@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/data/coremail.runtime.ts

@@ -346,7 +346,7 @@ export const normalizeCoreMailCredentialVerifier = (
     /^\$argon2id\$v=19\$m=65536,t=3,p=1\$([A-Za-z0-9+/]+)\$([A-Za-z0-9+/]+)$/,
   );
   if (!match) {
-    return fail(`${pathArg}.verificationHash must use the canonical argon2id-v1 PHC form`);
+    return fail(`${pathArg}.verificationHash must use the canonical argon2id PHC form`);
   }
   const [, saltBase64, digestBase64] = match;
   decodeCanonicalBase64(
@@ -1585,7 +1585,6 @@ const normalizeBinding = (
     record,
     pathArg,
     [
-      'schemaVersion',
       'bindingId',
       'serviceId',
       'tenantId',
@@ -1599,9 +1598,6 @@ const normalizeBinding = (
     ],
     ['defaultSender'],
   );
-  if (record.schemaVersion !== 2) {
-    fail(`${pathArg}.schemaVersion must be 2`);
-  }
   const state = record.state === 'active'
     || record.state === 'draining'
     || record.state === 'disabled'
@@ -1628,7 +1624,6 @@ const normalizeBinding = (
   }
 
   const normalized: ICoreMailBindingDesiredState = {
-    schemaVersion: 2,
     bindingId: requireIdentifier(record.bindingId, `${pathArg}.bindingId`),
     serviceId: requireIdentifier(record.serviceId, `${pathArg}.serviceId`),
     tenantId: requireIdentifier(record.tenantId, `${pathArg}.tenantId`),
@@ -1771,12 +1766,9 @@ export const normalizeCoreMailDesiredState = (
   assertKeys(
     record,
     'desiredState',
-    ['schemaVersion', 'configEpoch', 'bindings', 'gateway', 'cursorKeys'],
+    ['configEpoch', 'bindings', 'gateway', 'cursorKeys'],
     ['smtp'],
   );
-  if (record.schemaVersion !== 2) {
-    fail('desiredState.schemaVersion must be 2');
-  }
   const bindings = readArray(
     record.bindings,
     'desiredState.bindings',
@@ -1804,7 +1796,6 @@ export const normalizeCoreMailDesiredState = (
     compareStrings(leftArg.bindingId, rightArg.bindingId),
   );
   const normalized: ICoreMailDesiredState = {
-    schemaVersion: 2,
     configEpoch: requireSafeInteger(record.configEpoch, 'desiredState.configEpoch', 1),
     bindings,
     gateway: normalizeGateway(record.gateway, 'desiredState.gateway'),
@@ -1999,13 +1990,9 @@ export const normalizeCoreMailControlBootstrap = (
   assertKeys(
     record,
     'controlBootstrap',
-    ['schemaVersion', 'coreMailServiceId', 'credentials'],
+    ['coreMailServiceId', 'credentials'],
   );
-  if (record.schemaVersion !== 1) {
-    fail('controlBootstrap.schemaVersion must be 1');
-  }
   return deepFreezeValue({
-    schemaVersion: 1,
     coreMailServiceId: requireIdentifier(
       record.coreMailServiceId,
       'controlBootstrap.coreMailServiceId',
@@ -2024,13 +2011,9 @@ export const normalizeCoreMailGatewayPeerDesiredState = (
   assertKeys(
     record,
     'gatewayPeer',
-    ['schemaVersion', 'coreMailServiceId', 'transferOrigin', 'credentials'],
+    ['coreMailServiceId', 'transferOrigin', 'credentials'],
   );
-  if (record.schemaVersion !== 1) {
-    fail('gatewayPeer.schemaVersion must be 1');
-  }
   return deepFreezeValue({
-    schemaVersion: 1,
     coreMailServiceId: requireIdentifier(
       record.coreMailServiceId,
       'gatewayPeer.coreMailServiceId',

