@serve.zone/interfaces 31.8.0 → 32.0.0

package/ts/data/isolatedrestore.ts

@@ -11,6 +11,7 @@ import {
   deepFreezeValue,
   strictCanonicalJsonRules,
 } from '../private/canonicaljson.js';
+import { hasExactKeys } from '../private/dataproperties.js';
 
 /** Operations carried by a short-lived, single-operation restore grant. */
 export const isolatedRestoreGrantOperations = Object.freeze([
@@ -25,16 +26,15 @@ export type TIsolatedRestoreGrantOperation =
   (typeof isolatedRestoreGrantOperations)[number];
 
 /**
- * Versioned limits shared by signers, relays, and Corestore.
+ * The limits signers, relays and Corestore all hold this family to.
  *
- * V1 uses an inline descriptor manifest inside a 1 MiB control request. Its
- * 4,096 object slots reserve 256 entries for config, snapshots, keys, and
- * index segments; the remaining 3,840 slots fit 1,920 default 8 MiB pack/index
+ * The descriptor manifest travels inside a 1 MiB control request. Its 4,096
+ * object slots reserve 256 entries for config, snapshots, keys, and index
+ * segments; the remaining 3,840 slots fit 1,920 default 8 MiB pack/index
  * pairs. The 15 GiB total envelope is therefore reachable with the default
  * ContainerArchive packing profile instead of advertising impossible capacity.
  */
 export const isolatedRestoreContractLimits = Object.freeze({
-  version: 1 as const,
   maximumControlJsonBytes: 1024 * 1024,
   maximumRestoreGrantBytes: 64 * 1024,
   maximumConfiguredStringBytes: 2048,
@@ -50,9 +50,8 @@ export const isolatedRestoreContractLimits = Object.freeze({
   maximumObjectChunks: 4096,
 });
 
-/** ContainerArchive v1 paths that may be replicated into restore staging. */
+/** The ContainerArchive repository paths that may be replicated into restore staging. */
 export const isolatedRestoreRepositoryPathProfile = Object.freeze({
-  version: 1 as const,
   rootObject: 'config.json' as const,
   topLevelDirectories: Object.freeze([
     'packs',
@@ -69,7 +68,6 @@ export const isolatedRestoreRepositoryPathProfile = Object.freeze({
  * Persist this projection for audit/recovery, never the compact bearer JWT.
  */
 export interface IIsolatedRestoreGrantClaims {
-  grantVersion: 1;
   iss: string;
   aud: string;
   sub: string;
@@ -126,9 +124,23 @@ export interface IIsolatedRestoreControlForbiddenAuthority {
   archiveManifestSha256?: never;
 }
 
-export interface IIsolatedRestoreControlPrepareRequest
+/** What every isolated-restore control body carries, and the only authority Corestore accepts. */
+export interface IIsolatedRestoreControlAuthority
   extends IIsolatedRestoreControlForbiddenAuthority {
+  /**
+   * The compact RS256 restore grant Cloudly signed for exactly this operation, carried untouched
+   * to Corestore.
+   *
+   * It names the operation, expires within minutes, and binds the cluster, the node name, the
+   * canonical resource mappings and the archive manifest, so a carrier can forward it but can
+   * neither widen it nor mint one. Sensitive ephemeral input: it is a bearer credential, so
+   * exclude the complete request from hooks, logs, diagnostics and durable journals on every hop.
+   */
   restoreGrant: string;
+}
+
+export interface IIsolatedRestoreControlPrepareRequest
+  extends IIsolatedRestoreControlAuthority {
   expectedRevision: number;
   resourceMappings: TIsolatedRestoreResourceMapping[];
   archiveManifest: IBackupArchiveManifest;
@@ -141,8 +153,7 @@ export interface IIsolatedRestoreControlPrepareRequest
  * reaches the object boundary; it does not prove object completion.
  */
 export interface IIsolatedRestoreControlWriteRequest
-  extends IIsolatedRestoreControlForbiddenAuthority {
-  restoreGrant: string;
+  extends IIsolatedRestoreControlAuthority {
   expectedRevision: number;
   path: string;
   size: number;
@@ -153,21 +164,17 @@ export interface IIsolatedRestoreControlWriteRequest
 }
 
 export interface IIsolatedRestoreControlExecuteRequest
-  extends IIsolatedRestoreControlForbiddenAuthority {
-  restoreGrant: string;
+  extends IIsolatedRestoreControlAuthority {
   expectedRevision: number;
 }
 
