@serve.zone/interfaces 30.6.0 → 30.8.1

package/readme.md

@@ -254,6 +254,109 @@ one second. DNS expiry does not prove packet revocation or permit identity reuse
 Retirement and attachment responses describe desired or historical metadata;
 consumers must separately track outstanding node revocations and readiness.
 
+`IRuntimeNetworkProtectedAuthorityV1` declares the complete controller-owned IPv4
+protection set, disjoint private workload/transit pools, protected resolver and
+platform endpoints, and every affected egress authority, including offline nodes.
+Its snapshot and digest helpers bind the exact predecessor and all declaration
+content. They cannot prove that an operator's inventory is complete. Install the
+union of old and new protection on every affected egress owner, or independently
+fence that owner, before exposing a newly allocatable pool. Removing an entry from
+the declaration is not a revocation acknowledgement. Prefix arrays are sorted
+lexically and nonoverlapping; pools and endpoints are sorted by ID; egress owners
+are ordered by canonical JSON of `[nodeId, runtimeNamespace]`.
+
+`IRuntimeNetworkHandoffLeaseV1` binds an immutable node/router incarnation to its
+protected-authority reference, transit subnet and peers, protocol-qualified source
+ports, nonzero conntrack zone and 128-bit label. The label is exactly 32 lowercase
+hex characters. Port ranges are inclusive, sorted by protocol then first port,
+and disjoint within each protocol. `bindRuntimeNetworkHandoffLeaseV1` verifies both
+digests, scope and transit-pool containment and returns detached values. It does
+not authenticate a projection or attest to an actual namespace/interface.
+
+`snapshotRuntimeNetworkHandoffLedgerV1` verifies at most 256 retained leases for
+one node/controller epoch, including quarantined allocations. It rejects host
+handoff-port collisions even across router/runtime namespace changes, and zone or
+label reuse within one router incarnation. The caller must transactionally supply
+the complete retained set, serialize allocation and fence controller-epoch changes.
+These are collision checks, not an IPAM allocator or a native capability. No expiry,
+empty conntrack dump, process exit or table removal establishes flow drainage or
+permits handoff identity reuse. Signed complete projections, live interface proofs
+and the separate router/host apply journal remain responsibilities of Cloudly and
+Pallet; neither packet admission nor readiness follows from these helpers.
+
+`IRuntimeNetworkWorkloadLeaseV1` is the immutable material referenced by
+`assignment.workload.network`. It binds one execution attempt and router
+incarnation to a workload pool, dedicated unbridged `linkSubnet`, workload
+`address`, exact `/32` `sourcePrefix`, and router-side `gateway`. The gateway
+also supplies `dnsServer` on port 53, because CRI DNS settings cannot encode a
+port. Canonical private point-to-point subnets through `/31` are accepted; the
+owning CNI implementation must qualify its chosen layout. The source prefix,
+link subnet, VPN control prefix and host/router transit subnet have different
+roles. `bindRuntimeNetworkWorkloadLeaseToAssignmentV1` verifies immutable
+assignment identity without a circular assignment digest. Membership, aliases,
+readiness and projection revisions never change this address material.
+
+`IRuntimeNetworkProjectionV1` contains complete relevant network definitions,
+service memberships and endpoint leases, including remote ready endpoints and
+declared services with no replicas. It carries the current protected authority,
+exact historical allocation authorities, local handoff, a maximum 15-minute DNS
+window and explicit packet/lease/handoff withdrawals. All arrays use the
+documented canonical ordering: networks and endpoints by ID, memberships by
+canonical `[organizationId, serviceId]`, references by canonical complete
+reference, and withdrawals by canonical complete grant. Projections are bounded
+to 896 KiB, 128 networks, 256 memberships/endpoints, 16 historical authorities
+and 4,096 directed grants. These transport bounds do not assert native capacity;
+the node must preflight the actual SmartVPN, Smartnftables and DNS limits before
+effectful application.
