@serve.zone/interfaces 31.7.0 → 31.9.0

package/dist_ts/requests/cluster.d.ts

@@ -1,5 +1,8 @@
 import * as userInterfaces from '../data/user.js';
 import * as clusterInterfaces from '../data/cluster.js';
+import type { IClusterRuntime, TClusterRuntimeBlocker } from '../data/clusterruntime.js';
+import type { IServiceRuntimeAssignmentView } from '../data/serviceruntime.js';
+import type * as leaseInterfaces from '../data/networklease.js';
 import * as plugins from '../plugins.js';
 /**
  * get all clusters
@@ -112,6 +115,21 @@ export interface IReq_Relay_Cloudly_RegisterClusterRelayV1 extends plugins.typed
     request: clusterInterfaces.IClusterRelayRegistrationV1;
     response: clusterInterfaces.IClusterRelayRegistrationResponseV1;
 }
+/**
+ * Cloudly hands the cluster relay the DNS lease renewals it has signed ahead of time for one node.
+ *
+ * A cluster is outbound-only, so a node that loses Cloudly loses the only signer of its DNS
+ * window. The relay holds this run in memory, replacing whatever it held for that node, and
+ * releases from it only the renewal whose window is current (`notBefore <= now < expiresAt`), and
+ * only while it has no Cloudly session: a node refuses a window that is not current. It signs nothing and verifies
+ * nothing: each renewal is Cloudly's statement and the node verifies it against its own pinned
+ * authority.
+ */
+export interface IReq_Cloudly_Relay_HoldRuntimeNetworkDnsLeaseRenewals extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_Relay_HoldRuntimeNetworkDnsLeaseRenewals> {
+    method: 'holdRuntimeNetworkDnsLeaseRenewals';
+    request: leaseInterfaces.IHoldRuntimeNetworkDnsLeaseRenewalsRequest;
+    response: leaseInterfaces.IHoldRuntimeNetworkDnsLeaseRenewalsResponse;
+}
 /**
  * deletes a cluster
  */
@@ -125,3 +143,38 @@ export interface IReq_Any_Cloudly_DeleteClusterById extends plugins.typedrequest
         ok: boolean;
     };
 }
+/**
+ * A cluster's runtime phase, and what still blocks it from leaving `swarm`.
+ *
+ * Cloudly refuses a cluster without a phase record as `cluster-runtime-missing` rather than
+ * assuming one. `blockers` is empty once nothing blocks the cutover.
+ */
+export interface IReq_Any_Cloudly_GetClusterRuntime extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetClusterRuntime> {
+    method: 'getClusterRuntime';
+    request: {
+        identity: userInterfaces.IIdentity;
+        clusterId: string;
+    };
+    response: {
+        runtime: IClusterRuntime;
+        blockers: TClusterRuntimeBlocker[];
+    };
+}
+/**
+ * Every current runtime assignment on one cluster's nodes, a page at a time: a cluster carries
+ * every node's slots of every service, which no single response bounds. `limit` runs from 1 to
+ * `serviceRuntimeContract.maximumAssignmentPageSize`; Cloudly refuses any other.
+ */
+export interface IReq_Any_Cloudly_GetClusterRuntimeAssignments extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetClusterRuntimeAssignments> {
+    method: 'getClusterRuntimeAssignments';
+    request: {
+        identity: userInterfaces.IIdentity;
+        clusterId: string;
+        cursor: string | null;
+        limit: number;
+    };
+    response: {
+        assignments: IServiceRuntimeAssignmentView[];
+        nextCursor: string | null;
+    };
+}

package/dist_ts/requests/cluster.js

@@ -1,4 +1,4 @@
 import * as userInterfaces from '../data/user.js';
 import * as clusterInterfaces from '../data/cluster.js';
 import * as plugins from '../plugins.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3Rlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3JlcXVlc3RzL2NsdXN0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLGNBQWMsTUFBTSxpQkFBaUIsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sb0JBQW9CLENBQUM7QUFDeEQsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3Rlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3JlcXVlc3RzL2NsdXN0ZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLGNBQWMsTUFBTSxpQkFBaUIsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sb0JBQW9CLENBQUM7QUFJeEQsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUMifQ==

package/dist_ts/requests/network.d.ts

@@ -1,5 +1,7 @@
 import * as plugins from '../plugins.js';
-import type { IIdentityCredential } from '../data/user.js';
+import type { IIdentity, IIdentityCredential } from '../data/user.js';
+import type { IRuntimeNetworkAddressPlan, TRuntimeNetworkAddressPlanWritableData } from '../data/networkaddressplan.js';
+import type { IRuntimeNetworkNodeReadiness, IRuntimeRouterIncarnation } from '../data/networknode.js';
 import type { IPrivateNetworkV1, IServicePrivateNetworksV1, ISetServicePrivateNetworksV1, TPrivateNetworkMutationV1 } from '../data/privatenetwork.js';
 import type { IServicePublishedPortsV1, ISetServicePublishedPortsV1 } from '../data/networkprojection.js';
 /** Current organization picker data. Entries are never cached authorization grants. */
@@ -130,3 +132,57 @@ export interface IRequest_Any_Cloudly_GetNetworkNodes {
         networkNodes: plugins.tsclass.network.INetworkNode[];
     };
 }
+/**
+ * Writes the runtime network's address plan.