 export interface IIsolatedRestoreControlCleanupRequest
-  extends IIsolatedRestoreControlForbiddenAuthority {
-  restoreGrant: string;
+  extends IIsolatedRestoreControlAuthority {
   expectedRevision: number;
 }
 
 export interface IIsolatedRestoreControlStatusRequest
-  extends IIsolatedRestoreControlForbiddenAuthority {
-  restoreGrant: string;
-}
+  extends IIsolatedRestoreControlAuthority {}
 
 export type TIsolatedRestoreControlRequest =
   | IIsolatedRestoreControlPrepareRequest
@@ -182,7 +189,6 @@ export type TIsolatedRestoreControlRequest =
  * authorized write requests can contribute to the same object.
  */
 export interface IIsolatedRestoreAuthorityProjection {
-  version: 1;
   iss: string;
   aud: string;
   sub: string;
@@ -284,7 +290,6 @@ export interface IIsolatedRestoreCompletedObjectBinding {
  * they do not replace grant authentication or authenticate an untrusted store.
  */
 export interface IIsolatedRestoreDurableChunkReceipt {
-  version: 1;
   authority: Readonly<IIsolatedRestoreAuthorityProjection>;
   authoritySha256: string;
   descriptor: Readonly<IBackupArchiveObject>;
@@ -296,7 +301,6 @@ export interface IIsolatedRestoreDurableChunkReceipt {
 
 /** Durable, bearer-free proof regenerated from receipts and one file snapshot. */
 export interface IIsolatedRestoreDurableCompletedObjectProof {
-  version: 1;
   authority: Readonly<IIsolatedRestoreAuthorityProjection>;
   authoritySha256: string;
   descriptor: Readonly<IBackupArchiveObject>;
@@ -469,14 +473,10 @@ const assertExactKeys = (
   recordArg: Record<string, unknown>,
   expectedKeysArg: readonly string[],
   fieldNameArg: string,
+  optionalKeysArg: readonly string[] = [],
 ): void => {
-  const actualKeys = Object.keys(recordArg).sort();
-  const expectedKeys = [...expectedKeysArg].sort();
-  if (
-    actualKeys.length !== expectedKeys.length ||
-    actualKeys.some((keyArg, indexArg) => keyArg !== expectedKeys[indexArg])
-  ) {
-    fail(`${fieldNameArg} does not match its exact versioned schema`);
+  if (!hasExactKeys(recordArg, expectedKeysArg, optionalKeysArg)) {
+    fail(`${fieldNameArg} does not match its exact schema`);
   }
 };
 
@@ -1105,12 +1105,9 @@ export const normalizeIsolatedRestoreArchiveManifest = (
   const manifest = readRecord(valueArg, 'archiveManifest');
   assertExactKeys(
     manifest,
-    ['version', 'backupId', 'createdAt', 'objects', 'totalSize'],
+    ['backupId', 'createdAt', 'objects', 'totalSize'],
     'archiveManifest',
   );
-  if (manifest.version !== 1) {
-    return fail('archiveManifest.version must be 1');
-  }
   const objectEntries = readDenseArray(
     manifest.objects,
     'archiveManifest.objects',
@@ -1141,7 +1138,7 @@ export const normalizeIsolatedRestoreArchiveManifest = (
         isolatedRestoreContractLimits.maximumArchiveTotalBytes
     ) {
       return fail(
-        'archiveManifest object sizes exceed the versioned total-size limit',
+        'archiveManifest object sizes exceed the total-size limit',
       );
     }
     calculatedTotalSize += size;
@@ -1196,7 +1193,6 @@ export const normalizeIsolatedRestoreArchiveManifest = (
   }
 
   return deepFreeze({
-    version: 1,
     backupId: readScopedId(manifest.backupId, 'archiveManifest.backupId'),
     createdAt: readSafeInteger(
       manifest.createdAt,
@@ -1215,7 +1211,6 @@ export const normalizeIsolatedRestoreGrantClaims = (
   assertExactKeys(
     claims,
     [
-      'grantVersion',
       'iss',
       'aud',
       'sub',
@@ -1238,9 +1233,6 @@ export const normalizeIsolatedRestoreGrantClaims = (
     ],
     'restore grant claims',
   );
-  if (claims.grantVersion !== 1) {
-    return fail('grantVersion must be 1');
-  }
   if (
     typeof claims.operation !== 'string' ||
     !isolatedRestoreGrantOperations.includes(
@@ -1258,7 +1250,6 @@ export const normalizeIsolatedRestoreGrantClaims = (
   }
 
