@serve.zone/interfaces 28.4.0 → 29.0.0

package/ts/data/runtimesession.ts

@@ -0,0 +1,403 @@
+import type { IIdentityCredential } from './user.js';
+import { isSha256Digest } from './immutableimage.js';
+import type {
+  IRuntimeAssignmentObservationV1, IRuntimeAssignmentReferenceV1, IRuntimeAssignmentV1,
+  IRuntimeControllerV1,
+} from './runtimeassignment.js';
+import {
+  getRuntimeAssignmentV1Reference, snapshotRuntimeAssignmentObservationV1,
+  snapshotRuntimeAssignmentV1, validateRuntimeAssignmentObservationV1, validateRuntimeAssignmentV1,
+} from './runtimeassignment.js';
+import type { IRuntimeConfigV1 } from './runtimeconfig.js';
+import { bindRuntimeConfigV1ToAssignment, snapshotRuntimeConfigV1 } from './runtimeconfig.js';
+import { canonicalizeStrictJson } from '../private/canonicaljson.js';
+
+/**
+ * Server-issued public binding for the current authenticated physical connection.
+ * It contains no bearer, peer ID or client-selected authority. A serialized binding
+ * is not authentication: every receiver must compare it with its live peer context.
+ * Onebox local execution uses the same shape with its own authenticated IPC owner.
+ */
+export interface IRuntimeSessionBindingV1 {
+  schemaVersion: 1;
+  reporterSessionId: string;
+  nodeId: string;
+  credentialGeneration: number;
+  sessionEpoch: number;
+  controllerInstanceId: string;
+  controller: IRuntimeControllerV1;
+  runtimeNamespace: string;
+}
+
+/** Pallet-initiated WSS on its configured Cloudly HTTPS origin; never HTTP RPC. */
+export interface IRegisterPalletRuntimeSessionRequestV1 {
+  schemaVersion: 1;
+  nodeId: string;
+  credentialGeneration: number;
+  /** Sensitive ephemeral input; exclude the complete request from hooks and logs. */
+  bearer: string;
+}
+
+export interface IApplyRuntimeAssignmentRequestV1 {
+  session: IRuntimeSessionBindingV1;
+  assignment: IRuntimeAssignmentV1;
+  config: IRuntimeConfigV1;
+  /** Exact removed incumbent for a new attempt; not assignment.previous. */
+  predecessor: IRuntimeAssignmentReferenceV1 | null;
+}
+
+/** Durable admission acknowledgement only; it asserts neither effects nor readiness. */
+export interface IApplyRuntimeAssignmentResponseV1 {
+  status: 'accepted' | 'replay' | 'historical';
+  assignment: IRuntimeAssignmentReferenceV1;
+}
+
+export interface IReportRuntimeAssignmentObservationRequestV1 {
+  /** Always the CURRENT authenticated connection, including after credential rotation. */
+  session: IRuntimeSessionBindingV1;
+  /** Exact durable outbox body. Never rewrite reporterSessionId, digest or sequence. */
+  observation: IRuntimeAssignmentObservationV1;
+}
+
+export type TRuntimeObservationAuthorityUseV1 = 'current-session' | 'historical-recovery';
+
+export interface IReportRuntimeAssignmentObservationResponseV1 {
+  /** Exact request body after a durable sequence/receipt transaction. */
+  observation: IRuntimeAssignmentObservationV1;
+  /**
+   * Historical recovery can advance the durable counter and ACK only. It must not
+   * update active readiness, routing or liveness; those require a fresh report
+   * from the current session. Neither classification is proof of writer fencing.
