@serve.zone/interfaces 30.5.1 → 30.7.0

package/changelog.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 2026-09-13 - 30.7.0
+
+### Features
+
+- Add bounded canonical protected-network authority and immutable node handoff lease contracts, verify scope and transit-pool bindings, and reject retained port, conntrack zone and label collisions across generations.
+
+## 2026-09-13 - 30.6.0
+
+### Features
+
+- Add current owner-organization summaries and paginated private-network service attachment candidates.
+
+### Fixes
+
+- Use TSBuild 4.4.3 for release compilation and type checking.
+
 ## 2026-09-12 - 30.5.1
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '30.5.1',
+    version: '30.7.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -22,6 +22,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './networkauthority.js';
 export * from './privatenetwork.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';

package/dist_ts/data/index.js

@@ -22,6 +22,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './networkauthority.js';
 export * from './privatenetwork.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
@@ -44,4 +45,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9

package/dist_ts/data/networkauthority.d.ts

@@ -0,0 +1,92 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+/** Controller declaration; a digest does not authenticate completeness or activate a pool. */
+export interface IRuntimeNetworkProtectedAuthorityV1 {
+    schemaVersion: 1;
+    id: string;
+    generation: number;
+    controller: IRuntimeControllerV1;
+    previous: IRuntimeAuthorityReferenceV1 | null;
+    /** Complete canonical IPv4 union, including all pools and protected endpoints. */
+    prefixes: string[];
+    pools: Array<{
+        id: string;
+        purpose: 'workload' | 'transit';
+        prefix: string;
+    }>;
+    resolvers: Array<{
+        id: string;
+        address: string;
+        port: number;
+    }>;
+    /** Exact underlay exceptions; never inside a managed allocation pool. */
+    platformEndpoints: Array<{
+        id: string;
+        address: string;
+        protocol: 'tcp' | 'udp';
+        port: number;
+    }>;
+    /** Includes offline authorities with outstanding grants; omission does not fence them. */
+    egressAuthorities: Array<{
+        nodeId: string;
+        runtimeNamespace: string;
+    }>;
+    digest: TSha256Digest;
+}
+export interface IRuntimeNetworkHandoffPortRangeV1 {
+    protocol: 'tcp' | 'udp';
+    first: number;
+    last: number;
+}
+/** Immutable allocation, retained unchanged while active or quarantined. No expiry implies reuse. */
+export interface IRuntimeNetworkHandoffLeaseV1 {
+    schemaVersion: 1;
+    id: string;
+    generation: number;
+    controller: IRuntimeControllerV1;
+    nodeId: string;
+    runtimeNamespace: string;
+    protectedAuthority: IRuntimeAuthorityReferenceV1;
+    /** Logical allocation incarnation, never a path, PID, inode, descriptor or native capability. */
+    routerIncarnationId: string;
+    transit: {
+        poolId: string;
+        prefix: string;
+        routerAddress: string;
+        hostAddress: string;
+    };
+    sourcePortRanges: IRuntimeNetworkHandoffPortRangeV1[];
+    conntrackZone: number;
+    conntrackLabel: string;
+    digest: TSha256Digest;
+}
+export declare const runtimeNetworkAuthorityV1Contract: Readonly<{
+    readonly protectedDigestDomain: "serve.zone/runtime-network-protected-authority-v1";
+    readonly handoffDigestDomain: "serve.zone/runtime-network-handoff-lease-v1";
+    readonly maximumPrefixes: 128;
+    readonly maximumPools: 64;
+    readonly maximumResolvers: 16;
+    readonly maximumPlatformEndpoints: 64;
+    readonly maximumEgressAuthorities: 256;
+    readonly maximumPortRanges: 16;
+    readonly maximumRetainedHandoffLeases: 256;
+    readonly activation: "all-affected-egress-barriers-or-independent-fences-before-allocation";
+    readonly quarantine: "retain-until-exact-authority-acknowledgements-or-independent-fence";
+    readonly omission: "no-effect";
+}>;
+/** Structural snapshot only. Complete inventory, signatures and activation barriers are caller-owned. */
+export declare const snapshotRuntimeNetworkProtectedAuthorityV1: (value: unknown) => IRuntimeNetworkProtectedAuthorityV1;
+export declare const snapshotRuntimeNetworkHandoffLeaseV1: (value: unknown) => IRuntimeNetworkHandoffLeaseV1;
+export declare const computeRuntimeNetworkProtectedAuthorityV1Digest: (value: IRuntimeNetworkProtectedAuthorityV1) => Promise<TSha256Digest>;
+export declare const computeRuntimeNetworkHandoffLeaseV1Digest: (value: IRuntimeNetworkHandoffLeaseV1) => Promise<TSha256Digest>;
+/** Detached, digest-verified allocation binding. Does not establish pool activation or live link identity. */
+export declare const bindRuntimeNetworkHandoffLeaseV1: (leaseValue: unknown, authorityValue: unknown) => Promise<{
+    lease: IRuntimeNetworkHandoffLeaseV1;
+    authority: IRuntimeNetworkProtectedAuthorityV1;
+}>;
+/**
+ * Validate ALL retained leases for one physical node/controller epoch, including quarantine.
+ * The owning transactional ledger must supply its complete history and serialize reservations.
+ * Namespace replacement, an empty CT dump or process exit never removes an entry from this set.
+ */
+export declare const snapshotRuntimeNetworkHandoffLedgerV1: (value: unknown) => Promise<IRuntimeNetworkHandoffLeaseV1[]>;

