@serve.zone/interfaces 31.7.0 → 31.9.0

package/dist_ts/data/networkcredential.js

@@ -1,6 +1,7 @@
 import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
 import { validateRuntimeNetworkProjectionV1 } from './networkprojection.js';
-import { captureNetwork, failNetwork, networkCounter, networkEqual, networkId, networkIpv4, networkRecord, networkReference, networkReferenceOf, networkSafe, requireNetwork } from '../private/networkcontract.js';
+import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
+import { captureNetwork, failNetwork, networkCounter, networkEffectiveDnsWindow, networkEqual, networkId, networkIpv4, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
 /** Canonical 32-byte key encoding only. Cryptographic key agreement and pair
  * validation belong to the native Noise implementation, not this JSON parser. */
 const key = (value) => {
@@ -25,8 +26,7 @@ export const snapshotGetRuntimeManagedVpnCredentialResponseV1 = (value) => netwo
 });
 const bindRequest = (request, projection, trusted) => {
     requireNetwork(networkEqual(request.session, trusted) && networkEqual(request.projection, networkReferenceOf(projection))
-        && networkEqual(projection.controller, trusted.controller) && projection.nodeId === trusted.nodeId
-        && projection.runtimeNamespace === trusted.runtimeNamespace && projection.handoff);
+        && networkSameScope(projection, trusted) && projection.handoff);
 };
 /** Content binding only. The caller must resolve the exact current projection
  * and authenticate/fence the current physical peer before and after native work. */
@@ -43,24 +43,30 @@ export const bindGetRuntimeManagedVpnCredentialRequestV1 = async (value, project
     }
 };
 /** Bind the secret response to the original request and exact selected router
- * UDP endpoint. Time is caller-qualified; this helper does not sample a clock,
- * authenticate a transport, admit policy or prove a running managed connection. */
-export const bindGetRuntimeManagedVpnCredentialResponseV1 = async (value, requestValue, projectionValue, trustedSessionValue, nowValue) => {
+ * UDP endpoint, inside the projection's effective DNS window. renewalValue is the
+ * bare lease renewal the caller already verified and admitted for this exact
+ * projection, or null; this helper verifies no signature. Time is caller-qualified;
+ * this helper does not sample a clock, authenticate a transport, admit policy or
+ * prove a running managed connection. */
+export const bindGetRuntimeManagedVpnCredentialResponseV1 = async (value, requestValue, projectionValue, trustedSessionValue, nowValue, renewalValue = null) => {
     try {
         const response = snapshotGetRuntimeManagedVpnCredentialResponseV1(value);
         const request = snapshotGetRuntimeManagedVpnCredentialRequestV1(requestValue);
         const trusted = snapshotRuntimeSessionBindingV1(trustedSessionValue), now = networkCounter(nowValue);
+        const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
         const projection = await validateRuntimeNetworkProjectionV1(projectionValue);
+        const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
+        const window = networkEffectiveDnsWindow(projection, renewal);
         bindRequest(request, projection, trusted);
         requireNetwork(networkEqual(response.session, request.session) && networkEqual(response.projection, request.projection));
         requireNetwork(projection.router?.platformEndpointIds.includes(response.relay.id));
         const endpoint = projection.protectedAuthority.platformEndpoints.find(item => item.id === response.relay.id);
         requireNetwork(endpoint && endpoint.protocol === 'udp' && endpoint.address === response.relay.address && endpoint.port === response.relay.port);
-        requireNetwork(projection.dns.notBefore <= now && now < response.expiresAt && response.expiresAt <= projection.dns.expiresAt);
+        requireNetwork(window.notBefore <= now && now < response.expiresAt && response.expiresAt <= window.expiresAt);
         return response;
     }
     catch {
         return failNetwork();
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSwrQkFBK0IsRUFBaUMsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRyxPQUFPLEVBQUUsa0NBQWtDLEVBQW9DLE1BQU0sd0JBQXdCLENBQUM7QUFDOUcsT0FBTyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUN4RixhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBcUIxSDtpRkFDaUY7QUFDakYsTUFBTSxHQUFHLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUNyQyxjQUFjLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2hGLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM1QixjQUFjLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxFQUFFLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEtBQUssSUFBSSxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hILE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsQ0FBQyxLQUFjLEVBQTRDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQzVJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM3RSxPQUFPLEVBQUUsT0FBTyxFQUFFLCtCQUErQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDbkgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSxnREFBZ0QsR0FBRyxDQUFDLEtBQWMsRUFBNkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDOUksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxhQUFhO1FBQzdHLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDMUUsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsQ0FBQztJQUM5RyxPQUFPLEVBQUUsT0FBTyxFQUFFLCtCQUErQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLFNBQVMsRUFBRSxNQUFNO1FBQy9ILEtBQUssRUFBRSxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSxjQUFjLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsRUFBRTtRQUNoSCxXQUFXLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxlQUFlLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxlQUFlLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDaEksZ0JBQWdCLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFNBQVMsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDOUYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQWlELEVBQ3BFLFVBQXVDLEVBQUUsT0FBaUMsRUFBUSxFQUFFO0lBQ3BGLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztXQUNwSCxZQUFZLENBQUMsVUFBVSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTTtXQUMvRixVQUFVLENBQUMsZ0JBQWdCLEtBQUssT0FBTyxDQUFDLGdCQUFnQixJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUN2RixDQUFDLENBQUM7QUFFRjtvRkFDb0Y7QUFDcEYsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsS0FBSyxFQUFFLEtBQWMsRUFBRSxlQUF3QixFQUN4RyxtQkFBNEIsRUFBcUQsRUFBRTtJQUNuRixJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRywrQ0FBK0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2RSxNQUFNLE9BQU8sR0FBRywrQkFBK0IsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sVUFBVSxHQUFHLE1BQU0sa0NBQWtDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDN0UsV0FBVyxDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDMUMsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzttRkFFbUY7QUFDbkYsTUFBTSxDQUFDLE1BQU0sNENBQTRDLEdBQUcsS0FBSyxFQUFFLEtBQWMsRUFBRSxZQUFxQixFQUN0RyxlQUF3QixFQUFFLG1CQUE0QixFQUFFLFFBQWlCLEVBQXNELEVBQUU7SUFDakksSUFBSSxDQUFDO1FBQ0gsTUFBTSxRQUFRLEdBQUcsZ0RBQWdELENBQUMsS0FBSyxDQUFDLENBQUM7UUFDekUsTUFBTSxPQUFPLEdBQUcsK0NBQStDLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDOUUsTUFBTSxPQUFPLEdBQUcsK0JBQStCLENBQUMsbUJBQW1CLENBQUMsRUFBRSxHQUFHLEdBQUcsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3JHLE1BQU0sVUFBVSxHQUFHLE1BQU0sa0NBQWtDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDN0UsV0FBVyxDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDMUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUN6SCxjQUFjLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ25GLE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxrQkFBa0IsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDN0csY0FBYyxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsUUFBUSxLQUFLLEtBQUssSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxLQUFLLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNoSixjQUFjLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxTQUFTLElBQUksR0FBRyxJQUFJLEdBQUcsR0FBRyxRQUFRLENBQUMsU0FBUyxJQUFJLFFBQVEsQ0FBQyxTQUFTLElBQUksVUFBVSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM5SCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSwrQkFBK0IsRUFBaUMsTUFBTSxxQkFBcUIsQ0FBQztBQUNyRyxPQUFPLEVBQUUsa0NBQWtDLEVBQW9DLE1BQU0sd0JBQXdCLENBQUM7QUFDOUcsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLHFDQUFxQyxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDakgsT0FBTyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLHlCQUF5QixFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUNuSCxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBd0I1STtpRkFDaUY7QUFDakYsTUFBTSxHQUFHLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUNyQyxjQUFjLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2hGLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM1QixjQUFjLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxFQUFFLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEtBQUssSUFBSSxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hILE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsQ0FBQyxLQUFjLEVBQTRDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQzVJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM3RSxPQUFPLEVBQUUsT0FBTyxFQUFFLCtCQUErQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDbkgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSxnREFBZ0QsR0FBRyxDQUFDLEtBQWMsRUFBNkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDOUksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxhQUFhO1FBQzdHLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDMUUsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsQ0FBQztJQUM5RyxPQUFPLEVBQUUsT0FBTyxFQUFFLCtCQUErQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLFNBQVMsRUFBRSxNQUFNO1FBQy9ILEtBQUssRUFBRSxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSxjQUFjLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsRUFBRTtRQUNoSCxXQUFXLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxlQUFlLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxlQUFlLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDaEksZ0JBQWdCLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFNBQVMsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDOUYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQWlELEVBQ3BFLFVBQXVDLEVBQUUsT0FBaUMsRUFBUSxFQUFFO0lBQ3BGLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztXQUNwSCxnQkFBZ0IsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLElBQUksVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQ3BFLENBQUMsQ0FBQztBQUVGO29GQUNvRjtBQUNwRixNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLGVBQXdCLEVBQ3hHLG1CQUE0QixFQUFxRCxFQUFFO0lBQ25GLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLCtDQUErQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sT0FBTyxHQUFHLCtCQUErQixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDckUsTUFBTSxVQUFVLEdBQUcsTUFBTSxrQ0FBa0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUM3RSxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUY7Ozs7O3lDQUt5QztBQUN6QyxNQUFNLENBQUMsTUFBTSw0Q0FBNEMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLFlBQXFCLEVBQ3RHLGVBQXdCLEVBQUUsbUJBQTRCLEVBQUUsUUFBaUIsRUFDekUsZUFBK0IsSUFBSSxFQUFzRCxFQUFFO0lBQzNGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLGdEQUFnRCxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3pFLE1BQU0sT0FBTyxHQUFHLCtDQUErQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQzlFLE1BQU0sT0FBTyxHQUFHLCtCQUErQixDQUFDLG1CQUFtQixDQUFDLEVBQUUsR0FBRyxHQUFHLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNyRyxNQUFNLFlBQVksR0FBRyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3hHLE1BQU0sVUFBVSxHQUFHLE1BQU0sa0NBQWtDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDN0UsTUFBTSxPQUFPLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3pHLE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM5RCxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxQyxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3pILGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbkYsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGtCQUFrQixDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3RyxjQUFjLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxRQUFRLEtBQUssS0FBSyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLEtBQUssQ0FBQyxPQUFPLElBQUksUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2hKLGNBQWMsQ0FBQyxNQUFNLENBQUMsU0FBUyxJQUFJLEdBQUcsSUFBSSxHQUFHLEdBQUcsUUFBUSxDQUFDLFNBQVMsSUFBSSxRQUFRLENBQUMsU0FBUyxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM5RyxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/networkdelivery.d.ts

@@ -1,6 +1,7 @@
 import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
 import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
 import type { IRuntimeNetworkSigningAuthorityV1, ISignedRuntimeNetworkProjectionV1 } from './networksigning.js';
+import type { IRuntimeNetworkDnsLeaseRenewalReference, ISignedRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 export interface IApplyRuntimeNetworkSigningAuthorityRequestV1 {
     session: IRuntimeSessionBindingV1;
     authority: IRuntimeNetworkSigningAuthorityV1;
@@ -14,12 +15,32 @@ export interface IApplyRuntimeNetworkAuthorityResponseV1 {
     status: 'accepted' | 'replay';
     authority: IRuntimeAuthorityReferenceV1;
 }
+export interface IApplyRuntimeNetworkDnsLeaseRenewalRequest {
+    session: IRuntimeSessionBindingV1;
+    signed: ISignedRuntimeNetworkDnsLeaseRenewal;
+}
+/** Durable admission only. It does not assert that the node converted the window or serves DNS. */
+export interface IApplyRuntimeNetworkDnsLeaseRenewalResponse {
+    status: 'accepted' | 'replay';
+    renewal: IRuntimeNetworkDnsLeaseRenewalReference;
+}
 export declare const snapshotApplyRuntimeNetworkSigningAuthorityRequestV1: (value: unknown) => IApplyRuntimeNetworkSigningAuthorityRequestV1;
 export declare const snapshotApplyRuntimeNetworkProjectionRequestV1: (value: unknown) => IApplyRuntimeNetworkProjectionRequestV1;
 export declare const snapshotApplyRuntimeNetworkAuthorityResponseV1: (value: unknown) => IApplyRuntimeNetworkAuthorityResponseV1;
+export declare const snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest: (value: unknown) => IApplyRuntimeNetworkDnsLeaseRenewalRequest;
+export declare const snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse: (value: unknown) => IApplyRuntimeNetworkDnsLeaseRenewalResponse;
 /** trustedSessionValue must come from the receiving CURRENT physical connection. */
 export declare const bindApplyRuntimeNetworkSigningAuthorityRequestV1: (value: unknown, trustedSessionValue: unknown) => IApplyRuntimeNetworkSigningAuthorityRequestV1;
 /** Content binding only. Verify signature with stored trust and atomically fence admission. */
 export declare const bindApplyRuntimeNetworkProjectionRequestV1: (value: unknown, trustedSessionValue: unknown) => IApplyRuntimeNetworkProjectionRequestV1;
 /** Compare ACK with the exact SENT key or projection reference, never with a response-derived value. */
 export declare const bindApplyRuntimeNetworkAuthorityResponseV1: (value: unknown, sentReferenceValue: unknown) => IApplyRuntimeNetworkAuthorityResponseV1;
+/**
+ * Content binding only; trustedSessionValue must come from the receiving CURRENT physical
+ * connection. A relay pushes a held renewal under the binding the node obtained itself, so this
+ * comparison is what makes the push admissible, never who sent it. Verify the signature with
+ * stored trust, then admit and fence atomically.