package/ts/data/coremail.ts

@@ -12,7 +12,7 @@ export type TCoreMailSha256 = `sha256:${string}`;
 export type TCoreMailCapability = 'outbound' | 'inbound';
 export type TCoreMailBindingState = 'active' | 'draining' | 'disabled';
 export type TCoreMailCredentialState = 'current' | 'retiring';
-export type TCoreMailCredentialVerifierFormat = 'argon2id-v1';
+export type TCoreMailCredentialVerifierFormat = 'argon2id';
 export type TCoreMailPartKind = 'text' | 'html' | 'attachment';
 export type TCoreMailTransferMethod = 'PUT' | 'GET';
 export type TCoreMailSubmissionState =
@@ -195,7 +195,7 @@ export interface ICoreMailBindingCredentialVerifier {
   credentialId: string;
   version: number;
   state: TCoreMailCredentialState;
-  /** Versioned verifier contract. CoreMail currently accepts only argon2id-v1. */
+  /** The verifier contract this hash follows. CoreMail accepts only argon2id. */
   format: TCoreMailCredentialVerifierFormat;
   /** Password-verifier string only. Plaintext credential material is never part of desired state. */
   verificationHash: string;
@@ -203,7 +203,6 @@ export interface ICoreMailBindingCredentialVerifier {
 }
 
 export interface ICoreMailBindingDesiredState {
-  schemaVersion: 2;
   bindingId: string;
   serviceId: string;
   tenantId: string;
@@ -237,7 +236,6 @@ export interface ICoreMailGatewayDesiredState {
  * configuration; the matching plaintext is delivered only to Coreflow.
  */
 export interface ICoreMailControlBootstrap {
-  schemaVersion: 1;
   coreMailServiceId: string;
   credentials: ICoreMailBindingCredentialVerifier[];
 }
@@ -247,7 +245,6 @@ export interface ICoreMailControlBootstrap {
  * transferOrigin is authoritative control-plane data, never peer supplied.
  */
 export interface ICoreMailGatewayPeerDesiredState {
-  schemaVersion: 1;
   coreMailServiceId: string;
   transferOrigin: string;
   credentials: ICoreMailBindingCredentialVerifier[];
@@ -288,7 +285,6 @@ export interface ICoreMailSmtpDesiredState {
 }
 
 export interface ICoreMailDesiredState {
-  schemaVersion: 2;
   configEpoch: number;
   bindings: ICoreMailBindingDesiredState[];
   gateway: ICoreMailGatewayDesiredState;
@@ -486,7 +482,7 @@ export const coreMailTransferProtocol = Object.freeze({
 });
 
 export const coreMailCredentialVerifierPolicy = Object.freeze({
-  format: 'argon2id-v1' as const,
+  format: 'argon2id' as const,
   version: 19,
   memoryCost: 65_536,
   timeCost: 3,

package/ts/data/deploymentadoption.ts

@@ -12,12 +12,14 @@ import type {
   TSha256Digest,
 } from './immutableimage.js';
 import {
+  isCoreflowRuntimeCapabilityList,
   normalizeImmutableReleaseTag,
   normalizeSha256Digest,
   validateImageRolloutStatus,
   validateImmutableImageDeploymentPlan,
 } from './immutableimage.js';
 import type { IRegistryTarget } from './registry.js';
+import { hasExactKeys } from '../private/dataproperties.js';
 
 export type TServiceDeploymentAdoptionDecision = 'GO' | 'NO-GO';
 