+ *
+ * `expectedRevision` is the revision the caller read, or `null` when no plan exists yet. Cloudly
+ * validates the plan with `snapshotRuntimeNetworkAddressPlan`, decides the change with
+ * `admitRuntimeNetworkAddressPlanChange`, refuses the change while a resolver or platform endpoint
+ * it removes or changes is still referenced, and answers with the stored plan: at its new revision,
+ * or unchanged.
+ */
+export interface IReq_Any_Cloudly_SetRuntimeNetworkAddressPlan extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_SetRuntimeNetworkAddressPlan> {
+    method: 'setRuntimeNetworkAddressPlan';
+    request: {
+        identity: IIdentity;
+        expectedRevision: number | null;
+        plan: TRuntimeNetworkAddressPlanWritableData;
+    };
+    response: {
+        plan: IRuntimeNetworkAddressPlan;
+    };
+}
+/** `null` until an administrator sets the first plan; the runtime network stays unconfigured until then. */
+export interface IReq_Any_Cloudly_GetRuntimeNetworkAddressPlan extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetRuntimeNetworkAddressPlan> {
+    method: 'getRuntimeNetworkAddressPlan';
+    request: {
+        identity: IIdentity;
+    };
+    response: {
+        plan: IRuntimeNetworkAddressPlan | null;
+    };
+}
+/** Whether one node's runtime network is ready for workloads, and every condition still missing. */
+export interface IReq_Any_Cloudly_GetRuntimeNetworkNodeReadiness extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetRuntimeNetworkNodeReadiness> {
+    method: 'getRuntimeNetworkNodeReadiness';
+    request: {
+        identity: IIdentity;
+        nodeId: string;
+    };
+    response: IRuntimeNetworkNodeReadiness;
+}
+/**
+ * Advances one node's router incarnation, so the node producer reserves the router a fresh handoff.
+ * `expectedIncarnation` is the incarnation the caller read; any other refuses the request.
+ */
+export interface IReq_Any_Cloudly_ReincarnateRuntimeNetworkRouter extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_ReincarnateRuntimeNetworkRouter> {
+    method: 'reincarnateRuntimeNetworkRouter';
+    request: {
+        identity: IIdentity;
+        nodeId: string;
+        expectedIncarnation: number;
+    };
+    response: {
+        incarnation: IRuntimeRouterIncarnation;
+    };
+}

package/dist_ts/requests/runtimesession.d.ts

@@ -28,6 +28,20 @@ export interface IReq_Controller_Pallet_ApplyRuntimeNetworkProjectionV1 extends
     request: network.IApplyRuntimeNetworkProjectionRequestV1;
     response: network.IApplyRuntimeNetworkAuthorityResponseV1;
 }
+/**
+ * A fresh DNS window for the node's exact admitted projection; an ACK asserts admission only.
+ *
+ * The controller sends it while it is reachable. A cluster relay sends the renewals it holds
+ * while it has no controller session, under the binding the node obtained itself, which is why
+ * a node admits it from whoever holds its current connection and trusts only the signature.
+ * Either sender delivers a window once its slot has opened and never before, because a node
+ * refuses a renewal it could not use at once; delivering it again once the slot opens is enough.
