@serve.zone/interfaces 30.8.1 → 30.9.0

package/changelog.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-09-13 - 30.9.0
+
+### Features
+
+- Add durable native protection receipts, authenticated report bindings and complete affected-worker protection prerequisites for network allocation.
+
 ## 2026-09-13 - 30.8.1
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '30.8.1',
+    version: '30.9.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -25,6 +25,7 @@ export * from './nodeenrollment.js';
 export * from './networkauthority.js';
 export * from './networkdelivery.js';
 export * from './networkprojection.js';
+export * from './networkprotection.js';
 export * from './networksigning.js';
 export * from './privatenetwork.js';
 export * from './registry.js';

package/dist_ts/data/index.js

@@ -25,6 +25,7 @@ export * from './nodeenrollment.js';
 export * from './networkauthority.js';
 export * from './networkdelivery.js';
 export * from './networkprojection.js';
+export * from './networkprotection.js';
 export * from './networksigning.js';
 export * from './privatenetwork.js';
 export * from './registry.js';
@@ -48,4 +49,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/data/networkprotection.d.ts

@@ -0,0 +1,68 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
+import type { IRuntimeNetworkNodeScopeV1 } from './networkprojection.js';
+import type { IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
+/**
+ * Durable native protection report, independent of projection admission and DNS.
+ * The producer owns a joined native journal covering ALL affected local egress
+ * paths. nativeBarrier identifies that complete journal, never an admission ACK,
+ * a single table inspection, a boot event or a caller-selected success flag.
+ * A null nativeBarrier explicitly withdraws this node's allocation eligibility.
+ */
+export interface IRuntimeNetworkProtectionReceiptV1 extends IRuntimeNetworkNodeScopeV1 {
+    schemaVersion: 1;
+    id: string;
+    generation: number;
+    previous: IRuntimeAuthorityReferenceV1 | null;
+    protectedAuthority: IRuntimeAuthorityReferenceV1;
+    reporterSessionId: string;
+    bootId: string;
+    nativeBarrier: IRuntimeAuthorityReferenceV1 | null;
+    digest: TSha256Digest;
+}
+export interface IReportRuntimeNetworkProtectionRequestV1 {
+    session: IRuntimeSessionBindingV1;
+    receipt: IRuntimeNetworkProtectionReceiptV1;
+}
+export interface IReportRuntimeNetworkProtectionResponseV1 {
+    status: 'accepted' | 'replay';
+    receipt: IRuntimeAuthorityReferenceV1;
+    authorityUse: 'current' | 'historical';
+}
+export declare const runtimeNetworkProtectionV1Contract: Readonly<{
+    readonly digestDomain: "serve.zone/runtime-network-protection-receipt-v1";
+    readonly maximumAuthorities: 256;
+    readonly allocation: "all-current-affected-egress-receipts-before-reserving-any-lease";
+    readonly receiptSource: "joined-complete-native-protection-journal";
+    readonly unavailable: "null-native-barrier-removes-allocation-eligibility";
+    readonly historical: "retain-for-outbox-replay-never-current-allocation-eligibility";
+    readonly quarantine: "no-release-authority";
+}>;
+export declare const snapshotRuntimeNetworkProtectionReceiptV1: (value: unknown) => IRuntimeNetworkProtectionReceiptV1;
+export declare const computeRuntimeNetworkProtectionReceiptV1Digest: (value: IRuntimeNetworkProtectionReceiptV1) => Promise<TSha256Digest>;
+/** Pure revision binding. The owner must authenticate the reporter and fence all DB writes. */
+export declare const admitRuntimeNetworkProtectionReceiptV1: (value: unknown, previousValue: unknown | null, trustedScopeValue: unknown, knownProtectionValue: unknown) => Promise<{
+    status: "accepted" | "replay";
+    receipt: IRuntimeNetworkProtectionReceiptV1;
+}>;
+export declare const snapshotReportRuntimeNetworkProtectionRequestV1: (value: unknown) => IReportRuntimeNetworkProtectionRequestV1;
+/** Both trusted bindings come from the receiver's fenced physical-session/history owner. */
+export declare const bindReportRuntimeNetworkProtectionRequestV1: (value: unknown, trustedCurrentSessionValue: unknown, trustedReporterSessionValue: unknown) => {
+    request: IReportRuntimeNetworkProtectionRequestV1;
+    authorityUse: "current" | "historical";
+};
+export declare const snapshotReportRuntimeNetworkProtectionResponseV1: (value: unknown) => IReportRuntimeNetworkProtectionResponseV1;
+export declare const bindReportRuntimeNetworkProtectionResponseV1: (value: unknown, sentReceiptValue: unknown) => IReportRuntimeNetworkProtectionResponseV1;
+/**
+ * Complete allocation prerequisite, not authentication or a native inspector.
+ * Inputs MUST be the current receiver-persisted receipts and CURRENT durable
+ * sessions, fenced together with protection and lease insertion. Never supply
+ * worker-authored lists or just online peers. Missing/offline/unavailable owners
+ * cannot be omitted. Independent fences need their own verified owning contract;
+ * this helper supplies no generic override, expiry or quorum escape hatch.
