@serve.zone/interfaces 31.8.0 → 32.0.0

package/ts/data/privatenetwork.ts

@@ -1,7 +1,10 @@
+import {
+  readDataElements, readDataProperty, readExactDataRecord,
+} from '../private/dataproperties.js';
 import { isPlausibleUnicastIpv4 } from '../private/ipv4.js';
 
 /** Cloudly owns these definitions. Membership never follows node placement. */
-export interface IPrivateNetworkPolicyV1 {
+export interface IPrivateNetworkPolicy {
   connectivity: 'member-full-mesh';
   /** null denies external resolution; private names are never forwarded. */
   externalDns: {
@@ -12,8 +15,7 @@ export interface IPrivateNetworkPolicyV1 {
   } | null;
 }
 
-export interface IPrivateNetworkV1 {
-  schemaVersion: 1;
+export interface IPrivateNetwork {
   id: string;
   organizationId: string;
   /** Immutable server-owned keys; display-name changes do not rename DNS. */
@@ -22,52 +24,50 @@ export interface IPrivateNetworkV1 {
   name: string;
   revision: number;
   state: 'active' | 'retiring' | 'retired';
-  policy: IPrivateNetworkPolicyV1;
+  policy: IPrivateNetworkPolicy;
   createdAt: number;
   updatedAt: number;
 }
 
-export interface IPrivateNetworkAttachmentV1 {
+export interface IPrivateNetworkAttachment {
   networkId: string;
   /** Sorted unique single-label aliases, reserved per network for this service. */
   aliases: string[];
 }
 
 /** Desired membership only. Acceptance is neither packet enforcement nor DNS readiness. */
-export interface IServicePrivateNetworksV1 {
-  schemaVersion: 1;
+export interface IServicePrivateNetworks {
   organizationId: string;
   serviceId: string;
   revision: number;
   /** Sorted by networkId; every network must have the same canonical organization. */
-  attachments: IPrivateNetworkAttachmentV1[];
+  attachments: IPrivateNetworkAttachment[];
   /** Exactly the sole attachment, or explicit selection/null when several exist. */
   defaultNetworkId: string | null;
 }
 
-interface IPrivateNetworkMutationBaseV1 {
-  schemaVersion: 1;
+interface IPrivateNetworkMutationBase {
   organizationId: string;
   /** Retain the exact body and this identifier across retries. */
   mutationId: string;
 }
 
-export type TPrivateNetworkMutationV1 = IPrivateNetworkMutationBaseV1 & (
-  | { operation: 'create'; expectedRevision: null; name: string; policy: IPrivateNetworkPolicyV1 }
-  | { operation: 'update'; networkId: string; expectedRevision: number; name: string; policy: IPrivateNetworkPolicyV1 }
+export type TPrivateNetworkMutation = IPrivateNetworkMutationBase & (
+  | { operation: 'create'; expectedRevision: null; name: string; policy: IPrivateNetworkPolicy }
+  | { operation: 'update'; networkId: string; expectedRevision: number; name: string; policy: IPrivateNetworkPolicy }
   /** Retirement completes only after outstanding grants are denied or independently fenced. */
   | { operation: 'retire'; networkId: string; expectedRevision: number }
 );
 
-export interface ISetServicePrivateNetworksV1 extends IPrivateNetworkMutationBaseV1 {
+export interface ISetServicePrivateNetworks extends IPrivateNetworkMutationBase {
   serviceId: string;
   /** null means the service has never had a membership document; not an empty list. */
   expectedRevision: number | null;
-  attachments: IPrivateNetworkAttachmentV1[];
+  attachments: IPrivateNetworkAttachment[];
   defaultNetworkId: string | null;
 }
 
