@serve.zone/interfaces 31.8.0 → 32.0.0

package/ts/runtime.ts

@@ -1,13 +1,13 @@
 import * as plugins from './plugins.js';
 import type {
   IActiveSecretRecipientMetadata,
-  IClusterRuntimeTargetSetReadyV1,
-  IClusterRuntimeTargetV1,
+  IClusterRuntimeTargetSetReady,
+  IClusterRuntimeTarget,
   IClusterSecretDeploymentState,
-  ICoreflowRuntimeCapabilities,
   IIdentityCredential,
   IResolvedSecretManifest,
   IResolvedSecretManifestReference,
+  TCoreflowRuntimeCapability,
   TSha256Digest,
   TImmutableContainerPlatform,
   TSecretRecipientMetadata,
@@ -27,11 +27,12 @@ import {
   isClusterRuntimeTargetSetFresh,
   validateClusterRuntimeTargetSet,
 } from './data/clusternode.js';
-import { isSha256Digest } from './data/immutableimage.js';
+import { isCoreflowRuntimeCapabilityList, isSha256Digest } from './data/immutableimage.js';
+import { hasExactKeys } from './private/dataproperties.js';
 import type {
-  IWorkloadInitActiveApprovalAuthorityV1,
-  IWorkloadInitApprovalAuthorityReferenceV1,
-  IWorkloadInitApprovedArtifactV1,
+  IWorkloadInitActiveApprovalAuthority,
+  IWorkloadInitApprovalAuthorityReference,
+  IWorkloadInitApprovedArtifact,
 } from './runtime.workloadinit.js';
 import {
   validateWorkloadInitActiveApprovalAuthority,
@@ -43,8 +44,6 @@ export * from './runtime.networkprojection.js';
 export * from './runtime.corestore.js';
 export * from './runtime.corestore.databaseexportpackage.js';
 export * from './runtime.corestore.relay.js';
-export * from './runtime.cloudlylegacydeploymentsettlement.js';
-export * from './runtime.cloudlylegacydeploymentsettlement.offlineexport.js';
 
 export interface ISealedResolvedSecretMaterialEntry {
   secretVersionId: string;
@@ -53,8 +52,7 @@ export interface ISealedResolvedSecretMaterialEntry {
 
 /** Runtime-only material. No plaintext value is represented in this DTO. */
 export interface ISealedResolvedSecretMaterial {
-  schemaVersion: 1;
-  /** Full schema-v2 value-free manifest used for digest and rollout verification. */
+  /** The complete value-free manifest, used for digest and rollout verification. */
   manifest: IResolvedSecretManifest;
   /** Sorted exact coverage of the manifest's pinned versions. */
   entries: ISealedResolvedSecretMaterialEntry[];
@@ -93,11 +91,10 @@ export const verifySealedResolvedSecretMaterial = async (
   if (JSON.stringify(Object.keys(material).sort()) !== JSON.stringify([
     'entries',
     'manifest',
-    'schemaVersion',
   ])) {
     return false;
   }
-  if (material.schemaVersion !== 1 || !material.manifest || !Array.isArray(material.entries)) {
+  if (!material.manifest || !Array.isArray(material.entries)) {
     return false;
   }
   if (validateResolvedSecretManifest(material.manifest).length > 0
@@ -184,8 +181,7 @@ extends plugins.typedrequestInterfaces.implementsTR<
   };
 }
 
-export interface ISecretRecipientEnrollmentChallengeV1 {
-  schemaVersion: 1;
+export interface ISecretRecipientEnrollmentChallenge {
   enrollmentId: string;
   clusterId: string;
   recipientKeyId: string;
@@ -215,7 +211,7 @@ extends plugins.typedrequestInterfaces.implementsTR<
     expectedGeneration: number;
   };
   response: {
-    challenge: ISecretRecipientEnrollmentChallengeV1;
+    challenge: ISecretRecipientEnrollmentChallenge;
   };
 }
 