+ */
+export declare const bindApplyRuntimeNetworkDnsLeaseRenewalRequest: (value: unknown, trustedSessionValue: unknown) => IApplyRuntimeNetworkDnsLeaseRenewalRequest;
+/** Compare the ACK with the exact SENT renewal, never with a response-derived value. */
+export declare const bindApplyRuntimeNetworkDnsLeaseRenewalResponse: (value: unknown, sentRenewalValue: unknown) => IApplyRuntimeNetworkDnsLeaseRenewalResponse;

package/dist_ts/data/networkdelivery.js

@@ -1,6 +1,11 @@
 import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
 import { snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './networksigning.js';
-import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe, requireNetwork } from '../private/networkcontract.js';
+import { getRuntimeNetworkDnsLeaseRenewalReference, snapshotRuntimeNetworkDnsLeaseRenewal, snapshotRuntimeNetworkDnsLeaseRenewalReference, snapshotSignedRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
+import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
+const admissionStatus = (value) => {
+    requireNetwork(value === 'accepted' || value === 'replay');
+    return value;
+};
 export const snapshotApplyRuntimeNetworkSigningAuthorityRequestV1 = (value) => networkSafe(() => {
     const item = networkRecord(captureNetwork(value), ['session', 'authority']);
     return { session: snapshotRuntimeSessionBindingV1(item.session), authority: snapshotRuntimeNetworkSigningAuthorityV1(item.authority) };
@@ -11,8 +16,15 @@ export const snapshotApplyRuntimeNetworkProjectionRequestV1 = (value) => network
 });
 export const snapshotApplyRuntimeNetworkAuthorityResponseV1 = (value) => networkSafe(() => {
     const item = networkRecord(captureNetwork(value), ['status', 'authority']);
-    requireNetwork(item.status === 'accepted' || item.status === 'replay');
-    return { status: item.status, authority: networkReference(item.authority) };
+    return { status: admissionStatus(item.status), authority: networkReference(item.authority) };
+});
+export const snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['session', 'signed']);
+    return { session: snapshotRuntimeSessionBindingV1(item.session), signed: snapshotSignedRuntimeNetworkDnsLeaseRenewal(item.signed) };
+});
+export const snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['status', 'renewal']);
+    return { status: admissionStatus(item.status), renewal: snapshotRuntimeNetworkDnsLeaseRenewalReference(item.renewal) };
 });
 /** trustedSessionValue must come from the receiving CURRENT physical connection. */
 export const bindApplyRuntimeNetworkSigningAuthorityRequestV1 = (value, trustedSessionValue) => networkSafe(() => {
@@ -23,9 +35,7 @@ export const bindApplyRuntimeNetworkSigningAuthorityRequestV1 = (value, trustedS
 /** Content binding only. Verify signature with stored trust and atomically fence admission. */
 export const bindApplyRuntimeNetworkProjectionRequestV1 = (value, trustedSessionValue) => networkSafe(() => {
     const request = snapshotApplyRuntimeNetworkProjectionRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
-    const projection = request.signed.projection;
-    requireNetwork(networkEqual(request.session, session) && networkEqual(projection.controller, session.controller)
-        && projection.nodeId === session.nodeId && projection.runtimeNamespace === session.runtimeNamespace);
+    requireNetwork(networkEqual(request.session, session) && networkSameScope(request.signed.projection, session));
     return request;
 });
 /** Compare ACK with the exact SENT key or projection reference, never with a response-derived value. */
@@ -35,4 +45,22 @@ export const bindApplyRuntimeNetworkAuthorityResponseV1 = (value, sentReferenceV
     requireNetwork(networkEqual(response.authority, networkReferenceOf(expected)));
     return response;
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2RlbGl2ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9uZXR3b3JrZGVsaXZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLCtCQUErQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFdEUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDekgsT0FBTyxFQUFFLGNBQWMsRUFBRSxZQUFZLEVBQUUsYUFBYSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQWdCL0osTUFBTSxDQUFDLE1BQU0sb0RBQW9ELEdBQUcsQ0FBQyxLQUFjLEVBQWlELEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3RKLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUM1RSxPQUFPLEVBQUUsT0FBTyxFQUFFLCtCQUErQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxTQUFTLEVBQUUsd0NBQXdDLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDekksQ0FBQyxDQUFDLENBQUM7QUFDSCxNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUFDLEtBQWMsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLE9BQU8sRUFBRSxPQUFPLEVBQUUsK0JBQStCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sRUFBRSx3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUNuSSxDQUFDLENBQUMsQ0FBQztBQUNILE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQUMsS0FBYyxFQUEyQyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUMxSSxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDM0UsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssVUFBVSxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDdkUsT0FBTyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztBQUM5RSxDQUFDLENBQUMsQ0FBQztBQUVILG9GQUFvRjtBQUNwRixNQUFNLENBQUMsTUFBTSxnREFBZ0QsR0FBRyxDQUFDLEtBQWMsRUFBRSxtQkFBNEIsRUFBaUQsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDaEwsTUFBTSxPQUFPLEdBQUcsb0RBQW9ELENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxHQUFHLCtCQUErQixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDNUksY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUN6SCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUMsQ0FBQztBQUVILCtGQUErRjtBQUMvRixNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUFDLEtBQWMsRUFBRSxtQkFBNEIsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDcEssTUFBTSxPQUFPLEdBQUcsOENBQThDLENBQUMsS0FBSyxDQUFDLEVBQUUsT0FBTyxHQUFHLCtCQUErQixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDdEksTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7SUFDN0MsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUM7V0FDM0csVUFBVSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTSxJQUFJLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUN2RyxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUMsQ0FBQztBQUVILHdHQUF3RztBQUN4RyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUFDLEtBQWMsRUFBRSxrQkFBMkIsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDbkssTUFBTSxRQUFRLEdBQUcsOENBQThDLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDdkUsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsY0FBYyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQztJQUN0RSxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9FLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDIn0=
+/**
+ * Content binding only; trustedSessionValue must come from the receiving CURRENT physical
+ * connection. A relay pushes a held renewal under the binding the node obtained itself, so this
+ * comparison is what makes the push admissible, never who sent it. Verify the signature with
+ * stored trust, then admit and fence atomically.