+   */
+  authorityUse: TRuntimeObservationAuthorityUseV1;
+}
+
+export interface IGetRuntimeRegistryCredentialRequestV1 {
+  session: IRuntimeSessionBindingV1;
+  /** The server must authorize this exact CURRENT assignment, including its node. */
+  assignment: IRuntimeAssignmentReferenceV1;
+}
+
+/** Sensitive ephemeral material; never persist, hash, log or include in diagnostics. */
+export interface IGetRuntimeRegistryCredentialResponseV1 {
+  username: string;
+  password: string;
+  expiresAt: number;
+}
+
+/** Cloudly human/machine JWT registration on a physical TypedSocket; reject HTTP. */
+export interface IRegisterCloudlyClientSessionRequestV1 {
+  schemaVersion: 1;
+  /** Authenticate the current JWT server-side; do not accept client identity claims. */
+  identity: IIdentityCredential;
+}
+
+export interface IRegisterCloudlyClientSessionResponseV1 {
+  /** Server-owned identity tagging completed; never trust a client-authored tag. */
+  registered: true;
+}
+
+export const runtimeSessionV1Contract = Object.freeze({
+  maximumWireCanonicalBytes: 327_680,
+  maximumCredentialBytes: 16_384,
+  maximumRegistryPasswordBytes: 8192,
+  registerTransport: 'pallet-initiated-wss-on-configured-cloudly-https-origin',
+  historicalObservationAuthority: 'durable-counter-and-ack-only',
+  error: 'Runtime session contract rejected.',
+} as const);
+
+const fail = (): never => { throw new Error(runtimeSessionV1Contract.error); };
+function requireValue(conditionArg: unknown): asserts conditionArg {
+  if (!conditionArg) fail();
+}
+const safe = <T>(operationArg: () => T): T => {
+  try { return operationArg(); } catch { return fail(); }
+};
+const encoder = new TextEncoder();
+const canonical = (valueArg: unknown): string => canonicalizeStrictJson(valueArg, fail);
+const positive = (valueArg: unknown): number => {
+  requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && valueArg > 0);
+  return valueArg;
+};
+const identifier = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(valueArg));
+  return valueArg;
+};
+const nodeId = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg));
+  return valueArg;
+};
+
+/** Bound decoded JSON before canonicalization; copy data descriptors, never getters. */
+const capture = (valueArg: unknown): unknown => safe(() => {
+  let nodes = 0;
+  let stringBytes = 0;
+  const ancestors = new Set<object>();
+  const account = (value: string): void => {
+    requireValue(value.length <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+    stringBytes += encoder.encode(value).byteLength;
+    requireValue(stringBytes <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+  };
+  const copy = (value: unknown, depth: number): unknown => {
+    requireValue(++nodes <= 10_240 && depth <= 16);
+    if (typeof value === 'string') { account(value); return value; }
+    if (value === null || typeof value === 'boolean' || typeof value === 'number') return value;
+    requireValue(value !== null && typeof value === 'object' && !ancestors.has(value));
+    ancestors.add(value);
+    try {
+      const array = Array.isArray(value);
+      const prototype = Object.getPrototypeOf(value);
+      requireValue(array ? prototype === Array.prototype : prototype === Object.prototype || prototype === null);
+      const keys = Reflect.ownKeys(value);
+      requireValue(keys.length <= 257);
+      if (array) {
+        const length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
+        requireValue(Number.isSafeInteger(length) && length >= 0 && length <= 256 && keys.length === length + 1);
+        const result: unknown[] = [];
+        for (let index = 0; index < length; index++) {
+          const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+          requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+          result.push(copy(descriptor.value, depth + 1));
+        }
+        return result;
+      }
+      const result: Record<string, unknown> = Object.create(null);
+      for (const key of keys) {
+        requireValue(typeof key === 'string');