@@ -294,7 +290,6 @@ export const validateSecretRecipientEnrollmentChallenge = async (
     'generation',
     'publicKey',
     'recipientKeyId',
-    'schemaVersion',
   ])) {
     errors.push('enrollment challenge must use its exact schema');
   }
@@ -304,7 +299,6 @@ export const validateSecretRecipientEnrollmentChallenge = async (
       errors.push(`enrollment challenge ${field} must be canonical`);
     }
   }
-  if (challenge.schemaVersion !== 1) errors.push('enrollment challenge schemaVersion must be 1');
   if (typeof challenge.publicKey !== 'string'
     || !raw32ByteBase64UrlRegex.test(challenge.publicKey)) {
     errors.push('enrollment challenge public key must be canonical');
@@ -396,16 +390,6 @@ const isRuntimeRecord = (valueArg: unknown): valueArg is Record<string, unknown>
   Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg)
 );
 
-const hasExactRuntimeKeys = (
-  valueArg: Record<string, unknown>,
-  keysArg: string[],
-): boolean => JSON.stringify(Object.keys(valueArg).sort()) === JSON.stringify([...keysArg].sort());
-
-const hasOnlyRuntimeKeys = (
-  valueArg: Record<string, unknown>,
-  keysArg: string[],
-): boolean => Object.keys(valueArg).every((keyArg) => keysArg.includes(keyArg));
-
 const isRuntimeIdentifier = (valueArg: unknown): valueArg is string => (
   typeof valueArg === 'string' && runtimeIdentifierRegex.test(valueArg)
 );
@@ -441,8 +425,7 @@ const computeRuntimeSha256Bytes = async (
  * Reproducible binding persisted inside a trusted Cloudly mutation receipt.
  * This value alone does not prove that Cloudly admitted the envelope.
  */
-export interface ISecretEnvelopeAdmissionBindingV1 {
-  schemaVersion: 1;
+export interface ISecretEnvelopeAdmissionBinding {
   recipientKeyId: string;
   recipientGeneration: number;
   envelopeDigest: TSha256Digest;
@@ -482,8 +465,7 @@ export const validateSecretEnvelopeAdmissionBinding = (
   bindingArg: unknown,
 ): string[] => {
   if (!isRuntimeRecord(bindingArg)
-    || !hasExactRuntimeKeys(bindingArg, [
-      'schemaVersion',
+    || !hasExactKeys(bindingArg, [
       'recipientKeyId',
       'recipientGeneration',
       'envelopeDigest',
@@ -492,9 +474,6 @@ export const validateSecretEnvelopeAdmissionBinding = (
     return ['secret envelope admission binding must use its exact schema'];
   }
   const errors: string[] = [];
-  if (bindingArg.schemaVersion !== 1) {
-    errors.push('secret envelope admission binding schemaVersion must be 1');
-  }
   if (!isRuntimeIdentifier(bindingArg.recipientKeyId)
     || !isPositiveSafeInteger(bindingArg.recipientGeneration)) {
     errors.push('secret envelope admission binding recipient must be canonical');
@@ -512,7 +491,7 @@ export const createSecretEnvelopeAdmissionBinding = async (
   recipientArg: IActiveSecretRecipientMetadata,
   envelopeArg: unknown,
   requestContextArg: Uint8Array,
-): Promise<ISecretEnvelopeAdmissionBindingV1> => {
+): Promise<ISecretEnvelopeAdmissionBinding> => {
   if (validateSecretRecipientMetadata(recipientArg).length > 0
     || recipientArg.lifecycleState !== 'active') {
     throw new Error('secret envelope admission requires the active recipient');
@@ -523,7 +502,6 @@ export const createSecretEnvelopeAdmissionBinding = async (
     throw new Error('secret envelope admission binding does not match recipient and context');
   }
   return {
-    schemaVersion: 1,
     recipientKeyId: recipientArg.recipientKeyId,
     recipientGeneration: recipientArg.generation,
     envelopeDigest: await computeSecretEnvelopeDigest(envelope),
@@ -538,7 +516,7 @@ export const verifySecretEnvelopeAdmissionBinding = async (
 ): Promise<boolean> => {
   try {
     if (validateSecretEnvelopeAdmissionBinding(bindingArg).length > 0) return false;
-    const binding = bindingArg as ISecretEnvelopeAdmissionBindingV1;
+    const binding = bindingArg as ISecretEnvelopeAdmissionBinding;
     const envelope = plugins.smartcrypto.parseX25519Envelope(envelopeArg);
     return envelope.recipientKeyId === binding.recipientKeyId
       && await verifySecretEnvelopeContext(envelope, requestContextArg)
@@ -549,14 +527,12 @@ export const verifySecretEnvelopeAdmissionBinding = async (
   }
 };
 
