refactor(contracts): add DstackApp initialize overload and version(), remove KMS backward-compat factory

DstackApp:
- Extract shared init logic into _initializeCommon() internal function
- Add old 5-param initialize(address,bool,bool,bytes32,bytes32) overload
  for upgrade compatibility with existing proxies
- Keep 6-param initialize with requireTcbUpToDate for new deployments
- Add version() pure function returning 2 for capability detection

DstackKms:
- Remove 5-param deployAndRegisterApp backward-compat overload
- Remove _deployAndRegisterApp internal function
- Keep only 6-param deployAndRegisterApp with inline logic,
  callers must explicitly specify requireTcbUpToDate

Author: Leechael

kms/auth-eth/contracts/DstackApp.sol

@@ -46,7 +46,18 @@ contract DstackApp is
         _disableInitializers();
     }
 
-    // Initialize the contract
+    // Old initialize — preserved for upgrade compatibility
+    function initialize(
+        address initialOwner,
+        bool _disableUpgrades,
+        bool _allowAnyDevice,
+        bytes32 initialDeviceId,
+        bytes32 initialComposeHash
+    ) public initializer {
+        _initializeCommon(initialOwner, _disableUpgrades, _allowAnyDevice, initialDeviceId, initialComposeHash);
+    }
+
+    // New initialize — includes requireTcbUpToDate
     function initialize(
         address initialOwner,
         bool _disableUpgrades,
@@ -55,10 +66,20 @@ contract DstackApp is
         bytes32 initialDeviceId,
         bytes32 initialComposeHash
     ) public initializer {
+        requireTcbUpToDate = _requireTcbUpToDate;
+        _initializeCommon(initialOwner, _disableUpgrades, _allowAnyDevice, initialDeviceId, initialComposeHash);
+    }
+
+    function _initializeCommon(
+        address initialOwner,
+        bool _disableUpgrades,
+        bool _allowAnyDevice,
+        bytes32 initialDeviceId,
+        bytes32 initialComposeHash
+    ) internal {
         require(initialOwner != address(0), "invalid owner address");
 
         _upgradesDisabled = _disableUpgrades;
-        requireTcbUpToDate = _requireTcbUpToDate;
         allowAnyDevice = _allowAnyDevice;
 
         // Add initial device if provided
@@ -78,6 +99,10 @@ contract DstackApp is
         __ERC165_init();
     }
 
+    function version() public pure returns (uint256) {
+        return 2;
+    }
+
     /**
      * @dev See {IERC165-supportsInterface}.
      * @notice Returns true if this contract implements the interface defined by interfaceId

kms/auth-eth/contracts/DstackKms.sol

@@ -149,28 +149,9 @@ contract DstackKms is
         bytes32 initialDeviceId,
         bytes32 initialComposeHash
     ) external returns (address appId) {
-        return _deployAndRegisterApp(
-            initialOwner,
-            disableUpgrades,
-            requireTcbUpToDate,
-            allowAnyDevice,
-            initialDeviceId,
-            initialComposeHash
-        );
-    }
-
-    function _deployAndRegisterApp(
-        address initialOwner,
-        bool disableUpgrades,
-        bool requireTcbUpToDate,
-        bool allowAnyDevice,
-        bytes32 initialDeviceId,
-        bytes32 initialComposeHash
-    ) internal returns (address appId) {
         require(appImplementation != address(0), "DstackApp implementation not set");
         require(initialOwner != address(0), "Invalid owner address");
 
-        // Prepare initialization data
         bytes memory initData = abi.encodeWithSelector(
             bytes4(keccak256("initialize(address,bool,bool,bool,bytes32,bytes32)")),
             initialOwner,
@@ -181,31 +162,11 @@ contract DstackKms is
             initialComposeHash
         );
 
-        // Deploy proxy contract
         appId = address(new ERC1967Proxy(appImplementation, initData));
-        // Register to KMS
         registerApp(appId);
         emit AppDeployedViaFactory(appId, msg.sender);
     }
 
-    // Backward compatible factory method (pre TCB requirement flag)
-    function deployAndRegisterApp(
-        address initialOwner,
-        bool disableUpgrades,
-        bool allowAnyDevice,
-        bytes32 initialDeviceId,
-        bytes32 initialComposeHash
-    ) external returns (address appId) {
-        return _deployAndRegisterApp(
-            initialOwner,
-            disableUpgrades,
-            false, // requireTcbUpToDate (default)
-            allowAnyDevice,
-            initialDeviceId,
-            initialComposeHash
-        );
-    }
-
     // Function to register an aggregated MR measurement
     function addKmsAggregatedMr(bytes32 mrAggregated) external onlyOwner {
         kmsAllowedAggregatedMrs[mrAggregated] = true;

kms/auth-eth/typechain-types/contracts/DstackApp.ts

@@ -69,7 +69,8 @@ export interface DstackAppInterface extends Interface {
       | "allowedComposeHashes"
       | "allowedDeviceIds"
       | "disableUpgrades"
-      | "initialize"
+      | "initialize(address,bool,bool,bytes32,bytes32)"
+      | "initialize(address,bool,bool,bool,bytes32,bytes32)"
       | "isAppAllowed"
       | "owner"
       | "proxiableUUID"
@@ -82,6 +83,7 @@ export interface DstackAppInterface extends Interface {
       | "supportsInterface"
       | "transferOwnership"
       | "upgradeToAndCall"
+      | "version"
   ): FunctionFragment;
 
   getEvent(
@@ -127,7 +129,11 @@ export interface DstackAppInterface extends Interface {
     values?: undefined
   ): string;
   encodeFunctionData(
-    functionFragment: "initialize",
+    functionFragment: "initialize(address,bool,bool,bytes32,bytes32)",
+    values: [AddressLike, boolean, boolean, BytesLike, BytesLike]
+  ): string;
+  encodeFunctionData(
+    functionFragment: "initialize(address,bool,bool,bool,bytes32,bytes32)",
     values: [AddressLike, boolean, boolean, boolean, BytesLike, BytesLike]
   ): string;
   encodeFunctionData(
@@ -175,6 +181,7 @@ export interface DstackAppInterface extends Interface {
     functionFragment: "upgradeToAndCall",
     values: [AddressLike, BytesLike]
   ): string;
+  encodeFunctionData(functionFragment: "version", values?: undefined): string;
 
   decodeFunctionResult(
     functionFragment: "UPGRADE_INTERFACE_VERSION",
@@ -201,7 +208,14 @@ export interface DstackAppInterface extends Interface {
     functionFragment: "disableUpgrades",
     data: BytesLike
   ): Result;
-  decodeFunctionResult(functionFragment: "initialize", data: BytesLike): Result;
+  decodeFunctionResult(
+    functionFragment: "initialize(address,bool,bool,bytes32,bytes32)",
+    data: BytesLike
+  ): Result;
+  decodeFunctionResult(
+    functionFragment: "initialize(address,bool,bool,bool,bytes32,bytes32)",
+    data: BytesLike
+  ): Result;
   decodeFunctionResult(
     functionFragment: "isAppAllowed",
     data: BytesLike
@@ -247,6 +261,7 @@ export interface DstackAppInterface extends Interface {
     functionFragment: "upgradeToAndCall",
     data: BytesLike
   ): Result;
+  decodeFunctionResult(functionFragment: "version", data: BytesLike): Result;
 }
 
 export namespace AllowAnyDeviceSetEvent {
@@ -433,7 +448,19 @@ export interface DstackApp extends BaseContract {
 
   disableUpgrades: TypedContractMethod<[], [void], "nonpayable">;
 
-  initialize: TypedContractMethod<
+  "initialize(address,bool,bool,bytes32,bytes32)": TypedContractMethod<
+    [
+      initialOwner: AddressLike,
+      _disableUpgrades: boolean,
+      _allowAnyDevice: boolean,
+      initialDeviceId: BytesLike,
+      initialComposeHash: BytesLike
+    ],
+    [void],
+    "nonpayable"
+  >;
+
+  "initialize(address,bool,bool,bool,bytes32,bytes32)": TypedContractMethod<
     [
       initialOwner: AddressLike,
       _disableUpgrades: boolean,
@@ -502,6 +529,8 @@ export interface DstackApp extends BaseContract {
     "payable"
   >;
 
+  version: TypedContractMethod<[], [bigint], "view">;
+
   getFunction<T extends ContractMethod = ContractMethod>(
     key: string | FunctionFragment
   ): T;
@@ -528,7 +557,20 @@ export interface DstackApp extends BaseContract {
     nameOrSignature: "disableUpgrades"
   ): TypedContractMethod<[], [void], "nonpayable">;
   getFunction(
-    nameOrSignature: "initialize"
+    nameOrSignature: "initialize(address,bool,bool,bytes32,bytes32)"
+  ): TypedContractMethod<
+    [
+      initialOwner: AddressLike,
+      _disableUpgrades: boolean,
+      _allowAnyDevice: boolean,
+      initialDeviceId: BytesLike,
+      initialComposeHash: BytesLike
+    ],
+    [void],
+    "nonpayable"
+  >;
+  getFunction(
+    nameOrSignature: "initialize(address,bool,bool,bool,bytes32,bytes32)"
   ): TypedContractMethod<
     [
       initialOwner: AddressLike,
@@ -585,6 +627,9 @@ export interface DstackApp extends BaseContract {
     [void],
     "payable"
   >;
+  getFunction(
+    nameOrSignature: "version"
+  ): TypedContractMethod<[], [bigint], "view">;
 
   getEvent(
     key: "AllowAnyDeviceSet"

kms/auth-eth/typechain-types/contracts/DstackKms.ts

@@ -84,8 +84,7 @@ export interface DstackKmsInterface extends Interface {
       | "addOsImageHash"
       | "allowedOsImages"
       | "appImplementation"
-      | "deployAndRegisterApp(address,bool,bool,bytes32,bytes32)"
-      | "deployAndRegisterApp(address,bool,bool,bool,bytes32,bytes32)"
+      | "deployAndRegisterApp"
       | "gatewayAppId"
       | "initialize"
       | "isAppAllowed"
@@ -154,11 +153,7 @@ export interface DstackKmsInterface extends Interface {
     values?: undefined
   ): string;
   encodeFunctionData(
-    functionFragment: "deployAndRegisterApp(address,bool,bool,bytes32,bytes32)",
-    values: [AddressLike, boolean, boolean, BytesLike, BytesLike]
-  ): string;
-  encodeFunctionData(
-    functionFragment: "deployAndRegisterApp(address,bool,bool,bool,bytes32,bytes32)",
+    functionFragment: "deployAndRegisterApp",
     values: [AddressLike, boolean, boolean, boolean, BytesLike, BytesLike]
   ): string;
   encodeFunctionData(
@@ -273,11 +268,7 @@ export interface DstackKmsInterface extends Interface {
     data: BytesLike
   ): Result;
   decodeFunctionResult(
-    functionFragment: "deployAndRegisterApp(address,bool,bool,bytes32,bytes32)",
-    data: BytesLike
-  ): Result;
-  decodeFunctionResult(
-    functionFragment: "deployAndRegisterApp(address,bool,bool,bool,bytes32,bytes32)",
+    functionFragment: "deployAndRegisterApp",
     data: BytesLike
   ): Result;
   decodeFunctionResult(
@@ -599,19 +590,7 @@ export interface DstackKms extends BaseContract {
 
   appImplementation: TypedContractMethod<[], [string], "view">;
 
-  "deployAndRegisterApp(address,bool,bool,bytes32,bytes32)": TypedContractMethod<
-    [
-      initialOwner: AddressLike,
-      disableUpgrades: boolean,
-      allowAnyDevice: boolean,
-      initialDeviceId: BytesLike,
-      initialComposeHash: BytesLike
-    ],
-    [string],
-    "nonpayable"
-  >;
-
-  "deployAndRegisterApp(address,bool,bool,bool,bytes32,bytes32)": TypedContractMethod<
+  deployAndRegisterApp: TypedContractMethod<
     [
       initialOwner: AddressLike,
       disableUpgrades: boolean,
@@ -760,20 +739,7 @@ export interface DstackKms extends BaseContract {
     nameOrSignature: "appImplementation"
   ): TypedContractMethod<[], [string], "view">;
   getFunction(
-    nameOrSignature: "deployAndRegisterApp(address,bool,bool,bytes32,bytes32)"
-  ): TypedContractMethod<
-    [
-      initialOwner: AddressLike,
-      disableUpgrades: boolean,
-      allowAnyDevice: boolean,
-      initialDeviceId: BytesLike,
-      initialComposeHash: BytesLike
-    ],
-    [string],
-    "nonpayable"
-  >;
-  getFunction(
-    nameOrSignature: "deployAndRegisterApp(address,bool,bool,bool,bytes32,bytes32)"
+    nameOrSignature: "deployAndRegisterApp"
   ): TypedContractMethod<
     [
       initialOwner: AddressLike,