@kici-dev/engine 0.14.2 → 0.16.0

package/dist/protocol/messages/execution-status.js

@@ -269,8 +269,8 @@ const executionStatusSchema = z.object({
 	workflowName: z.string().max(128),
 	status: ExecutionRunStatus,
 	/**
-	* Routing key of the run's own source. Optional for backward compatibility
-	* with older orchestrators (absent → the Platform falls back to the WS
+	* Routing key of the run's own source. Absent for a run the orchestrator
+	* recorded no routing key for (the Platform then falls back to the WS
 	* connection's first routing key). Lets the Platform mirror attribute each
 	* run to its real source even when one orchestrator serves multiple sources.
 	*/
@@ -281,8 +281,7 @@ const executionStatusSchema = z.object({
 	* `repoIdentifier` — a global workflow authored in one repository and
 	* dispatched against another. Absent for every per-repository run, where the
 	* two are the same repository, so "present" is a precise marker for a
-	* cross-repository global run. Optional for backward compatibility with an
-	* older orchestrator that never sends it.
+	* cross-repository global run.
 	*/
 	workflowRepoIdentifier: z.string().max(256).optional(),
 	/**
@@ -292,8 +291,7 @@ const executionStatusSchema = z.object({
 	* The Platform mirrors it so its own re-run refusal can admit a round: a
 	* round is definitionally cross-repository, and re-running one re-evaluates
 	* the original event instead of resolving a workflow out of the acted-on
-	* repository's lock file. Absent means an ordinary run — optional for
-	* backward compatibility with an orchestrator that never sends it.
+	* repository's lock file. Absent means an ordinary run.
 	*/
 	isGlobalEvalRound: z.boolean().optional(),
 	/**
@@ -358,10 +356,8 @@ const executionStatusSchema = z.object({
 	* already dispatched reported in, and then continues). The Platform keeps a
 	* terminal status against a non-terminal frame unless the frame's generation
 	* is newer, so a frame that arrives late cannot move a finished run back.
-	* Optional for backward compatibility: an older orchestrator omits it, and the
-	* Platform then applies the frame unguarded.
 	*/
-	statusEpoch: statusEpochSchema.optional()
+	statusEpoch: statusEpochSchema
 });
 /** Per-step status forwarded from agent to Platform (real-time). */
 const stepStatusForwardSchema = z.object({
@@ -413,8 +409,7 @@ const jobStatusForwardSchema = z.object({
 	initFailure: initFailureSchema.optional(),
 	/**
 	* Job kind. Absent means an ordinary `standard` job. `gate`/`proxy` mark an
-	* invoke gate and its per-run proxy children. Additive/optional — an older
-	* peer ignores it.
+	* invoke gate and its per-run proxy children.
 	*/
 	jobKind: JobKind.optional(),
 	/** For a `proxy` job, the summoned run it mirrors. Additive/optional. */
@@ -459,7 +454,7 @@ const stateReplayRunSchema = z.object({
 	/** Why the run failed (`RunFailureClass`); only present for failed/cancelled runs. */
 	failureClass: RunFailureClass.optional(),
 	/** The run's status generation, with the same meaning as on `execution.status`. */
-	statusEpoch: statusEpochSchema.optional(),
+	statusEpoch: statusEpochSchema,
 	jobs: z.array(z.object({
 		jobId: z.string().max(128),
 		jobName: z.string().max(128),

package/dist/protocol/messages/join.d.ts

@@ -1,18 +1,89 @@
 import { z } from 'zod';
-/** Join request sent by a new orchestrator (via Platform relay or direct peer). */
+export declare const JOIN_PROTOCOL_VERSION: 2;
+/** `Upgrade` header value on the HTTP 426 that refuses a version-1 join. */
+export declare const JOIN_PROTOCOL_UPGRADE_TOKEN = "kici-join-v2";
+export declare const JOIN_PROTOCOL_V1_REMOVED_MESSAGE = "This kici-admin uses join protocol v1, which orchestrators no longer accept. Upgrade kici-admin, then run kici-admin join again.";
