@serve.zone/interfaces 21.1.0 → 23.0.0

package/ts/data/service.ts

@@ -34,36 +34,12 @@ export interface IServiceVolume {
   options?: Record<string, string>;
 }
 
-/**
- * A single secret-bundle key delivered as a file instead of an environment
- * variable. Targets are intentionally restricted to Docker's secret tmpfs so
- * a deployment declaration cannot overwrite application or system files.
- */
-export interface IServiceSecretFile {
-  /** Key in the service's merged secret bundles. */
-  sourceKey: string;
-  /** Absolute file path below /run/secrets/. */
-  targetPath: string;
-  /** Numeric container user identity. */
-  uid: number;
-  /** Numeric container group identity. */
-  gid: number;
-  /** Read-only POSIX mode. Supported values are 0400 and 0440. */
-  mode: number;
-}
-
 export const serviceContainerArgLimits = {
   maximumArgs: 64,
   maximumArgBytes: 4096,
   maximumTotalBytes: 32 * 1024,
 } as const;
 
-export const serviceSecretFileLimits = {
-  maximumFiles: 32,
-  maximumValueBytes: 500 * 1024,
-  maximumIdentity: 2_147_483_647,
-} as const;
-
 export const normalizeServiceAbsolutePath = (pathArg: string): string | undefined => {
   if (typeof pathArg !== 'string'
     || !pathArg.startsWith('/')
@@ -85,85 +61,6 @@ export const normalizeServiceAbsolutePath = (pathArg: string): string | undefine
   return `/${segments.join('/')}`;
 };
 
-const isCanonicalSecretTargetPath = (targetPathArg: string): boolean => (
-  normalizeServiceAbsolutePath(targetPathArg) === targetPathArg
-  && /^\/run\/secrets\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(targetPathArg)
-  && targetPathArg !== '/run/secrets/secret.json'
-);
-
-const pathsOverlap = (leftArg: string, rightArg: string): boolean => {
-  const left = normalizeServiceAbsolutePath(leftArg);
-  const right = normalizeServiceAbsolutePath(rightArg);
-  if (!left || !right) return false;
-  if (left === '/' || right === '/') return true;
-  return left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
-};
-
-/** Pure, secret-value-free validation shared by Cloudly and Coreflow. */
-export const validateServiceSecretFiles = (
-  secretFilesArg: unknown,
-  volumeMountPathsArg: string[] = [],
-): string[] => {
-  if (secretFilesArg === undefined) return [];
-  if (!Array.isArray(secretFilesArg)) return ['secretFiles must be an array'];
-  if (secretFilesArg.length > serviceSecretFileLimits.maximumFiles) {
-    return [`secretFiles must contain at most ${serviceSecretFileLimits.maximumFiles} entries`];
-  }
-  const errors: string[] = [];
-  if (volumeMountPathsArg.some((mountPathArg) => (
-    normalizeServiceAbsolutePath(mountPathArg) !== mountPathArg
-  ))) {
-    errors.push('volume mount paths must be canonical absolute paths');
-  }
-  const sourceKeys: string[] = [];
-  const targetPaths: string[] = [];
-  for (const [index, candidate] of secretFilesArg.entries()) {
-    if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
-      errors.push(`secretFiles[${index}] must be an object`);
-      continue;
-    }
-    const mapping = candidate as Partial<IServiceSecretFile>;
-    if (typeof mapping.sourceKey !== 'string'
-      || mapping.sourceKey.length > 253
-      || !/^[A-Z_][A-Z0-9_]*$/.test(mapping.sourceKey)) {
-      errors.push(`secretFiles[${index}].sourceKey must be a canonical environment key`);
-    } else {
-      sourceKeys.push(mapping.sourceKey);
-    }
-    if (typeof mapping.targetPath !== 'string'
-      || !isCanonicalSecretTargetPath(mapping.targetPath)) {
-      errors.push(
-        `secretFiles[${index}].targetPath must be a unique canonical file below /run/secrets and may not be secret.json`,
-      );
-    } else {
-      targetPaths.push(mapping.targetPath);
-      if (volumeMountPathsArg.some((mountPathArg) => (
-        typeof mountPathArg === 'string' && pathsOverlap(mapping.targetPath as string, mountPathArg)
-      ))) {
-        errors.push(`secretFiles[${index}].targetPath overlaps a declared volume mount`);
-      }
-    }
-    for (const identityField of ['uid', 'gid'] as const) {
-      const identity = mapping[identityField];
-      if (!Number.isSafeInteger(identity)
-        || (identity as number) < 0
-        || (identity as number) > serviceSecretFileLimits.maximumIdentity) {
-        errors.push(`secretFiles[${index}].${identityField} must be a bounded numeric identity`);
-      }
-    }
-    if (mapping.mode !== 0o400 && mapping.mode !== 0o440) {
-      errors.push(`secretFiles[${index}].mode must be 0400 or 0440`);
-    }
-  }
-  if (new Set(sourceKeys).size !== sourceKeys.length) {
-    errors.push('secretFiles sourceKey values must be unique');
-  }
-  if (new Set(targetPaths).size !== targetPaths.length) {
-    errors.push('secretFiles targetPath values must be unique');
-  }
-  return errors;
-};
-
 /** Pure validation for the exact OCI/Docker argument vector after image entrypoint. */
 export const validateServiceContainerArgs = (containerArgsArg: unknown): string[] => {
   if (containerArgsArg === undefined) return [];
@@ -261,27 +158,12 @@ export interface IService {
     hostedAppLifecycle?: IHostedAppLifecycleState;
     reconciliationStatus?: IServiceReconciliationStatus;
     environment: { [key: string]: string };
-    /**
-     * Legacy main SecretBundle ID. New services use secretConfiguration and
-     * the server-managed secretDeployment manifest pointer.
-     *
-     * @deprecated Compatibility-only until the versioned SecretBundle migration completes.
-     */
-    secretBundleId?: string;
-    /**
-     * Legacy additional SecretBundle IDs.
-     *
-     * @deprecated Use explicit same-organization SecretSet attachments.
-     */
-    additionalSecretBundleIds?: string[];
     /** Value-free, caller-managed SecretSet attachment configuration. */
     secretConfiguration?: IServiceSecretConfiguration;
     /** Server-managed immutable manifest authority pointer. */
     secretDeployment?: IServiceSecretDeploymentPlan;
     /** Exact OCI/Docker argument vector appended after the image entrypoint. */
     containerArgs?: string[];
-    /** Secret keys mounted as files and excluded from Env and secret.json. */
-    secretFiles?: IServiceSecretFile[];
     
