@serve.zone/interfaces 31.8.0 → 32.0.0

package/ts/data/secret.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import type { TSha256Digest } from './immutableimage.js';
 import { normalizeServiceAbsolutePath } from './service.js';
+import { hasExactKeys } from '../private/dataproperties.js';
 
 export type TSecretEnvironment = string;
 
@@ -135,8 +136,7 @@ export interface ISecretVersionMetadata {
 }
 
 /** Irreversibly erases every platform-managed copy after all references are gone. */
-export interface ISecretVersionPurgeIntentV1 {
-  schemaVersion: 1;
+export interface ISecretVersionPurgeIntent {
   mutationId: string;
   secretId: string;
   secretVersionId: string;
@@ -145,34 +145,33 @@ export interface ISecretVersionPurgeIntentV1 {
   expectedTargetSecretsRevision: number;
 }
 
-export interface ISecretVersionPurgeFailureV1 {
+export interface ISecretVersionPurgeFailure {
   code: string;
   retryable: boolean;
   failedAt: number;
 }
 
-interface ISecretVersionPurgeOperationBaseV1 {
-  schemaVersion: 1;
+interface ISecretVersionPurgeOperationBase {
   id: string;
   revision: number;
-  intent: ISecretVersionPurgeIntentV1;
+  intent: ISecretVersionPurgeIntent;
   intentDigest: TSha256Digest;
   createdAt: number;
   updatedAt: number;
 }
 
-export type TSecretVersionPurgeOperationV1 =
-  | (ISecretVersionPurgeOperationBaseV1 & {
+export type TSecretVersionPurgeOperation =
+  | (ISecretVersionPurgeOperationBase & {
       state: 'pending' | 'erasing';
       failure?: never;
       purgedAt?: never;
     })
-  | (ISecretVersionPurgeOperationBaseV1 & {
+  | (ISecretVersionPurgeOperationBase & {
       state: 'failed';
-      failure: ISecretVersionPurgeFailureV1;
+      failure: ISecretVersionPurgeFailure;
       purgedAt?: never;
     })
-  | (ISecretVersionPurgeOperationBaseV1 & {
+  | (ISecretVersionPurgeOperationBase & {
       state: 'succeeded';
       failure?: never;
       purgedAt: number;
@@ -275,7 +274,6 @@ export interface ISecretSetAttachment {
  * Cloudly verifies organization ownership when resolving the referenced sets.
  */
 export interface IServiceSecretConfiguration {
-  schemaVersion: 2;
   /** Dedicated CAS revision for SecretSet attachments. */
   revision: number;
   /** Dedicated CAS revision for service-owned secret membership. */
@@ -294,7 +292,6 @@ export interface IResolvedSecretManifestEntry {
 
 /** Immutable, value-free runtime snapshot. */
 export interface IResolvedSecretManifest {
-  schemaVersion: 2;
   id: string;
   digest: TSha256Digest;
   organizationId: string;
@@ -346,7 +343,6 @@ export interface IClusterSecretDeploymentState {
 
 /** Server-managed per-cluster authority switched with an expected revision CAS. */
 export interface IServiceSecretDeploymentPlan {
-  schemaVersion: 2;
   revision: number;
   clusterStates: IClusterSecretDeploymentState[];
   updatedAt: number;
@@ -395,15 +391,6 @@ const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> => (
   Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg)
 );
 
-const hasExactKeys = (
-  valueArg: Record<string, unknown>,
-  keysArg: string[],
-): boolean => {
-  const actual = Object.keys(valueArg).sort();
-  const expected = [...keysArg].sort();
-  return JSON.stringify(actual) === JSON.stringify(expected);
-};
-
 const hasOnlyKeys = (
   valueArg: Record<string, unknown>,
   keysArg: string[],
@@ -536,7 +523,6 @@ export const validateSecretVersionPurgeIntent = (
 ): string[] => {
   if (!isRecord(intentArg)
     || !hasExactKeys(intentArg, [
-      'schemaVersion',
       'mutationId',
       'secretId',
       'secretVersionId',
@@ -547,9 +533,6 @@ export const validateSecretVersionPurgeIntent = (
     return ['secret version purge intent must use its exact schema'];
   }
   const errors = validateSecretMutationId(intentArg.mutationId);
-  if (intentArg.schemaVersion !== 1) {
-    errors.push('secret version purge intent schemaVersion must be 1');
-  }
   for (const field of ['secretId', 'secretVersionId'] as const) {
     if (!isSecretIdentifier(intentArg[field])) {
       errors.push(`secret version purge intent ${field} must be canonical`);
@@ -567,9 +550,8 @@ export const validateSecretVersionPurgeIntent = (
 };
 
