@serve.zone/interfaces 31.6.0 → 31.8.0

package/dist_ts/requests/node.d.ts

@@ -150,6 +150,37 @@ export interface IReq_Any_Cloudly_DeleteNodeById extends plugins.typedrequestInt
         ok: boolean;
     };
 }
+/**
+ * An administrator states where one node's Corestore control API answers.
+ *
+ * Corestore is node-local, so one relay serving a whole cluster must be told per node where to
+ * dial; the cluster-local alias every component used while Docker Swarm resolved it is exactly
+ * what stops resolving. The endpoint is control-plane state Cloudly owns and the relay reads,
+ * so an administrator sets it here rather than a relay discovering it.
+ *
+ * Cloudly validates the endpoint with `validateClusterNodeCorestore` before it writes, takes the
+ * node's own real-write fence inside the writing transaction so a concurrent deletion conflicts
+ * instead of leaving an endpoint behind for a node that is gone, and pushes the cluster
+ * configuration afterwards so every connected relay learns the change without reconnecting.
+ *
+ * `endpoint: null` clears it, which is the same fact as never having set one: the node runs no
+ * Corestore the relay may reach, and an inventory for it answers
+ * `errorCode: 'CORESTORE_ENDPOINT_UNKNOWN'` rather than guessing a hostname. The endpoint says
+ * where, never with what — no credential travels in this request or in the node document.
+ */
+export interface IReq_Any_Cloudly_SetClusterNodeCorestoreEndpoint extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_SetClusterNodeCorestoreEndpoint> {
+    method: 'setClusterNodeCorestoreEndpoint';
+    request: {
+        identity: IIdentity;
+        nodeId: string;
+        /** A canonical `http:` or `https:` origin, or `null` to state that this node has none. */
+        endpoint: string | null;
+    };
+    response: {
+        /** The node as it now stands, so a caller needs no second read to see what it set. */
+        node: IClusterNode;
+    };
+}
 export interface IRequest_Spark_Cloudly_SendHeartbeat extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Spark_Cloudly_SendHeartbeat> {
     method: 'sparkNodeHeartbeat';
     request: {

package/dist_ts/requests/runtimesession.d.ts

@@ -28,6 +28,20 @@ export interface IReq_Controller_Pallet_ApplyRuntimeNetworkProjectionV1 extends
     request: network.IApplyRuntimeNetworkProjectionRequestV1;
     response: network.IApplyRuntimeNetworkAuthorityResponseV1;
 }
+/**
+ * A fresh DNS window for the node's exact admitted projection; an ACK asserts admission only.
+ *
+ * The controller sends it while it is reachable. A cluster relay sends the renewals it holds
+ * while it has no controller session, under the binding the node obtained itself, which is why
+ * a node admits it from whoever holds its current connection and trusts only the signature.
+ * Either sender delivers a window once its slot has opened and never before, because a node
+ * refuses a renewal it could not use at once; delivering it again once the slot opens is enough.
+ */
+export interface IReq_Controller_Pallet_ApplyRuntimeNetworkDnsLeaseRenewal extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkDnsLeaseRenewal> {
+    method: 'applyRuntimeNetworkDnsLeaseRenewal';
+    request: network.IApplyRuntimeNetworkDnsLeaseRenewalRequest;
+    response: network.IApplyRuntimeNetworkDnsLeaseRenewalResponse;
+}
 /**
  * WSS-only Pallet bootstrap. Derive physical peer/idempotency server-side; the registering
  * node process is named by `request.nodeInstanceNonce`, because one relay socket may carry

package/dist_ts/runtime.networkprojection.d.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.runtime.js';
 import type { ISignedRuntimeNetworkProjectionV1 } from './data/networksigning.js';
+import type { ISignedRuntimeNetworkDnsLeaseRenewal } from './data/networklease.js';
 /** The private KeyObject is process-local. Persist only through the controller's encrypted secret store. */
 export declare const createRuntimeNetworkSigningKeyV1: () => {
     publicKey: string;
@@ -13,3 +14,16 @@ export declare const signRuntimeNetworkProjectionV1: (projectionValue: unknown,
  * admission, live-session fencing, allocation barriers and conservative DNS time checks.
  */
 export declare const verifyRuntimeNetworkProjectionV1: (value: unknown, trustedAuthorityValue: unknown, trustedScopeValue: unknown) => Promise<ISignedRuntimeNetworkProjectionV1>;
+/** Sign only a validated renewal, with the same authority and key that sign this controller's projections. */
+export declare const signRuntimeNetworkDnsLeaseRenewal: (renewalValue: unknown, authorityValue: unknown, privateKey: plugins.crypto.KeyObject) => Promise<ISignedRuntimeNetworkDnsLeaseRenewal>;
+/**
+ * trustedAuthorityValue is receiver-owned persisted trust, NEVER envelope material, and a relay
+ * that delivers the renewal adds no trust to it. projectionAuthorityValue is the authority
+ * reference that signed the projection this renewal extends, which the receiver kept when it
+ * admitted that projection: a renewal is only ever valid under the exact revision that signed its
+ * projection, so a rotated key renews nothing and DNS still waits for a newly signed projection.
+ * This verifies content, scope and signature only: the owner still admits it against its own
+ * admitted projection with `admitRuntimeNetworkDnsLeaseRenewal`, fences the live session and
+ * converts the window with a qualified clock.
+ */
+export declare const verifyRuntimeNetworkDnsLeaseRenewal: (value: unknown, trustedAuthorityValue: unknown, trustedScopeValue: unknown, projectionAuthorityValue: unknown) => Promise<ISignedRuntimeNetworkDnsLeaseRenewal>;

