@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/data/runtimeconfig.ts

@@ -1,6 +1,6 @@
 import type {
-  IImmutableContainerInvocationPlatformEvidenceV1,
-  IImmutableContainerInvocationV1,
+  IImmutableContainerInvocation,
+  IImmutableContainerInvocationPlatformEvidence,
   TSha256Digest,
 } from './immutableimage.js';
 import {
@@ -9,8 +9,8 @@ import {
   validateImmutableContainerInvocation,
   verifyImmutableContainerInvocationDigest,
 } from './immutableimage.js';
-import type { IRuntimeAssignmentV1, IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
-import { snapshotRuntimeAssignmentV1, validateRuntimeAssignmentV1 } from './runtimeassignment.js';
+import type { IRuntimeAssignment, IRuntimeAuthorityReference } from './runtimeassignment.js';
+import { snapshotRuntimeAssignment, validateRuntimeAssignment } from './runtimeassignment.js';
 import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
 import {
   assertRuntimeReadiness, isBoundedInteger, isExactRecord, isRuntimeCpuMillis, isRuntimeIdentityNumber,
@@ -18,7 +18,7 @@ import {
 } from '../private/runtimepolicy.js';
 
 /** A container target only; declaration does not publish a host or gateway port. */
-export interface IRuntimeConfigTargetPortV1 {
+export interface IRuntimeConfigTargetPort {
   name: string;
   port: number;
   /** Inclusive; equal to port for a single port. */
@@ -26,7 +26,7 @@ export interface IRuntimeConfigTargetPortV1 {
   protocol: 'tcp' | 'udp';
 }
 
-export interface IRuntimeConfigReadinessTimingV1 {
+export interface IRuntimeConfigReadinessTiming {
   /** Measured from the evidenced container start; no probes before this delay. */
   initialDelayMs: number;
   /** Failures during this startup grace cannot mark the workload unhealthy. */
@@ -41,7 +41,7 @@ export interface IRuntimeConfigReadinessTimingV1 {
   failureThreshold: number;
 }
 
-export type TRuntimeConfigReadinessV1 = IRuntimeConfigReadinessTimingV1 & (
+export type TRuntimeConfigReadiness = IRuntimeConfigReadinessTiming & (
   | { kind: 'process' }
   | { kind: 'tcp'; targetPort: string; port: number }
   | {
@@ -64,7 +64,7 @@ export type TRuntimeConfigReadinessV1 = IRuntimeConfigReadinessTimingV1 & (
   }
 );
 
-export interface IRuntimeConfigLogPolicyV1 {
+export interface IRuntimeConfigLogPolicy {
   /** Maximum UTF-8 bytes in one captured stdout/stderr line. */
   maximumLineBytes: number;
   /** Maximum bytes waiting for delivery; overflow requires explicit evidence. */
@@ -80,8 +80,7 @@ export interface IRuntimeConfigLogPolicyV1 {
  * Secrets, network identity and storage claims remain separately assignment-bound
  * owner references. This document contains no registry credentials or host paths.
  */
-export interface IRuntimeConfigV1 extends IRuntimeAuthorityReferenceV1 {
-  schemaVersion: 1;
+export interface IRuntimeConfig extends IRuntimeAuthorityReference {
   organizationId: string;
   serviceId: string;
   image: {
@@ -89,7 +88,7 @@ export interface IRuntimeConfigV1 extends IRuntimeAuthorityReferenceV1 {
     repository: string;
     /** Root descriptor digest, which may be an OCI platform index. */
     imageDigest: TSha256Digest;
-    invocation: IImmutableContainerInvocationV1;
+    invocation: IImmutableContainerInvocation;
   };
   /** Complete effective public environment; secret values must never be inlined. */
   environment: Record<string, string>;
@@ -110,25 +109,25 @@ export interface IRuntimeConfigV1 extends IRuntimeAuthorityReferenceV1 {
   /** Numeric override paired with runAsUser, or null for the image identity policy. */
   runAsGroup: number | null;
   /** Sorted unique names, with no overlapping ranges for the same transport. */
-  targetPorts: IRuntimeConfigTargetPortV1[];
-  readiness: TRuntimeConfigReadinessV1;
+  targetPorts: IRuntimeConfigTargetPort[];
+  readiness: TRuntimeConfigReadiness;
   /**
    * SmartData owns log metadata and SmartBucket owns archived payloads. This
    * policy does not authorize persistent local files. Any CRI log capture uses
    * disposable process-local transport artifacts and must evidence bounded
    * buffering, backpressure and lost data; it must not silently truncate logs.
    */
-  logs: IRuntimeConfigLogPolicyV1;
+  logs: IRuntimeConfigLogPolicy;
 }
 
