@serve.zone/interfaces 30.7.0 → 30.9.0

package/changelog.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 2026-09-13 - 30.9.0
+
+### Features
+
+- Add durable native protection receipts, authenticated report bindings and complete affected-worker protection prerequisites for network allocation.
+
+## 2026-09-13 - 30.8.1
+
+### Fixes
+
+- Exclude internal development notes from published npm artifacts using a non-readme filename.
+
+## 2026-09-13 - 30.8.0
+
+### Features
+
+- Add immutable workload address leases, complete private-network and DNS projections, explicit withdrawal admission, dedicated Ed25519 signing authority, and authenticated runtime delivery contracts.
+
 ## 2026-09-13 - 30.7.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '30.7.0',
+    version: '30.9.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -23,6 +23,10 @@ export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
 export * from './networkauthority.js';
+export * from './networkdelivery.js';
+export * from './networkprojection.js';
+export * from './networkprotection.js';
+export * from './networksigning.js';
 export * from './privatenetwork.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';

package/dist_ts/data/index.js

@@ -23,6 +23,10 @@ export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
 export * from './networkauthority.js';
+export * from './networkdelivery.js';
+export * from './networkprojection.js';
+export * from './networkprotection.js';
+export * from './networksigning.js';
 export * from './privatenetwork.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
@@ -45,4 +49,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/data/networkdelivery.d.ts

@@ -0,0 +1,25 @@
+import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
+import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
+import type { IRuntimeNetworkSigningAuthorityV1, ISignedRuntimeNetworkProjectionV1 } from './networksigning.js';
+export interface IApplyRuntimeNetworkSigningAuthorityRequestV1 {
+    session: IRuntimeSessionBindingV1;
+    authority: IRuntimeNetworkSigningAuthorityV1;
+}
+export interface IApplyRuntimeNetworkProjectionRequestV1 {
+    session: IRuntimeSessionBindingV1;
+    signed: ISignedRuntimeNetworkProjectionV1;
+}
+/** Durable admission only. No packet, DNS, pool-activation, fencing or readiness assertion. */
+export interface IApplyRuntimeNetworkAuthorityResponseV1 {
+    status: 'accepted' | 'replay';
+    authority: IRuntimeAuthorityReferenceV1;
+}
+export declare const snapshotApplyRuntimeNetworkSigningAuthorityRequestV1: (value: unknown) => IApplyRuntimeNetworkSigningAuthorityRequestV1;
+export declare const snapshotApplyRuntimeNetworkProjectionRequestV1: (value: unknown) => IApplyRuntimeNetworkProjectionRequestV1;
+export declare const snapshotApplyRuntimeNetworkAuthorityResponseV1: (value: unknown) => IApplyRuntimeNetworkAuthorityResponseV1;
+/** trustedSessionValue must come from the receiving CURRENT physical connection. */
+export declare const bindApplyRuntimeNetworkSigningAuthorityRequestV1: (value: unknown, trustedSessionValue: unknown) => IApplyRuntimeNetworkSigningAuthorityRequestV1;
+/** Content binding only. Verify signature with stored trust and atomically fence admission. */
+export declare const bindApplyRuntimeNetworkProjectionRequestV1: (value: unknown, trustedSessionValue: unknown) => IApplyRuntimeNetworkProjectionRequestV1;
+/** Compare ACK with the exact SENT key or projection reference, never with a response-derived value. */
+export declare const bindApplyRuntimeNetworkAuthorityResponseV1: (value: unknown, sentReferenceValue: unknown) => IApplyRuntimeNetworkAuthorityResponseV1;