+
+`validateRuntimeNetworkProjectionV1` checks complete digest and scope bindings,
+pool containment, disjoint link subnets, network/organization keys, aliases,
+resolver authorization and ready-replica uniqueness. It does not authenticate
+controller inventory, prove observation provenance or authorize allocation reuse.
+Cloudly must derive readiness from the current authenticated assignment report,
+retain all affected offline authorities and complete its allocation/barrier
+transactions before issuance.
+
+`getRuntimeNetworkProjectionPacketGrantsV1` derives directed member connectivity
+and explicit local public/platform egress independently of DNS readiness.
+`composeRuntimeNetworkProjectionDnsViewsV1` builds one union view per local
+workload source address, with every authorized FQDN and complete ready-replica A
+set. An empty array declares NODATA; absent/unauthorized names remain NXDOMAIN,
+and IPv4-only service names have AAAA NODATA. The view carries the existing
+forwarding intersection and zero or one search suffix. Pallet must prove the
+actual sandbox/veth/source binding, block private/bare-name forwarding, clip
+TTLs and convert the absolute window using its qualified boot/time authority.
+These helpers neither cache queries nor renew a lease.
+
+`admitRuntimeNetworkProjectionV1` checks exact predecessor/replay identity and
+rejects changed same-generation content, regressed membership/readiness evidence,
+changed immutable address/DNS keys, and omitted packet grants without explicit
+withdrawal. Pending withdrawals/tombstones must carry forward until the caller
+supplies the exact previous projection reference from its own durable joined
+application receipt. That reference is never taken from an incoming ACK. Keep
+the accepted history and apply journal until native effects and DNS/allocation
+quarantine are settled; a complete new snapshot does not erase that history.
+
+`IRuntimeNetworkSigningAuthorityV1` is separate from human JWT signing. Install
+its current revision through the existing authenticated physical connection and
+commit it with a durable CAS fence. Newly enrolled nodes may bootstrap the
+controller's current key generation; existing trust cannot be reset to do so.
+Exact successor revisions rotate the Ed25519 public key; `publicKey: null`
+revokes it. Rotation/revocation stops acceptance under the previous key, and
+requires newly signed authority for DNS. It does not deny outstanding packets
+or permit allocation reuse.
+
+The Node-only `@serve.zone/interfaces/runtime` export supplies
+`createRuntimeNetworkSigningKeyV1`, `signRuntimeNetworkProjectionV1` and
+`verifyRuntimeNetworkProjectionV1`. The signature covers the complete canonical
+projection, signing-authority reference and dedicated signature domain. Verification
+requires receiver-owned trusted authority and node scope; an envelope contains
+no key to trust. Private KeyObjects stay process-local; Cloudly persists their
+exported material only through its encrypted internal secret store. The dedicated
+`requests.runtimesession` key/projection push contracts bind the current physical
+peer. Their response acknowledges durable admission only, never application,
+readiness, independent fencing or pool activation.
+
 ### Node-Bound Runtime Assignments
 
 The `data` namespace exports `IRuntimeAssignmentV1`, canonical digest helpers,

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '30.6.0',
+  version: '30.8.1',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -22,6 +22,10 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './networkauthority.js';
+export * from './networkdelivery.js';
+export * from './networkprojection.js';
+export * from './networksigning.js';
 export * from './privatenetwork.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';

package/ts/data/networkauthority.ts

@@ -0,0 +1,293 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+
+/** Controller declaration; a digest does not authenticate completeness or activate a pool. */
+export interface IRuntimeNetworkProtectedAuthorityV1 {