     /**
      * Service category determines deployment behavior

package/ts/data/settings.ts

@@ -1,94 +1,84 @@
-import * as plugins from '../plugins.js';
+import type { ISystemSecretOwner, TSecretManagementScope } from './secret.js';
 
-/**
- * Interface for Cloudly settings stored in EasyStore
- * These are runtime-configurable settings that can be modified via the UI
- */
-export interface ICloudlySettings {
-  // Cloud Provider Tokens
-  hetznerToken?: string;
-  cloudflareToken?: string;
+export interface ICloudlyS3BackupTargetDescriptor {
+  type: 's3';
+  endpoint: string;
+  bucket: string;
+  region?: string;
+  port?: number;
+  useSsl?: boolean;
+}
 
-  // Retention for archived deployment records in days (default 90)
-  deploymentArchiveRetentionDays?: string;
+export interface ICloudlyNfsBackupTargetDescriptor {
+  type: 'nfs';
+  path: string;
+}
 
-  // Long-term backup target. Type 's3' | 'nfs' | 'smb'; config is a JSON
-  // object string with the matching connection fields (s3: endpoint,
-  // accessKey, secretKey, bucket, port?, useSsl?, region?; nfs: path
-  // mounted into the cloudly container; smb: host, share, username?,
-  // password?, domain?, port?). Absent = no offload, backups stay on the
-  // cache tier.
-  backupExternalTargetType?: string;
-  backupExternalTargetConfig?: string;
+export interface ICloudlySmbBackupTargetDescriptor {
+  type: 'smb';
+  host: string;
+  share: string;
+  domain?: string;
+  port?: number;
+}
 
-  // Node-local archive cache retention in days (corestore prune; default 30)
-  backupNodeCacheKeepDays?: string;
+export type TCloudlyBackupTargetDescriptor =
+  | ICloudlyS3BackupTargetDescriptor
+  | ICloudlyNfsBackupTargetDescriptor
+  | ICloudlySmbBackupTargetDescriptor;
 
