@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/requests/node.ts

@@ -1,41 +1,41 @@
 import * as plugins from '../plugins.js';
 import type { IBareMetal } from '../data/baremetal.js';
 import type { ICluster } from '../data/cluster.js';
-import type { IClusterNode, IClusterNodeMetrics, INodeAction, INodeMetricsSample, ISparkNodeRuntimeInfo, TNodeActionName } from '../data/clusternode.js';
+import type { IClusterNode, INodeAction, INodeMetricsSample, TNodeActionName } from '../data/clusternode.js';
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
 import type {
-  INodeCredentialMetadataV1,
-  INodeCredentialMutationPreconditionsV1,
-  INodeCredentialMutationResultV1,
+  INodeCredentialMetadata,
+  INodeCredentialMutationPreconditions,
+  INodeCredentialMutationResult,
   TNodeCredentialPurpose,
 } from '../data/nodecredential.js';
 import type {
-  INodeEnrollmentRequestV1,
-  INodeEnrollmentAcknowledgementV1,
-  INodeEnrollmentStateV1,
+  INodeEnrollmentRequest,
+  INodeEnrollmentAcknowledgement,
+  INodeEnrollmentState,
 } from '../data/nodeenrollment.js';
 
 /** Node-self adoption preconditions, not an admin or workload RBAC grant. */
-export interface IReq_Spark_Cloudly_GetNodeEnrollmentStateV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Spark_Cloudly_GetNodeEnrollmentState extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Spark_Cloudly_GetNodeEnrollmentStateV1
+  IReq_Spark_Cloudly_GetNodeEnrollmentState
 > {
-  method: 'getNodeEnrollmentStateV1';
+  method: 'getNodeEnrollmentState';
   request: { nodeId: string; nodeToken: string };
   /** Reject unless Spark is currently authenticated and Pallet authority is absent. */
-  response: INodeEnrollmentStateV1;
+  response: INodeEnrollmentState;
 }
 
 /** One server transaction; each node-local owner durably activates independently. */
-export interface IReq_Spark_Cloudly_EnrollNodeV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Spark_Cloudly_EnrollNode extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Spark_Cloudly_EnrollNodeV1
+  IReq_Spark_Cloudly_EnrollNode
 > {
-  method: 'enrollNodeV1';
-  request: INodeEnrollmentRequestV1;
+  method: 'enrollNode';
+  request: INodeEnrollmentRequest;
   /** Replays require the exact receipt AND both current credential authorities. */
-  response: INodeEnrollmentAcknowledgementV1;
+  response: INodeEnrollmentAcknowledgement;
 }
 
 /** Requires verified platform-infrastructure admin authority; returns public data only. */
@@ -65,7 +65,7 @@ export interface IReq_Any_Cloudly_GetNodeCredential extends plugins.typedrequest
     purpose: TNodeCredentialPurpose;
   };
   response: {
-    metadata: INodeCredentialMetadataV1 | null;
+    metadata: INodeCredentialMetadata | null;
   };
 }
 
@@ -76,7 +76,7 @@ export interface IReq_Any_Cloudly_RotateNodeCredential extends plugins.typedrequ
   method: 'rotateNodeCredential';
   request: {
     identity: IIdentity;
-    mutation: INodeCredentialMutationPreconditionsV1 & {
+    mutation: INodeCredentialMutationPreconditions & {
       /**
        * SHA-256(token UTF-8 bytes), exactly 64 lowercase hexadecimal characters.
        * The node must durably retain its pending CSPRNG credential and mutation
@@ -86,7 +86,7 @@ export interface IReq_Any_Cloudly_RotateNodeCredential extends plugins.typedrequ
       newTokenHash: string;
     };
   };
-  response: INodeCredentialMutationResultV1;
+  response: INodeCredentialMutationResult;
 }
 