@@ -115,7 +117,6 @@ export interface IServiceDeploymentAdoptionRolloutResult {
 }
 
 interface IServiceDeploymentAdoptionReportBase {
-  schemaVersion: 1;
   mutationPerformed: false;
   requestId: string;
   generatedAt: number;
@@ -202,7 +203,6 @@ export type TServiceDeploymentAdoptionRetentionPhase = 'prepare' | 'commit';
  * retained for the exact adoption plan without mutating the Docker service.
  */
 export interface IServiceDeploymentAdoptionRetentionAttestation {
-  schemaVersion: 1;
   phase: TServiceDeploymentAdoptionRetentionPhase;
   retainedWithoutMutation: true;
   serviceId: string;
@@ -213,12 +213,26 @@ export interface IServiceDeploymentAdoptionRetentionAttestation {
   attestedAt: number;
 }
 
+/** Every key a retention attestation carries; nothing else is admitted. */
+const retentionAttestationKeys = [
+  'phase',
+  'retainedWithoutMutation',
+  'serviceId',
+  'operationId',
+  'adoptionConfigurationDigest',
+  'immutableReport',
+  'deployments',
+  'attestedAt',
+] as const;
+
 export const validateServiceDeploymentAdoptionRetentionAttestation = (
   attestationArg: unknown,
 ): string[] => {
   if (!isRecord(attestationArg)) return ['retention attestation must be an object'];
   const errors: string[] = [];
-  if (attestationArg.schemaVersion !== 1) errors.push('retention attestation schemaVersion must be 1');
+  if (!hasExactKeys(attestationArg, retentionAttestationKeys)) {
+    errors.push('retention attestation must use its exact schema');
+  }
   if (attestationArg.phase !== 'prepare' && attestationArg.phase !== 'commit') {
     errors.push('retention attestation phase is invalid');
   }
@@ -237,6 +251,10 @@ export const validateServiceDeploymentAdoptionRetentionAttestation = (
   }
   if (!isRecord(attestationArg.immutableReport)) {
     errors.push('retention attestation requires an immutable report envelope');
+  } else if (!isCoreflowRuntimeCapabilityList(attestationArg.immutableReport.reporterCapabilities)) {
+    // The envelope states what the reporter can do; a list that is not canonical cannot be
+    // compared against the one its registration stated, so the attestation is refused here.
+    errors.push('retention attestation reporter capabilities must be a canonical capability list');
   }
   if (!Array.isArray(attestationArg.deployments) || attestationArg.deployments.length < 1) {
     errors.push('retention attestation requires at least one deployment');
@@ -500,10 +518,34 @@ export const validateServiceDeploymentAdoptionRolloutResult = (
   return errors;
 };
 
+/** Every key an adoption report carries, whatever it decided. */
+const reportKeys = [
+  'mutationPerformed',
+  'requestId',
+  'generatedAt',
+  'runtimeAttestation',
+  'decision',
+  'registry',
+  'runtimeTasks',
+  'blockers',
+] as const;
+
+/** A GO report also states the scope it adopts into and the digest it adopted. */
+const goReportKeys = [...reportKeys, 'service', 'targetScope', 'adoptionDigest'] as const;
+
+/** A NO-GO report may have stopped before it read the service or resolved a scope. */
+const noGoReportOptionalKeys = ['service', 'targetScope'] as const;
+
 export const validateServiceDeploymentAdoptionReport = (reportArg: unknown): string[] => {
   if (!isRecord(reportArg)) return ['adoption report must be an object'];
   const errors: string[] = [];
-  if (reportArg.schemaVersion !== 1) errors.push('schemaVersion must be 1');
+  if (!hasExactKeys(
+    reportArg,
+    reportArg.decision === 'GO' ? goReportKeys : reportKeys,
+    reportArg.decision === 'GO' ? [] : noGoReportOptionalKeys,
+  )) {
+    errors.push('adoption report must use its exact decision schema');
+  }
   if (reportArg.mutationPerformed !== false) {
     errors.push('adoption preflight must be mutation-free');
   }

package/ts/data/deploymentoperation.ts

@@ -3,6 +3,7 @@ import type { IGatewayRouteDnsResult } from './gateway.js';
 import type { IImageRolloutStatus, IImmutableImageDeploymentPlan, TSha256Digest } from './immutableimage.js';
 import { normalizeImmutableReleaseTag, normalizeSha256Digest } from './immutableimage.js';
 import type { IRegistryTarget } from './registry.js';
+import { hasExactKeys } from '../private/dataproperties.js';
 import { normalizeServiceAbsolutePath, validateServiceContainerArgs } from './service.js';
 import type { TServiceTargetPortRef } from './serviceports.js';
 
