@kici-dev/orchestrator 0.6.1 → 0.7.0

package/dist/reporting/execution-tracker.d.ts

@@ -233,6 +233,43 @@ export interface ExecutionTrackerDeps {
      */
     resolveOrgId?: (routingKey: string) => Promise<string>;
 }
+/**
+ * The per-job fields the tracker persists to an execution_jobs row.
+ *
+ * Exported and shared by every registration entry point (`onExecutionStarted`,
+ * `addJobsToRun`) rather than restated inline at each one: three structural
+ * copies had already drifted apart on which optional fields they carried, so a
+ * new column had to be added in three places or silently go unwritten from one
+ * of them.
+ */
+export interface TrackedJobRow {
+    jobId: string;
+    jobName: string;
+    matrixValues?: Record<string, unknown>;
+    runsOnLabels?: string[];
+    baseJobName?: string;
+    variantKind?: string;
+    variantLabel?: string;
+    waveGated?: boolean;
+    waveMaxParallel?: number;
+    waveFailFast?: boolean;
+    contexts?: string[];
+    /**
+     * The `gitCredentials` map this job's lock entry declared, verbatim.
+     * Persisted so the credential relay can check a workflow-supplied ref against
+     * server truth without re-parsing a lock file on a hot path — so it must
+     * match the lock exactly, including a `<name>Value` the lock declared.
+     */
+    gitCredentials?: Readonly<Record<string, Readonly<Record<string, string>>>>;
+    skippedContexts?: string[];
+    envWarning?: string;
+    /** `gate` for an invoke gate, `proxy` for a summoned-run mirror. Defaults to `standard`. */
+    jobKind?: JobKind;
+    /** For a proxy job, the summoned run it mirrors. */
+    summonedRunId?: string;
+    /** For a gate job, its wall-clock timeout in ms (orchestrator-swept). */
+    timeoutMs?: number;
+}
 export declare class ExecutionTracker {
     private readonly db;
     private readonly observerRegistry?;
@@ -301,21 +338,7 @@ export declare class ExecutionTracker {
      * Inserts execution_runs and execution_jobs rows in the DB and
      * sets up in-memory tracking state.
      */
-    onExecutionStarted(runId: string, workflowName: string, provider: string, repoIdentifier: string, ref: string, sha: string, deliveryId: string | null, providerContext: Record<string, unknown>, triggerDecision: Record<string, unknown> | null, jobs: Array<{
-        jobId: string;
-        jobName: string;
-        matrixValues?: Record<string, unknown>;
-        runsOnLabels?: string[];
-        baseJobName?: string;
-        variantKind?: string;
-        variantLabel?: string;
-        waveGated?: boolean;
-        waveMaxParallel?: number;
-        waveFailFast?: boolean;
-        contexts?: string[];
-        skippedContexts?: string[];
-        envWarning?: string;
-    }>, routingKey?: string, 
+    onExecutionStarted(runId: string, workflowName: string, provider: string, repoIdentifier: string, ref: string, sha: string, deliveryId: string | null, providerContext: Record<string, unknown>, triggerDecision: Record<string, unknown> | null, jobs: TrackedJobRow[], routingKey?: string, 
     /** Secret context names dispatched with jobs (for context-disable job lookup). */
     dispatchedContexts?: string[], 
     /** Trigger event type (e.g. "push", "pr:open") for dashboard display. */
@@ -353,7 +376,34 @@ export declare class ExecutionTracker {
      * repository and dispatched against another. Omitted/null for every
      * per-repository run, where the two are the same repository.
      */
-    workflowRepoIdentifier?: string | null): Promise<void>;
+    workflowRepoIdentifier?: string | null, 
+    /**
+     * Pull-request head context, resolved from the normalized event.
+     *
+     * Written HERE, on the authoritative insert, and never in the
+     * fire-and-forget post-start update `trust_tier` uses. A lost write would
+     * leave `is_fork` NULL, which every claim renders `'unresolved'` — correct
+     * for a legacy row, and a silent policy failure for a live one.
+     */
+    eventContext?: {
+        headRef?: string | null;
+        headRepository?: string | null;
+        /**
+         * NULL only when the event genuinely does not resolve one: a PR payload