package/dist_ts/runtime.networkprojection.js

@@ -1,7 +1,8 @@
 import * as plugins from './plugins.runtime.js';
 import { snapshotRuntimeNetworkNodeScopeV1, snapshotRuntimeNetworkProjectionV1, validateRuntimeNetworkProjectionV1 } from './data/networkprojection.js';
 import { computeRuntimeNetworkSigningAuthorityV1Digest, runtimeNetworkSigningV1Contract, snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './data/networksigning.js';
-import { failNetwork, networkCanonical, networkEqual, networkReferenceOf, requireNetwork } from './private/networkcontract.js';
+import { runtimeNetworkDnsLeaseRenewalContract, snapshotRuntimeNetworkDnsLeaseRenewal, snapshotSignedRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './data/networklease.js';
+import { captureNetwork, failNetwork, networkCanonical, networkEqual, networkReference, networkReferenceOf, networkSameScope, requireNetwork } from './private/networkcontract.js';
 /** The private KeyObject is process-local. Persist only through the controller's encrypted secret store. */
 export const createRuntimeNetworkSigningKeyV1 = () => {
     const pair = plugins.crypto.generateKeyPairSync('ed25519');
@@ -9,23 +10,39 @@ export const createRuntimeNetworkSigningKeyV1 = () => {
     requireNetwork(jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && typeof jwk.x === 'string');
     return { publicKey: Buffer.from(jwk.x, 'base64url').toString('hex'), privateKey: pair.privateKey };
 };
-const signatureBytes = (authority, projection) => new TextEncoder().encode(networkCanonical({ domain: runtimeNetworkSigningV1Contract.signatureDomain, schemaVersion: 1, authority, projection }));
-const validateAuthority = async (authority, projection) => {
-    requireNetwork(authority.publicKey !== null && networkEqual(authority.controller, projection.controller)
+const projectionEnvelope = (authority, projection) => ({ domain: runtimeNetworkSigningV1Contract.signatureDomain, schemaVersion: 1, authority, projection });
+const renewalEnvelope = (authority, renewal) => ({ domain: runtimeNetworkDnsLeaseRenewalContract.signatureDomain, authority, renewal });
+const envelopeBytes = (envelope) => new TextEncoder().encode(networkCanonical(envelope));
+/** A revoked revision has no key; any other must be intact and belong to the controller that owns the content. */
+const liveKeyOf = async (authority, contentController) => {
+    const { publicKey } = authority;
+    requireNetwork(publicKey !== null && networkEqual(authority.controller, contentController)
         && authority.digest === await computeRuntimeNetworkSigningAuthorityV1Digest(authority));
+    return publicKey;
+};
+/** Sign as the authority's revision, and only with the private half of its live key. */
+const signAs = async (authority, privateKey, contentController, envelopeOf) => {
+    requireNetwork(privateKey instanceof plugins.crypto.KeyObject && privateKey.type === 'private' && privateKey.asymmetricKeyType === 'ed25519');
+    const derived = plugins.crypto.createPublicKey(privateKey).export({ format: 'jwk' });
+    const publicKey = await liveKeyOf(authority, contentController);
+    requireNetwork(typeof derived.x === 'string' && Buffer.from(derived.x, 'base64url').toString('hex') === publicKey);
+    const reference = networkReferenceOf(authority);
+    return { authority: reference, signature: plugins.crypto.sign(null, envelopeBytes(envelopeOf(reference)), privateKey).toString('hex') };
+};
+/** The receiver's own trusted revision decides; the envelope only names which revision it claims. */
+const requireSignedBy = async (trusted, signed, contentController, envelope) => {
+    requireNetwork(networkEqual(signed.authority, networkReferenceOf(trusted)));
+    const key = plugins.crypto.createPublicKey({ format: 'jwk', key: { kty: 'OKP', crv: 'Ed25519',
+            x: Buffer.from(await liveKeyOf(trusted, contentController), 'hex').toString('base64url') } });
+    requireNetwork(plugins.crypto.verify(null, envelopeBytes(envelope), key, Buffer.from(signed.signature, 'hex')));
 };
 /** Sign only validated complete state and a matching dedicated private key. */
 export const signRuntimeNetworkProjectionV1 = async (projectionValue, authorityValue, privateKey) => {
     try {
         const input = snapshotRuntimeNetworkProjectionV1(projectionValue), authority = snapshotRuntimeNetworkSigningAuthorityV1(authorityValue);
-        requireNetwork(privateKey instanceof plugins.crypto.KeyObject && privateKey.type === 'private' && privateKey.asymmetricKeyType === 'ed25519');
-        const publicKey = plugins.crypto.createPublicKey(privateKey).export({ format: 'jwk' });
-        requireNetwork(typeof publicKey.x === 'string' && Buffer.from(publicKey.x, 'base64url').toString('hex') === authority.publicKey);
         const projection = await validateRuntimeNetworkProjectionV1(input);
-        await validateAuthority(authority, projection);
-        const reference = networkReferenceOf(authority);
-        const signature = plugins.crypto.sign(null, signatureBytes(reference, projection), privateKey).toString('hex');
-        return { schemaVersion: 1, authority: reference, projection, signature };
+        const signed = await signAs(authority, privateKey, projection.controller, reference => projectionEnvelope(reference, projection));
+        return { schemaVersion: 1, authority: signed.authority, projection, signature: signed.signature };
     }
     catch {
         return failNetwork();
@@ -41,13 +58,8 @@ export const verifyRuntimeNetworkProjectionV1 = async (value, trustedAuthorityVa
         const signed = snapshotSignedRuntimeNetworkProjectionV1(value);
         const authority = snapshotRuntimeNetworkSigningAuthorityV1(trustedAuthorityValue);
         const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
-        requireNetwork(networkEqual(signed.authority, networkReferenceOf(authority))
-            && signed.projection.nodeId === trusted.nodeId && signed.projection.runtimeNamespace === trusted.runtimeNamespace
-            && networkEqual(signed.projection.controller, trusted.controller));
-        await validateAuthority(authority, signed.projection);
-        const key = plugins.crypto.createPublicKey({ format: 'jwk', key: { kty: 'OKP', crv: 'Ed25519',
-                x: Buffer.from(authority.publicKey, 'hex').toString('base64url') } });
-        requireNetwork(plugins.crypto.verify(null, signatureBytes(signed.authority, signed.projection), key, Buffer.from(signed.signature, 'hex')));
+        requireNetwork(networkSameScope(signed.projection, trusted));
+        await requireSignedBy(authority, signed, signed.projection.controller, projectionEnvelope(signed.authority, signed.projection));
         await validateRuntimeNetworkProjectionV1(signed.projection);
         return signed;
     }
