@serve.zone/interfaces 31.9.0 → 32.0.1

package/ts/data/sparknodereport.ts

@@ -1,6 +1,9 @@
+import { isReleaseVersion } from '../private/releaseversion.js';
+import { readExactDataRecord } from '../private/dataproperties.js';
+import { protocolRefusalHttpStatus, readProtocolOffer, type IProtocolOffer } from '../protocol.js';
+
 /** Host observations only. Container and workload readiness belong to Pallet. */
-export interface ISparkNodeReportV2 {
-  schemaVersion: 2;
+export interface ISparkNodeReport {
   observedAt: number;
   metrics: {
     cpuUsagePercent: number;
@@ -21,51 +24,55 @@ export interface ISparkNodeReportV2 {
 }
 
 /** HTTPS POST body. Never log, persist, or return nodeToken. */
-export interface ISparkNodeHeartbeatRequestV2 {
+export interface ISparkNodeHeartbeatRequest {
   nodeId: string;
   nodeToken: string;
-  report: ISparkNodeReportV2;
+  /** Read and negotiated before the node is authenticated; see `sparkNodeHeartbeatContract`. */
+  protocol: IProtocolOffer;
+  report: ISparkNodeReport;
 }
 
 /** Historical acceptance evidence, not current authority or workload readiness. */
-export interface ISparkNodeHeartbeatReceiptV2 {
-  schemaVersion: 2;
+export interface ISparkNodeHeartbeatReceipt {
   accepted: true;
   nodeId: string;
   credentialGeneration: number;
   sessionEpoch: number;
   acceptedAt: number;
+  /** The controller's offer, so an accepted node judges the session it just reported into. */
+  protocol: IProtocolOffer;
 }
 
 /** Persist only after the server's current Spark credential transaction commits. */
-export interface ISparkNodeReportRecordV2 {
-  report: ISparkNodeReportV2;
-  receipt: ISparkNodeHeartbeatReceiptV2;
+export interface ISparkNodeReportRecord {
+  report: ISparkNodeReport;
+  receipt: ISparkNodeHeartbeatReceipt;
 }
 
-export const sparkNodeHeartbeatV2Contract = Object.freeze({
-  endpoint: '/spark/v2/nodes/heartbeat',
+/**
+ * The node runtime's own heartbeat route.
+ *
+ * Judged in the one server order `protocol.readProtocolOffer` states, against this server's
+ * `sparkNode` offer and within `maxRequestBytes`. The route carries no typed error, so a refusal
+ * is answered with `protocolRefusalStatus` and an `IProtocolRefusal` body — before the report is
+ * snapshotted and before the node is authenticated, because a route that authenticated first would
+ * answer a peer of another major with a credential verdict it cannot act on.
+ */
+export const sparkNodeHeartbeatContract = Object.freeze({
+  endpoint: '/spark/nodes/heartbeat',
   maxRequestBytes: 8192,
   maxResponseBytes: 2048,
+  protocolRefusalStatus: protocolRefusalHttpStatus,
 } as const);
 
 const fail = (): never => { throw new Error('Spark node heartbeat contract rejected.'); };
 function requireValue(valueArg: unknown): asserts valueArg {
   if (!valueArg) fail();
 }
+/** Exactly these keys, carrying data: the shared reader refuses an accessor instead of running it. */
 const record = (valueArg: unknown, keysArg: readonly string[]): Record<string, unknown> => {
-  requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
-  const prototype = Object.getPrototypeOf(valueArg);
-  requireValue(prototype === Object.prototype || prototype === null);
-  const keys = Reflect.ownKeys(valueArg);
-  requireValue(keys.length === keysArg.length);
-  const result: Record<string, unknown> = Object.create(null);
-  for (const key of keys) {
-    requireValue(typeof key === 'string' && keysArg.includes(key));
-    const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
-    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
-    result[key] = descriptor.value;
-  }
+  const result = readExactDataRecord(valueArg, keysArg);
+  requireValue(result !== null);
   return result;
 };
 const text = (valueArg: unknown, patternArg: RegExp, maxLengthArg: number): string => {
@@ -73,6 +80,11 @@ const text = (valueArg: unknown, patternArg: RegExp, maxLengthArg: number): stri
     && valueArg.match(patternArg)?.[0] === valueArg);
   return valueArg;
 };
+// The shared grammar, not a copy of it: a stored bundle version has to be one the release
+// comparison can order, and a second rule here would be a second answer to that question.
+const releaseVersion = (valueArg: unknown): string => (
+  isReleaseVersion(valueArg) ? valueArg : fail()
+);
 const number = (valueArg: unknown, maxArg = Number.MAX_SAFE_INTEGER): number => {
   requireValue(typeof valueArg === 'number' && Number.isFinite(valueArg)
     && !Object.is(valueArg, -0) && valueArg >= 0 && valueArg <= maxArg);
@@ -85,9 +97,8 @@ const integer = (valueArg: unknown, minimumArg: number): number => {
 };
 
