@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/runtime.corestore.ts

@@ -10,11 +10,11 @@ import {
   validateSecretRecipientMetadata,
   verifySecretEnvelopeContext,
 } from './data/secret.js';
-import type { ISecretEnvelopeAdmissionBindingV1 } from './runtime.js';
+import type { ISecretEnvelopeAdmissionBinding } from './runtime.js';
 import type {
-  IObjectStorageRetentionIntentV1,
-  IObjectStorageRetentionEvidenceExpectationV1,
-  IObjectStorageRetentionEvidenceV1,
+  IObjectStorageRetentionIntent,
+  IObjectStorageRetentionEvidenceExpectation,
+  IObjectStorageRetentionEvidence,
 } from './platform/objectstorageretention.js';
 import {
   validateObjectStorageRetentionEvidence,
@@ -26,6 +26,7 @@ import {
   createCanonicalJsonSha256Hex,
   deepFreezeValue,
 } from './private/canonicaljson.js';
+import { hasExactKeys } from './private/dataproperties.js';
 
 export type TCorestoreCredentialCapability = 'database' | 'objectstorage';
 
@@ -58,15 +59,13 @@ export const getCorestoreProviderConfigId = (
   return corestoreProviderConfigIds[capabilityArg];
 };
 
-export interface ICorestoreControlCredentialPlaintextV1 {
-  schemaVersion: 1;
+export interface ICorestoreControlCredentialPlaintext {
   key: typeof corestoreControlCredentialKey;
   environment: typeof corestoreCredentialEnvironment;
   value: string;
 }
 
-export interface ICorestoreControlCredentialMaterialV1 {
-  schemaVersion: 1;
+export interface ICorestoreControlCredentialMaterial {
   requestId: string;
   clusterId: string;
   capability: TCorestoreCredentialCapability;
@@ -94,11 +93,11 @@ extends plugins.typedrequestInterfaces.implementsTR<
     expectedRecipientGeneration: number;
   };
   response: {
-    material: ICorestoreControlCredentialMaterialV1;
+    material: ICorestoreControlCredentialMaterial;
   };
 }
 
-export interface ICorestoreControlCredentialMaterialExpectationV1 {
+export interface ICorestoreControlCredentialMaterialExpectation {
   requestId: string;
   clusterId: string;
   capability: TCorestoreCredentialCapability;
@@ -106,7 +105,7 @@ export interface ICorestoreControlCredentialMaterialExpectationV1 {
   expectedRecipientGeneration: number;
 }
 
-export interface ICorestoreControlCredentialMaterialContextInputV1 {
+export interface ICorestoreControlCredentialMaterialContextInput {
   requestId: string;
   clusterId: string;
   capability: TCorestoreCredentialCapability;
@@ -116,7 +115,6 @@ export interface ICorestoreControlCredentialMaterialContextInputV1 {
 
 const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
 const bareSha256Pattern = /^[a-f0-9]{64}$/;
-const environmentKeyPattern = /^[A-Z_][A-Z0-9_]{0,127}$/;
 
 const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> => (
   Boolean(valueArg)
@@ -126,24 +124,6 @@ const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> => (
     || Object.getPrototypeOf(valueArg) === null)
 );
 
-const hasExactKeys = (
-  valueArg: Record<string, unknown>,
-  keysArg: readonly string[],
-): boolean => {
-  const actual = Object.keys(valueArg).sort();
-  const expected = [...keysArg].sort();
-  return actual.length === expected.length
-    && actual.every((keyArg, indexArg) => keyArg === expected[indexArg]);
-};
-
-const hasKeys = (
-  valueArg: Record<string, unknown>,
-  requiredArg: readonly string[],
-  optionalArg: readonly string[],
-): boolean => requiredArg.every((keyArg) => Object.hasOwn(valueArg, keyArg))
-  && Object.keys(valueArg).every((keyArg) => requiredArg.includes(keyArg)
-    || optionalArg.includes(keyArg));
-
 const isIdentifier = (valueArg: unknown): valueArg is string => (
   typeof valueArg === 'string' && identifierPattern.test(valueArg)
 );
@@ -243,7 +223,7 @@ export const createCorestoreControlCredentialPlaintextBytes = (
 ): Uint8Array | undefined => {
   if (!isCorestoreControlTokenBytes(tokenBytesArg)) return undefined;
   const prefix = new TextEncoder().encode(
-    `{"schemaVersion":1,"key":"${corestoreControlCredentialKey}","environment":"${
+    `{"key":"${corestoreControlCredentialKey}","environment":"${
       corestoreCredentialEnvironment
     }","value":"`,
   );
@@ -309,9 +289,8 @@ export const validateGetCorestoreControlCredentialMaterialRequest = (
 };
 
