@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/data/networkprotection.ts

@@ -1,12 +1,12 @@
 import { isPlausibleUnicastIpv4 } from '../private/ipv4.js';
 import type { TSha256Digest } from './immutableimage.js';
-import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
-import type { IRuntimeNetworkNodeScopeV1 } from './networkprojection.js';
-import { snapshotRuntimeNetworkNodeScopeV1 } from './networkprojection.js';
-import type { IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
-import { computeRuntimeNetworkProtectedAuthorityV1Digest, snapshotRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
-import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
-import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeNetworkNodeScope } from './networkprojection.js';
+import { snapshotRuntimeNetworkNodeScope } from './networkprojection.js';
+import type { IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import { computeRuntimeNetworkProtectedAuthorityDigest, snapshotRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import type { IRuntimeSessionBinding } from './runtimesession.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
 import { captureNetwork, failNetwork, networkCanonical, networkDigest, networkEqual, networkHash,
   networkId, networkList, networkRecord, networkReference, networkReferenceOf, networkRevision,
   networkSafe, networkSorted, requireNetwork } from '../private/networkcontract.js';
@@ -18,21 +18,20 @@ import { captureNetwork, failNetwork, networkCanonical, networkDigest, networkEq
  * a single table inspection, a boot event or a caller-selected success flag.
  * A null nativeBarrier explicitly withdraws this node's allocation eligibility.
  */
-export interface IRuntimeNetworkProtectionReceiptV1 extends IRuntimeNetworkNodeScopeV1 {
-  schemaVersion: 1;
+export interface IRuntimeNetworkProtectionReceipt extends IRuntimeNetworkNodeScope {
   id: string;
   generation: number;
-  previous: IRuntimeAuthorityReferenceV1 | null;
-  protectedAuthority: IRuntimeAuthorityReferenceV1;
+  previous: IRuntimeAuthorityReference | null;
+  protectedAuthority: IRuntimeAuthorityReference;
   reporterSessionId: string;
   bootId: string;
-  nativeBarrier: IRuntimeAuthorityReferenceV1 | null;
+  nativeBarrier: IRuntimeAuthorityReference | null;
   digest: TSha256Digest;
 }
 
-export interface IReportRuntimeNetworkProtectionRequestV1 {
-  session: IRuntimeSessionBindingV1;
-  receipt: IRuntimeNetworkProtectionReceiptV1;
+export interface IReportRuntimeNetworkProtectionRequest {
+  session: IRuntimeSessionBinding;
+  receipt: IRuntimeNetworkProtectionReceipt;
   /**
    * The address this node answers on, as the node itself observed it.
    *
@@ -44,14 +43,14 @@ export interface IReportRuntimeNetworkProtectionRequestV1 {
    */
   uplinkAddress?: string;
 }
-export interface IReportRuntimeNetworkProtectionResponseV1 {
+export interface IReportRuntimeNetworkProtectionResponse {
   status: 'accepted' | 'replay';
-  receipt: IRuntimeAuthorityReferenceV1;
+  receipt: IRuntimeAuthorityReference;
   authorityUse: 'current' | 'historical';
 }
 
-export const runtimeNetworkProtectionV1Contract = Object.freeze({
-  digestDomain: 'serve.zone/runtime-network-protection-receipt-v1',
+export const runtimeNetworkProtectionContract = Object.freeze({
+  digestDomain: 'serve.zone/runtime-network-protection-receipt',
   maximumAuthorities: 256,
   allocation: 'all-current-affected-egress-receipts-before-reserving-any-lease',
   receiptSource: 'joined-complete-native-protection-journal',
@@ -60,45 +59,45 @@ export const runtimeNetworkProtectionV1Contract = Object.freeze({
   quarantine: 'no-release-authority',
 } as const);
 
-const scopeOf = (value: IRuntimeNetworkNodeScopeV1): IRuntimeNetworkNodeScopeV1 =>
+const scopeOf = (value: IRuntimeNetworkNodeScope): IRuntimeNetworkNodeScope =>
   ({ controller: value.controller, nodeId: value.nodeId, runtimeNamespace: value.runtimeNamespace });
 const scopeKey = (value: { nodeId: string; runtimeNamespace: string }): string =>
   networkCanonical([value.nodeId, value.runtimeNamespace]);
 