+ */
+export const bindApplyRuntimeNetworkDnsLeaseRenewalRequest = (value, trustedSessionValue) => networkSafe(() => {
+    const request = snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+    requireNetwork(networkEqual(request.session, session) && networkSameScope(request.signed.renewal, session));
+    return request;
+});
+/** Compare the ACK with the exact SENT renewal, never with a response-derived value. */
+export const bindApplyRuntimeNetworkDnsLeaseRenewalResponse = (value, sentRenewalValue) => networkSafe(() => {
+    const response = snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse(value);
+    const sent = getRuntimeNetworkDnsLeaseRenewalReference(snapshotRuntimeNetworkDnsLeaseRenewal(sentRenewalValue));
+    requireNetwork(networkEqual(response.renewal, sent));
+    return response;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2RlbGl2ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9uZXR3b3JrZGVsaXZlcnkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLCtCQUErQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFdEUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFekgsT0FBTyxFQUFFLHlDQUF5QyxFQUFFLHFDQUFxQyxFQUN2Riw4Q0FBOEMsRUFBRSwyQ0FBMkMsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ3pILE9BQU8sRUFBRSxjQUFjLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLEVBQ3ZILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBeUJ4RCxNQUFNLGVBQWUsR0FBRyxDQUFDLEtBQWMsRUFBeUIsRUFBRTtJQUNoRSxjQUFjLENBQUMsS0FBSyxLQUFLLFVBQVUsSUFBSSxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUM7SUFBQyxPQUFPLEtBQUssQ0FBQztBQUMzRSxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxvREFBb0QsR0FBRyxDQUFDLEtBQWMsRUFBaUQsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDdEosTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzVFLE9BQU8sRUFBRSxPQUFPLEVBQUUsK0JBQStCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFNBQVMsRUFBRSx3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztBQUN6SSxDQUFDLENBQUMsQ0FBQztBQUNILE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQUMsS0FBYyxFQUEyQyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUMxSSxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDekUsT0FBTyxFQUFFLE9BQU8sRUFBRSwrQkFBK0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsTUFBTSxFQUFFLHdDQUF3QyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0FBQ25JLENBQUMsQ0FBQyxDQUFDO0FBQ0gsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FBQyxLQUFjLEVBQTJDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQzFJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMzRSxPQUFPLEVBQUUsTUFBTSxFQUFFLGVBQWUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQy9GLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0saURBQWlELEdBQUcsQ0FBQyxLQUFjLEVBQThDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ2hKLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN6RSxPQUFPLEVBQUUsT0FBTyxFQUFFLCtCQUErQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxNQUFNLEVBQUUsMkNBQTJDLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDdEksQ0FBQyxDQUFDLENBQUM7QUFDSCxNQUFNLENBQUMsTUFBTSxrREFBa0QsR0FBRyxDQUFDLEtBQWMsRUFBK0MsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDbEosTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLE9BQU8sRUFBRSxNQUFNLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxPQUFPLEVBQUUsOENBQThDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7QUFDekgsQ0FBQyxDQUFDLENBQUM7QUFFSCxvRkFBb0Y7QUFDcEYsTUFBTSxDQUFDLE1BQU0sZ0RBQWdELEdBQUcsQ0FBQyxLQUFjLEVBQUUsbUJBQTRCLEVBQWlELEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ2hMLE1BQU0sT0FBTyxHQUFHLG9EQUFvRCxDQUFDLEtBQUssQ0FBQyxFQUFFLE9BQU8sR0FBRywrQkFBK0IsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBQzVJLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDekgsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDLENBQUM7QUFFSCwrRkFBK0Y7QUFDL0YsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FBQyxLQUFjLEVBQUUsbUJBQTRCLEVBQTJDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3BLLE1BQU0sT0FBTyxHQUFHLDhDQUE4QyxDQUFDLEtBQUssQ0FBQyxFQUFFLE9BQU8sR0FBRywrQkFBK0IsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO0lBQ3RJLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQy9HLE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUMsQ0FBQyxDQUFDO0FBRUgsd0dBQXdHO0FBQ3hHLE1BQU0sQ0FBQyxNQUFNLDBDQUEwQyxHQUFHLENBQUMsS0FBYyxFQUFFLGtCQUEyQixFQUEyQyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUNuSyxNQUFNLFFBQVEsR0FBRyw4Q0FBOEMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN2RSxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxjQUFjLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDO0lBQ3RFLGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0UsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLENBQUMsS0FBYyxFQUFFLG1CQUE0QixFQUE4QyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUMxSyxNQUFNLE9BQU8sR0FBRyxpREFBaUQsQ0FBQyxLQUFLLENBQUMsRUFBRSxPQUFPLEdBQUcsK0JBQStCLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUN6SSxjQUFjLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUksZ0JBQWdCLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUM1RyxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUMsQ0FBQztBQUVILHdGQUF3RjtBQUN4RixNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUFDLEtBQWMsRUFBRSxnQkFBeUIsRUFBK0MsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDekssTUFBTSxRQUFRLEdBQUcsa0RBQWtELENBQUMsS0FBSyxDQUFDLENBQUM7SUFDM0UsTUFBTSxJQUFJLEdBQUcseUNBQXlDLENBQUMscUNBQXFDLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQ2hILGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ3JELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/networklease.d.ts

@@ -0,0 +1,110 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
+import type { IRuntimeNetworkDnsWindow, IRuntimeNetworkNodeScopeV1 } from './networkprojection.js';
+/**
+ * A fresh DNS window for one exact admitted projection, and nothing else.
+ *
+ * A projection's window is signed content, so only a newly signed statement can extend it. A
+ * re-issued projection would do that too, but a receiver treats every new projection as new
+ * network state and applies it again; a renewal leaves the applied state alone. It names the
+ * projection by exact reference, so it never joins the projection chain and stops being
+ * admissible the moment a successor projection is admitted.
+ */
+export interface IRuntimeNetworkDnsLeaseRenewal extends IRuntimeNetworkNodeScopeV1 {
+    projection: IRuntimeAuthorityReferenceV1;
+    /** Orders the renewals of one projection. A receiver may skip sequences, never go back. */
+    sequence: number;
+    /**
+     * `issuedAt` is the start of the window's slot, not the signing instant: a controller signs a
+     * run of future windows ahead of time, and the fifteen-minute rule is measured from here.
+     */
+    dns: IRuntimeNetworkDnsWindow;
+    digest: TSha256Digest;
+}
+/** Names one renewal without its window: what a receiver records and what an ACK repeats. */
+export interface IRuntimeNetworkDnsLeaseRenewalReference {
+    projection: IRuntimeAuthorityReferenceV1;
+    sequence: number;
+    digest: TSha256Digest;
+}
+export interface ISignedRuntimeNetworkDnsLeaseRenewal {
+    /** The signing authority revision that also signs this controller's projections. */
+    authority: IRuntimeAuthorityReferenceV1;
+    renewal: IRuntimeNetworkDnsLeaseRenewal;
+    /** Ed25519 signature of the complete domain-separated envelope, lowercase hex. */
+    signature: string;
+}
+/**
+ * The renewals a cluster relay holds for one node it carries, replacing what it held before.
+ *
+ * The relay has no signing trust and verifies no signature: it holds signed statements and hands
+ * them to the node, which verifies each one against its own pinned authority.