package/dist_ts/data/networkauthority.js

@@ -0,0 +1,244 @@
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+export const runtimeNetworkAuthorityV1Contract = Object.freeze({
+    protectedDigestDomain: 'serve.zone/runtime-network-protected-authority-v1',
+    handoffDigestDomain: 'serve.zone/runtime-network-handoff-lease-v1',
+    maximumPrefixes: 128,
+    maximumPools: 64,
+    maximumResolvers: 16,
+    maximumPlatformEndpoints: 64,
+    maximumEgressAuthorities: 256,
+    maximumPortRanges: 16,
+    maximumRetainedHandoffLeases: 256,
+    activation: 'all-affected-egress-barriers-or-independent-fences-before-allocation',
+    quarantine: 'retain-until-exact-authority-acknowledgements-or-independent-fence',
+    omission: 'no-effect',
+});
+const fail = () => { throw new Error('Runtime network authority contract rejected.'); };
+function requireValue(value) { if (!value)
+    fail(); }
+const safe = (operation) => { try {
+    return operation();
+}
+catch {
+    return fail();
+} };
+const record = (value, keys) => {
+    requireValue(value !== null && typeof value === 'object' && !Array.isArray(value));
+    const prototype = Object.getPrototypeOf(value);
+    requireValue(prototype === Object.prototype || prototype === null);
+    const actual = Reflect.ownKeys(value);
+    requireValue(actual.length === keys.length && keys.every(key => actual.includes(key)));
+    const result = Object.create(null);
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+        result[key] = descriptor.value;
+    }
+    return result;
+};
+const list = (value, maximum, read) => {
+    requireValue(Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype);
+    const length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
+    requireValue(Number.isSafeInteger(length) && length <= maximum && Reflect.ownKeys(value).length === length + 1);
+    const result = [];
+    for (let index = 0; index < length; index++) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+        result.push(read(descriptor.value));
+    }
+    return result;
+};
+const id = (value) => {
+    requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+    return value;
+};
+const integer = (value, maximum = Number.MAX_SAFE_INTEGER - 1) => {
+    requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= maximum);
+    return value;
+};
+const digest = (value) => {
+    requireValue(typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value));
+    return value;
+};
+const controller = (value) => {
+    const item = record(value, ['kind', 'id', 'epoch']);
+    requireValue(item.kind === 'cloudly' || item.kind === 'onebox');
+    return { kind: item.kind, id: id(item.id), epoch: id(item.epoch) };
+};
+const reference = (value) => {
+    const item = record(value, ['id', 'generation', 'digest']);
+    return { id: id(item.id), generation: integer(item.generation), digest: digest(item.digest) };
+};
+const protocol = (value) => {
+    requireValue(value === 'tcp' || value === 'udp');
+    return value;
+};
+const sorted = (values, key) => {
+    requireValue(values.every((value, index) => index === 0 || key(values[index - 1]) < key(value)));
+    return values;
+};
+const address = (value) => {
+    requireValue(typeof value === 'string' && value.length <= 15);
+    const parts = value.split('.');
+    requireValue(parts.length === 4 && parts.every(part => /^(?:0|[1-9][0-9]{0,2})$/.test(part) && Number(part) <= 255));
+    return value;
+};
+const numericAddress = (value) => value.split('.').reduce((sum, part) => sum * 256 + Number(part), 0);
+const endpointAddress = (value) => {
+    const result = address(value), first = Number(result.split('.')[0]);
+    requireValue(first > 0 && first < 224 && first !== 127);
+    return result;
+};
+const prefix = (value) => {
+    requireValue(typeof value === 'string' && value.length <= 18);
+    const parts = value.split('/');
+    requireValue(parts.length === 2 && /^(?:[0-9]|[12][0-9]|3[0-2])$/.test(parts[1]));
+    const base = numericAddress(address(parts[0])), width = 2 ** (32 - Number(parts[1]));
+    requireValue(base % width === 0);
+    return value;
+};
+const bounds = (value) => {
+    const [base, bits] = value.split('/'), first = numericAddress(base);
+    return [first, first + 2 ** (32 - Number(bits)) - 1];
+};
+const contains = (outer, inner) => {
+    const [a, b] = bounds(outer), [c, d] = bounds(inner);
+    return a <= c && b >= d;
+};
+const overlaps = (left, right) => {
+    const [a, b] = bounds(left), [c, d] = bounds(right);
+    return a <= d && c <= b;
+};
+const privatePrefix = (value) => {
+    const result = prefix(value);
+    requireValue(['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'].some(range => contains(range, result)));
+    return result;
+};
+const nonoverlapping = (values) => {
+    for (let index = 0; index < values.length; index++)
+        for (let other = 0; other < index; other++) {
+            requireValue(!overlaps(values[index], values[other]));
+        }
+};
+const canonical = (value) => canonicalizeStrictJson(value, fail);
+const equals = (left, right) => canonical(left) === canonical(right);
+/** Structural snapshot only. Complete inventory, signatures and activation barriers are caller-owned. */
+export const snapshotRuntimeNetworkProtectedAuthorityV1 = (value) => safe(() => {
+    const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'previous', 'prefixes',
+        'pools', 'resolvers', 'platformEndpoints', 'egressAuthorities', 'digest']);
+    requireValue(item.schemaVersion === 1);
+    const identity = id(item.id), generation = integer(item.generation);
+    const previous = item.previous === null ? null : reference(item.previous);
+    requireValue(generation === 1 ? previous === null : previous?.id === identity && previous.generation === generation - 1);
+    const prefixes = sorted(list(item.prefixes, runtimeNetworkAuthorityV1Contract.maximumPrefixes, prefix), value => value);
+    requireValue(prefixes.length > 0);
+    nonoverlapping(prefixes);
+    const protectedPrefix = (value) => requireValue(prefixes.some(range => contains(range, value)));
+    const pools = sorted(list(item.pools, runtimeNetworkAuthorityV1Contract.maximumPools, value => {
+        const pool = record(value, ['id', 'purpose', 'prefix']);
+        requireValue(pool.purpose === 'workload' || pool.purpose === 'transit');
+        const result = {
+            id: id(pool.id), purpose: pool.purpose, prefix: privatePrefix(pool.prefix),
+        };
+        protectedPrefix(result.prefix);
+        return result;
+    }), value => value.id);
+    nonoverlapping(pools.map(pool => pool.prefix));
+    const readEndpoint = (value, withProtocol) => {
+        const endpoint = record(value, withProtocol ? ['id', 'address', 'protocol', 'port'] : ['id', 'address', 'port']);
+        const result = { id: id(endpoint.id), address: endpointAddress(endpoint.address), port: integer(endpoint.port, 65535) };
+        protectedPrefix(`${result.address}/32`);
+        requireValue(pools.every(pool => !contains(pool.prefix, `${result.address}/32`)));
+        return withProtocol ? { ...result, protocol: protocol(endpoint.protocol) } : result;
+    };
+    const resolvers = sorted(list(item.resolvers, runtimeNetworkAuthorityV1Contract.maximumResolvers, value => readEndpoint(value, false)), value => value.id);
+    const platformEndpoints = sorted(list(item.platformEndpoints, runtimeNetworkAuthorityV1Contract.maximumPlatformEndpoints, value => readEndpoint(value, true)), value => value.id);
+    const allEndpointKeys = [...resolvers.flatMap(value => ['tcp', 'udp'].map(transport => `${value.address}:${value.port}:${transport}`)),
+        ...platformEndpoints.map(value => `${value.address}:${value.port}:${value.protocol}`)];
+    requireValue(new Set(allEndpointKeys).size === allEndpointKeys.length);
+    const egressAuthorities = sorted(list(item.egressAuthorities, runtimeNetworkAuthorityV1Contract.maximumEgressAuthorities, value => {
+        const authority = record(value, ['nodeId', 'runtimeNamespace']);
+        return { nodeId: id(authority.nodeId), runtimeNamespace: id(authority.runtimeNamespace) };
+    }), value => canonical([value.nodeId, value.runtimeNamespace]));
+    requireValue(egressAuthorities.length > 0);
+    return { schemaVersion: 1, id: identity, generation, controller: controller(item.controller), previous,
+        prefixes, pools, resolvers, platformEndpoints, egressAuthorities, digest: digest(item.digest) };
+});
+export const snapshotRuntimeNetworkHandoffLeaseV1 = (value) => safe(() => {
+    const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
+        'protectedAuthority', 'routerIncarnationId', 'transit', 'sourcePortRanges', 'conntrackZone', 'conntrackLabel', 'digest']);
+    requireValue(item.schemaVersion === 1);
+    const transit = record(item.transit, ['poolId', 'prefix', 'routerAddress', 'hostAddress']);
+    const transitPrefix = privatePrefix(transit.prefix), [first, last] = bounds(transitPrefix);
+    const routerAddress = endpointAddress(transit.routerAddress), hostAddress = endpointAddress(transit.hostAddress);
+    requireValue(first !== last && routerAddress !== hostAddress);
+    for (const value of [routerAddress, hostAddress]) {
+        const number = numericAddress(value);
+        requireValue(number >= first && number <= last && (last - first === 1 || (number !== first && number !== last)));
+    }
+    const sourcePortRanges = list(item.sourcePortRanges, runtimeNetworkAuthorityV1Contract.maximumPortRanges, value => {
+        const range = record(value, ['protocol', 'first', 'last']);
+        const result = { protocol: protocol(range.protocol), first: integer(range.first, 65535), last: integer(range.last, 65535) };
+        requireValue(result.first <= result.last);
+        return result;
+    });
+    requireValue(sourcePortRanges.length > 0);
+    for (let index = 1; index < sourcePortRanges.length; index++) {
+        const previous = sourcePortRanges[index - 1], current = sourcePortRanges[index];
+        requireValue(previous.protocol < current.protocol || (previous.protocol === current.protocol && previous.last < current.first));
+    }
+    requireValue(typeof item.conntrackLabel === 'string' && /^[a-f0-9]{32}$/.test(item.conntrackLabel)
+        && item.conntrackLabel !== '0'.repeat(32));
+    return { schemaVersion: 1, id: id(item.id), generation: integer(item.generation), controller: controller(item.controller),
+        nodeId: id(item.nodeId), runtimeNamespace: id(item.runtimeNamespace), protectedAuthority: reference(item.protectedAuthority),