 export interface IReq_Any_Cloudly_RevokeNodeCredential extends plugins.typedrequestInterfaces.implementsTR<
@@ -96,9 +96,9 @@ export interface IReq_Any_Cloudly_RevokeNodeCredential extends plugins.typedrequ
   method: 'revokeNodeCredential';
   request: {
     identity: IIdentity;
-    mutation: INodeCredentialMutationPreconditionsV1;
+    mutation: INodeCredentialMutationPreconditions;
   };
-  response: INodeCredentialMutationResultV1;
+  response: INodeCredentialMutationResult;
 }
 
 export interface IRequest_Any_Cloudly_GetNodesByCluster {
@@ -238,23 +238,6 @@ export interface IReq_Any_Cloudly_SetClusterNodeCorestoreEndpoint extends plugin
   };
 }
 
-export interface IRequest_Spark_Cloudly_SendHeartbeat extends plugins.typedrequestInterfaces.implementsTR<
-  plugins.typedrequestInterfaces.ITypedRequest,
-  IRequest_Spark_Cloudly_SendHeartbeat
-> {
-  method: 'sparkNodeHeartbeat';
-  request: {
-    nodeId: string;
-    nodeToken: string;
-    metrics: IClusterNodeMetrics;
-    runtimeInfo: ISparkNodeRuntimeInfo;
-  };
-  response: {
-    accepted: boolean;
-    message?: string;
-  };
-}
-
 export interface IReq_Any_Cloudly_CreateNodeAction extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
   IReq_Any_Cloudly_CreateNodeAction

package/ts/requests/pallet.ts

@@ -1,38 +1,38 @@
 import * as plugins from '../plugins.js';
 import type {
-  INodeEnrollmentV1, IPalletNodeEnrollmentActivationV1, IPalletNodeEnrollmentPreparationV1,
-  IPalletNodeEnrollmentBoundV1, IPalletNodeEnrollmentActiveV1,
+  INodeEnrollment, IPalletNodeEnrollmentActivation, IPalletNodeEnrollmentPreparation,
+  IPalletNodeEnrollmentBound, IPalletNodeEnrollmentActive,
 } from '../data/nodeenrollment.js';
 
 /** Root-authenticated node-local IPC only; never expose on a network router. */
-export interface IReq_Spark_Pallet_PrepareNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Spark_Pallet_PrepareNodeEnrollment extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Spark_Pallet_PrepareNodeEnrollmentV1
+  IReq_Spark_Pallet_PrepareNodeEnrollment
 > {
-  method: 'preparePalletNodeEnrollmentV1';
-  request: IPalletNodeEnrollmentPreparationV1;
+  method: 'preparePalletNodeEnrollment';
+  request: IPalletNodeEnrollmentPreparation;
   /** Return only a current pending proposal, never bearer material or a historical preparation. */
-  response: INodeEnrollmentV1['credentials'][1];
+  response: INodeEnrollment['credentials'][1];
 }
 
 /** First enrollment only, not generic credential rotation. */
-export interface IReq_Spark_Pallet_BindNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Spark_Pallet_BindNodeEnrollment extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Spark_Pallet_BindNodeEnrollmentV1
+  IReq_Spark_Pallet_BindNodeEnrollment
 > {
-  method: 'bindPalletNodeEnrollmentV1';
-  request: INodeEnrollmentV1;
+  method: 'bindPalletNodeEnrollment';
+  request: INodeEnrollment;
   /** Issued only after proving the exact durable pending binding. */
-  response: IPalletNodeEnrollmentBoundV1;
+  response: IPalletNodeEnrollmentBound;
 }
 
-export interface IReq_Spark_Pallet_ActivateNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Spark_Pallet_ActivateNodeEnrollment extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Spark_Pallet_ActivateNodeEnrollmentV1
+  IReq_Spark_Pallet_ActivateNodeEnrollment
 > {
-  method: 'activatePalletNodeEnrollmentV1';
+  method: 'activatePalletNodeEnrollment';
   /** The trusted Spark coordinator must authenticate Cloudly before submitting its acknowledgement. */
-  request: IPalletNodeEnrollmentActivationV1;
+  request: IPalletNodeEnrollmentActivation;
   /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
-  response: IPalletNodeEnrollmentActiveV1;
+  response: IPalletNodeEnrollmentActive;
 }

package/ts/requests/runtimesession.ts

@@ -6,39 +6,39 @@ import type * as protection from '../data/networkprotection.js';
 import type * as credential from '../data/networkcredential.js';
 