+  schemaVersion: 1;
+  id: string;
+  generation: number;
+  controller: IRuntimeControllerV1;
+  previous: IRuntimeAuthorityReferenceV1 | null;
+  /** Complete canonical IPv4 union, including all pools and protected endpoints. */
+  prefixes: string[];
+  pools: Array<{ id: string; purpose: 'workload' | 'transit'; prefix: string }>;
+  resolvers: Array<{ id: string; address: string; port: number }>;
+  /** Exact underlay exceptions; never inside a managed allocation pool. */
+  platformEndpoints: Array<{ id: string; address: string; protocol: 'tcp' | 'udp'; port: number }>;
+  /** Includes offline authorities with outstanding grants; omission does not fence them. */
+  egressAuthorities: Array<{ nodeId: string; runtimeNamespace: string }>;
+  digest: TSha256Digest;
+}
+
+export interface IRuntimeNetworkHandoffPortRangeV1 {
+  protocol: 'tcp' | 'udp';
+  first: number;
+  last: number;
+}
+
+/** Immutable allocation, retained unchanged while active or quarantined. No expiry implies reuse. */
+export interface IRuntimeNetworkHandoffLeaseV1 {
+  schemaVersion: 1;
+  id: string;
+  generation: number;
+  controller: IRuntimeControllerV1;
+  nodeId: string;
+  runtimeNamespace: string;
+  protectedAuthority: IRuntimeAuthorityReferenceV1;
+  /** Logical allocation incarnation, never a path, PID, inode, descriptor or native capability. */
+  routerIncarnationId: string;
+  transit: { poolId: string; prefix: string; routerAddress: string; hostAddress: string };
+  sourcePortRanges: IRuntimeNetworkHandoffPortRangeV1[];
+  conntrackZone: number;
+  conntrackLabel: string;
+  digest: TSha256Digest;
+}
+
+export const runtimeNetworkAuthorityV1Contract = Object.freeze({
+  protectedDigestDomain: 'serve.zone/runtime-network-protected-authority-v1',
+  handoffDigestDomain: 'serve.zone/runtime-network-handoff-lease-v1',
+  maximumPrefixes: 128,
+  maximumPools: 64,
+  maximumResolvers: 16,
+  maximumPlatformEndpoints: 64,
+  maximumEgressAuthorities: 256,
+  maximumPortRanges: 16,
+  maximumRetainedHandoffLeases: 256,
+  activation: 'all-affected-egress-barriers-or-independent-fences-before-allocation',
+  quarantine: 'retain-until-exact-authority-acknowledgements-or-independent-fence',
+  omission: 'no-effect',
+} as const);
+
+const fail = (): never => { throw new Error('Runtime network authority contract rejected.'); };
+function requireValue(value: unknown): asserts value { if (!value) fail(); }
+const safe = <T>(operation: () => T): T => { try { return operation(); } catch { return fail(); } };
+const record = (value: unknown, keys: string[]): Record<string, unknown> => {
+  requireValue(value !== null && typeof value === 'object' && !Array.isArray(value));
+  const prototype = Object.getPrototypeOf(value);
+  requireValue(prototype === Object.prototype || prototype === null);
+  const actual = Reflect.ownKeys(value);
+  requireValue(actual.length === keys.length && keys.every(key => actual.includes(key)));
+  const result: Record<string, unknown> = Object.create(null);
+  for (const key of keys) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+    result[key] = descriptor.value;
+  }
+  return result;
+};
+const list = <T>(value: unknown, maximum: number, read: (item: unknown) => T): T[] => {
+  requireValue(Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype);
+  const length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
+  requireValue(Number.isSafeInteger(length) && length <= maximum && Reflect.ownKeys(value).length === length + 1);
+  const result: T[] = [];
+  for (let index = 0; index < length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+    result.push(read(descriptor.value));
+  }
+  return result;
+};
+const id = (value: unknown): string => {
+  requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+  return value;
+};
+const integer = (value: unknown, maximum = Number.MAX_SAFE_INTEGER - 1): number => {
+  requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value <= maximum);
+  return value;
+};
+const digest = (value: unknown): TSha256Digest => {