-export const privateNetworkV1Contract = Object.freeze({
+export const privateNetworkContract = Object.freeze({
   privateRoot: 'internal.',
   maximumAttachments: 16,
   maximumAliasesPerAttachment: 32,
@@ -83,29 +83,17 @@ export const privateNetworkV1Contract = Object.freeze({
 const fail = (): never => { throw new Error('Private network contract rejected.'); };
 function requireValue(value: unknown): asserts value { if (!value) fail(); }
 const safe = <T>(operation: () => T): T => { try { return operation(); } catch { return fail(); } };
-const object = (value: unknown, keys: string[]): Record<string, unknown> => {
-  requireValue(value !== null && typeof value === 'object' && !Array.isArray(value));
-  requireValue(Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
-  const actual = Reflect.ownKeys(value);
-  requireValue(actual.length === keys.length && keys.every(key => actual.includes(key)));
-  const result: Record<string, unknown> = Object.create(null);
-  for (const key of keys) {
-    const descriptor = Object.getOwnPropertyDescriptor(value, key);
-    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
-    result[key] = descriptor.value;
-  }
+/** Exactly this shape's keys, read once as data; an accessor is refused, never invoked. */
+const object = (value: unknown, keys: readonly string[]): Record<string, unknown> => {
+  const result = readExactDataRecord(value, keys);
+  requireValue(result !== null);
   return result;
 };
+/** A bounded dense list, read the same way as a record, then read element by element. */
 const array = <T>(value: unknown, maximum: number, read: (item: unknown) => T): T[] => {
-  requireValue(Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype && value.length <= maximum);
-  requireValue(Reflect.ownKeys(value).length === value.length + 1);
-  const result: T[] = [];
-  for (let index = 0; index < value.length; index++) {
-    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
-    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
-    result.push(read(descriptor.value));
-  }
-  return result;
+  const elements = readDataElements(value, maximum);
+  requireValue(elements !== null);
+  return elements.map(read);
 };
 const identifier = (value: unknown): string => {
   requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
@@ -148,12 +136,12 @@ const publicSuffix = (value: unknown): string => {
 };
 
 /** Structural validation only; backend IP ownership/reachability and policy fences are required. */
-export const snapshotPrivateNetworkPolicyV1 = (value: unknown): IPrivateNetworkPolicyV1 => safe(() => {
+export const snapshotPrivateNetworkPolicy = (value: unknown): IPrivateNetworkPolicy => safe(() => {
   const policy = object(value, ['connectivity', 'externalDns']);
   requireValue(policy.connectivity === 'member-full-mesh');
   if (policy.externalDns === null) return { connectivity: 'member-full-mesh', externalDns: null };
   const external = object(policy.externalDns, ['upstreams', 'allowAnyPublicName', 'permittedSuffixes']);
-  const upstreams = array(external.upstreams, privateNetworkV1Contract.maximumUpstreams, entry => {
+  const upstreams = array(external.upstreams, privateNetworkContract.maximumUpstreams, entry => {
     const upstream = object(entry, ['address', 'port']);
     const port = counter(upstream.port);
     requireValue(port <= 65535);
@@ -161,18 +149,18 @@ export const snapshotPrivateNetworkPolicyV1 = (value: unknown): IPrivateNetworkP
   });
   requireValue(upstreams.length > 0 && new Set(upstreams.map(upstream => `${upstream.address}:${upstream.port}`)).size === upstreams.length);
   requireValue(typeof external.allowAnyPublicName === 'boolean');
-  const permittedSuffixes = sorted(array(external.permittedSuffixes, privateNetworkV1Contract.maximumPermittedSuffixes, publicSuffix));
+  const permittedSuffixes = sorted(array(external.permittedSuffixes, privateNetworkContract.maximumPermittedSuffixes, publicSuffix));
   requireValue(external.allowAnyPublicName ? permittedSuffixes.length === 0 : permittedSuffixes.length > 0);
   return { connectivity: 'member-full-mesh', externalDns: {
     upstreams, allowAnyPublicName: external.allowAnyPublicName, permittedSuffixes,
   } };
 });
 
-const membership = (attachmentsValue: unknown, defaultValue: unknown): Pick<IServicePrivateNetworksV1, 'attachments' | 'defaultNetworkId'> => {
-  const attachments = array(attachmentsValue, privateNetworkV1Contract.maximumAttachments, entry => {
+const membership = (attachmentsValue: unknown, defaultValue: unknown): Pick<IServicePrivateNetworks, 'attachments' | 'defaultNetworkId'> => {
+  const attachments = array(attachmentsValue, privateNetworkContract.maximumAttachments, entry => {
     const attachment = object(entry, ['networkId', 'aliases']);
     return { networkId: identifier(attachment.networkId),
-      aliases: sorted(array(attachment.aliases, privateNetworkV1Contract.maximumAliasesPerAttachment, label)) };
+      aliases: sorted(array(attachment.aliases, privateNetworkContract.maximumAliasesPerAttachment, label)) };
   });
   sorted(attachments.map(attachment => attachment.networkId));
   const defaultNetworkId = defaultValue === null ? null : identifier(defaultValue);
@@ -181,58 +169,54 @@ const membership = (attachmentsValue: unknown, defaultValue: unknown): Pick<ISer
   return { attachments, defaultNetworkId };
 };
 