+ */
+export interface IHoldRuntimeNetworkDnsLeaseRenewalsRequest {
+    /** The relay's own socket names the cluster; one relay carries every node of it, so the node is named here. */
+    nodeId: string;
+    projection: IRuntimeAuthorityReferenceV1;
+    /** Ascending by sequence. Empty holds nothing for this node. */
+    renewals: ISignedRuntimeNetworkDnsLeaseRenewal[];
+}
+export interface IHoldRuntimeNetworkDnsLeaseRenewalsResponse {
+    held: number;
+}
+export declare const runtimeNetworkDnsLeaseRenewalContract: Readonly<{
+    readonly renewalDigestDomain: "serve.zone/runtime-network-dns-lease-renewal";
+    readonly signatureDomain: "serve.zone/runtime-network-dns-lease-renewal-signature";
+    readonly maximumDnsLeaseMs: 900000;
+    readonly maximumEscrowedRenewals: 32;
+    /** From the first held window's `issuedAt` to the last one's `expiresAt`. */
+    readonly maximumEscrowHorizonMs: 14400000;
+    readonly binding: "exact-projection-reference";
+    readonly supersession: "a-successor-projection-refuses-every-renewal-of-its-predecessor";
+    readonly sequence: "strictly-increasing-per-projection-skipping-allowed";
+    readonly effect: "dns-window-only-never-applied-network-state";
+    readonly escrowRelease: "only-the-current-window-and-only-while-the-holder-has-no-controller-session";
+    readonly revocationLatency: "a-detached-cluster-keeps-dns-authority-until-its-last-held-window-ends";
+}>;
+export declare const snapshotRuntimeNetworkDnsLeaseRenewal: (value: unknown) => IRuntimeNetworkDnsLeaseRenewal;
+export declare const snapshotRuntimeNetworkDnsLeaseRenewalReference: (value: unknown) => IRuntimeNetworkDnsLeaseRenewalReference;
+export declare const getRuntimeNetworkDnsLeaseRenewalReference: (value: IRuntimeNetworkDnsLeaseRenewal) => IRuntimeNetworkDnsLeaseRenewalReference;
+export declare const snapshotSignedRuntimeNetworkDnsLeaseRenewal: (value: unknown) => ISignedRuntimeNetworkDnsLeaseRenewal;
+export declare const computeRuntimeNetworkDnsLeaseRenewalDigest: (value: IRuntimeNetworkDnsLeaseRenewal) => Promise<TSha256Digest>;
+/** Structure and digest only. A digest authenticates nothing: verify the signature with stored trust. */
+export declare const validateRuntimeNetworkDnsLeaseRenewal: (value: unknown) => Promise<IRuntimeNetworkDnsLeaseRenewal>;
+/**
+ * The DNS window a node may use under a projection: its admitted renewal's, else the projection's
+ * own. Controller and node derive every window-bounded fact, such as a VPN credential's expiry,
+ * from this one rule. renewalValue is the bare renewal `admitRuntimeNetworkDnsLeaseRenewal`
+ * admitted, or null; Cloudly passes `signed.renewal`. Both inputs are the caller's admitted state,
+ * so this checks structure, digests and that the renewal names exactly this projection; it
+ * verifies no signature and samples no clock.
+ */
+export declare const getRuntimeNetworkEffectiveDnsWindow: (projectionValue: unknown, renewalValue: unknown | null) => Promise<IRuntimeNetworkDnsWindow>;
+/**
+ * Pure admission decision for a renewal whose signature the caller has already verified.
+ *
+ * currentProjectionValue is the receiver's own admitted projection and previousValue the last
+ * renewal it admitted for that exact projection, or null when there is none; neither is ever
+ * taken from the incoming message. Without a previous renewal the projection's own window is the
+ * baseline. nowValue is the caller's qualified clock: a renewal is admitted only inside its own
+ * window, because storing a window that has not opened would displace the coverage the receiver
+ * has now. A sender therefore delivers a window once its slot has opened and never before, and
+ * simply delivers it again if it was refused. Re-delivering the renewal already admitted is
+ * answered `replay` whatever the time, so re-delivery stays idempotent. The caller commits the
+ * result atomically with its trust fence and discards the stored renewal in the transaction that
+ * admits a successor projection.
+ */
+export declare const admitRuntimeNetworkDnsLeaseRenewal: (value: unknown, currentProjectionValue: unknown, previousValue: unknown | null, trustedScopeValue: unknown, nowValue: unknown) => Promise<{
+    status: "accepted" | "replay";
+    renewal: IRuntimeNetworkDnsLeaseRenewal;
+}>;
+/**
+ * A held run is what one node could admit in order: one node, one projection, one authority,
+ * ascending sequences, each window extending the one before, inside both escrow maxima.
+ */
+export declare const snapshotHoldRuntimeNetworkDnsLeaseRenewalsRequest: (value: unknown) => IHoldRuntimeNetworkDnsLeaseRenewalsRequest;
+/** The run's rules plus every renewal's digest. It verifies no signature: a relay holds no trust. */
+export declare const validateHoldRuntimeNetworkDnsLeaseRenewalsRequest: (value: unknown) => Promise<IHoldRuntimeNetworkDnsLeaseRenewalsRequest>;
+export declare const snapshotHoldRuntimeNetworkDnsLeaseRenewalsResponse: (value: unknown) => IHoldRuntimeNetworkDnsLeaseRenewalsResponse;
+/** Compare the answer with the exact SENT run: a relay that held fewer did not take the run over. */
+export declare const bindHoldRuntimeNetworkDnsLeaseRenewalsResponse: (value: unknown, sentRequestValue: unknown) => IHoldRuntimeNetworkDnsLeaseRenewalsResponse;

package/dist_ts/data/networklease.js

@@ -0,0 +1,159 @@
+import { snapshotRuntimeNetworkNodeScopeV1, snapshotRuntimeNetworkProjectionV1, validateRuntimeNetworkProjectionV1 } from './networkprojection.js';
+import { captureNetwork, failNetwork, networkCounter, networkDigest, networkDnsWindow, networkEffectiveDnsWindow, networkEqual, networkHash, networkId, networkList, networkMaximumDnsLeaseMs, networkRecord, networkReference, networkReferenceOf, networkRenewsProjection, networkSafe, networkSameScope, networkScope, networkSignature, requireNetwork } from '../private/networkcontract.js';
+export const runtimeNetworkDnsLeaseRenewalContract = Object.freeze({
+    renewalDigestDomain: 'serve.zone/runtime-network-dns-lease-renewal',
+    signatureDomain: 'serve.zone/runtime-network-dns-lease-renewal-signature',
+    maximumDnsLeaseMs: networkMaximumDnsLeaseMs,
+    maximumEscrowedRenewals: 32,
+    /** From the first held window's `issuedAt` to the last one's `expiresAt`. */
+    maximumEscrowHorizonMs: 14_400_000,
+    binding: 'exact-projection-reference',
+    supersession: 'a-successor-projection-refuses-every-renewal-of-its-predecessor',
+    sequence: 'strictly-increasing-per-projection-skipping-allowed',
+    effect: 'dns-window-only-never-applied-network-state',
+    escrowRelease: 'only-the-current-window-and-only-while-the-holder-has-no-controller-session',
+    revocationLatency: 'a-detached-cluster-keeps-dns-authority-until-its-last-held-window-ends',
+});
+export const snapshotRuntimeNetworkDnsLeaseRenewal = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['controller', 'nodeId', 'runtimeNamespace', 'projection', 'sequence', 'dns', 'digest']);
+    return { ...networkScope(item), projection: networkReference(item.projection), sequence: networkCounter(item.sequence),
+        dns: networkDnsWindow(item.dns), digest: networkDigest(item.digest) };
+});
+export const snapshotRuntimeNetworkDnsLeaseRenewalReference = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['projection', 'sequence', 'digest']);
+    return { projection: networkReference(item.projection), sequence: networkCounter(item.sequence), digest: networkDigest(item.digest) };
+});
+export const getRuntimeNetworkDnsLeaseRenewalReference = (value) => ({ projection: networkReferenceOf(value.projection), sequence: value.sequence, digest: value.digest });
+export const snapshotSignedRuntimeNetworkDnsLeaseRenewal = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['authority', 'renewal', 'signature']);
+    return { authority: networkReference(item.authority), renewal: snapshotRuntimeNetworkDnsLeaseRenewal(item.renewal),
+        signature: networkSignature(item.signature) };
+});
+export const computeRuntimeNetworkDnsLeaseRenewalDigest = (value) => networkHash(runtimeNetworkDnsLeaseRenewalContract.renewalDigestDomain, snapshotRuntimeNetworkDnsLeaseRenewal(value));
+/** Structure and digest only. A digest authenticates nothing: verify the signature with stored trust. */
+export const validateRuntimeNetworkDnsLeaseRenewal = async (value) => {
+    try {
+        const renewal = snapshotRuntimeNetworkDnsLeaseRenewal(value);
+        requireNetwork(renewal.digest === await computeRuntimeNetworkDnsLeaseRenewalDigest(renewal));
+        return renewal;
+    }
+    catch {
+        return failNetwork();
+    }
+};
+/**
+ * A later window never moves its slot back and always ends later. Windows need not touch: a
+ * receiver that missed renewals while its lease lapsed must still be able to admit the next one.
