@kici-dev/orchestrator 0.15.0 → 0.16.0

package/dist/routes/admin-orchestrator-drain.d.ts

@@ -14,22 +14,15 @@
 import { Hono } from 'hono';
 import { z } from 'zod';
 import type { DrainController } from '../drain/drain-controller.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export declare const DrainActionSchema: z.ZodEnum<{
     drain: "drain";
     resume: "resume";
 }>;
 export type DrainAction = z.infer<typeof DrainActionSchema>;
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createOrchestratorDrainRoutes(deps: {
     drainController: DrainController;
     rbac: RbacEnforcer;
 }): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-orchestrator-drain.d.ts.map

package/dist/routes/admin-org-settings.d.ts

@@ -14,8 +14,9 @@ import { type Kysely } from 'kysely';
 import { type OrchestratorMode } from '@kici-dev/engine';
 import { DashboardWriteOperation } from '@kici-dev/engine/protocol/dashboard-write-operations';
 import type { Database } from '../db/types.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
+import { type AdminEnv } from './admin-env.js';
 interface OrgSettingsRouteDeps {
     db: Kysely<Database>;
     rbac: RbacEnforcer;
@@ -40,13 +41,6 @@ interface OrgSettingsRouteDeps {
      */
     accessLog?: AccessLogWriter;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createOrgSettingsRoutes(deps: OrgSettingsRouteDeps): Hono<AdminEnv>;
 export { DashboardWriteOperation };
 //# sourceMappingURL=admin-org-settings.d.ts.map

package/dist/routes/admin-orgs.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Admin API route listing the org ids this orchestrator holds data for.
+ *
+ *   GET /api/v1/admin/org-ids → `OrgListResponse`: every org id the configuration
+ *   and anchor tables name, each with the data that names it, plus the live
+ *   Platform attachment (`attached` / `pending` / `none`).
+ *
+ * Backs `kici-admin org list` and the `Org:` line of `kici-admin orchestrator
+ * status`. The listing spans every org, so the route requires an unscoped token
+ * and `secret.read`, like the other read-only inspection routes.
+ */
+import { Hono } from 'hono';
+import { type HeldOrg } from '../db/repos/org-ids-repo.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
+export interface AdminOrgRoutesDeps {
+    /** The org ids the database holds (`listHeldOrgIds` bound to the orchestrator DB). */
+    listOrgs: () => Promise<HeldOrg[]>;
+    rbac: RbacEnforcer;
+    /**
+     * The org the Platform named on `auth.success`; `undefined` before the first
+     * authentication. Absent when no Platform client runs (independent mode).
+     */
+    getPlatformOrgId?: () => string | undefined;
+}
+export declare function createAdminOrgRoutes(deps: AdminOrgRoutesDeps): Hono<AdminEnv>;
+//# sourceMappingURL=admin-orgs.d.ts.map

package/dist/routes/admin-peer-forget.d.ts

@@ -16,14 +16,8 @@
 import { Hono } from 'hono';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import { type PeerForgetResult } from '../cluster/peer-forget.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 /** What the route needs from the coordinator it runs on. */
 export interface PeerForgetRouteDeps {
     /**
@@ -39,5 +33,4 @@ export declare function createPeerForgetRoutes(deps: {
     rbac: RbacEnforcer;
     accessLog?: AccessLogWriter;
 }): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-peer-forget.d.ts.map

package/dist/routes/admin-queue-execution.d.ts

@@ -11,18 +11,11 @@
  */
 import { Hono } from 'hono';
 import { type Kysely } from 'kysely';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminQueueExecutionRoutesDeps {
     db: Kysely<any>;
     rbac: RbacEnforcer;
 }
-type AdminQEEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
-export declare function createAdminQueueExecutionRoutes(deps: AdminQueueExecutionRoutesDeps): Hono<AdminQEEnv>;
-export {};
+export declare function createAdminQueueExecutionRoutes(deps: AdminQueueExecutionRoutesDeps): Hono<AdminEnv>;
 //# sourceMappingURL=admin-queue-execution.d.ts.map