@@ -55,4 +67,41 @@ export const verifyRuntimeNetworkProjectionV1 = async (value, trustedAuthorityVa
         return failNetwork();
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5uZXR3b3JrcHJvamVjdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUubmV0d29ya3Byb2plY3Rpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxzQkFBc0IsQ0FBQztBQUdoRCxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsa0NBQWtDLEVBQUUsa0NBQWtDLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUV4SixPQUFPLEVBQUUsNkNBQTZDLEVBQUUsK0JBQStCLEVBQ3JGLHdDQUF3QyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDdkgsT0FBTyxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsa0JBQWtCLEVBQUUsY0FBYyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFL0gsNEdBQTRHO0FBQzVHLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEdBQWdFLEVBQUU7SUFDaEgsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3JELGNBQWMsQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLEtBQUssSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDeEYsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7QUFDckcsQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxTQUF1QyxFQUFFLFVBQXVDLEVBQWMsRUFBRSxDQUN0SCxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSwrQkFBK0IsQ0FBQyxlQUFlLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQ25KLE1BQU0saUJBQWlCLEdBQUcsS0FBSyxFQUFFLFNBQTRDLEVBQUUsVUFBdUMsRUFBaUIsRUFBRTtJQUN2SSxjQUFjLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxJQUFJLElBQUksWUFBWSxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQztXQUNuRyxTQUFTLENBQUMsTUFBTSxLQUFLLE1BQU0sNkNBQTZDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztBQUM1RixDQUFDLENBQUM7QUFFRiwrRUFBK0U7QUFDL0UsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsS0FBSyxFQUNqRCxlQUF3QixFQUFFLGNBQXVCLEVBQUUsVUFBb0MsRUFDM0MsRUFBRTtJQUM5QyxJQUFJLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxrQ0FBa0MsQ0FBQyxlQUFlLENBQUMsRUFBRSxTQUFTLEdBQUcsd0NBQXdDLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDeEksY0FBYyxDQUFDLFVBQVUsWUFBWSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVMsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsaUJBQWlCLEtBQUssU0FBUyxDQUFDLENBQUM7UUFDOUksTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDdkYsY0FBYyxDQUFDLE9BQU8sU0FBUyxDQUFDLENBQUMsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsS0FBSyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDakksTUFBTSxVQUFVLEdBQUcsTUFBTSxrQ0FBa0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuRSxNQUFNLGlCQUFpQixDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUMvQyxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoRCxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsY0FBYyxDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsRUFBRSxVQUFVLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0csT0FBTyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLENBQUM7SUFDM0UsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxLQUFLLEVBQ25ELEtBQWMsRUFBRSxxQkFBOEIsRUFBRSxpQkFBMEIsRUFDOUIsRUFBRTtJQUM5QyxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyx3Q0FBd0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvRCxNQUFNLFNBQVMsR0FBRyx3Q0FBd0MsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ2xGLE1BQU0sT0FBTyxHQUFHLGlDQUFpQyxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDckUsY0FBYyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxDQUFDO2VBQ3ZFLE1BQU0sQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxPQUFPLENBQUMsZ0JBQWdCO2VBQzlHLFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUNyRSxNQUFNLGlCQUFpQixDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDdEQsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLFNBQVM7Z0JBQzNGLENBQUMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFVLEVBQUUsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3pFLGNBQWMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsY0FBYyxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzVJLE1BQU0sa0NBQWtDLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzVELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUMifQ==
+/** Sign only a validated renewal, with the same authority and key that sign this controller's projections. */
+export const signRuntimeNetworkDnsLeaseRenewal = async (renewalValue, authorityValue, privateKey) => {
+    try {
+        const input = snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue), authority = snapshotRuntimeNetworkSigningAuthorityV1(authorityValue);
+        const renewal = await validateRuntimeNetworkDnsLeaseRenewal(input);
+        const signed = await signAs(authority, privateKey, renewal.controller, reference => renewalEnvelope(reference, renewal));
+        return { authority: signed.authority, renewal, signature: signed.signature };
+    }
+    catch {
+        return failNetwork();
+    }
+};
+/**
+ * trustedAuthorityValue is receiver-owned persisted trust, NEVER envelope material, and a relay
+ * that delivers the renewal adds no trust to it. projectionAuthorityValue is the authority
+ * reference that signed the projection this renewal extends, which the receiver kept when it
+ * admitted that projection: a renewal is only ever valid under the exact revision that signed its
+ * projection, so a rotated key renews nothing and DNS still waits for a newly signed projection.
+ * This verifies content, scope and signature only: the owner still admits it against its own
+ * admitted projection with `admitRuntimeNetworkDnsLeaseRenewal`, fences the live session and
+ * converts the window with a qualified clock.
+ */
+export const verifyRuntimeNetworkDnsLeaseRenewal = async (value, trustedAuthorityValue, trustedScopeValue, projectionAuthorityValue) => {
+    try {
+        const signed = snapshotSignedRuntimeNetworkDnsLeaseRenewal(value);
+        const authority = snapshotRuntimeNetworkSigningAuthorityV1(trustedAuthorityValue);
+        const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
+        const projectionAuthority = networkReference(captureNetwork(projectionAuthorityValue));
+        requireNetwork(networkSameScope(signed.renewal, trusted) && networkEqual(signed.authority, projectionAuthority));
+        await requireSignedBy(authority, signed, signed.renewal.controller, renewalEnvelope(signed.authority, signed.renewal));
+        await validateRuntimeNetworkDnsLeaseRenewal(signed.renewal);
+        return signed;
+    }
+    catch {
+        return failNetwork();
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5uZXR3b3JrcHJvamVjdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUubmV0d29ya3Byb2plY3Rpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxzQkFBc0IsQ0FBQztBQUdoRCxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsa0NBQWtDLEVBQUUsa0NBQWtDLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUV4SixPQUFPLEVBQUUsNkNBQTZDLEVBQUUsK0JBQStCLEVBQ3JGLHdDQUF3QyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFFdkgsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLHFDQUFxQyxFQUNuRiwyQ0FBMkMsRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ3JILE9BQU8sRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFDeEcsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFekUsNEdBQTRHO0FBQzVHLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEdBQWdFLEVBQUU7SUFDaEgsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3JELGNBQWMsQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLEtBQUssSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDeEYsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7QUFDckcsQ0FBQyxDQUFDO0FBUUYsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFNBQXVDLEVBQUUsVUFBdUMsRUFBRSxFQUFFLENBQzlHLENBQUMsRUFBRSxNQUFNLEVBQUUsK0JBQStCLENBQUMsZUFBZSxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7QUFDekcsTUFBTSxlQUFlLEdBQUcsQ0FBQyxTQUF1QyxFQUFFLE9BQXVDLEVBQUUsRUFBRSxDQUMzRyxDQUFDLEVBQUUsTUFBTSxFQUFFLHFDQUFxQyxDQUFDLGVBQWUsRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztBQUMxRixNQUFNLGFBQWEsR0FBRyxDQUFDLFFBQWdCLEVBQWMsRUFBRSxDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFN0csa0hBQWtIO0FBQ2xILE1BQU0sU0FBUyxHQUFHLEtBQUssRUFBRSxTQUE0QyxFQUFFLGlCQUF1QyxFQUFtQixFQUFFO0lBQ2pJLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxTQUFTLENBQUM7SUFDaEMsY0FBYyxDQUFDLFNBQVMsS0FBSyxJQUFJLElBQUksWUFBWSxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsaUJBQWlCLENBQUM7V0FDckYsU0FBUyxDQUFDLE1BQU0sS0FBSyxNQUFNLDZDQUE2QyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7SUFDMUYsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sTUFBTSxHQUFHLEtBQUssRUFDbEIsU0FBNEMsRUFBRSxVQUFvQyxFQUFFLGlCQUF1QyxFQUMzSCxVQUErRCxFQUNqQyxFQUFFO0lBQ2hDLGNBQWMsQ0FBQyxVQUFVLFlBQVksT0FBTyxDQUFDLE1BQU0sQ0FBQyxTQUFTLElBQUksVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTLElBQUksVUFBVSxDQUFDLGlCQUFpQixLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQzlJLE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3JGLE1BQU0sU0FBUyxHQUFHLE1BQU0sU0FBUyxDQUFDLFNBQVMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2hFLGNBQWMsQ0FBQyxPQUFPLE9BQU8sQ0FBQyxDQUFDLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsRUFBRSxXQUFXLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDbkgsTUFBTSxTQUFTLEdBQUcsa0JBQWtCLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEQsT0FBTyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxhQUFhLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDMUksQ0FBQyxDQUFDO0FBRUYscUdBQXFHO0FBQ3JHLE1BQU0sZUFBZSxHQUFHLEtBQUssRUFDM0IsT0FBMEMsRUFBRSxNQUEyQixFQUFFLGlCQUF1QyxFQUFFLFFBQWdCLEVBQ25ILEVBQUU7SUFDakIsY0FBYyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RSxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsU0FBUztZQUMzRixDQUFDLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLFNBQVMsQ0FBQyxPQUFPLEVBQUUsaUJBQWlCLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDaEcsY0FBYyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxhQUFhLENBQUMsUUFBUSxDQUFDLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDbEgsQ0FBQyxDQUFDO0FBRUYsK0VBQStFO0FBQy9FLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsZUFBd0IsRUFBRSxjQUF1QixFQUFFLFVBQW9DLEVBQzNDLEVBQUU7SUFDOUMsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsa0NBQWtDLENBQUMsZUFBZSxDQUFDLEVBQUUsU0FBUyxHQUFHLHdDQUF3QyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ3hJLE1BQU0sVUFBVSxHQUFHLE1BQU0sa0NBQWtDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbkUsTUFBTSxNQUFNLEdBQUcsTUFBTSxNQUFNLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUMsa0JBQWtCLENBQUMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDbEksT0FBTyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDcEcsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxLQUFLLEVBQ25ELEtBQWMsRUFBRSxxQkFBOEIsRUFBRSxpQkFBMEIsRUFDOUIsRUFBRTtJQUM5QyxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyx3Q0FBd0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvRCxNQUFNLFNBQVMsR0FBRyx3Q0FBd0MsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ2xGLE1BQU0sT0FBTyxHQUFHLGlDQUFpQyxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDckUsY0FBYyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM3RCxNQUFNLGVBQWUsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDaEksTUFBTSxrQ0FBa0MsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDNUQsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGLDhHQUE4RztBQUM5RyxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxLQUFLLEVBQ3BELFlBQXFCLEVBQUUsY0FBdUIsRUFBRSxVQUFvQyxFQUNyQyxFQUFFO0lBQ2pELElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxFQUFFLFNBQVMsR0FBRyx3Q0FBd0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUN4SSxNQUFNLE9BQU8sR0FBRyxNQUFNLHFDQUFxQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25FLE1BQU0sTUFBTSxHQUFHLE1BQU0sTUFBTSxDQUFDLFNBQVMsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVUsRUFBRSxTQUFTLENBQUMsRUFBRSxDQUFDLGVBQWUsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUN6SCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDL0UsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLEtBQUssRUFDdEQsS0FBYyxFQUFFLHFCQUE4QixFQUFFLGlCQUEwQixFQUFFLHdCQUFpQyxFQUM5RCxFQUFFO0lBQ2pELElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLDJDQUEyQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sU0FBUyxHQUFHLHdDQUF3QyxDQUFDLHFCQUFxQixDQUFDLENBQUM7UUFDbEYsTUFBTSxPQUFPLEdBQUcsaUNBQWlDLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNyRSxNQUFNLG1CQUFtQixHQUFHLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDLENBQUM7UUFDdkYsY0FBYyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUksWUFBWSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsbUJBQW1CLENBQUMsQ0FBQyxDQUFDO1FBQ2pILE1BQU0sZUFBZSxDQUFDLFNBQVMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsZUFBZSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDdkgsTUFBTSxxQ0FBcUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDNUQsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "31.6.0",
+  "version": "31.8.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -31,7 +31,7 @@
     "@git.zone/tsdoc": "^2.2.0",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "6.1.1",
-    "@types/node": "26.5.0"
+    "@types/node": "26.5.1"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -371,7 +371,8 @@ set. An empty array declares NODATA; absent/unauthorized names remain NXDOMAIN,
 and IPv4-only service names have AAAA NODATA. The view carries the existing
 forwarding intersection and zero or one search suffix. Pallet must prove the
 actual sandbox/veth/source binding, block private/bare-name forwarding, clip
-TTLs and convert the absolute window using its qualified boot/time authority.
+TTLs and convert the effective window from `getRuntimeNetworkEffectiveDnsWindow` (see
+[DNS Lease Renewals](#dns-lease-renewals)) using its qualified boot/time authority.
 These helpers neither cache queries nor renew a lease.
 
 The DNS composer accepts an optional second argument of exact local workload
@@ -454,10 +455,11 @@ capture closed detached JSON shapes and canonical 32-byte key encodings.
 `bindGetRuntimeManagedVpnCredentialRequestV1(request, projection, trustedSession)`
 validates the complete projection digest and binds node, controller, namespace,
 physical-session identity and projection reference. The response binder takes
-`(response, request, projection, trustedSession, now)` and additionally requires
+`(response, request, projection, trustedSession, now, renewal = null)` and additionally requires
 the relay's exact UDP tuple to be selected in `router.platformEndpointIds`.
 Expiry must be after the caller-qualified time and no later than the referenced
-projection's DNS lease; acceptance before that lease starts rejects.
+projection's effective DNS window (see [DNS Lease Renewals](#dns-lease-renewals));
+acceptance before that window starts rejects.
 
 These helpers perform content validation. Callers authenticate and fence the
 current physical peer and projection before and after native work, qualify time
@@ -466,6 +468,132 @@ Noise implementation owns cryptographic validation and authentication. Credentia
 delivery does not prove a connected VPN, TUN ownership, packet enforcement or
 workload readiness, and does not replace explicit packet withdrawals.
 
+### DNS Lease Renewals
+
+A projection's `dns` window lasts at most fifteen minutes and is signed content, so a node's
+private DNS stops when the window ends unless a newer signed statement extends it. Re-issuing the
+projection would extend it too, but a node applies every new projection as new network state,
+which restarts its data plane. `IRuntimeNetworkDnsLeaseRenewal` extends the window and nothing
+else: it carries the node scope (`controller`, `nodeId`, `runtimeNamespace`), the exact
+`projection` reference it renews, a `sequence`, a fresh `dns { issuedAt, notBefore, expiresAt }`
+window and its `digest`. It names the projection by reference, so it never joins the projection
+chain and never changes what the node applied. The new shapes carry no `schemaVersion` and no
+version suffix; the installed package version is the protocol version.
+
+`issuedAt` is the start of the window's slot, not the moment of signing: Cloudly signs renewals
+ahead of time on a grid, so the fifteen-minute rule (`maximumDnsLeaseMs`, the same limit a
+projection's window has) is measured from the slot. `computeRuntimeNetworkDnsLeaseRenewalDigest`
+hashes every field except `digest` under its own domain, and `validateRuntimeNetworkDnsLeaseRenewal`
+checks structure and digest only; a digest authenticates nothing.
+
+The Node-only `@serve.zone/interfaces/runtime` export signs and verifies renewals with the same
+authority and key that sign the controller's projections, under a separate signature domain.
+`signRuntimeNetworkDnsLeaseRenewal(renewal, authority, privateKey)` produces
+`ISignedRuntimeNetworkDnsLeaseRenewal { authority, renewal, signature }`.
+`verifyRuntimeNetworkDnsLeaseRenewal(signed, trustedAuthority, trustedScope, projectionAuthority)`
+takes the authority and scope from the node's own stored trust, never from the envelope.
+`projectionAuthority` is the reference of the authority revision that signed the projection the
+node admitted, and a renewal verifies only when it was signed under exactly that revision.
+Rotation and revocation end renewals exactly as they end projections: nothing signed under an
+earlier revision verifies after, and a renewal signed under a rotated revision does not renew a
+projection signed under the one before. A renewal never closes a key gap; after rotation, DNS
+continues only with a newly signed projection.
+
+`admitRuntimeNetworkDnsLeaseRenewal(renewal, currentProjection, previousRenewal | null, trustedScope, now)`
+is the pure admission decision after verification. The projection and the previous renewal are
+the node's own admitted state, and `now` is its caller-qualified clock, read before the first
+await like every other input. It admits a renewal only when:
+
+- the renewal and the projection are in the trusted scope, and the renewal names the current
+  projection's exact reference. Once a successor projection is admitted, every renewal of its
+  predecessor is refused, and a renewal never introduces a projection the node has not admitted;
+- its `sequence` is higher than the previous renewal's, with gaps allowed, or equal with
+  byte-identical content, which is answered as `replay` whatever `now` is, so re-delivery is
+  idempotent. The same sequence with any other content is refused;
+- its window is current: `notBefore <= now < expiresAt`. Admitting a window that has not opened
+  would displace the coverage the node has now, so a sender delivers a window only once its slot
+  has opened; a renewal refused for arriving early is simply delivered again once it has. An
+  expired window is refused as well;
+- its window does not move `issuedAt` back and ends later than the previous window. Without a
+  previous renewal, the projection's own window is the baseline. Windows need not touch, so a node
+  whose lease lapsed can still admit the next renewal it is given.
+
+The caller stores the admitted renewal in the same transaction as its trust fence, and deletes it
+in the transaction that admits a successor projection. Admission is not conversion: the node still
+turns the window into a deadline with its qualified clock, and must not use a window before its
+`notBefore`.
+
+`requests.runtimesession.IReq_Controller_Pallet_ApplyRuntimeNetworkDnsLeaseRenewal`
+(`applyRuntimeNetworkDnsLeaseRenewal`) delivers one renewal as
+`IApplyRuntimeNetworkDnsLeaseRenewalRequest { session, signed }`.
+`bindApplyRuntimeNetworkDnsLeaseRenewalRequest(request, trustedSession)` requires the node's
+current physical-session binding and a renewal in that session's scope. It does not care who sent
+the request: a cluster relay pushes under the binding the node obtained itself. The answer,
+`IApplyRuntimeNetworkDnsLeaseRenewalResponse { status, renewal }`, repeats
+`IRuntimeNetworkDnsLeaseRenewalReference { projection, sequence, digest }`.
+`bindApplyRuntimeNetworkDnsLeaseRenewalResponse(response, sentRenewal)` compares it with the exact
+renewal that was sent. The ACK asserts durable admission only, not that the node serves DNS.
+
+A cluster is outbound-only, so while its relay cannot reach Cloudly nobody can sign a new window.
+Cloudly therefore hands the elected relay a run of renewals it signed ahead of time, with
+`requests.cluster.IReq_Cloudly_Relay_HoldRuntimeNetworkDnsLeaseRenewals`
+(`holdRuntimeNetworkDnsLeaseRenewals`):
+`IHoldRuntimeNetworkDnsLeaseRenewalsRequest { nodeId, projection, renewals }` answered by
+`{ held }`. Each request replaces what the relay held for that node, and an empty run holds
+nothing. The relay keeps the run in memory only, pushes only the renewal whose window is current
+and only while it has no Cloudly session (`escrowRelease`), and holds no key and no trust.
+`snapshotHoldRuntimeNetworkDnsLeaseRenewalsRequest` checks the rules a relay can evaluate without
+the projection itself; the node still measures the first window against its admitted projection,
+and every window against its clock, when it admits it. The run must have:
+
+- one node, one projection and one signing authority revision, in one scope;
+- strictly ascending sequences, each window extending the one before;
+- at most `maximumEscrowedRenewals` (32) renewals;
+- at most `maximumEscrowHorizonMs` (four hours) from the first window's `issuedAt` to the last
+  window's `expiresAt`. On the intended grid of fifteen-minute windows every ten minutes, the
+  horizon allows 23 windows, so it is the limit that binds.
+
+`validateHoldRuntimeNetworkDnsLeaseRenewalsRequest` adds every renewal's digest check and
+verifies no signature. `bindHoldRuntimeNetworkDnsLeaseRenewalsResponse(response, sentRequest)`
+requires `held` to equal the number of renewals sent.
+
+The horizon is also the revocation latency: a detached cluster keeps DNS authority until its last
+held window ends. So a controller must not release an address or a DNS name before the latest
+`expiresAt` it has signed for that node. Renewals extend DNS only. They grant no packet authority
+and cannot introduce new network state, and they do not extend an already-issued VPN credential;
+a newly issued one may be bound to the renewed window.
+
+`getRuntimeNetworkEffectiveDnsWindow(projection, renewal | null)` is the one rule for the window a
+node may use: the admitted renewal's if there is one, else the projection's own. `renewal` is the
+bare `IRuntimeNetworkDnsLeaseRenewal` that admission takes and returns, which is what a node
+stores; Cloudly passes `signed.renewal`. It checks digests and that the renewal names exactly that
+projection, but verifies no signature. Controller and node use it for every limit tied to the
+window, and `bindGetRuntimeManagedVpnCredentialResponseV1` takes the same bare admitted renewal as
+an optional last argument, so a newly issued managed-VPN credential may run to the end of the
+renewed window instead of the projection's original one.
+
+```typescript
+import { data } from '@serve.zone/interfaces';
+import { signRuntimeNetworkDnsLeaseRenewal, verifyRuntimeNetworkDnsLeaseRenewal } from '@serve.zone/interfaces/runtime';
+
+const renewal: data.IRuntimeNetworkDnsLeaseRenewal = {
+  ...scope,
+  projection: { id: projection.id, generation: projection.generation, digest: projection.digest },
+  sequence: 1,
+  dns: { issuedAt: slotStart, notBefore: slotStart, expiresAt: slotStart + 900_000 },
+  digest: `sha256:${'0'.repeat(64)}` as data.TSha256Digest, // well-formed placeholder, replaced below
+};
+renewal.digest = await data.computeRuntimeNetworkDnsLeaseRenewalDigest(renewal);
+const signed = await signRuntimeNetworkDnsLeaseRenewal(renewal, signingAuthority, privateKey);
+
+// On the node: stored trust, then the node's own admitted state and qualified clock.
+const verified = await verifyRuntimeNetworkDnsLeaseRenewal(
+  signed, storedAuthority, nodeScope, admittedProjectionAuthority);
+const { renewal: admittedRenewal } = await data.admitRuntimeNetworkDnsLeaseRenewal(
+  verified.renewal, admittedProjection, previousRenewal, nodeScope, qualifiedNow);
+const window = await data.getRuntimeNetworkEffectiveDnsWindow(admittedProjection, admittedRenewal);
+```
+
 ### Node-Bound Runtime Assignments
 
 The `data` namespace exports `IRuntimeAssignmentV1`, canonical digest helpers,
@@ -1118,6 +1246,8 @@ answers with the block Cloudly published, and `disableClusterRelayV1` removes it
 an explicit `relay: null`. The caller names only the cluster: Cloudly derives the origin itself
 from that cluster and its own public hostname, and refuses the request when no DNS zone it
 manages matches the derived name, so a relay name that nothing can publish is never written.
+Both requests push the cluster configuration to the connected relay afterwards, so a relay learns
+the change without reconnecting.
 
