@kici-dev/engine 0.8.0 → 0.9.1

package/dist/protocol/messages/dashboard-global-workflows.d.ts

@@ -14,15 +14,13 @@
  * source in the org. When present, it qualifies the entry to a single
  * webhook source (e.g., `github:42` vs `generic:org:abcd`).
  *
- * Three independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
+ * Two independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
  *   - `allowedRepos` restricts which repos may AUTHOR global workflows.
  *   - `deniedRepos` blocks global dispatches for events FROM these SOURCE repos.
- *   - `elevatedRepos` is DEPRECATED and not enforced — see the field comments
- *     below and `docs/user/deprecations.md`.
  */
 import { z } from 'zod';
 /**
- * One entry in any of the three repo-pattern lists. `routingKey` is the
+ * One entry in either repo-pattern list. `routingKey` is the
  * source-qualifier; when absent the entry applies to any source in the org.
  */
 export declare const repoPatternEntrySchema: z.ZodObject<{
@@ -51,7 +49,11 @@ export type RepoPatternEntry = z.infer<typeof repoPatternEntrySchema>;
  * compiles into a real inversion, and `[!…]`, which it does not.
  */
 export declare function invalidRepoPatternReason(pattern: string): string | null;
-/** Projected org-level global workflow settings. */
+/**
+ * Projected org-level global workflow settings. `.strict()`: the projection
+ * once carried an unenforced elevated-access list, so an orchestrator still
+ * echoing one is on a build this protocol floor refuses.
+ */
 export declare const globalWorkflowSettingsSchema: z.ZodObject<{
     customerId: z.ZodString;
     enabled: z.ZodBoolean;
@@ -63,13 +65,9 @@ export declare const globalWorkflowSettingsSchema: z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>;
-    elevatedRepos: z.ZodNullable<z.ZodArray<z.ZodObject<{
-        routingKey: z.ZodOptional<z.ZodString>;
-        pattern: z.ZodString;
-    }, z.core.$strip>>>;
     createdAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodNullable<z.ZodString>;
-}, z.core.$strip>;
+}, z.core.$strict>;
 export type GlobalWorkflowSettings = z.infer<typeof globalWorkflowSettingsSchema>;
 /** Request the current global-workflow settings row. */
 export declare const globalWorkflowsGetRequestSchema: z.ZodObject<{
@@ -150,10 +148,6 @@ export declare const globalWorkflowsUpdateRequestSchema: z.ZodObject<{
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-    elevatedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
-        routingKey: z.ZodOptional<z.ZodString>;
-        pattern: z.ZodString;
-    }, z.core.$strip>>>>;
 }, z.core.$strict>;
 export declare const globalWorkflowsGetResponseSchema: z.ZodObject<{
     type: z.ZodLiteral<"dashboard.global-workflows.get.response">;
@@ -169,13 +163,9 @@ export declare const globalWorkflowsGetResponseSchema: z.ZodObject<{
             routingKey: z.ZodOptional<z.ZodString>;
             pattern: z.ZodString;
         }, z.core.$strip>>>;
-        elevatedRepos: z.ZodNullable<z.ZodArray<z.ZodObject<{
-            routingKey: z.ZodOptional<z.ZodString>;
-            pattern: z.ZodString;
-        }, z.core.$strip>>>;
         createdAt: z.ZodNullable<z.ZodString>;
         updatedAt: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const globalWorkflowsUpdateResponseSchema: z.ZodObject<{
@@ -192,13 +182,9 @@ export declare const globalWorkflowsUpdateResponseSchema: z.ZodObject<{
             routingKey: z.ZodOptional<z.ZodString>;
             pattern: z.ZodString;
         }, z.core.$strip>>>;
-        elevatedRepos: z.ZodNullable<z.ZodArray<z.ZodObject<{
-            routingKey: z.ZodOptional<z.ZodString>;
-            pattern: z.ZodString;
-        }, z.core.$strip>>>;
         createdAt: z.ZodNullable<z.ZodString>;
         updatedAt: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type GlobalWorkflowsGetRequest = z.infer<typeof globalWorkflowsGetRequestSchema>;