   const normalizedClaims: IIsolatedRestoreGrantClaims = {
-    grantVersion: 1,
     iss: readConfiguredString(claims.iss, 'iss'),
     aud: readConfiguredString(claims.aud, 'aud'),
     sub: readIdentifier(claims.sub, 'sub'),
@@ -1390,7 +1381,7 @@ export const normalizeIsolatedRestoreControlWriteRequest = (
   if (
     contents.byteLength > isolatedRestoreContractLimits.maximumWriteChunkBytes
   ) {
-    return fail('write request decoded chunk exceeds the versioned chunk limit');
+    return fail('write request decoded chunk exceeds the chunk limit');
   }
   if (size === 0) {
     if (offset !== 0 || contents.byteLength !== 0) {
@@ -1453,6 +1444,314 @@ export const normalizeIsolatedRestoreControlStatusRequest = (
   );
 };
 
+/**
+ * A node-scoped control call: which node of the cluster, and the control body carried to it.
+ *
+ * One relay serves every node of its cluster over one session, so the connection that answers
+ * proves the cluster and never the node — exactly as `getClusterCorestoreInventory` states it. The
+ * control body is the one Corestore reads; the relay forwards it untouched and may not widen it.
+ */
+export interface IIsolatedRestoreNodeControl<TControlGeneric> {
+  nodeId: string;
+  control: TControlGeneric;
+}
+
+/**
+ * Reads one node-scoped control request, judging the control with its own normalizer.
+ *
+ * The caller passes the normalizer of the operation it serves, so there is one reader for the
+ * envelope and one judge per control body instead of five near-identical readers.
+ */
+export const normalizeIsolatedRestoreNodeControl = <TControlGeneric>(
+  valueArg: unknown,
+  normalizeControlArg: (controlArg: unknown) => TControlGeneric,
+): Readonly<IIsolatedRestoreNodeControl<TControlGeneric>> => {
+  const request = readRecord(valueArg, 'node control request');
+  assertExactKeys(request, ['nodeId', 'control'], 'node control request');
+  return Object.freeze({
+    nodeId: readIdentifier(request.nodeId, 'node control request.nodeId'),
+    control: normalizeControlArg(request.control),
+  });
+};
+
+/**
+ * Every reason a relay answers instead of carrying a control to the node.
+ *
+ * The relay writes `<name>: <reason>` and the caller matches the name. Only the first two are the
+ * relay's own statement: they say the control never reached Corestore, which is the one thing
+ * Corestore cannot say about itself. Everything Corestore answered — a refused grant, a refused
+ * body, a revision conflict, an unsupported mapping, a restore it does not hold — arrives under
+ * `restore-node-refused` with Corestore's own reason behind it, because inventing a second
+ * vocabulary for those would be a second answer to what happened.
+ */
+export const isolatedRestoreNodeControlRefusals = Object.freeze([
+  /** This relay carries no Corestore endpoint for that node of its cluster. */
+  'restore-node-not-carried',
+  /** The node's Corestore did not answer, so nothing of the control was applied. */
+  'restore-node-unreachable',
+  /** Corestore answered and refused; its own reason follows the name. */
+  'restore-node-refused',
+] as const);
+
+/** One of the reasons a relay answers instead of a node's progress. */
+export type TIsolatedRestoreNodeControlRefusal =
+  typeof isolatedRestoreNodeControlRefusals[number];
+
+/**
+ * What a node states about one isolated restore it holds, in Corestore's own words.
+ *
+ * These are the staging states Corestore keeps, taken verbatim: the node is the only party that
+ * knows them, and the control plane composes its own record status out of what the node states
+ * rather than asking the node to speak the control plane's vocabulary.
+ */
+export const isolatedRestoreProgressStatuses = Object.freeze([
+  /** The plan is staged: the manifest is known and its objects may be written. */
+  'prepared',
+  /** The staged objects are being restored into the scratch namespace. */
+  'executing',
+  /** The restore stopped on an error; the staging tree and its state stay for cleanup. */
+  'failed',
+  /** Every mapping of the plan was restored. */
+  'executed',
+  /** The staging tree is gone; nothing of this restore is left on the node. */
+  'cleaned',
+] as const);