+ */
+export declare const bindRuntimeNetworkAllocationProtectionV1: (protectionValue: unknown, receiptsValue: unknown, currentSessionsValue: unknown) => Promise<{
+    protection: IRuntimeNetworkProtectedAuthorityV1;
+    receipts: IRuntimeNetworkProtectionReceiptV1[];
+}>;

package/dist_ts/data/networkprotection.js

@@ -0,0 +1,129 @@
+import { snapshotRuntimeNetworkNodeScopeV1 } from './networkprojection.js';
+import { computeRuntimeNetworkProtectedAuthorityV1Digest, snapshotRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
+import { captureNetwork, failNetwork, networkCanonical, networkDigest, networkEqual, networkHash, networkId, networkList, networkRecord, networkReference, networkReferenceOf, networkRevision, networkSafe, networkSorted, requireNetwork } from '../private/networkcontract.js';
+export const runtimeNetworkProtectionV1Contract = Object.freeze({
+    digestDomain: 'serve.zone/runtime-network-protection-receipt-v1',
+    maximumAuthorities: 256,
+    allocation: 'all-current-affected-egress-receipts-before-reserving-any-lease',
+    receiptSource: 'joined-complete-native-protection-journal',
+    unavailable: 'null-native-barrier-removes-allocation-eligibility',
+    historical: 'retain-for-outbox-replay-never-current-allocation-eligibility',
+    quarantine: 'no-release-authority',
+});
+const scopeOf = (value) => ({ controller: value.controller, nodeId: value.nodeId, runtimeNamespace: value.runtimeNamespace });
+const scopeKey = (value) => networkCanonical([value.nodeId, value.runtimeNamespace]);
+export const snapshotRuntimeNetworkProtectionReceiptV1 = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['schemaVersion', 'id', 'generation', 'previous',
+        'controller', 'nodeId', 'runtimeNamespace', 'protectedAuthority', 'reporterSessionId', 'bootId', 'nativeBarrier', 'digest']);
+    requireNetwork(item.schemaVersion === 1 && typeof item.bootId === 'string'
+        && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(item.bootId)
+        && item.bootId !== '00000000-0000-0000-0000-000000000000');
+    const scope = snapshotRuntimeNetworkNodeScopeV1({ controller: item.controller, nodeId: item.nodeId, runtimeNamespace: item.runtimeNamespace });
+    return { schemaVersion: 1, ...networkRevision(item), ...scope,
+        protectedAuthority: networkReference(item.protectedAuthority), reporterSessionId: networkId(item.reporterSessionId),
+        bootId: item.bootId, nativeBarrier: item.nativeBarrier === null ? null : networkReference(item.nativeBarrier),
+        digest: networkDigest(item.digest) };
+});
+export const computeRuntimeNetworkProtectionReceiptV1Digest = (value) => networkHash(runtimeNetworkProtectionV1Contract.digestDomain, snapshotRuntimeNetworkProtectionReceiptV1(value));
+/** Pure revision binding. The owner must authenticate the reporter and fence all DB writes. */
+export const admitRuntimeNetworkProtectionReceiptV1 = async (value, previousValue, trustedScopeValue, knownProtectionValue) => {
+    try {
+        const receipt = snapshotRuntimeNetworkProtectionReceiptV1(value);
+        const previous = previousValue === null ? null : snapshotRuntimeNetworkProtectionReceiptV1(previousValue);
+        const scope = snapshotRuntimeNetworkNodeScopeV1(captureNetwork(trustedScopeValue));
+        const protection = snapshotRuntimeNetworkProtectedAuthorityV1(captureNetwork(knownProtectionValue));
+        requireNetwork(networkEqual(scopeOf(receipt), scope) && networkEqual(receipt.controller, protection.controller)
+            && networkEqual(receipt.protectedAuthority, networkReferenceOf(protection))
+            && protection.egressAuthorities.some(owner => scopeKey(owner) === scopeKey(receipt)));
+        requireNetwork(receipt.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(receipt)
+            && protection.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(protection));
+        if (!previous)
+            requireNetwork(receipt.generation === 1 && receipt.previous === null);
+        else {
+            requireNetwork(networkEqual(scopeOf(previous), scope)
+                && previous.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(previous));
+            if (networkEqual(receipt, previous))
+                return { status: 'replay', receipt };
+            requireNetwork(receipt.id === previous.id && receipt.generation === previous.generation + 1
+                && networkEqual(receipt.previous, networkReferenceOf(previous))
+                && receipt.protectedAuthority.id === previous.protectedAuthority.id
+                && receipt.protectedAuthority.generation >= previous.protectedAuthority.generation);
+            if (receipt.protectedAuthority.generation === previous.protectedAuthority.generation) {
+                requireNetwork(networkEqual(receipt.protectedAuthority, previous.protectedAuthority));
+            }
+            if (receipt.nativeBarrier && previous.nativeBarrier) {
+                if (receipt.bootId !== previous.bootId || !networkEqual(receipt.protectedAuthority, previous.protectedAuthority)) {
+                    requireNetwork(!networkEqual(receipt.nativeBarrier, previous.nativeBarrier));
+                }
+                if (receipt.nativeBarrier.id === previous.nativeBarrier.id) {