 export const createSecretVersionPurgeIntentDigestInput = (
-  intentArg: ISecretVersionPurgeIntentV1,
+  intentArg: ISecretVersionPurgeIntent,
 ): string => JSON.stringify({
-  schemaVersion: intentArg.schemaVersion,
   purpose: 'serve.zone/secret-version-purge',
   mutationId: intentArg.mutationId,
   secretId: intentArg.secretId,
@@ -580,7 +562,7 @@ export const createSecretVersionPurgeIntentDigestInput = (
 });
 
 export const computeSecretVersionPurgeIntentDigest = async (
-  intentArg: ISecretVersionPurgeIntentV1,
+  intentArg: ISecretVersionPurgeIntent,
 ): Promise<TSha256Digest> => {
   if (validateSecretVersionPurgeIntent(intentArg).length > 0) {
     throw new Error('secret version purge intent must be canonical');
@@ -595,7 +577,7 @@ export const computeSecretVersionPurgeIntentDigest = async (
 };
 
 export const verifySecretVersionPurgeIntentDigest = async (
-  intentArg: ISecretVersionPurgeIntentV1,
+  intentArg: ISecretVersionPurgeIntent,
   digestArg: unknown,
 ): Promise<boolean> => {
   try {
@@ -613,27 +595,15 @@ export const validateSecretVersionPurgeOperation = async (
   if (!isRecord(operationArg)) return ['secret version purge operation must be an object'];
   const state = operationArg.state;
   const expectedKeys = state === 'failed'
-    ? [
-        'schemaVersion', 'id', 'revision', 'intent', 'intentDigest', 'state',
-        'failure', 'createdAt', 'updatedAt',
-      ]
+    ? ['id', 'revision', 'intent', 'intentDigest', 'state', 'failure', 'createdAt', 'updatedAt']
     : state === 'succeeded'
-      ? [
-          'schemaVersion', 'id', 'revision', 'intent', 'intentDigest', 'state',
-          'purgedAt', 'createdAt', 'updatedAt',
-        ]
-      : [
-          'schemaVersion', 'id', 'revision', 'intent', 'intentDigest', 'state',
-          'createdAt', 'updatedAt',
-        ];
+      ? ['id', 'revision', 'intent', 'intentDigest', 'state', 'purgedAt', 'createdAt', 'updatedAt']
+      : ['id', 'revision', 'intent', 'intentDigest', 'state', 'createdAt', 'updatedAt'];
   if (!['pending', 'erasing', 'failed', 'succeeded'].includes(state as string)
     || !hasExactKeys(operationArg, expectedKeys)) {
     return ['secret version purge operation must use its exact state schema'];
   }
   const errors = validateSecretVersionPurgeIntent(operationArg.intent);
-  if (operationArg.schemaVersion !== 1) {
-    errors.push('secret version purge operation schemaVersion must be 1');
-  }
   if (!isSecretIdentifier(operationArg.id) || !isPositiveSafeInteger(operationArg.revision)) {
     errors.push('secret version purge operation identity and revision must be canonical');
   }
@@ -647,7 +617,7 @@ export const validateSecretVersionPurgeOperation = async (
     && secretDigestRegex.test(operationArg.intentDigest)) {
     try {
       if (!await verifySecretVersionPurgeIntentDigest(
-        operationArg.intent as unknown as ISecretVersionPurgeIntentV1,
+        operationArg.intent as unknown as ISecretVersionPurgeIntent,
         operationArg.intentDigest,
       )) {
         errors.push('secret version purge operation intentDigest does not match');
@@ -964,16 +934,12 @@ export const validateServiceSecretConfiguration = (
   }
   const errors: string[] = [];
   if (!hasExactKeys(configurationArg, [
-    'schemaVersion',
     'revision',
     'secretsRevision',
     'secretSetAttachments',
   ])) {
     errors.push('secretConfiguration must use its exact schema');
   }
-  if (configurationArg.schemaVersion !== 2) {
-    errors.push('secretConfiguration schemaVersion must be 2');
-  }
   if (!Array.isArray(configurationArg.secretSetAttachments)) {
     errors.push('secretSetAttachments must be an array');
     return errors;
@@ -1103,7 +1069,6 @@ export const validateSecretSetAttachmentOwnership = (
 export const createResolvedSecretManifestDigestInput = (
   manifestArg: IResolvedSecretManifest,
 ): string => JSON.stringify({
-  schemaVersion: manifestArg.schemaVersion,
   id: manifestArg.id,
   organizationId: manifestArg.organizationId,
   serviceId: manifestArg.serviceId,
@@ -1171,7 +1136,6 @@ export const validateResolvedSecretManifest = (
   if (!isRecord(manifestArg)) return ['secret manifest must be an object'];
   const errors: string[] = [];
   if (!hasExactKeys(manifestArg, [
-    'schemaVersion',
     'id',
     'digest',
     'organizationId',
@@ -1188,7 +1152,6 @@ export const validateResolvedSecretManifest = (
   ])) {
     errors.push('secret manifest must use its exact schema');
   }
-  if (manifestArg.schemaVersion !== 2) errors.push('secret manifest schemaVersion must be 2');
   for (const field of [
     'id',
     'organizationId',
@@ -1397,14 +1360,12 @@ export const validateServiceSecretDeploymentPlan = (
   if (!isRecord(planArg)) return ['secret deployment plan must be an object'];
   const errors: string[] = [];
   if (!hasExactKeys(planArg, [
-    'schemaVersion',
     'revision',
     'clusterStates',
     'updatedAt',
   ])) {
     errors.push('secret deployment plan must use its exact schema');
   }
-  if (planArg.schemaVersion !== 2) errors.push('secret deployment plan schemaVersion must be 2');
   if (!Number.isSafeInteger(planArg.revision) || (planArg.revision as number) < 1) {
     errors.push('secret deployment plan revision must be a positive integer');
   }
@@ -1528,11 +1489,11 @@ export const validateServiceSecretDeploymentPlan = (
   return errors;
 };
 