+        routerIncarnationId: id(item.routerIncarnationId), transit: { poolId: id(transit.poolId), prefix: transitPrefix, routerAddress, hostAddress },
+        sourcePortRanges, conntrackZone: integer(item.conntrackZone, 65535), conntrackLabel: item.conntrackLabel, digest: digest(item.digest) };
+});
+const computeDigest = async (domain, value) => {
+    const { digest: omitted, ...payload } = value;
+    return `sha256:${await createCanonicalJsonSha256Hex(canonical({ domain, payload }), fail)}`;
+};
+export const computeRuntimeNetworkProtectedAuthorityV1Digest = (value) => computeDigest(runtimeNetworkAuthorityV1Contract.protectedDigestDomain, snapshotRuntimeNetworkProtectedAuthorityV1(value));
+export const computeRuntimeNetworkHandoffLeaseV1Digest = (value) => computeDigest(runtimeNetworkAuthorityV1Contract.handoffDigestDomain, snapshotRuntimeNetworkHandoffLeaseV1(value));
+/** Detached, digest-verified allocation binding. Does not establish pool activation or live link identity. */
+export const bindRuntimeNetworkHandoffLeaseV1 = async (leaseValue, authorityValue) => {
+    const lease = snapshotRuntimeNetworkHandoffLeaseV1(leaseValue);
+    const authority = snapshotRuntimeNetworkProtectedAuthorityV1(authorityValue);
+    requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
+    requireValue(authority.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(authority));
+    requireValue(equals(lease.controller, authority.controller)
+        && equals(lease.protectedAuthority, { id: authority.id, generation: authority.generation, digest: authority.digest })
+        && authority.egressAuthorities.some(value => value.nodeId === lease.nodeId && value.runtimeNamespace === lease.runtimeNamespace));
+    const pool = authority.pools.find(value => value.id === lease.transit.poolId);
+    requireValue(pool?.purpose === 'transit' && contains(pool.prefix, lease.transit.prefix));
+    return { lease, authority };
+};
+/**
+ * Validate ALL retained leases for one physical node/controller epoch, including quarantine.
+ * The owning transactional ledger must supply its complete history and serialize reservations.
+ * Namespace replacement, an empty CT dump or process exit never removes an entry from this set.
+ */
+export const snapshotRuntimeNetworkHandoffLedgerV1 = async (value) => {
+    const leases = safe(() => list(value, runtimeNetworkAuthorityV1Contract.maximumRetainedHandoffLeases, snapshotRuntimeNetworkHandoffLeaseV1));
+    for (let index = 0; index < leases.length; index++) {
+        const lease = leases[index];
+        requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
+        for (let other = 0; other < index; other++) {
+            const previous = leases[other];
+            requireValue(lease.nodeId === previous.nodeId && equals(lease.controller, previous.controller));
+            requireValue(lease.id !== previous.id || lease.generation !== previous.generation);
+            if (lease.runtimeNamespace === previous.runtimeNamespace && lease.routerIncarnationId === previous.routerIncarnationId) {
+                requireValue(lease.conntrackZone !== previous.conntrackZone && lease.conntrackLabel !== previous.conntrackLabel);
+            }
+            // Host handoff tuples remain reserved even across router or runtime namespace changes.
+            if (lease.transit.routerAddress === previous.transit.routerAddress) {
+                for (const left of lease.sourcePortRanges)
+                    for (const right of previous.sourcePortRanges) {
+                        requireValue(left.protocol !== right.protocol || left.last < right.first || right.last < left.first);
+                    }
+            }
+        }
+    }
+    return leases;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2F1dGhvcml0eS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvbmV0d29ya2F1dGhvcml0eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQTRDbkcsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM3RCxxQkFBcUIsRUFBRSxtREFBbUQ7SUFDMUUsbUJBQW1CLEVBQUUsNkNBQTZDO0lBQ2xFLGVBQWUsRUFBRSxHQUFHO0lBQ3BCLFlBQVksRUFBRSxFQUFFO0lBQ2hCLGdCQUFnQixFQUFFLEVBQUU7SUFDcEIsd0JBQXdCLEVBQUUsRUFBRTtJQUM1Qix3QkFBd0IsRUFBRSxHQUFHO0lBQzdCLGlCQUFpQixFQUFFLEVBQUU7SUFDckIsNEJBQTRCLEVBQUUsR0FBRztJQUNqQyxVQUFVLEVBQUUsc0VBQXNFO0lBQ2xGLFVBQVUsRUFBRSxvRUFBb0U7SUFDaEYsUUFBUSxFQUFFLFdBQVc7Q0FDYixDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDL0YsU0FBUyxZQUFZLENBQUMsS0FBYyxJQUFtQixJQUFJLENBQUMsS0FBSztJQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztBQUM1RSxNQUFNLElBQUksR0FBRyxDQUFJLFNBQWtCLEVBQUssRUFBRSxHQUFHLElBQUksQ0FBQztJQUFDLE9BQU8sU0FBUyxFQUFFLENBQUM7QUFBQyxDQUFDO0FBQUMsTUFBTSxDQUFDO0lBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztBQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDcEcsTUFBTSxNQUFNLEdBQUcsQ0FBQyxLQUFjLEVBQUUsSUFBYyxFQUEyQixFQUFFO0lBQ3pFLFlBQVksQ0FBQyxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNuRixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQy9DLFlBQVksQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDbkUsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN0QyxZQUFZLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN2RixNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDL0QsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUMzRSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQztJQUNqQyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxJQUFJLEdBQUcsQ0FBSSxLQUFjLEVBQUUsT0FBZSxFQUFFLElBQTBCLEVBQU8sRUFBRTtJQUNuRixZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUN2RixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxFQUFFLEtBQUssQ0FBQztJQUN2RSxZQUFZLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksT0FBTyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxLQUFLLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNoSCxNQUFNLE1BQU0sR0FBUSxFQUFFLENBQUM7SUFDdkIsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzVDLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDekUsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN0QyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxFQUFFLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUNwQyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBTyxHQUFHLE1BQU0sQ0FBQyxnQkFBZ0IsR0FBRyxDQUFDLEVBQVUsRUFBRTtJQUNoRixZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsSUFBSSxLQUFLLElBQUksT0FBTyxDQUFDLENBQUM7SUFDeEcsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDLENBQUM7QUFDRixNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBaUIsRUFBRTtJQUMvQyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQy9FLE9BQU8sS0FBc0IsQ0FBQztBQUNoQyxDQUFDLENBQUM7QUFDRixNQUFNLFVBQVUsR0FBRyxDQUFDLEtBQWMsRUFBd0IsRUFBRTtJQUMxRCxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3BELFlBQVksQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxJQUFJLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ2hFLE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQ3JFLENBQUMsQ0FBQztBQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFnQyxFQUFFO0lBQ2pFLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDM0QsT0FBTyxFQUFFLEVBQUUsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDaEcsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxRQUFRLEdBQUcsQ0FBQyxLQUFjLEVBQWlCLEVBQUU7SUFDakQsWUFBWSxDQUFDLEtBQUssS0FBSyxLQUFLLElBQUksS0FBSyxLQUFLLEtBQUssQ0FBQyxDQUFDO0lBQ2pELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBSSxNQUFXLEVBQUUsR0FBeUIsRUFBTyxFQUFFO0lBQ2hFLFlBQVksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxLQUFLLENBQUMsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDakcsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUN6QyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDLENBQUM7SUFDOUQsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUMvQixZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNySCxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQztBQUNGLE1BQU0sY0FBYyxHQUFHLENBQUMsS0FBYSxFQUFVLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDLEdBQUcsR0FBRyxHQUFHLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQ3RILE1BQU0sZUFBZSxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDakQsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLFlBQVksQ0FBQyxLQUFLLEdBQUcsQ0FBQyxJQUFJLEtBQUssR0FBRyxHQUFHLElBQUksS0FBSyxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ3hELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUNGLE1BQU0sTUFBTSxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDeEMsWUFBWSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzlELE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDL0IsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLDhCQUE4QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2xGLE1BQU0sSUFBSSxHQUFHLGNBQWMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3JGLFlBQVksQ0FBQyxJQUFJLEdBQUcsS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2pDLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxLQUFhLEVBQW9CLEVBQUU7SUFDakQsTUFBTSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDcEUsT0FBTyxDQUFDLEtBQUssRUFBRSxLQUFLLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBQ3ZELENBQUMsQ0FBQztBQUNGLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBYSxFQUFFLEtBQWEsRUFBVyxFQUFFO0lBQ3pELE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNyRCxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUMxQixDQUFDLENBQUM7QUFDRixNQUFNLFFBQVEsR0FBRyxDQUFDLElBQVksRUFBRSxLQUFhLEVBQVcsRUFBRTtJQUN4RCxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDcEQsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDMUIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxhQUFhLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUMvQyxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDN0IsWUFBWSxDQUFDLENBQUMsWUFBWSxFQUFFLGVBQWUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3ZHLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUNGLE1BQU0sY0FBYyxHQUFHLENBQUMsTUFBZ0IsRUFBUSxFQUFFO0lBQ2hELEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxNQUFNLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRTtRQUFFLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxLQUFLLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztZQUMvRixZQUFZLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDeEQsQ0FBQztBQUNILENBQUMsQ0FBQztBQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDbEYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxJQUFhLEVBQUUsS0FBYyxFQUFXLEVBQUUsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssU0FBUyxDQUFDLEtBQUssQ0FBQyxDQUFDO0FBRWhHLHlHQUF5RztBQUN6RyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUFDLEtBQWMsRUFBdUMsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDM0gsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLGVBQWUsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLFlBQVksRUFBRSxVQUFVLEVBQUUsVUFBVTtRQUNuRyxPQUFPLEVBQUUsV0FBVyxFQUFFLG1CQUFtQixFQUFFLG1CQUFtQixFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDN0UsWUFBWSxDQUFDLElBQUksQ0FBQyxhQUFhLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDdkMsTUFBTSxRQUFRLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxVQUFVLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNwRSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzFFLFlBQVksQ0FBQyxVQUFVLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLFVBQVUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUN6SCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsaUNBQWlDLENBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDeEgsWUFBWSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbEMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pCLE1BQU0sZUFBZSxHQUFHLENBQUMsS0FBYSxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hHLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxpQ0FBaUMsQ0FBQyxZQUFZLEVBQUUsS0FBSyxDQUFDLEVBQUU7UUFDNUYsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUN4RCxZQUFZLENBQUMsSUFBSSxDQUFDLE9BQU8sS0FBSyxVQUFVLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsQ0FBQztRQUN4RSxNQUFNLE1BQU0sR0FBeUQ7WUFDbkUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1NBQzNFLENBQUM7UUFDRixlQUFlLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQy9CLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZCLGNBQWMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDL0MsTUFBTSxZQUFZLEdBQUcsQ0FBQyxLQUFjLEVBQUUsWUFBcUIsRUFBRSxFQUFFO1FBQzdELE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUNqSCxNQUFNLE1BQU0sR0FBRyxFQUFFLEVBQUUsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxlQUFlLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3hILGVBQWUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssQ0FBQyxDQUFDO1FBQ3hDLFlBQVksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLE1BQU0sQ0FBQyxPQUFPLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNsRixPQUFPLFlBQVksQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7SUFDdEYsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLGlDQUFpQyxDQUFDLGdCQUFnQixFQUM5RixLQUFLLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUMzRCxNQUFNLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGlCQUFpQixFQUFFLGlDQUFpQyxDQUFDLHdCQUF3QixFQUN0SCxLQUFLLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFxRSxDQUFDLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDOUgsTUFBTSxlQUFlLEdBQUcsQ0FBQyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxHQUFHLEtBQUssQ0FBQyxPQUFPLElBQUksS0FBSyxDQUFDLElBQUksSUFBSSxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBQ3BJLEdBQUcsaUJBQWlCLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsT0FBTyxJQUFJLEtBQUssQ0FBQyxJQUFJLElBQUksS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUN6RixZQUFZLENBQUMsSUFBSSxHQUFHLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxLQUFLLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN2RSxNQUFNLGlCQUFpQixHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGlCQUFpQixFQUFFLGlDQUFpQyxDQUFDLHdCQUF3QixFQUFFLEtBQUssQ0FBQyxFQUFFO1FBQ2hJLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsa0JBQWtCLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztJQUM1RixDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLFlBQVksQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDM0MsT0FBTyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsUUFBUTtRQUNwRyxRQUFRLEVBQUUsS0FBSyxFQUFFLFNBQVMsRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0FBQ3BHLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FBQyxLQUFjLEVBQWlDLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQy9HLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxZQUFZLEVBQUUsUUFBUSxFQUFFLGtCQUFrQjtRQUN6RyxvQkFBb0IsRUFBRSxxQkFBcUIsRUFBRSxTQUFTLEVBQUUsa0JBQWtCLEVBQUUsZUFBZSxFQUFFLGdCQUFnQixFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDNUgsWUFBWSxDQUFDLElBQUksQ0FBQyxhQUFhLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDdkMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQyxRQUFRLEVBQUUsUUFBUSxFQUFFLGVBQWUsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQzNGLE1BQU0sYUFBYSxHQUFHLGFBQWEsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEdBQUcsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzNGLE1BQU0sYUFBYSxHQUFHLGVBQWUsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLEVBQUUsV0FBVyxHQUFHLGVBQWUsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDakgsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksYUFBYSxLQUFLLFdBQVcsQ0FBQyxDQUFDO0lBQzlELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxhQUFhLEVBQUUsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNqRCxNQUFNLE1BQU0sR0FBRyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckMsWUFBWSxDQUFDLE1BQU0sSUFBSSxLQUFLLElBQUksTUFBTSxJQUFJLElBQUksSUFBSSxDQUFDLElBQUksR0FBRyxLQUFLLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLEtBQUssSUFBSSxNQUFNLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ25ILENBQUM7SUFDRCxNQUFNLGdCQUFnQixHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsaUNBQWlDLENBQUMsaUJBQWlCLEVBQUUsS0FBSyxDQUFDLEVBQUU7UUFDaEgsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFVBQVUsRUFBRSxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMzRCxNQUFNLE1BQU0sR0FBRyxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUM1SCxZQUFZLENBQUMsTUFBTSxDQUFDLEtBQUssSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDMUMsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQyxDQUFDLENBQUM7SUFDSCxZQUFZLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzFDLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxnQkFBZ0IsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUM3RCxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLEVBQUUsT0FBTyxHQUFHLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2hGLFlBQVksQ0FBQyxRQUFRLENBQUMsUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxLQUFLLE9BQU8sQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLElBQUksR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNsSSxDQUFDO0lBQ0QsWUFBWSxDQUFDLE9BQU8sSUFBSSxDQUFDLGNBQWMsS0FBSyxRQUFRLElBQUksZ0JBQWdCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUM7V0FDN0YsSUFBSSxDQUFDLGNBQWMsS0FBSyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDN0MsT0FBTyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsVUFBVSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO1FBQ3ZILE1BQU0sRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLGdCQUFnQixFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxrQkFBa0IsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDO1FBQzVILG1CQUFtQixFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLENBQUMsRUFBRSxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUU7UUFDN0ksZ0JBQWdCLEVBQUUsYUFBYSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxFQUFFLGNBQWMsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDNUksQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLGFBQWEsR0FBRyxLQUFLLEVBQUUsTUFBYyxFQUFFLEtBQWdDLEVBQTBCLEVBQUU7SUFDdkcsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRyxLQUFLLENBQUM7SUFDOUMsT0FBTyxVQUFVLE1BQU0sNEJBQTRCLENBQUMsU0FBUyxDQUFDLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztBQUM5RixDQUFDLENBQUM7QUFDRixNQUFNLENBQUMsTUFBTSwrQ0FBK0MsR0FBRyxDQUFDLEtBQTBDLEVBQTBCLEVBQUUsQ0FDcEksYUFBYSxDQUFDLGlDQUFpQyxDQUFDLHFCQUFxQixFQUFFLDBDQUEwQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFDNUgsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FBQyxLQUFvQyxFQUEwQixFQUFFLENBQ3hILGFBQWEsQ0FBQyxpQ0FBaUMsQ0FBQyxtQkFBbUIsRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBRXBILDhHQUE4RztBQUM5RyxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxLQUFLLEVBQUUsVUFBbUIsRUFBRSxjQUF1QixFQUVoRyxFQUFFO0lBQ0gsTUFBTSxLQUFLLEdBQUcsb0NBQW9DLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDL0QsTUFBTSxTQUFTLEdBQUcsMENBQTBDLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDN0UsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssTUFBTSx5Q0FBeUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLFlBQVksQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLE1BQU0sK0NBQStDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNwRyxZQUFZLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsU0FBUyxDQUFDLFVBQVUsQ0FBQztXQUN0RCxNQUFNLENBQUMsS0FBSyxDQUFDLGtCQUFrQixFQUFFLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxFQUFFLEVBQUUsVUFBVSxFQUFFLFNBQVMsQ0FBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztXQUNsSCxTQUFTLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQ3BJLE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzlFLFlBQVksQ0FBQyxJQUFJLEVBQUUsT0FBTyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDekYsT0FBTyxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsQ0FBQztBQUM5QixDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsS0FBSyxFQUFFLEtBQWMsRUFBNEMsRUFBRTtJQUN0SCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxpQ0FBaUMsQ0FBQyw0QkFBNEIsRUFDbEcsb0NBQW9DLENBQUMsQ0FBQyxDQUFDO0lBQ3pDLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxNQUFNLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDbkQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVCLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLE1BQU0seUNBQXlDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUN0RixLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDM0MsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQy9CLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7WUFDaEcsWUFBWSxDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLEVBQUUsSUFBSSxLQUFLLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUNuRixJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxRQUFRLENBQUMsZ0JBQWdCLElBQUksS0FBSyxDQUFDLG1CQUFtQixLQUFLLFFBQVEsQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO2dCQUN2SCxZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxRQUFRLENBQUMsYUFBYSxJQUFJLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQ25ILENBQUM7WUFDRCx1RkFBdUY7WUFDdkYsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsS0FBSyxRQUFRLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUNuRSxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0I7b0JBQUUsS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQzt3QkFDekYsWUFBWSxDQUFDLElBQUksQ0FBQyxRQUFRLEtBQUssS0FBSyxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUMsSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7b0JBQ3ZHLENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/requests/network.d.ts