 /** Exact inert JSON records; detaches and freezes before any consumer awaits. */
-export const snapshotSparkNodeReportV2 = (valueArg: unknown): ISparkNodeReportV2 => {
-  const value = record(valueArg, ['schemaVersion', 'observedAt', 'metrics', 'runtime']);
-  requireValue(value.schemaVersion === 2);
+export const snapshotSparkNodeReport = (valueArg: unknown): ISparkNodeReport => {
+  const value = record(valueArg, ['observedAt', 'metrics', 'runtime']);
   const metrics = record(value.metrics, ['cpuUsagePercent', 'memoryUsedMB', 'memoryAvailableMB',
     'diskUsedGB', 'diskAvailableGB']);
   const runtime = record(value.runtime, ['hostname', 'platform', 'arch', 'osRelease', 'bundle',
@@ -98,7 +109,6 @@ export const snapshotSparkNodeReportV2 = (valueArg: unknown): ISparkNodeReportV2
   requireValue(hostname.split('.').every((label) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label)));
   const bundle = record(runtime.bundle, ['version', 'sourceCommit', 'manifestSha256']);
   return Object.freeze({
-    schemaVersion: 2,
     observedAt: integer(value.observedAt, 1),
     metrics: Object.freeze({
       cpuUsagePercent: number(metrics.cpuUsagePercent, 100),
@@ -109,7 +119,7 @@ export const snapshotSparkNodeReportV2 = (valueArg: unknown): ISparkNodeReportV2
       hostname, platform: 'linux', arch: runtime.arch as 'x86_64' | 'aarch64',
       osRelease: text(runtime.osRelease, /^[\x20-\x7e]+$/, 256),
       bundle: Object.freeze({
-        version: text(bundle.version, /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/, 64),
+        version: releaseVersion(bundle.version),
         sourceCommit: text(bundle.sourceCommit, /^[a-f0-9]{40}$/, 40),
         manifestSha256: text(bundle.manifestSha256, /^[a-f0-9]{64}$/, 64),
       }),
@@ -118,23 +128,25 @@ export const snapshotSparkNodeReportV2 = (valueArg: unknown): ISparkNodeReportV2
   });
 };
 
-export const snapshotSparkNodeHeartbeatRequestV2 = (valueArg: unknown): ISparkNodeHeartbeatRequestV2 => {
-  const value = record(valueArg, ['nodeId', 'nodeToken', 'report']);
+export const snapshotSparkNodeHeartbeatRequest = (valueArg: unknown): ISparkNodeHeartbeatRequest => {
+  const value = record(valueArg, ['nodeId', 'nodeToken', 'protocol', 'report']);
   return Object.freeze({
     nodeId: text(value.nodeId, /^[A-Za-z0-9_-]+$/, 128),
     // Both freshly enrolled and explicitly adopted credentials use this bearer format.
     nodeToken: text(value.nodeToken, /^secureToken[a-f0-9]{64}$/, 75),
-    report: snapshotSparkNodeReportV2(value.report),
+    protocol: readProtocolOffer(value),
+    report: snapshotSparkNodeReport(value.report),
   });
 };
 
-export const snapshotSparkNodeHeartbeatReceiptV2 = (valueArg: unknown): ISparkNodeHeartbeatReceiptV2 => {
-  const value = record(valueArg, ['schemaVersion', 'accepted', 'nodeId', 'credentialGeneration',
-    'sessionEpoch', 'acceptedAt']);
-  requireValue(value.schemaVersion === 2 && value.accepted === true);
+export const snapshotSparkNodeHeartbeatReceipt = (valueArg: unknown): ISparkNodeHeartbeatReceipt => {
+  const value = record(valueArg, ['accepted', 'nodeId', 'credentialGeneration',
+    'sessionEpoch', 'acceptedAt', 'protocol']);
+  requireValue(value.accepted === true);
   return Object.freeze({
-    schemaVersion: 2, accepted: true, nodeId: text(value.nodeId, /^[A-Za-z0-9_-]+$/, 128),
+    accepted: true, nodeId: text(value.nodeId, /^[A-Za-z0-9_-]+$/, 128),
     credentialGeneration: integer(value.credentialGeneration, 1),
     sessionEpoch: integer(value.sessionEpoch, 0), acceptedAt: integer(value.acceptedAt, 1),
+    protocol: readProtocolOffer(value),
   });
 };