-export const dockerSecretResourceNameDomain = 'serve.zone/docker-secret-resource/v1' as const;
-export const workloadInitEnvironmentMapPath = '/run/serve.zone/workloadinit-map-v1.json' as const;
+export const dockerSecretResourceNameDomain = 'serve.zone/docker-secret-resource' as const;
+export const workloadInitEnvironmentMapPath = '/run/serve.zone/workloadinit-map.json' as const;
 export const workloadRuntimeAssetRoot = '/opt/serve.zone/runtime-assets' as const;
 export const workloadInitExecutablePath =
-  '/opt/serve.zone/runtime-assets/workloadinit/v1/workloadinit' as const;
+  '/opt/serve.zone/runtime-assets/workloadinit/workloadinit' as const;
 export const workloadInitEnvironmentMapMode = 0o444 as const;
 export const workloadRuntimeAssetsReadOnly = true as const;
 
@@ -1579,17 +1540,16 @@ export const createLauncherSecretSourcePath = (
   return `/run/serve.zone/secrets/${resourceArg}`;
 };
 
-export interface IWorkloadInitEnvironmentMapEntryV1 {
+export interface IWorkloadInitEnvironmentMapEntry {
   variableName: string;
   resource: string;
   source: string;
 }
 
-export interface IWorkloadInitEnvironmentMapV1 {
-  schemaVersion: 1;
+export interface IWorkloadInitEnvironmentMap {
   manifestId: string;
   manifestDigest: TSha256Digest;
-  entries: IWorkloadInitEnvironmentMapEntryV1[];
+  entries: IWorkloadInitEnvironmentMapEntry[];
 }
 
 /**
@@ -1600,7 +1560,7 @@ export interface IWorkloadInitEnvironmentMapV1 {
  */
 export const createWorkloadInitEnvironmentMap = async (
   manifestArg: IResolvedSecretManifest,
-): Promise<IWorkloadInitEnvironmentMapV1> => {
+): Promise<IWorkloadInitEnvironmentMap> => {
   if (validateResolvedSecretManifest(manifestArg).length > 0
     || !await verifyResolvedSecretManifestDigest(manifestArg)) {
     throw new Error('workload init map requires a valid digest-verified manifest');
@@ -1629,7 +1589,6 @@ export const createWorkloadInitEnvironmentMap = async (
     throw new Error('workload init map entries must have unique variable, resource, and source fields');
   }
   return {
-    schemaVersion: 1,
     manifestId: manifestArg.id,
     manifestDigest: manifestArg.digest,
     entries,
@@ -1641,7 +1600,7 @@ export const verifyWorkloadInitEnvironmentMap = async (
   manifestArg: IResolvedSecretManifest,
 ): Promise<boolean> => {
   if (!isRecord(mapArg)
-    || !hasExactKeys(mapArg, ['schemaVersion', 'manifestId', 'manifestDigest', 'entries'])) {
+    || !hasExactKeys(mapArg, ['manifestId', 'manifestDigest', 'entries'])) {
     return false;
   }
   try {
@@ -1688,7 +1647,6 @@ export interface ISecretRuntimeResourceRetention {
 export type TSecretRecipientLifecycleState = 'active' | 'retiring' | 'revoked';
 
