_out_stale";
         unroutable: "unroutable";
     }>>>;
+    upstreamInvokeResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        repo: z.ZodString;
+        workflow: z.ZodString;
+        runId: z.ZodString;
+        status: z.ZodString;
+        outputs: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>>>>;
     sourceAuth: z.ZodOptional<z.ZodObject<{
         kind: z.ZodEnum<{
             basic: "basic";
@@ -813,6 +928,11 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
         alwaysAuth: z.ZodBoolean;
         token: z.ZodString;
     }, z.core.$strip>>>;
+    containerRegistryAuth: z.ZodOptional<z.ZodObject<{
+        username: z.ZodString;
+        password: z.ZodString;
+        serveraddress: z.ZodString;
+    }, z.core.$strip>>;
     installEnvSecrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     orgId: z.ZodOptional<z.ZodString>;
     repoId: z.ZodOptional<z.ZodString>;
@@ -833,6 +953,7 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     labels: z.ZodArray<z.ZodString>;
     scalerManaged: z.ZodDefault<z.ZodBoolean>;
     pendingDispatch: z.ZodOptional<z.ZodBoolean>;
+    warmPool: z.ZodOptional<z.ZodBoolean>;
     capabilities: z.ZodOptional<z.ZodObject<{
         artifactCompleteAck: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$loose>>;
@@ -907,6 +1028,16 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     requestId: z.ZodString;
     deliveryId: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"scaler.claim-credentials.response">;
+    requestId: z.ZodString;
+    credentials: z.ZodOptional<z.ZodObject<{
+        agentToken: z.ZodString;
+        agentId: z.ZodString;
+        orchestratorUrl: z.ZodString;
+        labels: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"agent.api.response">;
     requestId: z.ZodString;
@@ -1088,6 +1219,7 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     lockfileHash: z.ZodOptional<z.ZodString>;
     platform: z.ZodString;
     arch: z.ZodString;
+    depsHash: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"cache.upload.complete">;
     messageId: z.ZodString;
@@ -1177,6 +1309,10 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     target: z.ZodOptional<z.ZodObject<{
         repos: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"scaler.claim-credentials">;
+    requestId: z.ZodString;
+    claimCode: z.ZodString;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"agent.api.request">;
     requestId: z.ZodString;
@@ -1263,6 +1399,8 @@ export type ArtifactsDownloadResponse = z.infer<typeof artifactsDownloadResponse
 export type FleetLogsRequest = z.infer<typeof fleetLogsRequestSchema>;
 export type FleetBundleChunk = z.infer<typeof fleetBundleChunkSchema>;
 export type FleetBundleError = z.infer<typeof fleetBundleErrorSchema>;
+export type ScalerClaimCredentials = z.infer<typeof scalerClaimCredentialsSchema>;
+export type ScalerClaimCredentialsResponse = z.infer<typeof scalerClaimCredentialsResponseSchema>;
 export type OrchestratorToAgentMessage = z.infer<typeof orchestratorToAgentMessageSchema>;
 export type AgentToOrchestratorMessage = z.infer<typeof agentToOrchestratorMessageSchema>;
 //# sourceMappingURL=orchestrator-agent.d.ts.map