+ */
+export interface IReq_Controller_Pallet_ApplyRuntimeNetworkDnsLeaseRenewal extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkDnsLeaseRenewal> {
+    method: 'applyRuntimeNetworkDnsLeaseRenewal';
+    request: network.IApplyRuntimeNetworkDnsLeaseRenewalRequest;
+    response: network.IApplyRuntimeNetworkDnsLeaseRenewalResponse;
+}
 /**
  * WSS-only Pallet bootstrap. Derive physical peer/idempotency server-side; the registering
  * node process is named by `request.nodeInstanceNonce`, because one relay socket may carry

package/dist_ts/requests/service.d.ts

@@ -8,6 +8,7 @@ import type { IImageRelease } from '../data/immutableimage.js';
 import type { IDeploymentPreflightReport, IDeploymentPreflightRequestData } from '../data/deploymentpreflight.js';
 import type { IDeploymentReservationInput, IServiceDeploymentOperation, IServiceDeploymentStatus } from '../data/deploymentoperation.js';
 import type { TSha256Digest } from '../data/immutableimage.js';
+import type { IServiceRuntimeAssignmentView, IServiceRuntimeSpec, IServiceRuntimeStatus, TServiceRuntimeSpecWritableData } from '../data/serviceruntime.js';
 import type { IServiceDeploymentAdoptionInput, IServiceDeploymentAdoptionImagePromotionInput, IServiceDeploymentAdoptionImagePromotionResult, IServiceDeploymentAdoptionRolloutInput, IServiceDeploymentAdoptionRolloutResult, IServiceDeploymentAdoptionPreflightInput, IServiceDeploymentAdoptionReport, IServiceDeploymentAdoptionResult } from '../data/deploymentadoption.js';
 export interface IRequest_Any_Cloudly_BootstrapServiceDeploymentAdoptionRollout extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_BootstrapServiceDeploymentAdoptionRollout> {
     method: 'bootstrapServiceDeploymentAdoptionRollout';
@@ -253,3 +254,62 @@ export interface IRequest_Any_Cloudly_DeleteServiceById extends plugins.typedreq
         success: boolean;
     };
 }
+/**
+ * Writes the complete runtime spec of one service.
+ *
+ * `expectedRevision` is the revision the caller read, or `null` when the service has never had a
+ * spec; any other stored revision refuses the write. Cloudly copies the organization from the
+ * service and answers with the stored spec at its new revision.
+ */
+export interface IRequest_Any_Cloudly_SetServiceRuntimeSpec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_SetServiceRuntimeSpec> {
+    method: 'setServiceRuntimeSpec';
+    request: {
+        identity: IIdentity;
+        serviceId: string;
+        expectedRevision: number | null;
+        spec: TServiceRuntimeSpecWritableData;
+    };
+    response: {
+        spec: IServiceRuntimeSpec;
+    };
+}
+/**
+ * A service's runtime spec and the producer's verdict on it. Both are `null` before the first spec;
+ * a spec's status is `null` until the producer first decides it.
+ */
+export interface IRequest_Any_Cloudly_GetServiceRuntimeSpec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetServiceRuntimeSpec> {
+    method: 'getServiceRuntimeSpec';
+    request: {
+        identity: IIdentity;
+        serviceId: string;
+    };
+    response: {
+        spec: null;
+        status: null;
+    } | {
+        spec: IServiceRuntimeSpec;
+        status: IServiceRuntimeStatus | null;
+    };
+}
+/** Every current runtime assignment of one service, one per replica slot. */
+export interface IRequest_Any_Cloudly_GetServiceRuntimeAssignments extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetServiceRuntimeAssignments> {
+    method: 'getServiceRuntimeAssignments';
+    request: {
+        identity: IIdentity;
+        serviceId: string;
+    };
+    response: {
+        assignments: IServiceRuntimeAssignmentView[];
+    };
+}
+/**
+ * Cloudly -> admin UIs: a service's runtime spec, status or assignments changed. It carries no
+ * state, so a late or repeated push can never overwrite a newer read; the UI reads the views again.