-  // JSON map of swarm node hostname -> gateway-reachable IP/host. Routes for
-  // services pinned to a node target that node's coretraffic instead of the
-  // static dcrouterTargetHost (e.g. {"worker-a":"192.0.2.10"}).
+/** Public runtime-configurable settings. No serialized credential belongs here. */
+export interface ICloudlySettings {
+  deploymentArchiveRetentionDays?: number;
+  backupExternalTarget?: TCloudlyBackupTargetDescriptor;
+  backupNodeCacheKeepDays?: number;
   dcrouterGatewayUrl?: string;
-  dcrouterGatewayApiToken?: string;
   dcrouterGatewayClientId?: string;
   dcrouterTargetHost?: string;
-  dcrouterTargetPort?: string;
-  dcrouterTargetHostsByNode?: string;
-
-  // External dcrouter mail integration. Submission settings are injected into
-  // service secret bundles; forward targets are used for inbound smtpForward.
+  dcrouterTargetPort?: number;
+  dcrouterTargetHostsByNode?: Record<string, string>;
   dcrouterMailSubmissionHost?: string;
-  dcrouterMailSubmissionPort?: string;
+  dcrouterMailSubmissionPort?: number;
   dcrouterMailSubmissionTlsMode?: 'plain' | 'starttls' | 'implicitTls';
   dcrouterMailForwardTargetHost?: string;
-  dcrouterMailForwardTargetHostsByNode?: string;
-
-  // BaseOS enrollment
-  baseosJoinToken?: string;
-
-  // CoreBuild worker used for image generation
+  dcrouterMailForwardTargetHostsByNode?: Record<string, string>;
   corebuildWorkerUrl?: string;
-  corebuildWorkerToken?: string;
-  corebuildWorkersJson?: string;
-  
-  // AWS Credentials
-  awsAccessKey?: string;
-  awsSecretKey?: string;
-  awsRegion?: string;
-  
-  // DigitalOcean
-  digitalOceanToken?: string;
-  
-  // Azure Credentials
-  azureClientId?: string;
-  azureClientSecret?: string;
-  azureTenantId?: string;
-  azureSubscriptionId?: string;
-  
-  // Google Cloud
-  googleCloudKeyJson?: string;
-  googleCloudProjectId?: string;
-  
-  // Vultr
-  vultrApiKey?: string;
-  
-  // Linode
-  linodeToken?: string;
-  
-  // OVH
-  ovhApplicationKey?: string;
-  ovhApplicationSecret?: string;
-  ovhConsumerKey?: string;
-  
-  // Scaleway
-  scalewayAccessKey?: string;
-  scalewaySecretKey?: string;
-  scalewayOrganizationId?: string;
+  corebuildWorkerUrls?: string[];
 }
 
-/**
- * Interface for masked settings (used in API responses)
- * Shows only last 4 characters of sensitive tokens
- */
-export type ICloudlySettingsMasked = {
-  [K in keyof ICloudlySettings]: string | undefined;
-};
+export const cloudlySystemSecretOwner = Object.freeze({
+  kind: 'system',
+  systemId: 'cloudly-settings',
+} as const satisfies ISystemSecretOwner);
+
+export const cloudlySystemSecretManagementScope =
+  'system:cloudly-settings' as const satisfies TSecretManagementScope;
+
+/** Stable keys for values removed from serialized Cloudly settings. */
+export const cloudlySystemSecretKeys = Object.freeze({
+  hetznerToken: 'HETZNER_TOKEN',
+  cloudflareToken: 'CLOUDFLARE_TOKEN',
+  backupExternalTargetCredentials: 'BACKUP_EXTERNAL_TARGET_CREDENTIALS',
+  dcrouterGatewayApiToken: 'DCROUTER_GATEWAY_API_TOKEN',
+  baseosJoinToken: 'BASEOS_JOIN_TOKEN',
+  corebuildWorkerToken: 'COREBUILD_WORKER_TOKEN',
+  corebuildWorkers: 'COREBUILD_WORKERS',
+  awsAccessKey: 'AWS_ACCESS_KEY',
+  awsSecretKey: 'AWS_SECRET_KEY',
+  awsRegion: 'AWS_REGION',
+  digitalOceanToken: 'DIGITALOCEAN_TOKEN',
+  azureClientId: 'AZURE_CLIENT_ID',
+  azureClientSecret: 'AZURE_CLIENT_SECRET',
+  azureTenantId: 'AZURE_TENANT_ID',
+  azureSubscriptionId: 'AZURE_SUBSCRIPTION_ID',
+  googleCloudKey: 'GOOGLE_CLOUD_KEY',
+  googleCloudProjectId: 'GOOGLE_CLOUD_PROJECT_ID',
+  vultrApiKey: 'VULTR_API_KEY',
+  linodeToken: 'LINODE_TOKEN',
+  ovhApplicationKey: 'OVH_APPLICATION_KEY',
+  ovhApplicationSecret: 'OVH_APPLICATION_SECRET',
+  ovhConsumerKey: 'OVH_CONSUMER_KEY',
+  scalewayAccessKey: 'SCALEWAY_ACCESS_KEY',
+  scalewaySecretKey: 'SCALEWAY_SECRET_KEY',
+  scalewayOrganizationId: 'SCALEWAY_ORGANIZATION_ID',
+} as const);