 export const createCorestoreControlCredentialMaterialEnvelopeContext = (
-  materialArg: ICorestoreControlCredentialMaterialContextInputV1,
+  materialArg: ICorestoreControlCredentialMaterialContextInput,
 ): Uint8Array => new TextEncoder().encode(JSON.stringify({
-  schemaVersion: 1,
   purpose: 'serve.zone/corestore-control-credential-material',
   requestId: materialArg.requestId,
   clusterId: materialArg.clusterId,
@@ -329,12 +308,11 @@ export const validateCorestoreControlCredentialPlaintext = (
   plaintextArg: unknown,
 ): string[] => {
   if (!isRecord(plaintextArg)
-    || !hasExactKeys(plaintextArg, ['schemaVersion', 'key', 'environment', 'value'])) {
+    || !hasExactKeys(plaintextArg, ['key', 'environment', 'value'])) {
     return ['corestore control credential plaintext must use its exact schema'];
   }
   const errors: string[] = [];
-  if (plaintextArg.schemaVersion !== 1
-    || plaintextArg.key !== corestoreControlCredentialKey
+  if (plaintextArg.key !== corestoreControlCredentialKey
     || plaintextArg.environment !== corestoreCredentialEnvironment) {
     errors.push('corestore control credential plaintext constants must be canonical');
   }
@@ -346,11 +324,10 @@ export const validateCorestoreControlCredentialPlaintext = (
 
 export const validateCorestoreControlCredentialMaterial = async (
   materialArg: unknown,
-  expectedArg: ICorestoreControlCredentialMaterialExpectationV1,
+  expectedArg: ICorestoreControlCredentialMaterialExpectation,
 ): Promise<string[]> => {
   if (!isRecord(materialArg)
     || !hasExactKeys(materialArg, [
-      'schemaVersion',
       'requestId',
       'clusterId',
       'capability',
@@ -366,8 +343,7 @@ export const validateCorestoreControlCredentialMaterial = async (
     return ['corestore control credential material must use its exact schema'];
   }
   const errors: string[] = [];
-  if (materialArg.schemaVersion !== 1
-    || !isIdentifier(materialArg.requestId)
+  if (!isIdentifier(materialArg.requestId)
     || !isIdentifier(materialArg.clusterId)
     || !isIdentifier(materialArg.recipientKeyId)
     || !isPositiveSafeInteger(materialArg.recipientGeneration)) {
@@ -407,7 +383,7 @@ export const validateCorestoreControlCredentialMaterial = async (
     } else if (errors.length === 0 && !await verifySecretEnvelopeContext(
       envelope,
       createCorestoreControlCredentialMaterialEnvelopeContext(
-        materialArg as unknown as ICorestoreControlCredentialMaterialContextInputV1,
+        materialArg as unknown as ICorestoreControlCredentialMaterialContextInput,
       ),
     )) {
       errors.push('corestore control credential envelope context must match');
@@ -416,8 +392,7 @@ export const validateCorestoreControlCredentialMaterial = async (
   return errors;
 };
 
-export interface ICorestoreCredentialPublicationGrantV1 {
-  schemaVersion: 1;
+export interface ICorestoreCredentialPublicationGrant {
   operationId: string;
   serviceId: string;
   bindingId: string;
@@ -429,26 +404,7 @@ export interface ICorestoreCredentialPublicationGrantV1 {
   expiresAt: number;
 }
 
-interface ICorestoreCredentialBindingRequestBaseV1 {
-  schemaVersion: 1;
-  serviceId: string;
-  bindingId: string;
-  providerConfigId: typeof corestoreProviderConfigIds[TCorestoreCredentialCapability];
-  managementScope: typeof corestoreCredentialManagementScope;
-  environment: typeof corestoreCredentialEnvironment;
-}
-
-export type TCorestoreCredentialBindingRequestV1 =
-  | ICorestoreCredentialBindingRequestBaseV1 & {
-      capability: 'database';
-    }
-  | ICorestoreCredentialBindingRequestBaseV1 & {
-      capability: 'objectstorage';
-      objectstorageRetention?: IObjectStorageRetentionIntentV1;
-    };
-
-interface ICorestoreCredentialBindingRequestBaseV2 {
-  schemaVersion: 2;
+interface ICorestoreCredentialBindingRequestBase {
   serviceId: string;
   bindingId: string;
   providerConfigId: typeof corestoreProviderConfigIds[TCorestoreCredentialCapability];
@@ -456,16 +412,20 @@ interface ICorestoreCredentialBindingRequestBaseV2 {
   environment: typeof corestoreCredentialEnvironment;
 }
 
-export type TCorestoreCredentialBindingRequestV2 =
-  | ICorestoreCredentialBindingRequestBaseV2 & {
+export type TCorestoreCredentialBindingRequest =
+  | ICorestoreCredentialBindingRequestBase & {
       capability: 'database';
     }
-  | ICorestoreCredentialBindingRequestBaseV2 & {
+  | ICorestoreCredentialBindingRequestBase & {
       capability: 'objectstorage';
       bucketName: string;
-      objectstorageRetention?: IObjectStorageRetentionIntentV1;
+      objectstorageRetention?: IObjectStorageRetentionIntent;
     };
 