-export type TSecretRecipientEnrollmentStateV1 =
+export type TSecretRecipientEnrollmentState =
   | {
-    schemaVersion: 1;
     generation: 0;
     recipients: [];
   }
   | {
-    schemaVersion: 1;
     generation: number;
     recipients: TSecretRecipientMetadata[];
   };
@@ -571,7 +547,7 @@ extends plugins.typedrequestInterfaces.implementsTR<
   request: {
     identity: IIdentityCredential;
   };
-  response: TSecretRecipientEnrollmentStateV1;
+  response: TSecretRecipientEnrollmentState;
 }
 
 export const validateGetSecretRecipientEnrollmentStateRequest = (
@@ -579,9 +555,9 @@ export const validateGetSecretRecipientEnrollmentStateRequest = (
 ): string[] => {
   try {
     if (!isRuntimeRecord(requestArg)
-      || !hasExactRuntimeKeys(requestArg, ['identity'])
+      || !hasExactKeys(requestArg, ['identity'])
       || !isRuntimeRecord(requestArg.identity)
-      || !hasExactRuntimeKeys(requestArg.identity, ['jwt'])
+      || !hasExactKeys(requestArg.identity, ['jwt'])
       || typeof requestArg.identity.jwt !== 'string'
       || requestArg.identity.jwt.length === 0) {
       return ['secret recipient enrollment state request must contain only a JWT identity'];
@@ -597,13 +573,10 @@ export const validateSecretRecipientEnrollmentState = (
 ): string[] => {
   try {
     if (!isRuntimeRecord(stateArg)
-      || !hasExactRuntimeKeys(stateArg, ['schemaVersion', 'generation', 'recipients'])) {
+      || !hasExactKeys(stateArg, ['generation', 'recipients'])) {
       return ['secret recipient enrollment state must use its exact schema'];
     }
     const errors: string[] = [];
-    if (stateArg.schemaVersion !== 1) {
-      errors.push('secret recipient enrollment state schemaVersion must be 1');
-    }
     if (stateArg.generation === 0) {
       if (!Array.isArray(stateArg.recipients) || stateArg.recipients.length !== 0) {
         errors.push('generation-zero enrollment state must have no recipients');
@@ -628,32 +601,31 @@ export const validateSecretRecipientEnrollmentState = (
   }
 };
 
-export interface ICoreflowSecretRuntimeNodeTargetV2
-extends IClusterRuntimeTargetV1 {}
+export interface ICoreflowSecretRuntimeNodeTarget
+extends IClusterRuntimeTarget {}
 
-export interface ICoreflowSecretRuntimeNodeEvidenceV2
-extends ICoreflowSecretRuntimeNodeTargetV2 {
+export interface ICoreflowSecretRuntimeNodeEvidence
+extends ICoreflowSecretRuntimeNodeTarget {
   workloadInitPlatformManifestDigest: TSha256Digest;
   workloadInitExecutableDigest: TSha256Digest;
 }
 
-export interface ICoreflowSecretRuntimeRegistrationExpectationV2 {
-  expectationVersion: 2;
+export interface ICoreflowSecretRuntimeRegistrationExpectation {
   expectationDigest: TSha256Digest;
   reporterSessionId: string;
-  targetAuthority: IClusterRuntimeTargetSetReadyV1;
-  workloadInitAuthority: IWorkloadInitActiveApprovalAuthorityV1;
+  targetAuthority: IClusterRuntimeTargetSetReady;
+  workloadInitAuthority: IWorkloadInitActiveApprovalAuthority;
   activeRecipient: IActiveSecretRecipientMetadata;
 }
 
-/** Dedicated TypedSocket tag carrying ICoreflowSecretRuntimeRegistrationV2. */
+/** Dedicated TypedSocket tag carrying ICoreflowSecretRuntimeRegistration. */
 export const coreflowSecretRuntimeRegistrationTagId =
   'coreflowSecretRuntimeRegistration' as const;
 