+        account(key);
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+        result[key] = copy(descriptor.value, depth + 1);
+      }
+      return result;
+    } finally { ancestors.delete(value); }
+  };
+  const serialized = canonical(copy(valueArg, 0));
+  requireValue(encoder.encode(serialized).byteLength <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+  return JSON.parse(serialized);
+});
+
+const record = (valueArg: unknown, keysArg: readonly string[]): Record<string, unknown> => {
+  requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
+  const keys = Object.keys(valueArg);
+  requireValue(keys.length === keysArg.length && keys.every((key) => keysArg.includes(key)));
+  return valueArg as Record<string, unknown>;
+};
+const reference = (valueArg: unknown): IRuntimeAssignmentReferenceV1 => {
+  const value = record(valueArg, ['assignmentId', 'generation', 'digest']);
+  requireValue(typeof value.digest === 'string' && isSha256Digest(value.digest));
+  return { assignmentId: identifier(value.assignmentId), generation: positive(value.generation), digest: value.digest };
+};
+const session = (valueArg: unknown): IRuntimeSessionBindingV1 => {
+  const value = record(valueArg, ['schemaVersion', 'reporterSessionId', 'nodeId', 'credentialGeneration',
+    'sessionEpoch', 'controllerInstanceId', 'controller', 'runtimeNamespace']);
+  const controller = record(value.controller, ['kind', 'id', 'epoch']);
+  requireValue(value.schemaVersion === 1 && (controller.kind === 'cloudly' || controller.kind === 'onebox'));
+  return {
+    schemaVersion: 1, reporterSessionId: identifier(value.reporterSessionId), nodeId: nodeId(value.nodeId),
+    credentialGeneration: positive(value.credentialGeneration), sessionEpoch: positive(value.sessionEpoch),
+    controllerInstanceId: identifier(value.controllerInstanceId),
+    controller: { kind: controller.kind, id: identifier(controller.id), epoch: identifier(controller.epoch) },
+    runtimeNamespace: identifier(value.runtimeNamespace),
+  };
+};
+const sameSession = (leftArg: IRuntimeSessionBindingV1, rightArg: IRuntimeSessionBindingV1): boolean =>
+  canonical(leftArg) === canonical(rightArg);
+const sameOwner = (leftArg: IRuntimeSessionBindingV1, rightArg: IRuntimeSessionBindingV1): boolean =>
+  leftArg.nodeId === rightArg.nodeId && leftArg.runtimeNamespace === rightArg.runtimeNamespace
+  && canonical(leftArg.controller) === canonical(rightArg.controller);
+const matchesAssignment = (sessionArg: IRuntimeSessionBindingV1, assignmentArg: IRuntimeAssignmentV1): boolean =>
+  sessionArg.nodeId === assignmentArg.nodeId && sessionArg.runtimeNamespace === assignmentArg.runtimeNamespace
+  && canonical(sessionArg.controller) === canonical(assignmentArg.controller);
+
+/** Synchronous detached structural assertion only; never an authentication check. */
+export const snapshotRuntimeSessionBindingV1 = (valueArg: unknown): IRuntimeSessionBindingV1 =>
+  safe(() => session(capture(valueArg)));
+
+export const snapshotRegisterPalletRuntimeSessionRequestV1 = (
+  valueArg: unknown,
+): IRegisterPalletRuntimeSessionRequestV1 => safe(() => {
+  const value = record(capture(valueArg), ['schemaVersion', 'nodeId', 'credentialGeneration', 'bearer']);
+  requireValue(value.schemaVersion === 1 && typeof value.bearer === 'string'
+    && /^palletToken[0-9a-f]{64}$/.test(value.bearer));
+  return { schemaVersion: 1, nodeId: nodeId(value.nodeId),
+    credentialGeneration: positive(value.credentialGeneration), bearer: value.bearer };
+});
+
+export const snapshotApplyRuntimeAssignmentRequestV1 = (
+  valueArg: unknown,
+): IApplyRuntimeAssignmentRequestV1 => safe(() => {
+  const value = record(capture(valueArg), ['session', 'assignment', 'config', 'predecessor']);
+  const assignment = snapshotRuntimeAssignmentV1(value.assignment);
+  const predecessor = value.predecessor === null ? null : reference(value.predecessor);
+  // Assignment revisions use assignment.previous; a replacement names a different attempt.