@@ -148,12 +149,26 @@ const validateStringArray = (
     && validatorArg(itemArg))
   && new Set(valueArg).size === valueArg.length;
 
+/** Every key a proposed configuration carries; `containerArgs` is the one a template may omit. */
+const proposedConfigurationKeys = [
+  'declarationComplete',
+  'projectName',
+  'targetPlatforms',
+  'publicDomains',
+  'environmentVariableNames',
+  'containerPorts',
+  'volumeMounts',
+  'requiredCapabilities',
+] as const;
+
 export const validateDeploymentProposedConfiguration = (
   configurationArg: unknown,
 ): string[] => {
   if (!isRecord(configurationArg)) return ['proposedConfiguration must be an object'];
   const errors: string[] = [];
-  if (configurationArg.schemaVersion !== 1) errors.push('schemaVersion must be 1');
+  if (!hasExactKeys(configurationArg, proposedConfigurationKeys, ['containerArgs'])) {
+    errors.push('proposedConfiguration must use its exact schema');
+  }
   if (typeof configurationArg.declarationComplete !== 'boolean') {
     errors.push('declarationComplete must be boolean');
   }

package/ts/data/deploymentpreflight.ts

@@ -142,7 +142,6 @@ export interface IDeploymentPreflightProposedVolumeMount {
  * cluster names through this contract.
  */
 export interface IDeploymentPreflightProposedConfiguration {
-  schemaVersion: 1;
   declarationComplete: boolean;
   projectName: string;
   targetPlatforms: TImmutableContainerPlatform[];
@@ -194,7 +193,6 @@ export interface IDeploymentPreflightRequestData {
 }
 
 export interface IDeploymentPreflightReport {
-  schemaVersion: 2;
   decision: TDeploymentPreflightDecision;
   mutationPerformed: false;
   generatedAt: number;

package/ts/data/immutableimage.ts

@@ -1,3 +1,5 @@
+import { isCanonicalTokenList } from '../private/tokenlist.js';
+
 /** Canonical lower-case OCI sha256 digest. */
 export type TSha256Digest = `sha256:${string}`;
 
@@ -62,22 +64,70 @@ export type TImmutableImageRolloutStatus =
   | 'rolling-back'
   | 'rolled-back';
 