 /** Current-peer, exact-projection authorization; response contains secret keys. */
-export interface IReq_Pallet_Controller_GetRuntimeManagedVpnCredentialV1 extends plugins.typedrequestInterfaces.implementsTR<
-  plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeManagedVpnCredentialV1
+export interface IReq_Pallet_Controller_GetRuntimeManagedVpnCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeManagedVpnCredential
 > {
-  method: 'getRuntimeManagedVpnCredentialV1';
-  request: credential.IGetRuntimeManagedVpnCredentialRequestV1;
-  response: credential.IGetRuntimeManagedVpnCredentialResponseV1;
+  method: 'getRuntimeManagedVpnCredential';
+  request: credential.IGetRuntimeManagedVpnCredentialRequest;
+  response: credential.IGetRuntimeManagedVpnCredentialResponse;
 }
 
 /** Current authenticated peer reports its durable complete native protection journal. */
-export interface IReq_Pallet_Controller_ReportRuntimeNetworkProtectionV1 extends plugins.typedrequestInterfaces.implementsTR<
-  plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportRuntimeNetworkProtectionV1
+export interface IReq_Pallet_Controller_ReportRuntimeNetworkProtection extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportRuntimeNetworkProtection
 > {
-  method: 'reportRuntimeNetworkProtectionV1';
-  request: protection.IReportRuntimeNetworkProtectionRequestV1;
-  response: protection.IReportRuntimeNetworkProtectionResponseV1;
+  method: 'reportRuntimeNetworkProtection';
+  request: protection.IReportRuntimeNetworkProtectionRequest;
+  response: protection.IReportRuntimeNetworkProtectionResponse;
 }
 
 /** Dedicated signing trust installed only through the current authenticated physical peer. */
-export interface IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthorityV1 extends plugins.typedrequestInterfaces.implementsTR<
-  plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthorityV1
+export interface IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthority extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthority
 > {
-  method: 'applyRuntimeNetworkSigningAuthorityV1';
-  request: network.IApplyRuntimeNetworkSigningAuthorityRequestV1;
-  response: network.IApplyRuntimeNetworkAuthorityResponseV1;
+  method: 'applyRuntimeNetworkSigningAuthority';
+  request: network.IApplyRuntimeNetworkSigningAuthorityRequest;
+  response: network.IApplyRuntimeNetworkAuthorityResponse;
 }
 
 /** Complete signed node state; an ACK asserts admission only. */
-export interface IReq_Controller_Pallet_ApplyRuntimeNetworkProjectionV1 extends plugins.typedrequestInterfaces.implementsTR<
-  plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkProjectionV1
+export interface IReq_Controller_Pallet_ApplyRuntimeNetworkProjection extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkProjection
 > {
-  method: 'applyRuntimeNetworkProjectionV1';
-  request: network.IApplyRuntimeNetworkProjectionRequestV1;
-  response: network.IApplyRuntimeNetworkAuthorityResponseV1;
+  method: 'applyRuntimeNetworkProjection';
+  request: network.IApplyRuntimeNetworkProjectionRequest;
+  response: network.IApplyRuntimeNetworkAuthorityResponse;
 }
 