package/ts/platform/storage.ts

@@ -1,3 +1,5 @@
+import type { TSecretManagementScope } from '../data/secret.js';
+
 /**
  * Backend-neutral storage vocabulary shared by App Store manifests, control
  * planes, and fulfillment adapters. Physical providers and runtime attachment
@@ -100,13 +102,13 @@ export type TStorageClassCapabilities =
  * addresses, mount options, principals, and credential values are private.
  */
 export interface IStorageCapabilityAdvertisement {
-  schemaVersion: 1;
+  schemaVersion: 2;
   featureIds: string[];
   classes: TStorageClassCapabilities[];
 }
 
-export interface IObjectStorageEnvironmentDelivery {
-  type: 'environment';
+export interface IObjectStorageLauncherEnvironmentDelivery {
+  type: 'launcher-environment';
   /**
    * Explicit target keys prevent two named bindings from silently overwriting
    * each other. Every required field must have a distinct environment key.
@@ -121,8 +123,8 @@ export interface IObjectStorageEnvironmentDelivery {
   };
 }
 
-export interface IObjectStorageSecretFileDelivery {
-  type: 'secretFile';
+export interface IObjectStorageFileDelivery {
+  type: 'file';
   /** Canonical absolute path below /run/secrets/. */
   targetPath: string;
   /**
@@ -130,11 +132,14 @@ export interface IObjectStorageSecretFileDelivery {
    * secretAccessKey, and optional sessionToken fields.
    */
   format: 'servezone-object-storage-v1';
+  uid: number;
+  gid: number;
+  mode: 0o400 | 0o440;
 }
 
 export type TObjectStorageDelivery =
-  | IObjectStorageEnvironmentDelivery
-  | IObjectStorageSecretFileDelivery;
+  | IObjectStorageLauncherEnvironmentDelivery
+  | IObjectStorageFileDelivery;
 
 export type TResolvedStorageBindingStatus =
   | 'requested'
@@ -176,7 +181,7 @@ export interface IResolvedStorageCapacity {
 }
 
 export interface IResolvedStorageBindingBase {
-  schemaVersion: 1;
+  schemaVersion: 2;
   /** Stable binding/allocation identity. */
   id: string;
   serviceId: string;
@@ -208,13 +213,6 @@ extends IResolvedStorageBindingBase {
   accessMode: TFilesystemStorageAccessMode;
 }
 
-export interface IStorageObjectCredentialsRef {
-  secretBundleId: string;
-  accessKeyIdKey: string;
-  secretAccessKeyKey: string;
-  sessionTokenKey?: string;
-}
-
 export interface IResolvedObjectStorageConnection {
   endpoint: string;
   bucket: string;
@@ -226,7 +224,8 @@ extends IResolvedStorageBindingBase {
   kind: 'objectStorage';
   accessMode: TObjectStorageAccessMode;
   connection: IResolvedObjectStorageConnection;
-  credentials: IStorageObjectCredentialsRef;
+  /** Value-free service-owned Secret reconciliation scope. */
+  credentialManagementScope: Extract<TSecretManagementScope, `platform:${string}`>;
   delivery: TObjectStorageDelivery;
   versioning: boolean;
   retentionDays?: number;

package/ts/platform/storagemigration.golden.ts

@@ -24,7 +24,7 @@ const capabilities = {
 } as const;
 
 const delivery = {
-  type: 'environment',
+  type: 'launcher-environment',
   keys: {
     endpoint: 'APP_S3_ENDPOINT',
     bucket: 'APP_S3_BUCKET',
@@ -34,14 +34,10 @@ const delivery = {
   },
 } as const;
 