+const failBindingRequest = (reasonArg: string): never => {
+  throw new Error(reasonArg);
+};
+
 export const validateCorestoreCredentialBindingRequest = (
   requestArg: unknown,
 ): string[] => {
@@ -473,7 +433,6 @@ export const validateCorestoreCredentialBindingRequest = (
     return ['corestore credential binding request must use its exact schema'];
   }
   const baseKeys = [
-    'schemaVersion',
     'serviceId',
     'bindingId',
     'capability',
@@ -486,7 +445,7 @@ export const validateCorestoreCredentialBindingRequest = (
       return ['corestore database credential binding request must use its exact schema'];
     }
   } else if (requestArg.capability === 'objectstorage') {
-    if (!hasKeys(requestArg, baseKeys, ['objectstorageRetention'])) {
+    if (!hasExactKeys(requestArg, [...baseKeys, 'bucketName'], ['objectstorageRetention'])) {
       return ['corestore objectstorage credential binding request must use its exact schema'];
     }
   } else {
@@ -494,8 +453,7 @@ export const validateCorestoreCredentialBindingRequest = (
   }
 
   const errors: string[] = [];
-  if (requestArg.schemaVersion !== 1
-    || !isIdentifier(requestArg.serviceId)
+  if (!isIdentifier(requestArg.serviceId)
     || !isIdentifier(requestArg.bindingId)) {
     errors.push('corestore credential binding request identity must be canonical');
   }
@@ -504,113 +462,27 @@ export const validateCorestoreCredentialBindingRequest = (
     || requestArg.environment !== corestoreCredentialEnvironment) {
     errors.push('corestore credential binding request constants must be canonical');
   }
-  if (requestArg.capability === 'objectstorage'
-    && requestArg.objectstorageRetention !== undefined) {
-    errors.push(...validateObjectStorageRetentionIntent(
-      requestArg.objectstorageRetention,
-      'corestore objectstorage credential binding request retention',
-    ));
-  }
-  return errors;
-};
-
-const failBindingRequest = (reasonArg: string): never => {
-  throw new Error(reasonArg);
-};
-
-export const createCorestoreCredentialBindingRequestDigestInput = (
-  requestArg: TCorestoreCredentialBindingRequestV1,
-): string => {
-  const errors = validateCorestoreCredentialBindingRequest(requestArg);
-  if (errors.length > 0) throw new Error(errors[0]);
-  return canonicalizeStrictJson({
-    schemaVersion: requestArg.schemaVersion,
-    serviceId: requestArg.serviceId,
-    bindingId: requestArg.bindingId,
-    capability: requestArg.capability,
-    providerConfigId: requestArg.providerConfigId,
-    managementScope: requestArg.managementScope,
-    environment: requestArg.environment,
-    ...(requestArg.capability === 'objectstorage' && requestArg.objectstorageRetention
-      ? {
-          objectstorageRetention: {
-            mode: requestArg.objectstorageRetention.mode,
-            policyId: requestArg.objectstorageRetention.policyId,
-            retentionDurationSeconds:
-              requestArg.objectstorageRetention.retentionDurationSeconds,
-          },
-        }
-      : {}),
-  }, failBindingRequest, 'corestore credential binding request');
-};
-
-export const computeCorestoreCredentialBindingRequestSha256 = async (
-  requestArg: TCorestoreCredentialBindingRequestV1,
-): Promise<string> => createCanonicalJsonSha256Hex(
-  createCorestoreCredentialBindingRequestDigestInput(requestArg),
-  failBindingRequest,
-);
-
-export const validateCorestoreCredentialBindingRequestV2 = (
-  requestArg: unknown,
-): string[] => {
-  if (!isRecord(requestArg)) {
-    return ['corestore credential binding request v2 must use its exact schema'];
-  }
-  const baseKeys = [
-    'schemaVersion',
-    'serviceId',
-    'bindingId',
-    'capability',
-    'providerConfigId',
-    'managementScope',
-    'environment',
-  ];
-  if (requestArg.capability === 'database') {
-    if (!hasExactKeys(requestArg, baseKeys)) {
-      return ['corestore database credential binding request v2 must use its exact schema'];
-    }
-  } else if (requestArg.capability === 'objectstorage') {
-    if (!hasKeys(requestArg, [...baseKeys, 'bucketName'], ['objectstorageRetention'])) {
-      return ['corestore objectstorage credential binding request v2 must use its exact schema'];
-    }
-  } else {
-    return ['corestore credential binding request v2 capability must be canonical'];
-  }
-
-  const errors: string[] = [];
-  if (requestArg.schemaVersion !== 2
-    || !isIdentifier(requestArg.serviceId)
-    || !isIdentifier(requestArg.bindingId)) {
-    errors.push('corestore credential binding request v2 identity must be canonical');
-  }
-  if (requestArg.providerConfigId !== getCorestoreProviderConfigId(requestArg.capability)
-    || requestArg.managementScope !== corestoreCredentialManagementScope
-    || requestArg.environment !== corestoreCredentialEnvironment) {
-    errors.push('corestore credential binding request v2 constants must be canonical');
-  }
   if (requestArg.capability === 'objectstorage') {
     errors.push(...validatePlatformObjectStorageBucketName(
       requestArg.bucketName,
-      'corestore objectstorage credential binding request v2 bucketName',
+      'corestore objectstorage credential binding request bucketName',
     ));
     if (requestArg.objectstorageRetention !== undefined) {
       errors.push(...validateObjectStorageRetentionIntent(
         requestArg.objectstorageRetention,
-        'corestore objectstorage credential binding request v2 retention',
+        'corestore objectstorage credential binding request retention',
       ));
     }
   }
   return errors;
 };
 