-export const snapshotRuntimeNetworkProtectionReceiptV1 = (value: unknown): IRuntimeNetworkProtectionReceiptV1 => networkSafe(() => {
-  const item = networkRecord(captureNetwork(value), ['schemaVersion', 'id', 'generation', 'previous',
+export const snapshotRuntimeNetworkProtectionReceipt = (value: unknown): IRuntimeNetworkProtectionReceipt => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['id', 'generation', 'previous',
     'controller', 'nodeId', 'runtimeNamespace', 'protectedAuthority', 'reporterSessionId', 'bootId', 'nativeBarrier', 'digest']);
-  requireNetwork(item.schemaVersion === 1 && typeof item.bootId === 'string'
+  requireNetwork(typeof item.bootId === 'string'
     && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(item.bootId)
     && item.bootId !== '00000000-0000-0000-0000-000000000000');
-  const scope = snapshotRuntimeNetworkNodeScopeV1({ controller: item.controller, nodeId: item.nodeId, runtimeNamespace: item.runtimeNamespace });
-  return { schemaVersion: 1, ...networkRevision(item), ...scope,
+  const scope = snapshotRuntimeNetworkNodeScope({ controller: item.controller, nodeId: item.nodeId, runtimeNamespace: item.runtimeNamespace });
+  return { ...networkRevision(item), ...scope,
     protectedAuthority: networkReference(item.protectedAuthority), reporterSessionId: networkId(item.reporterSessionId),
     bootId: item.bootId, nativeBarrier: item.nativeBarrier === null ? null : networkReference(item.nativeBarrier),
     digest: networkDigest(item.digest) };
 });
 
-export const computeRuntimeNetworkProtectionReceiptV1Digest = (value: IRuntimeNetworkProtectionReceiptV1): Promise<TSha256Digest> =>
-  networkHash(runtimeNetworkProtectionV1Contract.digestDomain, snapshotRuntimeNetworkProtectionReceiptV1(value));
+export const computeRuntimeNetworkProtectionReceiptDigest = (value: IRuntimeNetworkProtectionReceipt): Promise<TSha256Digest> =>
+  networkHash(runtimeNetworkProtectionContract.digestDomain, snapshotRuntimeNetworkProtectionReceipt(value));
 
 /** Pure revision binding. The owner must authenticate the reporter and fence all DB writes. */
-export const admitRuntimeNetworkProtectionReceiptV1 = async (
+export const admitRuntimeNetworkProtectionReceipt = async (
   value: unknown, previousValue: unknown | null, trustedScopeValue: unknown, knownProtectionValue: unknown,
-): Promise<{ status: 'accepted' | 'replay'; receipt: IRuntimeNetworkProtectionReceiptV1 }> => {
+): Promise<{ status: 'accepted' | 'replay'; receipt: IRuntimeNetworkProtectionReceipt }> => {
   try {
-    const receipt = snapshotRuntimeNetworkProtectionReceiptV1(value);
-    const previous = previousValue === null ? null : snapshotRuntimeNetworkProtectionReceiptV1(previousValue);
-    const scope = snapshotRuntimeNetworkNodeScopeV1(captureNetwork(trustedScopeValue));
-    const protection = snapshotRuntimeNetworkProtectedAuthorityV1(captureNetwork(knownProtectionValue));
+    const receipt = snapshotRuntimeNetworkProtectionReceipt(value);
+    const previous = previousValue === null ? null : snapshotRuntimeNetworkProtectionReceipt(previousValue);
+    const scope = snapshotRuntimeNetworkNodeScope(captureNetwork(trustedScopeValue));
+    const protection = snapshotRuntimeNetworkProtectedAuthority(captureNetwork(knownProtectionValue));
     requireNetwork(networkEqual(scopeOf(receipt), scope) && networkEqual(receipt.controller, protection.controller)
       && networkEqual(receipt.protectedAuthority, networkReferenceOf(protection))
       && protection.egressAuthorities.some(owner => scopeKey(owner) === scopeKey(receipt)));
-    requireNetwork(receipt.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(receipt)
-      && protection.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(protection));
+    requireNetwork(receipt.digest === await computeRuntimeNetworkProtectionReceiptDigest(receipt)
+      && protection.digest === await computeRuntimeNetworkProtectedAuthorityDigest(protection));
     if (!previous) requireNetwork(receipt.generation === 1 && receipt.previous === null);
     else {
       requireNetwork(networkEqual(scopeOf(previous), scope)
-        && previous.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(previous));
+        && previous.digest === await computeRuntimeNetworkProtectionReceiptDigest(previous));
       if (networkEqual(receipt, previous)) return { status: 'replay', receipt };
       requireNetwork(receipt.id === previous.id && receipt.generation === previous.generation + 1
         && networkEqual(receipt.previous, networkReferenceOf(previous))
@@ -123,11 +122,11 @@ export const admitRuntimeNetworkProtectionReceiptV1 = async (
   } catch { return failNetwork(); }
 };
 
