@serve.zone/interfaces 28.4.0 → 28.5.0

package/changelog.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 2026-09-09 - 28.5.0
+
+### Features
+
+- add runtime config v1 contract (data/runtimeconfig)
+  - Introduce runtime config v1 interfaces for execution intent, target ports, readiness, log policy, and immutable image metadata.
+  - Add exact-schema snapshot validation, canonical digest computation, digest validation, and assignment binding helpers.
+  - Export the runtime config data module and add tests for digest vectors, schema bounds, assignment binding, and detached async snapshots.
+
 ## 2026-09-09 - 28.4.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '28.4.0',
+    version: '28.5.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -24,6 +24,7 @@ export * from './nodecredential.js';
 export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
+export * from './runtimeconfig.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';

package/dist_ts/data/index.js

@@ -24,6 +24,7 @@ export * from './nodecredential.js';
 export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
+export * from './runtimeconfig.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';
@@ -38,4 +39,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9

package/dist_ts/data/runtimeconfig.d.ts

@@ -0,0 +1,122 @@
+import type { IImmutableContainerInvocationPlatformEvidenceV1, IImmutableContainerInvocationV1, TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAssignmentV1, IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
+/** A container target only; declaration does not publish a host or gateway port. */
+export interface IRuntimeConfigTargetPortV1 {
+    name: string;
+    port: number;
+    /** Inclusive; equal to port for a single port. */
+    portEnd: number;
+    protocol: 'tcp' | 'udp';
+}
+export interface IRuntimeConfigReadinessTimingV1 {
+    /** Measured from the evidenced container start; no probes before this delay. */
+    initialDelayMs: number;
+    /** Failures during this startup grace cannot mark the workload unhealthy. */
+    startupGraceMs: number;
+    /** Probe start-to-start interval; probes must never overlap. */
+    intervalMs: number;
+    /** Per-probe deadline, including connection, TLS and HTTP response headers. */
+    timeoutMs: number;
+    /** Consecutive successful probes needed before ready becomes true. */
+    successThreshold: number;
+    /** Consecutive failures after startup grace needed to declare unhealthy. */
+    failureThreshold: number;
+}
+export type TRuntimeConfigReadinessV1 = IRuntimeConfigReadinessTimingV1 & ({
+    kind: 'process';
+} | {
+    kind: 'tcp';
+    targetPort: string;
+    port: number;
+} | {
+    kind: 'http';
+    targetPort: string;
+    port: number;
+    scheme: 'http' | 'https';
+    /**
+     * Host header name and HTTPS SNI/certificate hostname. Connect only to the
+     * evidenced container endpoint, never resolve this name as a probe target.
+     * HTTPS verifies system trust and this hostname; no insecure TLS mode.
+     */
+    host: string;
+    /** Canonical origin-form request target, including any nonsecret query. */
+    path: string;
+    /** Sorted unique final HTTP response status codes. */
+    expectedStatusCodes: number[];
+    /** A redirect response is evaluated as received; it cannot redirect probes. */
+    followRedirects: false;
+});
+export interface IRuntimeConfigLogPolicyV1 {
+    /** Maximum UTF-8 bytes in one captured stdout/stderr line. */
+    maximumLineBytes: number;
+    /** Maximum bytes waiting for delivery; overflow requires explicit evidence. */
+    maximumBufferedBytes: number;
+    /** Retention of archived logs; durable payloads belong to SmartBucket. */
+    retentionMs: number;
+}
+/**
+ * Controller-owned resolved nonsecret execution intent. OCI command, effective
+ * environment, working directory and identity must be resolved before sealing;
+ * consumers must not append inherited image defaults or choose runtime defaults.
+ * Secrets, network identity and storage claims remain separately assignment-bound
+ * owner references. This document contains no registry credentials or host paths.
+ */
+export interface IRuntimeConfigV1 extends IRuntimeAuthorityReferenceV1 {
+    schemaVersion: 1;
+    organizationId: string;
+    serviceId: string;
+    image: {
+        registryHost: string;
+        repository: string;
+        /** Root descriptor digest, which may be an OCI platform index. */
+        imageDigest: TSha256Digest;
+        invocation: IImmutableContainerInvocationV1;
+    };
+    /** Complete effective public environment; secret values must never be inlined. */
+    environment: Record<string, string>;
+    workingDirectory: string;
+    cpuMillis: number;
+    memoryBytes: number;
+    readonlyRootfs: boolean;
+    runAsUser: number;
+    runAsGroup: number;
+    /** Sorted unique names, with no overlapping ranges for the same transport. */
+    targetPorts: IRuntimeConfigTargetPortV1[];
+    readiness: TRuntimeConfigReadinessV1;
+    /**
+     * SmartData owns log metadata and SmartBucket owns archived payloads. This
+     * policy does not authorize persistent local files. Any CRI log capture uses
+     * disposable process-local transport artifacts and must evidence bounded
+     * buffering, backpressure and lost data; it must not silently truncate logs.
+     */
+    logs: IRuntimeConfigLogPolicyV1;
+}
+export interface IRuntimeConfigAssignmentBindingV1 {
+    config: IRuntimeConfigV1;
+    assignment: IRuntimeAssignmentV1;
+    platformEvidence: IImmutableContainerInvocationPlatformEvidenceV1;
+}
+export declare const runtimeConfigV1Contract: Readonly<{
+    readonly digestDomain: "serve.zone/runtime-config-v1";
+    readonly maximumCanonicalBytes: 262144;
+    readonly maximumEnvironmentEntries: 128;
+    readonly maximumTargetPorts: 64;
+    readonly maximumReadinessDurationMs: 3600000;
+    readonly maximumLogRetentionMs: 31536000000;
+}>;
+/**
+ * Detached exact-schema snapshot for synchronous persistence assertions. Digest
+ * integrity, scope authorization, admission and runtime readiness are not implied.
+ */
+export declare const snapshotRuntimeConfigV1: (valueArg: unknown) => IRuntimeConfigV1;
+/** Domain-separated canonical JSON excludes only the config's own digest. */
+export declare const computeRuntimeConfigV1Digest: (configArg: IRuntimeConfigV1) => Promise<TSha256Digest>;
+export declare const validateRuntimeConfigV1: (valueArg: unknown) => Promise<string[]>;
+/**
+ * Bind valid content to one exact assignment and select its platform evidence.
+ * No assignment digest is embedded in the config, avoiding circular hashes.
+ * This proves content consistency only: the caller must authenticate the
+ * controller, durably admit the attempt, resolve other owner references, and
+ * verify runtime and readiness evidence before effects or route publication.