+ */
+export interface IReq_Cloudly_Any_PushServiceRuntimeChanged extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_Any_PushServiceRuntimeChanged> {
+    method: 'pushServiceRuntimeChanged';
+    request: {
+        serviceId: string;
+    };
+    response: Record<string, never>;
+}

package/dist_ts/runtime.networkprojection.d.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.runtime.js';
 import type { ISignedRuntimeNetworkProjectionV1 } from './data/networksigning.js';
+import type { ISignedRuntimeNetworkDnsLeaseRenewal } from './data/networklease.js';
 /** The private KeyObject is process-local. Persist only through the controller's encrypted secret store. */
 export declare const createRuntimeNetworkSigningKeyV1: () => {
     publicKey: string;
@@ -13,3 +14,16 @@ export declare const signRuntimeNetworkProjectionV1: (projectionValue: unknown,
  * admission, live-session fencing, allocation barriers and conservative DNS time checks.
  */
 export declare const verifyRuntimeNetworkProjectionV1: (value: unknown, trustedAuthorityValue: unknown, trustedScopeValue: unknown) => Promise<ISignedRuntimeNetworkProjectionV1>;
+/** Sign only a validated renewal, with the same authority and key that sign this controller's projections. */
+export declare const signRuntimeNetworkDnsLeaseRenewal: (renewalValue: unknown, authorityValue: unknown, privateKey: plugins.crypto.KeyObject) => Promise<ISignedRuntimeNetworkDnsLeaseRenewal>;
+/**
+ * trustedAuthorityValue is receiver-owned persisted trust, NEVER envelope material, and a relay
+ * that delivers the renewal adds no trust to it. projectionAuthorityValue is the authority
+ * reference that signed the projection this renewal extends, which the receiver kept when it
+ * admitted that projection: a renewal is only ever valid under the exact revision that signed its
+ * projection, so a rotated key renews nothing and DNS still waits for a newly signed projection.
+ * This verifies content, scope and signature only: the owner still admits it against its own
+ * admitted projection with `admitRuntimeNetworkDnsLeaseRenewal`, fences the live session and
+ * converts the window with a qualified clock.
+ */
+export declare const verifyRuntimeNetworkDnsLeaseRenewal: (value: unknown, trustedAuthorityValue: unknown, trustedScopeValue: unknown, projectionAuthorityValue: unknown) => Promise<ISignedRuntimeNetworkDnsLeaseRenewal>;

package/dist_ts/runtime.networkprojection.js

@@ -1,7 +1,8 @@
 import * as plugins from './plugins.runtime.js';
 import { snapshotRuntimeNetworkNodeScopeV1, snapshotRuntimeNetworkProjectionV1, validateRuntimeNetworkProjectionV1 } from './data/networkprojection.js';
 import { computeRuntimeNetworkSigningAuthorityV1Digest, runtimeNetworkSigningV1Contract, snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './data/networksigning.js';
-import { failNetwork, networkCanonical, networkEqual, networkReferenceOf, requireNetwork } from './private/networkcontract.js';
+import { runtimeNetworkDnsLeaseRenewalContract, snapshotRuntimeNetworkDnsLeaseRenewal, snapshotSignedRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './data/networklease.js';
+import { captureNetwork, failNetwork, networkCanonical, networkEqual, networkReference, networkReferenceOf, networkSameScope, requireNetwork } from './private/networkcontract.js';
 /** The private KeyObject is process-local. Persist only through the controller's encrypted secret store. */
 export const createRuntimeNetworkSigningKeyV1 = () => {
     const pair = plugins.crypto.generateKeyPairSync('ed25519');
@@ -9,23 +10,39 @@ export const createRuntimeNetworkSigningKeyV1 = () => {
     requireNetwork(jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && typeof jwk.x === 'string');
     return { publicKey: Buffer.from(jwk.x, 'base64url').toString('hex'), privateKey: pair.privateKey };
 };
-const signatureBytes = (authority, projection) => new TextEncoder().encode(networkCanonical({ domain: runtimeNetworkSigningV1Contract.signatureDomain, schemaVersion: 1, authority, projection }));
-const validateAuthority = async (authority, projection) => {
-    requireNetwork(authority.publicKey !== null && networkEqual(authority.controller, projection.controller)
+const projectionEnvelope = (authority, projection) => ({ domain: runtimeNetworkSigningV1Contract.signatureDomain, schemaVersion: 1, authority, projection });
+const renewalEnvelope = (authority, renewal) => ({ domain: runtimeNetworkDnsLeaseRenewalContract.signatureDomain, authority, renewal });
+const envelopeBytes = (envelope) => new TextEncoder().encode(networkCanonical(envelope));
+/** A revoked revision has no key; any other must be intact and belong to the controller that owns the content. */
+const liveKeyOf = async (authority, contentController) => {
+    const { publicKey } = authority;