+                    requireNetwork(receipt.nativeBarrier.generation >= previous.nativeBarrier.generation);
+                    if (receipt.nativeBarrier.generation === previous.nativeBarrier.generation) {
+                        requireNetwork(networkEqual(receipt.nativeBarrier, previous.nativeBarrier));
+                    }
+                }
+            }
+        }
+        return { status: 'accepted', receipt };
+    }
+    catch {
+        return failNetwork();
+    }
+};
+export const snapshotReportRuntimeNetworkProtectionRequestV1 = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['session', 'receipt']);
+    return { session: snapshotRuntimeSessionBindingV1(item.session), receipt: snapshotRuntimeNetworkProtectionReceiptV1(item.receipt) };
+});
+/** Both trusted bindings come from the receiver's fenced physical-session/history owner. */
+export const bindReportRuntimeNetworkProtectionRequestV1 = (value, trustedCurrentSessionValue, trustedReporterSessionValue) => networkSafe(() => {
+    const request = snapshotReportRuntimeNetworkProtectionRequestV1(value);
+    const current = snapshotRuntimeSessionBindingV1(captureNetwork(trustedCurrentSessionValue));
+    const reporter = snapshotRuntimeSessionBindingV1(captureNetwork(trustedReporterSessionValue));
+    requireNetwork(networkEqual(request.session, current) && networkEqual(scopeOf(request.receipt), scopeOf(current))
+        && networkEqual(scopeOf(reporter), scopeOf(current)) && reporter.reporterSessionId === request.receipt.reporterSessionId);
+    const authorityUse = reporter.reporterSessionId === current.reporterSessionId ? 'current' : 'historical';
+    requireNetwork(authorityUse === 'current' ? networkEqual(reporter, current)
+        : reporter.sessionEpoch < current.sessionEpoch && reporter.credentialGeneration <= current.credentialGeneration);
+    return { request, authorityUse };
+});
+export const snapshotReportRuntimeNetworkProtectionResponseV1 = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['status', 'receipt', 'authorityUse']);
+    requireNetwork((item.status === 'accepted' || item.status === 'replay')
+        && (item.authorityUse === 'current' || item.authorityUse === 'historical'));
+    return { status: item.status, receipt: networkReference(item.receipt), authorityUse: item.authorityUse };
+});
+export const bindReportRuntimeNetworkProtectionResponseV1 = (value, sentReceiptValue) => networkSafe(() => {
+    const response = snapshotReportRuntimeNetworkProtectionResponseV1(value);
+    requireNetwork(networkEqual(response.receipt, networkReference(captureNetwork(sentReceiptValue))));
+    return response;
+});
+/**
+ * Complete allocation prerequisite, not authentication or a native inspector.
+ * Inputs MUST be the current receiver-persisted receipts and CURRENT durable
+ * sessions, fenced together with protection and lease insertion. Never supply
+ * worker-authored lists or just online peers. Missing/offline/unavailable owners
+ * cannot be omitted. Independent fences need their own verified owning contract;
+ * this helper supplies no generic override, expiry or quorum escape hatch.
+ */
+export const bindRuntimeNetworkAllocationProtectionV1 = async (protectionValue, receiptsValue, currentSessionsValue) => {
+    try {
+        const protection = snapshotRuntimeNetworkProtectedAuthorityV1(captureNetwork(protectionValue));
+        const receipts = networkSorted(networkList(captureNetwork(receiptsValue), 256, snapshotRuntimeNetworkProtectionReceiptV1), scopeKey);
+        const sessions = networkSorted(networkList(captureNetwork(currentSessionsValue), 256, snapshotRuntimeSessionBindingV1), scopeKey);
+        requireNetwork(protection.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(protection)
+            && receipts.length === protection.egressAuthorities.length && sessions.length === receipts.length);
+        for (const [index, owner] of protection.egressAuthorities.entries()) {
+            const receipt = receipts[index], session = sessions[index];
+            requireNetwork(scopeKey(receipt) === scopeKey(owner) && scopeKey(session) === scopeKey(owner)
+                && networkEqual(receipt.controller, protection.controller) && networkEqual(session.controller, protection.controller)
+                && receipt.reporterSessionId === session.reporterSessionId && receipt.nativeBarrier !== null
+                && networkEqual(receipt.protectedAuthority, networkReferenceOf(protection))
+                && receipt.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(receipt));
+        }
+        return { protection, receipts };
+    }
+    catch {
+        return failNetwork();
