@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/platform/storagemigration.ts

@@ -15,7 +15,6 @@ import type {
 } from './storage.js';
 
 export const storageMigrationContractLimits = Object.freeze({
-  version: 2 as const,
   maximumControlJsonBytes: 256 * 1024,
   maximumConfiguredStringBytes: 2048,
   maximumIssueMessageBytes: 4096,
@@ -49,7 +48,6 @@ export interface IStorageBindingMigrationOwner {
 }
 
 export interface IUnfencedObjectStorageBindingControlSnapshot {
-  schemaVersion: 2;
   binding: TActiveObjectStorageBinding;
   recordRevision: number;
   snapshotDigest: string;
@@ -58,7 +56,6 @@ export interface IUnfencedObjectStorageBindingControlSnapshot {
 }
 
 export interface IFencedObjectStorageBindingControlSnapshot {
-  schemaVersion: 2;
   binding: TActiveObjectStorageBinding;
   recordRevision: number;
   snapshotDigest: string;
@@ -84,7 +81,6 @@ export interface IObjectStorageMigrationTarget {
 }
 
 export interface IObjectStorageMigrationPrepareRequest {
-  schemaVersion: 2;
   migrationId: string;
   sourceControlSnapshot: IUnfencedObjectStorageBindingControlSnapshot;
   workloadGeneration: number;
@@ -127,7 +123,6 @@ extends IStorageMigrationIssueBase {
 }
 
 export interface IStorageMigrationMutationFence {
-  schemaVersion: 2;
   migrationId: string;
   migrationDigest: string;
   expectedMigrationRevision: number;
@@ -193,7 +188,6 @@ export interface IObjectStorageMigrationCleanupRequest
 extends IStorageMigrationMutationFence {}
 
 export interface IStorageMigrationStatusBase {
-  schemaVersion: 2;
   migrationId: string;
   migrationDigest: string;
   migrationRevision: number;
@@ -526,7 +520,7 @@ const assertKeys = (
     requiredKeysArg.some((keyArg) => !Object.hasOwn(recordArg, keyArg)) ||
     actualKeys.some((keyArg) => !allowedKeys.has(keyArg))
   ) {
-    fail(`${fieldNameArg} does not match its exact versioned schema`);
+    fail(`${fieldNameArg} does not match its exact schema`);
   }
 };
 