@@ -1,6 +1,39 @@
 import * as plugins from '../plugins.js';
 import type { IIdentityCredential } from '../data/user.js';
 import type { IPrivateNetworkV1, IServicePrivateNetworksV1, ISetServicePrivateNetworksV1, TPrivateNetworkMutationV1 } from '../data/privatenetwork.js';
+/** Current organization picker data. Entries are never cached authorization grants. */
+export interface IReq_Cloudly_ListOwnedOrganizationsV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListOwnedOrganizationsV1> {
+    method: 'listOwnedOrganizationsV1';
+    request: {
+        identity: IIdentityCredential;
+    };
+    /** Limited to the server-held OIDC token's grant and current canonical owner membership. */
+    response: {
+        organizations: Array<{
+            id: string;
+            name: string;
+            slug: string;
+        }>;
+    };
+}
+/** Organization-scoped attachment choices; excludes service configuration and secrets. */
+export interface IReq_Cloudly_ListPrivateNetworkServiceCandidatesV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListPrivateNetworkServiceCandidatesV1> {
+    method: 'listPrivateNetworkServiceCandidatesV1';
+    /** Each page requires a fresh canonical organization-owner authority observation. */
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        cursor: string | null;
+        limit: number;
+    };
+    response: {
+        services: Array<{
+            id: string;
+            name: string;
+        }>;
+        nextCursor: string | null;
+    };
+}
 /** Every request is authorized against live canonical membership and Cloudly policy. */
 export interface IReq_Cloudly_ListPrivateNetworksV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListPrivateNetworksV1> {
     method: 'listPrivateNetworksV1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "30.5.1",
+  "version": "30.7.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -27,7 +27,7 @@
     "@tsclass/tsclass": "^9.5.1"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.4.2",
+    "@git.zone/tsbuild": "^4.4.3",
     "@git.zone/tsdoc": "^2.2.0",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "6.0.0",