 Once its socket is authenticated with `registerCloudlyClientSessionV1`, the relay sends
 `registerClusterRelayV1` carrying `IClusterRelayRegistrationV1`: the relay build, the cluster node
@@ -1828,6 +1958,17 @@ is admitted so putting TLS in front of Corestore needs no contract change. Absen
 runs no Corestore the relay may reach, which an inventory reports as
 `errorCode: 'CORESTORE_ENDPOINT_UNKNOWN'` rather than guessing a hostname.
 
+An administrator sets it with `setClusterNodeCorestoreEndpoint { identity; nodeId; endpoint }`,
+answered by Cloudly with the node as it now stands. Cloudly validates the endpoint with
+`validateClusterNodeCorestore` before it writes, takes the node's own real-write fence inside the
+writing transaction so a concurrent deletion conflicts instead of leaving an endpoint behind for a
+node that is gone, and pushes the cluster configuration afterwards so every connected relay learns
+the change without reconnecting — the same push that
+[the cluster relay block](#cluster-relay-block) uses when an operator enables or disables a relay.
+`endpoint: null` clears it, which states the same fact as never having set one. There is no
+node-wide update request: one field with one validator cannot drift into a generic node mutation
+whose per-field authority nobody defined.
+
 The endpoint says where, never with what. The bearer control token that authorizes every call is
 obtained from Cloudly through `getCorestoreControlCredentialMaterial`, sealed to the X25519
 recipient the relay enrolled with `beginSecretRecipientEnrollment` and

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '31.6.0',
+  version: '31.8.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -27,6 +27,7 @@ export * from './nodeenrollment.js';
 export * from './networkauthority.js';
 export * from './networkcredential.js';
 export * from './networkdelivery.js';
+export * from './networklease.js';
 export * from './networkprojection.js';
 export type { IRuntimeNetworkRouterPacketGrantV1, IRuntimeNetworkRouterProjectionV1 } from './networkrouter.js';
 export * from './networkprotection.js';

package/ts/data/networkcredential.ts

@@ -1,8 +1,9 @@
 import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
 import { snapshotRuntimeSessionBindingV1, type IRuntimeSessionBindingV1 } from './runtimesession.js';
 import { validateRuntimeNetworkProjectionV1, type IRuntimeNetworkProjectionV1 } from './networkprojection.js';
-import { captureNetwork, failNetwork, networkCounter, networkEqual, networkId, networkIpv4,
-  networkRecord, networkReference, networkReferenceOf, networkSafe, requireNetwork } from '../private/networkcontract.js';
+import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
+import { captureNetwork, failNetwork, networkCounter, networkEffectiveDnsWindow, networkEqual, networkId, networkIpv4,
+  networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
 
 export interface IGetRuntimeManagedVpnCredentialRequestV1 {
   session: IRuntimeSessionBindingV1;
@@ -19,7 +20,10 @@ export interface IGetRuntimeManagedVpnCredentialResponseV1 extends IGetRuntimeMa
   serverPublicKey: string;
   clientPublicKey: string;
   clientPrivateKey: string;
-  /** Unix milliseconds; cannot outlive the referenced projection's DNS lease. */
+  /**
+   * Unix milliseconds; cannot outlive the referenced projection's effective DNS window: its
+   * admitted lease renewal's, else its own.
+   */
   expiresAt: number;
 }
 
@@ -50,8 +54,7 @@ export const snapshotGetRuntimeManagedVpnCredentialResponseV1 = (value: unknown)
 const bindRequest = (request: IGetRuntimeManagedVpnCredentialRequestV1,
   projection: IRuntimeNetworkProjectionV1, trusted: IRuntimeSessionBindingV1): void => {
   requireNetwork(networkEqual(request.session, trusted) && networkEqual(request.projection, networkReferenceOf(projection))
-    && networkEqual(projection.controller, trusted.controller) && projection.nodeId === trusted.nodeId
-    && projection.runtimeNamespace === trusted.runtimeNamespace && projection.handoff);
+    && networkSameScope(projection, trusted) && projection.handoff);
 };
 
 /** Content binding only. The caller must resolve the exact current projection
@@ -68,21 +71,28 @@ export const bindGetRuntimeManagedVpnCredentialRequestV1 = async (value: unknown
 };
 
 /** Bind the secret response to the original request and exact selected router
- * UDP endpoint. Time is caller-qualified; this helper does not sample a clock,
- * authenticate a transport, admit policy or prove a running managed connection. */
+ * UDP endpoint, inside the projection's effective DNS window. renewalValue is the
+ * bare lease renewal the caller already verified and admitted for this exact
+ * projection, or null; this helper verifies no signature. Time is caller-qualified;
+ * this helper does not sample a clock, authenticate a transport, admit policy or
+ * prove a running managed connection. */
 export const bindGetRuntimeManagedVpnCredentialResponseV1 = async (value: unknown, requestValue: unknown,
-  projectionValue: unknown, trustedSessionValue: unknown, nowValue: unknown): Promise<IGetRuntimeManagedVpnCredentialResponseV1> => {
+  projectionValue: unknown, trustedSessionValue: unknown, nowValue: unknown,
+  renewalValue: unknown | null = null): Promise<IGetRuntimeManagedVpnCredentialResponseV1> => {
   try {
     const response = snapshotGetRuntimeManagedVpnCredentialResponseV1(value);
     const request = snapshotGetRuntimeManagedVpnCredentialRequestV1(requestValue);
     const trusted = snapshotRuntimeSessionBindingV1(trustedSessionValue), now = networkCounter(nowValue);
+    const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
     const projection = await validateRuntimeNetworkProjectionV1(projectionValue);
+    const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
+    const window = networkEffectiveDnsWindow(projection, renewal);
     bindRequest(request, projection, trusted);
     requireNetwork(networkEqual(response.session, request.session) && networkEqual(response.projection, request.projection));
     requireNetwork(projection.router?.platformEndpointIds.includes(response.relay.id));
     const endpoint = projection.protectedAuthority.platformEndpoints.find(item => item.id === response.relay.id);
     requireNetwork(endpoint && endpoint.protocol === 'udp' && endpoint.address === response.relay.address && endpoint.port === response.relay.port);
-    requireNetwork(projection.dns.notBefore <= now && now < response.expiresAt && response.expiresAt <= projection.dns.expiresAt);
+    requireNetwork(window.notBefore <= now && now < response.expiresAt && response.expiresAt <= window.expiresAt);
     return response;
   } catch { return failNetwork(); }
 };