+
+/** One staging state of an isolated restore on a node. */
+export type TIsolatedRestoreProgressStatus =
+  typeof isolatedRestoreProgressStatuses[number];
+
+/**
+ * Where one staged object stands, stated only by the call that carried a chunk of it.
+ *
+ * `nextOffset` is the byte the next chunk continues at, so a resumed or replayed staging run
+ * continues where the node already is instead of where the sender assumed it was. `completed`
+ * means the node holds the whole object and proved its digest; reaching the object's size does
+ * not, which is why the two are separate facts.
+ */
+export interface IIsolatedRestoreObjectProgress {
+  path: string;
+  nextOffset: number;
+  completed: boolean;
+}
+
+/**
+ * One node's answer to an isolated-restore control call.
+ *
+ * Everything here is a fact the node holds: Corestore's summary of its staging state, plus the
+ * node the relay carried the control to. It is deliberately not the control plane's record — a
+ * node knows nothing of the source backup, the requesting actor or the verification the control
+ * plane will run — so the control plane composes its record from this and its own knowledge, as it
+ * does with the Corestore inventory.
+ */
+export interface IIsolatedRestoreProgress {
+  /** The cluster node this progress describes, as the cluster document names it. */
+  nodeId: string;
+  restoreId: string;
+  stagingArchiveId: string;
+  status: TIsolatedRestoreProgressStatus;
+  /** The node state's compare-and-swap value; the next control carries it as `expectedRevision`. */
+  revision: number;
+  /** The fence the node last committed under, so a stale writer is visible to the caller. */
+  lastFence: number;
+  expectedObjects: number;
+  receivedObjects: number;
+  completedMappings: number;
+  totalMappings: number;
+  preparedAt: number;
+  updatedAt: number;
+  executedAt?: number;
+  /**
+   * Present only on a staged chunk: where that one object stands.
+   *
+   * It is named apart from Corestore's own `object` member, which is the receipt for a received
+   * object and a different shape; see `stageIsolatedRestoreArchive` for the projection.
+   */
+  stagedObject?: IIsolatedRestoreObjectProgress;
+}
+
+const isolatedRestoreProgressKeys = [
+  'nodeId',
+  'restoreId',
+  'stagingArchiveId',
+  'status',
+  'revision',
+  'lastFence',
+  'expectedObjects',
+  'receivedObjects',
+  'completedMappings',
+  'totalMappings',
+  'preparedAt',
+  'updatedAt',
+] as const;
+
+const optionalIsolatedRestoreProgressKeys = ['executedAt', 'stagedObject'] as const;
+
+const normalizeIsolatedRestoreObjectProgress = (
+  valueArg: unknown,
+): IIsolatedRestoreObjectProgress => {
+  const progress = readRecord(valueArg, 'restore progress.stagedObject');
+  assertExactKeys(
+    progress,
+    ['path', 'nextOffset', 'completed'],
+    'restore progress.stagedObject',
+  );
+  if (typeof progress.completed !== 'boolean') {
+    return fail('restore progress.stagedObject.completed must be a boolean');
+  }
+  return {
+    path: readRepositoryPath(progress.path, 'restore progress.stagedObject.path'),
+    nextOffset: readSafeInteger(
+      progress.nextOffset,
+      'restore progress.stagedObject.nextOffset',
+      0,
+      isolatedRestoreContractLimits.maximumArchiveObjectBytes,
+    ),
+    completed: progress.completed,
+  };
+};
+
+/**
+ * Reads one node's progress and refuses everything that is not exactly it.
+ *
+ * The counts are read against each other rather than one by one: a node cannot have received more
+ * objects than its manifest lists or completed more mappings than its plan has, and a restore it
+ * never prepared has no progress at all — a node that does not hold the restore refuses the call
+ * (`restore-node-refused`) instead of answering a progress with revision 0. `revision` and
+ * `lastFence` are read from 1 for the same reason: a committed state carries the revision it was
+ * committed as and the fence of the lease that committed it, so neither is ever 0.
+ *
+ * The states a run passes through are read against the archive as well: `executing` and `executed`
+ * hold the whole archive, and `executed` completed every mapping and says when.