 interface ISecretRecipientMetadataBase {
-  schemaVersion: 1;
   recipientKeyId: string;
   /** Canonical unpadded base64url raw 32-byte X25519 public key. */
   publicKey: string;
@@ -1731,17 +1689,16 @@ export const validateSecretRecipientMetadata = (
   if (!isRecord(recipientArg)) return ['secret recipient must be an object'];
   const lifecycleState = recipientArg.lifecycleState;
   const requiredKeys = lifecycleState === 'active'
-    ? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState']
+    ? ['recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState']
     : lifecycleState === 'retiring'
-      ? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState', 'acceptUntil']
+      ? ['recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState', 'acceptUntil']
       : lifecycleState === 'revoked'
-        ? ['schemaVersion', 'recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState', 'revokedAt']
+        ? ['recipientKeyId', 'publicKey', 'generation', 'activatedAt', 'lifecycleState', 'revokedAt']
         : [];
   if (requiredKeys.length === 0 || !hasExactKeys(recipientArg, requiredKeys)) {
     return ['secret recipient must use its exact lifecycle schema'];
   }
   const errors: string[] = [];
-  if (recipientArg.schemaVersion !== 1) errors.push('secret recipient schemaVersion must be 1');
   if (!isSecretIdentifier(recipientArg.recipientKeyId)) {
     errors.push('secret recipient key id must be canonical');
   }
@@ -1877,7 +1834,6 @@ export const createSecretCreateEnvelopeContext = (contextArg: {
   delivery: TSecretDelivery;
   expectedTargetSecretsRevision: number;
 }): Uint8Array => contextBytes({
-  schemaVersion: 1,
   purpose: 'serve.zone/secret-create',
   mutationId: contextArg.mutationId,
   target: canonicalSecretOwner(contextArg.target),
@@ -1894,7 +1850,6 @@ export const createSecretRotateEnvelopeContext = (contextArg: {
   expectedActiveVersionId: string;
   expectedTargetSecretsRevision: number;
 }): Uint8Array => contextBytes({
-  schemaVersion: 1,
   purpose: 'serve.zone/secret-rotate',
   mutationId: contextArg.mutationId,
   secretId: contextArg.secretId,
@@ -1912,7 +1867,6 @@ export const createAppStoreInstallSecretEnvelopeContext = (contextArg: {
   delivery: TSecretDelivery;
   generation?: { encoding: TSecretGeneratedEncoding; bytes: number };
 }): Uint8Array => contextBytes({
-  schemaVersion: 1,
   purpose: 'serve.zone/app-install-secret',
   mutationId: contextArg.mutationId,
   appId: contextArg.appId,
@@ -1940,7 +1894,6 @@ export const createResolvedSecretMaterialEnvelopeContext = (contextArg: {
   secretId: string;
   secretVersionId: string;
 }): Uint8Array => contextBytes({
-  schemaVersion: 1,
   purpose: 'serve.zone/resolved-secret-material',
   recipientKeyId: contextArg.recipientKeyId,
   organizationId: contextArg.organizationId,
@@ -1965,7 +1918,6 @@ export const createSecretRecipientEnrollmentChallengeContext = (contextArg: {
   generation: number;
   expiresAt: number;
 }): Uint8Array => contextBytes({
-  schemaVersion: 1,
   purpose: 'serve.zone/secret-recipient-enrollment-challenge',
   enrollmentId: contextArg.enrollmentId,
   clusterId: contextArg.clusterId,

package/ts/data/servicecredential.ts

@@ -1,19 +1,22 @@
+import {
+  readDataElements, readDataProperty, readExactDataRecord,
+} from '../private/dataproperties.js';
+
 /** Workload permissions are independent of human membership and deployment grants. */
-export type TServiceMachineCapabilityV1 = 'platform:session';
+export type TServiceMachineCapability = 'platform:session';
 