-export interface IRuntimeConfigAssignmentBindingV1 {
-  config: IRuntimeConfigV1;
-  assignment: IRuntimeAssignmentV1;
-  platformEvidence: IImmutableContainerInvocationPlatformEvidenceV1;
+export interface IRuntimeConfigAssignmentBinding {
+  config: IRuntimeConfig;
+  assignment: IRuntimeAssignment;
+  platformEvidence: IImmutableContainerInvocationPlatformEvidence;
 }
 
-export const runtimeConfigV1Contract = Object.freeze({
-  digestDomain: 'serve.zone/runtime-config-v1',
+export const runtimeConfigContract = Object.freeze({
+  digestDomain: 'serve.zone/runtime-config',
   maximumCanonicalBytes: 262_144,
   maximumEnvironmentEntries: 128,
   maximumTargetPorts: 64,
@@ -153,9 +152,9 @@ const snapshotBoundedJson = (valueArg: unknown): unknown => {
   let stringBytes = 0;
   const ancestors = new Set<object>();
   const accountString = (value: string): void => {
-    if (value.length > runtimeConfigV1Contract.maximumCanonicalBytes) fail('runtime config string is oversized');
+    if (value.length > runtimeConfigContract.maximumCanonicalBytes) fail('runtime config string is oversized');
     stringBytes += encoder.encode(value).byteLength;
-    if (stringBytes > runtimeConfigV1Contract.maximumCanonicalBytes) fail('runtime config is oversized');
+    if (stringBytes > runtimeConfigContract.maximumCanonicalBytes) fail('runtime config is oversized');
   };
   const copy = (value: unknown, depth: number): unknown => {
     if (++nodes > 8192 || depth > 12) fail('runtime config exceeds structural bounds');
@@ -202,20 +201,20 @@ const snapshotBoundedJson = (valueArg: unknown): unknown => {
     } finally { ancestors.delete(value); }
   };
   const canonical = canonicalizeStrictJson(copy(valueArg, 0), fail);
-  if (encoder.encode(canonical).byteLength > runtimeConfigV1Contract.maximumCanonicalBytes) {
+  if (encoder.encode(canonical).byteLength > runtimeConfigContract.maximumCanonicalBytes) {
     fail('runtime config canonical JSON is oversized');
   }
   return JSON.parse(canonical);
 };
 
-const assertConfig = (valueArg: unknown): IRuntimeConfigV1 => {
-  if (!isExactRecord(valueArg, ['schemaVersion', 'id', 'generation', 'organizationId', 'serviceId',
+const assertConfig = (valueArg: unknown): IRuntimeConfig => {
+  if (!isExactRecord(valueArg, ['id', 'generation', 'organizationId', 'serviceId',
     'image', 'environment', 'workingDirectory', 'cpuMillis', 'memoryBytes', 'readonlyRootfs',
     'runAsUser', 'runAsGroup', 'targetPorts', 'readiness', 'logs', 'digest'])
-    || valueArg.schemaVersion !== 1 || !isIdentifier(valueArg.id)
+    || !isIdentifier(valueArg.id)
     || !isBoundedInteger(valueArg.generation, 1, Number.MAX_SAFE_INTEGER)
     || !isIdentifier(valueArg.organizationId) || !isIdentifier(valueArg.serviceId)
-    || !isDigest(valueArg.digest)) fail('runtime config must use its exact v1 schema');
+    || !isDigest(valueArg.digest)) fail('runtime config must use its exact schema');
   const image = valueArg.image;
   if (!isExactRecord(image, ['registryHost', 'repository', 'imageDigest', 'invocation'])
     || typeof image.registryHost !== 'string' || image.registryHost.length > 253
@@ -228,7 +227,7 @@ const assertConfig = (valueArg: unknown): IRuntimeConfigV1 => {
     image.imageDigest as TSha256Digest);
   const environment = valueArg.environment;
   if (!environment || typeof environment !== 'object' || Array.isArray(environment)
-    || Object.keys(environment).length > runtimeConfigV1Contract.maximumEnvironmentEntries) {
+    || Object.keys(environment).length > runtimeConfigContract.maximumEnvironmentEntries) {
     fail('runtime config requires an explicit bounded nonsecret environment');
   }
   for (const [key, value] of Object.entries(environment)) {
@@ -249,11 +248,11 @@ const assertConfig = (valueArg: unknown): IRuntimeConfigV1 => {
     fail('runtime config requires canonical directory and explicit resource and identity policies');
   }
   const ports = valueArg.targetPorts;
-  if (!Array.isArray(ports) || ports.length > runtimeConfigV1Contract.maximumTargetPorts) {
+  if (!Array.isArray(ports) || ports.length > runtimeConfigContract.maximumTargetPorts) {
     fail('runtime config target ports must be a bounded array');
   }
   let previousName = '';
-  const validatedPorts: IRuntimeConfigTargetPortV1[] = [];
+  const validatedPorts: IRuntimeConfigTargetPort[] = [];
   for (const port of ports) {
     if (!isExactRecord(port, ['name', 'port', 'portEnd', 'protocol'])
       || !isRuntimePortName(port.name) || port.name <= previousName
@@ -264,7 +263,7 @@ const assertConfig = (valueArg: unknown): IRuntimeConfigV1 => {
       fail('runtime config target ports require sorted unique names and nonoverlapping transport ranges');
     }
     previousName = port.name;
-    validatedPorts.push(port as unknown as IRuntimeConfigTargetPortV1);
+    validatedPorts.push(port as unknown as IRuntimeConfigTargetPort);
   }
   assertRuntimeReadiness(valueArg.readiness, (targetPortArg, portArg) => validatedPorts.some((targetArg) =>
     targetArg.name === targetPortArg && targetArg.protocol === 'tcp'
@@ -272,35 +271,35 @@ const assertConfig = (valueArg: unknown): IRuntimeConfigV1 => {
   if (!isRuntimeLogPolicy(valueArg.logs)) {
     fail('runtime config logs require explicit bounded line, buffer and retention limits');
   }
-  return valueArg as unknown as IRuntimeConfigV1;
+  return valueArg as unknown as IRuntimeConfig;
 };
 