-export type TCoreflowSecretRuntimeRegistrationExpectationResponseV2 =
+export type TCoreflowSecretRuntimeRegistrationExpectationResponse =
   | {
       status: 'available';
-      expectation: ICoreflowSecretRuntimeRegistrationExpectationV2;
+      expectation: ICoreflowSecretRuntimeRegistrationExpectation;
     }
   | {
       status: 'unavailable';
@@ -674,7 +646,7 @@ extends plugins.typedrequestInterfaces.implementsTR<
   request: {
     identity: IIdentityCredential;
   };
-  response: TCoreflowSecretRuntimeRegistrationExpectationResponseV2;
+  response: TCoreflowSecretRuntimeRegistrationExpectationResponse;
 }
 
 export const validateGetCoreflowSecretRuntimeRegistrationExpectationRequest = (
@@ -682,9 +654,9 @@ export const validateGetCoreflowSecretRuntimeRegistrationExpectationRequest = (
 ): string[] => {
   try {
     if (!isRuntimeRecord(requestArg)
-      || !hasExactRuntimeKeys(requestArg, ['identity'])
+      || !hasExactKeys(requestArg, ['identity'])
       || !isRuntimeRecord(requestArg.identity)
-      || !hasExactRuntimeKeys(requestArg.identity, ['jwt'])
+      || !hasExactKeys(requestArg.identity, ['jwt'])
       || typeof requestArg.identity.jwt !== 'string'
       || requestArg.identity.jwt.length === 0) {
       return ['secret runtime registration expectation request must contain only a JWT identity'];
@@ -695,24 +667,24 @@ export const validateGetCoreflowSecretRuntimeRegistrationExpectationRequest = (
   }
 };
 
-export interface ICoreflowSecretRuntimeRegistrationV2 {
-  registrationVersion: 2;
+export interface ICoreflowSecretRuntimeRegistration {
   expectationDigest: TSha256Digest;
   reporterSessionId: string;
   registeredAt: number;
   targetGeneration: number;
   targetSetDigest: TSha256Digest;
-  targets: ICoreflowSecretRuntimeNodeTargetV2[];
-  nodeEvidence: ICoreflowSecretRuntimeNodeEvidenceV2[];
-  capabilities: ICoreflowRuntimeCapabilities;
+  targets: ICoreflowSecretRuntimeNodeTarget[];
+  nodeEvidence: ICoreflowSecretRuntimeNodeEvidence[];
+  /** Sorted and duplicate-free; every required capability of this major is present. */
+  capabilities: TCoreflowRuntimeCapability[];
   activeRecipient: IActiveSecretRecipientMetadata;
-  workloadInitAuthority: IWorkloadInitApprovalAuthorityReferenceV1;
+  workloadInitAuthority: IWorkloadInitApprovalAuthorityReference;
   workloadInitImageIndexDigest: TSha256Digest;
 }
 
 const compareRuntimeTargets = (
-  leftArg: ICoreflowSecretRuntimeNodeTargetV2,
-  rightArg: ICoreflowSecretRuntimeNodeTargetV2,
+  leftArg: ICoreflowSecretRuntimeNodeTarget,
+  rightArg: ICoreflowSecretRuntimeNodeTarget,
 ): number => {
   for (const [left, right] of [
     [leftArg.cloudlyNodeId, rightArg.cloudlyNodeId],
@@ -727,20 +699,9 @@ const compareRuntimeTargets = (
   return 0;
 };
 
-const canonicalRuntimeTarget = (
-  targetArg: ICoreflowSecretRuntimeNodeTargetV2,
-): ICoreflowSecretRuntimeNodeTargetV2 => ({
-  cloudlyNodeId: targetArg.cloudlyNodeId,
-  swarmClusterId: targetArg.swarmClusterId,
-  swarmNodeId: targetArg.swarmNodeId,
-  nodeName: targetArg.nodeName,
-  platform: targetArg.platform,
-});
-
 const canonicalActiveRecipient = (
   recipientArg: IActiveSecretRecipientMetadata,
 ): IActiveSecretRecipientMetadata => ({
-  schemaVersion: recipientArg.schemaVersion,
   recipientKeyId: recipientArg.recipientKeyId,
   publicKey: recipientArg.publicKey,
   generation: recipientArg.generation,
@@ -749,9 +710,8 @@ const canonicalActiveRecipient = (
 });
 