 /** Exact existing-service authority. Never infer this grant from an API role. */
-export interface IServiceMachineGrantV1 {
+export interface IServiceMachineGrant {
   organizationId: string;
   serviceId: string;
-  capabilities: TServiceMachineCapabilityV1[];
+  capabilities: TServiceMachineCapability[];
 }
 
 /** Public metadata only. The bearer is delivered through the owning service's SecretSet. */
-export interface IServiceMachineCredentialMetadataV1 {
-  schemaVersion: 1;
+export interface IServiceMachineCredentialMetadata {
   credentialId: string;
   userId: string;
-  grant: IServiceMachineGrantV1;
+  grant: IServiceMachineGrant;
   generation: number;
   state: 'active' | 'revoked';
   expiresAt: number;
@@ -23,8 +26,7 @@ export interface IServiceMachineCredentialMetadataV1 {
   delivery: { secretId: string; secretVersionId: string } | null;
 }
 
-interface IServiceMachineCredentialMutationBaseV1 {
-  schemaVersion: 1;
+interface IServiceMachineCredentialMutationBase {
   organizationId: string;
   serviceId: string;
   /** Retain the complete request and this ID across retries. */
@@ -32,41 +34,34 @@ interface IServiceMachineCredentialMutationBaseV1 {
 }
 
 /** Creation is absent-only; rotation and revocation require the exact current generation. */
-export type TServiceMachineCredentialMutationV1 = IServiceMachineCredentialMutationBaseV1 & (
+export type TServiceMachineCredentialMutation = IServiceMachineCredentialMutationBase & (
   | {
       operation: 'ensure';
       expectedGeneration: null;
-      capabilities: TServiceMachineCapabilityV1[];
+      capabilities: TServiceMachineCapability[];
       expiresAt: number;
     }
   | {
       operation: 'rotate';
       expectedGeneration: number;
-      capabilities: TServiceMachineCapabilityV1[];
+      capabilities: TServiceMachineCapability[];
       expiresAt: number;
     }
   | { operation: 'revoke'; expectedGeneration: number }
 );
 
-export interface IServiceMachineCredentialMutationResultV1 {
+export interface IServiceMachineCredentialMutationResult {
   /** Historical on replay; replay never restores revoked or superseded authority. */
-  credential: IServiceMachineCredentialMetadataV1;
+  credential: IServiceMachineCredentialMetadata;
   replayed: boolean;
 }
 
 const fail = (): never => { throw new Error('Service credential contract rejected.'); };
 function requireValue(value: unknown): asserts value { if (!value) fail(); }
-const object = (value: unknown, keys: string[]): Record<string, unknown> => {
-  requireValue(value !== null && typeof value === 'object' && !Array.isArray(value));
-  requireValue(Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
-  const actual = Reflect.ownKeys(value);
-  requireValue(actual.length === keys.length && keys.every((key) => actual.includes(key)));
-  const copy: Record<string, unknown> = Object.create(null);
-  for (const key of keys) {
-    const descriptor = Object.getOwnPropertyDescriptor(value, key);
-    requireValue(descriptor && Object.hasOwn(descriptor, 'value') && descriptor.enumerable);
-    copy[key] = descriptor.value;
-  }
+/** Exactly this shape's keys, read once as data; an accessor is refused, never invoked. */
+const object = (value: unknown, keys: readonly string[]): Record<string, unknown> => {
+  const copy = readExactDataRecord(value, keys);
+  requireValue(copy !== null);
   return copy;
 };
 const identifier = (value: unknown): string => {
@@ -77,31 +72,26 @@ const counter = (value: unknown): number => {
   requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value < Number.MAX_SAFE_INTEGER);
   return value;
 };
-const capabilities = (value: unknown): TServiceMachineCapabilityV1[] => {
-  requireValue(Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype);
-  const keys = Reflect.ownKeys(value);
-  requireValue(keys.length === 2 && keys.includes('length') && keys.includes('0'));
-  const entry = Object.getOwnPropertyDescriptor(value, '0');
-  requireValue(entry && Object.hasOwn(entry, 'value') && entry.enumerable && entry.value === 'platform:session');
+const capabilities = (value: unknown): TServiceMachineCapability[] => {
+  const entries = readDataElements(value, 1);
+  requireValue(entries !== null && entries.length === 1 && entries[0] === 'platform:session');
   return ['platform:session'];
 };
 const safe = <T>(operation: () => T): T => { try { return operation(); } catch { return fail(); } };
 