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya3Byb3RlY3Rpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtwcm90ZWN0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUdBLE9BQU8sRUFBRSxpQ0FBaUMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRTNFLE9BQU8sRUFBRSwrQ0FBK0MsRUFBRSwwQ0FBMEMsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBRXBJLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3RFLE9BQU8sRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLGFBQWEsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUM5RixTQUFTLEVBQUUsV0FBVyxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxlQUFlLEVBQzVGLFdBQVcsRUFBRSxhQUFhLEVBQUUsY0FBYyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUErQnBGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDOUQsWUFBWSxFQUFFLGtEQUFrRDtJQUNoRSxrQkFBa0IsRUFBRSxHQUFHO0lBQ3ZCLFVBQVUsRUFBRSxpRUFBaUU7SUFDN0UsYUFBYSxFQUFFLDJDQUEyQztJQUMxRCxXQUFXLEVBQUUsb0RBQW9EO0lBQ2pFLFVBQVUsRUFBRSwrREFBK0Q7SUFDM0UsVUFBVSxFQUFFLHNCQUFzQjtDQUMxQixDQUFDLENBQUM7QUFFWixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWlDLEVBQThCLEVBQUUsQ0FDaEYsQ0FBQyxFQUFFLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLENBQUM7QUFDckcsTUFBTSxRQUFRLEdBQUcsQ0FBQyxLQUFtRCxFQUFVLEVBQUUsQ0FDL0UsZ0JBQWdCLENBQUMsQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7QUFFM0QsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FBQyxLQUFjLEVBQXNDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ2hJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxVQUFVO1FBQ2hHLFlBQVksRUFBRSxRQUFRLEVBQUUsa0JBQWtCLEVBQUUsb0JBQW9CLEVBQUUsbUJBQW1CLEVBQUUsUUFBUSxFQUFFLGVBQWUsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQy9ILGNBQWMsQ0FBQyxJQUFJLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxPQUFPLElBQUksQ0FBQyxNQUFNLEtBQUssUUFBUTtXQUNyRSxnRUFBZ0UsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQztXQUNsRixJQUFJLENBQUMsTUFBTSxLQUFLLHNDQUFzQyxDQUFDLENBQUM7SUFDN0QsTUFBTSxLQUFLLEdBQUcsaUNBQWlDLENBQUMsRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQyxDQUFDO0lBQy9JLE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLEdBQUcsZUFBZSxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsS0FBSztRQUMzRCxrQkFBa0IsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsRUFBRSxpQkFBaUIsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDO1FBQ25ILE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO1FBQzdHLE1BQU0sRUFBRSxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDekMsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUFDLEtBQXlDLEVBQTBCLEVBQUUsQ0FDbEksV0FBVyxDQUFDLGtDQUFrQyxDQUFDLFlBQVksRUFBRSx5Q0FBeUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBRWpILCtGQUErRjtBQUMvRixNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELEtBQWMsRUFBRSxhQUE2QixFQUFFLGlCQUEwQixFQUFFLG9CQUE2QixFQUNmLEVBQUU7SUFDM0YsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcseUNBQXlDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakUsTUFBTSxRQUFRLEdBQUcsYUFBYSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyx5Q0FBeUMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMxRyxNQUFNLEtBQUssR0FBRyxpQ0FBaUMsQ0FBQyxjQUFjLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO1FBQ25GLE1BQU0sVUFBVSxHQUFHLDBDQUEwQyxDQUFDLGNBQWMsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLENBQUM7UUFDcEcsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxDQUFDLElBQUksWUFBWSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQztlQUMxRyxZQUFZLENBQUMsT0FBTyxDQUFDLGtCQUFrQixFQUFFLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxDQUFDO2VBQ3hFLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN4RixjQUFjLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxNQUFNLDhDQUE4QyxDQUFDLE9BQU8sQ0FBQztlQUMxRixVQUFVLENBQUMsTUFBTSxLQUFLLE1BQU0sK0NBQStDLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUM5RixJQUFJLENBQUMsUUFBUTtZQUFFLGNBQWMsQ0FBQyxPQUFPLENBQUMsVUFBVSxLQUFLLENBQUMsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDO2FBQ2hGLENBQUM7WUFDSixjQUFjLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLENBQUM7bUJBQ2hELFFBQVEsQ0FBQyxNQUFNLEtBQUssTUFBTSw4Q0FBOEMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1lBQ3pGLElBQUksWUFBWSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUM7Z0JBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFDMUUsY0FBYyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLEVBQUUsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxVQUFVLEdBQUcsQ0FBQzttQkFDdEYsWUFBWSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUM7bUJBQzVELE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLGtCQUFrQixDQUFDLEVBQUU7bUJBQ2hFLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxVQUFVLElBQUksUUFBUSxDQUFDLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ3RGLElBQUksT0FBTyxDQUFDLGtCQUFrQixDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUMsa0JBQWtCLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ3JGLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLGtCQUFrQixFQUFFLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUM7WUFDeEYsQ0FBQztZQUNELElBQUksT0FBTyxDQUFDLGFBQWEsSUFBSSxRQUFRLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQ3BELElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxRQUFRLENBQUMsa0JBQWtCLENBQUMsRUFBRSxDQUFDO29CQUNqSCxjQUFjLENBQUMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztnQkFDL0UsQ0FBQztnQkFDRCxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQyxhQUFhLENBQUMsRUFBRSxFQUFFLENBQUM7b0JBQzNELGNBQWMsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLFVBQVUsSUFBSSxRQUFRLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxDQUFDO29CQUN0RixJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxhQUFhLENBQUMsVUFBVSxFQUFFLENBQUM7d0JBQzNFLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztvQkFDOUUsQ0FBQztnQkFDSCxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUN6QyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsQ0FBQyxLQUFjLEVBQTRDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQzVJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUMxRSxPQUFPLEVBQUUsT0FBTyxFQUFFLCtCQUErQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxPQUFPLEVBQUUseUNBQXlDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7QUFDdEksQ0FBQyxDQUFDLENBQUM7QUFFSCw0RkFBNEY7QUFDNUYsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FDekQsS0FBYyxFQUFFLDBCQUFtQyxFQUFFLDJCQUFvQyxFQUNNLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ25ILE1BQU0sT0FBTyxHQUFHLCtDQUErQyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZFLE1BQU0sT0FBTyxHQUFHLCtCQUErQixDQUFDLGNBQWMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUM7SUFDNUYsTUFBTSxRQUFRLEdBQUcsK0JBQStCLENBQUMsY0FBYyxDQUFDLDJCQUEyQixDQUFDLENBQUMsQ0FBQztJQUM5RixjQUFjLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUksWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1dBQzVHLFlBQVksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksUUFBUSxDQUFDLGlCQUFpQixLQUFLLE9BQU8sQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsQ0FBQztJQUM1SCxNQUFNLFlBQVksR0FBRyxRQUFRLENBQUMsaUJBQWlCLEtBQUssT0FBTyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQztJQUN6RyxjQUFjLENBQUMsWUFBWSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUM7UUFDekUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxZQUFZLEdBQUcsT0FBTyxDQUFDLFlBQVksSUFBSSxRQUFRLENBQUMsb0JBQW9CLElBQUksT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDbkgsT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsQ0FBQztBQUNuQyxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLGdEQUFnRCxHQUFHLENBQUMsS0FBYyxFQUE2QyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUM5SSxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDO0lBQ3pGLGNBQWMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssVUFBVSxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDO1dBQ2xFLENBQUMsSUFBSSxDQUFDLFlBQVksS0FBSyxTQUFTLElBQUksSUFBSSxDQUFDLFlBQVksS0FBSyxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQzlFLE9BQU8sRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7QUFDM0csQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw0Q0FBNEMsR0FBRyxDQUFDLEtBQWMsRUFBRSxnQkFBeUIsRUFBNkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDckssTUFBTSxRQUFRLEdBQUcsZ0RBQWdELENBQUMsS0FBSyxDQUFDLENBQUM7SUFDekUsY0FBYyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLEtBQUssRUFDM0QsZUFBd0IsRUFBRSxhQUFzQixFQUFFLG9CQUE2QixFQUMrQixFQUFFO0lBQ2hILElBQUksQ0FBQztRQUNILE1BQU0sVUFBVSxHQUFHLDBDQUEwQyxDQUFDLGNBQWMsQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDO1FBQy9GLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLGFBQWEsQ0FBQyxFQUFFLEdBQUcsRUFBRSx5Q0FBeUMsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3JJLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLG9CQUFvQixDQUFDLEVBQUUsR0FBRyxFQUFFLCtCQUErQixDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDbEksY0FBYyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssTUFBTSwrQ0FBK0MsQ0FBQyxVQUFVLENBQUM7ZUFDakcsUUFBUSxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsaUJBQWlCLENBQUMsTUFBTSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3JHLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsSUFBSSxVQUFVLENBQUMsaUJBQWlCLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUNwRSxNQUFNLE9BQU8sR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMzRCxjQUFjLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxLQUFLLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssUUFBUSxDQUFDLEtBQUssQ0FBQzttQkFDeEYsWUFBWSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxJQUFJLFlBQVksQ0FBQyxPQUFPLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUM7bUJBQ2xILE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyxPQUFPLENBQUMsaUJBQWlCLElBQUksT0FBTyxDQUFDLGFBQWEsS0FBSyxJQUFJO21CQUN6RixZQUFZLENBQUMsT0FBTyxDQUFDLGtCQUFrQixFQUFFLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxDQUFDO21CQUN4RSxPQUFPLENBQUMsTUFBTSxLQUFLLE1BQU0sOENBQThDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsT0FBTyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsQ0FBQztJQUNsQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/runtimesession.d.ts

@@ -2,6 +2,13 @@ import * as plugins from '../plugins.js';
 import type * as data from '../data/runtimesession.js';
 import type * as terminal from '../data/runtimeterminalreceipt.js';
 import type * as network from '../data/networkdelivery.js';
+import type * as protection from '../data/networkprotection.js';
+/** Current authenticated peer reports its durable complete native protection journal. */
+export interface IReq_Pallet_Controller_ReportRuntimeNetworkProtectionV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportRuntimeNetworkProtectionV1> {
+    method: 'reportRuntimeNetworkProtectionV1';
+    request: protection.IReportRuntimeNetworkProtectionRequestV1;
+    response: protection.IReportRuntimeNetworkProtectionResponseV1;
+}
 /** Dedicated signing trust installed only through the current authenticated physical peer. */
 export interface IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthorityV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthorityV1> {
     method: 'applyRuntimeNetworkSigningAuthorityV1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "30.8.1",
+  "version": "30.9.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -265,6 +265,26 @@ the declaration is not a revocation acknowledgement. Prefix arrays are sorted
 lexically and nonoverlapping; pools and endpoints are sorted by ID; egress owners
 are ordered by canonical JSON of `[nodeId, runtimeNamespace]`.