+         * carrying no head or base repository. A non-PR event resolves to
+         * `false`, because a push has no fork dimension — leaving it unresolved
+         * would make every `is_fork = false` trust policy reject legitimate
+         * pushes, and the customer's fix for that would re-open the hole.
+         */
+        isFork?: boolean | null;
+        /**
+         * The event the OIDC subject is derived from, when `triggerEvent` is not
+         * it. Set only by the re-run path, which records `'rerun'` as its trigger
+         * event and carries the original run's event here so a re-run of a pull
+         * request keeps the pull-request subject.
+         */
+        subjectTriggerEvent?: string | null;
+    }): Promise<void>;
     /**
      * Upsert one execution_jobs row per dispatched job (idempotent on
      * (run_id, job_id) to tolerate a race with an early `onJobStatus`). The
@@ -414,6 +464,18 @@ export declare class ExecutionTracker {
      * never a finished one.
      */
     isJobTerminal(runId: string, jobId: string): Promise<boolean>;
+    /**
+     * The status `execution_jobs` currently records for a job, or undefined when
+     * no row exists. Read after a guarded write is rejected, to tell a row that
+     * contradicts the frame from one that already agrees with it.
+     */
+    private readJobStatus;
+    /**
+     * The status `execution_runs` currently records for a run, or undefined when
+     * no row exists. Read on the agreeing-frame path to tell a run that still
+     * needs driving from one that was already rolled up.
+     */
+    private readRunStatus;
     /**
      * Run `fn` while holding a per-run lock, serializing the run-mutating methods
      * (`onJobStatus`, `addJobsToRun`) so a status reply cannot interleave with the
@@ -430,21 +492,7 @@ export declare class ExecutionTracker {
      * cross-run lock-ordering deadlock.
      */
     private withRunLock;
-    addJobsToRun(runId: string, jobs: Array<{
-        jobId: string;
-        jobName: string;
-        matrixValues?: Record<string, unknown>;
-        runsOnLabels?: string[];
-        baseJobName?: string;
-        variantKind?: string;
-        variantLabel?: string;
-        contexts?: string[];
-        skippedContexts?: string[];
-        envWarning?: string;
-        jobKind?: JobKind;
-        summonedRunId?: string;
-        timeoutMs?: number;
-    }>, dispatchedContexts?: string[], 
+    addJobsToRun(runId: string, jobs: TrackedJobRow[], dispatchedContexts?: string[], 
     /** Synthetic job ID to replace (e.g. needs-pending-deploy-{uuid}). */
     replaceSyntheticId?: string): Promise<void>;
     private addJobsToRunImpl;
@@ -479,8 +527,11 @@ export declare class ExecutionTracker {
     private recoverJobFromDispatchQueue;
     /**
      * Phase 2: build the upsert payload for execution_jobs and execute it.
-     * Returns the per-job log byte total when the job reached a terminal state
-     * (used downstream by the run-completion phase to populate run.log_bytes).
+     *
+     * The conflict update is guarded so it cannot rewrite a row that already
+     * reached a terminal state. `applied` reports the guard's verdict; the log
+     * byte total is the per-job value when the job reached a terminal state (used
+     * downstream by the run-completion phase to populate run.log_bytes).
      */
     private persistJobStatusUpdate;
     /**
@@ -969,9 +1020,9 @@ export declare class ExecutionTracker {
      * A run this tracker does not know is a no-op: a missing run means the status
      * updates that would read the fields are not coming either.
      *
-     * Keep this synchronous. Its one caller wraps it in `try`/`catch`, which
-     * catches a throw but not a rejected promise, so an async body would put the
-     * failure back outside the guard.
+     * Keep this synchronous. Each caller wraps it in `try`/`catch`, which catches
+     * a throw but not a rejected promise, so an async body would put the failure
+     * back outside the guard.
      */
     setRunTrustContext(runId: string, trustTier: string, lockFileSource?: string): void;
     /**