package/ts/data/networkdelivery.ts

@@ -3,7 +3,11 @@ import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
 import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
 import type { IRuntimeNetworkSigningAuthorityV1, ISignedRuntimeNetworkProjectionV1 } from './networksigning.js';
 import { snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './networksigning.js';
-import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe, requireNetwork } from '../private/networkcontract.js';
+import type { IRuntimeNetworkDnsLeaseRenewalReference, ISignedRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
+import { getRuntimeNetworkDnsLeaseRenewalReference, snapshotRuntimeNetworkDnsLeaseRenewal,
+  snapshotRuntimeNetworkDnsLeaseRenewalReference, snapshotSignedRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
+import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope,
+  requireNetwork } from '../private/networkcontract.js';
 
 export interface IApplyRuntimeNetworkSigningAuthorityRequestV1 {
   session: IRuntimeSessionBindingV1;
@@ -18,6 +22,19 @@ export interface IApplyRuntimeNetworkAuthorityResponseV1 {
   status: 'accepted' | 'replay';
   authority: IRuntimeAuthorityReferenceV1;
 }
+export interface IApplyRuntimeNetworkDnsLeaseRenewalRequest {
+  session: IRuntimeSessionBindingV1;
+  signed: ISignedRuntimeNetworkDnsLeaseRenewal;
+}
+/** Durable admission only. It does not assert that the node converted the window or serves DNS. */
+export interface IApplyRuntimeNetworkDnsLeaseRenewalResponse {
+  status: 'accepted' | 'replay';
+  renewal: IRuntimeNetworkDnsLeaseRenewalReference;
+}
+
+const admissionStatus = (value: unknown): 'accepted' | 'replay' => {
+  requireNetwork(value === 'accepted' || value === 'replay'); return value;
+};
 
 export const snapshotApplyRuntimeNetworkSigningAuthorityRequestV1 = (value: unknown): IApplyRuntimeNetworkSigningAuthorityRequestV1 => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'authority']);
@@ -29,8 +46,16 @@ export const snapshotApplyRuntimeNetworkProjectionRequestV1 = (value: unknown):
 });
 export const snapshotApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown): IApplyRuntimeNetworkAuthorityResponseV1 => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['status', 'authority']);
-  requireNetwork(item.status === 'accepted' || item.status === 'replay');
-  return { status: item.status, authority: networkReference(item.authority) };
+  return { status: admissionStatus(item.status), authority: networkReference(item.authority) };
+});
+
+export const snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest = (value: unknown): IApplyRuntimeNetworkDnsLeaseRenewalRequest => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['session', 'signed']);
+  return { session: snapshotRuntimeSessionBindingV1(item.session), signed: snapshotSignedRuntimeNetworkDnsLeaseRenewal(item.signed) };
+});
+export const snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse = (value: unknown): IApplyRuntimeNetworkDnsLeaseRenewalResponse => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['status', 'renewal']);
+  return { status: admissionStatus(item.status), renewal: snapshotRuntimeNetworkDnsLeaseRenewalReference(item.renewal) };
 });
 
 /** trustedSessionValue must come from the receiving CURRENT physical connection. */
@@ -43,9 +68,7 @@ export const bindApplyRuntimeNetworkSigningAuthorityRequestV1 = (value: unknown,
 /** Content binding only. Verify signature with stored trust and atomically fence admission. */
 export const bindApplyRuntimeNetworkProjectionRequestV1 = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkProjectionRequestV1 => networkSafe(() => {
   const request = snapshotApplyRuntimeNetworkProjectionRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
-  const projection = request.signed.projection;
-  requireNetwork(networkEqual(request.session, session) && networkEqual(projection.controller, session.controller)
-    && projection.nodeId === session.nodeId && projection.runtimeNamespace === session.runtimeNamespace);
+  requireNetwork(networkEqual(request.session, session) && networkSameScope(request.signed.projection, session));
   return request;
 });
 
@@ -56,3 +79,23 @@ export const bindApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown, sentR
   requireNetwork(networkEqual(response.authority, networkReferenceOf(expected)));
   return response;
 });
+
+/**
+ * Content binding only; trustedSessionValue must come from the receiving CURRENT physical
+ * connection. A relay pushes a held renewal under the binding the node obtained itself, so this
+ * comparison is what makes the push admissible, never who sent it. Verify the signature with
+ * stored trust, then admit and fence atomically.
+ */
+export const bindApplyRuntimeNetworkDnsLeaseRenewalRequest = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkDnsLeaseRenewalRequest => networkSafe(() => {
+  const request = snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+  requireNetwork(networkEqual(request.session, session) && networkSameScope(request.signed.renewal, session));
+  return request;
+});
+
+/** Compare the ACK with the exact SENT renewal, never with a response-derived value. */
+export const bindApplyRuntimeNetworkDnsLeaseRenewalResponse = (value: unknown, sentRenewalValue: unknown): IApplyRuntimeNetworkDnsLeaseRenewalResponse => networkSafe(() => {
+  const response = snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse(value);
+  const sent = getRuntimeNetworkDnsLeaseRenewalReference(snapshotRuntimeNetworkDnsLeaseRenewal(sentRenewalValue));
+  requireNetwork(networkEqual(response.renewal, sent));
+  return response;
+});