package/ts/data/webpush.ts

@@ -101,7 +101,6 @@ export interface IWebPushBinding {
  * from their authenticated API after receiving this event.
  */
 export interface IWebPushNotificationPayload {
-  schemaVersion: 1;
   event: 'notificationAvailable';
   eventId: string;
   /** Same-origin application route beginning with a single slash. */

package/ts/index.ts

@@ -2,6 +2,7 @@ import * as data from './data/index.js';
 import * as appstore from './appstore/index.js';
 import * as platform from './platform/index.js';
 import * as platformservice from './platformservice/index.js';
+import * as protocol from './protocol.js';
 import * as requests from './requests/index.js';
 
 export {
@@ -9,5 +10,6 @@ export {
   data,
   platform,
   platformservice,
+  protocol,
   requests
 }

package/ts/platform/objectstorageretention.ts

@@ -1,19 +1,19 @@
 import { createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
 import { validatePlatformObjectStorageBucketName } from './objectstorage.js';
+import { hasExactKeys } from '../private/dataproperties.js';
 
 export const objectStorageRetentionLimits = Object.freeze({
   maximumPolicyIdLength: 96,
   maximumRetentionDurationSeconds: 100 * 366 * 24 * 60 * 60,
 });
 
-export interface IObjectStorageRetentionIntentV1 {
+export interface IObjectStorageRetentionIntent {
   mode: 'compliance';
   policyId: string;
   retentionDurationSeconds: number;
 }
 
-export interface IObjectStorageRetentionCapabilityEvidenceV1 {
-  version: 1;
+export interface IObjectStorageRetentionCapabilityEvidence {
   supported: true;
   backend: 'standalone' | 'clustered';
   modes: ['compliance'];
@@ -21,16 +21,15 @@ export interface IObjectStorageRetentionCapabilityEvidenceV1 {
   retainedMultipartSupported: false;
 }
 
-export interface IObjectStorageRetentionAuthorityV1 {
+export interface IObjectStorageRetentionAuthority {
   serviceId: string;
   bindingId: string;
   reconciliationGeneration: number;
   bindingRequestDigest: string;
 }
 
-export interface IObjectStorageRetentionSentinelEvidenceV1
-extends IObjectStorageRetentionIntentV1 {
-  version: 1;
+export interface IObjectStorageRetentionSentinelEvidence
+extends IObjectStorageRetentionIntent {
   createdAt: number;
   retainUntil: number;
   payloadSha256: string;
@@ -38,33 +37,32 @@ extends IObjectStorageRetentionIntentV1 {
   etag: string;
 }
 
-export interface IObjectStorageRetentionReceiptV1
-extends IObjectStorageRetentionIntentV1 {
+export interface IObjectStorageRetentionReceipt
+extends IObjectStorageRetentionIntent {
   bucketName: string;
   configuredAt: number;
   sentinelKey: string;
-  sentinel: IObjectStorageRetentionSentinelEvidenceV1;
+  sentinel: IObjectStorageRetentionSentinelEvidence;
 }
 
-export interface IObjectStorageRetentionEvidenceV1 {
-  intent: IObjectStorageRetentionIntentV1;
+export interface IObjectStorageRetentionEvidence {
+  intent: IObjectStorageRetentionIntent;
   intentSha256: string;
-  authority: IObjectStorageRetentionAuthorityV1;
-  capability: IObjectStorageRetentionCapabilityEvidenceV1;
-  receipt: IObjectStorageRetentionReceiptV1;
+  authority: IObjectStorageRetentionAuthority;
+  capability: IObjectStorageRetentionCapabilityEvidence;
+  receipt: IObjectStorageRetentionReceipt;
   verifiedAt: number;
 }
 