package/dist/protocol/messages/dashboard-global-workflows.js

@@ -19,14 +19,12 @@ import { z } from "zod";
 * source in the org. When present, it qualifies the entry to a single
 * webhook source (e.g., `github:42` vs `generic:org:abcd`).
 *
-* Three independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
+* Two independent policy axes (see GlobalWorkflowPolicy in the orchestrator):
 *   - `allowedRepos` restricts which repos may AUTHOR global workflows.
 *   - `deniedRepos` blocks global dispatches for events FROM these SOURCE repos.
-*   - `elevatedRepos` is DEPRECATED and not enforced — see the field comments
-*     below and `docs/user/deprecations.md`.
 */
 /**
-* One entry in any of the three repo-pattern lists. `routingKey` is the
+* One entry in either repo-pattern list. `routingKey` is the
 * source-qualifier; when absent the entry applies to any source in the org.
 */
 const repoPatternEntrySchema = z.object({
@@ -59,7 +57,11 @@ function invalidRepoPatternReason(pattern) {
 	if (negation) return `${negation} is not allowed on a policy list — the list's direction already encodes allow/deny`;
 	return null;
 }
-/** Projected org-level global workflow settings. */
+/**
+* Projected org-level global workflow settings. `.strict()`: the projection
+* once carried an unenforced elevated-access list, so an orchestrator still
+* echoing one is on a build this protocol floor refuses.
+*/
 const globalWorkflowSettingsSchema = z.object({
 	customerId: z.string(),
 	/**
@@ -71,15 +73,9 @@ const globalWorkflowSettingsSchema = z.object({
 	enabled: z.boolean(),
 	allowedRepos: z.array(repoPatternEntrySchema).nullable(),
 	deniedRepos: z.array(repoPatternEntrySchema).nullable(),
-	/**
-	* @deprecated Stored and echoed back, but never enforced: an organization-wide
-	* workflow's job is dispatched with no secret material at all, so there is no
-	* secret access for this list to widen. Removal at v1.0.0.
-	*/
-	elevatedRepos: z.array(repoPatternEntrySchema).nullable(),
 	createdAt: z.string().nullable(),
 	updatedAt: z.string().nullable()
-});
+}).strict();
 /** Request the current global-workflow settings row. */
 const globalWorkflowsGetRequestSchema = z.object({
 	type: z.literal("dashboard.global-workflows.get"),
@@ -102,9 +98,7 @@ const globalWorkflowsUpdateRequestSchema = z.object({
 	requestId: z.string(),
 	actor: actorPrincipalSchema,
 	allowedRepos: z.array(repoPatternEntrySchema).nullable().optional(),
-	deniedRepos: z.array(repoPatternEntrySchema).nullable().optional(),
-	/** @deprecated Accepted and stored, but never enforced. Removal at v1.0.0. */
-	elevatedRepos: z.array(repoPatternEntrySchema).nullable().optional()
+	deniedRepos: z.array(repoPatternEntrySchema).nullable().optional()
 }).strict();
 const globalWorkflowsGetResponseSchema = z.object({
 	type: z.literal("dashboard.global-workflows.get.response"),