@@ -622,7 +616,7 @@ const readLiteral = <TLiteral extends string>(
     typeof valueArg !== 'string' ||
     !allowedArg.includes(valueArg as TLiteral)
   ) {
-    return fail(`${fieldNameArg} is outside the supported versioned values`);
+    return fail(`${fieldNameArg} is outside the supported values`);
   }
   return valueArg as TLiteral;
 };
@@ -952,13 +946,13 @@ const normalizeDelivery = (
         `${fieldNameArg}.targetPath must be a canonical path below /run/secrets`,
       );
     }
-    if (value.format !== 'servezone-object-storage-v1') {
+    if (value.format !== 'servezone-object-storage') {
       return fail(`${fieldNameArg}.format is unsupported`);
     }
     return {
       type: 'file',
       targetPath,
-      format: 'servezone-object-storage-v1',
+      format: 'servezone-object-storage',
       uid: readSafeInteger(value.uid, `${fieldNameArg}.uid`, 0, 2_147_483_647),
       gid: readSafeInteger(value.gid, `${fieldNameArg}.gid`, 0, 2_147_483_647),
       mode: value.mode === 0o400 || value.mode === 0o440
@@ -1150,7 +1144,6 @@ const normalizeObjectStorageBinding = (
   assertKeys(
     value,
     [
-      'schemaVersion',
       'id',
       'serviceId',
       'requestId',
@@ -1171,9 +1164,6 @@ const normalizeObjectStorageBinding = (
     ['capacity', 'createdAt', 'updatedAt', 'retentionDays'],
     fieldNameArg,
   );
-  if (value.schemaVersion !== 2) {
-    return fail(`${fieldNameArg}.schemaVersion must be 2`);
-  }
   if (value.kind !== 'objectStorage') {
     return fail(`${fieldNameArg}.kind must be objectStorage`);
   }
@@ -1206,7 +1196,6 @@ const normalizeObjectStorageBinding = (
     return fail(`${fieldNameArg}.updatedAt must not precede createdAt`);
   }
   return {
-    schemaVersion: 2,
     id: readIdentifier(value.id, `${fieldNameArg}.id`),
     serviceId: readIdentifier(value.serviceId, `${fieldNameArg}.serviceId`),
     requestId: readIdentifier(value.requestId, `${fieldNameArg}.requestId`),
@@ -1327,7 +1316,6 @@ const normalizeUnfencedSnapshotShape = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'binding',
       'recordRevision',
       'snapshotDigest',
@@ -1335,11 +1323,7 @@ const normalizeUnfencedSnapshotShape = (
     ],
     fieldNameArg,
   );
-  if (value.schemaVersion !== 2) {
-    return fail(`${fieldNameArg}.schemaVersion must be 2`);
-  }
   return {
-    schemaVersion: 2,
     binding: normalizeObjectStorageBinding(
       value.binding,
       'ready',
@@ -1370,7 +1354,6 @@ const normalizeFencedSnapshotShape = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'binding',
       'recordRevision',
       'snapshotDigest',
@@ -1379,11 +1362,7 @@ const normalizeFencedSnapshotShape = (
     ],
     fieldNameArg,
   );
-  if (value.schemaVersion !== 2) {
-    return fail(`${fieldNameArg}.schemaVersion must be 2`);
-  }
   return {
-    schemaVersion: 2,
     binding: normalizeObjectStorageBinding(
       value.binding,
       'ready',
@@ -1413,7 +1392,6 @@ const normalizeFencedSnapshotShape = (
 const createUnfencedSnapshotDigestPayload = (
   snapshotArg: IUnfencedObjectStorageBindingControlSnapshot,
 ): TUnfencedObjectStorageBindingControlSnapshotDigestPayload => ({
-  schemaVersion: 2,
   binding: snapshotArg.binding,
   recordRevision: snapshotArg.recordRevision,
   capturedAt: snapshotArg.capturedAt,
@@ -1422,7 +1400,6 @@ const createUnfencedSnapshotDigestPayload = (
 const createFencedSnapshotDigestPayload = (
   snapshotArg: IFencedObjectStorageBindingControlSnapshot,
 ): TFencedObjectStorageBindingControlSnapshotDigestPayload => ({
-  schemaVersion: 2,
   binding: snapshotArg.binding,
   recordRevision: snapshotArg.recordRevision,
   capturedAt: snapshotArg.capturedAt,
@@ -1438,7 +1415,7 @@ export const canonicalizeUnfencedObjectStorageBindingControlSnapshotPayload = (
   );
   assertExactKeys(
     value,
-    ['schemaVersion', 'binding', 'recordRevision', 'capturedAt'],
+    ['binding', 'recordRevision', 'capturedAt'],