+ */
+export const normalizeIsolatedRestoreProgress = (
+  valueArg: unknown,
+): Readonly<IIsolatedRestoreProgress> => {
+  const progress = readRecord(valueArg, 'restore progress');
+  assertExactKeys(
+    progress,
+    isolatedRestoreProgressKeys,
+    'restore progress',
+    optionalIsolatedRestoreProgressKeys,
+  );
+  if (
+    typeof progress.status !== 'string' ||
+    !isolatedRestoreProgressStatuses.includes(
+      progress.status as TIsolatedRestoreProgressStatus,
+    )
+  ) {
+    return fail('restore progress.status is unsupported');
+  }
+  const expectedObjects = readSafeInteger(
+    progress.expectedObjects,
+    'restore progress.expectedObjects',
+    1,
+    isolatedRestoreContractLimits.maximumArchiveObjects,
+  );
+  const totalMappings = readSafeInteger(
+    progress.totalMappings,
+    'restore progress.totalMappings',
+    1,
+    isolatedRestoreContractLimits.maximumResourceMappings,
+  );
+  const preparedAt = readSafeInteger(progress.preparedAt, 'restore progress.preparedAt', 1);
+  const normalized: IIsolatedRestoreProgress = {
+    nodeId: readIdentifier(progress.nodeId, 'restore progress.nodeId'),
+    restoreId: readScopedId(progress.restoreId, 'restore progress.restoreId'),
+    stagingArchiveId: readScopedId(
+      progress.stagingArchiveId,
+      'restore progress.stagingArchiveId',
+    ),
+    status: progress.status as TIsolatedRestoreProgressStatus,
+    revision: readSafeInteger(progress.revision, 'restore progress.revision', 1),
+    lastFence: readSafeInteger(progress.lastFence, 'restore progress.lastFence', 1),
+    expectedObjects,
+    receivedObjects: readSafeInteger(
+      progress.receivedObjects,
+      'restore progress.receivedObjects',
+      0,
+      expectedObjects,
+    ),
+    completedMappings: readSafeInteger(
+      progress.completedMappings,
+      'restore progress.completedMappings',
+      0,
+      totalMappings,
+    ),
+    totalMappings,
+    preparedAt,
+    updatedAt: readSafeInteger(progress.updatedAt, 'restore progress.updatedAt', preparedAt),
+    ...(Object.hasOwn(progress, 'executedAt')
+      ? {
+        executedAt: readSafeInteger(
+          progress.executedAt,
+          'restore progress.executedAt',
+          preparedAt,
+        ),
+      }
+      : {}),
+    ...(Object.hasOwn(progress, 'stagedObject')
+      ? { stagedObject: normalizeIsolatedRestoreObjectProgress(progress.stagedObject) }
+      : {}),
+  };
+  // Corestore asserts that every manifest object was received before it commits `executing`, and
+  // refuses archive writes from that state on, so a run that reached either state holds the whole
+  // archive; `executedAt` is written by the same commit that sets `executed`.
+  if (
+    (normalized.status === 'executing' || normalized.status === 'executed') &&
+    normalized.receivedObjects !== expectedObjects
+  ) {
+    return fail(
+      `restore progress.status ${normalized.status} requires every archive object to be received`,
+    );
+  }
+  if (normalized.status === 'executed') {
+    if (normalized.completedMappings !== totalMappings) {
+      return fail('restore progress.status executed requires every mapping to be completed');
+    }
+    if (normalized.executedAt === undefined) {
+      return fail('restore progress.status executed requires an executedAt');
+    }
+  }
+  return deepFreeze(normalized);
+};
+
+/** The node and restore a caller sent a control for, and expects the answer to describe. */
+export interface IIsolatedRestoreProgressExpectation {
+  nodeId: string;
+  restoreId: string;
+}
+
+/**
+ * The progress a node stated, bound to the call it answers.
+ *
+ * The control body carries no node and no restore id — the signed grant is the only authority for
+ * the restore, and the relay routes on `nodeId` — so the caller is the one party holding both
+ * facts, and this is where the answer is tied back to them. Without it a relay could answer with
+ * another node's progress, or with another restore's, and the fields alone would look perfectly
+ * canonical.
+ */
+export const bindIsolatedRestoreProgressToNode = (
+  progressArg: unknown,
+  expectationArg: IIsolatedRestoreProgressExpectation,