package/dist_ts/data/networkdelivery.js

@@ -0,0 +1,38 @@
+import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
+import { snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './networksigning.js';
+import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe, requireNetwork } from '../private/networkcontract.js';
+export const snapshotApplyRuntimeNetworkSigningAuthorityRequestV1 = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['session', 'authority']);
+    return { session: snapshotRuntimeSessionBindingV1(item.session), authority: snapshotRuntimeNetworkSigningAuthorityV1(item.authority) };
+});
+export const snapshotApplyRuntimeNetworkProjectionRequestV1 = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['session', 'signed']);
+    return { session: snapshotRuntimeSessionBindingV1(item.session), signed: snapshotSignedRuntimeNetworkProjectionV1(item.signed) };
+});
+export const snapshotApplyRuntimeNetworkAuthorityResponseV1 = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['status', 'authority']);
+    requireNetwork(item.status === 'accepted' || item.status === 'replay');
+    return { status: item.status, authority: networkReference(item.authority) };
+});
+/** trustedSessionValue must come from the receiving CURRENT physical connection. */
+export const bindApplyRuntimeNetworkSigningAuthorityRequestV1 = (value, trustedSessionValue) => networkSafe(() => {
+    const request = snapshotApplyRuntimeNetworkSigningAuthorityRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+    requireNetwork(networkEqual(request.session, session) && networkEqual(request.authority.controller, session.controller));
+    return request;
+});
+/** Content binding only. Verify signature with stored trust and atomically fence admission. */
+export const bindApplyRuntimeNetworkProjectionRequestV1 = (value, trustedSessionValue) => networkSafe(() => {
+    const request = snapshotApplyRuntimeNetworkProjectionRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+    const projection = request.signed.projection;
+    requireNetwork(networkEqual(request.session, session) && networkEqual(projection.controller, session.controller)
+        && projection.nodeId === session.nodeId && projection.runtimeNamespace === session.runtimeNamespace);
+    return request;
+});
+/** Compare ACK with the exact SENT key or projection reference, never with a response-derived value. */
+export const bindApplyRuntimeNetworkAuthorityResponseV1 = (value, sentReferenceValue) => networkSafe(() => {
+    const response = snapshotApplyRuntimeNetworkAuthorityResponseV1(value);
+    const expected = networkReference(captureNetwork(sentReferenceValue));
+    requireNetwork(networkEqual(response.authority, networkReferenceOf(expected)));
+    return response;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2RlbGl2ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9uZXR3b3JrZGVsaXZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLCtCQUErQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFdEUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDekgsT0FBTyxFQUFFLGNBQWMsRUFBRSxZQUFZLEVBQUUsYUFBYSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQWdCL0osTUFBTSxDQUFDLE1BQU0sb0RBQW9ELEdBQUcsQ0FBQyxLQUFjLEVBQWlELEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3RKLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUM1RSxPQUFPLEVBQUUsT0FBTyxFQUFFLCtCQUErQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxTQUFTLEVBQUUsd0NBQXdDLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDekksQ0FBQyxDQUFDLENBQUM7QUFDSCxNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUFDLEtBQWMsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLE9BQU8sRUFBRSxPQUFPLEVBQUUsK0JBQStCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sRUFBRSx3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUNuSSxDQUFDLENBQUMsQ0FBQztBQUNILE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQUMsS0FBYyxFQUEyQyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUMxSSxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDM0UsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssVUFBVSxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDdkUsT0FBTyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztBQUM5RSxDQUFDLENBQUMsQ0FBQztBQUVILG9GQUFvRjtBQUNwRixNQUFNLENBQUMsTUFBTSxnREFBZ0QsR0FBRyxDQUFDLEtBQWMsRUFBRSxtQkFBNEIsRUFBaUQsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDaEwsTUFBTSxPQUFPLEdBQUcsb0RBQW9ELENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxHQUFHLCtCQUErQixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDNUksY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUN6SCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUMsQ0FBQztBQUVILCtGQUErRjtBQUMvRixNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUFDLEtBQWMsRUFBRSxtQkFBNEIsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDcEssTUFBTSxPQUFPLEdBQUcsOENBQThDLENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxHQUFHLCtCQUErQixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDdEksTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7SUFDN0MsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUM7V0FDM0csVUFBVSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTSxJQUFJLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUN2RyxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUMsQ0FBQztBQUVILHdHQUF3RztBQUN4RyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUFDLEtBQWMsRUFBRSxrQkFBMkIsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDbkssTUFBTSxRQUFRLEdBQUcsOENBQThDLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDdkUsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsY0FBYyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQztJQUN0RSxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9FLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/networkprojection.d.ts