     'unfenced object-storage control snapshot digest payload',
   );
   const normalized = normalizeUnfencedSnapshotShape({
@@ -1458,7 +1435,6 @@ export const canonicalizeFencedObjectStorageBindingControlSnapshotPayload = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'binding',
       'recordRevision',
       'capturedAt',
@@ -1639,7 +1615,6 @@ const normalizePrepareRequestShape = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'sourceControlSnapshot',
       'workloadGeneration',
@@ -1647,11 +1622,7 @@ const normalizePrepareRequestShape = (
     ],
     'object-storage migration prepare request',
   );
-  if (value.schemaVersion !== 2) {
-    return fail('object-storage migration prepare request.schemaVersion must be 2');
-  }
   return {
-    schemaVersion: 2,
     migrationId: readIdentifier(
       value.migrationId,
       'object-storage migration prepare request.migrationId',
@@ -1845,11 +1816,7 @@ const normalizeMutationFence = (
   valueArg: Record<string, unknown>,
   fieldNameArg: string,
 ): IStorageMigrationMutationFence => {
-  if (valueArg.schemaVersion !== 2) {
-    return fail(`${fieldNameArg}.schemaVersion must be 2`);
-  }
   return {
-    schemaVersion: 2,
     migrationId: readIdentifier(
       valueArg.migrationId,
       `${fieldNameArg}.migrationId`,
@@ -1878,7 +1845,6 @@ export const normalizeStorageMigrationMutationFence = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'migrationDigest',
       'expectedMigrationRevision',
@@ -1897,7 +1863,6 @@ const normalizeQuiesceRequestShape = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'migrationDigest',
       'expectedMigrationRevision',
@@ -1952,7 +1917,6 @@ const normalizeQuiesceRequestShape = (
 const createPersistedStagingDigestPayload = (
   requestArg: IObjectStorageMigrationConsumerQuiesceRequest,
 ): TObjectStorageMigrationPersistedStagingDigestPayload => ({
-  schemaVersion: 2,
   migrationId: requestArg.migrationId,
   migrationDigest: requestArg.migrationDigest,
   expectedMigrationRevision: requestArg.expectedMigrationRevision,
@@ -1972,7 +1936,6 @@ export const createObjectStorageMigrationPersistedStagingSha256 = async (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'migrationDigest',
       'expectedMigrationRevision',
@@ -2019,7 +1982,6 @@ const normalizeActivationRequestShape = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'migrationDigest',
       'expectedMigrationRevision',
@@ -2068,7 +2030,6 @@ const normalizeActivationRequestShape = (
 const createPersistedActivationDigestPayload = (
   requestArg: IObjectStorageMigrationConsumerActivationRequest,
 ): TObjectStorageMigrationPersistedActivationDigestPayload => ({
-  schemaVersion: 2,
   migrationId: requestArg.migrationId,
   migrationDigest: requestArg.migrationDigest,
   expectedMigrationRevision: requestArg.expectedMigrationRevision,
@@ -2087,7 +2048,6 @@ export const createObjectStorageMigrationPersistedActivationSha256 = async (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'migrationDigest',
       'expectedMigrationRevision',
@@ -2220,7 +2180,6 @@ export const normalizeObjectStorageMigrationAbortRequest = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'migrationDigest',
       'expectedMigrationRevision',
@@ -2247,7 +2206,6 @@ export const normalizeObjectStorageMigrationResumeRequest = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'migrationDigest',
       'expectedMigrationRevision',
@@ -2274,7 +2232,6 @@ export const normalizeObjectStorageMigrationCleanupRequest = (
   assertExactKeys(
     value,
     [
-      'schemaVersion',
       'migrationId',
       'migrationDigest',
       'expectedMigrationRevision',
@@ -2396,7 +2353,6 @@ const assertActiveMatchesCandidate = (
   fieldNameArg: string,
 ): void => {
   const immutableKeys: readonly (keyof TActiveObjectStorageBinding)[] = [
-    'schemaVersion',
     'id',
     'serviceId',
     'requestId',
@@ -2490,7 +2446,6 @@ const assertEvidenceFence = (
 };
 