-export const snapshotReportRuntimeNetworkProtectionRequestV1 = (value: unknown): IReportRuntimeNetworkProtectionRequestV1 => networkSafe(() => {
+export const snapshotReportRuntimeNetworkProtectionRequest = (value: unknown): IReportRuntimeNetworkProtectionRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'receipt'], ['uplinkAddress']);
-  const request: IReportRuntimeNetworkProtectionRequestV1 = {
-    session: snapshotRuntimeSessionBindingV1(item.session),
-    receipt: snapshotRuntimeNetworkProtectionReceiptV1(item.receipt),
+  const request: IReportRuntimeNetworkProtectionRequest = {
+    session: snapshotRuntimeSessionBinding(item.session),
+    receipt: snapshotRuntimeNetworkProtectionReceipt(item.receipt),
   };
   if (Object.hasOwn(item, 'uplinkAddress')) {
     request.uplinkAddress = runtimeNodeUplinkAddress(item.uplinkAddress);
@@ -150,12 +149,12 @@ export const runtimeNodeUplinkAddress = (value: unknown): string => {
 };
 
 /** Both trusted bindings come from the receiver's fenced physical-session/history owner. */
-export const bindReportRuntimeNetworkProtectionRequestV1 = (
+export const bindReportRuntimeNetworkProtectionRequest = (
   value: unknown, trustedCurrentSessionValue: unknown, trustedReporterSessionValue: unknown,
-): { request: IReportRuntimeNetworkProtectionRequestV1; authorityUse: 'current' | 'historical' } => networkSafe(() => {
-  const request = snapshotReportRuntimeNetworkProtectionRequestV1(value);
-  const current = snapshotRuntimeSessionBindingV1(captureNetwork(trustedCurrentSessionValue));
-  const reporter = snapshotRuntimeSessionBindingV1(captureNetwork(trustedReporterSessionValue));
+): { request: IReportRuntimeNetworkProtectionRequest; authorityUse: 'current' | 'historical' } => networkSafe(() => {
+  const request = snapshotReportRuntimeNetworkProtectionRequest(value);
+  const current = snapshotRuntimeSessionBinding(captureNetwork(trustedCurrentSessionValue));
+  const reporter = snapshotRuntimeSessionBinding(captureNetwork(trustedReporterSessionValue));
   requireNetwork(networkEqual(request.session, current) && networkEqual(scopeOf(request.receipt), scopeOf(current))
     && networkEqual(scopeOf(reporter), scopeOf(current)) && reporter.reporterSessionId === request.receipt.reporterSessionId);
   const authorityUse = reporter.reporterSessionId === current.reporterSessionId ? 'current' : 'historical';
@@ -164,15 +163,15 @@ export const bindReportRuntimeNetworkProtectionRequestV1 = (
   return { request, authorityUse };
 });
 
-export const snapshotReportRuntimeNetworkProtectionResponseV1 = (value: unknown): IReportRuntimeNetworkProtectionResponseV1 => networkSafe(() => {
+export const snapshotReportRuntimeNetworkProtectionResponse = (value: unknown): IReportRuntimeNetworkProtectionResponse => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['status', 'receipt', 'authorityUse']);
   requireNetwork((item.status === 'accepted' || item.status === 'replay')
     && (item.authorityUse === 'current' || item.authorityUse === 'historical'));
   return { status: item.status, receipt: networkReference(item.receipt), authorityUse: item.authorityUse };
 });
 