+): Readonly<IIsolatedRestoreProgress> => {
+  const expectation = readRecord(expectationArg, 'restore progress expectation');
+  assertExactKeys(expectation, ['nodeId', 'restoreId'], 'restore progress expectation');
+  const nodeId = readIdentifier(expectation.nodeId, 'restore progress expectation.nodeId');
+  const restoreId = readScopedId(
+    expectation.restoreId,
+    'restore progress expectation.restoreId',
+  );
+  const progress = normalizeIsolatedRestoreProgress(progressArg);
+  if (progress.nodeId !== nodeId) {
+    return fail('restore progress must describe the node the control was carried to');
+  }
+  if (progress.restoreId !== restoreId) {
+    return fail('restore progress must describe the restore its grant names');
+  }
+  return progress;
+};
+
 const canonicalizeJson = (valueArg: unknown): string => {
   return canonicalizeStrictJson(valueArg, fail);
 };
@@ -1482,7 +1781,6 @@ export const normalizeIsolatedRestoreAuthorityProjection = (
   assertExactKeys(
     authority,
     [
-      'version',
       'iss',
       'aud',
       'sub',
@@ -1500,11 +1798,7 @@ export const normalizeIsolatedRestoreAuthorityProjection = (
     ],
     'restore authority projection',
   );
-  if (authority.version !== 1) {
-    return fail('restore authority projection.version must be 1');
-  }
   const normalized: IIsolatedRestoreAuthorityProjection = {
-    version: 1,
     iss: readConfiguredString(authority.iss, 'restore authority projection.iss'),
     aud: readConfiguredString(authority.aud, 'restore authority projection.aud'),
     sub: readIdentifier(authority.sub, 'restore authority projection.sub'),
@@ -1571,7 +1865,6 @@ export const createIsolatedRestoreAuthorityProjection = (
 ): Readonly<IIsolatedRestoreAuthorityProjection> => {
   const claims = normalizeIsolatedRestoreGrantClaims(claimsArg);
   return normalizeIsolatedRestoreAuthorityProjection({
-    version: 1,
     iss: claims.iss,
     aud: claims.aud,
     sub: claims.sub,
@@ -2003,7 +2296,6 @@ const createDurableChunkReceiptPayload = (
   receiptArg: IIsolatedRestoreDurableChunkReceipt,
 ): TIsolatedRestoreDurableChunkReceiptPayload => {
   return {
-    version: 1,
     authority: receiptArg.authority,
     authoritySha256: receiptArg.authoritySha256,
     descriptor: receiptArg.descriptor,
@@ -2026,7 +2318,6 @@ export const normalizeIsolatedRestoreDurableChunkReceipt = (
   assertExactKeys(
     receipt,
     [
-      'version',
       'authority',
       'authoritySha256',
       'descriptor',
@@ -2037,9 +2328,6 @@ export const normalizeIsolatedRestoreDurableChunkReceipt = (
     ],
     'durable chunk receipt',
   );
-  if (receipt.version !== 1) {
-    return fail('durable chunk receipt.version must be 1');
-  }
   const authority = normalizeIsolatedRestoreAuthorityProjection(
     receipt.authority,
   );
@@ -2096,7 +2384,6 @@ export const normalizeIsolatedRestoreDurableChunkReceipt = (
     );
   }
   return deepFreeze({
-    version: 1,
     authority,
     authoritySha256: readSha256(
       receipt.authoritySha256,
@@ -2148,7 +2435,6 @@ export const createIsolatedRestoreDurableChunkReceipt = async (
 ): Promise<Readonly<IIsolatedRestoreDurableChunkReceipt>> => {
   const binding = requireBoundWriteRequest(bindingArg);
   const payload: TIsolatedRestoreDurableChunkReceiptPayload = {
-    version: 1,
     authority: binding.authority,
     authoritySha256: binding.authoritySha256,
     descriptor: binding.descriptor,
@@ -2263,7 +2549,6 @@ export const verifyIsolatedRestoreDurableCompletedObject = async (
     canonicalizeJson(receipts),
   );
   const proofPayload = {
-    version: 1 as const,
     authority,
     authoritySha256,
     descriptor,

package/ts/data/mail.ts

@@ -271,7 +271,7 @@ export interface IServiceMailInboundConfig {
   typedMethod?: string;
   /**
    * Published Docker/Swarm port that dcrouter may SMTP-forward inbound mail to.
-   * It must resolve to one `IRuntimeNetworkPublishedPortV1` entry of the
+   * It must resolve to one `IRuntimeNetworkPublishedPort` entry of the
    * service's signed runtime network projection: the same node host port, with
    * its own Cloudly authorization. A value with no matching published port is
    * not routable.