 
+`IRuntimeNetworkProtectionReceiptV1` reports a worker's durable, joined native
+protection journal separately from projection admission. It binds a complete
+protected-authority reference, node/controller scope, authenticated reporter,
+boot identity and exact native journal reference to a monotonic receipt chain.
+A null `nativeBarrier` explicitly removes allocation eligibility. A boot or
+protection change requires new native journal evidence. These portable values
+do not inspect a kernel or authenticate their own producer.
+
+`reportRuntimeNetworkProtectionV1` uses the current authenticated physical peer.
+Its request binder accepts a historical outbox only against receiver-owned
+reporter history and identifies that use as historical. The response must match
+the exact sent receipt. `bindRuntimeNetworkAllocationProtectionV1` requires the
+current persisted protection receipt and durable session for every declared
+egress owner, in canonical owner order. Missing, unavailable, stale-protection
+and superseded-session evidence reject. An offline owner cannot be omitted.
+The controller must fence all those records together with lease insertion, before
+reserving any handoff or workload address. No generic independent-fence flag is
+provided; such a mechanism needs its own verified owner. Protection receipts
+neither prove workload readiness nor release packet/address/name quarantine.
+
 `IRuntimeNetworkHandoffLeaseV1` binds an immutable node/router incarnation to its
 protected-authority reference, transit subnet and peers, protocol-qualified source
 ports, nonzero conntrack zone and 128-bit label. The label is exactly 32 lowercase

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '30.8.1',
+  version: '30.9.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -25,6 +25,7 @@ export * from './nodeenrollment.js';
 export * from './networkauthority.js';
 export * from './networkdelivery.js';
 export * from './networkprojection.js';
+export * from './networkprotection.js';
 export * from './networksigning.js';
 export * from './privatenetwork.js';
 export * from './registry.js';

package/ts/data/networkprotection.ts

@@ -0,0 +1,175 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
+import type { IRuntimeNetworkNodeScopeV1 } from './networkprojection.js';
+import { snapshotRuntimeNetworkNodeScopeV1 } from './networkprojection.js';
+import type { IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import { computeRuntimeNetworkProtectedAuthorityV1Digest, snapshotRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
+import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
+import { captureNetwork, failNetwork, networkCanonical, networkDigest, networkEqual, networkHash,
+  networkId, networkList, networkRecord, networkReference, networkReferenceOf, networkRevision,
+  networkSafe, networkSorted, requireNetwork } from '../private/networkcontract.js';
+
+/**
+ * Durable native protection report, independent of projection admission and DNS.
+ * The producer owns a joined native journal covering ALL affected local egress
+ * paths. nativeBarrier identifies that complete journal, never an admission ACK,
+ * a single table inspection, a boot event or a caller-selected success flag.
+ * A null nativeBarrier explicitly withdraws this node's allocation eligibility.
+ */
+export interface IRuntimeNetworkProtectionReceiptV1 extends IRuntimeNetworkNodeScopeV1 {
+  schemaVersion: 1;
+  id: string;
+  generation: number;
+  previous: IRuntimeAuthorityReferenceV1 | null;
+  protectedAuthority: IRuntimeAuthorityReferenceV1;
+  reporterSessionId: string;
+  bootId: string;
+  nativeBarrier: IRuntimeAuthorityReferenceV1 | null;
+  digest: TSha256Digest;
+}
+
+export interface IReportRuntimeNetworkProtectionRequestV1 {
+  session: IRuntimeSessionBindingV1;
+  receipt: IRuntimeNetworkProtectionReceiptV1;
+}
+export interface IReportRuntimeNetworkProtectionResponseV1 {
+  status: 'accepted' | 'replay';
+  receipt: IRuntimeAuthorityReferenceV1;
+  authorityUse: 'current' | 'historical';
+}
+
+export const runtimeNetworkProtectionV1Contract = Object.freeze({
+  digestDomain: 'serve.zone/runtime-network-protection-receipt-v1',
+  maximumAuthorities: 256,
+  allocation: 'all-current-affected-egress-receipts-before-reserving-any-lease',
+  receiptSource: 'joined-complete-native-protection-journal',
+  unavailable: 'null-native-barrier-removes-allocation-eligibility',
+  historical: 'retain-for-outbox-replay-never-current-allocation-eligibility',
+  quarantine: 'no-release-authority',
+} as const);
+
+const scopeOf = (value: IRuntimeNetworkNodeScopeV1): IRuntimeNetworkNodeScopeV1 =>
+  ({ controller: value.controller, nodeId: value.nodeId, runtimeNamespace: value.runtimeNamespace });
+const scopeKey = (value: { nodeId: string; runtimeNamespace: string }): string =>
+  networkCanonical([value.nodeId, value.runtimeNamespace]);