-export interface ICoreflowRuntimeCapabilities {
-  immutableImageDeploymentVersion: 1;
-  /** Coreflow can answer the versioned, node-scoped Corestore inventory probe. */
-  corestoreInventoryVersion?: 1;
-  /** Coreflow can consume exact, cluster-scoped resolved secret manifests. */
-  secretManifestVersion: 2;
-  sealedSecretMaterialVersion: 1;
-  secretRecipientEnrollmentVersion: 1;
-  workloadInitEnvironmentVersion: 1;
-  /** Coreflow can submit replay-safe schema-v1 secret deployment reports. */
-  secretDeploymentReportVersion?: 1;
-}
+/**
+ * What a Coreflow build can do, named one capability at a time.
+ *
+ * A capability used to be advertised as the shape version the build spoke, which said two things
+ * at once: that the contract existed and which of its shapes was meant. The contract version is
+ * the interfaces version both peers exchange, so what is left to state is the capability itself.
+ */
+export const coreflowRuntimeCapabilities = Object.freeze([
+  /** Answers the node-scoped Corestore inventory probe. */
+  'corestore-inventory',
+  /** Deploys an image by its immutable digest and reports the rollout. */
+  'immutable-image-deployment',
+  /** Opens sealed secret material addressed to its recipient key. */
+  'sealed-secret-material',
+  /** Submits replay-safe secret deployment reports. */
+  'secret-deployment-report',
+  /** Consumes exact, cluster-scoped resolved secret manifests. */
+  'secret-manifest',
+  /** Enrolls as a secret recipient and answers the enrollment challenge. */
+  'secret-recipient-enrollment',
+  /** Writes the WorkloadInit environment map and launches through the wrapper. */
+  'workload-init-environment',
+] as const);
+
+/** One capability a Coreflow build states in its secret-runtime registration. */
+export type TCoreflowRuntimeCapability = typeof coreflowRuntimeCapabilities[number];
+
+/**
+ * The capabilities a build may legitimately lack.
+ *
+ * `corestore-inventory` depends on the node's Corestore deployment rather than on the contracts
+ * the build was compiled against, so a build without one still registers.
+ */
+export const optionalCoreflowRuntimeCapabilities = Object.freeze(
+  ['corestore-inventory'] as const satisfies readonly TCoreflowRuntimeCapability[],
+);
+
+/**
+ * The capabilities every build of this major has, so a registration that omits one is refused.
+ *
+ * Filtered out of the vocabulary rather than listed again: a capability added to the vocabulary is
+ * required from that moment unless it is named optional, which is the decision worth stating.
+ */
+export const requiredCoreflowRuntimeCapabilities: readonly TCoreflowRuntimeCapability[] =
+  Object.freeze(coreflowRuntimeCapabilities.filter((capabilityArg) => (
+    !optionalCoreflowRuntimeCapabilities.some((optionalArg) => optionalArg === capabilityArg)
+  )));
+
+/**
+ * True when a value is exactly a canonical capability list that carries every capability this
+ * major requires — the canonical-list rule plus this contract's own coverage clause.
+ */
+export const isCoreflowRuntimeCapabilityList = (
+  valueArg: unknown,
+): valueArg is TCoreflowRuntimeCapability[] => (
+  isCanonicalTokenList(valueArg, coreflowRuntimeCapabilities)
+  && requiredCoreflowRuntimeCapabilities.every(
+    (capabilityArg) => valueArg.some((entryArg) => entryArg === capabilityArg),
+  )
+);
 
 export type TImmutableContainerPlatform = 'linux/amd64' | 'linux/arm64';
 
-export interface IImmutableContainerInvocationPlatformEvidenceV1 {
+export interface IImmutableContainerInvocationPlatformEvidence {
   platform: TImmutableContainerPlatform;
   platformManifestDigest: TSha256Digest;
   imageConfigDigest: TSha256Digest;
@@ -85,14 +135,13 @@ export interface IImmutableContainerInvocationPlatformEvidenceV1 {
   effectiveArgv: string[];
 }
 
-export interface IImmutableContainerInvocationV1 {
-  schemaVersion: 1;
+export interface IImmutableContainerInvocation {
   /** Sorted, unique, non-empty and limited to the authoritative platform union. */
   targetPlatforms: TImmutableContainerPlatform[];
   /** The one effective argv shared by every target platform. */
   argv: string[];
   /** Sorted exact one-to-one platform evidence. */
-  evidence: IImmutableContainerInvocationPlatformEvidenceV1[];
+  evidence: IImmutableContainerInvocationPlatformEvidence[];
   digest: TSha256Digest;
 }
 