+  requireValue(predecessor === null || predecessor.assignmentId !== assignment.assignmentId);
+  return { session: session(value.session), assignment, config: snapshotRuntimeConfigV1(value.config), predecessor };
+});
+
+export const snapshotApplyRuntimeAssignmentResponseV1 = (
+  valueArg: unknown,
+): IApplyRuntimeAssignmentResponseV1 => safe(() => {
+  const value = record(capture(valueArg), ['status', 'assignment']);
+  requireValue(value.status === 'accepted' || value.status === 'replay' || value.status === 'historical');
+  return { status: value.status, assignment: reference(value.assignment) };
+});
+
+export const snapshotReportRuntimeAssignmentObservationRequestV1 = (
+  valueArg: unknown,
+): IReportRuntimeAssignmentObservationRequestV1 => safe(() => {
+  const value = record(capture(valueArg), ['session', 'observation']);
+  return { session: session(value.session), observation: snapshotRuntimeAssignmentObservationV1(value.observation) };
+});
+
+export const snapshotReportRuntimeAssignmentObservationResponseV1 = (
+  valueArg: unknown,
+): IReportRuntimeAssignmentObservationResponseV1 => safe(() => {
+  const value = record(capture(valueArg), ['observation', 'authorityUse']);
+  requireValue(value.authorityUse === 'current-session' || value.authorityUse === 'historical-recovery');
+  return { observation: snapshotRuntimeAssignmentObservationV1(value.observation), authorityUse: value.authorityUse };
+});
+
+export const snapshotGetRuntimeRegistryCredentialRequestV1 = (
+  valueArg: unknown,
+): IGetRuntimeRegistryCredentialRequestV1 => safe(() => {
+  const value = record(capture(valueArg), ['session', 'assignment']);
+  return { session: session(value.session), assignment: reference(value.assignment) };
+});
+
+export const snapshotGetRuntimeRegistryCredentialResponseV1 = (
+  valueArg: unknown,
+): IGetRuntimeRegistryCredentialResponseV1 => safe(() => {
+  const value = record(capture(valueArg), ['username', 'password', 'expiresAt']);
+  requireValue(typeof value.username === 'string' && value.username.length > 0
+    && encoder.encode(value.username).byteLength <= 1024 && !/[\s:\u0000-\u001f\u007f]/.test(value.username));
+  requireValue(typeof value.password === 'string' && value.password.length > 0
+    && encoder.encode(value.password).byteLength <= runtimeSessionV1Contract.maximumRegistryPasswordBytes
+    && !/[\u0000-\u001f\u007f]/.test(value.password));
+  return { username: value.username, password: value.password, expiresAt: positive(value.expiresAt) };
+});
+
+export const snapshotRegisterCloudlyClientSessionRequestV1 = (
+  valueArg: unknown,
+): IRegisterCloudlyClientSessionRequestV1 => safe(() => {
+  const value = record(capture(valueArg), ['schemaVersion', 'identity']);
+  const identity = record(value.identity, ['jwt']);
+  requireValue(value.schemaVersion === 1 && typeof identity.jwt === 'string'
+    && identity.jwt.length <= runtimeSessionV1Contract.maximumCredentialBytes
+    && /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(identity.jwt));
+  return { schemaVersion: 1, identity: { jwt: identity.jwt } };
+});
+
+export const snapshotRegisterCloudlyClientSessionResponseV1 = (
+  valueArg: unknown,
+): IRegisterCloudlyClientSessionResponseV1 => safe(() => {
+  const value = record(capture(valueArg), ['registered']);
+  requireValue(value.registered === true);
+  return { registered: true };
+});
+
+/** Bind the authenticated Cloudly registration reply to the node and credential sent. */
+export const bindRegisterPalletRuntimeSessionResponseV1 = (
+  valueArg: unknown, requestArg: unknown,
+): IRuntimeSessionBindingV1 => safe(() => {
+  const response = snapshotRuntimeSessionBindingV1(valueArg);
+  const request = snapshotRegisterPalletRuntimeSessionRequestV1(requestArg);
+  requireValue(response.controller.kind === 'cloudly' && response.nodeId === request.nodeId
+    && response.credentialGeneration === request.credentialGeneration);
+  return response;
+});
+
+/** Reject already expired material; issuance policy and current assignment authority remain server-owned. */
+export const bindGetRuntimeRegistryCredentialResponseV1 = (
+  valueArg: unknown, nowArg: number,
+): IGetRuntimeRegistryCredentialResponseV1 => safe(() => {
+  const response = snapshotGetRuntimeRegistryCredentialResponseV1(valueArg);
+  requireValue(response.expiresAt > positive(nowArg));
+  return response;
+});
+
+/**
+ * Capture every input before awaiting digest verification. trustedSessionArg must
+ * come from the receiving live connection, never from another request field.