+  requireValue(typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value));
+  return value as TSha256Digest;
+};
+const controller = (value: unknown): IRuntimeControllerV1 => {
+  const item = record(value, ['kind', 'id', 'epoch']);
+  requireValue(item.kind === 'cloudly' || item.kind === 'onebox');
+  return { kind: item.kind, id: id(item.id), epoch: id(item.epoch) };
+};
+const reference = (value: unknown): IRuntimeAuthorityReferenceV1 => {
+  const item = record(value, ['id', 'generation', 'digest']);
+  return { id: id(item.id), generation: integer(item.generation), digest: digest(item.digest) };
+};
+const protocol = (value: unknown): 'tcp' | 'udp' => {
+  requireValue(value === 'tcp' || value === 'udp');
+  return value;
+};
+const sorted = <T>(values: T[], key: (value: T) => string): T[] => {
+  requireValue(values.every((value, index) => index === 0 || key(values[index - 1]) < key(value)));
+  return values;
+};
+const address = (value: unknown): string => {
+  requireValue(typeof value === 'string' && value.length <= 15);
+  const parts = value.split('.');
+  requireValue(parts.length === 4 && parts.every(part => /^(?:0|[1-9][0-9]{0,2})$/.test(part) && Number(part) <= 255));
+  return value;
+};
+const numericAddress = (value: string): number => value.split('.').reduce((sum, part) => sum * 256 + Number(part), 0);
+const endpointAddress = (value: unknown): string => {
+  const result = address(value), first = Number(result.split('.')[0]);
+  requireValue(first > 0 && first < 224 && first !== 127);
+  return result;
+};
+const prefix = (value: unknown): string => {
+  requireValue(typeof value === 'string' && value.length <= 18);
+  const parts = value.split('/');
+  requireValue(parts.length === 2 && /^(?:[0-9]|[12][0-9]|3[0-2])$/.test(parts[1]));
+  const base = numericAddress(address(parts[0])), width = 2 ** (32 - Number(parts[1]));
+  requireValue(base % width === 0);
+  return value;
+};
+const bounds = (value: string): [number, number] => {
+  const [base, bits] = value.split('/'), first = numericAddress(base);
+  return [first, first + 2 ** (32 - Number(bits)) - 1];
+};
+const contains = (outer: string, inner: string): boolean => {
+  const [a, b] = bounds(outer), [c, d] = bounds(inner);
+  return a <= c && b >= d;
+};
+const overlaps = (left: string, right: string): boolean => {
+  const [a, b] = bounds(left), [c, d] = bounds(right);
+  return a <= d && c <= b;
+};
+const privatePrefix = (value: unknown): string => {
+  const result = prefix(value);
+  requireValue(['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'].some(range => contains(range, result)));
+  return result;
+};
+const nonoverlapping = (values: string[]): void => {
+  for (let index = 0; index < values.length; index++) for (let other = 0; other < index; other++) {
+    requireValue(!overlaps(values[index], values[other]));
+  }
+};
+const canonical = (value: unknown): string => canonicalizeStrictJson(value, fail);
+const equals = (left: unknown, right: unknown): boolean => canonical(left) === canonical(right);
+
+/** Structural snapshot only. Complete inventory, signatures and activation barriers are caller-owned. */
+export const snapshotRuntimeNetworkProtectedAuthorityV1 = (value: unknown): IRuntimeNetworkProtectedAuthorityV1 => safe(() => {
+  const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'previous', 'prefixes',
+    'pools', 'resolvers', 'platformEndpoints', 'egressAuthorities', 'digest']);
+  requireValue(item.schemaVersion === 1);
+  const identity = id(item.id), generation = integer(item.generation);
+  const previous = item.previous === null ? null : reference(item.previous);
+  requireValue(generation === 1 ? previous === null : previous?.id === identity && previous.generation === generation - 1);
+  const prefixes = sorted(list(item.prefixes, runtimeNetworkAuthorityV1Contract.maximumPrefixes, prefix), value => value);
+  requireValue(prefixes.length > 0);
+  nonoverlapping(prefixes);
+  const protectedPrefix = (value: string) => requireValue(prefixes.some(range => contains(range, value)));