package/dist/protocol/messages/dashboard.d.ts

@@ -102,7 +102,6 @@ export declare const dashboardRunStructuredResponseSchema: z.ZodObject<{
         completedAt: z.ZodNullable<z.ZodString>;
         durationMs: z.ZodNullable<z.ZodNumber>;
         trustTier: z.ZodNullable<z.ZodEnum<{
-            known: "known";
             trusted: "trusted";
             unknown: "unknown";
         }>>;
@@ -563,7 +562,6 @@ export declare const dashboardRunDetailResponseSchema: z.ZodObject<{
     }, z.core.$strip>>;
     trustContext: z.ZodOptional<z.ZodObject<{
         trustTier: z.ZodNullable<z.ZodEnum<{
-            known: "known";
             trusted: "trusted";
             unknown: "unknown";
         }>>;
@@ -6746,10 +6744,6 @@ export declare const dashboardPlatformToOrchSchema: z.ZodDiscriminatedUnion<[z.Z
         routingKey: z.ZodOptional<z.ZodString>;
         pattern: z.ZodString;
     }, z.core.$strip>>>>;
-    elevatedRepos: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodObject<{
-        routingKey: z.ZodOptional<z.ZodString>;
-        pattern: z.ZodString;
-    }, z.core.$strip>>>>;
 }, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.access-log.list">;
     requestId: z.ZodString;
@@ -7210,7 +7204,6 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
     }, z.core.$strip>>;
     trustContext: z.ZodOptional<z.ZodObject<{
         trustTier: z.ZodNullable<z.ZodEnum<{
-            known: "known";
             trusted: "trusted";
             unknown: "unknown";
         }>>;
@@ -7275,7 +7268,6 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
         completedAt: z.ZodNullable<z.ZodString>;
         durationMs: z.ZodNullable<z.ZodNumber>;
         trustTier: z.ZodNullable<z.ZodEnum<{
-            known: "known";
             trusted: "trusted";
             unknown: "unknown";
         }>>;
@@ -8488,13 +8480,9 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             routingKey: z.ZodOptional<z.ZodString>;
             pattern: z.ZodString;
         }, z.core.$strip>>>;
-        elevatedRepos: z.ZodNullable<z.ZodArray<z.ZodObject<{
-            routingKey: z.ZodOptional<z.ZodString>;
-            pattern: z.ZodString;
-        }, z.core.$strip>>>;
         createdAt: z.ZodNullable<z.ZodString>;
         updatedAt: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.global-workflows.update.response">;
@@ -8510,13 +8498,9 @@ export declare const dashboardOrchToPlatformSchema: z.ZodDiscriminatedUnion<[z.Z
             routingKey: z.ZodOptional<z.ZodString>;
             pattern: z.ZodString;
         }, z.core.$strip>>>;
-        elevatedRepos: z.ZodNullable<z.ZodArray<z.ZodObject<{
-            routingKey: z.ZodOptional<z.ZodString>;
-            pattern: z.ZodString;
-        }, z.core.$strip>>>;
         createdAt: z.ZodNullable<z.ZodString>;
         updatedAt: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"dashboard.access-log.list.response">;
@@ -8873,7 +8857,6 @@ export declare const dashboardRunDetailApiResponseSchema: z.ZodObject<{
     }, z.core.$strip>>;
     trustContext: z.ZodOptional<z.ZodObject<{
         trustTier: z.ZodNullable<z.ZodEnum<{
-            known: "known";
             trusted: "trusted";
             unknown: "unknown";
         }>>;
@@ -9383,8 +9366,6 @@ export type RunEvent = z.infer<typeof runEventSchema>;
  */
 export declare const trustPolicyResponseSchema: z.ZodObject<{
     forkPolicy: z.ZodString;
-    unknownContributorPolicy: z.ZodString;
-    workflowChangePolicy: z.ZodString;
     approvalExpiryHours: z.ZodNumber;
     approvalExpirySeconds: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
@@ -9434,7 +9415,6 @@ export declare const orgMemberSchema: z.ZodObject<{
     suspendedAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
     joinedAt: z.ZodCoercedString<unknown>;
     ciTrustLevel: z.ZodString;
-    ciTrustOverride: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     identityLinks: z.ZodArray<z.ZodObject<{
         provider: z.ZodString;
         providerUsername: z.ZodString;
@@ -9455,7 +9435,6 @@ export declare const memberListResponseSchema: z.ZodObject<{
         suspendedAt: z.ZodNullable<z.ZodCoercedString<unknown>>;
         joinedAt: z.ZodCoercedString<unknown>;
         ciTrustLevel: z.ZodString;
-        ciTrustOverride: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         identityLinks: z.ZodArray<z.ZodObject<{
             provider: z.ZodString;
             providerUsername: z.ZodString;