-export const snapshotPrivateNetworkV1 = (value: unknown): IPrivateNetworkV1 => safe(() => {
-  const network = object(value, ['schemaVersion', 'id', 'organizationId', 'organizationDnsKey', 'networkDnsKey',
+export const snapshotPrivateNetwork = (value: unknown): IPrivateNetwork => safe(() => {
+  const network = object(value, ['id', 'organizationId', 'organizationDnsKey', 'networkDnsKey',
     'name', 'revision', 'state', 'policy', 'createdAt', 'updatedAt']);
-  requireValue(network.schemaVersion === 1 && ['active', 'retiring', 'retired'].includes(network.state as string));
+  requireValue(['active', 'retiring', 'retired'].includes(network.state as string));
   const createdAt = counter(network.createdAt);
   const updatedAt = counter(network.updatedAt);
   requireValue(updatedAt >= createdAt);
-  return { schemaVersion: 1, id: identifier(network.id), organizationId: identifier(network.organizationId),
+  return { id: identifier(network.id), organizationId: identifier(network.organizationId),
     organizationDnsKey: dnsKey(network.organizationDnsKey, 'o'), networkDnsKey: dnsKey(network.networkDnsKey, 'n'),
-    name: name(network.name), revision: counter(network.revision), state: network.state as IPrivateNetworkV1['state'],
-    policy: snapshotPrivateNetworkPolicyV1(network.policy), createdAt, updatedAt };
+    name: name(network.name), revision: counter(network.revision), state: network.state as IPrivateNetwork['state'],
+    policy: snapshotPrivateNetworkPolicy(network.policy), createdAt, updatedAt };
 });
 
-export const snapshotServicePrivateNetworksV1 = (value: unknown): IServicePrivateNetworksV1 => safe(() => {
-  const service = object(value, ['schemaVersion', 'organizationId', 'serviceId', 'revision', 'attachments', 'defaultNetworkId']);
-  requireValue(service.schemaVersion === 1);
-  return { schemaVersion: 1, organizationId: identifier(service.organizationId), serviceId: identifier(service.serviceId),
+export const snapshotServicePrivateNetworks = (value: unknown): IServicePrivateNetworks => safe(() => {
+  const service = object(value, ['organizationId', 'serviceId', 'revision', 'attachments', 'defaultNetworkId']);
+  return { organizationId: identifier(service.organizationId), serviceId: identifier(service.serviceId),
     revision: counter(service.revision), ...membership(service.attachments, service.defaultNetworkId) };
 });
 
-export const snapshotSetServicePrivateNetworksV1 = (value: unknown): ISetServicePrivateNetworksV1 => safe(() => {
-  const request = object(value, ['schemaVersion', 'organizationId', 'serviceId', 'mutationId', 'expectedRevision', 'attachments', 'defaultNetworkId']);
-  requireValue(request.schemaVersion === 1);
-  return { schemaVersion: 1, organizationId: identifier(request.organizationId), serviceId: identifier(request.serviceId),
+export const snapshotSetServicePrivateNetworks = (value: unknown): ISetServicePrivateNetworks => safe(() => {
+  const request = object(value, ['organizationId', 'serviceId', 'mutationId', 'expectedRevision', 'attachments', 'defaultNetworkId']);
+  return { organizationId: identifier(request.organizationId), serviceId: identifier(request.serviceId),
     mutationId: identifier(request.mutationId), expectedRevision: request.expectedRevision === null ? null : counter(request.expectedRevision),
     ...membership(request.attachments, request.defaultNetworkId) };
 });
 