package/dist/routes/admin-registrations.d.ts

@@ -9,11 +9,9 @@ import { Hono } from 'hono';
 import type { RegistrationStore } from '../registration/registration-store.js';
 import type { RegistrationIndex } from '../registration/registration-index.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { ContextStore } from '../contexts/context-store.js';
-/**
- * Dependencies for admin registration routes.
- */
+import { type AdminEnv } from './admin-env.js';
 export interface AdminRegistrationRoutesDeps {
     registrationStore: RegistrationStore;
     registrationIndex: RegistrationIndex;
@@ -27,20 +25,11 @@ export interface AdminRegistrationRoutesDeps {
      */
     contextStore?: Pick<ContextStore, 'matchContext'>;
 }
-/** Hono env type for admin registration routes with context variables. */
-type AdminRegEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * Create admin API routes for workflow registration management.
  *
  * @param deps - Admin registration route dependencies
  * @returns Hono app with registration routes mounted at /api/v1/admin/registrations
  */
-export declare function createAdminRegistrationRoutes(deps: AdminRegistrationRoutesDeps): Hono<AdminRegEnv>;
-export {};
+export declare function createAdminRegistrationRoutes(deps: AdminRegistrationRoutesDeps): Hono<AdminEnv>;
 //# sourceMappingURL=admin-registrations.d.ts.map

package/dist/routes/admin-runs.d.ts

@@ -22,10 +22,11 @@ import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
 import type { ResolvedMasterKeys } from '../secrets/config.js';
 import type { LogStorage } from '../reporting/log-storage.js';
+import { type AdminEnv } from './admin-env.js';
 /**
  * Statuses accepted by the `?status=` filter.
  *
@@ -35,9 +36,6 @@ import type { LogStorage } from '../reporting/log-storage.js';
  * an empty result into a rejected request.
  */
 export declare const RUN_STATUSES: ReadonlySet<string>;
-/**
- * Dependencies for admin run routes.
- */
 export interface AdminRunRoutesDeps {
     db: Kysely<Database>;
     tokenManager: TokenManager;
@@ -58,20 +56,11 @@ export interface AdminRunRoutesDeps {
      */
     logStorage?: LogStorage;
 }
-/** Hono env type for admin run routes with context variables. */
-type AdminRunEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * Create admin API routes for execution run inspection.
  *
  * @param deps - Admin run route dependencies
  * @returns Hono app with run routes mounted at /api/v1/admin/runs
  */
-export declare function createAdminRunRoutes(deps: AdminRunRoutesDeps): Hono<AdminRunEnv>;
-export {};
+export declare function createAdminRunRoutes(deps: AdminRunRoutesDeps): Hono<AdminEnv>;
 //# sourceMappingURL=admin-runs.d.ts.map

package/dist/routes/admin-scaler-orphans.d.ts

@@ -19,16 +19,10 @@
 import { Hono } from 'hono';
 import { type PeerScalerOrphansResponse } from '@kici-dev/engine';
 import type { AccessLogWriter } from '../audit/access-log.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import { type ScalerOrphansAnswer, type ScalerOrphansRequest } from '../scaler/orphan-requests.js';
 import { ScalerOrphansForwardFailure } from '../cluster/scaler-orphans-peer.js';
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
+import { type AdminEnv } from './admin-env.js';
 /** What the routes need from the coordinator they run on. */
 export interface ScalerOrphansRouteDeps {
     /** This coordinator's instance id. */
@@ -60,5 +54,4 @@ export declare function createScalerOrphansRoutes(deps: {
     rbac: RbacEnforcer;
     accessLog?: AccessLogWriter;
 }): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-scaler-orphans.d.ts.map