-const credentials = {
-  secretBundleId: 'service-storage',
-  accessKeyIdKey: 'object.accessKeyId',
-  secretAccessKeyKey: 'object.secretAccessKey',
-};
+const credentialManagementScope = 'platform:object-storage-binding';
 
 const sourceBinding: TActiveObjectStorageBinding = {
-  schemaVersion: 1,
+  schemaVersion: 2,
   id: 'binding-object',
   serviceId: 'service-app',
   requestId: 'object-data',
@@ -63,7 +59,7 @@ const sourceBinding: TActiveObjectStorageBinding = {
     bucket: 'source-bucket',
     region: 'local',
   },
-  credentials,
+  credentialManagementScope,
   delivery,
   versioning: false,
   createdAt: 1_700_000_000_000,
@@ -96,12 +92,12 @@ const target = {
     accessMode: 'readWrite',
     delivery,
   },
-  credentials,
+  credentialManagementScope,
 } as const;
 
 const preparationSnapshotPayload:
 TUnfencedObjectStorageBindingControlSnapshotDigestPayload = {
-  schemaVersion: 1,
+  schemaVersion: 2,
   binding: sourceBinding,
   recordRevision: 12,
   capturedAt: 1_700_000_000_010,
@@ -110,11 +106,11 @@ TUnfencedObjectStorageBindingControlSnapshotDigestPayload = {
 const preparationSnapshot: IUnfencedObjectStorageBindingControlSnapshot = {
   ...preparationSnapshotPayload,
   snapshotDigest:
-    '35870a0c3ca7f2ee70d0ae7f83109bec23a8ce59bf8efef1c94221a496210439',
+    'ac8166a9888144d11dc7419f60be055eeb6f392ec41a254a9f9b2a7b3df1fba7',
 };
 
 const prepareRequest: IObjectStorageMigrationPrepareRequest = {
-  schemaVersion: 1,
+  schemaVersion: 2,
   migrationId: 'migration-object-capacity',
   sourceControlSnapshot: preparationSnapshot,
   workloadGeneration: 8,
@@ -124,7 +120,7 @@ const prepareRequest: IObjectStorageMigrationPrepareRequest = {
 const candidateBinding: TStagedObjectStorageBinding = {
   ...sourceBinding,
   requestDigest:
-    '2096dfa1f6db50d670cbb4d6436f38c2eec383435c99346e31d0d1a9e0b1beba',
+    '3f864862041002e25b790b3bc7afbe37c399a006f385e1def9f679a93d4fa173',
   generation: 4,
   observedGeneration: 3,
   status: 'provisioning',
@@ -144,98 +140,25 @@ const candidateBinding: TStagedObjectStorageBinding = {
 };
 