+ */
+export declare const bindRuntimeConfigV1ToAssignment: (configArg: unknown, assignmentArg: unknown) => Promise<IRuntimeConfigAssignmentBindingV1>;

package/dist_ts/data/runtimeconfig.js

@@ -0,0 +1,278 @@
+import { buildDigestPinnedImageReference, isSha256Digest, validateImmutableContainerInvocation, verifyImmutableContainerInvocationDigest, } from './immutableimage.js';
+import { snapshotRuntimeAssignmentV1, validateRuntimeAssignmentV1 } from './runtimeassignment.js';
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+export const runtimeConfigV1Contract = Object.freeze({
+    digestDomain: 'serve.zone/runtime-config-v1',
+    maximumCanonicalBytes: 262_144,
+    maximumEnvironmentEntries: 128,
+    maximumTargetPorts: 64,
+    maximumReadinessDurationMs: 3_600_000,
+    maximumLogRetentionMs: 31_536_000_000,
+});
+const fail = (messageArg) => { throw new Error(messageArg); };
+const encoder = new TextEncoder();
+const isInteger = (valueArg, minimumArg, maximumArg) => typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && !Object.is(valueArg, -0)
+    && valueArg >= minimumArg && valueArg <= maximumArg;
+const isIdentifier = (valueArg) => typeof valueArg === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(valueArg);
+const isDigest = (valueArg) => typeof valueArg === 'string' && isSha256Digest(valueArg);
+const isPortName = (valueArg) => typeof valueArg === 'string' && /^[a-z0-9][a-z0-9_.-]{0,62}$/.test(valueArg);
+const isExactRecord = (valueArg, keysArg) => {
+    if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg))
+        return false;
+    const keys = Object.keys(valueArg);
+    return keys.length === keysArg.length && keys.every((keyArg) => keysArg.includes(keyArg));
+};
+/**
+ * Bound traversal before canonicalization and copy descriptor values so input
+ * getters/toJSON never run. The canonical helper supplies scalar Unicode and
+ * safe-integer validation. Detached output is obtained before any async work.
+ */
+const snapshotBoundedJson = (valueArg) => {
+    let nodes = 0;
+    let stringBytes = 0;
+    const ancestors = new Set();
+    const accountString = (value) => {
+        if (value.length > runtimeConfigV1Contract.maximumCanonicalBytes)
+            fail('runtime config string is oversized');
+        stringBytes += encoder.encode(value).byteLength;
+        if (stringBytes > runtimeConfigV1Contract.maximumCanonicalBytes)
+            fail('runtime config is oversized');
+    };
+    const copy = (value, depth) => {
+        if (++nodes > 8192 || depth > 12)
+            fail('runtime config exceeds structural bounds');
+        if (typeof value === 'string') {
+            accountString(value);
+            return value;
+        }
+        if (value === null || typeof value === 'boolean' || typeof value === 'number')
+            return value;
+        if (!value || typeof value !== 'object')
+            fail('runtime config contains a non-JSON value');
+        if (ancestors.has(value))
+            fail('runtime config contains a cycle');
+        ancestors.add(value);
+        try {
+            const array = Array.isArray(value);
+            const prototype = Object.getPrototypeOf(value);
+            if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) {
+                fail('runtime config requires plain records and arrays');
+            }
+            const keys = Reflect.ownKeys(value);
+            if (keys.length > 257)
+                fail('runtime config object exceeds key bounds');
+            if (array) {
+                const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length');
+                const length = lengthDescriptor?.value;
+                if (!isInteger(length, 0, 256) || keys.length !== length + 1) {
+                    fail('runtime config requires bounded dense arrays');
+                }
+                const result = [];
+                for (let index = 0; index < length; index++) {
+                    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+                        fail('runtime config array contains a missing or non-data entry');
+                    }
+                    result.push(copy(descriptor.value, depth + 1));
+                }
+                return result;
+            }
+            const result = Object.create(null);
+            for (const key of keys) {
+                if (typeof key !== 'string')
+                    fail('runtime config contains a symbol key');
+                accountString(key);
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+                    fail('runtime config requires enumerable data properties');
+                }
+                result[key] = copy(descriptor.value, depth + 1);
+            }
+            return result;
+        }
+        finally {
+            ancestors.delete(value);
+        }
+    };
+    const canonical = canonicalizeStrictJson(copy(valueArg, 0), fail);
+    if (encoder.encode(canonical).byteLength > runtimeConfigV1Contract.maximumCanonicalBytes) {
+        fail('runtime config canonical JSON is oversized');
+    }
+    return JSON.parse(canonical);
+};
+const timingKeys = ['initialDelayMs', 'startupGraceMs', 'intervalMs', 'timeoutMs',
+    'successThreshold', 'failureThreshold'];
+const assertReadiness = (valueArg, portsArg) => {
+    if (!valueArg || typeof valueArg !== 'object')
+        fail('runtime config readiness is required');
+    const value = valueArg;
+    const keys = value.kind === 'process' ? ['kind', ...timingKeys]
+        : value.kind === 'tcp' ? ['kind', ...timingKeys, 'targetPort', 'port']
+            : value.kind === 'http' ? ['kind', ...timingKeys, 'targetPort', 'port',
+                'scheme', 'host', 'path', 'expectedStatusCodes', 'followRedirects'] : [];
+    if (keys.length === 0 || !isExactRecord(value, keys)
+        || !isInteger(value.initialDelayMs, 0, runtimeConfigV1Contract.maximumReadinessDurationMs)
+        || !isInteger(value.startupGraceMs, 0, runtimeConfigV1Contract.maximumReadinessDurationMs)
+        || !isInteger(value.intervalMs, 100, runtimeConfigV1Contract.maximumReadinessDurationMs)
+        || !isInteger(value.timeoutMs, 1, 60_000)
+        || !isInteger(value.successThreshold, 1, 100)
+        || !isInteger(value.failureThreshold, 1, 100)
+        || value.timeoutMs > value.intervalMs || value.initialDelayMs > value.startupGraceMs) {
+        fail('runtime config readiness must use explicit bounded timing and exact schema');
+    }
+    if (value.kind === 'process')
+        return;
+    const target = portsArg.find((portArg) => portArg.name === value.targetPort);
+    if (!isPortName(value.targetPort) || !target || target.protocol !== 'tcp'
+        || !isInteger(value.port, target.port, target.portEnd)) {
+        fail('runtime config readiness must select a declared TCP target and port');
+    }
+    if (value.kind === 'tcp')
+        return;
+    if ((value.scheme !== 'http' && value.scheme !== 'https') || value.followRedirects !== false
+        || typeof value.host !== 'string' || value.host.length > 253
+        || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/.test(value.host)
+        || typeof value.path !== 'string' || value.path.length > 4096
+        || !value.path.startsWith('/') || value.path.startsWith('//')
+        || /[^\x21-\x7e]|[\\#]/.test(value.path)
+        || /%(?![0-9A-F]{2})/.test(value.path)
+        || !Array.isArray(value.expectedStatusCodes) || value.expectedStatusCodes.length === 0
+        || value.expectedStatusCodes.length > 32) {
+        fail('runtime config HTTP readiness must use an exact bounded request policy');
+    }
+    const parsed = new URL(value.path, 'http://runtime.invalid');
+    if (`${parsed.pathname}${parsed.search}` !== value.path)
+        fail('runtime config HTTP path must be canonical');
+    let previousCode = 0;
+    for (const code of value.expectedStatusCodes) {
+        if (!isInteger(code, 200, 599) || code <= previousCode) {
+            fail('runtime config HTTP status expectations must be sorted unique final codes');
+        }
+        previousCode = code;
+    }
+};
+const assertConfig = (valueArg) => {
+    if (!isExactRecord(valueArg, ['schemaVersion', 'id', 'generation', 'organizationId', 'serviceId',
+        'image', 'environment', 'workingDirectory', 'cpuMillis', 'memoryBytes', 'readonlyRootfs',
+        'runAsUser', 'runAsGroup', 'targetPorts', 'readiness', 'logs', 'digest'])
+        || valueArg.schemaVersion !== 1 || !isIdentifier(valueArg.id)
+        || !isInteger(valueArg.generation, 1, Number.MAX_SAFE_INTEGER)
+        || !isIdentifier(valueArg.organizationId) || !isIdentifier(valueArg.serviceId)
+        || !isDigest(valueArg.digest))
+        fail('runtime config must use its exact v1 schema');
+    const image = valueArg.image;
+    if (!isExactRecord(image, ['registryHost', 'repository', 'imageDigest', 'invocation'])
+        || typeof image.registryHost !== 'string' || image.registryHost.length > 253
+        || typeof image.repository !== 'string' || image.repository.length > 255
+        || !isDigest(image.imageDigest)
+        || validateImmutableContainerInvocation(image.invocation).length !== 0) {
+        fail('runtime config image must contain exact immutable invocation evidence');
+    }
+    buildDigestPinnedImageReference(image.registryHost, image.repository, image.imageDigest);
+    const environment = valueArg.environment;
+    if (!environment || typeof environment !== 'object' || Array.isArray(environment)
+        || Object.keys(environment).length > runtimeConfigV1Contract.maximumEnvironmentEntries) {
+        fail('runtime config requires an explicit bounded nonsecret environment');
+    }
+    for (const [key, value] of Object.entries(environment)) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key) || typeof value !== 'string'
+            || value.includes('\u0000') || encoder.encode(value).byteLength > 8192) {
+            fail('runtime config environment must contain bounded string entries');
+        }
+    }
+    const directory = valueArg.workingDirectory;
+    if (typeof directory !== 'string' || !directory.startsWith('/')
+        || encoder.encode(directory).byteLength > 4096 || /[\u0000-\u001f\u007f]/.test(directory)
+        || (directory !== '/' && directory.split('/').slice(1).some((partArg) => !partArg || partArg === '.' || partArg === '..'))