package/dist/routes/admin-scaler-reload.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Reload the scaler config, behind `kici-admin scaler reload`.
+ *
+ * Mounted inside `createAdminRoutes` at `/api/v1/admin`, so the Bearer-token
+ * auth middleware has already resolved the caller's role. Needs an unscoped
+ * token and the `scaler.manage` permission (owner, admin).
+ *
+ * - `POST /api/v1/admin/scaler/reload { single?, timeoutMs? }` — re-read the
+ *   scaler config on this orchestrator and, unless `single`, on every peer it
+ *   is connected to. Each orchestrator applies its own file completely or not
+ *   at all. Answers `{ scope, results }` with one result per instance, this
+ *   one first: `200` when no instance refused its file or went unanswered,
+ *   `422` otherwise.
+ *
+ * The route runs the scaler reload only: it does not reload the orchestrator
+ * config, so it never bumps the config version the peers follow, and a
+ * `single` reload stays on this orchestrator.
+ */
+import { Hono } from 'hono';
+import { type ScalerReloadInstanceResult } from '@kici-dev/engine';
+import type { AccessLogWriter } from '../audit/access-log.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
+/** What the route needs from the orchestrator it runs on. */
+export interface ScalerReloadRouteDeps {
+    /** This orchestrator's instance id, the audit row's target. */
+    instanceId: string;
+    /**
+     * Reload here and, unless `single`, on every connected peer, waiting
+     * `timeoutMs` for each peer. The first result is this orchestrator's.
+     */
+    reload: (single: boolean, timeoutMs: number) => Promise<ScalerReloadInstanceResult[]>;
+}
+/** How long the route waits for each peer by default. */
+export declare const DEFAULT_SCALER_RELOAD_TIMEOUT_MS = 60000;
+export declare function createScalerReloadRoutes(deps: {
+    scalerReload: ScalerReloadRouteDeps;
+    rbac: RbacEnforcer;
+    accessLog?: AccessLogWriter;
+}): Hono<AdminEnv>;
+//# sourceMappingURL=admin-scaler-reload.d.ts.map

package/dist/routes/admin-scheduled-jobs.d.ts

@@ -18,19 +18,12 @@ import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminScheduledJobsRoutesDeps {
     db: Kysely<Database>;
     tokenManager: TokenManager;
     rbac: RbacEnforcer;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createAdminScheduledJobsRoutes(deps: AdminScheduledJobsRoutesDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-scheduled-jobs.d.ts.map

package/dist/routes/admin-signing-keys.d.ts

@@ -16,18 +16,11 @@
 import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
 import type { Database } from '../db/types.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
+import { type AdminEnv } from './admin-env.js';
 export interface AdminSigningKeyRoutesDeps {
     db: Kysely<Database>;
     rbac: RbacEnforcer;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createAdminSigningKeyRoutes(deps: AdminSigningKeyRoutesDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin-signing-keys.d.ts.map

package/dist/routes/admin-sources.d.ts

@@ -11,9 +11,9 @@
 import { Hono } from 'hono';
 import type { SourceStore } from '../sources/source-store.js';
 import { type WebhookUrlResolution } from '../sources/webhook-url-resolvers.js';
-import type { Role } from '../secrets/rbac.js';
 import { type RedeliverWindowResult } from '../providers/github/deliveries.js';
 import { type FetchGithubAppIdentity, type FetchGithubAppInstallations } from '../github-app-name-refresher/github-app-name-refresher.js';
+import { type AdminEnv } from './admin-env.js';
 interface SourceRouteDeps {
     sourceStore: SourceStore;
     /**
@@ -72,13 +72,6 @@ export type RedeliverDeliveries = (app: {
     until: Date;
     dryRun?: boolean;
 }) => Promise<RedeliverWindowResult>;
-type AdminSourcesEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
-export declare function createSourceRoutes(deps: SourceRouteDeps): Hono<AdminSourcesEnv>;
+export declare function createSourceRoutes(deps: SourceRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-sources.d.ts.map