 const statusBaseRequiredKeys = [
-  'schemaVersion',
   'migrationId',
   'migrationDigest',
   'migrationRevision',
@@ -2594,9 +2549,6 @@ export const normalizeObjectStorageMigrationStatus = async (
     phaseOptional,
     fieldName,
   );
-  if (value.schemaVersion !== 2) {
-    return fail(`${fieldName}.schemaVersion must be 2`);
-  }
 
   const migrationId = readIdentifier(value.migrationId, `${fieldName}.migrationId`);
   const migrationDigest = readSha256(
@@ -2633,7 +2585,6 @@ export const normalizeObjectStorageMigrationStatus = async (
   }
   await assertTargetIdentity(target, sourceBinding, `${fieldName}.target`);
   const recomputedMigrationDigest = await createObjectStorageMigrationSha256({
-    schemaVersion: 2,
     migrationId,
     sourceControlSnapshot: source.preparationSnapshot,
     workloadGeneration,
@@ -2840,7 +2791,6 @@ export const normalizeObjectStorageMigrationStatus = async (
   }
 
   const normalized = {
-    schemaVersion: 2 as const,
     migrationId,
     migrationDigest,
     migrationRevision,

package/ts/platform/types.ts

@@ -1,5 +1,5 @@
 import type { TSecretManagementScope } from '../data/secret.js';
-import type { IObjectStorageRetentionBindingV1 } from './objectstorageretention.js';
+import type { IObjectStorageRetentionBinding } from './objectstorageretention.js';
 
 export type TPlatformCapability =
   | 'email'
@@ -68,7 +68,7 @@ export interface IPlatformBinding {
   /** Durable Cloudly authority for the exact Corestore object-storage bucket. */
   objectstorageBucketName?: string;
   /** Capability-specific value-free immutable-retention intent and evidence. */
-  objectstorageRetention?: IObjectStorageRetentionBindingV1;
+  objectstorageRetention?: IObjectStorageRetentionBinding;
   createdAt?: number;
   updatedAt?: number;
 }