package/dist/protocol/messages/dashboard.js

@@ -6,6 +6,7 @@ import { actorPrincipalSchema } from "./actor.js";
 import { HeldRunStatus } from "../../context/held-run-status.js";
 import { dashboardSealedEnvelopeSchema } from "./dashboard-sealed-write.js";
 import { JobKind, StepConcurrencyKind, initFailureSchema, stateReplayRunSchema } from "./execution-status.js";
+import { TrustTierSchema } from "../../context/types.js";
 import { agentRunResultSchema } from "./agent-run-result.js";
 import { kiciBundleSchema } from "../../provenance/bundle.js";
 import { dashboardAccessLogListRequestSchema, dashboardAccessLogListResponseSchema } from "./access-log.js";
@@ -208,11 +209,7 @@ const dashboardJobDetailSchema = z.object({
 });
 /** Trust context from orchestrator execution_runs (populated for PR-triggered runs). */
 const trustContextSchema = z.object({
-	trustTier: z.enum([
-		"trusted",
-		"known",
-		"unknown"
-	]).nullable(),
+	trustTier: TrustTierSchema.nullable(),
 	lockFileSource: z.enum(["head", "base"]).nullable(),
 	contributorUsername: z.string().nullable()
 });
@@ -2526,8 +2523,6 @@ const runEventSchema = z.object({
 */
 const trustPolicyResponseSchema = z.object({
 	forkPolicy: z.string(),
-	unknownContributorPolicy: z.string(),
-	workflowChangePolicy: z.string(),
 	approvalExpiryHours: z.number(),
 	approvalExpirySeconds: z.number().optional()
 });
@@ -2562,20 +2557,6 @@ const orgMemberSchema = z.object({
 	suspendedAt: z.coerce.string().nullable(),
 	joinedAt: z.coerce.string(),
 	ciTrustLevel: z.string(),
-	/**
-	* The per-member `ci_trust` override, when one is stored, or `null` when the
-	* member's level is entirely role-derived.
-	*
-	* Carried beside `ciTrustLevel` rather than folded into it, because the two
-	* answer different questions. `ciTrustLevel` is the effective level the CI
-	* trust gate decides with — the role-derived level with any override applied
-	* on top — so it cannot say which half produced it. An override OUTRANKS the
-	* roles, so an org that lowered a member by override has no way to see that,
-	* and no way to undo it, from a payload that reports only the result.
-	*
-	* Optional so an older client keeps parsing the response.
-	*/
-	ciTrustOverride: z.string().nullable().optional(),
 	identityLinks: z.array(memberIdentityLinkSchema)
 });
 /** Response for org members list endpoint. */

package/dist/protocol/messages/oidc-token-relay.d.ts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
 /**
- * agent.api method name for the provenance ID-token relay.
+ * agent.api method name for the provenance ID-token request.
  *
- * Single source of truth: both the orchestrator's relay-handler registration
+ * Single source of truth: both the orchestrator's mint-handler registration
  * and the SDK `ctx.kici.oidc.token()` wrapper import this constant, so the
  * wire method name lives in exactly one place.
  */
@@ -18,8 +18,6 @@ export declare const oidcTokenRequestParamsSchema: z.ZodObject<{
     audience: z.ZodString;
 }, z.core.$strip>;
 export type OidcTokenRequestParams = z.infer<typeof oidcTokenRequestParamsSchema>;
-export { OidcMintErrorCode } from './oidc-mint.js';
-export type { OidcMintErrorCode as OidcMintErrorCodeType } from './oidc-mint.js';
 /** A successfully minted ID token bound to a job. */
 export declare const oidcMintedTokenSchema: z.ZodObject<{
     token: z.ZodString;
@@ -46,13 +44,4 @@ export declare const oidcTokenResultSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
 }, z.core.$strip>]>;
 export type OidcTokenResult = z.infer<typeof oidcTokenResultSchema>;
-/** Extra fields a deferred *fulfilment* mint carries (orchestrator -> Platform). */
-export declare const deferredMintParamsSchema: z.ZodObject<{
-    statementHash: z.ZodString;
-    origin: z.ZodEnum<{
-        deferred: "deferred";
-        "offline-backfill": "offline-backfill";
-    }>;
-}, z.core.$strip>;
-export type DeferredMintParams = z.infer<typeof deferredMintParamsSchema>;
 //# sourceMappingURL=oidc-token-relay.d.ts.map

package/dist/protocol/messages/oidc-token-relay.js

@@ -1,12 +1,10 @@
 import "../../rolldown-runtime-ClRpJifh.js";
-import { AttestationOrigin } from "../../provenance/attestation-origin.js";
-import { OidcMintErrorCode } from "./oidc-mint.js";
 import { z } from "zod";
 //#region src/protocol/messages/oidc-token-relay.ts
 /**
-* agent.api method name for the provenance ID-token relay.
+* agent.api method name for the provenance ID-token request.
 *
-* Single source of truth: both the orchestrator's relay-handler registration
+* Single source of truth: both the orchestrator's mint-handler registration
 * and the SDK `ctx.kici.oidc.token()` wrapper import this constant, so the
 * wire method name lives in exactly one place.
 */
@@ -38,12 +36,7 @@ const oidcTokenResultSchema = z.union([oidcMintedTokenSchema, z.object({
 	deferred: z.literal(true),
 	code: z.enum(["unavailable", "failed"])
 })]);
-/** Extra fields a deferred *fulfilment* mint carries (orchestrator -> Platform). */
-const deferredMintParamsSchema = z.object({
-	statementHash: z.string(),
-	origin: AttestationOrigin.extract(["deferred", "offline-backfill"])
-});
 //#endregion
-export { OIDC_TOKEN_REQUEST_METHOD, OidcMintErrorCode, deferredMintParamsSchema, oidcMintedTokenSchema, oidcTokenRequestParamsSchema, oidcTokenResultSchema };
+export { OIDC_TOKEN_REQUEST_METHOD, oidcMintedTokenSchema, oidcTokenRequestParamsSchema, oidcTokenResultSchema };
 