package/dist/routes/admin-trust-policy.d.ts

@@ -23,8 +23,9 @@ import { Hono } from 'hono';
 import type { OrchestratorMode } from '@kici-dev/engine';
 import type { TrustPolicyStore } from '../security/trust-policy-store.js';
 import type { TrustDirectoryStore } from '../security/trust-directory-store.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { AccessLogWriter } from '../audit/access-log.js';
+import { type AdminEnv } from './admin-env.js';
 /**
  * Wording for the Platform-managed refusal. Shared with the CLI through the
  * response body — the CLI surfaces this verbatim rather than inventing its own.
@@ -76,13 +77,6 @@ interface TrustPolicyRouteDeps {
      */
     accessLog: AccessLogWriter;
 }
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 export declare function createTrustPolicyRoutes(deps: TrustPolicyRouteDeps): Hono<AdminEnv>;
 export {};
 //# sourceMappingURL=admin-trust-policy.d.ts.map

package/dist/routes/admin.d.ts

@@ -10,7 +10,7 @@
  */
 import { Hono } from 'hono';
 import type { TokenManager } from '../secrets/token-manager.js';
-import type { RbacEnforcer, Role } from '../secrets/rbac.js';
+import type { RbacEnforcer } from '../secrets/rbac.js';
 import type { PgSecretStore } from '../secrets/pg-secret-store.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
 import type { AgentTokenStore } from '../agent/token-store.js';
@@ -21,6 +21,7 @@ import { type HeldRunReleaseWiring } from './admin-held-runs.js';
 import { type ClusterSettingsPropagationSource } from './admin-cluster-settings.js';
 import { type ScalerOrphansRouteDeps } from './admin-scaler-orphans.js';
 import { type PeerForgetRouteDeps } from './admin-peer-forget.js';
+import { type ScalerReloadRouteDeps } from './admin-scaler-reload.js';
 import type { DrainController } from '../drain/drain-controller.js';
 import type { SourceStore } from '../sources/source-store.js';
 import type { JoinTokenManager } from '../cluster/join-token.js';
@@ -31,9 +32,7 @@ import type { Kysely } from 'kysely';
 import type pg from 'pg';
 import type { AccessLogWriter } from '../audit/access-log.js';
 import type { WebhookUrlResolution } from '../sources/webhook-url-resolvers.js';
-/**
- * Dependencies for admin API routes.
- */
+import { type AdminEnv } from './admin-env.js';
 export interface AdminRouteDeps {
     tokenManager: TokenManager;
     /**
@@ -55,6 +54,12 @@ export interface AdminRouteDeps {
      * an independent orchestrator and on a test admin, which have no connection.
      */
     platformConnected?: () => boolean;
+    /**
+     * The org the Platform named on `auth.success`, read per request; `undefined`
+     * before the first authentication. Backs the attachment `GET /org-ids` reports.
+     * Absent on an independent orchestrator and on a test admin.
+     */
+    getPlatformOrgId?: () => string | undefined;
     rbac: RbacEnforcer;
     secretStore: PgSecretStore;
     auditLogger: AuditLogger;
@@ -166,6 +171,12 @@ export interface AdminRouteDeps {
      * Bound by orchestrator-core once the cluster is up.
      */
     scalerOrphans?: ScalerOrphansRouteDeps;
+    /**
+     * Optional -- reload the scaler config here and on every connected peer.
+     * Backs `POST /api/v1/admin/scaler/reload` (`kici-admin scaler reload`).
+     * Bound by orchestrator-core once the cluster is up.
+     */
+    scalerReload?: ScalerReloadRouteDeps;
     /**
      * Optional -- forget a departed peer here and on every connected sibling
      * coordinator. Backs `POST /api/v1/admin/peers/forget` (`kici-admin peer
@@ -202,14 +213,6 @@ export interface AdminRouteDeps {
      */
     heldRunRelease?: HeldRunReleaseWiring;
 }
-/** Hono env type for admin routes with context variables. */
-type AdminEnv = {
-    Variables: {
-        role: Role;
-        userId: string;
-        routingKey: string | null;
-    };
-};
 /**
  * Create admin API routes with Bearer token authentication and RBAC.
  *
@@ -217,5 +220,4 @@ type AdminEnv = {
  * @returns Hono app with admin routes mounted at /api/v1/admin/*
  */
 export declare function createAdminRoutes(deps: AdminRouteDeps): Hono<AdminEnv>;
-export {};
 //# sourceMappingURL=admin.d.ts.map