+        || !isInteger(valueArg.cpuMillis, 1, 1_000_000)
+        || !isInteger(valueArg.memoryBytes, 16 * 1024 * 1024, 2 ** 50)
+        || typeof valueArg.readonlyRootfs !== 'boolean'
+        || !isInteger(valueArg.runAsUser, 0, 2 ** 31 - 1)
+        || !isInteger(valueArg.runAsGroup, 0, 2 ** 31 - 1)) {
+        fail('runtime config requires canonical directory, explicit resources and numeric identity');
+    }
+    const ports = valueArg.targetPorts;
+    if (!Array.isArray(ports) || ports.length > runtimeConfigV1Contract.maximumTargetPorts) {
+        fail('runtime config target ports must be a bounded array');
+    }
+    let previousName = '';
+    const validatedPorts = [];
+    for (const port of ports) {
+        if (!isExactRecord(port, ['name', 'port', 'portEnd', 'protocol'])
+            || !isPortName(port.name) || port.name <= previousName
+            || !isInteger(port.port, 1, 65535) || !isInteger(port.portEnd, port.port, 65535)
+            || (port.protocol !== 'tcp' && port.protocol !== 'udp')
+            || validatedPorts.some((previousArg) => previousArg.protocol === port.protocol
+                && port.port <= previousArg.portEnd && port.portEnd >= previousArg.port)) {
+            fail('runtime config target ports require sorted unique names and nonoverlapping transport ranges');
+        }
+        previousName = port.name;
+        validatedPorts.push(port);
+    }
+    assertReadiness(valueArg.readiness, validatedPorts);
+    const logs = valueArg.logs;
+    if (!isExactRecord(logs, ['maximumLineBytes', 'maximumBufferedBytes', 'retentionMs'])
+        || !isInteger(logs.maximumLineBytes, 1, 1_048_576)
+        || !isInteger(logs.maximumBufferedBytes, 1, 67_108_864)
+        || logs.maximumBufferedBytes < logs.maximumLineBytes
+        || !isInteger(logs.retentionMs, 1, runtimeConfigV1Contract.maximumLogRetentionMs)) {
+        fail('runtime config logs require explicit bounded line, buffer and retention limits');
+    }
+    return valueArg;
+};
+/**
+ * Detached exact-schema snapshot for synchronous persistence assertions. Digest
+ * integrity, scope authorization, admission and runtime readiness are not implied.
+ */
+export const snapshotRuntimeConfigV1 = (valueArg) => assertConfig(snapshotBoundedJson(valueArg));
+/** Domain-separated canonical JSON excludes only the config's own digest. */
+export const computeRuntimeConfigV1Digest = async (configArg) => {
+    const { digest: _digest, ...payload } = snapshotRuntimeConfigV1(configArg);
+    return `sha256:${await createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+        domain: runtimeConfigV1Contract.digestDomain, payload,
+    }, fail), fail)}`;
+};
+const validateSnapshot = async (configArg) => {
+    if (!await verifyImmutableContainerInvocationDigest(configArg.image.invocation)) {
+        return ['runtime config immutable invocation digest does not match'];
+    }
+    return configArg.digest === await computeRuntimeConfigV1Digest(configArg)
+        ? [] : ['runtime config digest does not match'];
+};
+export const validateRuntimeConfigV1 = async (valueArg) => {
+    try {
+        return await validateSnapshot(snapshotRuntimeConfigV1(valueArg));
+    }
+    catch {
+        return ['runtime config must use its exact canonical v1 schema'];
+    }
+};
+/**
+ * Bind valid content to one exact assignment and select its platform evidence.
+ * No assignment digest is embedded in the config, avoiding circular hashes.
+ * This proves content consistency only: the caller must authenticate the
+ * controller, durably admit the attempt, resolve other owner references, and
+ * verify runtime and readiness evidence before effects or route publication.