-export const bindReportRuntimeNetworkProtectionResponseV1 = (value: unknown, sentReceiptValue: unknown): IReportRuntimeNetworkProtectionResponseV1 => networkSafe(() => {
-  const response = snapshotReportRuntimeNetworkProtectionResponseV1(value);
+export const bindReportRuntimeNetworkProtectionResponse = (value: unknown, sentReceiptValue: unknown): IReportRuntimeNetworkProtectionResponse => networkSafe(() => {
+  const response = snapshotReportRuntimeNetworkProtectionResponse(value);
   requireNetwork(networkEqual(response.receipt, networkReference(captureNetwork(sentReceiptValue))));
   return response;
 });
@@ -185,14 +184,14 @@ export const bindReportRuntimeNetworkProtectionResponseV1 = (value: unknown, sen
  * cannot be omitted. Independent fences need their own verified owning contract;
  * this helper supplies no generic override, expiry or quorum escape hatch.
  */
-export const bindRuntimeNetworkAllocationProtectionV1 = async (
+export const bindRuntimeNetworkAllocationProtection = async (
   protectionValue: unknown, receiptsValue: unknown, currentSessionsValue: unknown,
-): Promise<{ protection: IRuntimeNetworkProtectedAuthorityV1; receipts: IRuntimeNetworkProtectionReceiptV1[] }> => {
+): Promise<{ protection: IRuntimeNetworkProtectedAuthority; receipts: IRuntimeNetworkProtectionReceipt[] }> => {
   try {
-    const protection = snapshotRuntimeNetworkProtectedAuthorityV1(captureNetwork(protectionValue));
-    const receipts = networkSorted(networkList(captureNetwork(receiptsValue), 256, snapshotRuntimeNetworkProtectionReceiptV1), scopeKey);
-    const sessions = networkSorted(networkList(captureNetwork(currentSessionsValue), 256, snapshotRuntimeSessionBindingV1), scopeKey);
-    requireNetwork(protection.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(protection)
+    const protection = snapshotRuntimeNetworkProtectedAuthority(captureNetwork(protectionValue));
+    const receipts = networkSorted(networkList(captureNetwork(receiptsValue), 256, snapshotRuntimeNetworkProtectionReceipt), scopeKey);
+    const sessions = networkSorted(networkList(captureNetwork(currentSessionsValue), 256, snapshotRuntimeSessionBinding), scopeKey);
+    requireNetwork(protection.digest === await computeRuntimeNetworkProtectedAuthorityDigest(protection)
       && receipts.length === protection.egressAuthorities.length && sessions.length === receipts.length);
     for (const [index, owner] of protection.egressAuthorities.entries()) {
       const receipt = receipts[index], session = sessions[index];
@@ -200,7 +199,7 @@ export const bindRuntimeNetworkAllocationProtectionV1 = async (
         && networkEqual(receipt.controller, protection.controller) && networkEqual(session.controller, protection.controller)
         && receipt.reporterSessionId === session.reporterSessionId && receipt.nativeBarrier !== null
         && networkEqual(receipt.protectedAuthority, networkReferenceOf(protection))
-        && receipt.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(receipt));
+        && receipt.digest === await computeRuntimeNetworkProtectionReceiptDigest(receipt));
     }
     return { protection, receipts };
   } catch { return failNetwork(); }

package/ts/data/networkrouter.ts

@@ -1,23 +1,23 @@
-import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
-import type { IRuntimeNetworkHandoffLeaseV1, IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeNetworkHandoffLease, IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
 import { networkCanonical, networkCounter, networkId, networkIpv4, networkList,
   networkRecord, networkReference, networkReferenceOf, networkSorted, requireNetwork } from '../private/networkcontract.js';
 