-export const snapshotPrivateNetworkMutationV1 = (value: unknown): TPrivateNetworkMutationV1 => safe(() => {
-  requireValue(value !== null && typeof value === 'object');
-  const operation = Object.getOwnPropertyDescriptor(value, 'operation')?.value;
+export const snapshotPrivateNetworkMutation = (value: unknown): TPrivateNetworkMutation => safe(() => {
+  const operation = readDataProperty(value, 'operation')?.value;
   requireValue(operation === 'create' || operation === 'update' || operation === 'retire');
-  const request = object(value, ['schemaVersion', 'organizationId', 'mutationId', 'operation', 'expectedRevision',
+  const request = object(value, ['organizationId', 'mutationId', 'operation', 'expectedRevision',
     ...(operation === 'create' ? [] : ['networkId']), ...(operation === 'retire' ? [] : ['name', 'policy'])]);
-  requireValue(request.schemaVersion === 1);
-  const base = { schemaVersion: 1 as const, organizationId: identifier(request.organizationId), mutationId: identifier(request.mutationId) };
+  const base = { organizationId: identifier(request.organizationId), mutationId: identifier(request.mutationId) };
   if (operation === 'create') {
     requireValue(request.expectedRevision === null);
-    return { ...base, operation, expectedRevision: null, name: name(request.name), policy: snapshotPrivateNetworkPolicyV1(request.policy) };
+    return { ...base, operation, expectedRevision: null, name: name(request.name), policy: snapshotPrivateNetworkPolicy(request.policy) };
   }
   const current = { networkId: identifier(request.networkId), expectedRevision: counter(request.expectedRevision) };
   if (operation === 'retire') return { ...base, ...current, operation };
-  return { ...base, ...current, operation, name: name(request.name), policy: snapshotPrivateNetworkPolicyV1(request.policy) };
+  return { ...base, ...current, operation, name: name(request.name), policy: snapshotPrivateNetworkPolicy(request.policy) };
 });
 
 /** Pure naming helper; it does not reserve a name or create any public DNS/ingress record. */
-export const buildPrivateNetworkFqdnV1 = (networkValue: unknown, aliasValue: unknown): string => safe(() => {
-  const network = snapshotPrivateNetworkV1(networkValue);
-  return `${label(aliasValue)}.${network.networkDnsKey}.${network.organizationDnsKey}.${privateNetworkV1Contract.privateRoot}`;
+export const buildPrivateNetworkFqdn = (networkValue: unknown, aliasValue: unknown): string => safe(() => {
+  const network = snapshotPrivateNetwork(networkValue);
+  return `${label(aliasValue)}.${network.networkDnsKey}.${network.organizationDnsKey}.${privateNetworkContract.privateRoot}`;
 });
 
-export interface IServicePrivateNetworkDnsPolicyV1 {
+export interface IServicePrivateNetworkDnsPolicy {
   organizationId: string;
   serviceId: string;
   membershipRevision: number;
@@ -260,11 +244,11 @@ const minimalSuffixes = (values: string[]): string[] => {
  * The caller must fence these exact revisions before issuing runtime authority.
  * An inactive/missing/extra network is rejected, never silently omitted.
  */
-export const composeServicePrivateNetworkDnsPolicyV1 = (
+export const composeServicePrivateNetworkDnsPolicy = (
   membershipValue: unknown, networksValue: unknown,
-): IServicePrivateNetworkDnsPolicyV1 => safe(() => {
-  const member = snapshotServicePrivateNetworksV1(membershipValue);
-  const networks = array(networksValue, privateNetworkV1Contract.maximumAttachments, snapshotPrivateNetworkV1);
+): IServicePrivateNetworkDnsPolicy => safe(() => {
+  const member = snapshotServicePrivateNetworks(membershipValue);
+  const networks = array(networksValue, privateNetworkContract.maximumAttachments, snapshotPrivateNetwork);
   requireValue(networks.length === member.attachments.length
     && new Set(networks.map(network => network.id)).size === networks.length
     && new Set(networks.map(network => network.networkDnsKey)).size === networks.length
@@ -273,10 +257,10 @@ export const composeServicePrivateNetworkDnsPolicyV1 = (
     && network.state === 'active' && member.attachments.some(attachment => attachment.networkId === network.id));
   const ordered = member.attachments.map(attachment => networks.find(network => network.id === attachment.networkId)!);
   const networkSuffixes = ordered.map(network => ({ networkId: network.id, networkRevision: network.revision,
-    dnsSuffix: `${network.networkDnsKey}.${network.organizationDnsKey}.${privateNetworkV1Contract.privateRoot}` }));
+    dnsSuffix: `${network.networkDnsKey}.${network.organizationDnsKey}.${privateNetworkContract.privateRoot}` }));
   const searchDomains = member.defaultNetworkId === null ? []
     : [networkSuffixes.find(network => network.networkId === member.defaultNetworkId)!.dnsSuffix];
-  let externalDns: IServicePrivateNetworkDnsPolicyV1['externalDns'] = null;
+  let externalDns: IServicePrivateNetworkDnsPolicy['externalDns'] = null;
   if (ordered.length > 0 && ordered.every(network => network.policy.externalDns !== null)) {
     const policies = ordered.map(network => network.policy.externalDns!);
     const upstreams = policies[0].upstreams.filter(upstream => policies.every(policy => policy.upstreams.some(