+export declare const JOIN_PROTOCOL_UNSUPPORTED_MESSAGE = "The cluster's orchestrators predate join protocol v2. Upgrade them, then join again.";
+export declare const LEGACY_JOINER_AUTH_MESSAGE = "This kici-admin cannot join through the Platform. Upgrade kici-admin, then run kici-admin join again.";
+export declare const INVALID_JOIN_REQUEST_MESSAGE = "Invalid join request";
+/** Why a join was refused. Every refusal on the Platform, the orchestrator and the HTTP route sets one. */
+export declare const JoinErrorCode: z.ZodEnum<{
+    invalid_request: "invalid_request";
+    invalid_token: "invalid_token";
+    join_protocol_unsupported: "join_protocol_unsupported";
+    join_protocol_v1_removed: "join_protocol_v1_removed";
+    no_target: "no_target";
+    org_mismatch: "org_mismatch";
+    relay_timeout: "relay_timeout";
+    token_already_used: "token_already_used";
+    token_expired: "token_expired";
+}>;
+export type JoinErrorCode = z.infer<typeof JoinErrorCode>;
+export declare const JoinRequestKind: z.ZodEnum<{
+    invalid: "invalid";
+    v1_removed: "v1_removed";
+    v2: "v2";
+}>;
+export type JoinRequestKind = z.infer<typeof JoinRequestKind>;
+/** The decoded routing part of a join token. A lookup key only: the orchestrator trusts its stored row. */
+export declare const joinRoutingSchema: z.ZodObject<{
+    orgId: z.ZodString;
+    routingKey: z.ZodString;
+    expiry: z.ZodNumber;
+}, z.core.$loose>;
+export type JoinRouting = z.infer<typeof joinRoutingSchema>;
+/** Join request sent by a new orchestrator (through the Platform relay or directly to a peer). */
 export declare const joinRequestSchema: z.ZodObject<{
     type: z.ZodLiteral<"join.request">;
     messageId: z.ZodOptional<z.ZodString>;
-    token: z.ZodString;
+    joinProtocol: z.ZodLiteral<2>;
+    routing: z.ZodString;
+    joinerPublicKey: z.ZodString;
+    joinerNonce: z.ZodString;
+    joinerProof: z.ZodString;
 }, z.core.$strip>;
 /** Join response from an existing orchestrator back to the joiner. */
 export declare const joinResponseSchema: z.ZodObject<{
     type: z.ZodLiteral<"join.response">;
     messageId: z.ZodOptional<z.ZodString>;
     success: z.ZodBoolean;
+    joinProtocol: z.ZodOptional<z.ZodLiteral<2>>;
+    serverPublicKey: z.ZodOptional<z.ZodString>;
+    serverNonce: z.ZodOptional<z.ZodString>;
+    serverProof: z.ZodOptional<z.ZodString>;
     encryptedBundle: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodString>;
+    errorCode: z.ZodOptional<z.ZodEnum<{
+        invalid_request: "invalid_request";
+        invalid_token: "invalid_token";
+        join_protocol_unsupported: "join_protocol_unsupported";
+        join_protocol_v1_removed: "join_protocol_v1_removed";
+        no_target: "no_target";
+        org_mismatch: "org_mismatch";
+        relay_timeout: "relay_timeout";
+        token_already_used: "token_already_used";
+        token_expired: "token_expired";
+    }>>;
 }, z.core.$strip>;
 export type JoinRequest = z.infer<typeof joinRequestSchema>;
 export type JoinResponse = z.infer<typeof joinResponseSchema>;
+export type ClassifiedJoinRequest = {
+    kind: typeof JoinRequestKind.enum.v2;
+    request: JoinRequest;
+} | {
+    kind: typeof JoinRequestKind.enum.v1_removed;
+    messageId?: string;
+} | {
+    kind: typeof JoinRequestKind.enum.invalid;
+    messageId?: string;
+};
+/** True for an object whose `type` is `join.request`, whatever else it carries. */
+export declare function isJoinRequestFrame(raw: unknown): boolean;
+/**
+ * Classify a join.request frame. A frame that carries `token` is version 1 even when
+ * v2 fields are present too: it is checked before the parse, which would strip it.
+ */
+export declare function classifyJoinRequest(raw: unknown): ClassifiedJoinRequest;
+/** A refused join.response carrying its error code. */
+export declare function buildJoinRefusal(messageId: string | undefined, errorCode: JoinErrorCode, error: string): JoinResponse;
 //# sourceMappingURL=join.d.ts.map

package/dist/protocol/messages/join.js

@@ -1,28 +1,117 @@
 import "../../rolldown-runtime-ClRpJifh.js";
 import { z } from "zod";
 //#region src/protocol/messages/join.ts
-/** Join request sent by a new orchestrator (via Platform relay or direct peer). */
+const JOIN_PROTOCOL_VERSION = 2;
+/** `Upgrade` header value on the HTTP 426 that refuses a version-1 join. */
+const JOIN_PROTOCOL_UPGRADE_TOKEN = "kici-join-v2";
+const JOIN_PROTOCOL_V1_REMOVED_MESSAGE = "This kici-admin uses join protocol v1, which orchestrators no longer accept. Upgrade kici-admin, then run kici-admin join again.";
+const JOIN_PROTOCOL_UNSUPPORTED_MESSAGE = "The cluster's orchestrators predate join protocol v2. Upgrade them, then join again.";
+const LEGACY_JOINER_AUTH_MESSAGE = "This kici-admin cannot join through the Platform. Upgrade kici-admin, then run kici-admin join again.";
+const INVALID_JOIN_REQUEST_MESSAGE = "Invalid join request";
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+const BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+const HEX_PROOF = /^[0-9a-f]{64}$/;
+const MAX_MESSAGE_ID = 256;
+/** Why a join was refused. Every refusal on the Platform, the orchestrator and the HTTP route sets one. */
+const JoinErrorCode = z.enum([
+	"join_protocol_v1_removed",
+	"join_protocol_unsupported",
+	"invalid_request",
+	"invalid_token",
+	"token_expired",
+	"token_already_used",
+	"org_mismatch",
+	"no_target",
+	"relay_timeout"
+]);
+const JoinRequestKind = z.enum([
+	"v2",
+	"v1_removed",
+	"invalid"
+]);
+/** The decoded routing part of a join token. A lookup key only: the orchestrator trusts its stored row. */
+const joinRoutingSchema = z.object({
+	orgId: z.string().min(1),
+	routingKey: z.string().min(1),
+	expiry: z.number().finite()
+}).passthrough();
+/** Join request sent by a new orchestrator (through the Platform relay or directly to a peer). */
 const joinRequestSchema = z.object({
 	type: z.literal("join.request"),
-	/** Correlation ID for Platform relay routing. Platform injects this on relay to match
-	*  join.response back to the correct joining orchestrator when multiple joiners
-	*  are active concurrently. */
-	messageId: z.string().optional(),
-	/** The full join token: kici_join_v1.<base64url_routing>.<secret_hex> */
-	token: z.string()
+	/** Correlation ID the Platform injects on relay to route the response back. */
+	messageId: z.string().max(MAX_MESSAGE_ID).optional(),
+	joinProtocol: z.literal(2),
+	/** The token's base64url routing part, exactly as it appears in the token. */
+	routing: z.string().max(2048).regex(BASE64URL),
+	/** The joiner's one-time X25519 public key, DER SPKI, base64. */
+	joinerPublicKey: z.string().max(128).regex(BASE64),
+	/** 32 random bytes, base64. */
+	joinerNonce: z.string().max(64).regex(BASE64),
+	/** HMAC-SHA256 over the request transcript, lowercase hex. */
+	joinerProof: z.string().regex(HEX_PROOF)
 });
 /** Join response from an existing orchestrator back to the joiner. */
 const joinResponseSchema = z.object({
 	type: z.literal("join.response"),
 	/** Correlation ID echoed from join.request for Platform relay routing. */
-	messageId: z.string().optional(),
+	messageId: z.string().max(MAX_MESSAGE_ID).optional(),
 	success: z.boolean(),
-	/** Base64-encoded AES-256-GCM encrypted config bundle (present on success). */
+	joinProtocol: z.literal(2).optional(),
+	/** The existing orchestrator's one-time X25519 public key, DER SPKI, base64. */
+	serverPublicKey: z.string().max(128).regex(BASE64).optional(),
+	/** 32 random bytes, base64. */
+	serverNonce: z.string().max(64).regex(BASE64).optional(),
+	/** HMAC-SHA256 over the response transcript, lowercase hex. */
+	serverProof: z.string().regex(HEX_PROOF).optional(),
+	/** Base64 AES-256-GCM sealed configuration bundle (on success). */
 	encryptedBundle: z.string().optional(),
-	/** Error message (present on failure). */
-	error: z.string().optional()
+	/** Error message (on failure). */
+	error: z.string().optional(),
+	errorCode: JoinErrorCode.optional()
 });
+function isRecord(raw) {
+	return typeof raw === "object" && raw !== null && !Array.isArray(raw);
+}
+function messageIdOf(raw) {
+	if (!isRecord(raw)) return void 0;
+	const id = raw.messageId;
+	return typeof id === "string" && id.length <= MAX_MESSAGE_ID ? id : void 0;
+}
+/** True for an object whose `type` is `join.request`, whatever else it carries. */
+function isJoinRequestFrame(raw) {
+	return isRecord(raw) && raw.type === "join.request";
+}
+/**
+* Classify a join.request frame. A frame that carries `token` is version 1 even when
+* v2 fields are present too: it is checked before the parse, which would strip it.
+*/
+function classifyJoinRequest(raw) {
+	const messageId = messageIdOf(raw);
+	if (isJoinRequestFrame(raw) && Object.prototype.hasOwnProperty.call(raw, "token")) return {
+		kind: JoinRequestKind.enum.v1_removed,
+		messageId
+	};
+	const parsed = joinRequestSchema.safeParse(raw);
+	if (parsed.success) return {
+		kind: JoinRequestKind.enum.v2,
+		request: parsed.data
+	};
+	return {
+		kind: JoinRequestKind.enum.invalid,
+		messageId
+	};
+}
+/** A refused join.response carrying its error code. */
+function buildJoinRefusal(messageId, errorCode, error) {
+	return {
+		type: "join.response",
+		messageId,
+		success: false,
+		errorCode,
+		error
+	};
+}
 //#endregion
-export { joinRequestSchema, joinResponseSchema };
+export { INVALID_JOIN_REQUEST_MESSAGE, JOIN_PROTOCOL_UNSUPPORTED_MESSAGE, JOIN_PROTOCOL_UPGRADE_TOKEN, JOIN_PROTOCOL_V1_REMOVED_MESSAGE, JOIN_PROTOCOL_VERSION, JoinErrorCode, JoinRequestKind, LEGACY_JOINER_AUTH_MESSAGE, buildJoinRefusal, classifyJoinRequest, isJoinRequestFrame, joinRequestSchema, joinResponseSchema, joinRoutingSchema };
 
 //# sourceMappingURL=join.js.map

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -102,7 +102,6 @@ export declare const jobDispatchSchema: z.ZodObject<{
     lockFileUrl: z.ZodString;
     jobConfig: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     timestamp: z.ZodNumber;
-    token: z.ZodOptional<z.ZodString>;
     secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     namespacedSecrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
     maxLogSizeBytes: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
@@ -210,9 +209,7 @@ export declare const registerAckSchema: z.ZodObject<{
     scalerManaged: z.ZodDefault<z.ZodBoolean>;
     pendingDispatch: z.ZodOptional<z.ZodBoolean>;
     warmPool: z.ZodOptional<z.ZodBoolean>;
-    capabilities: z.ZodOptional<z.ZodObject<{
-        artifactCompleteAck: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>>;
+    capabilities: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
 }, z.core.$strip>;
 /** Agent registration with capabilities and capacity. */
 export declare const agentRegisterSchema: z.ZodObject<{
@@ -237,9 +234,7 @@ export declare const agentRegisterSchema: z.ZodObject<{
     runningAsUser: z.ZodOptional<z.ZodString>;
     runningAsUid: z.ZodOptional<z.ZodNumber>;
     properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
-    capabilities: z.ZodOptional<z.ZodObject<{
-        globalEvalSkipsResultAwareGenerators: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>>;
+    capabilities: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
 }, z.core.$strip>;
 /** Periodic agent status update. */
 export declare const agentStatusSchema: z.ZodObject<{
@@ -291,8 +286,8 @@ export declare const jobStatusSchema: z.ZodObject<{
  * `LockJob` interface in `trigger/types.ts`, and a hand-written Zod copy would
  * drift and start rejecting legitimate generated jobs.
  *
- * Every field beyond the verdict itself is `.optional()` so an older peer
- * tolerates the message unchanged.
+ * Every field beyond the verdict itself is `.optional()`: an undecided or
+ * job-less verdict omits them.
  */
 export declare const globalEvalCandidateResultSchema: z.ZodObject<{
     workflowName: z.ZodString;
@@ -387,10 +382,10 @@ export declare const agentLogChunkSchema: z.ZodObject<{
     stepIndex: z.ZodNumber;
     lines: z.ZodArray<z.ZodString>;
     timestamp: z.ZodNumber;
-    stream: z.ZodOptional<z.ZodEnum<{
+    stream: z.ZodEnum<{
         stderr: "stderr";
         stdout: "stdout";
-    }>>;
+    }>;
 }, z.core.$strip>;
 /** Step-level execution state report (agent -> orchestrator). */
 export declare const agentStepStatusSchema: z.ZodObject<{
@@ -640,9 +635,7 @@ export declare const ArtifactCompleteAckOutcome: z.ZodEnum<{
 export type ArtifactCompleteAckOutcome = z.infer<typeof ArtifactCompleteAckOutcome>;
 /**
  * Orchestrator -> Agent: the outcome of committing an
- * `artifacts.upload.complete`. Sent by orchestrators that advertise the
- * `artifactCompleteAck` capability on `register.ack`; the agent awaits it and
- * fails the workflow step on `failed`/timeout, so a lost commit surfaces as a
+ * `artifacts.upload.complete`. The agent awaits it and fails the workflow step on `failed`/timeout, so a lost commit surfaces as a
  * failed step instead of a green run with a missing artifact. `requestId`
  * echoes the complete message's `messageId`.
  */
@@ -702,8 +695,7 @@ export declare const eventEmitResponseSchema: z.ZodObject<{
  * A provisioned agent normally sends this itself to self-bootstrap — the claim
  * code is the authorization, so it may send it before it authenticates or
  * registers. A provisioning workflow can also send it to obtain the token
- * directly. Additive/negotiated by presence — older peers that never emit it
- * are unaffected, so it needs no `PROTOCOL_VERSION` bump of its own.
+ * directly.
  */
 export declare const scalerClaimCredentialsSchema: z.ZodObject<{
     type: z.ZodLiteral<"scaler.claim-credentials">;
@@ -900,7 +892,6 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     lockFileUrl: z.ZodString;
     jobConfig: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     timestamp: z.ZodNumber;
-    token: z.ZodOptional<z.ZodString>;
     secrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     namespacedSecrets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
     maxLogSizeBytes: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
@@ -1004,9 +995,7 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     scalerManaged: z.ZodDefault<z.ZodBoolean>;
     pendingDispatch: z.ZodOptional<z.ZodBoolean>;
     warmPool: z.ZodOptional<z.ZodBoolean>;
-    capabilities: z.ZodOptional<z.ZodObject<{
-        artifactCompleteAck: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>>;
+    capabilities: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"job.concurrency.ack">;
     requestId: z.ZodString;
@@ -1143,9 +1132,7 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     runningAsUser: z.ZodOptional<z.ZodString>;
     runningAsUid: z.ZodOptional<z.ZodNumber>;
     properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
-    capabilities: z.ZodOptional<z.ZodObject<{
-        globalEvalSkipsResultAwareGenerators: z.ZodOptional<z.ZodBoolean>;
-    }, z.core.$loose>>;
+    capabilities: z.ZodOptional<z.ZodObject<{}, z.core.$loose>>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"agent.status">;
     messageId: z.ZodString;
@@ -1204,10 +1191,10 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     stepIndex: z.ZodNumber;
     lines: z.ZodArray<z.ZodString>;
     timestamp: z.ZodNumber;
-    stream: z.ZodOptional<z.ZodEnum<{
+    stream: z.ZodEnum<{
         stderr: "stderr";
         stdout: "stdout";
-    }>>;
+    }>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"step.status">;
     messageId: z.ZodString;
@@ -1263,37 +1250,45 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     type: z.ZodLiteral<"config.ack">;
     messageId: z.ZodString;
     agentId: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strip>, z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"cache.upload.request">;
     messageId: z.ZodString;
     jobId: z.ZodString;
-    cacheType: z.ZodEnum<{
-        deps: "deps";
-        source: "source";
-    }>;
+    cacheType: z.ZodLiteral<"source">;
     contentHash: z.ZodOptional<z.ZodString>;
+    platform: z.ZodString;
+    arch: z.ZodString;
+    sourceTarDigest: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"cache.upload.request">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    cacheType: z.ZodLiteral<"deps">;
     lockfileHash: z.ZodOptional<z.ZodString>;
     platform: z.ZodString;
     arch: z.ZodString;
-    depsHash: z.ZodOptional<z.ZodString>;
-    sourceTarDigest: z.ZodOptional<z.ZodString>;
+    depsHash: z.ZodString;
     siblingsDigest: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strip>], "cacheType">, z.ZodDiscriminatedUnion<[z.ZodObject<{
     type: z.ZodLiteral<"cache.upload.complete">;
     messageId: z.ZodString;
     jobId: z.ZodString;
-    cacheType: z.ZodEnum<{
-        deps: "deps";
-        source: "source";
-    }>;
+    cacheType: z.ZodLiteral<"source">;
     contentHash: z.ZodOptional<z.ZodString>;
+    platform: z.ZodString;
+    arch: z.ZodString;
+    sourceTarDigest: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"cache.upload.complete">;
+    messageId: z.ZodString;
+    jobId: z.ZodString;
+    cacheType: z.ZodLiteral<"deps">;
     lockfileHash: z.ZodOptional<z.ZodString>;
     platform: z.ZodString;
     arch: z.ZodString;
-    depsHash: z.ZodOptional<z.ZodString>;
-    sourceTarDigest: z.ZodOptional<z.ZodString>;
+    depsHash: z.ZodString;
     siblingsDigest: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strip>], "cacheType">, z.ZodObject<{
     type: z.ZodLiteral<"cache.user.restore.request">;
     messageId: z.ZodString;
     jobId: z.ZodString;