 /** Exact router-origin flow authority; unrelated to workload connectivity or DNS names. */
-export interface IRuntimeNetworkRouterPacketGrantV1 {
-  source: { handoff: IRuntimeAuthorityReferenceV1; address: string };
+export interface IRuntimeNetworkRouterPacketGrant {
+  source: { handoff: IRuntimeAuthorityReference; address: string };
   destination: { kind: 'resolver' | 'platform'; id: string; address: string; protocol: 'tcp' | 'udp'; port: number };
 }
 
 /** Explicit selections from the current protected inventory plus retained denials. */
-export interface IRuntimeNetworkRouterProjectionV1 {
+export interface IRuntimeNetworkRouterProjection {
   /** Each selected resolver authorizes its exact TCP and UDP endpoint. */
   resolverIds: string[];
   platformEndpointIds: string[];
-  withdrawals: IRuntimeNetworkRouterPacketGrantV1[];
+  withdrawals: IRuntimeNetworkRouterPacketGrant[];
 }
 
-const grant = (value: unknown): IRuntimeNetworkRouterPacketGrantV1 => {
+const grant = (value: unknown): IRuntimeNetworkRouterPacketGrant => {
   const item = networkRecord(value, ['source', 'destination']);
   const source = networkRecord(item.source, ['handoff', 'address']);
   const destination = networkRecord(item.destination, ['kind', 'id', 'address', 'protocol', 'port']);
@@ -29,7 +29,7 @@ const grant = (value: unknown): IRuntimeNetworkRouterPacketGrantV1 => {
 };
 
 /** Internal parser: the enclosing projection has already captured caller input. */
-export const snapshotRouterProjection = (value: unknown): IRuntimeNetworkRouterProjectionV1 => {
+export const snapshotRouterProjection = (value: unknown): IRuntimeNetworkRouterProjection => {
   const item = networkRecord(value, ['resolverIds', 'platformEndpointIds', 'withdrawals']);
   return {
     resolverIds: networkSorted(networkList(item.resolverIds, 16, networkId), value => value),
@@ -40,16 +40,16 @@ export const snapshotRouterProjection = (value: unknown): IRuntimeNetworkRouterP
 
 /** Internal composition after capture. The public helper validates the whole projection. */
 export const routerPacketGrantsOf = (projection: {
-  router?: IRuntimeNetworkRouterProjectionV1;
-  handoff: IRuntimeNetworkHandoffLeaseV1 | null;
-  protectedAuthority: IRuntimeNetworkProtectedAuthorityV1;
-}): IRuntimeNetworkRouterPacketGrantV1[] => {
+  router?: IRuntimeNetworkRouterProjection;
+  handoff: IRuntimeNetworkHandoffLease | null;
+  protectedAuthority: IRuntimeNetworkProtectedAuthority;
+}): IRuntimeNetworkRouterPacketGrant[] => {
   const selected = projection.router;
   if (!selected || selected.resolverIds.length + selected.platformEndpointIds.length === 0) return [];
   const handoff = projection.handoff; requireNetwork(handoff);
   const source = { handoff: networkReferenceOf(handoff), address: handoff.transit.routerAddress };
-  const result: IRuntimeNetworkRouterPacketGrantV1[] = [];
-  const append = (destination: IRuntimeNetworkRouterPacketGrantV1['destination']) => {
+  const result: IRuntimeNetworkRouterPacketGrant[] = [];
+  const append = (destination: IRuntimeNetworkRouterPacketGrant['destination']) => {
     requireNetwork(handoff.sourcePortRanges.some(range => range.protocol === destination.protocol));
     result.push({ source: { handoff: { ...source.handoff }, address: source.address }, destination });
   };

package/ts/data/networksigning.ts

@@ -1,23 +1,21 @@
 import type { TSha256Digest } from './immutableimage.js';
-import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
-import type { IRuntimeNetworkProjectionV1 } from './networkprojection.js';
-import { snapshotRuntimeNetworkProjectionV1 } from './networkprojection.js';
-import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
+import type { IRuntimeAuthorityReference, IRuntimeController } from './runtimeassignment.js';
+import type { IRuntimeNetworkProjection } from './networkprojection.js';
+import { snapshotRuntimeNetworkProjection } from './networkprojection.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
 import { captureNetwork, failNetwork, networkController, networkDigest, networkEqual, networkHash, networkRecord,
   networkReference, networkReferenceOf, networkRevision, networkSafe, networkSignature, requireNetwork } from '../private/networkcontract.js';
 