+
+export const snapshotRuntimeNetworkProtectionReceiptV1 = (value: unknown): IRuntimeNetworkProtectionReceiptV1 => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['schemaVersion', 'id', 'generation', 'previous',
+    'controller', 'nodeId', 'runtimeNamespace', 'protectedAuthority', 'reporterSessionId', 'bootId', 'nativeBarrier', 'digest']);
+  requireNetwork(item.schemaVersion === 1 && typeof item.bootId === 'string'
+    && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(item.bootId)
+    && item.bootId !== '00000000-0000-0000-0000-000000000000');
+  const scope = snapshotRuntimeNetworkNodeScopeV1({ controller: item.controller, nodeId: item.nodeId, runtimeNamespace: item.runtimeNamespace });
+  return { schemaVersion: 1, ...networkRevision(item), ...scope,
+    protectedAuthority: networkReference(item.protectedAuthority), reporterSessionId: networkId(item.reporterSessionId),
+    bootId: item.bootId, nativeBarrier: item.nativeBarrier === null ? null : networkReference(item.nativeBarrier),
+    digest: networkDigest(item.digest) };
+});
+
+export const computeRuntimeNetworkProtectionReceiptV1Digest = (value: IRuntimeNetworkProtectionReceiptV1): Promise<TSha256Digest> =>
+  networkHash(runtimeNetworkProtectionV1Contract.digestDomain, snapshotRuntimeNetworkProtectionReceiptV1(value));
+
+/** Pure revision binding. The owner must authenticate the reporter and fence all DB writes. */
+export const admitRuntimeNetworkProtectionReceiptV1 = async (
+  value: unknown, previousValue: unknown | null, trustedScopeValue: unknown, knownProtectionValue: unknown,
+): Promise<{ status: 'accepted' | 'replay'; receipt: IRuntimeNetworkProtectionReceiptV1 }> => {
+  try {
+    const receipt = snapshotRuntimeNetworkProtectionReceiptV1(value);
+    const previous = previousValue === null ? null : snapshotRuntimeNetworkProtectionReceiptV1(previousValue);
+    const scope = snapshotRuntimeNetworkNodeScopeV1(captureNetwork(trustedScopeValue));
+    const protection = snapshotRuntimeNetworkProtectedAuthorityV1(captureNetwork(knownProtectionValue));
+    requireNetwork(networkEqual(scopeOf(receipt), scope) && networkEqual(receipt.controller, protection.controller)
+      && networkEqual(receipt.protectedAuthority, networkReferenceOf(protection))
+      && protection.egressAuthorities.some(owner => scopeKey(owner) === scopeKey(receipt)));
+    requireNetwork(receipt.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(receipt)
+      && protection.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(protection));
+    if (!previous) requireNetwork(receipt.generation === 1 && receipt.previous === null);
+    else {
+      requireNetwork(networkEqual(scopeOf(previous), scope)
+        && previous.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(previous));
+      if (networkEqual(receipt, previous)) return { status: 'replay', receipt };
+      requireNetwork(receipt.id === previous.id && receipt.generation === previous.generation + 1
+        && networkEqual(receipt.previous, networkReferenceOf(previous))
+        && receipt.protectedAuthority.id === previous.protectedAuthority.id
+        && receipt.protectedAuthority.generation >= previous.protectedAuthority.generation);
+      if (receipt.protectedAuthority.generation === previous.protectedAuthority.generation) {
+        requireNetwork(networkEqual(receipt.protectedAuthority, previous.protectedAuthority));
+      }
+      if (receipt.nativeBarrier && previous.nativeBarrier) {
+        if (receipt.bootId !== previous.bootId || !networkEqual(receipt.protectedAuthority, previous.protectedAuthority)) {
+          requireNetwork(!networkEqual(receipt.nativeBarrier, previous.nativeBarrier));
+        }
+        if (receipt.nativeBarrier.id === previous.nativeBarrier.id) {
+          requireNetwork(receipt.nativeBarrier.generation >= previous.nativeBarrier.generation);
+          if (receipt.nativeBarrier.generation === previous.nativeBarrier.generation) {
+            requireNetwork(networkEqual(receipt.nativeBarrier, previous.nativeBarrier));
+          }
+        }
+      }
+    }
+    return { status: 'accepted', receipt };
+  } catch { return failNetwork(); }
+};
+
+export const snapshotReportRuntimeNetworkProtectionRequestV1 = (value: unknown): IReportRuntimeNetworkProtectionRequestV1 => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['session', 'receipt']);
+  return { session: snapshotRuntimeSessionBindingV1(item.session), receipt: snapshotRuntimeNetworkProtectionReceiptV1(item.receipt) };
+});
+
+/** Both trusted bindings come from the receiver's fenced physical-session/history owner. */
+export const bindReportRuntimeNetworkProtectionRequestV1 = (
+  value: unknown, trustedCurrentSessionValue: unknown, trustedReporterSessionValue: unknown,
+): { request: IReportRuntimeNetworkProtectionRequestV1; authorityUse: 'current' | 'historical' } => networkSafe(() => {