+  const pools = sorted(list(item.pools, runtimeNetworkAuthorityV1Contract.maximumPools, value => {
+    const pool = record(value, ['id', 'purpose', 'prefix']);
+    requireValue(pool.purpose === 'workload' || pool.purpose === 'transit');
+    const result: IRuntimeNetworkProtectedAuthorityV1['pools'][number] = {
+      id: id(pool.id), purpose: pool.purpose, prefix: privatePrefix(pool.prefix),
+    };
+    protectedPrefix(result.prefix);
+    return result;
+  }), value => value.id);
+  nonoverlapping(pools.map(pool => pool.prefix));
+  const readEndpoint = (value: unknown, withProtocol: boolean) => {
+    const endpoint = record(value, withProtocol ? ['id', 'address', 'protocol', 'port'] : ['id', 'address', 'port']);
+    const result = { id: id(endpoint.id), address: endpointAddress(endpoint.address), port: integer(endpoint.port, 65535) };
+    protectedPrefix(`${result.address}/32`);
+    requireValue(pools.every(pool => !contains(pool.prefix, `${result.address}/32`)));
+    return withProtocol ? { ...result, protocol: protocol(endpoint.protocol) } : result;
+  };
+  const resolvers = sorted(list(item.resolvers, runtimeNetworkAuthorityV1Contract.maximumResolvers,
+    value => readEndpoint(value, false)), value => value.id);
+  const platformEndpoints = sorted(list(item.platformEndpoints, runtimeNetworkAuthorityV1Contract.maximumPlatformEndpoints,
+    value => readEndpoint(value, true) as IRuntimeNetworkProtectedAuthorityV1['platformEndpoints'][number]), value => value.id);
+  const allEndpointKeys = [...resolvers.flatMap(value => ['tcp', 'udp'].map(transport => `${value.address}:${value.port}:${transport}`)),
+    ...platformEndpoints.map(value => `${value.address}:${value.port}:${value.protocol}`)];
+  requireValue(new Set(allEndpointKeys).size === allEndpointKeys.length);
+  const egressAuthorities = sorted(list(item.egressAuthorities, runtimeNetworkAuthorityV1Contract.maximumEgressAuthorities, value => {
+    const authority = record(value, ['nodeId', 'runtimeNamespace']);
+    return { nodeId: id(authority.nodeId), runtimeNamespace: id(authority.runtimeNamespace) };
+  }), value => canonical([value.nodeId, value.runtimeNamespace]));
+  requireValue(egressAuthorities.length > 0);
+  return { schemaVersion: 1, id: identity, generation, controller: controller(item.controller), previous,
+    prefixes, pools, resolvers, platformEndpoints, egressAuthorities, digest: digest(item.digest) };
+});
+
+export const snapshotRuntimeNetworkHandoffLeaseV1 = (value: unknown): IRuntimeNetworkHandoffLeaseV1 => safe(() => {
+  const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
+    'protectedAuthority', 'routerIncarnationId', 'transit', 'sourcePortRanges', 'conntrackZone', 'conntrackLabel', 'digest']);
+  requireValue(item.schemaVersion === 1);
+  const transit = record(item.transit, ['poolId', 'prefix', 'routerAddress', 'hostAddress']);
+  const transitPrefix = privatePrefix(transit.prefix), [first, last] = bounds(transitPrefix);
+  const routerAddress = endpointAddress(transit.routerAddress), hostAddress = endpointAddress(transit.hostAddress);
+  requireValue(first !== last && routerAddress !== hostAddress);
+  for (const value of [routerAddress, hostAddress]) {
+    const number = numericAddress(value);
+    requireValue(number >= first && number <= last && (last - first === 1 || (number !== first && number !== last)));
+  }
+  const sourcePortRanges = list(item.sourcePortRanges, runtimeNetworkAuthorityV1Contract.maximumPortRanges, value => {
+    const range = record(value, ['protocol', 'first', 'last']);
+    const result = { protocol: protocol(range.protocol), first: integer(range.first, 65535), last: integer(range.last, 65535) };
+    requireValue(result.first <= result.last);
+    return result;
+  });
+  requireValue(sourcePortRanges.length > 0);
+  for (let index = 1; index < sourcePortRanges.length; index++) {
+    const previous = sourcePortRanges[index - 1], current = sourcePortRanges[index];
+    requireValue(previous.protocol < current.protocol || (previous.protocol === current.protocol && previous.last < current.first));