package/ts/private/canonicaljson.ts

@@ -1,5 +1,4 @@
 export const strictCanonicalJsonRules = Object.freeze({
-  version: 1 as const,
   encoding: 'utf-8' as const,
   objectKeyOrdering: 'utf-16-code-unit-ascending' as const,
   arrayOrdering: 'preserved-dense' as const,
@@ -10,6 +9,19 @@ export const strictCanonicalJsonRules = Object.freeze({
 
 export type TCanonicalJsonFailure = (reasonArg: string) => never;
 
+/**
+ * The canonical order of two wire tokens: UTF-16 code units ascending, the rule this module
+ * already orders object keys by.
+ *
+ * A list of tokens a peer sends is compared byte for byte once it is judged, so the rule that
+ * builds a sorted list and the rule that judges one have to be the same rule; a second comparison
+ * elsewhere would be a second answer to what "sorted" means.
+ */
+export const compareWireTokens = (leftArg: string, rightArg: string): number => {
+  if (leftArg === rightArg) return 0;
+  return leftArg < rightArg ? -1 : 1;
+};
+
 const assertUnicodeScalarString = (
   valueArg: string,
   fieldNameArg: string,

package/ts/private/dataproperties.ts

@@ -0,0 +1,139 @@
+/**
+ * Reading a value a peer wrote without running the peer's code.
+ *
+ * A body arrives as decoded JSON on every honest path, but a caller can hand a contract any object
+ * it likes, and a property backed by an accessor runs code inside whatever validated it — once for
+ * the check and again for the copy, so the two can disagree. Every reader here takes own
+ * enumerable data properties only and refuses anything else instead of invoking it, which is what
+ * lets a validator promise that judging a value changed nothing and observed nothing twice.
+ *
+ * That promise covers accessors, not a `Proxy` whose descriptor trap answers differently on each
+ * call: decoded JSON from a peer never yields a Proxy, so these readers protect a validator from
+ * the accessor-bearing object an in-process caller can hand it, not from a hostile Proxy.
+ */
+
+/** One own data property that was read: `value` alone, so `undefined` stays distinguishable. */
+export interface IDataProperty {
+  value: unknown;
+}
+
+/** A record a peer could have sent as JSON: no class, no array, nothing inherited. */
+export const isPlainRecord = (valueArg: unknown): valueArg is Record<string, unknown> => (
+  Boolean(valueArg)
+  && typeof valueArg === 'object'
+  && !Array.isArray(valueArg)
+  && (Object.getPrototypeOf(valueArg) === Object.prototype
+    || Object.getPrototypeOf(valueArg) === null)
+);
+
+/**
+ * One key of a plain record, when it carries an own enumerable data property.
+ *
+ * `null` when the container is not a plain record, when the key is absent, or when it is anything
+ * but a data property — including the accessor this exists to refuse.
+ */
+export const readDataProperty = (valueArg: unknown, keyArg: string): IDataProperty | null => {
+  if (!isPlainRecord(valueArg)) {
+    return null;
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(valueArg, keyArg);
+  return descriptor?.enumerable === true && Object.hasOwn(descriptor, 'value')
+    ? { value: descriptor.value }
+    : null;
+};
+
+/**
+ * A plain record's own data properties, copied one level deep into an inert record.
+ *
+ * `null` when any own key is a symbol or is not an enumerable data property, so a record that
+ * passes here has nothing left on it that could run, change or hide a value after it was judged.
+ */
+export const readDataProperties = (valueArg: unknown): Record<string, unknown> | null => {
+  if (!isPlainRecord(valueArg)) {
+    return null;
+  }
+  const result: Record<string, unknown> = Object.create(null);
+  for (const key of Reflect.ownKeys(valueArg)) {
+    if (typeof key !== 'string') {
+      return null;
+    }
+    const property = readDataProperty(valueArg, key);
+    if (property === null) {
+      return null;
+    }
+    result[key] = property.value;
+  }
+  return result;
+};
+
+/**
+ * A bounded, dense array a peer could have sent as JSON, copied into an inert list.
+ *
+ * `null` when the value is not a plain array, when it is longer than the caller's bound, when it
+ * carries any own key beyond its elements and `length` — a hole or an extra property — or when an
+ * element is not an enumerable data property. The bound is read before any element is copied, so a
+ * caller cannot be made to walk an array it would have refused anyway.
+ */
+export const readDataElements = (
+  valueArg: unknown,
+  maximumLengthArg: number,
+): unknown[] | null => {
+  if (!Array.isArray(valueArg) || Object.getPrototypeOf(valueArg) !== Array.prototype) {
+    return null;
+  }
+  if (valueArg.length > maximumLengthArg
+    || Reflect.ownKeys(valueArg).length !== valueArg.length + 1) {
+    return null;
+  }
+  const elements: unknown[] = [];
+  for (let index = 0; index < valueArg.length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(valueArg, String(index));
+    if (descriptor?.enumerable !== true || !Object.hasOwn(descriptor, 'value')) {
+      return null;
+    }
+    elements.push(descriptor.value);
+  }
+  return elements;
+};
+
+/**
+ * True when a record carries every required key and nothing beyond the optional ones.
+ *
+ * The key-set half of an exact schema, for a validator that has already established it holds a
+ * record and wants to name every reason a body is refused rather than stop at the first. A shape
+ * with no optional members passes one list and gets "exactly these keys". Both halves judge the
+ * own enumerable keys — the ones a peer's JSON could have carried — so a required key hidden on a
+ * non-enumerable property is missing here just as it is missing from the body.
+ *
+ * Key names only: what each key holds, and whether it holds data at all, is the reader's question.
+ */
+export const hasExactKeys = (
+  recordArg: Record<string, unknown>,
+  requiredKeysArg: readonly string[],
+  optionalKeysArg: readonly string[] = [],
+): boolean => {
+  const keys = Object.keys(recordArg);
+  return requiredKeysArg.every((keyArg) => keys.includes(keyArg))
+    && keys.every((keyArg) => requiredKeysArg.includes(keyArg) || optionalKeysArg.includes(keyArg));
+};
+
+/**
+ * Exactly these keys, carrying data and nothing that runs, copied away from the caller's object.
+ *
+ * `null` for everything else: a missing key, an extra key, or a key that is not an enumerable data
+ * property. This is the one exact-key reader every contract and carrier in this package is built
+ * on, so a shape whose schema is written down as a key list is judged the same way everywhere.
+ */
+export const readExactDataRecord = (
+  valueArg: unknown,
+  keysArg: readonly string[],
+): Record<string, unknown> | null => {
+  const record = readDataProperties(valueArg);
+  if (record === null) {
+    return null;
+  }
+  const keys = Object.keys(record);
+  return keys.length === keysArg.length && keys.every((keyArg) => keysArg.includes(keyArg))
+    ? record
+    : null;
+};

package/ts/private/networkcontract.ts

@@ -1,7 +1,7 @@
 import type { TSha256Digest } from '../data/immutableimage.js';
-import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from '../data/runtimeassignment.js';
+import type { IRuntimeAuthorityReference, IRuntimeController } from '../data/runtimeassignment.js';
 import type { IRuntimeNetworkDnsLeaseRenewal } from '../data/networklease.js';
-import type { IRuntimeNetworkDnsWindow, IRuntimeNetworkNodeScopeV1, IRuntimeNetworkProjectionV1 } from '../data/networkprojection.js';
+import type { IRuntimeNetworkDnsWindow, IRuntimeNetworkNodeScope, IRuntimeNetworkProjection } from '../data/networkprojection.js';
 import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from './canonicaljson.js';
 