-export const createCorestoreCredentialBindingRequestDigestInputV2 = (
-  requestArg: TCorestoreCredentialBindingRequestV2,
+export const createCorestoreCredentialBindingRequestDigestInput = (
+  requestArg: TCorestoreCredentialBindingRequest,
 ): string => {
-  const errors = validateCorestoreCredentialBindingRequestV2(requestArg);
+  const errors = validateCorestoreCredentialBindingRequest(requestArg);
   if (errors.length > 0) throw new Error(errors[0]);
   return canonicalizeStrictJson({
-    schemaVersion: requestArg.schemaVersion,
     serviceId: requestArg.serviceId,
     bindingId: requestArg.bindingId,
     capability: requestArg.capability,
@@ -632,13 +504,13 @@ export const createCorestoreCredentialBindingRequestDigestInputV2 = (
             : {}),
         }
       : {}),
-  }, failBindingRequest, 'corestore credential binding request v2');
+  }, failBindingRequest, 'corestore credential binding request');
 };
 
-export const computeCorestoreCredentialBindingRequestSha256V2 = async (
-  requestArg: TCorestoreCredentialBindingRequestV2,
+export const computeCorestoreCredentialBindingRequestSha256 = async (
+  requestArg: TCorestoreCredentialBindingRequest,
 ): Promise<string> => createCanonicalJsonSha256Hex(
-  createCorestoreCredentialBindingRequestDigestInputV2(requestArg),
+  createCorestoreCredentialBindingRequestDigestInput(requestArg),
   failBindingRequest,
 );
 
@@ -648,7 +520,6 @@ export const validateCorestoreCredentialPublicationGrant = (
 ): string[] => {
   if (!isRecord(grantArg)
     || !hasExactKeys(grantArg, [
-      'schemaVersion',
       'operationId',
       'serviceId',
       'bindingId',
@@ -662,9 +533,6 @@ export const validateCorestoreCredentialPublicationGrant = (
     return ['corestore credential publication grant must use its exact schema'];
   }
   const errors: string[] = [];
-  if (grantArg.schemaVersion !== 1) {
-    errors.push('corestore credential publication grant schemaVersion must be 1');
-  }
   if (!isIdentifier(grantArg.operationId)
     || !isIdentifier(grantArg.serviceId)
     || !isIdentifier(grantArg.bindingId)) {
@@ -702,30 +570,28 @@ export const corestoreCredentialPublicationGrantsEqual = (
   rightArg: unknown,
 ): boolean => validateCorestoreCredentialPublicationGrant(leftArg).length === 0
   && validateCorestoreCredentialPublicationGrant(rightArg).length === 0
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).schemaVersion
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).schemaVersion
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).operationId
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).operationId
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).serviceId
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).serviceId
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).bindingId
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).bindingId
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).capability
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).capability
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).reconciliationGeneration
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).reconciliationGeneration
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).expectedTargetSecretsRevision
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).expectedTargetSecretsRevision
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).bindingRequestDigest
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).bindingRequestDigest
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).issuedAt
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).issuedAt
-  && (leftArg as ICorestoreCredentialPublicationGrantV1).expiresAt
-    === (rightArg as ICorestoreCredentialPublicationGrantV1).expiresAt;
+  && (leftArg as ICorestoreCredentialPublicationGrant).operationId
+    === (rightArg as ICorestoreCredentialPublicationGrant).operationId
+  && (leftArg as ICorestoreCredentialPublicationGrant).serviceId
+    === (rightArg as ICorestoreCredentialPublicationGrant).serviceId
+  && (leftArg as ICorestoreCredentialPublicationGrant).bindingId
+    === (rightArg as ICorestoreCredentialPublicationGrant).bindingId
+  && (leftArg as ICorestoreCredentialPublicationGrant).capability
+    === (rightArg as ICorestoreCredentialPublicationGrant).capability
+  && (leftArg as ICorestoreCredentialPublicationGrant).reconciliationGeneration
+    === (rightArg as ICorestoreCredentialPublicationGrant).reconciliationGeneration
+  && (leftArg as ICorestoreCredentialPublicationGrant).expectedTargetSecretsRevision
+    === (rightArg as ICorestoreCredentialPublicationGrant).expectedTargetSecretsRevision
+  && (leftArg as ICorestoreCredentialPublicationGrant).bindingRequestDigest
+    === (rightArg as ICorestoreCredentialPublicationGrant).bindingRequestDigest
+  && (leftArg as ICorestoreCredentialPublicationGrant).issuedAt
+    === (rightArg as ICorestoreCredentialPublicationGrant).issuedAt
+  && (leftArg as ICorestoreCredentialPublicationGrant).expiresAt
+    === (rightArg as ICorestoreCredentialPublicationGrant).expiresAt;
 