 /**
@@ -62,62 +62,74 @@ export interface IReq_Controller_Pallet_ApplyRuntimeNetworkDnsLeaseRenewal exten
  * WSS-only Pallet bootstrap. Derive physical peer/idempotency server-side; the registering
  * node process is named by `request.nodeInstanceNonce`, because one relay socket may carry
  * the registrations of every node in a cluster.
+ *
+ * The controller judges the body in the one server order `protocol.readProtocolOffer` states,
+ * negotiating against its `palletRuntime` offer before the body is validated, and answers
+ * `{ session, protocol }`, which `bindRegisterPalletRuntimeSessionResponse` binds to the
+ * request the node sent. A refusal travels as `IProtocolRefusal` in `TypedResponseError.errorData`,
+ * so a node that is refused keeps its workloads and offers again rather than tearing them down.
  */
-export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSession extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1
+  IReq_Pallet_Cloudly_RegisterPalletRuntimeSession
 > {
-  method: 'registerPalletRuntimeSessionV1';
-  request: data.IRegisterPalletRuntimeSessionRequestV1;
-  response: data.IRuntimeSessionBindingV1;
+  method: 'registerPalletRuntimeSession';
+  request: data.IRegisterPalletRuntimeSessionRequest;
+  response: data.IRegisterPalletRuntimeSessionResponse;
 }
 
 /** Controller push over the already authenticated Pallet-initiated connection. */
-export interface IReq_Controller_Pallet_ApplyRuntimeAssignmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Controller_Pallet_ApplyRuntimeAssignment extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Controller_Pallet_ApplyRuntimeAssignmentV1
+  IReq_Controller_Pallet_ApplyRuntimeAssignment
 > {
-  method: 'applyRuntimeAssignmentV1';
-  request: data.IApplyRuntimeAssignmentRequestV1;
-  response: data.IApplyRuntimeAssignmentResponseV1;
+  method: 'applyRuntimeAssignment';
+  request: data.IApplyRuntimeAssignmentRequest;
+  response: data.IApplyRuntimeAssignmentResponse;
 }
 
 /** Current-peer report, including exact historical outbox recovery after reconnect. */
-export interface IReq_Pallet_Controller_ReportRuntimeAssignmentObservationV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Pallet_Controller_ReportRuntimeAssignmentObservation extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Pallet_Controller_ReportRuntimeAssignmentObservationV1
+  IReq_Pallet_Controller_ReportRuntimeAssignmentObservation
 > {
-  method: 'reportRuntimeAssignmentObservationV1';
-  request: data.IReportRuntimeAssignmentObservationRequestV1;
-  response: data.IReportRuntimeAssignmentObservationResponseV1;
+  method: 'reportRuntimeAssignmentObservation';
+  request: data.IReportRuntimeAssignmentObservationRequest;
+  response: data.IReportRuntimeAssignmentObservationResponse;
 }
 
 /** Exact joined terminal-operation receipt; observations and boot changes cannot substitute. */
-export interface IReq_Pallet_Controller_ReportRuntimeAssignmentTerminalReceiptV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Pallet_Controller_ReportRuntimeAssignmentTerminalReceipt extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Pallet_Controller_ReportRuntimeAssignmentTerminalReceiptV1
+  IReq_Pallet_Controller_ReportRuntimeAssignmentTerminalReceipt
 > {
-  method: 'reportRuntimeAssignmentTerminalReceiptV1';
-  request: terminal.IReportRuntimeAssignmentTerminalReceiptRequestV1;
-  response: terminal.IReportRuntimeAssignmentTerminalReceiptResponseV1;
+  method: 'reportRuntimeAssignmentTerminalReceipt';
+  request: terminal.IReportRuntimeAssignmentTerminalReceiptRequest;
+  response: terminal.IReportRuntimeAssignmentTerminalReceiptResponse;
 }
 
 /** Current-peer, exact current assignment authorization; response is secret material. */
-export interface IReq_Pallet_Controller_GetRuntimeRegistryCredentialV1 extends plugins.typedrequestInterfaces.implementsTR<
+export interface IReq_Pallet_Controller_GetRuntimeRegistryCredential extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Pallet_Controller_GetRuntimeRegistryCredentialV1
+  IReq_Pallet_Controller_GetRuntimeRegistryCredential
 > {
-  method: 'getRuntimeRegistryCredentialV1';
-  request: data.IGetRuntimeRegistryCredentialRequestV1;
-  response: data.IGetRuntimeRegistryCredentialResponseV1;
+  method: 'getRuntimeRegistryCredential';
+  request: data.IGetRuntimeRegistryCredentialRequest;
+  response: data.IGetRuntimeRegistryCredentialResponse;
 }
 
-/** WSS-only JWT authentication; server-owned identity tag, never client-authored claims. */
-export interface IReq_Any_Cloudly_RegisterCloudlyClientSessionV1 extends plugins.typedrequestInterfaces.implementsTR<
+/**
+ * WSS-only JWT authentication; server-owned identity tag, never client-authored claims.
+ *
+ * Judged in the order `runtimeSessionContract` states, against the server's `cloudlyClient` offer,
+ * before the JWT is authenticated: a peer of another major is refused by name rather than by a
+ * credential verdict it cannot act on.
+ */
+export interface IReq_Any_Cloudly_RegisterCloudlyClientSession extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
-  IReq_Any_Cloudly_RegisterCloudlyClientSessionV1
+  IReq_Any_Cloudly_RegisterCloudlyClientSession
 > {
-  method: 'registerCloudlyClientSessionV1';
-  request: data.IRegisterCloudlyClientSessionRequestV1;
-  response: data.IRegisterCloudlyClientSessionResponseV1;
+  method: 'registerCloudlyClientSession';
+  request: data.IRegisterCloudlyClientSessionRequest;
+  response: data.IRegisterCloudlyClientSessionResponse;
 }

package/ts/requests/secret.ts

@@ -8,9 +8,9 @@ import type {
   ISecretSetConsumerRolloutStatus,
   ISecretSetMetadata,
   ISecretVersionMetadata,
-  ISecretVersionPurgeIntentV1,
+  ISecretVersionPurgeIntent,
   ISecretVersionRetentionReference,
-  TSecretVersionPurgeOperationV1,
+  TSecretVersionPurgeOperation,
   TSecretMutationTarget,
   TSecretValueInput,
   TSecretDelivery,
@@ -146,7 +146,6 @@ extends plugins.typedrequestInterfaces.implementsTR<
     limit?: number;
   };
   response: {
-    schemaVersion: 1;
     secret: ISecretMetadata;
     version: ISecretVersionMetadata;
     targetSecretsRevision: number;
@@ -156,7 +155,7 @@ extends plugins.typedrequestInterfaces.implementsTR<
     references: ISecretVersionRetentionReference[];
     nextCursor?: string;
     referencesTruncated: boolean;
-    operation?: TSecretVersionPurgeOperationV1;
+    operation?: TSecretVersionPurgeOperation;
   };
 }
 
@@ -172,13 +171,13 @@ extends plugins.typedrequestInterfaces.implementsTR<
   IReq_PurgeSecretVersion
 > {
   method: 'purgeSecretVersion';
-  request: ISecretVersionPurgeIntentV1 & {
+  request: ISecretVersionPurgeIntent & {
     identity: IIdentityCredential;
   };
   response: {
     secret: ISecretMetadata;
     version: ISecretVersionMetadata;
-    operation: TSecretVersionPurgeOperationV1;
+    operation: TSecretVersionPurgeOperation;
     targetSecretsRevision: number;
   };
 }
@@ -565,7 +564,6 @@ export const validateSecretVersionPurgePreflightResponse = async (
     }
     const response = responseArg as Record<string, unknown>;
     const expectedKeys = [
-      'schemaVersion',
       'secret',
       'version',
       'targetSecretsRevision',
@@ -582,9 +580,6 @@ export const validateSecretVersionPurgePreflightResponse = async (
       !== JSON.stringify([...expectedKeys].sort())) {
       errors.push('secret version purge preflight response must use its exact schema');
     }
-    if (response.schemaVersion !== 1) {
-      errors.push('secret version purge preflight response schemaVersion must be 1');
-    }
     if (secretData.validateSecretVersionMetadata(response.version).length > 0) {
       errors.push('secret version purge preflight version must be canonical');
     }