-export interface ISignedRuntimeNetworkProjectionV1 {
-  schemaVersion: 1;
-  authority: IRuntimeAuthorityReferenceV1;
-  projection: IRuntimeNetworkProjectionV1;
+export interface ISignedRuntimeNetworkProjection {
+  authority: IRuntimeAuthorityReference;
+  projection: IRuntimeNetworkProjection;
   /** Ed25519 signature of the complete domain-separated envelope, lowercase hex. */
   signature: string;
 }
 
-export const snapshotSignedRuntimeNetworkProjectionV1 = (value: unknown): ISignedRuntimeNetworkProjectionV1 => networkSafe(() => {
-  const item = networkRecord(captureNetwork(value), ['schemaVersion', 'authority', 'projection', 'signature']);
-  requireNetwork(item.schemaVersion === 1);
-  return { schemaVersion: 1, authority: networkReference(item.authority), projection: snapshotRuntimeNetworkProjectionV1(item.projection),
+export const snapshotSignedRuntimeNetworkProjection = (value: unknown): ISignedRuntimeNetworkProjection => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['authority', 'projection', 'signature']);
+  return { authority: networkReference(item.authority), projection: snapshotRuntimeNetworkProjection(item.projection),
     signature: networkSignature(item.signature) };
 });
 
@@ -27,54 +25,53 @@ export const snapshotSignedRuntimeNetworkProjectionV1 = (value: unknown): ISigne
  * null revokes signing; rotation requires a new complete signed projection for DNS.
  * Existing packet grants still require applied denial or independent fencing.
  */
-export interface IRuntimeNetworkSigningAuthorityV1 {
-  schemaVersion: 1;
+export interface IRuntimeNetworkSigningAuthority {
   id: string;
   generation: number;
-  previous: IRuntimeAuthorityReferenceV1 | null;
-  controller: IRuntimeControllerV1;
+  previous: IRuntimeAuthorityReference | null;
+  controller: IRuntimeController;
   algorithm: 'Ed25519';
   /** Canonical 32-byte raw public key, lowercase hex. No private material. */
   publicKey: string | null;
   digest: TSha256Digest;
 }
 
-export const runtimeNetworkSigningV1Contract = Object.freeze({
-  authorityDigestDomain: 'serve.zone/runtime-network-signing-authority-v1',
-  signatureDomain: 'serve.zone/runtime-network-projection-signature-v1',
+export const runtimeNetworkSigningContract = Object.freeze({
+  authorityDigestDomain: 'serve.zone/runtime-network-signing-authority',
+  signatureDomain: 'serve.zone/runtime-network-projection-signature',
   trust: 'current-authenticated-physical-session-and-durable-revision-fence',
   rotation: 'replace-dns-authority-with-new-signed-projection',
   revocation: 'no-implicit-packet-denial-or-allocation-reuse',
 } as const);
 
-export const snapshotRuntimeNetworkSigningAuthorityV1 = (value: unknown): IRuntimeNetworkSigningAuthorityV1 => networkSafe(() => {
-  const item = networkRecord(captureNetwork(value), ['schemaVersion', 'id', 'generation', 'previous', 'controller', 'algorithm', 'publicKey', 'digest']);
-  requireNetwork(item.schemaVersion === 1 && item.algorithm === 'Ed25519');
+export const snapshotRuntimeNetworkSigningAuthority = (value: unknown): IRuntimeNetworkSigningAuthority => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['id', 'generation', 'previous', 'controller', 'algorithm', 'publicKey', 'digest']);
+  requireNetwork(item.algorithm === 'Ed25519');
   requireNetwork(item.publicKey === null || (typeof item.publicKey === 'string'
     && /^[a-f0-9]{64}$/.test(item.publicKey) && item.publicKey !== '0'.repeat(64)));
-  return { schemaVersion: 1, ...networkRevision(item), controller: networkController(item.controller),
+  return { ...networkRevision(item), controller: networkController(item.controller),
     algorithm: 'Ed25519', publicKey: item.publicKey, digest: networkDigest(item.digest) };
 });
 