+  }
+  requireValue(typeof item.conntrackLabel === 'string' && /^[a-f0-9]{32}$/.test(item.conntrackLabel)
+    && item.conntrackLabel !== '0'.repeat(32));
+  return { schemaVersion: 1, id: id(item.id), generation: integer(item.generation), controller: controller(item.controller),
+    nodeId: id(item.nodeId), runtimeNamespace: id(item.runtimeNamespace), protectedAuthority: reference(item.protectedAuthority),
+    routerIncarnationId: id(item.routerIncarnationId), transit: { poolId: id(transit.poolId), prefix: transitPrefix, routerAddress, hostAddress },
+    sourcePortRanges, conntrackZone: integer(item.conntrackZone, 65535), conntrackLabel: item.conntrackLabel, digest: digest(item.digest) };
+});
+
+const computeDigest = async (domain: string, value: { digest: TSha256Digest }): Promise<TSha256Digest> => {
+  const { digest: omitted, ...payload } = value;
+  return `sha256:${await createCanonicalJsonSha256Hex(canonical({ domain, payload }), fail)}`;
+};
+export const computeRuntimeNetworkProtectedAuthorityV1Digest = (value: IRuntimeNetworkProtectedAuthorityV1): Promise<TSha256Digest> =>
+  computeDigest(runtimeNetworkAuthorityV1Contract.protectedDigestDomain, snapshotRuntimeNetworkProtectedAuthorityV1(value));
+export const computeRuntimeNetworkHandoffLeaseV1Digest = (value: IRuntimeNetworkHandoffLeaseV1): Promise<TSha256Digest> =>
+  computeDigest(runtimeNetworkAuthorityV1Contract.handoffDigestDomain, snapshotRuntimeNetworkHandoffLeaseV1(value));
+
+/** Detached, digest-verified allocation binding. Does not establish pool activation or live link identity. */
+export const bindRuntimeNetworkHandoffLeaseV1 = async (leaseValue: unknown, authorityValue: unknown): Promise<{
+  lease: IRuntimeNetworkHandoffLeaseV1; authority: IRuntimeNetworkProtectedAuthorityV1;
+}> => {
+  const lease = snapshotRuntimeNetworkHandoffLeaseV1(leaseValue);
+  const authority = snapshotRuntimeNetworkProtectedAuthorityV1(authorityValue);
+  requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
+  requireValue(authority.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(authority));
+  requireValue(equals(lease.controller, authority.controller)
+    && equals(lease.protectedAuthority, { id: authority.id, generation: authority.generation, digest: authority.digest })
+    && authority.egressAuthorities.some(value => value.nodeId === lease.nodeId && value.runtimeNamespace === lease.runtimeNamespace));
+  const pool = authority.pools.find(value => value.id === lease.transit.poolId);
+  requireValue(pool?.purpose === 'transit' && contains(pool.prefix, lease.transit.prefix));
+  return { lease, authority };
+};
+
+/**
+ * Validate ALL retained leases for one physical node/controller epoch, including quarantine.
+ * The owning transactional ledger must supply its complete history and serialize reservations.
+ * Namespace replacement, an empty CT dump or process exit never removes an entry from this set.
+ */
+export const snapshotRuntimeNetworkHandoffLedgerV1 = async (value: unknown): Promise<IRuntimeNetworkHandoffLeaseV1[]> => {
+  const leases = safe(() => list(value, runtimeNetworkAuthorityV1Contract.maximumRetainedHandoffLeases,
+    snapshotRuntimeNetworkHandoffLeaseV1));
+  for (let index = 0; index < leases.length; index++) {
+    const lease = leases[index];
+    requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
+    for (let other = 0; other < index; other++) {
+      const previous = leases[other];
+      requireValue(lease.nodeId === previous.nodeId && equals(lease.controller, previous.controller));
+      requireValue(lease.id !== previous.id || lease.generation !== previous.generation);
+      if (lease.runtimeNamespace === previous.runtimeNamespace && lease.routerIncarnationId === previous.routerIncarnationId) {
+        requireValue(lease.conntrackZone !== previous.conntrackZone && lease.conntrackLabel !== previous.conntrackLabel);
+      }
+      // Host handoff tuples remain reserved even across router or runtime namespace changes.