 /** Value-free desired intent with optional exact provider evidence. */
-export interface IObjectStorageRetentionBindingV1 {
-  schemaVersion: 1;
-  intent: IObjectStorageRetentionIntentV1;
-  evidence?: IObjectStorageRetentionEvidenceV1;
+export interface IObjectStorageRetentionBinding {
+  intent: IObjectStorageRetentionIntent;
+  evidence?: IObjectStorageRetentionEvidence;
 }
 
-export interface IObjectStorageRetentionEvidenceExpectationV1
-extends IObjectStorageRetentionAuthorityV1 {
-  intent: IObjectStorageRetentionIntentV1;
+export interface IObjectStorageRetentionEvidenceExpectation
+extends IObjectStorageRetentionAuthority {
+  intent: IObjectStorageRetentionIntent;
   bucketName: string;
 }
 
@@ -72,6 +70,11 @@ const policyIdPattern = /^[A-Za-z0-9._-]{1,96}$/;
 const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
 const sha256Pattern = /^[a-f0-9]{64}$/;
 const etagPattern = /^[a-f0-9]{32}$/;
+/**
+ * ObjectStorage's own on-disk sentinel key, pinned verbatim: `@lossless.org/objectstorage` writes
+ * `.smartstorage-retention/v1/sentinel-<sha256>.json`, so the `v1` segment belongs to that
+ * package's object layout and is not a serve.zone name (naming rule N10 — foreign bytes stay).
+ */
 const sentinelKeyPattern = /^\.smartstorage-retention\/v1\/sentinel-[a-f0-9]{64}\.json$/;
 
 const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> => (
@@ -82,16 +85,6 @@ const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> => (
     || Object.getPrototypeOf(valueArg) === null)
 );
 
-const hasExactKeys = (
-  valueArg: Record<string, unknown>,
-  keysArg: readonly string[],
-): boolean => {
-  const actualKeys = Object.keys(valueArg).sort();
-  const expectedKeys = [...keysArg].sort();
-  return actualKeys.length === expectedKeys.length
-    && actualKeys.every((keyArg, indexArg) => keyArg === expectedKeys[indexArg]);
-};
-
 const isPositiveSafeInteger = (valueArg: unknown): valueArg is number => (
   Number.isSafeInteger(valueArg) && (valueArg as number) > 0
 );
@@ -135,7 +128,7 @@ export const createObjectStorageRetentionRetainUntil = (
 };
 
 export const createObjectStorageRetentionIntentDigestInput = (
-  intentArg: IObjectStorageRetentionIntentV1,
+  intentArg: IObjectStorageRetentionIntent,
 ): string => {
   const errors = validateObjectStorageRetentionIntent(intentArg);
   if (errors.length > 0) throw new Error(errors[0]);
@@ -146,12 +139,11 @@ export const createObjectStorageRetentionIntentDigestInput = (
       policyId: intentArg.policyId,
       retentionDurationSeconds: intentArg.retentionDurationSeconds,
     },
-    version: 1,
   });
 };
 
 export const computeObjectStorageRetentionIntentSha256 = async (
-  intentArg: IObjectStorageRetentionIntentV1,
+  intentArg: IObjectStorageRetentionIntent,
 ): Promise<string> => createCanonicalJsonSha256Hex(
   createObjectStorageRetentionIntentDigestInput(intentArg),
   (reasonArg) => { throw new Error(reasonArg); },
@@ -162,12 +154,12 @@ export const objectStorageRetentionIntentsEqual = (
   rightArg: unknown,
 ): boolean => validateObjectStorageRetentionIntent(leftArg).length === 0
   && validateObjectStorageRetentionIntent(rightArg).length === 0
-  && (leftArg as IObjectStorageRetentionIntentV1).mode
-    === (rightArg as IObjectStorageRetentionIntentV1).mode
-  && (leftArg as IObjectStorageRetentionIntentV1).policyId
-    === (rightArg as IObjectStorageRetentionIntentV1).policyId
-  && (leftArg as IObjectStorageRetentionIntentV1).retentionDurationSeconds
-    === (rightArg as IObjectStorageRetentionIntentV1).retentionDurationSeconds;
+  && (leftArg as IObjectStorageRetentionIntent).mode
+    === (rightArg as IObjectStorageRetentionIntent).mode
+  && (leftArg as IObjectStorageRetentionIntent).policyId
+    === (rightArg as IObjectStorageRetentionIntent).policyId
+  && (leftArg as IObjectStorageRetentionIntent).retentionDurationSeconds
+    === (rightArg as IObjectStorageRetentionIntent).retentionDurationSeconds;
 
