@serve.zone/interfaces 30.6.0 → 30.8.1

package/ts/requests/runtimesession.ts

@@ -1,6 +1,25 @@
 import * as plugins from '../plugins.js';
 import type * as data from '../data/runtimesession.js';
 import type * as terminal from '../data/runtimeterminalreceipt.js';
+import type * as network from '../data/networkdelivery.js';
+
+/** Dedicated signing trust installed only through the current authenticated physical peer. */
+export interface IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthorityV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthorityV1
+> {
+  method: 'applyRuntimeNetworkSigningAuthorityV1';
+  request: network.IApplyRuntimeNetworkSigningAuthorityRequestV1;
+  response: network.IApplyRuntimeNetworkAuthorityResponseV1;
+}
+
+/** Complete signed node state; an ACK asserts admission only. */
+export interface IReq_Controller_Pallet_ApplyRuntimeNetworkProjectionV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkProjectionV1
+> {
+  method: 'applyRuntimeNetworkProjectionV1';
+  request: network.IApplyRuntimeNetworkProjectionRequestV1;
+  response: network.IApplyRuntimeNetworkAuthorityResponseV1;
+}
 
 /** WSS-only Pallet bootstrap. Derive physical peer/process/idempotency server-side. */
 export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1 extends plugins.typedrequestInterfaces.implementsTR<

package/ts/runtime.networkprojection.ts

@@ -0,0 +1,64 @@
+import * as plugins from './plugins.runtime.js';
+import type { IRuntimeAuthorityReferenceV1 } from './data/runtimeassignment.js';
+import type { IRuntimeNetworkProjectionV1 } from './data/networkprojection.js';
+import { snapshotRuntimeNetworkNodeScopeV1, snapshotRuntimeNetworkProjectionV1, validateRuntimeNetworkProjectionV1 } from './data/networkprojection.js';
+import type { IRuntimeNetworkSigningAuthorityV1, ISignedRuntimeNetworkProjectionV1 } from './data/networksigning.js';
+import { computeRuntimeNetworkSigningAuthorityV1Digest, runtimeNetworkSigningV1Contract,
+  snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './data/networksigning.js';
+import { failNetwork, networkCanonical, networkEqual, networkReferenceOf, requireNetwork } from './private/networkcontract.js';
+
+/** The private KeyObject is process-local. Persist only through the controller's encrypted secret store. */
+export const createRuntimeNetworkSigningKeyV1 = (): { publicKey: string; privateKey: plugins.crypto.KeyObject } => {
+  const pair = plugins.crypto.generateKeyPairSync('ed25519');
+  const jwk = pair.publicKey.export({ format: 'jwk' });
+  requireNetwork(jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && typeof jwk.x === 'string');
+  return { publicKey: Buffer.from(jwk.x, 'base64url').toString('hex'), privateKey: pair.privateKey };
+};
+
+const signatureBytes = (authority: IRuntimeAuthorityReferenceV1, projection: IRuntimeNetworkProjectionV1): Uint8Array =>
+  new TextEncoder().encode(networkCanonical({ domain: runtimeNetworkSigningV1Contract.signatureDomain, schemaVersion: 1, authority, projection }));
+const validateAuthority = async (authority: IRuntimeNetworkSigningAuthorityV1, projection: IRuntimeNetworkProjectionV1): Promise<void> => {
+  requireNetwork(authority.publicKey !== null && networkEqual(authority.controller, projection.controller)
+    && authority.digest === await computeRuntimeNetworkSigningAuthorityV1Digest(authority));
+};
+
+/** Sign only validated complete state and a matching dedicated private key. */
+export const signRuntimeNetworkProjectionV1 = async (
+  projectionValue: unknown, authorityValue: unknown, privateKey: plugins.crypto.KeyObject,
+): Promise<ISignedRuntimeNetworkProjectionV1> => {
+  try {
+    const input = snapshotRuntimeNetworkProjectionV1(projectionValue), authority = snapshotRuntimeNetworkSigningAuthorityV1(authorityValue);
+    requireNetwork(privateKey instanceof plugins.crypto.KeyObject && privateKey.type === 'private' && privateKey.asymmetricKeyType === 'ed25519');
+    const publicKey = plugins.crypto.createPublicKey(privateKey).export({ format: 'jwk' });
+    requireNetwork(typeof publicKey.x === 'string' && Buffer.from(publicKey.x, 'base64url').toString('hex') === authority.publicKey);
+    const projection = await validateRuntimeNetworkProjectionV1(input);
+    await validateAuthority(authority, projection);
+    const reference = networkReferenceOf(authority);
+    const signature = plugins.crypto.sign(null, signatureBytes(reference, projection), privateKey).toString('hex');
+    return { schemaVersion: 1, authority: reference, projection, signature };
+  } catch { return failNetwork(); }
+};
+
+/**
+ * trustedAuthorityValue is receiver-owned persisted trust, NEVER envelope material.
+ * This verifies content/scope/signature only. The owner still performs atomic revision
+ * admission, live-session fencing, allocation barriers and conservative DNS time checks.
+ */
+export const verifyRuntimeNetworkProjectionV1 = async (
+  value: unknown, trustedAuthorityValue: unknown, trustedScopeValue: unknown,
+): Promise<ISignedRuntimeNetworkProjectionV1> => {
+  try {
+    const signed = snapshotSignedRuntimeNetworkProjectionV1(value);
+    const authority = snapshotRuntimeNetworkSigningAuthorityV1(trustedAuthorityValue);
+    const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
+    requireNetwork(networkEqual(signed.authority, networkReferenceOf(authority))
+      && signed.projection.nodeId === trusted.nodeId && signed.projection.runtimeNamespace === trusted.runtimeNamespace
+      && networkEqual(signed.projection.controller, trusted.controller));
+    await validateAuthority(authority, signed.projection);
+    const key = plugins.crypto.createPublicKey({ format: 'jwk', key: { kty: 'OKP', crv: 'Ed25519',
+      x: Buffer.from(authority.publicKey!, 'hex').toString('base64url') } });
+    requireNetwork(plugins.crypto.verify(null, signatureBytes(signed.authority, signed.projection), key, Buffer.from(signed.signature, 'hex')));
+    await validateRuntimeNetworkProjectionV1(signed.projection);
+    return signed;
+  } catch { return failNetwork(); }
+};

package/ts/runtime.ts

@@ -39,6 +39,7 @@ import {
 } from './runtime.workloadinit.js';
 
 export * from './runtime.workloadinit.js';
+export * from './runtime.networkprojection.js';
 export * from './runtime.corestore.js';
 export * from './runtime.corestore.databaseexportpackage.js';
 export * from './runtime.cloudlylegacydeploymentsettlement.js';