+ * This binds content only; durable CAS, slot admission and authority remain owners.
+ */
+export const bindApplyRuntimeAssignmentRequestV1 = async (
+  valueArg: unknown, trustedSessionArg: unknown,
+): Promise<IApplyRuntimeAssignmentRequestV1> => {
+  try {
+    const request = snapshotApplyRuntimeAssignmentRequestV1(valueArg);
+    const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
+    requireValue(sameSession(request.session, trustedSession) && matchesAssignment(trustedSession, request.assignment));
+    await bindRuntimeConfigV1ToAssignment(request.config, request.assignment);
+    return request;
+  } catch { return fail(); }
+};
+
+/** Match an admission acknowledgement to the exact sent revision, including historical replies. */
+export const bindApplyRuntimeAssignmentResponseV1 = (
+  valueArg: unknown, requestArg: unknown,
+): IApplyRuntimeAssignmentResponseV1 => safe(() => {
+  const response = snapshotApplyRuntimeAssignmentResponseV1(valueArg);
+  const request = snapshotApplyRuntimeAssignmentRequestV1(requestArg);
+  requireValue(canonical(response.assignment) === canonical(getRuntimeAssignmentV1Reference(request.assignment)));
+  return response;
+});
+
+/**
+ * trustedSessionArg is the CURRENT authenticated physical peer. reporterHistoryArg
+ * must be server-indexed immutable session history, obtained by the original
+ * observation's reporterSessionId; never accept caller-supplied history. All V1
+ * runtime sessions are Pallet-purpose sessions, so Spark history cannot qualify.
+ *
+ * This verifies content and classifies recovery, not authentication, history
+ * provenance, sequence admission or current authority. The server must transact
+ * receipt/counter acceptance under current credential and peer authority. A
+ * historical result MUST NOT restore active readiness, routes or liveness.
+ */
+export const bindReportRuntimeAssignmentObservationRequestV1 = async (
+  valueArg: unknown, assignmentArg: unknown, trustedSessionArg: unknown, reporterHistoryArg: unknown,
+): Promise<{ request: IReportRuntimeAssignmentObservationRequestV1; authorityUse: TRuntimeObservationAuthorityUseV1 }> => {
+  try {
+    const request = snapshotReportRuntimeAssignmentObservationRequestV1(valueArg);
+    const assignment = snapshotRuntimeAssignmentV1(capture(assignmentArg));
+    const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
+    const reporterHistory = snapshotRuntimeSessionBindingV1(reporterHistoryArg);
+    requireValue(sameSession(request.session, trustedSession) && matchesAssignment(trustedSession, assignment)
+      && request.observation.reporterSessionId === reporterHistory.reporterSessionId
+      && sameOwner(trustedSession, reporterHistory));
+    const current = sameSession(reporterHistory, trustedSession);
+    requireValue(current || (reporterHistory.reporterSessionId !== trustedSession.reporterSessionId
+      && reporterHistory.sessionEpoch < trustedSession.sessionEpoch
+      && reporterHistory.credentialGeneration <= trustedSession.credentialGeneration));
+    requireValue((await validateRuntimeAssignmentObservationV1(request.observation, assignment)).length === 0);
+    return { request, authorityUse: current ? 'current-session' : 'historical-recovery' };
+  } catch { return fail(); }
+};
+
+/** Reject body rewriting and a historical receipt mislabeled as current authority. */
+export const bindReportRuntimeAssignmentObservationResponseV1 = (
+  valueArg: unknown, requestArg: unknown,
+): IReportRuntimeAssignmentObservationResponseV1 => safe(() => {
+  const response = snapshotReportRuntimeAssignmentObservationResponseV1(valueArg);
+  const request = snapshotReportRuntimeAssignmentObservationRequestV1(requestArg);
+  requireValue(canonical(response.observation) === canonical(request.observation)