package/readme.md

@@ -254,6 +254,36 @@ one second. DNS expiry does not prove packet revocation or permit identity reuse
 Retirement and attachment responses describe desired or historical metadata;
 consumers must separately track outstanding node revocations and readiness.
 
+`IRuntimeNetworkProtectedAuthorityV1` declares the complete controller-owned IPv4
+protection set, disjoint private workload/transit pools, protected resolver and
+platform endpoints, and every affected egress authority, including offline nodes.
+Its snapshot and digest helpers bind the exact predecessor and all declaration
+content. They cannot prove that an operator's inventory is complete. Install the
+union of old and new protection on every affected egress owner, or independently
+fence that owner, before exposing a newly allocatable pool. Removing an entry from
+the declaration is not a revocation acknowledgement. Prefix arrays are sorted
+lexically and nonoverlapping; pools and endpoints are sorted by ID; egress owners
+are ordered by canonical JSON of `[nodeId, runtimeNamespace]`.
+
+`IRuntimeNetworkHandoffLeaseV1` binds an immutable node/router incarnation to its
+protected-authority reference, transit subnet and peers, protocol-qualified source
+ports, nonzero conntrack zone and 128-bit label. The label is exactly 32 lowercase
+hex characters. Port ranges are inclusive, sorted by protocol then first port,
+and disjoint within each protocol. `bindRuntimeNetworkHandoffLeaseV1` verifies both
+digests, scope and transit-pool containment and returns detached values. It does
+not authenticate a projection or attest to an actual namespace/interface.
+
+`snapshotRuntimeNetworkHandoffLedgerV1` verifies at most 256 retained leases for
+one node/controller epoch, including quarantined allocations. It rejects host
+handoff-port collisions even across router/runtime namespace changes, and zone or
+label reuse within one router incarnation. The caller must transactionally supply
+the complete retained set, serialize allocation and fence controller-epoch changes.
+These are collision checks, not an IPAM allocator or a native capability. No expiry,
+empty conntrack dump, process exit or table removal establishes flow drainage or
+permits handoff identity reuse. Signed complete projections, live interface proofs
+and the separate router/host apply journal remain responsibilities of Cloudly and
+Pallet; neither packet admission nor readiness follows from these helpers.
+
 ### Node-Bound Runtime Assignments
 
 The `data` namespace exports `IRuntimeAssignmentV1`, canonical digest helpers,

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '30.5.1',
+  version: '30.7.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -22,6 +22,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './networkauthority.js';
 export * from './privatenetwork.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';