+      if (lease.transit.routerAddress === previous.transit.routerAddress) {
+        for (const left of lease.sourcePortRanges) for (const right of previous.sourcePortRanges) {
+          requireValue(left.protocol !== right.protocol || left.last < right.first || right.last < left.first);
+        }
+      }
+    }
+  }
+  return leases;
+};

package/ts/data/networkdelivery.ts

@@ -0,0 +1,58 @@
+import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
+import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
+import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
+import type { IRuntimeNetworkSigningAuthorityV1, ISignedRuntimeNetworkProjectionV1 } from './networksigning.js';
+import { snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './networksigning.js';
+import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe, requireNetwork } from '../private/networkcontract.js';
+
+export interface IApplyRuntimeNetworkSigningAuthorityRequestV1 {
+  session: IRuntimeSessionBindingV1;
+  authority: IRuntimeNetworkSigningAuthorityV1;
+}
+export interface IApplyRuntimeNetworkProjectionRequestV1 {
+  session: IRuntimeSessionBindingV1;
+  signed: ISignedRuntimeNetworkProjectionV1;
+}
+/** Durable admission only. No packet, DNS, pool-activation, fencing or readiness assertion. */
+export interface IApplyRuntimeNetworkAuthorityResponseV1 {
+  status: 'accepted' | 'replay';
+  authority: IRuntimeAuthorityReferenceV1;
+}
+
+export const snapshotApplyRuntimeNetworkSigningAuthorityRequestV1 = (value: unknown): IApplyRuntimeNetworkSigningAuthorityRequestV1 => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['session', 'authority']);
+  return { session: snapshotRuntimeSessionBindingV1(item.session), authority: snapshotRuntimeNetworkSigningAuthorityV1(item.authority) };
+});
+export const snapshotApplyRuntimeNetworkProjectionRequestV1 = (value: unknown): IApplyRuntimeNetworkProjectionRequestV1 => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['session', 'signed']);
+  return { session: snapshotRuntimeSessionBindingV1(item.session), signed: snapshotSignedRuntimeNetworkProjectionV1(item.signed) };
+});
+export const snapshotApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown): IApplyRuntimeNetworkAuthorityResponseV1 => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['status', 'authority']);
+  requireNetwork(item.status === 'accepted' || item.status === 'replay');
+  return { status: item.status, authority: networkReference(item.authority) };
+});
+
+/** trustedSessionValue must come from the receiving CURRENT physical connection. */
+export const bindApplyRuntimeNetworkSigningAuthorityRequestV1 = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkSigningAuthorityRequestV1 => networkSafe(() => {
+  const request = snapshotApplyRuntimeNetworkSigningAuthorityRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+  requireNetwork(networkEqual(request.session, session) && networkEqual(request.authority.controller, session.controller));
+  return request;
+});
+
+/** Content binding only. Verify signature with stored trust and atomically fence admission. */
+export const bindApplyRuntimeNetworkProjectionRequestV1 = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkProjectionRequestV1 => networkSafe(() => {
+  const request = snapshotApplyRuntimeNetworkProjectionRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+  const projection = request.signed.projection;
+  requireNetwork(networkEqual(request.session, session) && networkEqual(projection.controller, session.controller)
+    && projection.nodeId === session.nodeId && projection.runtimeNamespace === session.runtimeNamespace);
+  return request;
+});
+
+/** Compare ACK with the exact SENT key or projection reference, never with a response-derived value. */
+export const bindApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown, sentReferenceValue: unknown): IApplyRuntimeNetworkAuthorityResponseV1 => networkSafe(() => {
+  const response = snapshotApplyRuntimeNetworkAuthorityResponseV1(value);
+  const expected = networkReference(captureNetwork(sentReferenceValue));
+  requireNetwork(networkEqual(response.authority, networkReferenceOf(expected)));
+  return response;
+});