+    && response.authorityUse === (request.observation.reporterSessionId === request.session.reporterSessionId
+      ? 'current-session' : 'historical-recovery'));
+  return response;
+});
+
+/** Current assignment lookup and live peer authorization remain mandatory server-owned inputs. */
+export const bindGetRuntimeRegistryCredentialRequestV1 = async (
+  valueArg: unknown, assignmentArg: unknown, trustedSessionArg: unknown,
+): Promise<IGetRuntimeRegistryCredentialRequestV1> => {
+  try {
+    const request = snapshotGetRuntimeRegistryCredentialRequestV1(valueArg);
+    const assignment = snapshotRuntimeAssignmentV1(capture(assignmentArg));
+    const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
+    requireValue(sameSession(request.session, trustedSession) && matchesAssignment(trustedSession, assignment)
+      && assignment.disposition === 'run'
+      && canonical(request.assignment) === canonical(getRuntimeAssignmentV1Reference(assignment)));
+    requireValue((await validateRuntimeAssignmentV1(assignment)).length === 0);
+    return request;
+  } catch { return fail(); }
+};

package/ts/requests/index.ts

@@ -27,6 +27,7 @@ import * as nodeRequests from './node.js';
 import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
+import * as runtimeSessionRequests from './runtimesession.js';
 import * as secretRequests from './secret.js';
 import * as serverRequests from './server.js';
 import * as serviceRequests from './service.js';
@@ -64,6 +65,7 @@ export {
   palletRequests as pallet,
   platformRequests as platform,
   routingRequests as routing,
+  runtimeSessionRequests as runtimesession,
   secretRequests as secret,
   serverRequests as server,
   serviceRequests as service,

package/ts/requests/runtimesession.ts

@@ -0,0 +1,52 @@
+import * as plugins from '../plugins.js';
+import type * as data from '../data/runtimesession.js';
+
+/** WSS-only Pallet bootstrap. Derive physical peer/process/idempotency server-side. */
+export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1
+> {
+  method: 'registerPalletRuntimeSessionV1';
+  request: data.IRegisterPalletRuntimeSessionRequestV1;
+  response: data.IRuntimeSessionBindingV1;
+}
+
+/** Controller push over the already authenticated Pallet-initiated connection. */
+export interface IReq_Controller_Pallet_ApplyRuntimeAssignmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Controller_Pallet_ApplyRuntimeAssignmentV1
+> {
+  method: 'applyRuntimeAssignmentV1';
+  request: data.IApplyRuntimeAssignmentRequestV1;
+  response: data.IApplyRuntimeAssignmentResponseV1;
+}
+
+/** Current-peer report, including exact historical outbox recovery after reconnect. */
+export interface IReq_Pallet_Controller_ReportRuntimeAssignmentObservationV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Pallet_Controller_ReportRuntimeAssignmentObservationV1
+> {
+  method: 'reportRuntimeAssignmentObservationV1';
+  request: data.IReportRuntimeAssignmentObservationRequestV1;
+  response: data.IReportRuntimeAssignmentObservationResponseV1;
+}
+
+/** Current-peer, exact current assignment authorization; response is secret material. */
+export interface IReq_Pallet_Controller_GetRuntimeRegistryCredentialV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Pallet_Controller_GetRuntimeRegistryCredentialV1
+> {
+  method: 'getRuntimeRegistryCredentialV1';
+  request: data.IGetRuntimeRegistryCredentialRequestV1;
+  response: data.IGetRuntimeRegistryCredentialResponseV1;
+}
+
+/** WSS-only JWT authentication; server-owned identity tag, never client-authored claims. */
+export interface IReq_Any_Cloudly_RegisterCloudlyClientSessionV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Any_Cloudly_RegisterCloudlyClientSessionV1
+> {
+  method: 'registerCloudlyClientSessionV1';
+  request: data.IRegisterCloudlyClientSessionRequestV1;
+  response: data.IRegisterCloudlyClientSessionResponseV1;
+}