 export const storageMigrationCanonicalDigestGoldenVectors = deepFreezeValue({
-  version: 1 as const,
+  version: 2 as const,
   targetRequest: {
     input: target.request,
-    canonicalJson:
-      '{"accessMode":"readWrite","capacity":{"limit":"1TiB","request":"500GiB"},' +
-      '"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET",' +
-      '"endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION",' +
-      '"secretAccessKey":"APP_S3_SECRET_KEY"},"type":"environment"},' +
-      '"id":"object-data","kind":"objectStorage","reclaimPolicy":"retain",' +
-      '"storageClass":"backupCapacity"}',
-    sha256:
-      '2096dfa1f6db50d670cbb4d6436f38c2eec383435c99346e31d0d1a9e0b1beba',
+    canonicalJson: '{"accessMode":"readWrite","capacity":{"limit":"1TiB","request":"500GiB"},"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"id":"object-data","kind":"objectStorage","reclaimPolicy":"retain","storageClass":"backupCapacity"}',
+    sha256: '3f864862041002e25b790b3bc7afbe37c399a006f385e1def9f679a93d4fa173',
   },
   preparationSnapshot: {
     input: preparationSnapshotPayload,
-    canonicalJson:
-      '{"binding":{"accessMode":"readWrite","capabilities":{"backup":true,' +
-      '"durability":"persistent","encryptedInTransit":true,"hardQuota":true,' +
-      '"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},' +
-      '"connection":{"bucket":"source-bucket","endpoint":"https://source.example.test",' +
-      '"region":"local"},"createdAt":1700000000000,"credentials":' +
-      '{"accessKeyIdKey":"object.accessKeyId","secretAccessKeyKey":"object.secretAccessKey",' +
-      '"secretBundleId":"service-storage"},"delivery":{"keys":' +
-      '{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET",' +
-      '"endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION",' +
-      '"secretAccessKey":"APP_S3_SECRET_KEY"},"type":"environment"},' +
-      '"generation":3,"id":"binding-object","kind":"objectStorage",' +
-      '"observedGeneration":3,"policy":{"classId":"source-object","revision":"1"},' +
-      '"requestDigest":"1111111111111111111111111111111111111111111111111111111111111111",' +
-      '"requestId":"object-data","resourceRef":"source-resource","schemaVersion":1,' +
-      '"serviceId":"service-app","status":"ready","updatedAt":1700000000001,' +
-      '"versioning":false},"capturedAt":1700000000010,"recordRevision":12,"schemaVersion":1}',
-    sha256:
-      '35870a0c3ca7f2ee70d0ae7f83109bec23a8ce59bf8efef1c94221a496210439',
+    canonicalJson: '{"binding":{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"connection":{"bucket":"source-bucket","endpoint":"https://source.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":3,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"source-object","revision":"1"},"requestDigest":"1111111111111111111111111111111111111111111111111111111111111111","requestId":"object-data","resourceRef":"source-resource","schemaVersion":2,"serviceId":"service-app","status":"ready","updatedAt":1700000000001,"versioning":false},"capturedAt":1700000000010,"recordRevision":12,"schemaVersion":2}',
+    sha256: 'ac8166a9888144d11dc7419f60be055eeb6f392ec41a254a9f9b2a7b3df1fba7',
   },
   prepareRequest: {
     input: prepareRequest,
-    canonicalJson:
-      '{"migrationId":"migration-object-capacity","schemaVersion":1,' +
-      '"sourceControlSnapshot":{"binding":{"accessMode":"readWrite",' +
-      '"capabilities":{"backup":true,"durability":"persistent",' +
-      '"encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity",' +
-      '"snapshots":"none","topology":"singleNode"},"connection":' +
-      '{"bucket":"source-bucket","endpoint":"https://source.example.test","region":"local"},' +
-      '"createdAt":1700000000000,"credentials":{"accessKeyIdKey":"object.accessKeyId",' +
-      '"secretAccessKeyKey":"object.secretAccessKey","secretBundleId":"service-storage"},' +
-      '"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET",' +
-      '"endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION",' +
-      '"secretAccessKey":"APP_S3_SECRET_KEY"},"type":"environment"},' +
-      '"generation":3,"id":"binding-object","kind":"objectStorage",' +
-      '"observedGeneration":3,"policy":{"classId":"source-object","revision":"1"},' +
-      '"requestDigest":"1111111111111111111111111111111111111111111111111111111111111111",' +
-      '"requestId":"object-data","resourceRef":"source-resource","schemaVersion":1,' +
-      '"serviceId":"service-app","status":"ready","updatedAt":1700000000001,' +
-      '"versioning":false},"capturedAt":1700000000010,"recordRevision":12,' +