+ */
+export const bindRuntimeConfigV1ToAssignment = async (configArg, assignmentArg) => {
+    const config = snapshotRuntimeConfigV1(configArg);
+    const assignment = snapshotRuntimeAssignmentV1(snapshotBoundedJson(assignmentArg));
+    if ((await validateSnapshot(config)).length !== 0
+        || (await validateRuntimeAssignmentV1(assignment)).length !== 0) {
+        fail('runtime config binding requires valid config, invocation and assignment digests');
+    }
+    const reference = assignment.workload.config;
+    if (reference.id !== config.id || reference.generation !== config.generation
+        || reference.digest !== config.digest || assignment.organizationId !== config.organizationId
+        || assignment.serviceId !== config.serviceId
+        || assignment.workload.registryHost !== config.image.registryHost
+        || assignment.workload.repository !== config.image.repository
+        || assignment.workload.imageDigest !== config.image.imageDigest) {
+        fail('runtime config does not match the exact assignment reference, ownership and image');
+    }
+    const platformEvidence = config.image.invocation.evidence.find((entryArg) => entryArg.platform === assignment.workload.platform);
+    if (!platformEvidence)
+        fail('runtime config lacks exact assignment platform evidence');
+    return { config, assignment, platformEvidence };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWNvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvcnVudGltZWNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQ0wsK0JBQStCLEVBQy9CLGNBQWMsRUFDZCxvQ0FBb0MsRUFDcEMsd0NBQXdDLEdBQ3pDLE1BQU0scUJBQXFCLENBQUM7QUFFN0IsT0FBTyxFQUFFLDJCQUEyQixFQUFFLDJCQUEyQixFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDbEcsT0FBTyxFQUFFLHNCQUFzQixFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFzR25HLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbkQsWUFBWSxFQUFFLDhCQUE4QjtJQUM1QyxxQkFBcUIsRUFBRSxPQUFPO0lBQzlCLHlCQUF5QixFQUFFLEdBQUc7SUFDOUIsa0JBQWtCLEVBQUUsRUFBRTtJQUN0QiwwQkFBMEIsRUFBRSxTQUFTO0lBQ3JDLHFCQUFxQixFQUFFLGNBQWM7Q0FDN0IsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQWtDLENBQUMsVUFBVSxFQUFFLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzdGLE1BQU0sT0FBTyxHQUFHLElBQUksV0FBVyxFQUFFLENBQUM7QUFDbEMsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFVBQWtCLEVBQUUsVUFBa0IsRUFBc0IsRUFBRSxDQUNsRyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO09BQ3ZGLFFBQVEsSUFBSSxVQUFVLElBQUksUUFBUSxJQUFJLFVBQVUsQ0FBQztBQUN0RCxNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDN0QsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUN2RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FDaEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUMzRCxNQUFNLFVBQVUsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDM0QsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLDZCQUE2QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUMvRSxNQUFNLGFBQWEsR0FBRyxDQUNwQixRQUFpQixFQUFFLE9BQTBCLEVBQ1IsRUFBRTtJQUN2QyxJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3ZGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkMsT0FBTyxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBQzVGLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBaUIsRUFBVyxFQUFFO0lBQ3pELElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLElBQUksV0FBVyxHQUFHLENBQUMsQ0FBQztJQUNwQixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3BDLE1BQU0sYUFBYSxHQUFHLENBQUMsS0FBYSxFQUFRLEVBQUU7UUFDNUMsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLHVCQUF1QixDQUFDLHFCQUFxQjtZQUFFLElBQUksQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO1FBQzdHLFdBQVcsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFVBQVUsQ0FBQztRQUNoRCxJQUFJLFdBQVcsR0FBRyx1QkFBdUIsQ0FBQyxxQkFBcUI7WUFBRSxJQUFJLENBQUMsNkJBQTZCLENBQUMsQ0FBQztJQUN2RyxDQUFDLENBQUM7SUFDRixNQUFNLElBQUksR0FBRyxDQUFDLEtBQWMsRUFBRSxLQUFhLEVBQVcsRUFBRTtRQUN0RCxJQUFJLEVBQUUsS0FBSyxHQUFHLElBQUksSUFBSSxLQUFLLEdBQUcsRUFBRTtZQUFFLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO1FBQ25GLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssQ0FBQztRQUFDLENBQUM7UUFDdEUsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDNUYsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQUUsSUFBSSxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDMUYsSUFBSSxTQUFTLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQztZQUFFLElBQUksQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ2xFLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNuQyxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQy9DLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxTQUFTLElBQUksU0FBUyxLQUFLLElBQUksRUFBRSxDQUFDO2dCQUNqRyxJQUFJLENBQUMsa0RBQWtELENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNwQyxJQUFJLElBQUksQ0FBQyxNQUFNLEdBQUcsR0FBRztnQkFBRSxJQUFJLENBQUMsMENBQTBDLENBQUMsQ0FBQztZQUN4RSxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDMUUsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLEVBQUUsS0FBSyxDQUFDO2dCQUN2QyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQzdELElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO2dCQUN2RCxDQUFDO2dCQUNELE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztnQkFDN0IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO29CQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUN6RSxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUM7d0JBQ2pGLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO29CQUNwRSxDQUFDO29CQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ2pELENBQUM7Z0JBQ0QsT0FBTyxNQUFNLENBQUM7WUFDaEIsQ0FBQztZQUNELE1BQU0sTUFBTSxHQUE0QixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVELEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQ3ZCLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtvQkFBRSxJQUFJLENBQUMsc0NBQXNDLENBQUMsQ0FBQztnQkFDMUUsYUFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUNuQixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUMvRCxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUM7b0JBQ2pGLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO2dCQUM3RCxDQUFDO2dCQUNELE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDbEQsQ0FBQztZQUNELE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUM7Z0JBQVMsQ0FBQztZQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFBQyxDQUFDO0lBQ3hDLENBQUMsQ0FBQztJQUNGLE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDbEUsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLFVBQVUsR0FBRyx1QkFBdUIsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1FBQ3pGLElBQUksQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDL0IsQ0FBQyxDQUFDO0FBRUYsTUFBTSxVQUFVLEdBQUcsQ0FBQyxnQkFBZ0IsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsV0FBVztJQUMvRSxrQkFBa0IsRUFBRSxrQkFBa0IsQ0FBVSxDQUFDO0FBQ25ELE1BQU0sZUFBZSxHQUFHLENBQUMsUUFBaUIsRUFBRSxRQUFzQyxFQUFRLEVBQUU7SUFDMUYsSUFBSSxDQUFDLFFBQVEsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRO1FBQUUsSUFBSSxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDNUYsTUFBTSxLQUFLLEdBQUcsUUFBbUMsQ0FBQztJQUNsRCxNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsR0FBRyxVQUFVLENBQUM7UUFDN0QsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxHQUFHLFVBQVUsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDO1lBQ3BFLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsR0FBRyxVQUFVLEVBQUUsWUFBWSxFQUFFLE1BQU07Z0JBQ3BFLFFBQVEsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLHFCQUFxQixFQUFFLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUMvRSxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUM7V0FDL0MsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxDQUFDLEVBQUUsdUJBQXVCLENBQUMsMEJBQTBCLENBQUM7V0FDdkYsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxDQUFDLEVBQUUsdUJBQXVCLENBQUMsMEJBQTBCLENBQUM7V0FDdkYsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxHQUFHLEVBQUUsdUJBQXVCLENBQUMsMEJBQTBCLENBQUM7V0FDckYsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDLEVBQUUsTUFBTSxDQUFDO1dBQ3RDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDO1dBQzFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDO1dBQzFDLEtBQUssQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDLFVBQVUsSUFBSSxLQUFLLENBQUMsY0FBYyxHQUFHLEtBQUssQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUN2RixJQUFJLENBQUMsNEVBQTRFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVM7UUFBRSxPQUFPO0lBQ3JDLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzdFLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssS0FBSztXQUNwRSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDekQsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxLQUFLO1FBQUUsT0FBTztJQUNqQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsSUFBSSxLQUFLLENBQUMsZUFBZSxLQUFLLEtBQUs7V0FDdkYsT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQ3pELENBQUMsdUZBQXVGLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7V0FDekcsT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJO1dBQzFELENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO1dBQzFELG9CQUFvQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDO1dBQ3JDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDO1dBQ25DLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQUMsSUFBSSxLQUFLLENBQUMsbUJBQW1CLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbkYsS0FBSyxDQUFDLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUMzQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUNqRixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSx3QkFBd0IsQ0FBQyxDQUFDO0lBQzdELElBQUksR0FBRyxNQUFNLENBQUMsUUFBUSxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsS0FBSyxLQUFLLENBQUMsSUFBSTtRQUFFLElBQUksQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQzVHLElBQUksWUFBWSxHQUFHLENBQUMsQ0FBQztJQUNyQixLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQzdDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsSUFBSSxJQUFJLElBQUksWUFBWSxFQUFFLENBQUM7WUFDdkQsSUFBSSxDQUFDLDJFQUEyRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELFlBQVksR0FBRyxJQUFJLENBQUM7SUFDdEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBb0IsRUFBRTtJQUMzRCxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLFdBQVc7UUFDOUYsT0FBTyxFQUFFLGFBQWEsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGdCQUFnQjtRQUN4RixXQUFXLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1dBQ3RFLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7V0FDMUQsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixDQUFDO1dBQzNELENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQzNFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7UUFBRSxJQUFJLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUNyRixNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDO0lBQzdCLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsWUFBWSxDQUFDLENBQUM7V0FDakYsT0FBTyxLQUFLLENBQUMsWUFBWSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQ3pFLE9BQU8sS0FBSyxDQUFDLFVBQVUsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUNyRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDO1dBQzVCLG9DQUFvQyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekUsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELCtCQUErQixDQUFDLEtBQUssQ0FBQyxZQUFzQixFQUFFLEtBQUssQ0FBQyxVQUFvQixFQUN0RixLQUFLLENBQUMsV0FBNEIsQ0FBQyxDQUFDO0lBQ3RDLE1BQU0sV0FBVyxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUM7SUFDekMsSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7V0FDNUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxNQUFNLEdBQUcsdUJBQXVCLENBQUMseUJBQXlCLEVBQUUsQ0FBQztRQUN6RixJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBQ0QsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUN2RCxJQUFJLENBQUMsZ0NBQWdDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVE7ZUFDdkUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFVBQVUsR0FBRyxJQUFJLEVBQUUsQ0FBQztZQUN6RSxJQUFJLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztRQUN6RSxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQztJQUM1QyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1dBQzFELE9BQU8sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsVUFBVSxHQUFHLElBQUksSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1dBQ3RGLENBQUMsU0FBUyxLQUFLLEdBQUcsSUFBSSxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxJQUFJLE9BQU8sS0FBSyxHQUFHLElBQUksT0FBTyxLQUFLLElBQUksQ0FBQyxDQUFDO1dBQ3ZILENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxFQUFFLFNBQVMsQ0FBQztXQUM1QyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsV0FBVyxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUM7V0FDM0QsT0FBTyxRQUFRLENBQUMsY0FBYyxLQUFLLFNBQVM7V0FDNUMsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUM7V0FDOUMsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3JELElBQUksQ0FBQyxzRkFBc0YsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsV0FBVyxDQUFDO0lBQ25DLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLEdBQUcsdUJBQXVCLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUN2RixJQUFJLENBQUMscURBQXFELENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxZQUFZLEdBQUcsRUFBRSxDQUFDO0lBQ3RCLE1BQU0sY0FBYyxHQUFpQyxFQUFFLENBQUM7SUFDeEQsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUN6QixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDO2VBQzVELENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxJQUFJLFlBQVk7ZUFDbkQsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQztlQUM3RSxDQUFDLElBQUksQ0FBQyxRQUFRLEtBQUssS0FBSyxJQUFJLElBQUksQ0FBQyxRQUFRLEtBQUssS0FBSyxDQUFDO2VBQ3BELGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLFFBQVE7bUJBQ3hFLElBQUksQ0FBQyxJQUFlLElBQUksV0FBVyxDQUFDLE9BQU8sSUFBSyxJQUFJLENBQUMsT0FBa0IsSUFBSSxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNyRyxJQUFJLENBQUMsNkZBQTZGLENBQUMsQ0FBQztRQUN0RyxDQUFDO1FBQ0QsWUFBWSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUM7UUFDekIsY0FBYyxDQUFDLElBQUksQ0FBQyxJQUE2QyxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUNELGVBQWUsQ0FBQyxRQUFRLENBQUMsU0FBUyxFQUFFLGNBQWMsQ0FBQyxDQUFDO0lBQ3BELE1BQU0sSUFBSSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUM7SUFDM0IsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxrQkFBa0IsRUFBRSxzQkFBc0IsRUFBRSxhQUFhLENBQUMsQ0FBQztXQUNoRixDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQyxFQUFFLFNBQVMsQ0FBQztXQUMvQyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsb0JBQW9CLEVBQUUsQ0FBQyxFQUFFLFVBQVUsQ0FBQztXQUNwRCxJQUFJLENBQUMsb0JBQW9CLEdBQUcsSUFBSSxDQUFDLGdCQUFnQjtXQUNqRCxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUMsRUFBRSx1QkFBdUIsQ0FBQyxxQkFBcUIsQ0FBQyxFQUFFLENBQUM7UUFDcEYsSUFBSSxDQUFDLGdGQUFnRixDQUFDLENBQUM7SUFDekYsQ0FBQztJQUNELE9BQU8sUUFBdUMsQ0FBQztBQUNqRCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFFBQWlCLEVBQW9CLEVBQUUsQ0FDN0UsWUFBWSxDQUFDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFOUMsNkVBQTZFO0FBQzdFLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLEtBQUssRUFBRSxTQUEyQixFQUEwQixFQUFFO0lBQ3hHLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsdUJBQXVCLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDM0UsT0FBTyxVQUFVLE1BQU0sNEJBQTRCLENBQUMsc0JBQXNCLENBQUM7UUFDekUsTUFBTSxFQUFFLHVCQUF1QixDQUFDLFlBQVksRUFBRSxPQUFPO0tBQ3RELEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztBQUNwQixDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLEtBQUssRUFBRSxTQUEyQixFQUFxQixFQUFFO0lBQ2hGLElBQUksQ0FBQyxNQUFNLHdDQUF3QyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUMsTUFBTSxLQUFLLE1BQU0sNEJBQTRCLENBQUMsU0FBUyxDQUFDO1FBQ3ZFLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsc0NBQXNDLENBQUMsQ0FBQztBQUNwRCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxLQUFLLEVBQUUsUUFBaUIsRUFBcUIsRUFBRTtJQUNwRixJQUFJLENBQUM7UUFBQyxPQUFPLE1BQU0sZ0JBQWdCLENBQUMsdUJBQXVCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUFDLENBQUM7SUFDekUsTUFBTSxDQUFDO1FBQUMsT0FBTyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFBQyxDQUFDO0FBQzdFLENBQUMsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLEtBQUssRUFDbEQsU0FBa0IsRUFBRSxhQUFzQixFQUNFLEVBQUU7SUFDOUMsTUFBTSxNQUFNLEdBQUcsdUJBQXVCLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbEQsTUFBTSxVQUFVLEdBQUcsMkJBQTJCLENBQUMsbUJBQW1CLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUNuRixJQUFJLENBQUMsTUFBTSxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQzVDLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNsRSxJQUFJLENBQUMsaUZBQWlGLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7SUFDN0MsSUFBSSxTQUFTLENBQUMsRUFBRSxLQUFLLE1BQU0sQ0FBQyxFQUFFLElBQUksU0FBUyxDQUFDLFVBQVUsS0FBSyxNQUFNLENBQUMsVUFBVTtXQUN2RSxTQUFTLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxNQUFNLElBQUksVUFBVSxDQUFDLGNBQWMsS0FBSyxNQUFNLENBQUMsY0FBYztXQUN6RixVQUFVLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxTQUFTO1dBQ3pDLFVBQVUsQ0FBQyxRQUFRLENBQUMsWUFBWSxLQUFLLE1BQU0sQ0FBQyxLQUFLLENBQUMsWUFBWTtXQUM5RCxVQUFVLENBQUMsUUFBUSxDQUFDLFVBQVUsS0FBSyxNQUFNLENBQUMsS0FBSyxDQUFDLFVBQVU7V0FDMUQsVUFBVSxDQUFDLFFBQVEsQ0FBQyxXQUFXLEtBQUssTUFBTSxDQUFDLEtBQUssQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNsRSxJQUFJLENBQUMsbUZBQW1GLENBQUMsQ0FBQztJQUM1RixDQUFDO0lBQ0QsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUM1RCxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsS0FBSyxVQUFVLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FDakUsQ0FBQztJQUNGLElBQUksQ0FBQyxnQkFBZ0I7UUFBRSxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN2RixPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO0FBQ2xELENBQUMsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "28.4.0",
+  "version": "28.5.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '28.4.0',
+  version: '28.5.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -24,6 +24,7 @@ export * from './nodecredential.js';
 export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
+export * from './runtimeconfig.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';

package/ts/data/runtimeconfig.ts

@@ -0,0 +1,385 @@
+import type {
+  IImmutableContainerInvocationPlatformEvidenceV1,
+  IImmutableContainerInvocationV1,
+  TSha256Digest,
+} from './immutableimage.js';
+import {
+  buildDigestPinnedImageReference,
+  isSha256Digest,
+  validateImmutableContainerInvocation,
+  verifyImmutableContainerInvocationDigest,
+} from './immutableimage.js';
+import type { IRuntimeAssignmentV1, IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
+import { snapshotRuntimeAssignmentV1, validateRuntimeAssignmentV1 } from './runtimeassignment.js';
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+
+/** A container target only; declaration does not publish a host or gateway port. */
+export interface IRuntimeConfigTargetPortV1 {
+  name: string;
+  port: number;
+  /** Inclusive; equal to port for a single port. */
+  portEnd: number;
+  protocol: 'tcp' | 'udp';
+}
+
+export interface IRuntimeConfigReadinessTimingV1 {
+  /** Measured from the evidenced container start; no probes before this delay. */
+  initialDelayMs: number;
+  /** Failures during this startup grace cannot mark the workload unhealthy. */
+  startupGraceMs: number;
+  /** Probe start-to-start interval; probes must never overlap. */
+  intervalMs: number;
+  /** Per-probe deadline, including connection, TLS and HTTP response headers. */
+  timeoutMs: number;
+  /** Consecutive successful probes needed before ready becomes true. */
+  successThreshold: number;
+  /** Consecutive failures after startup grace needed to declare unhealthy. */
+  failureThreshold: number;
+}
+
+export type TRuntimeConfigReadinessV1 = IRuntimeConfigReadinessTimingV1 & (
+  | { kind: 'process' }
+  | { kind: 'tcp'; targetPort: string; port: number }
+  | {
+    kind: 'http';
+    targetPort: string;
+    port: number;
+    scheme: 'http' | 'https';
+    /**
+     * Host header name and HTTPS SNI/certificate hostname. Connect only to the
+     * evidenced container endpoint, never resolve this name as a probe target.
+     * HTTPS verifies system trust and this hostname; no insecure TLS mode.
+     */
+    host: string;
+    /** Canonical origin-form request target, including any nonsecret query. */
+    path: string;
+    /** Sorted unique final HTTP response status codes. */
+    expectedStatusCodes: number[];
+    /** A redirect response is evaluated as received; it cannot redirect probes. */
+    followRedirects: false;
+  }
+);
+
+export interface IRuntimeConfigLogPolicyV1 {
+  /** Maximum UTF-8 bytes in one captured stdout/stderr line. */
+  maximumLineBytes: number;
+  /** Maximum bytes waiting for delivery; overflow requires explicit evidence. */
+  maximumBufferedBytes: number;
+  /** Retention of archived logs; durable payloads belong to SmartBucket. */
+  retentionMs: number;
+}
+
+/**
+ * Controller-owned resolved nonsecret execution intent. OCI command, effective
+ * environment, working directory and identity must be resolved before sealing;
+ * consumers must not append inherited image defaults or choose runtime defaults.
+ * Secrets, network identity and storage claims remain separately assignment-bound
+ * owner references. This document contains no registry credentials or host paths.
+ */
+export interface IRuntimeConfigV1 extends IRuntimeAuthorityReferenceV1 {
+  schemaVersion: 1;
+  organizationId: string;
+  serviceId: string;
+  image: {
+    registryHost: string;
+    repository: string;
+    /** Root descriptor digest, which may be an OCI platform index. */
+    imageDigest: TSha256Digest;
+    invocation: IImmutableContainerInvocationV1;
+  };
+  /** Complete effective public environment; secret values must never be inlined. */
+  environment: Record<string, string>;
+  workingDirectory: string;
+  cpuMillis: number;
+  memoryBytes: number;
+  readonlyRootfs: boolean;
+  runAsUser: number;
+  runAsGroup: number;
+  /** Sorted unique names, with no overlapping ranges for the same transport. */
+  targetPorts: IRuntimeConfigTargetPortV1[];
+  readiness: TRuntimeConfigReadinessV1;
+  /**
+   * SmartData owns log metadata and SmartBucket owns archived payloads. This
+   * policy does not authorize persistent local files. Any CRI log capture uses
+   * disposable process-local transport artifacts and must evidence bounded
+   * buffering, backpressure and lost data; it must not silently truncate logs.
+   */
+  logs: IRuntimeConfigLogPolicyV1;
+}
+
+export interface IRuntimeConfigAssignmentBindingV1 {
+  config: IRuntimeConfigV1;
+  assignment: IRuntimeAssignmentV1;
+  platformEvidence: IImmutableContainerInvocationPlatformEvidenceV1;
+}
+
+export const runtimeConfigV1Contract = Object.freeze({
+  digestDomain: 'serve.zone/runtime-config-v1',
+  maximumCanonicalBytes: 262_144,
+  maximumEnvironmentEntries: 128,
+  maximumTargetPorts: 64,
+  maximumReadinessDurationMs: 3_600_000,
+  maximumLogRetentionMs: 31_536_000_000,
+} as const);
+
+const fail: (messageArg: string) => never = (messageArg) => { throw new Error(messageArg); };
+const encoder = new TextEncoder();
+const isInteger = (valueArg: unknown, minimumArg: number, maximumArg: number): valueArg is number =>
+  typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && !Object.is(valueArg, -0)
+  && valueArg >= minimumArg && valueArg <= maximumArg;
+const isIdentifier = (valueArg: unknown): valueArg is string =>
+  typeof valueArg === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(valueArg);
+const isDigest = (valueArg: unknown): valueArg is TSha256Digest =>
+  typeof valueArg === 'string' && isSha256Digest(valueArg);
+const isPortName = (valueArg: unknown): valueArg is string =>
+  typeof valueArg === 'string' && /^[a-z0-9][a-z0-9_.-]{0,62}$/.test(valueArg);
+const isExactRecord = (
+  valueArg: unknown, keysArg: readonly string[],
+): valueArg is Record<string, unknown> => {
+  if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) return false;
+  const keys = Object.keys(valueArg);
+  return keys.length === keysArg.length && keys.every((keyArg) => keysArg.includes(keyArg));
+};
+
+/**
+ * Bound traversal before canonicalization and copy descriptor values so input
+ * getters/toJSON never run. The canonical helper supplies scalar Unicode and
+ * safe-integer validation. Detached output is obtained before any async work.