package/dist/scaler/config.d.ts

@@ -37,40 +37,16 @@ export declare const labelSetConfigSchema: z.ZodObject<{
         Never: "Never";
     }>>;
     binaryPath: z.ZodOptional<z.ZodString>;
-    resources: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodObject<{
+    resources: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
         requests: z.ZodOptional<z.ZodObject<{
-            memory: z.ZodOptional<z.ZodString>;
             cpus: z.ZodOptional<z.ZodNumber>;
+            memory: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         limits: z.ZodOptional<z.ZodObject<{
-            memory: z.ZodOptional<z.ZodString>;
             cpus: z.ZodOptional<z.ZodNumber>;
+            memory: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
-    }, z.core.$strict>, z.ZodObject<{
-        memory: z.ZodOptional<z.ZodString>;
-        cpus: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strict>]>, z.ZodTransform<{
-        requests?: {
-            cpus?: number;
-            memory?: string;
-        };
-        limits?: {
-            cpus?: number;
-            memory?: string;
-        };
-    }, {
-        memory?: string | undefined;
-        cpus?: number | undefined;
-    } | {
-        requests?: {
-            memory?: string | undefined;
-            cpus?: number | undefined;
-        } | undefined;
-        limits?: {
-            memory?: string | undefined;
-            cpus?: number | undefined;
-        } | undefined;
-    }>>>;
+    }, z.core.$strict>, unknown>>;
     volumes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     containerSocket: z.ZodDefault<z.ZodBoolean>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -109,40 +85,16 @@ export declare const scalerFileSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     globalMaxAgents: z.ZodDefault<z.ZodNumber>;
     defaults: z.ZodOptional<z.ZodObject<{
-        resources: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodObject<{
+        resources: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
             requests: z.ZodOptional<z.ZodObject<{
-                memory: z.ZodOptional<z.ZodString>;
                 cpus: z.ZodOptional<z.ZodNumber>;
+                memory: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
             limits: z.ZodOptional<z.ZodObject<{
-                memory: z.ZodOptional<z.ZodString>;
                 cpus: z.ZodOptional<z.ZodNumber>;
+                memory: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
-        }, z.core.$strict>, z.ZodObject<{
-            memory: z.ZodOptional<z.ZodString>;
-            cpus: z.ZodOptional<z.ZodNumber>;
-        }, z.core.$strict>]>, z.ZodTransform<{
-            requests?: {
-                cpus?: number;
-                memory?: string;
-            };
-            limits?: {
-                cpus?: number;
-                memory?: string;
-            };
-        }, {
-            memory?: string | undefined;
-            cpus?: number | undefined;
-        } | {
-            requests?: {
-                memory?: string | undefined;
-                cpus?: number | undefined;
-            } | undefined;
-            limits?: {
-                memory?: string | undefined;
-                cpus?: number | undefined;
-            } | undefined;
-        }>>>;
+        }, z.core.$strict>, unknown>>;
     }, z.core.$strip>>;
     globalResourceCap: z.ZodOptional<z.ZodPipe<z.ZodObject<{
         maxCpu: z.ZodOptional<z.ZodNumber>;
@@ -186,40 +138,16 @@ export declare const scalerFileSchema: z.ZodObject<{
                 Never: "Never";
             }>>;
             binaryPath: z.ZodOptional<z.ZodString>;
-            resources: z.ZodOptional<z.ZodPipe<z.ZodUnion<readonly [z.ZodObject<{
+            resources: z.ZodOptional<z.ZodPreprocess<z.ZodObject<{
                 requests: z.ZodOptional<z.ZodObject<{
-                    memory: z.ZodOptional<z.ZodString>;
                     cpus: z.ZodOptional<z.ZodNumber>;
+                    memory: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
                 limits: z.ZodOptional<z.ZodObject<{
-                    memory: z.ZodOptional<z.ZodString>;
                     cpus: z.ZodOptional<z.ZodNumber>;
+                    memory: z.ZodOptional<z.ZodString>;
                 }, z.core.$strict>>;
-            }, z.core.$strict>, z.ZodObject<{
-                memory: z.ZodOptional<z.ZodString>;
-                cpus: z.ZodOptional<z.ZodNumber>;
-            }, z.core.$strict>]>, z.ZodTransform<{
-                requests?: {
-                    cpus?: number;
-                    memory?: string;
-                };
-                limits?: {
-                    cpus?: number;
-                    memory?: string;
-                };
-            }, {
-                memory?: string | undefined;
-                cpus?: number | undefined;
-            } | {
-                requests?: {
-                    memory?: string | undefined;
-                    cpus?: number | undefined;
-                } | undefined;
-                limits?: {
-                    memory?: string | undefined;
-                    cpus?: number | undefined;
-                } | undefined;
-            }>>>;
+            }, z.core.$strict>, unknown>>;
             volumes: z.ZodOptional<z.ZodArray<z.ZodString>>;
             containerSocket: z.ZodDefault<z.ZodBoolean>;
             env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