 //# sourceMappingURL=oidc-token-relay.js.map

package/dist/protocol/messages/orchestrator-agent.d.ts

@@ -108,7 +108,6 @@ export declare const jobDispatchSchema: z.ZodObject<{
     maxLogSizeBytes: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     concurrencyWaitTimeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     sourceTarUrl: z.ZodOptional<z.ZodString>;
-    sourceTarHash: z.ZodOptional<z.ZodString>;
     sourceTarDigest: z.ZodOptional<z.ZodString>;
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
@@ -613,16 +612,21 @@ export declare const artifactsUploadResponseSchema: z.ZodObject<{
     }>>;
     error: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
-/** Agent -> Orchestrator: confirm an artifact upload finished; records the DB row. */
+/**
+ * Agent -> Orchestrator: confirm an artifact upload finished; records the DB row.
+ *
+ * The orchestrator derives the storage key from the server-resolved run and
+ * artifact name and reads the real object size back from storage, so the agent
+ * asserts neither. `.strict()`: an agent still echoing either is on a build the
+ * protocol floor refuses, and a stray field is a version-skew signal.
+ */
 export declare const artifactsUploadCompleteSchema: z.ZodObject<{
     type: z.ZodLiteral<"artifacts.upload.complete">;
     messageId: z.ZodString;
     jobId: z.ZodString;
     name: z.ZodString;
-    sizeBytes: z.ZodNumber;
     sha256: z.ZodString;
-    storageKey: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strict>;
 /**
  * Outcome the orchestrator reports for an artifact commit: the DB row was
  * written (`committed`) or the commit could not be completed (`failed`).
@@ -893,7 +897,6 @@ export declare const orchestratorToAgentMessageSchema: z.ZodDiscriminatedUnion<[
     maxLogSizeBytes: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     concurrencyWaitTimeoutMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     sourceTarUrl: z.ZodOptional<z.ZodString>;
-    sourceTarHash: z.ZodOptional<z.ZodString>;
     sourceTarDigest: z.ZodOptional<z.ZodString>;
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
@@ -1337,10 +1340,8 @@ export declare const agentToOrchestratorMessageSchema: z.ZodDiscriminatedUnion<[
     messageId: z.ZodString;
     jobId: z.ZodString;
     name: z.ZodString;
-    sizeBytes: z.ZodNumber;
     sha256: z.ZodString;
-    storageKey: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     type: z.ZodLiteral<"artifacts.download.request">;
     messageId: z.ZodString;
     jobId: z.ZodString;