-export const computeRuntimeNetworkSigningAuthorityV1Digest = (value: IRuntimeNetworkSigningAuthorityV1): Promise<TSha256Digest> =>
-  networkHash(runtimeNetworkSigningV1Contract.authorityDigestDomain, snapshotRuntimeNetworkSigningAuthorityV1(value));
+export const computeRuntimeNetworkSigningAuthorityDigest = (value: IRuntimeNetworkSigningAuthority): Promise<TSha256Digest> =>
+  networkHash(runtimeNetworkSigningContract.authorityDigestDomain, snapshotRuntimeNetworkSigningAuthority(value));
 
 /**
  * Detached content/CAS check. Caller must fence the live peer and commit atomically.
  * A newly enrolled node bootstraps the controller's CURRENT authority at any generation;
  * it must not fabricate local history or use this bootstrap path to erase existing trust.
  */
-export const admitRuntimeNetworkSigningAuthorityV1 = async (
+export const admitRuntimeNetworkSigningAuthority = async (
   value: unknown, previousValue: unknown | null, trustedSessionValue: unknown,
-): Promise<{ status: 'accepted' | 'replay'; authority: IRuntimeNetworkSigningAuthorityV1 }> => {
+): Promise<{ status: 'accepted' | 'replay'; authority: IRuntimeNetworkSigningAuthority }> => {
   try {
-    const authority = snapshotRuntimeNetworkSigningAuthorityV1(value);
-    const previous = previousValue === null ? null : snapshotRuntimeNetworkSigningAuthorityV1(previousValue);
-    const session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+    const authority = snapshotRuntimeNetworkSigningAuthority(value);
+    const previous = previousValue === null ? null : snapshotRuntimeNetworkSigningAuthority(previousValue);
+    const session = snapshotRuntimeSessionBinding(trustedSessionValue);
     requireNetwork(networkEqual(authority.controller, session.controller));
-    requireNetwork(authority.digest === await computeRuntimeNetworkSigningAuthorityV1Digest(authority));
+    requireNetwork(authority.digest === await computeRuntimeNetworkSigningAuthorityDigest(authority));
     if (previous === null) return { status: 'accepted', authority };
-    requireNetwork(previous.digest === await computeRuntimeNetworkSigningAuthorityV1Digest(previous)
+    requireNetwork(previous.digest === await computeRuntimeNetworkSigningAuthorityDigest(previous)
       && authority.id === previous.id && networkEqual(previous.controller, authority.controller));
     if (authority.generation === previous.generation) {
       requireNetwork(networkEqual(authority, previous)); return { status: 'replay', authority };

package/ts/data/nodecredential.ts

@@ -6,8 +6,7 @@ export type TNodeCredentialPurpose = 'spark' | 'pallet';
  * hashes, socket peer IDs or controller process IDs. On replay this is historical
  * evidence, not an assertion that a credential or reporter session is still live.
  */
-export interface INodeCredentialMetadataV1 {
-  schemaVersion: 1;
+export interface INodeCredentialMetadata {
   nodeId: string;
   purpose: TNodeCredentialPurpose;
   state: 'active' | 'revoked';
@@ -25,8 +24,7 @@ export interface INodeCredentialMetadataV1 {
  * preconditions, not minimums. Retrying must retain this complete input and the
  * original mutationId; a changed request with the same ID must fail closed.
  */
-export interface INodeCredentialMutationPreconditionsV1 {
-  schemaVersion: 1;
+export interface INodeCredentialMutationPreconditions {
   nodeId: string;
   purpose: TNodeCredentialPurpose;
   mutationId: string;
@@ -34,8 +32,8 @@ export interface INodeCredentialMutationPreconditionsV1 {
   expectedSessionEpoch: number;
 }
 
-export interface INodeCredentialMutationResultV1 {
-  metadata: INodeCredentialMetadataV1;
+export interface INodeCredentialMutationResult {
+  metadata: INodeCredentialMetadata;
   /** A replay returns the original result without restoring its authority. */
   replayed: boolean;
 }