 export const createCoreflowSecretRuntimeRegistrationExpectationDigestInput = (
-  expectationArg: ICoreflowSecretRuntimeRegistrationExpectationV2,
+  expectationArg: ICoreflowSecretRuntimeRegistrationExpectation,
 ): string => JSON.stringify({
-  schemaVersion: 2,
   purpose: 'serve.zone/coreflow-secret-runtime-expectation',
   reporterSessionId: expectationArg.reporterSessionId,
   targetAuthority: {
@@ -761,7 +721,6 @@ export const createCoreflowSecretRuntimeRegistrationExpectationDigestInput = (
     targetSetDigest: expectationArg.targetAuthority.targetSetDigest,
   },
   workloadInitAuthority: {
-    authorityVersion: expectationArg.workloadInitAuthority.authorityVersion,
     authorityGeneration: expectationArg.workloadInitAuthority.authorityGeneration,
     approvalDigest: expectationArg.workloadInitAuthority.approvalDigest,
   },
@@ -769,7 +728,7 @@ export const createCoreflowSecretRuntimeRegistrationExpectationDigestInput = (
 });
 
 export const computeCoreflowSecretRuntimeRegistrationExpectationDigest = async (
-  expectationArg: ICoreflowSecretRuntimeRegistrationExpectationV2,
+  expectationArg: ICoreflowSecretRuntimeRegistrationExpectation,
 ): Promise<TSha256Digest> => computeRuntimeSha256(
   createCoreflowSecretRuntimeRegistrationExpectationDigestInput(expectationArg),
 );
@@ -784,13 +743,13 @@ const validateRuntimeTargets = (
     return [`${pathArg} must be a non-empty bounded array`];
   }
   const errors: string[] = [];
-  let previous: ICoreflowSecretRuntimeNodeTargetV2 | undefined;
+  let previous: ICoreflowSecretRuntimeNodeTarget | undefined;
   const cloudlyNodeIds = new Set<string>();
   const swarmNodeScopes = new Set<string>();
   const nodeNames = new Set<string>();
   for (const [index, targetArg] of targetsArg.entries()) {
     if (!isRuntimeRecord(targetArg)
-      || !hasExactRuntimeKeys(targetArg, [
+      || !hasExactKeys(targetArg, [
         'cloudlyNodeId',
         'swarmClusterId',
         'swarmNodeId',
@@ -814,7 +773,7 @@ const validateRuntimeTargets = (
       && isRuntimeIdentifier(targetArg.swarmNodeId)
       && isRuntimeIdentifier(targetArg.nodeName)
       && runtimePlatforms.has(targetArg.platform as TImmutableContainerPlatform)) {
-      const target = targetArg as unknown as ICoreflowSecretRuntimeNodeTargetV2;
+      const target = targetArg as unknown as ICoreflowSecretRuntimeNodeTarget;
       if (previous && compareRuntimeTargets(previous, target) >= 0) {
         errors.push(`${pathArg} must be uniquely sorted by runtime identity`);
       }
@@ -850,8 +809,7 @@ export const validateCoreflowSecretRuntimeRegistrationExpectation = async (
   try {
     const errors: string[] = [];
     if (!isRuntimeRecord(expectationArg)
-      || !hasExactRuntimeKeys(expectationArg, [
-        'expectationVersion',
+      || !hasExactKeys(expectationArg, [
         'expectationDigest',
         'reporterSessionId',
         'targetAuthority',
@@ -860,9 +818,6 @@ export const validateCoreflowSecretRuntimeRegistrationExpectation = async (
       ])) {
       return ['secret runtime registration expectation must use its exact schema'];
     }
-    if (expectationArg.expectationVersion !== 2) {
-      errors.push('secret runtime registration expectationVersion must be 2');
-    }
     if (!isRuntimeIdentifier(expectationArg.reporterSessionId)) {
       errors.push('expected secret runtime reporterSessionId must be canonical');
     }
@@ -872,7 +827,7 @@ export const validateCoreflowSecretRuntimeRegistrationExpectation = async (
     errors.push(...targetAuthorityErrors.map((errorArg) => `expected ${errorArg}`));
     if (targetAuthorityErrors.length === 0
       && !isClusterRuntimeTargetSetFresh(
-        expectationArg.targetAuthority as IClusterRuntimeTargetSetReadyV1,
+        expectationArg.targetAuthority as IClusterRuntimeTargetSetReady,
         trustedNowArg,
       )) {
       errors.push('expected cluster runtime target authority must be fresh');
@@ -915,7 +870,7 @@ export const validateCoreflowSecretRuntimeRegistrationExpectation = async (
     } else if (errors.length === 0
       && expectationArg.expectationDigest
         !== await computeCoreflowSecretRuntimeRegistrationExpectationDigest(
-          expectationArg as unknown as ICoreflowSecretRuntimeRegistrationExpectationV2,
+          expectationArg as unknown as ICoreflowSecretRuntimeRegistrationExpectation,
         )) {
       errors.push('secret runtime expectationDigest does not match');
     }
@@ -941,8 +896,7 @@ export const validateCoreflowSecretRuntimeRegistration = async (
     );
     if (errors.length > 0 || !isRuntimeRecord(expectationArg)) return errors;
     if (!isRuntimeRecord(registrationArg)
-      || !hasExactRuntimeKeys(registrationArg, [
-        'registrationVersion',
+      || !hasExactKeys(registrationArg, [
         'expectationDigest',
         'reporterSessionId',
         'registeredAt',
@@ -958,9 +912,6 @@ export const validateCoreflowSecretRuntimeRegistration = async (
       errors.push('secret runtime registration must use its exact schema');