@@ -248,7 +297,7 @@ export interface IImmutableImageDeploymentPlan {
   digestPinnedImageReference: string;
   manifestMediaType: TOciManifestMediaType;
   /** Mandatory immutable command/config evidence for every target platform. */
-  containerInvocation: IImmutableContainerInvocationV1;
+  containerInvocation: IImmutableContainerInvocation;
   createdAt: number;
   mode: TImmutableImageRolloutMode;
   /** Full pre-adoption service configuration fence, required only for adoption. */
@@ -313,7 +362,8 @@ export interface IImmutableRolloutReportEnvelope {
   rolloutGeneration: number;
   reporterSessionId: string;
   reportSequence: number;
-  reporterCapabilities: ICoreflowRuntimeCapabilities;
+  /** Sorted and duplicate-free; every required capability of this major is present. */
+  reporterCapabilities: TCoreflowRuntimeCapability[];
   reporterNodeIds: string[];
   reporterNodeNames: string[];
 }
@@ -368,9 +418,8 @@ const validateImmutableArgv = (argvArg: unknown): argvArg is string[] => (
 );
 
 export const createImmutableContainerInvocationDigestInput = (
-  invocationArg: Omit<IImmutableContainerInvocationV1, 'digest'> | IImmutableContainerInvocationV1,
+  invocationArg: Omit<IImmutableContainerInvocation, 'digest'> | IImmutableContainerInvocation,
 ): string => JSON.stringify({
-  schemaVersion: invocationArg.schemaVersion,
   targetPlatforms: invocationArg.targetPlatforms,
   argv: invocationArg.argv,
   evidence: invocationArg.evidence.map((entryArg) => ({
@@ -382,7 +431,7 @@ export const createImmutableContainerInvocationDigestInput = (
 });
 
 export const computeImmutableContainerInvocationDigest = async (
-  invocationArg: Omit<IImmutableContainerInvocationV1, 'digest'> | IImmutableContainerInvocationV1,
+  invocationArg: Omit<IImmutableContainerInvocation, 'digest'> | IImmutableContainerInvocation,
 ): Promise<TSha256Digest> => {
   const input = new TextEncoder().encode(createImmutableContainerInvocationDigestInput(invocationArg));
   const digest = new Uint8Array(await globalThis.crypto.subtle.digest(
@@ -395,7 +444,7 @@ export const computeImmutableContainerInvocationDigest = async (
 };
 
 export const verifyImmutableContainerInvocationDigest = async (
-  invocationArg: IImmutableContainerInvocationV1,
+  invocationArg: IImmutableContainerInvocation,
 ): Promise<boolean> => invocationArg.digest
   === await computeImmutableContainerInvocationDigest(invocationArg);
 
@@ -411,12 +460,10 @@ export const validateImmutableContainerInvocation = (
     'argv',
     'digest',
     'evidence',
-    'schemaVersion',
     'targetPlatforms',
   ])) {
     errors.push('containerInvocation must use its exact schema');
   }
-  if (invocation.schemaVersion !== 1) errors.push('containerInvocation schemaVersion must be 1');
   const platforms = Array.isArray(invocation.targetPlatforms)
     ? invocation.targetPlatforms
     : [];

package/ts/data/index.ts

@@ -32,7 +32,7 @@ export * from './networkdelivery.js';
 export * from './networklease.js';
 export * from './networknode.js';
 export * from './networkprojection.js';
-export type { IRuntimeNetworkRouterPacketGrantV1, IRuntimeNetworkRouterProjectionV1 } from './networkrouter.js';
+export type { IRuntimeNetworkRouterPacketGrant, IRuntimeNetworkRouterProjection } from './networkrouter.js';
 export * from './networkprotection.js';
 export * from './networksigning.js';
 export * from './privatenetwork.js';