+    requireNetwork(publicKey !== null && networkEqual(authority.controller, contentController)
         && authority.digest === await computeRuntimeNetworkSigningAuthorityV1Digest(authority));
+    return publicKey;
+};
+/** Sign as the authority's revision, and only with the private half of its live key. */
+const signAs = async (authority, privateKey, contentController, envelopeOf) => {
+    requireNetwork(privateKey instanceof plugins.crypto.KeyObject && privateKey.type === 'private' && privateKey.asymmetricKeyType === 'ed25519');
+    const derived = plugins.crypto.createPublicKey(privateKey).export({ format: 'jwk' });
+    const publicKey = await liveKeyOf(authority, contentController);
+    requireNetwork(typeof derived.x === 'string' && Buffer.from(derived.x, 'base64url').toString('hex') === publicKey);
+    const reference = networkReferenceOf(authority);
+    return { authority: reference, signature: plugins.crypto.sign(null, envelopeBytes(envelopeOf(reference)), privateKey).toString('hex') };
+};
+/** The receiver's own trusted revision decides; the envelope only names which revision it claims. */
+const requireSignedBy = async (trusted, signed, contentController, envelope) => {
+    requireNetwork(networkEqual(signed.authority, networkReferenceOf(trusted)));
+    const key = plugins.crypto.createPublicKey({ format: 'jwk', key: { kty: 'OKP', crv: 'Ed25519',
+            x: Buffer.from(await liveKeyOf(trusted, contentController), 'hex').toString('base64url') } });
+    requireNetwork(plugins.crypto.verify(null, envelopeBytes(envelope), key, Buffer.from(signed.signature, 'hex')));
 };
 /** Sign only validated complete state and a matching dedicated private key. */
 export const signRuntimeNetworkProjectionV1 = async (projectionValue, authorityValue, privateKey) => {
     try {
         const input = snapshotRuntimeNetworkProjectionV1(projectionValue), authority = snapshotRuntimeNetworkSigningAuthorityV1(authorityValue);
-        requireNetwork(privateKey instanceof plugins.crypto.KeyObject && privateKey.type === 'private' && privateKey.asymmetricKeyType === 'ed25519');
-        const publicKey = plugins.crypto.createPublicKey(privateKey).export({ format: 'jwk' });
-        requireNetwork(typeof publicKey.x === 'string' && Buffer.from(publicKey.x, 'base64url').toString('hex') === authority.publicKey);
         const projection = await validateRuntimeNetworkProjectionV1(input);
-        await validateAuthority(authority, projection);
-        const reference = networkReferenceOf(authority);
-        const signature = plugins.crypto.sign(null, signatureBytes(reference, projection), privateKey).toString('hex');
-        return { schemaVersion: 1, authority: reference, projection, signature };
+        const signed = await signAs(authority, privateKey, projection.controller, reference => projectionEnvelope(reference, projection));
+        return { schemaVersion: 1, authority: signed.authority, projection, signature: signed.signature };
     }
     catch {
         return failNetwork();
@@ -41,13 +58,8 @@ export const verifyRuntimeNetworkProjectionV1 = async (value, trustedAuthorityVa
         const signed = snapshotSignedRuntimeNetworkProjectionV1(value);
         const authority = snapshotRuntimeNetworkSigningAuthorityV1(trustedAuthorityValue);
         const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
-        requireNetwork(networkEqual(signed.authority, networkReferenceOf(authority))
-            && signed.projection.nodeId === trusted.nodeId && signed.projection.runtimeNamespace === trusted.runtimeNamespace
-            && networkEqual(signed.projection.controller, trusted.controller));
-        await validateAuthority(authority, signed.projection);
-        const key = plugins.crypto.createPublicKey({ format: 'jwk', key: { kty: 'OKP', crv: 'Ed25519',
-                x: Buffer.from(authority.publicKey, 'hex').toString('base64url') } });
-        requireNetwork(plugins.crypto.verify(null, signatureBytes(signed.authority, signed.projection), key, Buffer.from(signed.signature, 'hex')));
+        requireNetwork(networkSameScope(signed.projection, trusted));
+        await requireSignedBy(authority, signed, signed.projection.controller, projectionEnvelope(signed.authority, signed.projection));
         await validateRuntimeNetworkProjectionV1(signed.projection);
         return signed;
     }
@@ -55,4 +67,41 @@ export const verifyRuntimeNetworkProjectionV1 = async (value, trustedAuthorityVa
         return failNetwork();