 const comparePublicationGrants = (
-  leftArg: ICorestoreCredentialPublicationGrantV1,
-  rightArg: ICorestoreCredentialPublicationGrantV1,
+  leftArg: ICorestoreCredentialPublicationGrant,
+  rightArg: ICorestoreCredentialPublicationGrant,
 ): number => leftArg.bindingId < rightArg.bindingId
   ? -1
   : leftArg.bindingId > rightArg.bindingId
@@ -745,12 +611,12 @@ export const validateCorestoreCredentialPublicationGrants = (
     return ['corestore credential publication grants must be a bounded array'];
   }
   const errors: string[] = [];
-  let previous: ICorestoreCredentialPublicationGrantV1 | undefined;
+  let previous: ICorestoreCredentialPublicationGrant | undefined;
   for (const [index, grantArg] of grantsArg.entries()) {
     const grantErrors = validateCorestoreCredentialPublicationGrant(grantArg, trustedNowArg);
     errors.push(...grantErrors.map((errorArg) => `publication grants[${index}] ${errorArg}`));
     if (grantErrors.length === 0) {
-      const grant = grantArg as ICorestoreCredentialPublicationGrantV1;
+      const grant = grantArg as ICorestoreCredentialPublicationGrant;
       if (previous && comparePublicationGrants(previous, grant) >= 0) {
         errors.push('corestore credential publication grants must be unique and sorted by bindingId then operationId');
       }
@@ -798,29 +664,27 @@ export type TCorestoreCredentialSecretKey =
   | TCorestoreDatabaseCredentialKey
   | TCorestoreObjectStorageCredentialSecretKey;
 
-export type TCorestoreDatabaseCredentialValuesV1 = {
+export type TCorestoreDatabaseCredentialValues = {
   [TKey in TCorestoreDatabaseCredentialKey]: string;
 };
 
-export interface ICorestoreDatabaseCredentialPlaintextMaterialV1 {
-  schemaVersion: 1;
+export interface ICorestoreDatabaseCredentialPlaintextMaterial {
   capability: 'database';
-  values: TCorestoreDatabaseCredentialValuesV1;
+  values: TCorestoreDatabaseCredentialValues;
 }
 
-export interface ICorestoreObjectStorageCredentialPlaintextMaterialV1 {
-  schemaVersion: 1;
+export interface ICorestoreObjectStorageCredentialPlaintextMaterial {
   capability: 'objectstorage';
   values: {
     accessKeyId: string;
     secretAccessKey: string;
   };
-  retention?: IObjectStorageRetentionEvidenceV1;
+  retention?: IObjectStorageRetentionEvidence;
 }
 
-export type TCorestoreCredentialPlaintextMaterialV1 =
-  | ICorestoreDatabaseCredentialPlaintextMaterialV1
-  | ICorestoreObjectStorageCredentialPlaintextMaterialV1;
+export type TCorestoreCredentialPlaintextMaterial =
+  | ICorestoreDatabaseCredentialPlaintextMaterial
+  | ICorestoreObjectStorageCredentialPlaintextMaterial;
 
 const readCredentialString = (valueArg: unknown): boolean => typeof valueArg === 'string'
   && valueArg.length > 0
@@ -831,8 +695,7 @@ export const validateCorestoreDatabaseCredentialMaterial = (
   materialArg: unknown,
 ): string[] => {
   if (!isRecord(materialArg)
-    || !hasExactKeys(materialArg, ['schemaVersion', 'capability', 'values'])
-    || materialArg.schemaVersion !== 1
+    || !hasExactKeys(materialArg, ['capability', 'values'])
     || materialArg.capability !== 'database'
     || !isRecord(materialArg.values)
     || !hasExactKeys(materialArg.values, corestoreDatabaseCredentialKeys)) {
@@ -866,11 +729,10 @@ export const validateCorestoreDatabaseCredentialMaterial = (
 
 export const validateCorestoreObjectStorageCredentialMaterial = async (
   materialArg: unknown,
-  retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectationV1,
+  retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectation,
 ): Promise<string[]> => {
   if (!isRecord(materialArg)
-    || !hasKeys(materialArg, ['schemaVersion', 'capability', 'values'], ['retention'])
-    || materialArg.schemaVersion !== 1
+    || !hasExactKeys(materialArg, ['capability', 'values'], ['retention'])
     || materialArg.capability !== 'objectstorage'
     || !isRecord(materialArg.values)
     || !hasExactKeys(materialArg.values, corestoreObjectStorageCredentialPlaintextKeys)) {
@@ -898,20 +760,20 @@ export const validateCorestoreObjectStorageCredentialMaterial = async (
 
 export const validateCorestoreCredentialPlaintextMaterial = async (
   materialArg: unknown,
-  retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectationV1,
+  retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectation,
 ): Promise<string[]> => isRecord(materialArg) && materialArg.capability === 'database'
   ? validateCorestoreDatabaseCredentialMaterial(materialArg)
   : validateCorestoreObjectStorageCredentialMaterial(materialArg, retentionExpectationArg);
 
-export interface ICorestoreCredentialSecretValueV1 {
+export interface ICorestoreCredentialSecretValue {
   key: TCorestoreCredentialSecretKey;
   value: string;
 }
 
 export const createCorestoreCredentialSecretValues = async (
-  materialArg: TCorestoreCredentialPlaintextMaterialV1,
-  retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectationV1,
-): Promise<ICorestoreCredentialSecretValueV1[]> => {
+  materialArg: TCorestoreCredentialPlaintextMaterial,
+  retentionExpectationArg?: IObjectStorageRetentionEvidenceExpectation,
+): Promise<ICorestoreCredentialSecretValue[]> => {
   const errors = await validateCorestoreCredentialPlaintextMaterial(
     materialArg,
     retentionExpectationArg,
@@ -933,38 +795,37 @@ export const createCorestoreCredentialSecretValues = async (
   }));
 };
 
-export interface IPublishCorestoreCredentialMaterialRequestV1 {
+export interface IPublishCorestoreCredentialMaterialRequest {
   identity: IIdentityCredential;
   mutationId: string;
-  grant: ICorestoreCredentialPublicationGrantV1;
+  grant: ICorestoreCredentialPublicationGrant;
   expectedIngressRecipientKeyId: string;
   expectedIngressRecipientGeneration: number;
   envelope: plugins.smartcrypto.IX25519EnvelopeV1;
 }
 
-export interface ICorestoreCredentialSecretVersionReferenceV1
+export interface ICorestoreCredentialSecretVersionReference
 extends ISecretVersionReference {
   key: TCorestoreCredentialSecretKey;
 }
 
-export interface ICorestoreCredentialPublicationCoverageV1 {
+export interface ICorestoreCredentialPublicationCoverage {
   keys: TCorestoreCredentialSecretKey[];
-  versionReferences: ICorestoreCredentialSecretVersionReferenceV1[];
+  versionReferences: ICorestoreCredentialSecretVersionReference[];
 }
 
-export interface ICorestoreCredentialPublicationReceiptV1 {
-  schemaVersion: 1;
+export interface ICorestoreCredentialPublicationReceipt {
   mutationId: string;
   organizationId: string;
   clusterId: string;
   serviceId: string;
   bindingId: string;
   capability: TCorestoreCredentialCapability;
-  grant: ICorestoreCredentialPublicationGrantV1;
-  coverage: ICorestoreCredentialPublicationCoverageV1;
+  grant: ICorestoreCredentialPublicationGrant;
+  coverage: ICorestoreCredentialPublicationCoverage;
   expectedTargetSecretsRevision: number;
   targetSecretsRevision: number;
-  ingressAdmissionBinding: ISecretEnvelopeAdmissionBindingV1;
+  ingressAdmissionBinding: ISecretEnvelopeAdmissionBinding;
   acceptedAt: number;
   replayed: boolean;
 }
@@ -975,20 +836,18 @@ extends plugins.typedrequestInterfaces.implementsTR<
   IReq_PublishCorestoreCredentialMaterial
 > {
   method: 'publishCorestoreCredentialMaterial';
-  request: IPublishCorestoreCredentialMaterialRequestV1;
+  request: IPublishCorestoreCredentialMaterialRequest;
   response: {
-    receipt: ICorestoreCredentialPublicationReceiptV1;
+    receipt: ICorestoreCredentialPublicationReceipt;
   };
 }
 
 export const createPublishCorestoreCredentialMaterialEnvelopeContext = (
-  requestArg: Omit<IPublishCorestoreCredentialMaterialRequestV1, 'identity' | 'envelope'>,
+  requestArg: Omit<IPublishCorestoreCredentialMaterialRequest, 'identity' | 'envelope'>,
 ): Uint8Array => new TextEncoder().encode(JSON.stringify({
-  schemaVersion: 1,
   purpose: 'serve.zone/publish-corestore-credential-material',
   mutationId: requestArg.mutationId,
   grant: {
-    schemaVersion: requestArg.grant.schemaVersion,
     operationId: requestArg.grant.operationId,
     serviceId: requestArg.grant.serviceId,
     bindingId: requestArg.grant.bindingId,
@@ -1005,7 +864,7 @@ export const createPublishCorestoreCredentialMaterialEnvelopeContext = (
 
 export const validatePublishCorestoreCredentialMaterialRequest = async (
   requestArg: unknown,
-  expectedGrantArg: ICorestoreCredentialPublicationGrantV1,
+  expectedGrantArg: ICorestoreCredentialPublicationGrant,
   activeRecipientArg: IActiveSecretRecipientMetadata,
   trustedNowArg: number,
 ): Promise<string[]> => {
@@ -1055,7 +914,7 @@ export const validatePublishCorestoreCredentialMaterialRequest = async (
       envelope,
       createPublishCorestoreCredentialMaterialEnvelopeContext(
         requestArg as unknown as Omit<
-          IPublishCorestoreCredentialMaterialRequestV1,
+          IPublishCorestoreCredentialMaterialRequest,
           'identity' | 'envelope'
         >,
       ),
@@ -1072,8 +931,8 @@ const expectedCoverageKeys = (
   ? corestoreDatabaseCredentialKeys
   : corestoreObjectStorageCredentialSecretKeys;
 
-export interface ICorestoreCredentialPublicationReceiptExpectationV1 {
-  request: IPublishCorestoreCredentialMaterialRequestV1;
+export interface ICorestoreCredentialPublicationReceiptExpectation {
+  request: IPublishCorestoreCredentialMaterialRequest;
   organizationId: string;
   clusterId: string;
 }
@@ -1087,7 +946,7 @@ const computeRuntimeSha256 = async (valueArg: Uint8Array): Promise<string> => {
 };
 
 const verifyPublicationAdmissionBinding = async (
-  bindingArg: ISecretEnvelopeAdmissionBindingV1,
+  bindingArg: ISecretEnvelopeAdmissionBinding,
   envelopeArg: unknown,
   contextArg: Uint8Array,
 ): Promise<boolean> => {
@@ -1118,11 +977,10 @@ const verifyPublicationAdmissionBinding = async (
 
 export const validateCorestoreCredentialPublicationReceipt = async (
   receiptArg: unknown,
-  expectedArg: ICorestoreCredentialPublicationReceiptExpectationV1,
+  expectedArg: ICorestoreCredentialPublicationReceiptExpectation,
 ): Promise<string[]> => {
   if (!isRecord(receiptArg)
     || !hasExactKeys(receiptArg, [
-      'schemaVersion',
       'mutationId',
       'organizationId',
       'clusterId',
@@ -1140,15 +998,14 @@ export const validateCorestoreCredentialPublicationReceipt = async (
     return ['corestore credential publication receipt must use its exact schema'];
   }
   const errors = validateCorestoreCredentialPublicationGrant(receiptArg.grant);
-  if (receiptArg.schemaVersion !== 1
-    || !isIdentifier(receiptArg.mutationId)
+  if (!isIdentifier(receiptArg.mutationId)
     || !isIdentifier(receiptArg.organizationId)
     || !isIdentifier(receiptArg.clusterId)
     || !isIdentifier(receiptArg.serviceId)
     || !isIdentifier(receiptArg.bindingId)) {
     errors.push('corestore credential publication receipt identifiers must be canonical');
   }
-  const grant = receiptArg.grant as ICorestoreCredentialPublicationGrantV1;
+  const grant = receiptArg.grant as ICorestoreCredentialPublicationGrant;
   if ((receiptArg.capability !== 'database' && receiptArg.capability !== 'objectstorage')
     || receiptArg.serviceId !== grant.serviceId
     || receiptArg.bindingId !== grant.bindingId
@@ -1206,13 +1063,11 @@ export const validateCorestoreCredentialPublicationReceipt = async (
   const admission = receiptArg.ingressAdmissionBinding;
   if (!isRecord(admission)
     || !hasExactKeys(admission, [
-      'schemaVersion',
       'recipientKeyId',
       'recipientGeneration',
       'envelopeDigest',
       'requestContextDigest',
     ])
-    || admission.schemaVersion !== 1
     || !isIdentifier(admission.recipientKeyId)
     || !isPositiveSafeInteger(admission.recipientGeneration)
     || typeof admission.envelopeDigest !== 'string'
@@ -1223,7 +1078,7 @@ export const validateCorestoreCredentialPublicationReceipt = async (
   } else if (admission.recipientKeyId !== expectedArg.request.expectedIngressRecipientKeyId
     || admission.recipientGeneration !== expectedArg.request.expectedIngressRecipientGeneration
     || !await verifyPublicationAdmissionBinding(
-      admission as unknown as ISecretEnvelopeAdmissionBindingV1,
+      admission as unknown as ISecretEnvelopeAdmissionBinding,
       expectedArg.request.envelope,
       createPublishCorestoreCredentialMaterialEnvelopeContext(expectedArg.request),
     )) {
@@ -1255,16 +1110,14 @@ export const corestoreCredentialPublicationErrorMetadata = Object.freeze({
 export type TCorestoreCredentialPublicationErrorCode =
   keyof typeof corestoreCredentialPublicationErrorMetadata;
 
-export interface ICorestoreCredentialPublicationErrorMetadataV1 {
-  schemaVersion: 1;
+export interface ICorestoreCredentialPublicationErrorMetadata {
   code: TCorestoreCredentialPublicationErrorCode;
   retryable: boolean;
 }
 
 export const getCorestoreCredentialPublicationErrorMetadata = (
   codeArg: TCorestoreCredentialPublicationErrorCode,
-): ICorestoreCredentialPublicationErrorMetadataV1 => ({
-  schemaVersion: 1,
+): ICorestoreCredentialPublicationErrorMetadata => ({
   code: codeArg,
   retryable: corestoreCredentialPublicationErrorMetadata[codeArg].retryable,
 });
@@ -1313,7 +1166,6 @@ export interface ICorestoreDatabaseBackupSnapshot {
 }
 
 export interface ICorestoreDatabaseBackupClosureReceipt {
-  formatVersion: 1;
   snapshotIds: [string];
   objectCount: number;
   packCount: number;
@@ -1323,9 +1175,22 @@ export interface ICorestoreDatabaseBackupClosureReceipt {
   sha256: string;
 }
 
+/**
+ * The media type a Corestore database backup archive is served and stored under.
+ *
+ * Defined once here because four processes state it — Corestore's control server and its export
+ * packager, Onebox and the cluster relay — and a content type that two of them spell differently
+ * is a transfer that fails at the last hop instead of at the first. Every one of them imports this
+ * constant rather than writing the bytes again.
+ */
+export const corestoreDatabaseBackupMediaType =
+  'application/vnd.serve-zone.corestore-database-backup' as const;
+
+/** The format a backup receipt states, which is this media type's payload contract. */
+export const corestoreDatabaseBackupFormat = 'corestore.database.backup' as const;
+
 export interface ICorestoreDatabaseBackupReceipt {
-  schemaVersion: 1;
-  format: 'corestore.database.backup.v1';
+  format: typeof corestoreDatabaseBackupFormat;
   backupId: string;
   sourceServiceId: string;
   createdAt: number;
@@ -1334,7 +1199,6 @@ export interface ICorestoreDatabaseBackupReceipt {
 }
 
 export interface ICorestoreDatabaseBackupRestoreRequest {
-  schemaVersion: 1;
   targetServiceId: string;
   receipt: ICorestoreDatabaseBackupReceipt;
   expectedDatabaseAllocation?: ICorestoreDatabaseAllocationReference;
@@ -1343,7 +1207,6 @@ export interface ICorestoreDatabaseBackupRestoreRequest {
 }
 
 export interface ICorestoreDatabaseBackupRestoreResponse {
-  schemaVersion: 1;
   ok: true;
   backupId: string;
   sourceServiceId: string;
@@ -1498,7 +1361,6 @@ const normalizeCorestoreDatabaseBackupReceiptInternal = (
 ): ICorestoreDatabaseBackupReceipt => {
   const value = readCorestoreDatabaseBackupRecord(valueArg, pathArg);
   assertCorestoreDatabaseBackupExactKeys(value, [
-    'schemaVersion',
     'format',
     'backupId',
     'sourceServiceId',
@@ -1506,8 +1368,8 @@ const normalizeCorestoreDatabaseBackupReceiptInternal = (
     'snapshot',
     'closure',
   ], pathArg);
-  if (value.schemaVersion !== 1 || value.format !== 'corestore.database.backup.v1') {
-    failCorestoreDatabaseBackup(`${pathArg} version must be canonical`);
+  if (value.format !== corestoreDatabaseBackupFormat) {
+    failCorestoreDatabaseBackup(`${pathArg} format must be canonical`);
   }
   const backupId = readCorestoreDatabaseBackupIdentifier(value.backupId, `${pathArg}.backupId`);
   const sourceServiceId = readCorestoreDatabaseBackupIdentifier(
@@ -1584,7 +1446,6 @@ const normalizeCorestoreDatabaseBackupReceiptInternal = (
   const serviceName = tagsValue.serviceName as string;
   const closureValue = readCorestoreDatabaseBackupRecord(value.closure, `${pathArg}.closure`);
   assertCorestoreDatabaseBackupExactKeys(closureValue, [
-    'formatVersion',
     'snapshotIds',
     'objectCount',
     'packCount',
@@ -1647,8 +1508,7 @@ const normalizeCorestoreDatabaseBackupReceiptInternal = (
       )
     : undefined;
   return {
-    schemaVersion: 1,
-    format: 'corestore.database.backup.v1',
+    format: corestoreDatabaseBackupFormat,
     backupId,
     sourceServiceId,
     createdAt,
@@ -1673,9 +1533,6 @@ const normalizeCorestoreDatabaseBackupReceiptInternal = (
       ...(databaseAllocation ? { databaseAllocation } : {}),
     },
     closure: {
-      formatVersion: closureValue.formatVersion === 1
-        ? 1
-        : failCorestoreDatabaseBackup(`${pathArg}.closure formatVersion must be 1`),
       snapshotIds: [snapshotId],
       objectCount,
       packCount,
@@ -1714,15 +1571,11 @@ export const normalizeCorestoreDatabaseBackupRestoreRequest = (
   const hasAllocation = Object.hasOwn(value, 'expectedDatabaseAllocation');
   const hasRestoreAttemptId = Object.hasOwn(value, 'restoreAttemptId');
   assertCorestoreDatabaseBackupExactKeys(value, [
-    'schemaVersion',
     'targetServiceId',
     'receipt',
     ...(hasAllocation ? ['expectedDatabaseAllocation'] : []),
     ...(hasRestoreAttemptId ? ['restoreAttemptId'] : []),
   ], 'databaseBackupRestoreRequest');
-  if (value.schemaVersion !== 1) {
-    failCorestoreDatabaseBackup('databaseBackupRestoreRequest schemaVersion must be 1');
-  }
   const receipt = normalizeCorestoreDatabaseBackupReceiptInternal(
     value.receipt,
     'databaseBackupRestoreRequest.receipt',
@@ -1740,7 +1593,6 @@ export const normalizeCorestoreDatabaseBackupRestoreRequest = (
       )
     : undefined;
   return finalizeCorestoreDatabaseBackup({
-    schemaVersion: 1,
     targetServiceId: readCorestoreDatabaseBackupIdentifier(
       value.targetServiceId,
       'databaseBackupRestoreRequest.targetServiceId',
@@ -1756,7 +1608,6 @@ export const normalizeCorestoreDatabaseBackupRestoreResponse = (
 ): Readonly<ICorestoreDatabaseBackupRestoreResponse> => {
   const value = readCorestoreDatabaseBackupRecord(valueArg, 'databaseBackupRestoreResponse');
   assertCorestoreDatabaseBackupExactKeys(value, [
-    'schemaVersion',
     'ok',
     'backupId',
     'sourceServiceId',
@@ -1766,12 +1617,11 @@ export const normalizeCorestoreDatabaseBackupRestoreResponse = (
     'requestSha256',
     'replayed',
   ], 'databaseBackupRestoreResponse');
-  if (value.schemaVersion !== 1 || value.ok !== true || typeof value.replayed !== 'boolean') {
+  if (value.ok !== true || typeof value.replayed !== 'boolean') {
     failCorestoreDatabaseBackup('databaseBackupRestoreResponse constants must be canonical');
   }
   const replayed = value.replayed as boolean;
   return finalizeCorestoreDatabaseBackup({
-    schemaVersion: 1,
     ok: true,
     backupId: readCorestoreDatabaseBackupIdentifier(
       value.backupId,