package/ts/data/isolatedrestore.golden.ts

@@ -29,7 +29,6 @@ const deepFreezeVector = <T>(valueArg: T): T => {
  * quote, and a backslash. Consumers compare both JSON and SHA-256 verbatim.
  */
 export const isolatedRestoreCanonicalDigestGoldenVectors: {
-  version: 1;
   resourceMappings: IIsolatedRestoreCanonicalDigestGoldenVector<
     TIsolatedRestoreResourceMapping[]
   >;
@@ -40,7 +39,6 @@ export const isolatedRestoreCanonicalDigestGoldenVectors: {
     IIsolatedRestoreGrantClaims
   >;
 } = deepFreezeVector({
-  version: 1,
   resourceMappings: {
     input: [
       {
@@ -91,7 +89,6 @@ export const isolatedRestoreCanonicalDigestGoldenVectors: {
   },
   archiveManifest: {
     input: {
-      version: 1,
       backupId: 'backup-0001',
       createdAt: 1700000000123,
       objects: [
@@ -122,12 +119,11 @@ export const isolatedRestoreCanonicalDigestGoldenVectors: {
       '{"backupId":"backup-0001","createdAt":1700000000123,"objects":[{"path":"config.json","sha256":"0000000000000000000000000000000000000000000000000000000000000000","size":2},' +
       '{"path":"snapshots/snapshot-volume.json","sha256":"ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff","size":3},' +
       '{"path":"snapshots/snapshot-database.json","sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":5},' +
-      '{"path":"snapshots/snapshot-objectstorage.json","sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":7}],"totalSize":17,"version":1}',
-    sha256: 'cd688de1a4b7e0f0b185c660a2c0c199ea4009832c5614a49e8a4dec411f3bd4',
+      '{"path":"snapshots/snapshot-objectstorage.json","sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":7}],"totalSize":17}',
+    sha256: '5063bbb4e967fc01023fe498274039395bfb3dc82f85a35acd6cda64ac723cb9',
   },
   grantClaims: {
     input: {
-      grantVersion: 1,
       iss: 'urn:foss:restore:😀:é:é:"quoted":\\backslash',
       aud: 'corestore.restore',
       sub: 'cloudly-control',
@@ -143,15 +139,15 @@ export const isolatedRestoreCanonicalDigestGoldenVectors: {
       stagingArchiveId: 'archive-0001',
       operation: 'prepare',
       resourceMappingsSha256: '3c084580fc258dcb5dc25b80d7331eb1d9072a124f640df3ce26eba4917afe70',
-      archiveManifestSha256: 'cd688de1a4b7e0f0b185c660a2c0c199ea4009832c5614a49e8a4dec411f3bd4',
+      archiveManifestSha256: '5063bbb4e967fc01023fe498274039395bfb3dc82f85a35acd6cda64ac723cb9',
       iat: 2_000_000_000,
       nbf: 2_000_000_000,
       exp: 2_000_000_120,
     },
     canonicalJson:
-      '{"archiveManifestSha256":"cd688de1a4b7e0f0b185c660a2c0c199ea4009832c5614a49e8a4dec411f3bd4","aud":"corestore.restore","authorizationId":"authorization-0001","clusterId":"cluster-eu-1","exp":2000000120,"grantVersion":1,"iat":2000000000,' +
+      '{"archiveManifestSha256":"5063bbb4e967fc01023fe498274039395bfb3dc82f85a35acd6cda64ac723cb9","aud":"corestore.restore","authorizationId":"authorization-0001","clusterId":"cluster-eu-1","exp":2000000120,"iat":2000000000,' +
       '"iss":"urn:foss:restore:😀:é:é:\\"quoted\\":\\\\backslash","jti":"grant-0001","nbf":2000000000,"operation":"prepare","resourceMappingsSha256":"3c084580fc258dcb5dc25b80d7331eb1d9072a124f640df3ce26eba4917afe70",' +
       '"restoreId":"restore-0001","scratchNamespaceId":"scratch-0001","sourceBackupId":"backup-0001","sourceServiceId":"service-source","stagingArchiveId":"archive-0001","sub":"cloudly-control","targetNodeName":"node-1","tenantId":"tenant-0001"}',
-    sha256: '6fcc94b4c6498b9fa45ec41de197999bbb38b9f8437a9c41f9c9478bdf3af8bf',
+    sha256: '7346ba0b19a66535183c7afa6cb1f76236fd0c7f9f678a1695cca9874f8f3743',
   },
 });