package/dist/protocol/messages/orchestrator-agent.js

@@ -105,13 +105,6 @@ const jobDispatchSchema = z.object({
 	/** URL or file:// path to a pre-packed `.kici/` source tarball. If present, agent extracts it into workDir instead of cloning the repo. */
 	sourceTarUrl: z.string().optional(),
 	/**
-	* @deprecated Use `sourceTarDigest`. Despite its name this carries the
-	* workflow `contentHash`, not a hash of the tarball bytes, so an agent
-	* could not verify a restored tarball against it. Kept on the wire for
-	* older agents; removed at v1.0.0.
-	*/
-	sourceTarHash: z.string().optional(),
-	/**
 	* SHA-256 of the source tarball's own bytes, for integrity verification
 	* before extraction. The sibling of `depsHash`, which has always carried
 	* the dependency tarball's real digest.
@@ -772,31 +765,22 @@ const artifactsUploadResponseSchema = z.object({
 	*/
 	error: z.string().optional()
 });
-/** Agent -> Orchestrator: confirm an artifact upload finished; records the DB row. */
+/**
+* Agent -> Orchestrator: confirm an artifact upload finished; records the DB row.
+*
+* The orchestrator derives the storage key from the server-resolved run and
+* artifact name and reads the real object size back from storage, so the agent
+* asserts neither. `.strict()`: an agent still echoing either is on a build the
+* protocol floor refuses, and a stray field is a version-skew signal.
+*/
 const artifactsUploadCompleteSchema = z.object({
 	type: z.literal("artifacts.upload.complete"),
 	messageId: z.string(),
 	jobId: z.string(),
 	name: z.string(),
-	/**
-	* Packed tarball size in bytes.
-	*
-	* @deprecated Advisory only — the orchestrator reads the real object size back
-	* from storage and records that instead. Still sent for backward compatibility
-	* with older orchestrators; removed at v1.0.0.
-	*/
-	sizeBytes: z.number().int().nonnegative(),
 	/** SHA-256 (hex) of the tarball bytes. */
-	sha256: z.string(),
-	/**
-	* Storage key echoed from the grant response.
-	*
-	* @deprecated Ignored server-side — the orchestrator derives the storage key
-	* from the server-resolved run and artifact name. Still sent for backward
-	* compatibility with older orchestrators; removed at v1.0.0.
-	*/
-	storageKey: z.string()
-});
+	sha256: z.string()
+}).strict();
 /**
 * Outcome the orchestrator reports for an artifact commit: the DB row was
 * written (`committed`) or the commit could not be completed (`failed`).