 export const failNetwork = (): never => { throw new Error('Runtime network projection contract rejected.'); };
@@ -89,15 +89,15 @@ export const networkDigest = (value: unknown): TSha256Digest => {
 export const networkSignature = (value: unknown): string => {
   requireNetwork(typeof value === 'string' && /^[a-f0-9]{128}$/.test(value)); return value;
 };
-export const networkController = (value: unknown): IRuntimeControllerV1 => {
+export const networkController = (value: unknown): IRuntimeController => {
   const item = networkRecord(value, ['kind', 'id', 'epoch']);
   requireNetwork(item.kind === 'cloudly' || item.kind === 'onebox');
   return { kind: item.kind, id: networkId(item.id), epoch: networkId(item.epoch) };
 };
-export const networkScope = (item: Record<string, unknown>): IRuntimeNetworkNodeScopeV1 => ({
+export const networkScope = (item: Record<string, unknown>): IRuntimeNetworkNodeScope => ({
   controller: networkController(item.controller), nodeId: networkId(item.nodeId), runtimeNamespace: networkId(item.runtimeNamespace),
 });
-export const networkSameScope = (left: IRuntimeNetworkNodeScopeV1, right: IRuntimeNetworkNodeScopeV1): boolean =>
+export const networkSameScope = (left: IRuntimeNetworkNodeScope, right: IRuntimeNetworkNodeScope): boolean =>
   networkEqual(left.controller, right.controller) && left.nodeId === right.nodeId && left.runtimeNamespace === right.runtimeNamespace;
 export const networkMaximumDnsLeaseMs = 900_000;
 /** One rule for every signed DNS window, projection or renewal: ordered, non-empty, at most fifteen minutes. */
@@ -108,21 +108,21 @@ export const networkDnsWindow = (value: unknown): IRuntimeNetworkDnsWindow => {
     && window.expiresAt - window.issuedAt <= networkMaximumDnsLeaseMs);
   return window;
 };
-export const networkReference = (value: unknown): IRuntimeAuthorityReferenceV1 => {
+export const networkReference = (value: unknown): IRuntimeAuthorityReference => {
   const item = networkRecord(value, ['id', 'generation', 'digest']);
   return { id: networkId(item.id), generation: networkCounter(item.generation), digest: networkDigest(item.digest) };
 };
-export const networkReferenceOf = (value: IRuntimeAuthorityReferenceV1): IRuntimeAuthorityReferenceV1 =>
+export const networkReferenceOf = (value: IRuntimeAuthorityReference): IRuntimeAuthorityReference =>
   ({ id: value.id, generation: value.generation, digest: value.digest });
 /** A renewal renews exactly one projection: the same node scope and that projection's exact reference. */
-export const networkRenewsProjection = (renewal: IRuntimeNetworkDnsLeaseRenewal, projection: IRuntimeNetworkProjectionV1): boolean =>
+export const networkRenewsProjection = (renewal: IRuntimeNetworkDnsLeaseRenewal, projection: IRuntimeNetworkProjection): boolean =>
   networkSameScope(renewal, projection) && networkEqual(renewal.projection, networkReferenceOf(projection));
 /**
  * The one rule for the DNS window a node may use under a projection: its admitted renewal's, else
  * the projection's own. Both inputs are already validated caller state; this verifies no signature.
  */
 export const networkEffectiveDnsWindow = (
-  projection: IRuntimeNetworkProjectionV1, renewal: IRuntimeNetworkDnsLeaseRenewal | null,
+  projection: IRuntimeNetworkProjection, renewal: IRuntimeNetworkDnsLeaseRenewal | null,
 ): IRuntimeNetworkDnsWindow => {
   if (renewal === null) return projection.dns;
   requireNetwork(networkRenewsProjection(renewal, projection));