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5uZXR3b3JrcHJvamVjdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUubmV0d29ya3Byb2plY3Rpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxzQkFBc0IsQ0FBQztBQUdoRCxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsa0NBQWtDLEVBQUUsa0NBQWtDLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUV4SixPQUFPLEVBQUUsNkNBQTZDLEVBQUUsK0JBQStCLEVBQ3JGLHdDQUF3QyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDdkgsT0FBTyxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsa0JBQWtCLEVBQUUsY0FBYyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFL0gsNEdBQTRHO0FBQzVHLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEdBQWdFLEVBQUU7SUFDaEgsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3JELGNBQWMsQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLEtBQUssSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDeEYsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7QUFDckcsQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxTQUF1QyxFQUFFLFVBQXVDLEVBQWMsRUFBRSxDQUN0SCxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSwrQkFBK0IsQ0FBQyxlQUFlLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQ25KLE1BQU0saUJBQWlCLEdBQUcsS0FBSyxFQUFFLFNBQTRDLEVBQUUsVUFBdUMsRUFBaUIsRUFBRTtJQUN2SSxjQUFjLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxJQUFJLElBQUksWUFBWSxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQztXQUNuRyxTQUFTLENBQUMsTUFBTSxLQUFLLE1BQU0sNkNBQTZDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztBQUM1RixDQUFDLENBQUM7QUFFRiwrRUFBK0U7QUFDL0UsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsS0FBSyxFQUNqRCxlQUF3QixFQUFFLGNBQXVCLEVBQUUsVUFBb0MsRUFDM0MsRUFBRTtJQUM5QyxJQUFJLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxrQ0FBa0MsQ0FBQyxlQUFlLENBQUMsRUFBRSxTQUFTLEdBQUcsd0NBQXdDLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDeEksY0FBYyxDQUFDLFVBQVUsWUFBWSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVMsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsaUJBQWlCLEtBQUssU0FBUyxDQUFDLENBQUM7UUFDOUksTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDdkYsY0FBYyxDQUFDLE9BQU8sU0FBUyxDQUFDLENBQUMsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsS0FBSyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDakksTUFBTSxVQUFVLEdBQUcsTUFBTSxrQ0FBa0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuRSxNQUFNLGlCQUFpQixDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUMvQyxNQUFNLFNBQVMsR0FBRyxrQkFBa0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoRCxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsY0FBYyxDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsRUFBRSxVQUFVLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0csT0FBTyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLENBQUM7SUFDM0UsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxLQUFLLEVBQ25ELEtBQWMsRUFBRSxxQkFBOEIsRUFBRSxpQkFBMEIsRUFDOUIsRUFBRTtJQUM5QyxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyx3Q0FBd0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvRCxNQUFNLFNBQVMsR0FBRyx3Q0FBd0MsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ2xGLE1BQU0sT0FBTyxHQUFHLGlDQUFpQyxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDckUsY0FBYyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxDQUFDO2VBQ3ZFLE1BQU0sQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxPQUFPLENBQUMsZ0JBQWdCO2VBQzlHLFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUNyRSxNQUFNLGlCQUFpQixDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDdEQsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLFNBQVM7Z0JBQzNGLENBQUMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFVLEVBQUUsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3pFLGNBQWMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsY0FBYyxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxFQUFFLEdBQUcsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzVJLE1BQU0sa0NBQWtDLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzVELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUMifQ==
+/** Sign only a validated renewal, with the same authority and key that sign this controller's projections. */
+export const signRuntimeNetworkDnsLeaseRenewal = async (renewalValue, authorityValue, privateKey) => {
+    try {
+        const input = snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue), authority = snapshotRuntimeNetworkSigningAuthorityV1(authorityValue);
+        const renewal = await validateRuntimeNetworkDnsLeaseRenewal(input);
+        const signed = await signAs(authority, privateKey, renewal.controller, reference => renewalEnvelope(reference, renewal));
+        return { authority: signed.authority, renewal, signature: signed.signature };
+    }
+    catch {
+        return failNetwork();
+    }
+};
+/**
+ * trustedAuthorityValue is receiver-owned persisted trust, NEVER envelope material, and a relay
+ * that delivers the renewal adds no trust to it. projectionAuthorityValue is the authority
+ * reference that signed the projection this renewal extends, which the receiver kept when it
+ * admitted that projection: a renewal is only ever valid under the exact revision that signed its
+ * projection, so a rotated key renews nothing and DNS still waits for a newly signed projection.