+  const request = snapshotReportRuntimeNetworkProtectionRequestV1(value);
+  const current = snapshotRuntimeSessionBindingV1(captureNetwork(trustedCurrentSessionValue));
+  const reporter = snapshotRuntimeSessionBindingV1(captureNetwork(trustedReporterSessionValue));
+  requireNetwork(networkEqual(request.session, current) && networkEqual(scopeOf(request.receipt), scopeOf(current))
+    && networkEqual(scopeOf(reporter), scopeOf(current)) && reporter.reporterSessionId === request.receipt.reporterSessionId);
+  const authorityUse = reporter.reporterSessionId === current.reporterSessionId ? 'current' : 'historical';
+  requireNetwork(authorityUse === 'current' ? networkEqual(reporter, current)
+    : reporter.sessionEpoch < current.sessionEpoch && reporter.credentialGeneration <= current.credentialGeneration);
+  return { request, authorityUse };
+});
+
+export const snapshotReportRuntimeNetworkProtectionResponseV1 = (value: unknown): IReportRuntimeNetworkProtectionResponseV1 => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['status', 'receipt', 'authorityUse']);
+  requireNetwork((item.status === 'accepted' || item.status === 'replay')
+    && (item.authorityUse === 'current' || item.authorityUse === 'historical'));
+  return { status: item.status, receipt: networkReference(item.receipt), authorityUse: item.authorityUse };
+});
+
+export const bindReportRuntimeNetworkProtectionResponseV1 = (value: unknown, sentReceiptValue: unknown): IReportRuntimeNetworkProtectionResponseV1 => networkSafe(() => {
+  const response = snapshotReportRuntimeNetworkProtectionResponseV1(value);
+  requireNetwork(networkEqual(response.receipt, networkReference(captureNetwork(sentReceiptValue))));
+  return response;
+});
+
+/**
+ * Complete allocation prerequisite, not authentication or a native inspector.
+ * Inputs MUST be the current receiver-persisted receipts and CURRENT durable
+ * sessions, fenced together with protection and lease insertion. Never supply
+ * worker-authored lists or just online peers. Missing/offline/unavailable owners
+ * cannot be omitted. Independent fences need their own verified owning contract;
+ * this helper supplies no generic override, expiry or quorum escape hatch.
+ */
+export const bindRuntimeNetworkAllocationProtectionV1 = async (
+  protectionValue: unknown, receiptsValue: unknown, currentSessionsValue: unknown,
+): Promise<{ protection: IRuntimeNetworkProtectedAuthorityV1; receipts: IRuntimeNetworkProtectionReceiptV1[] }> => {
+  try {
+    const protection = snapshotRuntimeNetworkProtectedAuthorityV1(captureNetwork(protectionValue));
+    const receipts = networkSorted(networkList(captureNetwork(receiptsValue), 256, snapshotRuntimeNetworkProtectionReceiptV1), scopeKey);
+    const sessions = networkSorted(networkList(captureNetwork(currentSessionsValue), 256, snapshotRuntimeSessionBindingV1), scopeKey);
+    requireNetwork(protection.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(protection)
+      && receipts.length === protection.egressAuthorities.length && sessions.length === receipts.length);
+    for (const [index, owner] of protection.egressAuthorities.entries()) {
+      const receipt = receipts[index], session = sessions[index];
+      requireNetwork(scopeKey(receipt) === scopeKey(owner) && scopeKey(session) === scopeKey(owner)
+        && networkEqual(receipt.controller, protection.controller) && networkEqual(session.controller, protection.controller)
+        && receipt.reporterSessionId === session.reporterSessionId && receipt.nativeBarrier !== null
+        && networkEqual(receipt.protectedAuthority, networkReferenceOf(protection))
+        && receipt.digest === await computeRuntimeNetworkProtectionReceiptV1Digest(receipt));
+    }
+    return { protection, receipts };
+  } catch { return failNetwork(); }
+};

package/ts/requests/runtimesession.ts

@@ -2,6 +2,16 @@ import * as plugins from '../plugins.js';
 import type * as data from '../data/runtimesession.js';
 import type * as terminal from '../data/runtimeterminalreceipt.js';
 import type * as network from '../data/networkdelivery.js';
+import type * as protection from '../data/networkprotection.js';
+
+/** Current authenticated peer reports its durable complete native protection journal. */
+export interface IReq_Pallet_Controller_ReportRuntimeNetworkProtectionV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportRuntimeNetworkProtectionV1
+> {
+  method: 'reportRuntimeNetworkProtectionV1';
+  request: protection.IReportRuntimeNetworkProtectionRequestV1;
+  response: protection.IReportRuntimeNetworkProtectionResponseV1;
+}
 
 /** Dedicated signing trust installed only through the current authenticated physical peer. */
 export interface IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthorityV1 extends plugins.typedrequestInterfaces.implementsTR<