 const retentionIntentFieldsEqual = (
   leftArg: unknown,
@@ -183,7 +175,7 @@ const retentionIntentFieldsEqual = (
 
 export const validateObjectStorageRetentionEvidence = async (
   evidenceArg: unknown,
-  expectedArg: IObjectStorageRetentionEvidenceExpectationV1,
+  expectedArg: IObjectStorageRetentionEvidenceExpectation,
 ): Promise<string[]> => {
   if (!isRecord(evidenceArg)
     || !hasExactKeys(evidenceArg, [
@@ -197,7 +189,7 @@ export const validateObjectStorageRetentionEvidence = async (
     return ['objectstorage retention evidence must use its exact schema'];
   }
   const errors = validateObjectStorageRetentionIntent(evidenceArg.intent);
-  const intent = evidenceArg.intent as IObjectStorageRetentionIntentV1;
+  const intent = evidenceArg.intent as IObjectStorageRetentionIntent;
   if (!retentionIntentFieldsEqual(intent, expectedArg.intent)) {
     errors.push('objectstorage retention evidence intent must equal the expected intent');
   }
@@ -233,14 +225,12 @@ export const validateObjectStorageRetentionEvidence = async (
   const capability = evidenceArg.capability;
   if (!isRecord(capability)
     || !hasExactKeys(capability, [
-      'version',
       'supported',
       'backend',
       'modes',
       'atomicCreateOnly',
       'retainedMultipartSupported',
     ])
-    || capability.version !== 1
     || capability.supported !== true
     || (capability.backend !== 'standalone' && capability.backend !== 'clustered')
     || !Array.isArray(capability.modes)
@@ -283,7 +273,6 @@ export const validateObjectStorageRetentionEvidence = async (
   const sentinel = receipt.sentinel;
   if (!isRecord(sentinel)
     || !hasExactKeys(sentinel, [
-      'version',
       'mode',
       'policyId',
       'retentionDurationSeconds',
@@ -296,7 +285,7 @@ export const validateObjectStorageRetentionEvidence = async (
     errors.push('objectstorage retention sentinel evidence must use its exact schema');
     return errors;
   }
-  if (sentinel.version !== 1 || !retentionIntentFieldsEqual(sentinel, intent)) {
+  if (!retentionIntentFieldsEqual(sentinel, intent)) {
     errors.push('objectstorage retention sentinel intent must equal its evidence intent');
   }
   if (!isPositiveSafeInteger(sentinel.createdAt)
@@ -331,17 +320,14 @@ export const validateObjectStorageRetentionEvidence = async (
 
 export const validateObjectStorageRetentionBinding = async (
   bindingArg: unknown,
-  expectedArg: IObjectStorageRetentionEvidenceExpectationV1,
+  expectedArg: IObjectStorageRetentionEvidenceExpectation,
 ): Promise<string[]> => {
   if (!isRecord(bindingArg)
-    || !Object.hasOwn(bindingArg, 'schemaVersion')
     || !Object.hasOwn(bindingArg, 'intent')
-    || Object.keys(bindingArg).some((keyArg) => !['schemaVersion', 'intent', 'evidence'].includes(keyArg))) {
+    || Object.keys(bindingArg).some((keyArg) => !['intent', 'evidence'].includes(keyArg))) {
     return ['objectstorage retention binding must use its exact schema'];
   }
-  const errors = bindingArg.schemaVersion === 1
-    ? validateObjectStorageRetentionIntent(bindingArg.intent)
-    : ['objectstorage retention binding schemaVersion must be 1'];
+  const errors = validateObjectStorageRetentionIntent(bindingArg.intent);
   if (!retentionIntentFieldsEqual(bindingArg.intent, expectedArg.intent)) {
     errors.push('objectstorage retention binding intent must equal the trusted expected intent');
   }
@@ -356,7 +342,7 @@ export const validateObjectStorageRetentionBinding = async (
 
 export const validatePlatformBindingObjectStorageRetention = async (
   bindingArg: unknown,
-  expectedArg: IObjectStorageRetentionEvidenceExpectationV1,
+  expectedArg: IObjectStorageRetentionEvidenceExpectation,
 ): Promise<string[]> => {
   if (!isRecord(bindingArg)) {
     return ['platform objectstorage retention binding must be an object'];