       return errors;
     }
-    if (registrationArg.registrationVersion !== 2) {
-      errors.push('secret runtime registrationVersion must be 2');
-    }
     if (registrationArg.expectationDigest !== expectationArg.expectationDigest) {
       errors.push('secret runtime registration expectationDigest does not match');
     }
@@ -977,7 +928,7 @@ export const validateCoreflowSecretRuntimeRegistration = async (
       'registration targets',
     );
     errors.push(...registrationTargetErrors);
-    const targetAuthority = expectationArg.targetAuthority as unknown as IClusterRuntimeTargetSetReadyV1;
+    const targetAuthority = expectationArg.targetAuthority as unknown as IClusterRuntimeTargetSetReady;
     if (registrationArg.targetGeneration !== targetAuthority.generation
       || registrationArg.targetSetDigest !== targetAuthority.targetSetDigest) {
       errors.push('secret runtime registration target authority does not match');
@@ -997,24 +948,7 @@ export const validateCoreflowSecretRuntimeRegistration = async (
       registrationArg.workloadInitAuthority,
     );
     errors.push(...registrationAuthorityErrors);
-    if (!isRuntimeRecord(registrationArg.capabilities)
-      || !hasOnlyRuntimeKeys(registrationArg.capabilities, [
-        'immutableImageDeploymentVersion',
-        'corestoreInventoryVersion',
-        'secretManifestVersion',
-        'sealedSecretMaterialVersion',
-        'secretRecipientEnrollmentVersion',
-        'workloadInitEnvironmentVersion',
-        'secretDeploymentReportVersion',
-      ])
-      || registrationArg.capabilities.immutableImageDeploymentVersion !== 1
-      || registrationArg.capabilities.secretManifestVersion !== 2
-      || registrationArg.capabilities.sealedSecretMaterialVersion !== 1
-      || registrationArg.capabilities.secretRecipientEnrollmentVersion !== 1
-      || registrationArg.capabilities.workloadInitEnvironmentVersion !== 1
-      || registrationArg.capabilities.secretDeploymentReportVersion !== 1
-      || (registrationArg.capabilities.corestoreInventoryVersion !== undefined
-        && registrationArg.capabilities.corestoreInventoryVersion !== 1)) {
+    if (!isCoreflowRuntimeCapabilityList(registrationArg.capabilities)) {
       errors.push('secret runtime registration capabilities are incomplete or unsupported');
     }
     if (!Array.isArray(registrationArg.nodeEvidence)
@@ -1022,11 +956,11 @@ export const validateCoreflowSecretRuntimeRegistration = async (
       || registrationArg.nodeEvidence.length > maximumRuntimeNodes) {
       errors.push('secret runtime node evidence must be a non-empty bounded array');
     } else {
-      const evidenceTargets: ICoreflowSecretRuntimeNodeTargetV2[] = [];
-      const evidenceArtifacts: IWorkloadInitApprovedArtifactV1[] = [];
+      const evidenceTargets: ICoreflowSecretRuntimeNodeTarget[] = [];
+      const evidenceArtifacts: IWorkloadInitApprovedArtifact[] = [];
       for (const [index, evidenceArg] of registrationArg.nodeEvidence.entries()) {
         if (!isRuntimeRecord(evidenceArg)
-          || !hasExactRuntimeKeys(evidenceArg, [
+          || !hasExactKeys(evidenceArg, [
             'cloudlyNodeId',
             'swarmClusterId',
             'swarmNodeId',
@@ -1064,8 +998,8 @@ export const validateCoreflowSecretRuntimeRegistration = async (
       }
       const expectedArtifacts = new Map<
         TImmutableContainerPlatform,
-        IWorkloadInitApprovedArtifactV1
-      >(((expectationArg.workloadInitAuthority as unknown as IWorkloadInitActiveApprovalAuthorityV1)
+        IWorkloadInitApprovedArtifact
+      >(((expectationArg.workloadInitAuthority as unknown as IWorkloadInitActiveApprovalAuthority)
         .approval.artifacts)
         .map((artifactArg) => [artifactArg.platform, artifactArg]));
       for (const [index, artifactArg] of evidenceArtifacts.entries()) {
@@ -1083,16 +1017,14 @@ export const validateCoreflowSecretRuntimeRegistration = async (
       errors.push('secret runtime registration must exactly cover authoritative target nodes');
     }
     const workloadInitAuthority = expectationArg.workloadInitAuthority as
-      IWorkloadInitActiveApprovalAuthorityV1;
+      IWorkloadInitActiveApprovalAuthority;
     if (registrationArg.workloadInitImageIndexDigest
       !== workloadInitAuthority.approval.workloadInitImageIndexDigest) {
       errors.push('secret runtime WorkloadInit image index is not approved');
     }
     if (isRuntimeRecord(registrationArg.workloadInitAuthority)
       && (
-        registrationArg.workloadInitAuthority.authorityVersion
-          !== workloadInitAuthority.authorityVersion
-        || registrationArg.workloadInitAuthority.authorityGeneration
+        registrationArg.workloadInitAuthority.authorityGeneration
           !== workloadInitAuthority.authorityGeneration
         || registrationArg.workloadInitAuthority.approvalDigest
           !== workloadInitAuthority.approvalDigest
@@ -1113,8 +1045,7 @@ export const validateCoreflowSecretRuntimeRegistration = async (
   }
 };
 