@@ -0,0 +1,140 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAssignmentReferenceV1, IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+import type { IRuntimeNetworkHandoffLeaseV1, IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import type { IPrivateNetworkV1, IServicePrivateNetworksV1, IServicePrivateNetworkDnsPolicyV1 } from './privatenetwork.js';
+export interface IRuntimeNetworkNodeScopeV1 {
+    controller: IRuntimeControllerV1;
+    nodeId: string;
+    runtimeNamespace: string;
+}
+/** Immutable per-attempt address material. Membership and projection revisions are independent. */
+export interface IRuntimeNetworkWorkloadLeaseV1 extends IRuntimeNetworkNodeScopeV1 {
+    schemaVersion: 1;
+    id: string;
+    /** Allocation incarnation, not a mutable desired-state revision. */
+    generation: number;
+    organizationId: string;
+    assignmentId: string;
+    serviceId: string;
+    replicaId: string;
+    attemptId: string;
+    protectedAuthority: IRuntimeAuthorityReferenceV1;
+    routerIncarnationId: string;
+    ipv4: {
+        poolId: string;
+        /** Dedicated, unbridged point-to-point subnet; never the host transit pool. */
+        linkSubnet: string;
+        address: string;
+        /** Exactly address/32, distinct from the link subnet and node-control prefix. */
+        sourcePrefix: string;
+        gateway: string;
+    };
+    /** Router-side reachable address on port 53, injected through CRI dns_config. */
+    dnsServer: string;
+    digest: TSha256Digest;
+}
+/** Controller-owned readiness evidence. A signature does not prove this evidence's provenance. */
+export interface IRuntimeNetworkEndpointV1 {
+    lease: IRuntimeNetworkWorkloadLeaseV1;
+    ready: boolean;
+    observation: {
+        assignment: IRuntimeAssignmentReferenceV1;
+        reporterSessionId: string;
+        sequence: number;
+        digest: TSha256Digest;
+    } | null;
+    /** TCP/UDP only; the complete protected union remains denied. */
+    publicEgress: boolean;
+    platformEndpointIds: string[];
+}
+/** Exact directed grant identity; receiver-owned realization resolves the lease to kernel facts. */
+export interface IRuntimeNetworkPacketGrantV1 {
+    source: IRuntimeAuthorityReferenceV1;
+    destination: {
+        kind: 'workload';
+        lease: IRuntimeAuthorityReferenceV1;
+    } | {
+        kind: 'public';
+    } | {
+        kind: 'platform';
+        id: string;
+        address: string;
+        protocol: 'tcp' | 'udp';
+        port: number;
+    };
+}
+export interface IRuntimeNetworkProjectionV1 extends IRuntimeNetworkNodeScopeV1 {
+    schemaVersion: 1;
+    id: string;
+    generation: number;
+    previous: IRuntimeAuthorityReferenceV1 | null;
+    protectedAuthority: IRuntimeNetworkProtectedAuthorityV1;
+    /** Exact historical authorities needed to authenticate retained allocation material. */
+    allocationAuthorities: IRuntimeNetworkProtectedAuthorityV1[];
+    handoff: IRuntimeNetworkHandoffLeaseV1 | null;
+    /** COMPLETE relevant definitions, including declared names with no ready replicas. */
+    networks: IPrivateNetworkV1[];
+    memberships: IServicePrivateNetworksV1[];
+    endpoints: IRuntimeNetworkEndpointV1[];
+    dns: {
+        issuedAt: number;
+        notBefore: number;
+        expiresAt: number;
+    };
+    /** Explicit denial intent. Carry until the exact predecessor's application is proven. */
+    withdrawals: IRuntimeNetworkPacketGrantV1[];
+    retiredLeases: IRuntimeAuthorityReferenceV1[];