package/dist/routes/admin-db.d.ts

@@ -15,6 +15,11 @@ import type { Role } from '../secrets/rbac.js';
 interface DbRouteDeps {
     db: Kysely<any>;
     pool: pg.Pool;
+    /**
+     * Connection string for the timeout-free pool that schema work runs on.
+     * Absent in unit tests, which fall back to the shared pool.
+     */
+    databaseUrl?: string;
 }
 type AdminDbEnv = {
     Variables: {

package/dist/routes/admin-events.d.ts

@@ -41,6 +41,19 @@ interface AdminEventRouteDeps {
     secretResolver: SecretResolver | null;
     /** Fleet-wide settings reader; threads the live lock-file cap into newly-registered universal-git sources. */
     clusterSettings?: ClusterSettingsReader;
+    /**
+     * The canonical Platform organization id this orchestrator authenticated
+     * as, or `undefined` when it is not Platform-connected (independent mode)
+     * or has not authenticated yet.
+     *
+     * A generic source mints the routing key `generic:<orgId>:<id>`, and the
+     * Platform refuses to register a key naming an organization other than the
+     * authenticated one. So a source created under a mismatched org would
+     * register, be rejected, and silently never deliver — and its published
+     * webhook URL, which the Platform composes from the Platform org id, would
+     * 404. The create handler refuses the mismatch up front instead.
+     */
+    getPlatformOrgId?: () => string | undefined;
     /**
      * Optional — when provided, the `POST /api/v1/admin/events/emit` route is
      * mounted so operators can INSERT into `kici_events` + `pg_notify` via HTTP.

package/dist/routes/admin-held-runs.d.ts

@@ -42,7 +42,7 @@ import { Hono } from 'hono';
 import type { Kysely } from 'kysely';
 import type { OrchestratorMode } from '@kici-dev/engine';
 import { HeldRunStore, type ReleaseSignal } from '../contexts/held-runs.js';
-import { TrustDirectoryStore } from '../security/trust-directory-store.js';
+import type { TrustDirectoryStore } from '../security/trust-directory-store.js';
 import { adminActorSub, triggererSubjectFor } from '../approvals/triggerer-subject.js';
 import { type ResolveCheckStatusPoster } from '../pipeline/security-hold-check.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
@@ -67,6 +67,16 @@ export declare const PLATFORM_MANAGED_HELD_RUN_MESSAGE: string;
  * would block with nothing left to release OR expire it.
  */
 export declare const STEP_SCOPE_UNSUPPORTED_MESSAGE: string;
+/**
+ * Wording for an `--as` id the approval directory does not hold.
+ *
+ * The directory is the enumerable set of subjects this route will answer as. An
+ * id it does not carry is refused rather than passed through, because an
+ * unvalidated approver subject is free text: it would let an operator token
+ * write any string it liked into `held_run_approvals.approver_user_id` and
+ * satisfy any `{user}` clause by naming it.
+ */
+export declare function unregisteredApproverMessage(userId: string): string;
 /** The release wiring the applier needs to actually resume a released element. */
 export interface HeldRunReleaseWiring {
     /**

package/dist/routes/admin-org-settings.d.ts

@@ -11,6 +11,7 @@
  */
 import { Hono } from 'hono';
 import { type Kysely } from 'kysely';
+import { type OrchestratorMode } from '@kici-dev/engine';
 import { DashboardWriteOperation } from '@kici-dev/engine/protocol/dashboard-write-operations';
 import type { Database } from '../db/types.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
@@ -23,6 +24,14 @@ interface OrgSettingsRouteDeps {
      * `config.globalWorkflowsEnabled`.
      */
     globalWorkflowsEnabledDefault: boolean;
+    /**
+     * This orchestrator's mode.
+     *
+     * The dashboard-write policy needs it: disabling `held_runs.approve` /
+     * `held_runs.reject` is coherent only where `kici-admin held-run` can still
+     * answer a hold, which is independent mode alone.
+     */
+    mode: OrchestratorMode;
     /**
      * Optional — when wired, each `dashboard_write_policy` flip emits one
      * `access_log` row (`org_settings.dashboard_write_policy.update`)

package/dist/routes/admin-runs.d.ts

@@ -24,13 +24,14 @@ import type { Database } from '../db/types.js';
 import type { TokenManager } from '../secrets/token-manager.js';
 import type { RbacEnforcer, Role } from '../secrets/rbac.js';
 import type { AuditLogger } from '../secrets/audit-logger.js';
+import type { ResolvedMasterKeys } from '../secrets/config.js';
 import type { LogStorage } from '../reporting/log-storage.js';
 /**
  * Statuses accepted by the `?status=` filter.
  *
  * The full canonical union rather than just `ExecutionRunStatus.options`: only
  * run statuses can appear in `execution_runs.status`, but the job-only members
- * were accepted before and simply match no row, so keeping them avoids turning
+ * were accepted before and match no row, so keeping them avoids turning
  * an empty result into a rejected request.
  */
 export declare const RUN_STATUSES: ReadonlySet<string>;
@@ -44,10 +45,12 @@ export interface AdminRunRoutesDeps {
     /** Required to reveal secret-output plaintext via ?reveal=true. */
     auditLogger?: AuditLogger;
     /**
-     * Orchestrator master secret key (raw hex / base64). Required to reveal
-     * secret-output plaintext. Derived once per request via deriveKey().
+     * The orchestrator master key, plus the previous generation during a
+     * rotation grace window. Required to reveal secret-output plaintext; a row
+     * still sealed under the old key reveals until `rotate-key` has swept the
+     * table.
      */
-    masterSecretKey?: string;
+    masterKeys?: ResolvedMasterKeys | null;
     /**
      * Log storage backend. Required only by the agent step-logs endpoint
      * (`/runs/:runId/jobs/:jobId/steps/:stepIndex/logs`); when absent, that

package/dist/routes/admin-sources.d.ts

@@ -12,6 +12,7 @@ import { Hono } from 'hono';
 import { OrchestratorMode } from '@kici-dev/engine';
 import type { SourceStore } from '../sources/source-store.js';
 import type { Role } from '../secrets/rbac.js';
+import { type RedeliverWindowResult } from '../providers/github/deliveries.js';
 import { type FetchGithubAppIdentity } from '../github-app-name-refresher/github-app-name-refresher.js';
 interface SourceRouteDeps {
     sourceStore: SourceStore;
@@ -47,6 +48,11 @@ interface SourceRouteDeps {
      * `source refresh` route.
      */
     fetchAppIdentity?: FetchGithubAppIdentity;
+    /**
+     * Replay a window of GitHub webhook deliveries for one App. Injectable for
+     * tests; defaults to the real `redeliverWindow`.
+     */
+    redeliverDeliveries?: RedeliverDeliveries;
     /**
      * Orchestrator operating mode. `observed` refuses GitHub-App source creation:
      * those sources are ingested through the Platform relay, and an observed
@@ -54,6 +60,15 @@ interface SourceRouteDeps {
      */
     mode?: OrchestratorMode;
 }
+/** Replay a delivery window for a GitHub App. Matches `redeliverWindow`. */
+export type RedeliverDeliveries = (app: {
+    appId: string;
+    privateKey: string;
+}, opts: {
+    since: Date;
+    until: Date;
+    dryRun?: boolean;
+}) => Promise<RedeliverWindowResult>;
 type AdminSourcesEnv = {
     Variables: {
         role: Role;

package/dist/routes/admin-trust-policy.d.ts

@@ -52,6 +52,17 @@ interface TrustPolicyRouteDeps {
     rbac: RbacEnforcer;
     /** This orchestrator's mode; decides whether PATCH is permitted at all. */
     mode: OrchestratorMode;
+    /**
+     * Whether the Platform connection is up right now.
+     *
+     * `mode` alone cannot answer this: it says a Platform is configured, not that
+     * one is reachable, and the two differ during exactly the outage that leaves
+     * the directory below frozen. Read per request rather than captured once, so
+     * a reconnect is reflected without re-mounting the route.
+     *
+     * Absent on an independent orchestrator, which has no connection to report.
+     */
+    platformConnected?: () => boolean;
     /**
      * Audit sink for the PATCH, written inside the policy transaction.
      *