 /** Structural copy only; the backend must fence live service ownership and credential authority. */
-export const snapshotServiceMachineGrantV1 = (value: unknown): IServiceMachineGrantV1 => safe(() => {
+export const snapshotServiceMachineGrant = (value: unknown): IServiceMachineGrant => safe(() => {
   const grant = object(value, ['organizationId', 'serviceId', 'capabilities']);
   return { organizationId: identifier(grant.organizationId), serviceId: identifier(grant.serviceId),
     capabilities: capabilities(grant.capabilities) };
 });
 
-export const snapshotServiceMachineCredentialMutationV1 = (value: unknown): TServiceMachineCredentialMutationV1 => safe(() => {
-  requireValue(value !== null && typeof value === 'object');
-  const operation = Object.getOwnPropertyDescriptor(value, 'operation')?.value;
+export const snapshotServiceMachineCredentialMutation = (value: unknown): TServiceMachineCredentialMutation => safe(() => {
+  const operation = readDataProperty(value, 'operation')?.value;
   requireValue(operation === 'ensure' || operation === 'rotate' || operation === 'revoke');
-  const request = object(value, ['schemaVersion', 'organizationId', 'serviceId', 'mutationId', 'operation',
+  const request = object(value, ['organizationId', 'serviceId', 'mutationId', 'operation',
     'expectedGeneration', ...(operation === 'revoke' ? [] : ['capabilities', 'expiresAt'])]);
-  requireValue(request.schemaVersion === 1);
-  const base = { schemaVersion: 1 as const, organizationId: identifier(request.organizationId),
+  const base = { organizationId: identifier(request.organizationId),
     serviceId: identifier(request.serviceId), mutationId: identifier(request.mutationId) };
   if (operation === 'revoke') return { ...base, operation, expectedGeneration: counter(request.expectedGeneration) };
   const material = { capabilities: capabilities(request.capabilities), expiresAt: counter(request.expiresAt) };
@@ -112,19 +102,19 @@ export const snapshotServiceMachineCredentialMutationV1 = (value: unknown): TSer
   return { ...base, ...material, operation, expectedGeneration: counter(request.expectedGeneration) };
 });
 
-export const snapshotServiceMachineCredentialMetadataV1 = (value: unknown): IServiceMachineCredentialMetadataV1 => safe(() => {
-  const metadata = object(value, ['schemaVersion', 'credentialId', 'userId', 'grant', 'generation', 'state',
+export const snapshotServiceMachineCredentialMetadata = (value: unknown): IServiceMachineCredentialMetadata => safe(() => {
+  const metadata = object(value, ['credentialId', 'userId', 'grant', 'generation', 'state',
     'expiresAt', 'createdAt', 'updatedAt', 'delivery']);
-  requireValue(metadata.schemaVersion === 1 && (metadata.state === 'active' || metadata.state === 'revoked'));
+  requireValue(metadata.state === 'active' || metadata.state === 'revoked');
   const createdAt = counter(metadata.createdAt);
   const updatedAt = counter(metadata.updatedAt);
   requireValue(updatedAt >= createdAt);
-  let delivery: IServiceMachineCredentialMetadataV1['delivery'] = null;
+  let delivery: IServiceMachineCredentialMetadata['delivery'] = null;
   if (metadata.state === 'active') {
     const version = object(metadata.delivery, ['secretId', 'secretVersionId']);
     delivery = { secretId: identifier(version.secretId), secretVersionId: identifier(version.secretVersionId) };
   } else requireValue(metadata.delivery === null);
-  return { schemaVersion: 1, credentialId: identifier(metadata.credentialId), userId: identifier(metadata.userId),
-    grant: snapshotServiceMachineGrantV1(metadata.grant), generation: counter(metadata.generation),
+  return { credentialId: identifier(metadata.credentialId), userId: identifier(metadata.userId),
+    grant: snapshotServiceMachineGrant(metadata.grant), generation: counter(metadata.generation),
     state: metadata.state, expiresAt: counter(metadata.expiresAt), createdAt, updatedAt, delivery };
 });