package/ts/data/networkauthority.ts

@@ -0,0 +1,293 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+
+/** Controller declaration; a digest does not authenticate completeness or activate a pool. */
+export interface IRuntimeNetworkProtectedAuthorityV1 {
+  schemaVersion: 1;
+  id: string;
+  generation: number;
+  controller: IRuntimeControllerV1;
+  previous: IRuntimeAuthorityReferenceV1 | null;
+  /** Complete canonical IPv4 union, including all pools and protected endpoints. */
+  prefixes: string[];
+  pools: Array<{ id: string; purpose: 'workload' | 'transit'; prefix: string }>;
+  resolvers: Array<{ id: string; address: string; port: number }>;
+  /** Exact underlay exceptions; never inside a managed allocation pool. */
+  platformEndpoints: Array<{ id: string; address: string; protocol: 'tcp' | 'udp'; port: number }>;
+  /** Includes offline authorities with outstanding grants; omission does not fence them. */
+  egressAuthorities: Array<{ nodeId: string; runtimeNamespace: string }>;
+  digest: TSha256Digest;
+}
+
+export interface IRuntimeNetworkHandoffPortRangeV1 {
+  protocol: 'tcp' | 'udp';
+  first: number;
+  last: number;
+}
+
+/** Immutable allocation, retained unchanged while active or quarantined. No expiry implies reuse. */
+export interface IRuntimeNetworkHandoffLeaseV1 {
+  schemaVersion: 1;
+  id: string;
+  generation: number;
+  controller: IRuntimeControllerV1;
+  nodeId: string;
+  runtimeNamespace: string;
+  protectedAuthority: IRuntimeAuthorityReferenceV1;
+  /** Logical allocation incarnation, never a path, PID, inode, descriptor or native capability. */
+  routerIncarnationId: string;
+  transit: { poolId: string; prefix: string; routerAddress: string; hostAddress: string };
+  sourcePortRanges: IRuntimeNetworkHandoffPortRangeV1[];
+  conntrackZone: number;
+  conntrackLabel: string;
+  digest: TSha256Digest;
+}
+
+export const runtimeNetworkAuthorityV1Contract = Object.freeze({
+  protectedDigestDomain: 'serve.zone/runtime-network-protected-authority-v1',
+  handoffDigestDomain: 'serve.zone/runtime-network-handoff-lease-v1',
+  maximumPrefixes: 128,
+  maximumPools: 64,
+  maximumResolvers: 16,
+  maximumPlatformEndpoints: 64,
+  maximumEgressAuthorities: 256,
+  maximumPortRanges: 16,
+  maximumRetainedHandoffLeases: 256,
+  activation: 'all-affected-egress-barriers-or-independent-fences-before-allocation',
+  quarantine: 'retain-until-exact-authority-acknowledgements-or-independent-fence',
+  omission: 'no-effect',
+} as const);
+
+const fail = (): never => { throw new Error('Runtime network authority contract rejected.'); };
+function requireValue(value: unknown): asserts value { if (!value) fail(); }
+const safe = <T>(operation: () => T): T => { try { return operation(); } catch { return fail(); } };
+const record = (value: unknown, keys: string[]): Record<string, unknown> => {
+  requireValue(value !== null && typeof value === 'object' && !Array.isArray(value));
+  const prototype = Object.getPrototypeOf(value);
+  requireValue(prototype === Object.prototype || prototype === null);
+  const actual = Reflect.ownKeys(value);
+  requireValue(actual.length === keys.length && keys.every(key => actual.includes(key)));
+  const result: Record<string, unknown> = Object.create(null);
+  for (const key of keys) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+    result[key] = descriptor.value;
+  }
+  return result;
+};
+const list = <T>(value: unknown, maximum: number, read: (item: unknown) => T): T[] => {
+  requireValue(Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype);
+  const length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
+  requireValue(Number.isSafeInteger(length) && length <= maximum && Reflect.ownKeys(value).length === length + 1);
+  const result: T[] = [];
+  for (let index = 0; index < length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+    result.push(read(descriptor.value));
+  }
+  return result;
+};
+const id = (value: unknown): string => {
+  requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+  return value;
+};
+const integer = (value: unknown, maximum = Number.MAX_SAFE_INTEGER - 1): number => {
+  requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= maximum);
+  return value;
+};
+const digest = (value: unknown): TSha256Digest => {
+  requireValue(typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value));
+  return value as TSha256Digest;
+};
+const controller = (value: unknown): IRuntimeControllerV1 => {
+  const item = record(value, ['kind', 'id', 'epoch']);
+  requireValue(item.kind === 'cloudly' || item.kind === 'onebox');
+  return { kind: item.kind, id: id(item.id), epoch: id(item.epoch) };
+};
+const reference = (value: unknown): IRuntimeAuthorityReferenceV1 => {
+  const item = record(value, ['id', 'generation', 'digest']);
+  return { id: id(item.id), generation: integer(item.generation), digest: digest(item.digest) };
+};
+const protocol = (value: unknown): 'tcp' | 'udp' => {
+  requireValue(value === 'tcp' || value === 'udp');
+  return value;
+};
+const sorted = <T>(values: T[], key: (value: T) => string): T[] => {
+  requireValue(values.every((value, index) => index === 0 || key(values[index - 1]) < key(value)));
+  return values;
+};
+const address = (value: unknown): string => {
+  requireValue(typeof value === 'string' && value.length <= 15);
+  const parts = value.split('.');
+  requireValue(parts.length === 4 && parts.every(part => /^(?:0|[1-9][0-9]{0,2})$/.test(part) && Number(part) <= 255));
+  return value;
+};
+const numericAddress = (value: string): number => value.split('.').reduce((sum, part) => sum * 256 + Number(part), 0);
+const endpointAddress = (value: unknown): string => {
+  const result = address(value), first = Number(result.split('.')[0]);
+  requireValue(first > 0 && first < 224 && first !== 127);
+  return result;
+};
+const prefix = (value: unknown): string => {
+  requireValue(typeof value === 'string' && value.length <= 18);
+  const parts = value.split('/');
+  requireValue(parts.length === 2 && /^(?:[0-9]|[12][0-9]|3[0-2])$/.test(parts[1]));
+  const base = numericAddress(address(parts[0])), width = 2 ** (32 - Number(parts[1]));
+  requireValue(base % width === 0);
+  return value;
+};
+const bounds = (value: string): [number, number] => {
+  const [base, bits] = value.split('/'), first = numericAddress(base);
+  return [first, first + 2 ** (32 - Number(bits)) - 1];
+};
+const contains = (outer: string, inner: string): boolean => {
+  const [a, b] = bounds(outer), [c, d] = bounds(inner);
+  return a <= c && b >= d;
+};
+const overlaps = (left: string, right: string): boolean => {
+  const [a, b] = bounds(left), [c, d] = bounds(right);
+  return a <= d && c <= b;
+};
+const privatePrefix = (value: unknown): string => {
+  const result = prefix(value);
+  requireValue(['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'].some(range => contains(range, result)));
+  return result;
+};
+const nonoverlapping = (values: string[]): void => {
+  for (let index = 0; index < values.length; index++) for (let other = 0; other < index; other++) {
+    requireValue(!overlaps(values[index], values[other]));
+  }
+};
+const canonical = (value: unknown): string => canonicalizeStrictJson(value, fail);
+const equals = (left: unknown, right: unknown): boolean => canonical(left) === canonical(right);
+
+/** Structural snapshot only. Complete inventory, signatures and activation barriers are caller-owned. */
+export const snapshotRuntimeNetworkProtectedAuthorityV1 = (value: unknown): IRuntimeNetworkProtectedAuthorityV1 => safe(() => {
+  const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'previous', 'prefixes',
+    'pools', 'resolvers', 'platformEndpoints', 'egressAuthorities', 'digest']);
+  requireValue(item.schemaVersion === 1);
+  const identity = id(item.id), generation = integer(item.generation);
+  const previous = item.previous === null ? null : reference(item.previous);
+  requireValue(generation === 1 ? previous === null : previous?.id === identity && previous.generation === generation - 1);
+  const prefixes = sorted(list(item.prefixes, runtimeNetworkAuthorityV1Contract.maximumPrefixes, prefix), value => value);
+  requireValue(prefixes.length > 0);
+  nonoverlapping(prefixes);
+  const protectedPrefix = (value: string) => requireValue(prefixes.some(range => contains(range, value)));
+  const pools = sorted(list(item.pools, runtimeNetworkAuthorityV1Contract.maximumPools, value => {
+    const pool = record(value, ['id', 'purpose', 'prefix']);
+    requireValue(pool.purpose === 'workload' || pool.purpose === 'transit');
+    const result: IRuntimeNetworkProtectedAuthorityV1['pools'][number] = {
+      id: id(pool.id), purpose: pool.purpose, prefix: privatePrefix(pool.prefix),
+    };
+    protectedPrefix(result.prefix);
+    return result;
+  }), value => value.id);
+  nonoverlapping(pools.map(pool => pool.prefix));
+  const readEndpoint = (value: unknown, withProtocol: boolean) => {
+    const endpoint = record(value, withProtocol ? ['id', 'address', 'protocol', 'port'] : ['id', 'address', 'port']);
+    const result = { id: id(endpoint.id), address: endpointAddress(endpoint.address), port: integer(endpoint.port, 65535) };
+    protectedPrefix(`${result.address}/32`);
+    requireValue(pools.every(pool => !contains(pool.prefix, `${result.address}/32`)));
+    return withProtocol ? { ...result, protocol: protocol(endpoint.protocol) } : result;
+  };
+  const resolvers = sorted(list(item.resolvers, runtimeNetworkAuthorityV1Contract.maximumResolvers,
+    value => readEndpoint(value, false)), value => value.id);
+  const platformEndpoints = sorted(list(item.platformEndpoints, runtimeNetworkAuthorityV1Contract.maximumPlatformEndpoints,
+    value => readEndpoint(value, true) as IRuntimeNetworkProtectedAuthorityV1['platformEndpoints'][number]), value => value.id);
+  const allEndpointKeys = [...resolvers.flatMap(value => ['tcp', 'udp'].map(transport => `${value.address}:${value.port}:${transport}`)),
+    ...platformEndpoints.map(value => `${value.address}:${value.port}:${value.protocol}`)];
+  requireValue(new Set(allEndpointKeys).size === allEndpointKeys.length);
+  const egressAuthorities = sorted(list(item.egressAuthorities, runtimeNetworkAuthorityV1Contract.maximumEgressAuthorities, value => {
+    const authority = record(value, ['nodeId', 'runtimeNamespace']);
+    return { nodeId: id(authority.nodeId), runtimeNamespace: id(authority.runtimeNamespace) };
+  }), value => canonical([value.nodeId, value.runtimeNamespace]));
+  requireValue(egressAuthorities.length > 0);
+  return { schemaVersion: 1, id: identity, generation, controller: controller(item.controller), previous,
+    prefixes, pools, resolvers, platformEndpoints, egressAuthorities, digest: digest(item.digest) };
+});
+
+export const snapshotRuntimeNetworkHandoffLeaseV1 = (value: unknown): IRuntimeNetworkHandoffLeaseV1 => safe(() => {
+  const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
+    'protectedAuthority', 'routerIncarnationId', 'transit', 'sourcePortRanges', 'conntrackZone', 'conntrackLabel', 'digest']);
+  requireValue(item.schemaVersion === 1);
+  const transit = record(item.transit, ['poolId', 'prefix', 'routerAddress', 'hostAddress']);
+  const transitPrefix = privatePrefix(transit.prefix), [first, last] = bounds(transitPrefix);
+  const routerAddress = endpointAddress(transit.routerAddress), hostAddress = endpointAddress(transit.hostAddress);
+  requireValue(first !== last && routerAddress !== hostAddress);
+  for (const value of [routerAddress, hostAddress]) {
+    const number = numericAddress(value);
+    requireValue(number >= first && number <= last && (last - first === 1 || (number !== first && number !== last)));
+  }
+  const sourcePortRanges = list(item.sourcePortRanges, runtimeNetworkAuthorityV1Contract.maximumPortRanges, value => {
+    const range = record(value, ['protocol', 'first', 'last']);
+    const result = { protocol: protocol(range.protocol), first: integer(range.first, 65535), last: integer(range.last, 65535) };
+    requireValue(result.first <= result.last);
+    return result;
+  });
+  requireValue(sourcePortRanges.length > 0);
+  for (let index = 1; index < sourcePortRanges.length; index++) {
+    const previous = sourcePortRanges[index - 1], current = sourcePortRanges[index];
+    requireValue(previous.protocol < current.protocol || (previous.protocol === current.protocol && previous.last < current.first));
+  }
+  requireValue(typeof item.conntrackLabel === 'string' && /^[a-f0-9]{32}$/.test(item.conntrackLabel)
+    && item.conntrackLabel !== '0'.repeat(32));
+  return { schemaVersion: 1, id: id(item.id), generation: integer(item.generation), controller: controller(item.controller),
+    nodeId: id(item.nodeId), runtimeNamespace: id(item.runtimeNamespace), protectedAuthority: reference(item.protectedAuthority),
+    routerIncarnationId: id(item.routerIncarnationId), transit: { poolId: id(transit.poolId), prefix: transitPrefix, routerAddress, hostAddress },
+    sourcePortRanges, conntrackZone: integer(item.conntrackZone, 65535), conntrackLabel: item.conntrackLabel, digest: digest(item.digest) };
+});
+
+const computeDigest = async (domain: string, value: { digest: TSha256Digest }): Promise<TSha256Digest> => {
+  const { digest: omitted, ...payload } = value;
+  return `sha256:${await createCanonicalJsonSha256Hex(canonical({ domain, payload }), fail)}`;
+};
+export const computeRuntimeNetworkProtectedAuthorityV1Digest = (value: IRuntimeNetworkProtectedAuthorityV1): Promise<TSha256Digest> =>
+  computeDigest(runtimeNetworkAuthorityV1Contract.protectedDigestDomain, snapshotRuntimeNetworkProtectedAuthorityV1(value));
+export const computeRuntimeNetworkHandoffLeaseV1Digest = (value: IRuntimeNetworkHandoffLeaseV1): Promise<TSha256Digest> =>
+  computeDigest(runtimeNetworkAuthorityV1Contract.handoffDigestDomain, snapshotRuntimeNetworkHandoffLeaseV1(value));
+
+/** Detached, digest-verified allocation binding. Does not establish pool activation or live link identity. */
+export const bindRuntimeNetworkHandoffLeaseV1 = async (leaseValue: unknown, authorityValue: unknown): Promise<{
+  lease: IRuntimeNetworkHandoffLeaseV1; authority: IRuntimeNetworkProtectedAuthorityV1;
+}> => {
+  const lease = snapshotRuntimeNetworkHandoffLeaseV1(leaseValue);
+  const authority = snapshotRuntimeNetworkProtectedAuthorityV1(authorityValue);
+  requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
+  requireValue(authority.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(authority));
+  requireValue(equals(lease.controller, authority.controller)
+    && equals(lease.protectedAuthority, { id: authority.id, generation: authority.generation, digest: authority.digest })
+    && authority.egressAuthorities.some(value => value.nodeId === lease.nodeId && value.runtimeNamespace === lease.runtimeNamespace));
+  const pool = authority.pools.find(value => value.id === lease.transit.poolId);
+  requireValue(pool?.purpose === 'transit' && contains(pool.prefix, lease.transit.prefix));
+  return { lease, authority };
+};
+
+/**
+ * Validate ALL retained leases for one physical node/controller epoch, including quarantine.
+ * The owning transactional ledger must supply its complete history and serialize reservations.
+ * Namespace replacement, an empty CT dump or process exit never removes an entry from this set.
+ */
+export const snapshotRuntimeNetworkHandoffLedgerV1 = async (value: unknown): Promise<IRuntimeNetworkHandoffLeaseV1[]> => {
+  const leases = safe(() => list(value, runtimeNetworkAuthorityV1Contract.maximumRetainedHandoffLeases,
+    snapshotRuntimeNetworkHandoffLeaseV1));
+  for (let index = 0; index < leases.length; index++) {
+    const lease = leases[index];
+    requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
+    for (let other = 0; other < index; other++) {
+      const previous = leases[other];
+      requireValue(lease.nodeId === previous.nodeId && equals(lease.controller, previous.controller));
+      requireValue(lease.id !== previous.id || lease.generation !== previous.generation);
+      if (lease.runtimeNamespace === previous.runtimeNamespace && lease.routerIncarnationId === previous.routerIncarnationId) {
+        requireValue(lease.conntrackZone !== previous.conntrackZone && lease.conntrackLabel !== previous.conntrackLabel);
+      }
+      // Host handoff tuples remain reserved even across router or runtime namespace changes.
+      if (lease.transit.routerAddress === previous.transit.routerAddress) {
+        for (const left of lease.sourcePortRanges) for (const right of previous.sourcePortRanges) {
+          requireValue(left.protocol !== right.protocol || left.last < right.first || right.last < left.first);
+        }
+      }
+    }
+  }
+  return leases;
+};