-interface ISecretDeploymentReportBaseV1 {
-  schemaVersion: 1;
+interface ISecretDeploymentReportBase {
   reporterSessionId: string;
   reportSequence: number;
   serviceId: string;
@@ -1124,40 +1055,39 @@ interface ISecretDeploymentReportBaseV1 {
   reportDigest: TSha256Digest;
 }
 
-export interface ISecretDeploymentApplyingReportV1 extends ISecretDeploymentReportBaseV1 {
+export interface ISecretDeploymentApplyingReport extends ISecretDeploymentReportBase {
   status: 'applying';
 }
 
-export interface ISecretDeploymentAppliedReportV1 extends ISecretDeploymentReportBaseV1 {
+export interface ISecretDeploymentAppliedReport extends ISecretDeploymentReportBase {
   status: 'applied';
   appliedManifest: IResolvedSecretManifestReference;
 }
 
-export interface ISecretDeploymentDriftedReportV1 extends ISecretDeploymentReportBaseV1 {
+export interface ISecretDeploymentDriftedReport extends ISecretDeploymentReportBase {
   status: 'drifted';
   observedManifest?: IResolvedSecretManifestReference;
   failureCode: string;
 }
 
-export interface ISecretDeploymentFailedReportV1 extends ISecretDeploymentReportBaseV1 {
+export interface ISecretDeploymentFailedReport extends ISecretDeploymentReportBase {
   status: 'failed';
   failureCode: string;
 }
 
-export type TSecretDeploymentReportV1 =
-  | ISecretDeploymentApplyingReportV1
-  | ISecretDeploymentAppliedReportV1
-  | ISecretDeploymentDriftedReportV1
-  | ISecretDeploymentFailedReportV1;
+export type TSecretDeploymentReport =
+  | ISecretDeploymentApplyingReport
+  | ISecretDeploymentAppliedReport
+  | ISecretDeploymentDriftedReport
+  | ISecretDeploymentFailedReport;
 
-export type TSecretDeploymentReportWithoutDigestV1 =
-  | Omit<ISecretDeploymentApplyingReportV1, 'reportDigest'>
-  | Omit<ISecretDeploymentAppliedReportV1, 'reportDigest'>
-  | Omit<ISecretDeploymentDriftedReportV1, 'reportDigest'>
-  | Omit<ISecretDeploymentFailedReportV1, 'reportDigest'>;
+export type TSecretDeploymentReportWithoutDigest =
+  | Omit<ISecretDeploymentApplyingReport, 'reportDigest'>
+  | Omit<ISecretDeploymentAppliedReport, 'reportDigest'>
+  | Omit<ISecretDeploymentDriftedReport, 'reportDigest'>
+  | Omit<ISecretDeploymentFailedReport, 'reportDigest'>;
 
-export interface ISecretDeploymentReportResponseV1 {
-  schemaVersion: 1;
+export interface ISecretDeploymentReportResponse {
   acceptedSequence: number;
   planRevision: number;
   clusterState: IClusterSecretDeploymentState;
@@ -1169,10 +1099,10 @@ extends plugins.typedrequestInterfaces.implementsTR<
   IReq_ReportSecretDeploymentState
 > {
   method: 'reportSecretDeploymentState';
-  request: TSecretDeploymentReportV1 & {
+  request: TSecretDeploymentReport & {
     identity: IIdentityCredential;
   };
-  response: ISecretDeploymentReportResponseV1;
+  response: ISecretDeploymentReportResponse;
 }
 
 const canonicalManifestReference = (
@@ -1190,10 +1120,9 @@ const canonicalManifestReference = (
 });
 
 export const createSecretDeploymentReportDigestInput = (
-  reportArg: TSecretDeploymentReportWithoutDigestV1 | TSecretDeploymentReportV1,
+  reportArg: TSecretDeploymentReportWithoutDigest | TSecretDeploymentReport,
 ): string => {
   const common = {
-    schemaVersion: reportArg.schemaVersion,
     reporterSessionId: reportArg.reporterSessionId,
     reportSequence: reportArg.reportSequence,
     serviceId: reportArg.serviceId,
@@ -1229,7 +1158,7 @@ export const createSecretDeploymentReportDigestInput = (
 };
 
 export const computeSecretDeploymentReportDigest = async (
-  reportArg: TSecretDeploymentReportWithoutDigestV1 | TSecretDeploymentReportV1,
+  reportArg: TSecretDeploymentReportWithoutDigest | TSecretDeploymentReport,
 ): Promise<TSha256Digest> => computeRuntimeSha256(
   createSecretDeploymentReportDigestInput(reportArg),
 );
@@ -1244,7 +1173,7 @@ export const verifySecretDeploymentReportDigest = async (
       return false;
     }
     return reportArg.reportDigest === await computeSecretDeploymentReportDigest(
-      reportArg as unknown as TSecretDeploymentReportV1,
+      reportArg as unknown as TSecretDeploymentReport,
     );
   } catch {
     return false;
@@ -1273,7 +1202,6 @@ export const validateSecretDeploymentReportRequest = async (
     const status = requestArg.status;
     const commonKeys = [
       'identity',
-      'schemaVersion',
       'reporterSessionId',
       'reportSequence',
       'serviceId',
@@ -1294,18 +1222,15 @@ export const validateSecretDeploymentReportRequest = async (
           : commonKeys;
     const errors: string[] = [];
     if (!['applying', 'applied', 'drifted', 'failed'].includes(status as string)
-      || !hasExactRuntimeKeys(requestArg, expectedKeys)) {
+      || !hasExactKeys(requestArg, expectedKeys)) {
       errors.push('secret deployment report must use its exact status schema');
     }
     if (!isRuntimeRecord(requestArg.identity)
-      || !hasExactRuntimeKeys(requestArg.identity, ['jwt'])
+      || !hasExactKeys(requestArg.identity, ['jwt'])
       || typeof requestArg.identity.jwt !== 'string'
       || requestArg.identity.jwt.length === 0) {
       errors.push('secret deployment report requires a JWT identity');
     }
-    if (requestArg.schemaVersion !== 1) {
-      errors.push('secret deployment report schemaVersion must be 1');
-    }
     if (!isRuntimeIdentifier(requestArg.reporterSessionId)
       || !isRuntimeIdentifier(requestArg.serviceId)) {
       errors.push('secret deployment report identity fields must be canonical');