+    retiredHandoffs: IRuntimeAuthorityReferenceV1[];
+    digest: TSha256Digest;
+}
+export interface IRuntimeNetworkDnsViewV1 {
+    source: IRuntimeAuthorityReferenceV1;
+    sourceAddress: string;
+    dnsServer: string;
+    policy: IServicePrivateNetworkDnsPolicyV1;
+    /** Sorted complete A sets; [] is declared NODATA, never an omitted name. AAAA is NODATA. */
+    records: Array<{
+        name: string;
+        addresses: string[];
+    }>;
+}
+export declare const runtimeNetworkProjectionV1Contract: Readonly<{
+    readonly workloadDigestDomain: "serve.zone/runtime-network-workload-lease-v1";
+    readonly projectionDigestDomain: "serve.zone/runtime-network-projection-v1";
+    readonly maximumCanonicalBytes: 917504;
+    readonly maximumAllocationAuthorities: 16;
+    readonly maximumNetworks: 128;
+    readonly maximumMemberships: 256;
+    readonly maximumEndpoints: 256;
+    readonly maximumGrants: 4096;
+    readonly maximumDnsLeaseMs: 900000;
+    readonly positiveTtlSeconds: 5;
+    readonly negativeTtlSeconds: 1;
+    readonly omission: "no-effect-without-explicit-withdrawal";
+    readonly packetLifetime: "until-applied-denial-or-independent-fence";
+    readonly acknowledgement: "admission-is-not-application-or-readiness";
+    readonly allocationReuse: "requires-controller-quarantine-and-all-affected-authority-fences";
+}>;
+export declare const snapshotRuntimeNetworkNodeScopeV1: (value: unknown) => IRuntimeNetworkNodeScopeV1;
+export declare const snapshotRuntimeNetworkWorkloadLeaseV1: (value: unknown) => IRuntimeNetworkWorkloadLeaseV1;
+export declare const computeRuntimeNetworkWorkloadLeaseV1Digest: (value: IRuntimeNetworkWorkloadLeaseV1) => Promise<TSha256Digest>;
+/** Structural snapshot only; use validate/signature/admission helpers before accepting authority. */
+export declare const snapshotRuntimeNetworkProjectionV1: (value: unknown) => IRuntimeNetworkProjectionV1;
+export declare const computeRuntimeNetworkProjectionV1Digest: (value: IRuntimeNetworkProjectionV1) => Promise<TSha256Digest>;
+/** Complete structural, digest, allocation and policy binding. Not an allocation/barrier/readiness proof. */
+export declare const validateRuntimeNetworkProjectionV1: (value: unknown) => Promise<IRuntimeNetworkProjectionV1>;
+/** Complete directed full-mesh and explicitly authorized egress; no DNS readiness dependency. */
+export declare const getRuntimeNetworkProjectionPacketGrantsV1: (value: unknown) => Promise<IRuntimeNetworkPacketGrantV1[]>;
+/** Complete offline DNS material, including authorized names never previously queried. */
+export declare const composeRuntimeNetworkProjectionDnsViewsV1: (value: unknown) => Promise<IRuntimeNetworkDnsViewV1[]>;
+/** Bind immutable address material without a circular assignment-digest dependency. */
+export declare const bindRuntimeNetworkWorkloadLeaseToAssignmentV1: (leaseValue: unknown, assignmentValue: unknown) => Promise<IRuntimeNetworkWorkloadLeaseV1>;
+/**
+ * Pure revision decision. appliedPrevious must be the receiver's exact durable,
+ * joined application receipt, never an incoming ACK field. All prior accepted
+ * material/apply journals survive until effects and DNS/allocation quarantine end.
+ */
+export declare const admitRuntimeNetworkProjectionV1: (value: unknown, previousValue: unknown | null, trustedScopeValue: unknown, appliedPreviousValue: unknown | null) => Promise<{
+    status: "accepted" | "replay";
+    projection: IRuntimeNetworkProjectionV1;
+}>;