package/ts/platform/storage.ts

@@ -102,7 +102,6 @@ export type TStorageClassCapabilities =
  * addresses, mount options, principals, and credential values are private.
  */
 export interface IStorageCapabilityAdvertisement {
-  schemaVersion: 2;
   featureIds: string[];
   classes: TStorageClassCapabilities[];
 }
@@ -131,7 +130,7 @@ export interface IObjectStorageFileDelivery {
    * JSON object with endpoint, bucket, region, accessKeyId,
    * secretAccessKey, and optional sessionToken fields.
    */
-  format: 'servezone-object-storage-v1';
+  format: 'servezone-object-storage';
   uid: number;
   gid: number;
   mode: 0o400 | 0o440;
@@ -181,7 +180,6 @@ export interface IResolvedStorageCapacity {
 }
 
 export interface IResolvedStorageBindingBase {
-  schemaVersion: 2;
   /** Stable binding/allocation identity. */
   id: string;
   serviceId: string;

package/ts/platform/storagemigration.golden.ts

@@ -37,7 +37,6 @@ const delivery = {
 const credentialManagementScope = 'platform:object-storage-binding';
 
 const sourceBinding: TActiveObjectStorageBinding = {
-  schemaVersion: 2,
   id: 'binding-object',
   serviceId: 'service-app',
   requestId: 'object-data',
@@ -97,7 +96,6 @@ const target = {
 
 const preparationSnapshotPayload:
 TUnfencedObjectStorageBindingControlSnapshotDigestPayload = {
-  schemaVersion: 2,
   binding: sourceBinding,
   recordRevision: 12,
   capturedAt: 1_700_000_000_010,
@@ -106,11 +104,10 @@ TUnfencedObjectStorageBindingControlSnapshotDigestPayload = {
 const preparationSnapshot: IUnfencedObjectStorageBindingControlSnapshot = {
   ...preparationSnapshotPayload,
   snapshotDigest:
-    'ac8166a9888144d11dc7419f60be055eeb6f392ec41a254a9f9b2a7b3df1fba7',
+    '59e518dd446cde4ff8899d628f017e9410674e3d52ce6be5f7965c1ec04c80a3',
 };
 
 const prepareRequest: IObjectStorageMigrationPrepareRequest = {
-  schemaVersion: 2,
   migrationId: 'migration-object-capacity',
   sourceControlSnapshot: preparationSnapshot,
   workloadGeneration: 8,
@@ -140,7 +137,6 @@ const candidateBinding: TStagedObjectStorageBinding = {
 };
 