package/dist/protocol/messages/peer.d.ts

@@ -7,7 +7,12 @@ export declare const peerCapabilitiesSchema: z.ZodObject<{
         direct: "direct";
     }>>;
 }, z.core.$strip>;
-/** Scaler capacity summary included in peer heartbeat and auth response for routing decisions. */
+/**
+ * Scaler capacity summary included in peer heartbeat and auth response for
+ * routing decisions. `.strict()`: the entry once carried a scaler-wide taint
+ * union a peer on this protocol floor never sends, so a stray field is a
+ * version-skew signal rather than something to ignore.
+ */
 declare const scalerCapacitySummarySchema: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     type: z.ZodOptional<z.ZodString>;
@@ -15,9 +20,8 @@ declare const scalerCapacitySummarySchema: z.ZodObject<{
     maxAgents: z.ZodNumber;
     activeCount: z.ZodNumber;
     spawnsOnLocalHost: z.ZodOptional<z.ZodBoolean>;
-    mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
-    labelSetMandatoryLabels: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
-}, z.core.$strip>;
+    labelSetMandatoryLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
 /** Peer hello: initiator sends ephemeral X25519 public key and nonce. */
 export declare const peerHelloSchema: z.ZodObject<{
     type: z.ZodLiteral<"peer.hello">;
@@ -58,7 +62,7 @@ export declare const peerAuthResponseSchema: z.ZodObject<{
         maxConcurrency: z.ZodNumber;
         platform: z.ZodString;
         arch: z.ZodString;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        mandatoryLabels: z.ZodArray<z.ZodString>;
         scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -68,9 +72,8 @@ export declare const peerAuthResponseSchema: z.ZodObject<{
         maxAgents: z.ZodNumber;
         activeCount: z.ZodNumber;
         spawnsOnLocalHost: z.ZodOptional<z.ZodBoolean>;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
-        labelSetMandatoryLabels: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
-    }, z.core.$strip>>>;
+        labelSetMandatoryLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
@@ -93,7 +96,7 @@ export declare const peerHeartbeatSchema: z.ZodObject<{
         maxConcurrency: z.ZodNumber;
         platform: z.ZodString;
         arch: z.ZodString;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        mandatoryLabels: z.ZodArray<z.ZodString>;
         scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
     capabilities: z.ZodObject<{
@@ -110,9 +113,8 @@ export declare const peerHeartbeatSchema: z.ZodObject<{
         maxAgents: z.ZodNumber;
         activeCount: z.ZodNumber;
         spawnsOnLocalHost: z.ZodOptional<z.ZodBoolean>;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
-        labelSetMandatoryLabels: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
-    }, z.core.$strip>>>;
+        labelSetMandatoryLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
     configVersion: z.ZodOptional<z.ZodNumber>;
     registryVersion: z.ZodOptional<z.ZodNumber>;
     clusterSettingsVersion: z.ZodOptional<z.ZodNumber>;
@@ -172,7 +174,6 @@ export declare const jobRerouteSchema: z.ZodObject<{
     provider: z.ZodOptional<z.ZodString>;
     providerContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     sourceTarUrl: z.ZodOptional<z.ZodString>;
-    sourceTarHash: z.ZodOptional<z.ZodString>;
     sourceTarDigest: z.ZodOptional<z.ZodString>;
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
@@ -488,7 +489,7 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         maxConcurrency: z.ZodNumber;
         platform: z.ZodString;
         arch: z.ZodString;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        mandatoryLabels: z.ZodArray<z.ZodString>;
         scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -498,9 +499,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         maxAgents: z.ZodNumber;
         activeCount: z.ZodNumber;
         spawnsOnLocalHost: z.ZodOptional<z.ZodBoolean>;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
-        labelSetMandatoryLabels: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
-    }, z.core.$strip>>>;
+        labelSetMandatoryLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
@@ -521,7 +521,7 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         maxConcurrency: z.ZodNumber;
         platform: z.ZodString;
         arch: z.ZodString;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        mandatoryLabels: z.ZodArray<z.ZodString>;
         scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
     capabilities: z.ZodObject<{
@@ -538,9 +538,8 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         maxAgents: z.ZodNumber;
         activeCount: z.ZodNumber;
         spawnsOnLocalHost: z.ZodOptional<z.ZodBoolean>;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
-        labelSetMandatoryLabels: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
-    }, z.core.$strip>>>;
+        labelSetMandatoryLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
     configVersion: z.ZodOptional<z.ZodNumber>;
     registryVersion: z.ZodOptional<z.ZodNumber>;
     clusterSettingsVersion: z.ZodOptional<z.ZodNumber>;
@@ -598,7 +597,6 @@ export declare const peerToPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObje
     provider: z.ZodOptional<z.ZodString>;
     providerContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     sourceTarUrl: z.ZodOptional<z.ZodString>;
-    sourceTarHash: z.ZodOptional<z.ZodString>;
     sourceTarDigest: z.ZodOptional<z.ZodString>;
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;
@@ -805,7 +803,7 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
         maxConcurrency: z.ZodNumber;
         platform: z.ZodString;
         arch: z.ZodString;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        mandatoryLabels: z.ZodArray<z.ZodString>;
         scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>>;
     scalerCapacity: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -815,9 +813,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
         maxAgents: z.ZodNumber;
         activeCount: z.ZodNumber;
         spawnsOnLocalHost: z.ZodOptional<z.ZodBoolean>;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
-        labelSetMandatoryLabels: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
-    }, z.core.$strip>>>;
+        labelSetMandatoryLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
     capabilities: z.ZodOptional<z.ZodObject<{
         s3LogAccess: z.ZodBoolean;
         logRoutingOverride: z.ZodOptional<z.ZodEnum<{
@@ -838,7 +835,7 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
         maxConcurrency: z.ZodNumber;
         platform: z.ZodString;
         arch: z.ZodString;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        mandatoryLabels: z.ZodArray<z.ZodString>;
         scalerName: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$strip>>;
     capabilities: z.ZodObject<{
@@ -855,9 +852,8 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
         maxAgents: z.ZodNumber;
         activeCount: z.ZodNumber;
         spawnsOnLocalHost: z.ZodOptional<z.ZodBoolean>;
-        mandatoryLabels: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString>>>;
-        labelSetMandatoryLabels: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
-    }, z.core.$strip>>>;
+        labelSetMandatoryLabels: z.ZodArray<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>>;
     configVersion: z.ZodOptional<z.ZodNumber>;
     registryVersion: z.ZodOptional<z.ZodNumber>;
     clusterSettingsVersion: z.ZodOptional<z.ZodNumber>;
@@ -915,7 +911,6 @@ export declare const peerFromPeerMessageSchema: z.ZodDiscriminatedUnion<[z.ZodOb
     provider: z.ZodOptional<z.ZodString>;
     providerContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     sourceTarUrl: z.ZodOptional<z.ZodString>;
-    sourceTarHash: z.ZodOptional<z.ZodString>;
     sourceTarDigest: z.ZodOptional<z.ZodString>;
     depsUrl: z.ZodOptional<z.ZodString>;
     depsHash: z.ZodOptional<z.ZodString>;