package/dist/routes/admin.d.ts

@@ -16,6 +16,7 @@ import type { AuditLogger } from '../secrets/audit-logger.js';
 import type { AgentTokenStore } from '../agent/token-store.js';
 import type { AgentRegistry } from '../agent/registry.js';
 import type { SharedConfigStore } from '../config/shared-store.js';
+import type { ResolvedMasterKeys } from '../secrets/config.js';
 import { type HeldRunReleaseWiring } from './admin-held-runs.js';
 import type { DrainController } from '../drain/drain-controller.js';
 import type { SourceStore } from '../sources/source-store.js';
@@ -31,6 +32,12 @@ import type { AccessLogWriter } from '../audit/access-log.js';
  */
 export interface AdminRouteDeps {
     tokenManager: TokenManager;
+    /**
+     * Connection string handed to the DB migration routes, which run schema work
+     * on their own timeout-free pool. Optional so WS-only / test admins can omit
+     * it; omitting it makes those routes fall back to the shared pool.
+     */
+    databaseUrl?: string;
     /**
      * Orchestrator operating mode. Gates mode-specific admin behavior — today the
      * `observed`-mode refusal of GitHub-App source creation (those sources are
@@ -38,6 +45,14 @@ export interface AdminRouteDeps {
      * relay). Optional so WS-only / test admins can omit it.
      */
     mode?: OrchestratorMode;
+    /**
+     * Whether the Platform connection is up right now, read per request.
+     *
+     * Reported by the trust-policy directory route so an operator can tell a
+     * directory that is merely old from one that cannot refresh at all. Absent on
+     * an independent orchestrator and on a test admin, which have no connection.
+     */
+    platformConnected?: () => boolean;
     rbac: RbacEnforcer;
     secretStore: PgSecretStore;
     auditLogger: AuditLogger;
@@ -127,6 +142,16 @@ export interface AdminRouteDeps {
      * response reports `reEncryptedConfigs: 0`.
      */
     sharedStore?: SharedConfigStore;
+    /**
+     * Optional -- the resolved master key, for `POST /api/v1/admin/rotate-key`.
+     *
+     * When set, `rotate-key` additionally sweeps the four remaining
+     * master-key-wrapped stores: `orchestrator_signing_keys`,
+     * `dashboard_encryption_keys`, `run_ephemeral_keys` and `run_secret_outputs`.
+     * When unset the secrets subsystem is off and there is nothing wrapped to
+     * sweep, so those counts report 0.
+     */
+    masterKeys?: ResolvedMasterKeys | null;
     /**
      * Optional -- attribution writer for routes that emit an `access_log`
      * row directly (today: org-settings dashboard-write policy flips). When

package/dist/scaler/backend-factory.d.ts

@@ -29,6 +29,12 @@ export interface BackendFactoryContext {
     tokenStore?: AgentTokenStore;
     /** True when `config.agentAuth === 'token'`; gates token injection for the three local backends. */
     injectAgentToken: boolean;
+    /**
+     * Host services the orchestrator itself directed agents at, as `hostAccess`
+     * entries — today its object-storage endpoint. Resolved by the startup host,
+     * which is where `AppConfig` lives.
+     */
+    hostServices?: string[];
     tokenTtlMs?: number;
     /** Live per-spawn resolver for the fleet-wide agent-token TTL. */
     tokenTtlProvider: () => Promise<number>;
@@ -42,6 +48,16 @@ export interface BackendFactoryContext {
     stateStore?: ScalerStateStore;
     /** Absent ⇒ the `event` type is unsupported on this host (worker mode). */
     eventEmitterProvider?: () => ScalerEventEmitterLike;
+    /**
+     * Whether an agent id is currently registered on this host.
+     *
+     * The container backend's orphan sweep uses it to tell a running agent that
+     * is doing work from one whose agent never registered. Absent ⇒ the sweep
+     * assumes every running container is registered, which is the fail-safe
+     * direction: it leaves an orphan for the next pass rather than killing a
+     * live agent.
+     */
+    isAgentRegistered?: (agentId: string) => boolean;
     logger: ReturnType<typeof createLogger>;
 }
 /** Tool requirements for a set of entries, for `validateRequiredTools` from `@kici-dev/shared`. */