+ * This verifies content, scope and signature only: the owner still admits it against its own
+ * admitted projection with `admitRuntimeNetworkDnsLeaseRenewal`, fences the live session and
+ * converts the window with a qualified clock.
+ */
+export const verifyRuntimeNetworkDnsLeaseRenewal = async (value, trustedAuthorityValue, trustedScopeValue, projectionAuthorityValue) => {
+    try {
+        const signed = snapshotSignedRuntimeNetworkDnsLeaseRenewal(value);
+        const authority = snapshotRuntimeNetworkSigningAuthorityV1(trustedAuthorityValue);
+        const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
+        const projectionAuthority = networkReference(captureNetwork(projectionAuthorityValue));
+        requireNetwork(networkSameScope(signed.renewal, trusted) && networkEqual(signed.authority, projectionAuthority));
+        await requireSignedBy(authority, signed, signed.renewal.controller, renewalEnvelope(signed.authority, signed.renewal));
+        await validateRuntimeNetworkDnsLeaseRenewal(signed.renewal);
+        return signed;
+    }
+    catch {
+        return failNetwork();
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5uZXR3b3JrcHJvamVjdGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUubmV0d29ya3Byb2plY3Rpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxzQkFBc0IsQ0FBQztBQUdoRCxPQUFPLEVBQUUsaUNBQWlDLEVBQUUsa0NBQWtDLEVBQUUsa0NBQWtDLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUV4SixPQUFPLEVBQUUsNkNBQTZDLEVBQUUsK0JBQStCLEVBQ3JGLHdDQUF3QyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFFdkgsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLHFDQUFxQyxFQUNuRiwyQ0FBMkMsRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ3JILE9BQU8sRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFDeEcsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFekUsNEdBQTRHO0FBQzVHLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEdBQWdFLEVBQUU7SUFDaEgsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3JELGNBQWMsQ0FBQyxHQUFHLENBQUMsR0FBRyxLQUFLLEtBQUssSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLFNBQVMsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDeEYsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7QUFDckcsQ0FBQyxDQUFDO0FBUUYsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLFNBQXVDLEVBQUUsVUFBdUMsRUFBRSxFQUFFLENBQzlHLENBQUMsRUFBRSxNQUFNLEVBQUUsK0JBQStCLENBQUMsZUFBZSxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxDQUFDLENBQUM7QUFDekcsTUFBTSxlQUFlLEdBQUcsQ0FBQyxTQUF1QyxFQUFFLE9BQXVDLEVBQUUsRUFBRSxDQUMzRyxDQUFDLEVBQUUsTUFBTSxFQUFFLHFDQUFxQyxDQUFDLGVBQWUsRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztBQUMxRixNQUFNLGFBQWEsR0FBRyxDQUFDLFFBQWdCLEVBQWMsRUFBRSxDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFN0csa0hBQWtIO0FBQ2xILE1BQU0sU0FBUyxHQUFHLEtBQUssRUFBRSxTQUE0QyxFQUFFLGlCQUF1QyxFQUFtQixFQUFFO0lBQ2pJLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxTQUFTLENBQUM7SUFDaEMsY0FBYyxDQUFDLFNBQVMsS0FBSyxJQUFJLElBQUksWUFBWSxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsaUJBQWlCLENBQUM7V0FDckYsU0FBUyxDQUFDLE1BQU0sS0FBSyxNQUFNLDZDQUE2QyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7SUFDMUYsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sTUFBTSxHQUFHLEtBQUssRUFDbEIsU0FBNEMsRUFBRSxVQUFvQyxFQUFFLGlCQUF1QyxFQUMzSCxVQUErRCxFQUNqQyxFQUFFO0lBQ2hDLGNBQWMsQ0FBQyxVQUFVLFlBQVksT0FBTyxDQUFDLE1BQU0sQ0FBQyxTQUFTLElBQUksVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTLElBQUksVUFBVSxDQUFDLGlCQUFpQixLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQzlJLE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ3JGLE1BQU0sU0FBUyxHQUFHLE1BQU0sU0FBUyxDQUFDLFNBQVMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2hFLGNBQWMsQ0FBQyxPQUFPLE9BQU8sQ0FBQyxDQUFDLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsRUFBRSxXQUFXLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDbkgsTUFBTSxTQUFTLEdBQUcsa0JBQWtCLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEQsT0FBTyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxhQUFhLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDMUksQ0FBQyxDQUFDO0FBRUYscUdBQXFHO0FBQ3JHLE1BQU0sZUFBZSxHQUFHLEtBQUssRUFDM0IsT0FBMEMsRUFBRSxNQUEyQixFQUFFLGlCQUF1QyxFQUFFLFFBQWdCLEVBQ25ILEVBQUU7SUFDakIsY0FBYyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RSxNQUFNLEdBQUcsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsU0FBUztZQUMzRixDQUFDLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLFNBQVMsQ0FBQyxPQUFPLEVBQUUsaUJBQWlCLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDaEcsY0FBYyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxhQUFhLENBQUMsUUFBUSxDQUFDLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDbEgsQ0FBQyxDQUFDO0FBRUYsK0VBQStFO0FBQy9FLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsZUFBd0IsRUFBRSxjQUF1QixFQUFFLFVBQW9DLEVBQzNDLEVBQUU7SUFDOUMsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsa0NBQWtDLENBQUMsZUFBZSxDQUFDLEVBQUUsU0FBUyxHQUFHLHdDQUF3QyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ3hJLE1BQU0sVUFBVSxHQUFHLE1BQU0sa0NBQWtDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbkUsTUFBTSxNQUFNLEdBQUcsTUFBTSxNQUFNLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUMsa0JBQWtCLENBQUMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDbEksT0FBTyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDcEcsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxLQUFLLEVBQ25ELEtBQWMsRUFBRSxxQkFBOEIsRUFBRSxpQkFBMEIsRUFDOUIsRUFBRTtJQUM5QyxJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBRyx3Q0FBd0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvRCxNQUFNLFNBQVMsR0FBRyx3Q0FBd0MsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ2xGLE1BQU0sT0FBTyxHQUFHLGlDQUFpQyxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDckUsY0FBYyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUM3RCxNQUFNLGVBQWUsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDaEksTUFBTSxrQ0FBa0MsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDNUQsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGLDhHQUE4RztBQUM5RyxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxLQUFLLEVBQ3BELFlBQXFCLEVBQUUsY0FBdUIsRUFBRSxVQUFvQyxFQUNyQyxFQUFFO0lBQ2pELElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxFQUFFLFNBQVMsR0FBRyx3Q0FBd0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUN4SSxNQUFNLE9BQU8sR0FBRyxNQUFNLHFDQUFxQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ25FLE1BQU0sTUFBTSxHQUFHLE1BQU0sTUFBTSxDQUFDLFNBQVMsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVUsRUFBRSxTQUFTLENBQUMsRUFBRSxDQUFDLGVBQWUsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUN6SCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDL0UsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7Ozs7Ozs7R0FTRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLEtBQUssRUFDdEQsS0FBYyxFQUFFLHFCQUE4QixFQUFFLGlCQUEwQixFQUFFLHdCQUFpQyxFQUM5RCxFQUFFO0lBQ2pELElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLDJDQUEyQyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sU0FBUyxHQUFHLHdDQUF3QyxDQUFDLHFCQUFxQixDQUFDLENBQUM7UUFDbEYsTUFBTSxPQUFPLEdBQUcsaUNBQWlDLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNyRSxNQUFNLG1CQUFtQixHQUFHLGdCQUFnQixDQUFDLGNBQWMsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDLENBQUM7UUFDdkYsY0FBYyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUksWUFBWSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsbUJBQW1CLENBQUMsQ0FBQyxDQUFDO1FBQ2pILE1BQU0sZUFBZSxDQUFDLFNBQVMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsZUFBZSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDdkgsTUFBTSxxQ0FBcUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDNUQsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "31.7.0",
+  "version": "31.9.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -31,7 +31,7 @@
     "@git.zone/tsdoc": "^2.2.0",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "6.1.1",
-    "@types/node": "26.5.0"
+    "@types/node": "26.5.1"
   },
   "files": [
     "ts/**/*",