+ */
+const snapshotBoundedJson = (valueArg: unknown): unknown => {
+  let nodes = 0;
+  let stringBytes = 0;
+  const ancestors = new Set<object>();
+  const accountString = (value: string): void => {
+    if (value.length > runtimeConfigV1Contract.maximumCanonicalBytes) fail('runtime config string is oversized');
+    stringBytes += encoder.encode(value).byteLength;
+    if (stringBytes > runtimeConfigV1Contract.maximumCanonicalBytes) fail('runtime config is oversized');
+  };
+  const copy = (value: unknown, depth: number): unknown => {
+    if (++nodes > 8192 || depth > 12) fail('runtime config exceeds structural bounds');
+    if (typeof value === 'string') { accountString(value); return value; }
+    if (value === null || typeof value === 'boolean' || typeof value === 'number') return value;
+    if (!value || typeof value !== 'object') fail('runtime config contains a non-JSON value');
+    if (ancestors.has(value)) fail('runtime config contains a cycle');
+    ancestors.add(value);
+    try {
+      const array = Array.isArray(value);
+      const prototype = Object.getPrototypeOf(value);
+      if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) {
+        fail('runtime config requires plain records and arrays');
+      }
+      const keys = Reflect.ownKeys(value);
+      if (keys.length > 257) fail('runtime config object exceeds key bounds');
+      if (array) {
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length');
+        const length = lengthDescriptor?.value;
+        if (!isInteger(length, 0, 256) || keys.length !== length + 1) {
+          fail('runtime config requires bounded dense arrays');
+        }
+        const result: unknown[] = [];
+        for (let index = 0; index < length; index++) {
+          const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+          if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+            fail('runtime config array contains a missing or non-data entry');
+          }
+          result.push(copy(descriptor.value, depth + 1));
+        }
+        return result;
+      }
+      const result: Record<string, unknown> = Object.create(null);
+      for (const key of keys) {
+        if (typeof key !== 'string') fail('runtime config contains a symbol key');
+        accountString(key);
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+          fail('runtime config requires enumerable data properties');
+        }
+        result[key] = copy(descriptor.value, depth + 1);
+      }
+      return result;
+    } finally { ancestors.delete(value); }
+  };
+  const canonical = canonicalizeStrictJson(copy(valueArg, 0), fail);
+  if (encoder.encode(canonical).byteLength > runtimeConfigV1Contract.maximumCanonicalBytes) {
+    fail('runtime config canonical JSON is oversized');
+  }
+  return JSON.parse(canonical);
+};
+
+const timingKeys = ['initialDelayMs', 'startupGraceMs', 'intervalMs', 'timeoutMs',
+  'successThreshold', 'failureThreshold'] as const;
+const assertReadiness = (valueArg: unknown, portsArg: IRuntimeConfigTargetPortV1[]): void => {
+  if (!valueArg || typeof valueArg !== 'object') fail('runtime config readiness is required');
+  const value = valueArg as Record<string, unknown>;
+  const keys = value.kind === 'process' ? ['kind', ...timingKeys]
+    : value.kind === 'tcp' ? ['kind', ...timingKeys, 'targetPort', 'port']
+      : value.kind === 'http' ? ['kind', ...timingKeys, 'targetPort', 'port',
+        'scheme', 'host', 'path', 'expectedStatusCodes', 'followRedirects'] : [];
+  if (keys.length === 0 || !isExactRecord(value, keys)
+    || !isInteger(value.initialDelayMs, 0, runtimeConfigV1Contract.maximumReadinessDurationMs)
+    || !isInteger(value.startupGraceMs, 0, runtimeConfigV1Contract.maximumReadinessDurationMs)
+    || !isInteger(value.intervalMs, 100, runtimeConfigV1Contract.maximumReadinessDurationMs)
+    || !isInteger(value.timeoutMs, 1, 60_000)
+    || !isInteger(value.successThreshold, 1, 100)
+    || !isInteger(value.failureThreshold, 1, 100)
+    || value.timeoutMs > value.intervalMs || value.initialDelayMs > value.startupGraceMs) {
+    fail('runtime config readiness must use explicit bounded timing and exact schema');
+  }
+  if (value.kind === 'process') return;
+  const target = portsArg.find((portArg) => portArg.name === value.targetPort);
+  if (!isPortName(value.targetPort) || !target || target.protocol !== 'tcp'
+    || !isInteger(value.port, target.port, target.portEnd)) {
+    fail('runtime config readiness must select a declared TCP target and port');
+  }
+  if (value.kind === 'tcp') return;
+  if ((value.scheme !== 'http' && value.scheme !== 'https') || value.followRedirects !== false
+    || typeof value.host !== 'string' || value.host.length > 253
+    || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/.test(value.host)
+    || typeof value.path !== 'string' || value.path.length > 4096
+    || !value.path.startsWith('/') || value.path.startsWith('//')
+    || /[^\x21-\x7e]|[\\#]/.test(value.path)
+    || /%(?![0-9A-F]{2})/.test(value.path)
+    || !Array.isArray(value.expectedStatusCodes) || value.expectedStatusCodes.length === 0
+    || value.expectedStatusCodes.length > 32) {
+    fail('runtime config HTTP readiness must use an exact bounded request policy');
+  }
+  const parsed = new URL(value.path, 'http://runtime.invalid');
+  if (`${parsed.pathname}${parsed.search}` !== value.path) fail('runtime config HTTP path must be canonical');
+  let previousCode = 0;
+  for (const code of value.expectedStatusCodes) {
+    if (!isInteger(code, 200, 599) || code <= previousCode) {
+      fail('runtime config HTTP status expectations must be sorted unique final codes');
+    }
+    previousCode = code;
+  }
+};
+
+const assertConfig = (valueArg: unknown): IRuntimeConfigV1 => {
+  if (!isExactRecord(valueArg, ['schemaVersion', 'id', 'generation', 'organizationId', 'serviceId',
+    'image', 'environment', 'workingDirectory', 'cpuMillis', 'memoryBytes', 'readonlyRootfs',
+    'runAsUser', 'runAsGroup', 'targetPorts', 'readiness', 'logs', 'digest'])
+    || valueArg.schemaVersion !== 1 || !isIdentifier(valueArg.id)
+    || !isInteger(valueArg.generation, 1, Number.MAX_SAFE_INTEGER)
+    || !isIdentifier(valueArg.organizationId) || !isIdentifier(valueArg.serviceId)
+    || !isDigest(valueArg.digest)) fail('runtime config must use its exact v1 schema');
+  const image = valueArg.image;
+  if (!isExactRecord(image, ['registryHost', 'repository', 'imageDigest', 'invocation'])
+    || typeof image.registryHost !== 'string' || image.registryHost.length > 253
+    || typeof image.repository !== 'string' || image.repository.length > 255
+    || !isDigest(image.imageDigest)
+    || validateImmutableContainerInvocation(image.invocation).length !== 0) {
+    fail('runtime config image must contain exact immutable invocation evidence');
+  }
+  buildDigestPinnedImageReference(image.registryHost as string, image.repository as string,
+    image.imageDigest as TSha256Digest);
+  const environment = valueArg.environment;
+  if (!environment || typeof environment !== 'object' || Array.isArray(environment)
+    || Object.keys(environment).length > runtimeConfigV1Contract.maximumEnvironmentEntries) {
+    fail('runtime config requires an explicit bounded nonsecret environment');
+  }
+  for (const [key, value] of Object.entries(environment)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key) || typeof value !== 'string'
+      || value.includes('\u0000') || encoder.encode(value).byteLength > 8192) {
+      fail('runtime config environment must contain bounded string entries');
+    }
+  }
+  const directory = valueArg.workingDirectory;
+  if (typeof directory !== 'string' || !directory.startsWith('/')
+    || encoder.encode(directory).byteLength > 4096 || /[\u0000-\u001f\u007f]/.test(directory)
+    || (directory !== '/' && directory.split('/').slice(1).some((partArg) => !partArg || partArg === '.' || partArg === '..'))