-      '"schemaVersion":1,"snapshotDigest":' +
-      '"35870a0c3ca7f2ee70d0ae7f83109bec23a8ce59bf8efef1c94221a496210439"},' +
-      '"target":{"credentials":{"accessKeyIdKey":"object.accessKeyId",' +
-      '"secretAccessKeyKey":"object.secretAccessKey","secretBundleId":"service-storage"},' +
-      '"policy":{"classId":"capacity-object","revision":"4"},"request":' +
-      '{"accessMode":"readWrite","capacity":{"limit":"1TiB","request":"500GiB"},' +
-      '"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET",' +
-      '"endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION",' +
-      '"secretAccessKey":"APP_S3_SECRET_KEY"},"type":"environment"},' +
-      '"id":"object-data","kind":"objectStorage","reclaimPolicy":"retain",' +
-      '"storageClass":"backupCapacity"},"storageClass":{"kind":"objectStorage",' +
-      '"purpose":"backup","required":{"backup":true,"durability":"persistent",' +
-      '"performanceTier":"capacity"}}},"workloadGeneration":8}',
-    sha256:
-      'ecbb40ec9bfa20b9f4372eb0d00eaf79c3e84dd3132c5bde7e65ba3fec55e595',
+    canonicalJson: '{"migrationId":"migration-object-capacity","schemaVersion":2,"sourceControlSnapshot":{"binding":{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"connection":{"bucket":"source-bucket","endpoint":"https://source.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":3,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"source-object","revision":"1"},"requestDigest":"1111111111111111111111111111111111111111111111111111111111111111","requestId":"object-data","resourceRef":"source-resource","schemaVersion":2,"serviceId":"service-app","status":"ready","updatedAt":1700000000001,"versioning":false},"capturedAt":1700000000010,"recordRevision":12,"schemaVersion":2,"snapshotDigest":"ac8166a9888144d11dc7419f60be055eeb6f392ec41a254a9f9b2a7b3df1fba7"},"target":{"credentialManagementScope":"platform:object-storage-binding","policy":{"classId":"capacity-object","revision":"4"},"request":{"accessMode":"readWrite","capacity":{"limit":"1TiB","request":"500GiB"},"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"id":"object-data","kind":"objectStorage","reclaimPolicy":"retain","storageClass":"backupCapacity"},"storageClass":{"kind":"objectStorage","purpose":"backup","required":{"backup":true,"durability":"persistent","performanceTier":"capacity"}}},"workloadGeneration":8}',
+    sha256: '7682ed6f8c8b64d4c677ea91c04e4261bfe5326a3fb905d5da093f51e4b2dbbe',
   },
   candidateBinding: {
     input: candidateBinding,
-    canonicalJson:
-      '{"accessMode":"readWrite","capabilities":{"backup":true,' +
-      '"durability":"persistent","encryptedInTransit":true,"hardQuota":true,' +
-      '"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},' +
-      '"capacity":{"granted":"500GiB","limit":"1TiB","requested":"500GiB"},' +
-      '"connection":{"bucket":"destination-bucket",' +
-      '"endpoint":"https://destination.example.test","region":"local"},' +
-      '"createdAt":1700000000000,"credentials":{"accessKeyIdKey":"object.accessKeyId",' +
-      '"secretAccessKeyKey":"object.secretAccessKey","secretBundleId":"service-storage"},' +
-      '"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET",' +
-      '"endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION",' +
-      '"secretAccessKey":"APP_S3_SECRET_KEY"},"type":"environment"},' +
-      '"generation":4,"id":"binding-object","kind":"objectStorage",' +
-      '"observedGeneration":3,"policy":{"classId":"capacity-object","revision":"4"},' +
-      '"requestDigest":"2096dfa1f6db50d670cbb4d6436f38c2eec383435c99346e31d0d1a9e0b1beba",' +
-      '"requestId":"object-data","resourceRef":"destination-resource",' +
-      '"schemaVersion":1,"serviceId":"service-app","status":"provisioning",' +
-      '"updatedAt":1700000000020,"versioning":false}',
-    sha256:
-      'b49017f41cd86626ccb05ffa5fb591994a5e20fad9856182b1a1d4c964c6177c',
+    canonicalJson: '{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"capacity":{"granted":"500GiB","limit":"1TiB","requested":"500GiB"},"connection":{"bucket":"destination-bucket","endpoint":"https://destination.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":4,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"capacity-object","revision":"4"},"requestDigest":"3f864862041002e25b790b3bc7afbe37c399a006f385e1def9f679a93d4fa173","requestId":"object-data","resourceRef":"destination-resource","schemaVersion":2,"serviceId":"service-app","status":"provisioning","updatedAt":1700000000020,"versioning":false}',
+    sha256: '6e5c954466b600f81d1f19dcdd7ef426be99dc12ae33103e4d0c238e0070de71',
   },
 });