package/ts/private/releaseversion.ts

@@ -0,0 +1,70 @@
+/**
+ * The release-version grammar every serve.zone package agrees on.
+ *
+ * Exactly what a published release is named and nothing else: no prerelease, because gitzone
+ * refuses to publish one, and no build metadata, because two strings that name one release would
+ * then compare unequal. Components are read as numbers, which is the whole reason this rule
+ * exists — `32.10.0` is above `32.9.0`, and a lexical comparison of the strings says the opposite.
+ */
+export interface IReleaseVersion {
+  major: number;
+  minor: number;
+  patch: number;
+}
+
+/** Canonical decimal components: no leading zeros, no prefix, no suffix. */
+const releaseVersionPattern = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+
+/**
+ * Bounds the string before anything parses it.
+ *
+ * Every component of a real release fits many times over, so the only values this refuses are
+ * digit runs that no release could carry and that a reader would otherwise have to count.
+ */
+export const maximumReleaseVersionLength = 32;
+
+/**
+ * The three components of one release version, or `null` for everything that is not one.
+ *
+ * A component beyond the safe-integer range is refused rather than rounded: two such versions
+ * would compare equal after rounding, and an ordering that cannot tell two releases apart is
+ * worse than no answer.
+ */
+export const parseReleaseVersion = (valueArg: unknown): IReleaseVersion | null => {
+  if (typeof valueArg !== 'string' || valueArg.length > maximumReleaseVersionLength) {
+    return null;
+  }
+  const components = releaseVersionPattern.exec(valueArg);
+  if (components === null) {
+    return null;
+  }
+  const [major, minor, patch] = components.slice(1).map(Number);
+  if (!Number.isSafeInteger(major) || !Number.isSafeInteger(minor) || !Number.isSafeInteger(patch)) {
+    return null;
+  }
+  return { major, minor, patch };
+};
+
+/**
+ * Whether a value names one published release.
+ *
+ * Every rule of the grammar goes through `parseReleaseVersion`, including the numeric one, so a
+ * validator that accepts a version cannot accept one the comparison then refuses to order.
+ */
+export const isReleaseVersion = (valueArg: unknown): valueArg is string => (
+  parseReleaseVersion(valueArg) !== null
+);
+
+/** Negative, zero or positive as the left version is below, equal to or above the right one. */
+export const compareReleaseVersions = (
+  leftArg: IReleaseVersion,
+  rightArg: IReleaseVersion,
+): number => {
+  if (leftArg.major !== rightArg.major) {
+    return leftArg.major - rightArg.major;
+  }
+  if (leftArg.minor !== rightArg.minor) {
+    return leftArg.minor - rightArg.minor;
+  }
+  return leftArg.patch - rightArg.patch;
+};

package/ts/private/runtimepolicy.ts

@@ -1,4 +1,4 @@
-import type { IRuntimeConfigLogPolicyV1 } from '../data/runtimeconfig.js';
+import type { IRuntimeConfigLogPolicy } from '../data/runtimeconfig.js';
 
 /**
  * The execution policy a runtime config seals and a service runtime profile states ahead of it.
@@ -40,7 +40,7 @@ export const isRuntimeMemoryBytes = (valueArg: unknown): valueArg is number =>
 export const isRuntimeIdentityNumber = (valueArg: unknown): valueArg is number =>
   isBoundedInteger(valueArg, 0, runtimePolicyLimits.maximumIdentityNumber);
 
-export const isRuntimeLogPolicy = (valueArg: unknown): valueArg is IRuntimeConfigLogPolicyV1 =>
+export const isRuntimeLogPolicy = (valueArg: unknown): valueArg is IRuntimeConfigLogPolicy =>
   isExactRecord(valueArg, ['maximumLineBytes', 'maximumBufferedBytes', 'retentionMs'])
   && isBoundedInteger(valueArg.maximumLineBytes, 1, 1_048_576)
   && isBoundedInteger(valueArg.maximumBufferedBytes, 1, 67_108_864)

package/ts/private/tokenlist.ts

@@ -0,0 +1,30 @@
+/**
+ * Judging a list of tokens a peer sent against the vocabulary it may draw from.
+ *
+ * Every such list in this package is compared byte for byte by its receiver, so they all obey one
+ * rule; a second spelling of that rule elsewhere would be a second answer to what a canonical list
+ * is. A caller adds whatever else its own contract demands — a required subset, a bound — as its
+ * own clause beside this one.
+ */
+import { compareWireTokens } from './canonicaljson.js';
+
+/**
+ * True when a value is exactly a canonical token list: known names, strictly increasing.
+ *
+ * Strictly increasing states sorted and duplicate-free in one rule, which is what lets a replayed
+ * list be compared byte for byte instead of as a set. A hole is refused rather than skipped over:
+ * array iteration passes holes by, so a sparse list would satisfy every rule about its entries
+ * while carrying none of the entries a receiver then compares.
+ */
+export const isCanonicalTokenList = <TTokenGeneric extends string>(
+  valueArg: unknown,
+  vocabularyArg: readonly TTokenGeneric[],
+): valueArg is TTokenGeneric[] => (
+  Array.isArray(valueArg)
+  && Object.keys(valueArg).length === valueArg.length
+  && valueArg.every((entryArg, indexArg) => (
+    vocabularyArg.some((tokenArg) => tokenArg === entryArg)
+    && (indexArg === 0
+      || compareWireTokens(valueArg[indexArg - 1] as string, entryArg as string) < 0)
+  ))
+);