@serve.zone/interfaces 32.4.0 → 32.6.0

package/ts/private/nodeidentifier.ts

@@ -0,0 +1,25 @@
+/**
+ * The one vocabulary a node of a cluster is named in.
+ *
+ * It lives beside the canonical JSON and data-property helpers rather than in a contract module
+ * because every family reads it — the node's enrollment, its runtime session, the Spark wire, its
+ * assignments, the private network contract and the relay block — and a second spelling of the rule
+ * is a second answer to which nodes exist.
+ */
+
+/**
+ * True when a value is exactly a node id: the URL alphabet, a leading `-` or `_` included,
+ * one to 128 characters.
+ *
+ * These contracts disagreed with themselves about what a node may be called: enrollment, the
+ * session registration and the Spark wire admit a separator-led node id, which makes this the
+ * vocabulary a stored node id is written in, while the assignment and the network members read
+ * that same id by the canonical identifier vocabulary — whose first character must be
+ * alphanumeric — and refuse it, and with it the assignment, the runtime network and, because one
+ * refused egress owner fails the whole pass, its entire cluster's protected authority. A
+ * controller now keeps the first character alphanumeric where it mints, so the ids this one
+ * vocabulary serves are the ones already stored under the members that admit them.
+ */
+export const isClusterNodeId = (valueArg: unknown): valueArg is string => (
+  typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg)
+);

package/ts/requests/corestore.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import type { IIdentity } from '../data/user.js';
 import { hasExactKeys } from '../private/dataproperties.js';
+import { isClusterNodeId } from '../private/nodeidentifier.js';
 
 /**
  * A provisioned corestore resource (NoSQLDB database or ObjectStorage bucket)
@@ -189,9 +190,8 @@ export const validateClusterCorestoreInventory = (
     return [`${pathArg} must use its exact schema`];
   }
   const errors: string[] = [];
-  if (typeof valueArg.nodeId !== 'string'
-    || !clusterCorestoreInventoryIdentifierPattern.test(valueArg.nodeId)) {
-    errors.push(`${pathArg} nodeId must be a bounded identifier`);
+  if (!isClusterNodeId(valueArg.nodeId)) {
+    errors.push(`${pathArg} nodeId must be a node id`);
   }
   if (!Number.isSafeInteger(valueArg.checkedAt) || (valueArg.checkedAt as number) < 0) {
     errors.push(`${pathArg} checkedAt must be a non-negative safe integer`);

package/ts/runtime.ts

@@ -29,6 +29,7 @@ import {
 } from './data/clusternode.js';
 import { isCoreflowRuntimeCapabilityList, isSha256Digest } from './data/immutableimage.js';
 import { hasExactKeys } from './private/dataproperties.js';
+import { isClusterNodeId } from './private/nodeidentifier.js';
 import type {
   IWorkloadInitActiveApprovalAuthority,
   IWorkloadInitApprovalAuthorityReference,
@@ -759,8 +760,10 @@ const validateRuntimeTargets = (
       errors.push(`${pathArg}[${index}] must use its exact schema`);
       continue;
     }
-    if (!isRuntimeIdentifier(targetArg.cloudlyNodeId)
-      || !isRuntimeIdentifier(targetArg.swarmClusterId)
+    if (!isClusterNodeId(targetArg.cloudlyNodeId)) {
+      errors.push(`${pathArg}[${index}].cloudlyNodeId must be a node id`);
+    }
+    if (!isRuntimeIdentifier(targetArg.swarmClusterId)
       || !isRuntimeIdentifier(targetArg.swarmNodeId)
       || !isRuntimeIdentifier(targetArg.nodeName)) {
       errors.push(`${pathArg}[${index}] node identity must be canonical`);
@@ -768,7 +771,7 @@ const validateRuntimeTargets = (
     if (!runtimePlatforms.has(targetArg.platform as TImmutableContainerPlatform)) {
       errors.push(`${pathArg}[${index}].platform must be supported`);
     }
-    if (isRuntimeIdentifier(targetArg.cloudlyNodeId)
+    if (isClusterNodeId(targetArg.cloudlyNodeId)
       && isRuntimeIdentifier(targetArg.swarmClusterId)
       && isRuntimeIdentifier(targetArg.swarmNodeId)
       && isRuntimeIdentifier(targetArg.nodeName)