 /**
  * Detached exact-schema snapshot for synchronous persistence assertions. Digest
  * integrity, scope authorization, admission and runtime readiness are not implied.
  */
-export const snapshotRuntimeConfigV1 = (valueArg: unknown): IRuntimeConfigV1 =>
+export const snapshotRuntimeConfig = (valueArg: unknown): IRuntimeConfig =>
   assertConfig(snapshotBoundedJson(valueArg));
 
 /** Domain-separated canonical JSON excludes only the config's own digest. */
-export const computeRuntimeConfigV1Digest = async (configArg: IRuntimeConfigV1): Promise<TSha256Digest> => {
-  const { digest: _digest, ...payload } = snapshotRuntimeConfigV1(configArg);
+export const computeRuntimeConfigDigest = async (configArg: IRuntimeConfig): Promise<TSha256Digest> => {
+  const { digest: _digest, ...payload } = snapshotRuntimeConfig(configArg);
   return `sha256:${await createCanonicalJsonSha256Hex(canonicalizeStrictJson({
-    domain: runtimeConfigV1Contract.digestDomain, payload,
+    domain: runtimeConfigContract.digestDomain, payload,
   }, fail), fail)}`;
 };
 
-const validateSnapshot = async (configArg: IRuntimeConfigV1): Promise<string[]> => {
+const validateSnapshot = async (configArg: IRuntimeConfig): Promise<string[]> => {
   if (!await verifyImmutableContainerInvocationDigest(configArg.image.invocation)) {
     return ['runtime config immutable invocation digest does not match'];
   }
-  return configArg.digest === await computeRuntimeConfigV1Digest(configArg)
+  return configArg.digest === await computeRuntimeConfigDigest(configArg)
     ? [] : ['runtime config digest does not match'];
 };
 
-export const validateRuntimeConfigV1 = async (valueArg: unknown): Promise<string[]> => {
-  try { return await validateSnapshot(snapshotRuntimeConfigV1(valueArg)); }
-  catch { return ['runtime config must use its exact canonical v1 schema']; }
+export const validateRuntimeConfig = async (valueArg: unknown): Promise<string[]> => {
+  try { return await validateSnapshot(snapshotRuntimeConfig(valueArg)); }
+  catch { return ['runtime config must use its exact canonical schema']; }
 };
 
 /**
@@ -310,13 +309,13 @@ export const validateRuntimeConfigV1 = async (valueArg: unknown): Promise<string
  * controller, durably admit the attempt, resolve other owner references, and
  * verify runtime and readiness evidence before effects or route publication.
  */
-export const bindRuntimeConfigV1ToAssignment = async (
+export const bindRuntimeConfigToAssignment = async (
   configArg: unknown, assignmentArg: unknown,
-): Promise<IRuntimeConfigAssignmentBindingV1> => {
-  const config = snapshotRuntimeConfigV1(configArg);
-  const assignment = snapshotRuntimeAssignmentV1(snapshotBoundedJson(assignmentArg));
+): Promise<IRuntimeConfigAssignmentBinding> => {
+  const config = snapshotRuntimeConfig(configArg);
+  const assignment = snapshotRuntimeAssignment(snapshotBoundedJson(assignmentArg));
   if ((await validateSnapshot(config)).length !== 0
-    || (await validateRuntimeAssignmentV1(assignment)).length !== 0) {
+    || (await validateRuntimeAssignment(assignment)).length !== 0) {
     fail('runtime config binding requires valid config, invocation and assignment digests');
   }
   const reference = assignment.workload.config;