+ */
+const extendsWindow = (next, baseline) => next.issuedAt >= baseline.issuedAt && next.expiresAt > baseline.expiresAt;
+/** A receiver admits only a window it can use at once: its slot has opened and it has not ended. */
+const isCurrentWindow = (window, now) => window.notBefore <= now && now < window.expiresAt;
+/**
+ * The DNS window a node may use under a projection: its admitted renewal's, else the projection's
+ * own. Controller and node derive every window-bounded fact, such as a VPN credential's expiry,
+ * from this one rule. renewalValue is the bare renewal `admitRuntimeNetworkDnsLeaseRenewal`
+ * admitted, or null; Cloudly passes `signed.renewal`. Both inputs are the caller's admitted state,
+ * so this checks structure, digests and that the renewal names exactly this projection; it
+ * verifies no signature and samples no clock.
+ */
+export const getRuntimeNetworkEffectiveDnsWindow = async (projectionValue, renewalValue) => {
+    try {
+        const projectionInput = snapshotRuntimeNetworkProjectionV1(projectionValue);
+        const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
+        const projection = await validateRuntimeNetworkProjectionV1(projectionInput);
+        const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
+        return networkEffectiveDnsWindow(projection, renewal);
+    }
+    catch {
+        return failNetwork();
+    }
+};
+/**
+ * Pure admission decision for a renewal whose signature the caller has already verified.
+ *
+ * currentProjectionValue is the receiver's own admitted projection and previousValue the last
+ * renewal it admitted for that exact projection, or null when there is none; neither is ever
+ * taken from the incoming message. Without a previous renewal the projection's own window is the
+ * baseline. nowValue is the caller's qualified clock: a renewal is admitted only inside its own
+ * window, because storing a window that has not opened would displace the coverage the receiver
+ * has now. A sender therefore delivers a window once its slot has opened and never before, and
+ * simply delivers it again if it was refused. Re-delivering the renewal already admitted is
+ * answered `replay` whatever the time, so re-delivery stays idempotent. The caller commits the
+ * result atomically with its trust fence and discards the stored renewal in the transaction that
+ * admits a successor projection.
+ */
+export const admitRuntimeNetworkDnsLeaseRenewal = async (value, currentProjectionValue, previousValue, trustedScopeValue, nowValue) => {
+    try {
+        // Snapshot ALL caller-owned inputs before the first asynchronous operation.
+        const incoming = snapshotRuntimeNetworkDnsLeaseRenewal(value);
+        const projectionInput = snapshotRuntimeNetworkProjectionV1(currentProjectionValue);
+        const previousInput = previousValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(previousValue);
+        const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
+        const now = networkCounter(nowValue);
+        const renewal = await validateRuntimeNetworkDnsLeaseRenewal(incoming);
+        const projection = await validateRuntimeNetworkProjectionV1(projectionInput);
+        requireNetwork(networkSameScope(projection, trusted) && networkRenewsProjection(renewal, projection));
+        const previous = previousInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(previousInput);
+        if (previous !== null) {
+            requireNetwork(networkRenewsProjection(previous, projection));
+            if (renewal.sequence === previous.sequence) {
+                requireNetwork(networkEqual(renewal, previous));
+                return { status: 'replay', renewal };
+            }
+            requireNetwork(renewal.sequence > previous.sequence);
+        }
+        requireNetwork(isCurrentWindow(renewal.dns, now));
+        requireNetwork(extendsWindow(renewal.dns, previous === null ? projection.dns : previous.dns));
+        return { status: 'accepted', renewal };
+    }
+    catch {
+        return failNetwork();
+    }
+};
+/** Consecutive held renewals: same signer and scope, a higher sequence, a window that extends the one before. */
+const followsInRun = (next, before) => networkEqual(next.authority, before.authority) && networkSameScope(next.renewal, before.renewal)
+    && next.renewal.sequence > before.renewal.sequence && extendsWindow(next.renewal.dns, before.renewal.dns);
+const heldHorizonMs = (renewals) => {
+    const first = renewals.at(0), last = renewals.at(-1);
+    return first === undefined || last === undefined ? 0 : last.renewal.dns.expiresAt - first.renewal.dns.issuedAt;
+};
+/**
+ * A held run is what one node could admit in order: one node, one projection, one authority,
+ * ascending sequences, each window extending the one before, inside both escrow maxima.