package/dist/scaler/file-reload.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The one scaler config reload: re-read the scaler file, hand it to the
+ * manager (which validates everything before it applies anything), and report
+ * what happened.
+ *
+ * `SIGHUP` (through `ConfigReloader`), the `POST /admin/scaler/reload` route
+ * and a peer's `peer.scaler.reload.request` all run this function, so each of
+ * them applies a file the same way.
+ */
+import { type Logger } from '@kici-dev/shared';
+import { type ScalerReloadAnswer } from '@kici-dev/engine';
+import type { ScalerManager } from './manager.js';
+import type { ScalerConfig } from './types.js';
+export interface ScalerFileReloadDeps {
+    /** Null when the orchestrator runs without a scaler config. */
+    manager: Pick<ScalerManager, 'reload'> | null;
+    /** Re-reads the scaler config from disk; throws on a missing or invalid file. */
+    load: () => Promise<ScalerConfig>;
+    /** Runs after a reload applied (the dashboard diagnostics snapshot). */
+    onApplied?: (config: ScalerConfig) => void;
+    logger: Logger;
+}
+/**
+ * One orchestrator's scaler reload outcome: `applied` with its plan, `rejected`
+ * with its errors (nothing applied), or `not-configured`.
+ */
+export type ScalerFileReloadResult = ScalerReloadAnswer;
+/** Runs one scaler file reload; see `createScalerFileReload`. */
+export type ScalerFileReload = () => Promise<ScalerFileReloadResult>;
+/**
+ * Build the reload function. Calls run one after the other: a reload that
+ * arrives while another runs (a `SIGHUP` during an HTTP reload) waits, then
+ * reads the file again, and each caller gets the outcome of its own run.
+ */
+export declare function createScalerFileReload(deps: ScalerFileReloadDeps): ScalerFileReload;
+/** The part of `process` the signal listener needs, injectable for tests. */
+export interface SignalSource {
+    on(signal: 'SIGHUP', listener: () => void): unknown;
+    off(signal: 'SIGHUP', listener: () => void): unknown;
+}
+/**
+ * Run `reload` on `SIGHUP`, debounced like the coordinator's `ConfigReloader`
+ * so a burst of signals reloads once. A Node.js process with no `SIGHUP`
+ * listener exits on the signal, so a host that reloads only its scaler config
+ * (a worker) installs this one. Returns the disposer that removes the listener.
+ */
+export declare function installScalerReloadSignal(reload: ScalerFileReload, logger: Logger, signals?: SignalSource): () => void;
+//# sourceMappingURL=file-reload.d.ts.map