+    || !isInteger(valueArg.cpuMillis, 1, 1_000_000)
+    || !isInteger(valueArg.memoryBytes, 16 * 1024 * 1024, 2 ** 50)
+    || typeof valueArg.readonlyRootfs !== 'boolean'
+    || !isInteger(valueArg.runAsUser, 0, 2 ** 31 - 1)
+    || !isInteger(valueArg.runAsGroup, 0, 2 ** 31 - 1)) {
+    fail('runtime config requires canonical directory, explicit resources and numeric identity');
+  }
+  const ports = valueArg.targetPorts;
+  if (!Array.isArray(ports) || ports.length > runtimeConfigV1Contract.maximumTargetPorts) {
+    fail('runtime config target ports must be a bounded array');
+  }
+  let previousName = '';
+  const validatedPorts: IRuntimeConfigTargetPortV1[] = [];
+  for (const port of ports) {
+    if (!isExactRecord(port, ['name', 'port', 'portEnd', 'protocol'])
+      || !isPortName(port.name) || port.name <= previousName
+      || !isInteger(port.port, 1, 65535) || !isInteger(port.portEnd, port.port, 65535)
+      || (port.protocol !== 'tcp' && port.protocol !== 'udp')
+      || validatedPorts.some((previousArg) => previousArg.protocol === port.protocol
+        && (port.port as number) <= previousArg.portEnd && (port.portEnd as number) >= previousArg.port)) {
+      fail('runtime config target ports require sorted unique names and nonoverlapping transport ranges');
+    }
+    previousName = port.name;
+    validatedPorts.push(port as unknown as IRuntimeConfigTargetPortV1);
+  }
+  assertReadiness(valueArg.readiness, validatedPorts);
+  const logs = valueArg.logs;
+  if (!isExactRecord(logs, ['maximumLineBytes', 'maximumBufferedBytes', 'retentionMs'])
+    || !isInteger(logs.maximumLineBytes, 1, 1_048_576)
+    || !isInteger(logs.maximumBufferedBytes, 1, 67_108_864)
+    || logs.maximumBufferedBytes < logs.maximumLineBytes
+    || !isInteger(logs.retentionMs, 1, runtimeConfigV1Contract.maximumLogRetentionMs)) {
+    fail('runtime config logs require explicit bounded line, buffer and retention limits');
+  }
+  return valueArg as unknown as IRuntimeConfigV1;
+};
+
+/**
+ * Detached exact-schema snapshot for synchronous persistence assertions. Digest
+ * integrity, scope authorization, admission and runtime readiness are not implied.
+ */
+export const snapshotRuntimeConfigV1 = (valueArg: unknown): IRuntimeConfigV1 =>
+  assertConfig(snapshotBoundedJson(valueArg));
+
+/** Domain-separated canonical JSON excludes only the config's own digest. */
+export const computeRuntimeConfigV1Digest = async (configArg: IRuntimeConfigV1): Promise<TSha256Digest> => {
+  const { digest: _digest, ...payload } = snapshotRuntimeConfigV1(configArg);
+  return `sha256:${await createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+    domain: runtimeConfigV1Contract.digestDomain, payload,
+  }, fail), fail)}`;
+};
+
+const validateSnapshot = async (configArg: IRuntimeConfigV1): Promise<string[]> => {
+  if (!await verifyImmutableContainerInvocationDigest(configArg.image.invocation)) {
+    return ['runtime config immutable invocation digest does not match'];
+  }
+  return configArg.digest === await computeRuntimeConfigV1Digest(configArg)
+    ? [] : ['runtime config digest does not match'];
+};
+
+export const validateRuntimeConfigV1 = async (valueArg: unknown): Promise<string[]> => {
+  try { return await validateSnapshot(snapshotRuntimeConfigV1(valueArg)); }
+  catch { return ['runtime config must use its exact canonical v1 schema']; }
+};
+
+/**
+ * Bind valid content to one exact assignment and select its platform evidence.
+ * No assignment digest is embedded in the config, avoiding circular hashes.
+ * This proves content consistency only: the caller must authenticate the
+ * controller, durably admit the attempt, resolve other owner references, and
+ * verify runtime and readiness evidence before effects or route publication.
+ */
+export const bindRuntimeConfigV1ToAssignment = async (
+  configArg: unknown, assignmentArg: unknown,
+): Promise<IRuntimeConfigAssignmentBindingV1> => {
+  const config = snapshotRuntimeConfigV1(configArg);
+  const assignment = snapshotRuntimeAssignmentV1(snapshotBoundedJson(assignmentArg));
+  if ((await validateSnapshot(config)).length !== 0
+    || (await validateRuntimeAssignmentV1(assignment)).length !== 0) {
+    fail('runtime config binding requires valid config, invocation and assignment digests');
+  }
+  const reference = assignment.workload.config;
+  if (reference.id !== config.id || reference.generation !== config.generation
+    || reference.digest !== config.digest || assignment.organizationId !== config.organizationId
+    || assignment.serviceId !== config.serviceId
+    || assignment.workload.registryHost !== config.image.registryHost
+    || assignment.workload.repository !== config.image.repository
+    || assignment.workload.imageDigest !== config.image.imageDigest) {
+    fail('runtime config does not match the exact assignment reference, ownership and image');
+  }
+  const platformEvidence = config.image.invocation.evidence.find(
+    (entryArg) => entryArg.platform === assignment.workload.platform,
+  );
+  if (!platformEvidence) fail('runtime config lacks exact assignment platform evidence');
+  return { config, assignment, platformEvidence };
+};