+ */
+export const snapshotHoldRuntimeNetworkDnsLeaseRenewalsRequest = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['nodeId', 'projection', 'renewals']);
+    const contract = runtimeNetworkDnsLeaseRenewalContract;
+    const request = { nodeId: networkId(item.nodeId), projection: networkReference(item.projection),
+        renewals: networkList(item.renewals, contract.maximumEscrowedRenewals, snapshotSignedRuntimeNetworkDnsLeaseRenewal) };
+    request.renewals.forEach((signed, index) => requireNetwork(signed.renewal.nodeId === request.nodeId
+        && networkEqual(signed.renewal.projection, request.projection)
+        && (index === 0 || followsInRun(signed, request.renewals[index - 1]))));
+    requireNetwork(heldHorizonMs(request.renewals) <= contract.maximumEscrowHorizonMs);
+    return request;
+});
+/** The run's rules plus every renewal's digest. It verifies no signature: a relay holds no trust. */
+export const validateHoldRuntimeNetworkDnsLeaseRenewalsRequest = async (value) => {
+    try {
+        const request = snapshotHoldRuntimeNetworkDnsLeaseRenewalsRequest(value);
+        for (const signed of request.renewals)
+            await validateRuntimeNetworkDnsLeaseRenewal(signed.renewal);
+        return request;
+    }
+    catch {
+        return failNetwork();
+    }
+};
+export const snapshotHoldRuntimeNetworkDnsLeaseRenewalsResponse = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['held']);
+    requireNetwork(typeof item.held === 'number' && Number.isSafeInteger(item.held) && item.held >= 0
+        && item.held <= runtimeNetworkDnsLeaseRenewalContract.maximumEscrowedRenewals);
+    return { held: item.held };
+});
+/** Compare the answer with the exact SENT run: a relay that held fewer did not take the run over. */
+export const bindHoldRuntimeNetworkDnsLeaseRenewalsResponse = (value, sentRequestValue) => networkSafe(() => {
+    const response = snapshotHoldRuntimeNetworkDnsLeaseRenewalsResponse(value);
+    requireNetwork(response.held === snapshotHoldRuntimeNetworkDnsLeaseRenewalsRequest(sentRequestValue).renewals.length);
+    return response;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2xlYXNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9uZXR3b3JrbGVhc2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBR0EsT0FBTyxFQUFFLGlDQUFpQyxFQUFFLGtDQUFrQyxFQUFFLGtDQUFrQyxFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDbkosT0FBTyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSx5QkFBeUIsRUFBRSxZQUFZLEVBQzVILFdBQVcsRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLHdCQUF3QixFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFDbEgsdUJBQXVCLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQXdEaEosTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNqRSxtQkFBbUIsRUFBRSw4Q0FBOEM7SUFDbkUsZUFBZSxFQUFFLHdEQUF3RDtJQUN6RSxpQkFBaUIsRUFBRSx3QkFBd0I7SUFDM0MsdUJBQXVCLEVBQUUsRUFBRTtJQUMzQiw2RUFBNkU7SUFDN0Usc0JBQXNCLEVBQUUsVUFBVTtJQUNsQyxPQUFPLEVBQUUsNEJBQTRCO0lBQ3JDLFlBQVksRUFBRSxpRUFBaUU7SUFDL0UsUUFBUSxFQUFFLHFEQUFxRDtJQUMvRCxNQUFNLEVBQUUsNkNBQTZDO0lBQ3JELGFBQWEsRUFBRSw2RUFBNkU7SUFDNUYsaUJBQWlCLEVBQUUsd0VBQXdFO0NBQ25GLENBQUMsQ0FBQztBQUVaLE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQUMsS0FBYyxFQUFrQyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUN4SCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsWUFBWSxFQUFFLFFBQVEsRUFBRSxrQkFBa0IsRUFBRSxZQUFZLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzNJLE9BQU8sRUFBRSxHQUFHLFlBQVksQ0FBQyxJQUFJLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLFFBQVEsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztRQUNwSCxHQUFHLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLE1BQU0sRUFBRSxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDMUUsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUFDLEtBQWMsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFlBQVksRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN4RixPQUFPLEVBQUUsVUFBVSxFQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0FBQ3hJLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FBQyxLQUFxQyxFQUEyQyxFQUFFLENBQzFJLENBQUMsRUFBRSxVQUFVLEVBQUUsa0JBQWtCLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUV6RyxNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxDQUFDLEtBQWMsRUFBd0MsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDcEksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFdBQVcsRUFBRSxTQUFTLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUN6RixPQUFPLEVBQUUsU0FBUyxFQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxPQUFPLEVBQUUscUNBQXFDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUNoSCxTQUFTLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDbEQsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUFDLEtBQXFDLEVBQTBCLEVBQUUsQ0FDMUgsV0FBVyxDQUFDLHFDQUFxQyxDQUFDLG1CQUFtQixFQUFFLHFDQUFxQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFdkgseUdBQXlHO0FBQ3pHLE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLEtBQUssRUFBRSxLQUFjLEVBQTJDLEVBQUU7SUFDckgsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcscUNBQXFDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDN0QsY0FBYyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssTUFBTSwwQ0FBMEMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQzdGLE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLGFBQWEsR0FBRyxDQUFDLElBQThCLEVBQUUsUUFBa0MsRUFBVyxFQUFFLENBQ3BHLElBQUksQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsSUFBSSxJQUFJLENBQUMsU0FBUyxHQUFHLFFBQVEsQ0FBQyxTQUFTLENBQUM7QUFFNUUsb0dBQW9HO0FBQ3BHLE1BQU0sZUFBZSxHQUFHLENBQUMsTUFBZ0MsRUFBRSxHQUFXLEVBQVcsRUFBRSxDQUNqRixNQUFNLENBQUMsU0FBUyxJQUFJLEdBQUcsSUFBSSxHQUFHLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQztBQUVwRDs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsS0FBSyxFQUN0RCxlQUF3QixFQUFFLFlBQTRCLEVBQ25CLEVBQUU7SUFDckMsSUFBSSxDQUFDO1FBQ0gsTUFBTSxlQUFlLEdBQUcsa0NBQWtDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDNUUsTUFBTSxZQUFZLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxxQ0FBcUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN4RyxNQUFNLFVBQVUsR0FBRyxNQUFNLGtDQUFrQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQzdFLE1BQU0sT0FBTyxHQUFHLFlBQVksS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTSxxQ0FBcUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN6RyxPQUFPLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7Ozs7R0FhRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLEtBQUssRUFDckQsS0FBYyxFQUFFLHNCQUErQixFQUFFLGFBQTZCLEVBQUUsaUJBQTBCLEVBQUUsUUFBaUIsRUFDeEMsRUFBRTtJQUN2RixJQUFJLENBQUM7UUFDSCw0RUFBNEU7UUFDNUUsTUFBTSxRQUFRLEdBQUcscUNBQXFDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDOUQsTUFBTSxlQUFlLEdBQUcsa0NBQWtDLENBQUMsc0JBQXNCLENBQUMsQ0FBQztRQUNuRixNQUFNLGFBQWEsR0FBRyxhQUFhLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzNHLE1BQU0sT0FBTyxHQUFHLGlDQUFpQyxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDckUsTUFBTSxHQUFHLEdBQUcsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sT0FBTyxHQUFHLE1BQU0scUNBQXFDLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDdEUsTUFBTSxVQUFVLEdBQUcsTUFBTSxrQ0FBa0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUM3RSxjQUFjLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxJQUFJLHVCQUF1QixDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3RHLE1BQU0sUUFBUSxHQUFHLGFBQWEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTSxxQ0FBcUMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUM1RyxJQUFJLFFBQVEsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUN0QixjQUFjLENBQUMsdUJBQXVCLENBQUMsUUFBUSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7WUFDOUQsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztnQkFDM0MsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztnQkFBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUN4RixDQUFDO1lBQ0QsY0FBYyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEdBQUcsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFDRCxjQUFjLENBQUMsZUFBZSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNsRCxjQUFjLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDOUYsT0FBTyxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsT0FBTyxFQUFFLENBQUM7SUFDekMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGLGlIQUFpSDtBQUNqSCxNQUFNLFlBQVksR0FBRyxDQUFDLElBQTBDLEVBQUUsTUFBNEMsRUFBVyxFQUFFLENBQ3pILFlBQVksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUM7T0FDM0YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksYUFBYSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7QUFFOUcsTUFBTSxhQUFhLEdBQUcsQ0FBQyxRQUFnRCxFQUFVLEVBQUU7SUFDakYsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLEdBQUcsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3JELE9BQU8sS0FBSyxLQUFLLFNBQVMsSUFBSSxJQUFJLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLFNBQVMsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUM7QUFDakgsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0saURBQWlELEdBQUcsQ0FBQyxLQUFjLEVBQThDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ2hKLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsWUFBWSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDeEYsTUFBTSxRQUFRLEdBQUcscUNBQXFDLENBQUM7SUFDdkQsTUFBTSxPQUFPLEdBQStDLEVBQUUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsVUFBVSxFQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUM7UUFDekksUUFBUSxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyx1QkFBdUIsRUFBRSwyQ0FBMkMsQ0FBQyxFQUFFLENBQUM7SUFDeEgsT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssT0FBTyxDQUFDLE1BQU07V0FDOUYsWUFBWSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUM7V0FDM0QsQ0FBQyxLQUFLLEtBQUssQ0FBQyxJQUFJLFlBQVksQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLFFBQVEsQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMxRSxjQUFjLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLENBQUMsc0JBQXNCLENBQUMsQ0FBQztJQUNuRixPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUMsQ0FBQztBQUVILHFHQUFxRztBQUNyRyxNQUFNLENBQUMsTUFBTSxpREFBaUQsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUF1RCxFQUFFO0lBQzdJLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLGlEQUFpRCxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3pFLEtBQUssTUFBTSxNQUFNLElBQUksT0FBTyxDQUFDLFFBQVE7WUFBRSxNQUFNLHFDQUFxQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNuRyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sa0RBQWtELEdBQUcsQ0FBQyxLQUFjLEVBQStDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ2xKLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQzVELGNBQWMsQ0FBQyxPQUFPLElBQUksQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQztXQUM1RixJQUFJLENBQUMsSUFBSSxJQUFJLHFDQUFxQyxDQUFDLHVCQUF1QixDQUFDLENBQUM7SUFDakYsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7QUFDN0IsQ0FBQyxDQUFDLENBQUM7QUFFSCxxR0FBcUc7QUFDckcsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FBQyxLQUFjLEVBQUUsZ0JBQXlCLEVBQStDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3pLLE1BQU0sUUFBUSxHQUFHLGtEQUFrRCxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzNFLGNBQWMsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLGlEQUFpRCxDQUFDLGdCQUFnQixDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3RILE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/networknode.d.ts

@@ -0,0 +1,37 @@
+import type { IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+type TEgressOwner = IRuntimeNetworkProtectedAuthorityV1['egressAuthorities'][number];
+/**
+ * One unmet condition of a node's runtime network readiness, in the order the node producer meets
+ * them: the node joins the protected authority's egress, every egress owner reports current
+ * protection, a handoff is reserved, the router selection carries it, the node's acknowledged
+ * projection carries it, and the node is a managed VPN member. `protection-receipts-pending` names
+ * the egress owners whose current receipts are still missing.
+ */
+export type TRuntimeNetworkNodeReadinessGap = {
+    condition: 'egress-pending' | 'handoff-pending' | 'selection-pending' | 'projection-pending' | 'vpn-member-pending';
+} | {
+    condition: 'protection-receipts-pending';
+    owners: [TEgressOwner, ...TEgressOwner[]];
+};
+/** A node is ready exactly when nothing is missing. */
+export type IRuntimeNetworkNodeReadiness = {
+    nodeId: string;
+} & ({
+    ready: true;
+    missing: [];
+} | {
+    ready: false;
+    missing: [TRuntimeNetworkNodeReadinessGap, ...TRuntimeNetworkNodeReadinessGap[]];
+});
+/**
+ * The router incarnation of one node. A handoff's id and router incarnation id derive from it, so
+ * advancing it is the only way to give a node's router a fresh handoff.
+ */
+export interface IRuntimeRouterIncarnation {
+    /** The node id. */
+    id: string;
+    /** Starts at 1 with the node's first handoff; every reincarnation advances it by one. */
+    incarnation: number;
+}
+export declare const snapshotRuntimeRouterIncarnation: (value: unknown) => IRuntimeRouterIncarnation;
+export {};

package/dist_ts/data/networknode.js

@@ -0,0 +1,6 @@
+import { captureNetwork, networkCounter, networkId, networkRecord, networkSafe } from '../private/networkcontract.js';
+export const snapshotRuntimeRouterIncarnation = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['id', 'incarnation']);
+    return { id: networkId(item.id), incarnation: networkCounter(item.incarnation) };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya25vZGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtub2RlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxjQUFjLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsV0FBVyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFnQ3RILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQUMsS0FBYyxFQUE2QixFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUM5RyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDekUsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLFdBQVcsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7QUFDbkYsQ0FBQyxDQUFDLENBQUMifQ==

package/dist_ts/data/networkprojection.d.ts

@@ -8,6 +8,15 @@ export interface IRuntimeNetworkNodeScopeV1 {
     nodeId: string;
     runtimeNamespace: string;
 }
+/**
+ * One signed DNS window, on a projection or on a renewal of it: the start of the slot it was
+ * issued for, the instant a receiver may use it, and the instant it stops being usable.
+ */
+export interface IRuntimeNetworkDnsWindow {
+    issuedAt: number;
+    notBefore: number;
+    expiresAt: number;
+}
 /** Immutable per-attempt address material. Membership and projection revisions are independent. */
 export interface IRuntimeNetworkWorkloadLeaseV1 extends IRuntimeNetworkNodeScopeV1 {
     schemaVersion: 1;
@@ -132,11 +141,7 @@ export interface IRuntimeNetworkProjectionV1 extends IRuntimeNetworkNodeScopeV1
     networks: IPrivateNetworkV1[];
     memberships: IServicePrivateNetworksV1[];
     endpoints: IRuntimeNetworkEndpointV1[];
-    dns: {
-        issuedAt: number;
-        notBefore: number;
-        expiresAt: number;
-    };
+    dns: IRuntimeNetworkDnsWindow;
     /** Explicit denial intent. Carry until the exact predecessor's application is proven. */
     withdrawals: IRuntimeNetworkPacketGrantV1[];
     retiredLeases: IRuntimeAuthorityReferenceV1[];