package/dist/scaler/bare-metal-backend.d.ts

@@ -17,6 +17,12 @@ export interface BareMetalScalerBackendOptions {
     maxAgents: number;
     /** Default resource limits applied when label set has none */
     defaultResources?: ResourceRequest;
+    /**
+     * Extra `hostAccess` entries the orchestrator itself directed agents at —
+     * today its object-storage endpoint. Folded into the agent default for the
+     * container mode, which is the only mode with a network boundary.
+     */
+    hostServices?: string[];
     /** Token store for creating ephemeral agent auth tokens. Optional -- when undefined, no token is injected. */
     tokenStore?: AgentTokenStore;
     /** TTL for ephemeral agent tokens in ms. Default: 1 hour. */
@@ -56,11 +62,23 @@ export declare class BareMetalScalerBackend implements ScalerBackend {
     private readonly tokenTtlProvider?;
     private readonly roles;
     private readonly enforceCgroups;
+    /** Host services the orchestrator directed agents at, as `hostAccess` entries. */
+    private readonly hostServices?;
     /** Tracks all managed agent processes */
     private readonly agents;
     /** LogCapture instances for each managed agent (keyed by ManagedAgent.id) */
     private readonly logCaptures;
+    /** Container-mode agents' IPs on the isolated network, for nftables cleanup. */
+    private readonly containerIps;
     constructor(options: BareMetalScalerBackendOptions);
+    /**
+     * Warn about label sets whose `networkPolicy` this backend cannot enforce.
+     *
+     * Only process-mode label sets qualify. A label set that declares an `image`
+     * and no `binaryPath` spawns its agent as a container on the isolated agent
+     * network, where the policy IS applied — warning about it tells an operator
+     * their working configuration does nothing, which invites them to remove it.
+     */
     private warnNetworkPolicy;
     /**
      * Declare required tools for a bare-metal scaler entry.
@@ -99,14 +117,14 @@ export declare class BareMetalScalerBackend implements ScalerBackend {
      *
      * `destroy()` opens with an in-memory map lookup, so an orchestrator restart
      * makes it a silent no-op while the container keeps running. The container
-     * backend's own startup sweep does not cover this one either: it removes every
-     * `kici-managed` container, but it only runs when a container scaler is
-     * configured, and a bare-metal-only deployment has none.
+     * backend's own startup sweep does not cover this one either: it reaps only
+     * containers stamped with its OWN `kici-scaler-name`, and it runs only when a
+     * container scaler is configured, which a bare-metal-only deployment has not.
      *
      * The host-local evidence is the container itself: `spawnContainerAgent` stamps
      * `kici-agent-id` and `kici-scaler-name` onto it, and a container listing only
      * ever names containers on this host. So a coordinator cannot reach a peer's
-     * compute through this path — a wrongly-routed agent id simply matches nothing.
+     * compute through this path — a wrongly-routed agent id matches nothing.
      *
      * A process-mode agent is NOT reclaimed here. Its PID lives in the in-memory
      * entry alone, so a restart leaves no durable, host-local artifact to key off,

package/dist/scaler/config.d.ts

@@ -23,12 +23,13 @@ export declare const DEFAULT_MAX_CONCURRENT_SPAWNS = 8;
 export declare const networkPolicySchema: z.ZodOptional<z.ZodObject<{
     allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
     denyAll: z.ZodDefault<z.ZodBoolean>;
+    hostAccess: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>>;
 /**
  * Zod schema for a label-set configuration entry.
  */
 export declare const labelSetConfigSchema: z.ZodObject<{
-    labels: z.ZodArray<z.ZodString>;
+    labels: z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<import("@kici-dev/engine").CanonicalLabel[], string[]>>;
     image: z.ZodOptional<z.ZodString>;
     imagePullPolicy: z.ZodDefault<z.ZodEnum<{
         Always: "Always";
@@ -80,6 +81,7 @@ export declare const labelSetConfigSchema: z.ZodObject<{
     networkPolicy: z.ZodOptional<z.ZodObject<{
         allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
         denyAll: z.ZodDefault<z.ZodBoolean>;
+        hostAccess: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
     rootfsPath: z.ZodOptional<z.ZodString>;
     kernelPath: z.ZodOptional<z.ZodString>;
@@ -176,7 +178,7 @@ export declare const scalerFileSchema: z.ZodObject<{
         maxAgents: z.ZodNumber;
         maxConcurrentSpawns: z.ZodDefault<z.ZodNumber>;
         labelSets: z.ZodArray<z.ZodObject<{
-            labels: z.ZodArray<z.ZodString>;
+            labels: z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<import("@kici-dev/engine").CanonicalLabel[], string[]>>;
             image: z.ZodOptional<z.ZodString>;
             imagePullPolicy: z.ZodDefault<z.ZodEnum<{
                 Always: "Always";
@@ -228,6 +230,7 @@ export declare const scalerFileSchema: z.ZodObject<{
             networkPolicy: z.ZodOptional<z.ZodObject<{
                 allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 denyAll: z.ZodDefault<z.ZodBoolean>;
+                hostAccess: z.ZodOptional<z.ZodArray<z.ZodString>>;
             }, z.core.$strip>>;
             rootfsPath: z.ZodOptional<z.ZodString>;
             kernelPath: z.ZodOptional<z.ZodString>;
@@ -250,7 +253,7 @@ export declare const scalerFileSchema: z.ZodObject<{
             size: z.ZodDefault<z.ZodNumber>;
             idleTimeoutSeconds: z.ZodDefault<z.ZodNumber>;
         }, z.core.$strip>>;
-        mandatoryLabels: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        mandatoryLabels: z.ZodPipe<z.ZodDefault<z.ZodArray<z.ZodString>>, z.ZodTransform<import("@kici-dev/engine").CanonicalLabel[], string[]>>;
         platform: z.ZodOptional<z.ZodObject<{
             os: z.ZodEnum<{
                 linux: "linux";