 export const storageMigrationCanonicalDigestGoldenVectors = deepFreezeValue({
-  version: 2 as const,
   targetRequest: {
     input: target.request,
     canonicalJson: '{"accessMode":"readWrite","capacity":{"limit":"1TiB","request":"500GiB"},"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"id":"object-data","kind":"objectStorage","reclaimPolicy":"retain","storageClass":"backupCapacity"}',
@@ -148,17 +144,17 @@ export const storageMigrationCanonicalDigestGoldenVectors = deepFreezeValue({
   },
   preparationSnapshot: {
     input: preparationSnapshotPayload,
-    canonicalJson: '{"binding":{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"connection":{"bucket":"source-bucket","endpoint":"https://source.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":3,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"source-object","revision":"1"},"requestDigest":"1111111111111111111111111111111111111111111111111111111111111111","requestId":"object-data","resourceRef":"source-resource","schemaVersion":2,"serviceId":"service-app","status":"ready","updatedAt":1700000000001,"versioning":false},"capturedAt":1700000000010,"recordRevision":12,"schemaVersion":2}',
-    sha256: 'ac8166a9888144d11dc7419f60be055eeb6f392ec41a254a9f9b2a7b3df1fba7',
+    canonicalJson: '{"binding":{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"connection":{"bucket":"source-bucket","endpoint":"https://source.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":3,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"source-object","revision":"1"},"requestDigest":"1111111111111111111111111111111111111111111111111111111111111111","requestId":"object-data","resourceRef":"source-resource","serviceId":"service-app","status":"ready","updatedAt":1700000000001,"versioning":false},"capturedAt":1700000000010,"recordRevision":12}',
+    sha256: '59e518dd446cde4ff8899d628f017e9410674e3d52ce6be5f7965c1ec04c80a3',
   },
   prepareRequest: {
     input: prepareRequest,
-    canonicalJson: '{"migrationId":"migration-object-capacity","schemaVersion":2,"sourceControlSnapshot":{"binding":{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"connection":{"bucket":"source-bucket","endpoint":"https://source.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":3,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"source-object","revision":"1"},"requestDigest":"1111111111111111111111111111111111111111111111111111111111111111","requestId":"object-data","resourceRef":"source-resource","schemaVersion":2,"serviceId":"service-app","status":"ready","updatedAt":1700000000001,"versioning":false},"capturedAt":1700000000010,"recordRevision":12,"schemaVersion":2,"snapshotDigest":"ac8166a9888144d11dc7419f60be055eeb6f392ec41a254a9f9b2a7b3df1fba7"},"target":{"credentialManagementScope":"platform:object-storage-binding","policy":{"classId":"capacity-object","revision":"4"},"request":{"accessMode":"readWrite","capacity":{"limit":"1TiB","request":"500GiB"},"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"id":"object-data","kind":"objectStorage","reclaimPolicy":"retain","storageClass":"backupCapacity"},"storageClass":{"kind":"objectStorage","purpose":"backup","required":{"backup":true,"durability":"persistent","performanceTier":"capacity"}}},"workloadGeneration":8}',
-    sha256: '7682ed6f8c8b64d4c677ea91c04e4261bfe5326a3fb905d5da093f51e4b2dbbe',
+    canonicalJson: '{"migrationId":"migration-object-capacity","sourceControlSnapshot":{"binding":{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"connection":{"bucket":"source-bucket","endpoint":"https://source.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":3,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"source-object","revision":"1"},"requestDigest":"1111111111111111111111111111111111111111111111111111111111111111","requestId":"object-data","resourceRef":"source-resource","serviceId":"service-app","status":"ready","updatedAt":1700000000001,"versioning":false},"capturedAt":1700000000010,"recordRevision":12,"snapshotDigest":"59e518dd446cde4ff8899d628f017e9410674e3d52ce6be5f7965c1ec04c80a3"},"target":{"credentialManagementScope":"platform:object-storage-binding","policy":{"classId":"capacity-object","revision":"4"},"request":{"accessMode":"readWrite","capacity":{"limit":"1TiB","request":"500GiB"},"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"id":"object-data","kind":"objectStorage","reclaimPolicy":"retain","storageClass":"backupCapacity"},"storageClass":{"kind":"objectStorage","purpose":"backup","required":{"backup":true,"durability":"persistent","performanceTier":"capacity"}}},"workloadGeneration":8}',
+    sha256: '549cc9ec83ec3ce1b17c9379448a869d43eba911d540973e207672e4f2d82644',
   },
   candidateBinding: {
     input: candidateBinding,
-    canonicalJson: '{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"capacity":{"granted":"500GiB","limit":"1TiB","requested":"500GiB"},"connection":{"bucket":"destination-bucket","endpoint":"https://destination.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":4,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"capacity-object","revision":"4"},"requestDigest":"3f864862041002e25b790b3bc7afbe37c399a006f385e1def9f679a93d4fa173","requestId":"object-data","resourceRef":"destination-resource","schemaVersion":2,"serviceId":"service-app","status":"provisioning","updatedAt":1700000000020,"versioning":false}',
-    sha256: '6e5c954466b600f81d1f19dcdd7ef426be99dc12ae33103e4d0c238e0070de71',
+    canonicalJson: '{"accessMode":"readWrite","capabilities":{"backup":true,"durability":"persistent","encryptedInTransit":true,"hardQuota":true,"performanceTier":"capacity","snapshots":"none","topology":"singleNode"},"capacity":{"granted":"500GiB","limit":"1TiB","requested":"500GiB"},"connection":{"bucket":"destination-bucket","endpoint":"https://destination.example.test","region":"local"},"createdAt":1700000000000,"credentialManagementScope":"platform:object-storage-binding","delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"generation":4,"id":"binding-object","kind":"objectStorage","observedGeneration":3,"policy":{"classId":"capacity-object","revision":"4"},"requestDigest":"3f864862041002e25b790b3bc7afbe37c399a006f385e1def9f679a93d4fa173","requestId":"object-data","resourceRef":"destination-resource","serviceId":"service-app","status":"provisioning","updatedAt":1700000000020,"versioning":false}',
+    sha256: '30ccf8221dea7cf7d26b062edf64b6cba29ef809cc1a213fd6428ee95ff92179',
   },
 });