package/ts/requests/network.ts

@@ -5,6 +5,26 @@ import type {
   TPrivateNetworkMutationV1,
 } from '../data/privatenetwork.js';
 
+/** Current organization picker data. Entries are never cached authorization grants. */
+export interface IReq_Cloudly_ListOwnedOrganizationsV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListOwnedOrganizationsV1
+> {
+  method: 'listOwnedOrganizationsV1';
+  request: { identity: IIdentityCredential };
+  /** Limited to the server-held OIDC token's grant and current canonical owner membership. */
+  response: { organizations: Array<{ id: string; name: string; slug: string }> };
+}
+
+/** Organization-scoped attachment choices; excludes service configuration and secrets. */
+export interface IReq_Cloudly_ListPrivateNetworkServiceCandidatesV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListPrivateNetworkServiceCandidatesV1
+> {
+  method: 'listPrivateNetworkServiceCandidatesV1';
+  /** Each page requires a fresh canonical organization-owner authority observation. */
+  request: { identity: IIdentityCredential; organizationId: string; cursor: string | null; limit: number };
+  response: { services: Array<{ id: string; name: string }>; nextCursor: string | null };
+}
+
 /** Every request is authorized against live canonical membership and Cloudly policy. */
 export interface IReq_Cloudly_ListPrivateNetworksV1 extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListPrivateNetworksV1