@serve.zone/interfaces 31.8.0 → 32.0.0

package/ts/data/networkaddressplan.ts

@@ -0,0 +1,175 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import { computeRuntimeNetworkProtectedAuthorityDigest, snapshotRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import type { IGetRuntimeManagedVpnCredentialResponse } from './networkcredential.js';
+import { captureNetwork, failNetwork, networkContains, networkCounter, networkEqual, networkId, networkIpv4, networkOverlaps,
+  networkPrefixBounds, networkPrivatePrefix, networkRecord, networkSafe, requireNetwork } from '../private/networkcontract.js';
+
+/**
+ * The address space an administrator gives the runtime network, and the one input the protected
+ * authority is composed from. Cloudly keeps a single plan; pools and prefixes only grow, and the
+ * managed VPN never changes once set.
+ */
+export interface IRuntimeNetworkAddressPlan {
+  id: 'address-plan';
+  /** Compare-and-swap counter; every accepted change advances it by one. */
+  revision: number;
+  /** Every protected prefix: they cover the pools, resolvers, platform endpoints and the VPN. */
+  prefixes: string[];
+  pools: IRuntimeNetworkProtectedAuthority['pools'];
+  resolvers: IRuntimeNetworkProtectedAuthority['resolvers'];
+  /** Without the VPN relay, which the composed authority adds as a UDP platform endpoint. */
+  platformEndpoints: IRuntimeNetworkProtectedAuthority['platformEndpoints'];
+  vpn: {
+    /** The private prefix VPN control addresses are allocated from. */
+    controlPrefix: string;
+    /** The endpoint every node dials for the managed VPN. */
+    relay: IGetRuntimeManagedVpnCredentialResponse['relay'];
+  };
+}
+
+/** What an administrator writes; Cloudly supplies the id and the revision. */
+export type TRuntimeNetworkAddressPlanWritableData = Omit<IRuntimeNetworkAddressPlan, 'id' | 'revision'>;
+
+/** What a protection producer fixes around a plan: the authority's identity, revision chain and egress. */
+export type TRuntimeNetworkProtectedAuthorityFrame = Pick<IRuntimeNetworkProtectedAuthority,
+  'id' | 'generation' | 'controller' | 'previous' | 'egressAuthorities'>;
+
+/** Refusals the pure change check decides from the two plans alone. */
+export type TRuntimeNetworkAddressPlanChangeRefusal = 'plan-vpn-immutable' | 'plan-pool-removed' | 'plan-prefix-shrunk';
+
+/**
+ * Every refusal of a plan write. Cloudly adds the two that need live references: a resolver or
+ * platform endpoint the change removes or changes while a router selection or a service still names it.
+ */
+export type TRuntimeNetworkAddressPlanRefusal =
+  | TRuntimeNetworkAddressPlanChangeRefusal | 'plan-resolver-referenced' | 'plan-endpoint-referenced';
+
+export type TRuntimeNetworkAddressPlanChange =
+  | { status: 'unchanged' }
+  /** The ids the change removes or changes, which Cloudly checks against live references before it writes. */
+  | { status: 'accepted'; removed: { resolverIds: string[]; platformEndpointIds: string[] } }
+  | { status: 'refused'; reason: TRuntimeNetworkAddressPlanChangeRefusal };
+
+export const runtimeNetworkAddressPlanContract = Object.freeze({
+  id: 'address-plan',
+  /**
+   * SmartVPN needs its gateway and at least one member inside the control prefix. No minimum length
+   * is stated: the private-range rule already keeps the control prefix at /8 or longer.
+   */
+  maximumControlPrefixLength: 30,
+  relayProtocol: 'udp',
+} as const);
+
+/**
+ * The structural authority validator reads a frame's shape and nothing else, and a plan fixes none of
+ * the frame, so every valid frame decides a plan the same way. The digest is a well-formed
+ * placeholder: this candidate is never hashed or stored.
+ */
+const validationFrame: TRuntimeNetworkProtectedAuthorityFrame = {
+  id: 'address-plan', generation: 1, controller: { kind: 'cloudly', id: 'address-plan', epoch: 'address-plan' },
+  previous: null, egressAuthorities: [{ nodeId: 'address-plan', runtimeNamespace: 'address-plan' }],
+};
+const unsealedDigest = `sha256:${'0'.repeat(64)}` as TSha256Digest;
+
+type TAuthoritySets = Pick<IRuntimeNetworkProtectedAuthority, 'prefixes' | 'pools' | 'resolvers' | 'platformEndpoints'>;
+
+/** Unvalidated sets and frame in, the protected authority validator's verdict out. */
+const authorityOf = (
+  sets: Record<keyof TAuthoritySets, unknown>, frame: Record<keyof TRuntimeNetworkProtectedAuthorityFrame, unknown>,
+): IRuntimeNetworkProtectedAuthority => snapshotRuntimeNetworkProtectedAuthority({ id: frame.id,
+  generation: frame.generation, controller: frame.controller, previous: frame.previous, egressAuthorities: frame.egressAuthorities,
+  prefixes: sets.prefixes, pools: sets.pools, resolvers: sets.resolvers, platformEndpoints: sets.platformEndpoints, digest: unsealedDigest });
+
+const setsWithRelay = (plan: IRuntimeNetworkAddressPlan): TAuthoritySets => ({
+  prefixes: plan.prefixes, pools: plan.pools, resolvers: plan.resolvers,
+  platformEndpoints: [...plan.platformEndpoints, { ...plan.vpn.relay, protocol: runtimeNetworkAddressPlanContract.relayProtocol }]
+    .sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0),
+});
+
+const vpnOf = (value: unknown): IRuntimeNetworkAddressPlan['vpn'] => {
+  const item = networkRecord(value, ['controlPrefix', 'relay']);
+  const relay = networkRecord(item.relay, ['id', 'address', 'port']);
+  const controlPrefix = networkPrivatePrefix(item.controlPrefix);
+  requireNetwork(Number(controlPrefix.split('/')[1]) <= runtimeNetworkAddressPlanContract.maximumControlPrefixLength);
+  return { controlPrefix, relay: { id: networkId(relay.id), address: networkIpv4(relay.address), port: networkCounter(relay.port, 65535) } };
+};
+
+/** The control prefix is protected, and no pool, resolver or platform endpoint, the relay included, sits inside it. */
+const requireVpnProtected = (authority: IRuntimeNetworkProtectedAuthority, controlPrefix: string): void => {
+  requireNetwork(authority.prefixes.some(prefix => networkContains(prefix, controlPrefix))
+    && authority.pools.every(pool => !networkOverlaps(pool.prefix, controlPrefix))
+    && [...authority.resolvers, ...authority.platformEndpoints].every(endpoint => !networkContains(controlPrefix, `${endpoint.address}/32`)));
+};
+
+/**
+ * Structural snapshot for exact persistence and for a plan write. A plan passes only when both
+ * authorities it can describe pass the protected authority's own validator: its sets alone, and
+ * its sets with the relay added, so no plan can compose an authority that contract refuses.
+ */
+export const snapshotRuntimeNetworkAddressPlan = (value: unknown): IRuntimeNetworkAddressPlan => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['id', 'revision', 'prefixes', 'pools', 'resolvers', 'platformEndpoints', 'vpn']);
+  requireNetwork(item.id === runtimeNetworkAddressPlanContract.id);
+  const own = authorityOf({ prefixes: item.prefixes, pools: item.pools, resolvers: item.resolvers,
+    platformEndpoints: item.platformEndpoints }, validationFrame);
+  const plan: IRuntimeNetworkAddressPlan = { id: runtimeNetworkAddressPlanContract.id, revision: networkCounter(item.revision),
+    prefixes: own.prefixes, pools: own.pools, resolvers: own.resolvers, platformEndpoints: own.platformEndpoints, vpn: vpnOf(item.vpn) };
+  requireVpnProtected(authorityOf(setsWithRelay(plan), validationFrame), plan.vpn.controlPrefix);
+  return plan;
+});
+
+/**
+ * The protected authority a plan describes inside a producer's frame, digest included: the plan's
+ * sets with the VPN relay as the UDP platform endpoint every node dials. Both inputs are read before
+ * the digest is computed.
+ */
+export const composeRuntimeNetworkProtectedAuthority = async (
+  planValue: unknown, frameValue: unknown,
+): Promise<IRuntimeNetworkProtectedAuthority> => {
+  try {
+    const plan = snapshotRuntimeNetworkAddressPlan(planValue);
+    const frame = networkRecord(captureNetwork(frameValue), ['id', 'generation', 'controller', 'previous', 'egressAuthorities']);
+    const authority = authorityOf(setsWithRelay(plan), frame);
+    return { ...authority, digest: await computeRuntimeNetworkProtectedAuthorityDigest(authority) };
+  } catch { return failNetwork(); }
+};
+
+/** Whether the union of `prefixes`, which never overlap one another, covers every address of `prefix`. */
+const coveredBy = (prefixes: string[], prefix: string): boolean => {
+  const [first, last] = networkPrefixBounds(prefix);
+  const covered = prefixes.reduce((sum, candidate) => {
+    const [low, high] = networkPrefixBounds(candidate);
+    return sum + Math.max(0, Math.min(last, high) - Math.max(first, low) + 1);
+  }, 0);
+  return covered === last - first + 1;
+};
+
+/**
+ * The entries of `previous` that `next` does not hold exactly as they were. An entry changed under its
+ * old id counts: whatever still names that id would now reach something else.
+ */
+const removedOrChanged = <T>(previous: T[], next: T[]): T[] =>
+  previous.filter(item => !next.some(candidate => networkEqual(candidate, item)));
+
+const idsOf = (entries: Array<{ id: string }>): string[] => entries.map(entry => entry.id);
+
+/**
+ * The pure decision for replacing `previousValue`, the stored plan or null, with `nextValue` at the
+ * following revision. Leases and the managed VPN outlive a plan revision, so every pool stays exactly
+ * as it was, the protected address space only grows, and the VPN never changes. Resolvers and platform
+ * endpoints may go or change; `accepted` names every one that did. Equal content is `unchanged`:
+ * Cloudly writes nothing and the stored revision stands.
+ */
+export const admitRuntimeNetworkAddressPlanChange = (previousValue: unknown | null, nextValue: unknown): TRuntimeNetworkAddressPlanChange =>
+  networkSafe(() => {
+    const previous = previousValue === null ? null : snapshotRuntimeNetworkAddressPlan(previousValue);
+    const next = snapshotRuntimeNetworkAddressPlan(nextValue);
+    requireNetwork(next.revision === (previous?.revision ?? 0) + 1);
+    if (previous === null) return { status: 'accepted', removed: { resolverIds: [], platformEndpointIds: [] } };
+    if (networkEqual({ ...previous, revision: next.revision }, next)) return { status: 'unchanged' };
+    if (!networkEqual(previous.vpn, next.vpn)) return { status: 'refused', reason: 'plan-vpn-immutable' };
+    if (removedOrChanged(previous.pools, next.pools).length > 0) return { status: 'refused', reason: 'plan-pool-removed' };
+    if (!previous.prefixes.every(prefix => coveredBy(next.prefixes, prefix))) return { status: 'refused', reason: 'plan-prefix-shrunk' };
+    return { status: 'accepted', removed: { resolverIds: idsOf(removedOrChanged(previous.resolvers, next.resolvers)),
+      platformEndpointIds: idsOf(removedOrChanged(previous.platformEndpoints, next.platformEndpoints)) } };
+  });

package/ts/data/networkauthority.ts

@@ -1,14 +1,14 @@
 import type { TSha256Digest } from './immutableimage.js';
-import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+import type { IRuntimeAuthorityReference, IRuntimeController } from './runtimeassignment.js';
 import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+import { networkPrefix, networkPrivatePrefix } from '../private/networkcontract.js';
 
 /** Controller declaration; a digest does not authenticate completeness or activate a pool. */
-export interface IRuntimeNetworkProtectedAuthorityV1 {
-  schemaVersion: 1;
+export interface IRuntimeNetworkProtectedAuthority {
   id: string;
   generation: number;
-  controller: IRuntimeControllerV1;
-  previous: IRuntimeAuthorityReferenceV1 | null;
+  controller: IRuntimeController;
+  previous: IRuntimeAuthorityReference | null;
   /** Complete canonical IPv4 union, including all pools and protected endpoints. */
   prefixes: string[];
   pools: Array<{ id: string; purpose: 'workload' | 'transit'; prefix: string }>;
@@ -20,33 +20,32 @@ export interface IRuntimeNetworkProtectedAuthorityV1 {
   digest: TSha256Digest;
 }
 
-export interface IRuntimeNetworkHandoffPortRangeV1 {
+export interface IRuntimeNetworkHandoffPortRange {
   protocol: 'tcp' | 'udp';
   first: number;
   last: number;
 }
 
 /** Immutable allocation, retained unchanged while active or quarantined. No expiry implies reuse. */
-export interface IRuntimeNetworkHandoffLeaseV1 {
-  schemaVersion: 1;
+export interface IRuntimeNetworkHandoffLease {
   id: string;
   generation: number;
-  controller: IRuntimeControllerV1;
+  controller: IRuntimeController;
   nodeId: string;
   runtimeNamespace: string;
-  protectedAuthority: IRuntimeAuthorityReferenceV1;
+  protectedAuthority: IRuntimeAuthorityReference;
   /** Logical allocation incarnation, never a path, PID, inode, descriptor or native capability. */
   routerIncarnationId: string;
   transit: { poolId: string; prefix: string; routerAddress: string; hostAddress: string };
-  sourcePortRanges: IRuntimeNetworkHandoffPortRangeV1[];
+  sourcePortRanges: IRuntimeNetworkHandoffPortRange[];
   conntrackZone: number;
   conntrackLabel: string;
   digest: TSha256Digest;
 }
 
-export const runtimeNetworkAuthorityV1Contract = Object.freeze({
-  protectedDigestDomain: 'serve.zone/runtime-network-protected-authority-v1',
-  handoffDigestDomain: 'serve.zone/runtime-network-handoff-lease-v1',
+export const runtimeNetworkAuthorityContract = Object.freeze({
+  protectedDigestDomain: 'serve.zone/runtime-network-protected-authority',
+  handoffDigestDomain: 'serve.zone/runtime-network-handoff-lease',
   maximumPrefixes: 128,
   maximumPools: 64,
   maximumResolvers: 16,
@@ -100,12 +99,12 @@ const digest = (value: unknown): TSha256Digest => {
   requireValue(typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value));
   return value as TSha256Digest;
 };
-const controller = (value: unknown): IRuntimeControllerV1 => {
+const controller = (value: unknown): IRuntimeController => {
   const item = record(value, ['kind', 'id', 'epoch']);
   requireValue(item.kind === 'cloudly' || item.kind === 'onebox');
   return { kind: item.kind, id: id(item.id), epoch: id(item.epoch) };
 };
-const reference = (value: unknown): IRuntimeAuthorityReferenceV1 => {
+const reference = (value: unknown): IRuntimeAuthorityReference => {
   const item = record(value, ['id', 'generation', 'digest']);
   return { id: id(item.id), generation: integer(item.generation), digest: digest(item.digest) };
 };
@@ -129,14 +128,6 @@ const endpointAddress = (value: unknown): string => {
   requireValue(first > 0 && first < 224 && first !== 127);
   return result;
 };
-const prefix = (value: unknown): string => {
-  requireValue(typeof value === 'string' && value.length <= 18);
-  const parts = value.split('/');
-  requireValue(parts.length === 2 && /^(?:[0-9]|[12][0-9]|3[0-2])$/.test(parts[1]));
-  const base = numericAddress(address(parts[0])), width = 2 ** (32 - Number(parts[1]));
-  requireValue(base % width === 0);
-  return value;
-};
 const bounds = (value: string): [number, number] => {
   const [base, bits] = value.split('/'), first = numericAddress(base);
   return [first, first + 2 ** (32 - Number(bits)) - 1];
@@ -149,11 +140,6 @@ const overlaps = (left: string, right: string): boolean => {
   const [a, b] = bounds(left), [c, d] = bounds(right);
   return a <= d && c <= b;
 };
-const privatePrefix = (value: unknown): string => {
-  const result = prefix(value);
-  requireValue(['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'].some(range => contains(range, result)));
-  return result;
-};
 const nonoverlapping = (values: string[]): void => {
   for (let index = 0; index < values.length; index++) for (let other = 0; other < index; other++) {
     requireValue(!overlaps(values[index], values[other]));
@@ -163,22 +149,21 @@ const canonical = (value: unknown): string => canonicalizeStrictJson(value, fail
 const equals = (left: unknown, right: unknown): boolean => canonical(left) === canonical(right);
 
 /** Structural snapshot only. Complete inventory, signatures and activation barriers are caller-owned. */
-export const snapshotRuntimeNetworkProtectedAuthorityV1 = (value: unknown): IRuntimeNetworkProtectedAuthorityV1 => safe(() => {
-  const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'previous', 'prefixes',
+export const snapshotRuntimeNetworkProtectedAuthority = (value: unknown): IRuntimeNetworkProtectedAuthority => safe(() => {
+  const item = record(value, ['id', 'generation', 'controller', 'previous', 'prefixes',
     'pools', 'resolvers', 'platformEndpoints', 'egressAuthorities', 'digest']);
-  requireValue(item.schemaVersion === 1);
   const identity = id(item.id), generation = integer(item.generation);
   const previous = item.previous === null ? null : reference(item.previous);
   requireValue(generation === 1 ? previous === null : previous?.id === identity && previous.generation === generation - 1);
-  const prefixes = sorted(list(item.prefixes, runtimeNetworkAuthorityV1Contract.maximumPrefixes, prefix), value => value);
+  const prefixes = sorted(list(item.prefixes, runtimeNetworkAuthorityContract.maximumPrefixes, networkPrefix), value => value);
   requireValue(prefixes.length > 0);
   nonoverlapping(prefixes);
   const protectedPrefix = (value: string) => requireValue(prefixes.some(range => contains(range, value)));
-  const pools = sorted(list(item.pools, runtimeNetworkAuthorityV1Contract.maximumPools, value => {
+  const pools = sorted(list(item.pools, runtimeNetworkAuthorityContract.maximumPools, value => {
     const pool = record(value, ['id', 'purpose', 'prefix']);
     requireValue(pool.purpose === 'workload' || pool.purpose === 'transit');
-    const result: IRuntimeNetworkProtectedAuthorityV1['pools'][number] = {
-      id: id(pool.id), purpose: pool.purpose, prefix: privatePrefix(pool.prefix),
+    const result: IRuntimeNetworkProtectedAuthority['pools'][number] = {
+      id: id(pool.id), purpose: pool.purpose, prefix: networkPrivatePrefix(pool.prefix),
     };
     protectedPrefix(result.prefix);
     return result;
@@ -191,35 +176,34 @@ export const snapshotRuntimeNetworkProtectedAuthorityV1 = (value: unknown): IRun
     requireValue(pools.every(pool => !contains(pool.prefix, `${result.address}/32`)));
     return withProtocol ? { ...result, protocol: protocol(endpoint.protocol) } : result;
   };
-  const resolvers = sorted(list(item.resolvers, runtimeNetworkAuthorityV1Contract.maximumResolvers,
+  const resolvers = sorted(list(item.resolvers, runtimeNetworkAuthorityContract.maximumResolvers,
     value => readEndpoint(value, false)), value => value.id);
-  const platformEndpoints = sorted(list(item.platformEndpoints, runtimeNetworkAuthorityV1Contract.maximumPlatformEndpoints,
-    value => readEndpoint(value, true) as IRuntimeNetworkProtectedAuthorityV1['platformEndpoints'][number]), value => value.id);
+  const platformEndpoints = sorted(list(item.platformEndpoints, runtimeNetworkAuthorityContract.maximumPlatformEndpoints,
+    value => readEndpoint(value, true) as IRuntimeNetworkProtectedAuthority['platformEndpoints'][number]), value => value.id);
   const allEndpointKeys = [...resolvers.flatMap(value => ['tcp', 'udp'].map(transport => `${value.address}:${value.port}:${transport}`)),
     ...platformEndpoints.map(value => `${value.address}:${value.port}:${value.protocol}`)];
   requireValue(new Set(allEndpointKeys).size === allEndpointKeys.length);
-  const egressAuthorities = sorted(list(item.egressAuthorities, runtimeNetworkAuthorityV1Contract.maximumEgressAuthorities, value => {
+  const egressAuthorities = sorted(list(item.egressAuthorities, runtimeNetworkAuthorityContract.maximumEgressAuthorities, value => {
     const authority = record(value, ['nodeId', 'runtimeNamespace']);
     return { nodeId: id(authority.nodeId), runtimeNamespace: id(authority.runtimeNamespace) };
   }), value => canonical([value.nodeId, value.runtimeNamespace]));
   requireValue(egressAuthorities.length > 0);
-  return { schemaVersion: 1, id: identity, generation, controller: controller(item.controller), previous,
+  return { id: identity, generation, controller: controller(item.controller), previous,
     prefixes, pools, resolvers, platformEndpoints, egressAuthorities, digest: digest(item.digest) };
 });
 
-export const snapshotRuntimeNetworkHandoffLeaseV1 = (value: unknown): IRuntimeNetworkHandoffLeaseV1 => safe(() => {
-  const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
+export const snapshotRuntimeNetworkHandoffLease = (value: unknown): IRuntimeNetworkHandoffLease => safe(() => {
+  const item = record(value, ['id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
     'protectedAuthority', 'routerIncarnationId', 'transit', 'sourcePortRanges', 'conntrackZone', 'conntrackLabel', 'digest']);
-  requireValue(item.schemaVersion === 1);
   const transit = record(item.transit, ['poolId', 'prefix', 'routerAddress', 'hostAddress']);
-  const transitPrefix = privatePrefix(transit.prefix), [first, last] = bounds(transitPrefix);
+  const transitPrefix = networkPrivatePrefix(transit.prefix), [first, last] = bounds(transitPrefix);
   const routerAddress = endpointAddress(transit.routerAddress), hostAddress = endpointAddress(transit.hostAddress);
   requireValue(first !== last && routerAddress !== hostAddress);
   for (const value of [routerAddress, hostAddress]) {
     const number = numericAddress(value);
     requireValue(number >= first && number <= last && (last - first === 1 || (number !== first && number !== last)));
   }
-  const sourcePortRanges = list(item.sourcePortRanges, runtimeNetworkAuthorityV1Contract.maximumPortRanges, value => {
+  const sourcePortRanges = list(item.sourcePortRanges, runtimeNetworkAuthorityContract.maximumPortRanges, value => {
     const range = record(value, ['protocol', 'first', 'last']);
     const result = { protocol: protocol(range.protocol), first: integer(range.first, 65535), last: integer(range.last, 65535) };
     requireValue(result.first <= result.last);
@@ -232,7 +216,7 @@ export const snapshotRuntimeNetworkHandoffLeaseV1 = (value: unknown): IRuntimeNe
   }
   requireValue(typeof item.conntrackLabel === 'string' && /^[a-f0-9]{32}$/.test(item.conntrackLabel)
     && item.conntrackLabel !== '0'.repeat(32));
-  return { schemaVersion: 1, id: id(item.id), generation: integer(item.generation), controller: controller(item.controller),
+  return { id: id(item.id), generation: integer(item.generation), controller: controller(item.controller),
     nodeId: id(item.nodeId), runtimeNamespace: id(item.runtimeNamespace), protectedAuthority: reference(item.protectedAuthority),
     routerIncarnationId: id(item.routerIncarnationId), transit: { poolId: id(transit.poolId), prefix: transitPrefix, routerAddress, hostAddress },
     sourcePortRanges, conntrackZone: integer(item.conntrackZone, 65535), conntrackLabel: item.conntrackLabel, digest: digest(item.digest) };
@@ -242,19 +226,19 @@ const computeDigest = async (domain: string, value: { digest: TSha256Digest }):
   const { digest: omitted, ...payload } = value;
   return `sha256:${await createCanonicalJsonSha256Hex(canonical({ domain, payload }), fail)}`;
 };
-export const computeRuntimeNetworkProtectedAuthorityV1Digest = (value: IRuntimeNetworkProtectedAuthorityV1): Promise<TSha256Digest> =>
-  computeDigest(runtimeNetworkAuthorityV1Contract.protectedDigestDomain, snapshotRuntimeNetworkProtectedAuthorityV1(value));
-export const computeRuntimeNetworkHandoffLeaseV1Digest = (value: IRuntimeNetworkHandoffLeaseV1): Promise<TSha256Digest> =>
-  computeDigest(runtimeNetworkAuthorityV1Contract.handoffDigestDomain, snapshotRuntimeNetworkHandoffLeaseV1(value));
+export const computeRuntimeNetworkProtectedAuthorityDigest = (value: IRuntimeNetworkProtectedAuthority): Promise<TSha256Digest> =>
+  computeDigest(runtimeNetworkAuthorityContract.protectedDigestDomain, snapshotRuntimeNetworkProtectedAuthority(value));
+export const computeRuntimeNetworkHandoffLeaseDigest = (value: IRuntimeNetworkHandoffLease): Promise<TSha256Digest> =>
+  computeDigest(runtimeNetworkAuthorityContract.handoffDigestDomain, snapshotRuntimeNetworkHandoffLease(value));
 
 /** Detached, digest-verified allocation binding. Does not establish pool activation or live link identity. */
-export const bindRuntimeNetworkHandoffLeaseV1 = async (leaseValue: unknown, authorityValue: unknown): Promise<{
-  lease: IRuntimeNetworkHandoffLeaseV1; authority: IRuntimeNetworkProtectedAuthorityV1;
+export const bindRuntimeNetworkHandoffLease = async (leaseValue: unknown, authorityValue: unknown): Promise<{
+  lease: IRuntimeNetworkHandoffLease; authority: IRuntimeNetworkProtectedAuthority;
 }> => {
-  const lease = snapshotRuntimeNetworkHandoffLeaseV1(leaseValue);
-  const authority = snapshotRuntimeNetworkProtectedAuthorityV1(authorityValue);
-  requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
-  requireValue(authority.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(authority));
+  const lease = snapshotRuntimeNetworkHandoffLease(leaseValue);
+  const authority = snapshotRuntimeNetworkProtectedAuthority(authorityValue);
+  requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseDigest(lease));
+  requireValue(authority.digest === await computeRuntimeNetworkProtectedAuthorityDigest(authority));
   requireValue(equals(lease.controller, authority.controller)
     && equals(lease.protectedAuthority, { id: authority.id, generation: authority.generation, digest: authority.digest })
     && authority.egressAuthorities.some(value => value.nodeId === lease.nodeId && value.runtimeNamespace === lease.runtimeNamespace));
@@ -268,12 +252,12 @@ export const bindRuntimeNetworkHandoffLeaseV1 = async (leaseValue: unknown, auth
  * The owning transactional ledger must supply its complete history and serialize reservations.
  * Namespace replacement, an empty CT dump or process exit never removes an entry from this set.
  */
-export const snapshotRuntimeNetworkHandoffLedgerV1 = async (value: unknown): Promise<IRuntimeNetworkHandoffLeaseV1[]> => {
-  const leases = safe(() => list(value, runtimeNetworkAuthorityV1Contract.maximumRetainedHandoffLeases,
-    snapshotRuntimeNetworkHandoffLeaseV1));
+export const snapshotRuntimeNetworkHandoffLedger = async (value: unknown): Promise<IRuntimeNetworkHandoffLease[]> => {
+  const leases = safe(() => list(value, runtimeNetworkAuthorityContract.maximumRetainedHandoffLeases,
+    snapshotRuntimeNetworkHandoffLease));
   for (let index = 0; index < leases.length; index++) {
     const lease = leases[index];
-    requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
+    requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseDigest(lease));
     for (let other = 0; other < index; other++) {
       const previous = leases[other];
       requireValue(lease.nodeId === previous.nodeId && equals(lease.controller, previous.controller));

package/ts/data/networkcredential.ts

@@ -1,19 +1,19 @@
-import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
-import { snapshotRuntimeSessionBindingV1, type IRuntimeSessionBindingV1 } from './runtimesession.js';
-import { validateRuntimeNetworkProjectionV1, type IRuntimeNetworkProjectionV1 } from './networkprojection.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import { snapshotRuntimeSessionBinding, type IRuntimeSessionBinding } from './runtimesession.js';
+import { validateRuntimeNetworkProjection, type IRuntimeNetworkProjection } from './networkprojection.js';
 import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { captureNetwork, failNetwork, networkCounter, networkEffectiveDnsWindow, networkEqual, networkId, networkIpv4,
   networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
 
-export interface IGetRuntimeManagedVpnCredentialRequestV1 {
-  session: IRuntimeSessionBindingV1;
-  projection: IRuntimeAuthorityReferenceV1;
+export interface IGetRuntimeManagedVpnCredentialRequest {
+  session: IRuntimeSessionBinding;
+  projection: IRuntimeAuthorityReference;
 }
 
 /** Secret response over the current authenticated physical peer only. Never
  * persist, hash, log, or include it in a signed network projection. The native
  * Noise owner validates and uses the keys; these shapes confer no TUN readiness. */
-export interface IGetRuntimeManagedVpnCredentialResponseV1 extends IGetRuntimeManagedVpnCredentialRequestV1 {
+export interface IGetRuntimeManagedVpnCredentialResponse extends IGetRuntimeManagedVpnCredentialRequest {
   transport: 'quic';
   relay: { id: string; address: string; port: number };
   authorityId: string;
@@ -36,35 +36,35 @@ const key = (value: unknown): string => {
   return value;
 };
 
-export const snapshotGetRuntimeManagedVpnCredentialRequestV1 = (value: unknown): IGetRuntimeManagedVpnCredentialRequestV1 => networkSafe(() => {
+export const snapshotGetRuntimeManagedVpnCredentialRequest = (value: unknown): IGetRuntimeManagedVpnCredentialRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'projection']);
-  return { session: snapshotRuntimeSessionBindingV1(item.session), projection: networkReference(item.projection) };
+  return { session: snapshotRuntimeSessionBinding(item.session), projection: networkReference(item.projection) };
 });
 
-export const snapshotGetRuntimeManagedVpnCredentialResponseV1 = (value: unknown): IGetRuntimeManagedVpnCredentialResponseV1 => networkSafe(() => {
+export const snapshotGetRuntimeManagedVpnCredentialResponse = (value: unknown): IGetRuntimeManagedVpnCredentialResponse => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'projection', 'transport', 'relay', 'authorityId',
     'serverPublicKey', 'clientPublicKey', 'clientPrivateKey', 'expiresAt']);
   const relay = networkRecord(item.relay, ['id', 'address', 'port']); requireNetwork(item.transport === 'quic');
-  return { session: snapshotRuntimeSessionBindingV1(item.session), projection: networkReference(item.projection), transport: 'quic',
+  return { session: snapshotRuntimeSessionBinding(item.session), projection: networkReference(item.projection), transport: 'quic',
     relay: { id: networkId(relay.id), address: networkIpv4(relay.address), port: networkCounter(relay.port, 65535) },
     authorityId: networkId(item.authorityId), serverPublicKey: key(item.serverPublicKey), clientPublicKey: key(item.clientPublicKey),
     clientPrivateKey: key(item.clientPrivateKey), expiresAt: networkCounter(item.expiresAt) };
 });
 
-const bindRequest = (request: IGetRuntimeManagedVpnCredentialRequestV1,
-  projection: IRuntimeNetworkProjectionV1, trusted: IRuntimeSessionBindingV1): void => {
+const bindRequest = (request: IGetRuntimeManagedVpnCredentialRequest,
+  projection: IRuntimeNetworkProjection, trusted: IRuntimeSessionBinding): void => {
   requireNetwork(networkEqual(request.session, trusted) && networkEqual(request.projection, networkReferenceOf(projection))
     && networkSameScope(projection, trusted) && projection.handoff);
 };
 
 /** Content binding only. The caller must resolve the exact current projection
  * and authenticate/fence the current physical peer before and after native work. */
-export const bindGetRuntimeManagedVpnCredentialRequestV1 = async (value: unknown, projectionValue: unknown,
-  trustedSessionValue: unknown): Promise<IGetRuntimeManagedVpnCredentialRequestV1> => {
+export const bindGetRuntimeManagedVpnCredentialRequest = async (value: unknown, projectionValue: unknown,
+  trustedSessionValue: unknown): Promise<IGetRuntimeManagedVpnCredentialRequest> => {
   try {
-    const request = snapshotGetRuntimeManagedVpnCredentialRequestV1(value);
-    const trusted = snapshotRuntimeSessionBindingV1(trustedSessionValue);
-    const projection = await validateRuntimeNetworkProjectionV1(projectionValue);
+    const request = snapshotGetRuntimeManagedVpnCredentialRequest(value);
+    const trusted = snapshotRuntimeSessionBinding(trustedSessionValue);
+    const projection = await validateRuntimeNetworkProjection(projectionValue);
     bindRequest(request, projection, trusted);
     return request;
   } catch { return failNetwork(); }
@@ -76,15 +76,15 @@ export const bindGetRuntimeManagedVpnCredentialRequestV1 = async (value: unknown
  * projection, or null; this helper verifies no signature. Time is caller-qualified;
  * this helper does not sample a clock, authenticate a transport, admit policy or
  * prove a running managed connection. */
-export const bindGetRuntimeManagedVpnCredentialResponseV1 = async (value: unknown, requestValue: unknown,
+export const bindGetRuntimeManagedVpnCredentialResponse = async (value: unknown, requestValue: unknown,
   projectionValue: unknown, trustedSessionValue: unknown, nowValue: unknown,
-  renewalValue: unknown | null = null): Promise<IGetRuntimeManagedVpnCredentialResponseV1> => {
+  renewalValue: unknown | null = null): Promise<IGetRuntimeManagedVpnCredentialResponse> => {
   try {
-    const response = snapshotGetRuntimeManagedVpnCredentialResponseV1(value);
-    const request = snapshotGetRuntimeManagedVpnCredentialRequestV1(requestValue);
-    const trusted = snapshotRuntimeSessionBindingV1(trustedSessionValue), now = networkCounter(nowValue);
+    const response = snapshotGetRuntimeManagedVpnCredentialResponse(value);
+    const request = snapshotGetRuntimeManagedVpnCredentialRequest(requestValue);
+    const trusted = snapshotRuntimeSessionBinding(trustedSessionValue), now = networkCounter(nowValue);
     const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
-    const projection = await validateRuntimeNetworkProjectionV1(projectionValue);
+    const projection = await validateRuntimeNetworkProjection(projectionValue);
     const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
     const window = networkEffectiveDnsWindow(projection, renewal);
     bindRequest(request, projection, trusted);

package/ts/data/networkdelivery.ts

@@ -1,29 +1,29 @@
-import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
-import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
-import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
-import type { IRuntimeNetworkSigningAuthorityV1, ISignedRuntimeNetworkProjectionV1 } from './networksigning.js';
-import { snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './networksigning.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeSessionBinding } from './runtimesession.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
+import type { IRuntimeNetworkSigningAuthority, ISignedRuntimeNetworkProjection } from './networksigning.js';
+import { snapshotRuntimeNetworkSigningAuthority, snapshotSignedRuntimeNetworkProjection } from './networksigning.js';
 import type { IRuntimeNetworkDnsLeaseRenewalReference, ISignedRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { getRuntimeNetworkDnsLeaseRenewalReference, snapshotRuntimeNetworkDnsLeaseRenewal,
   snapshotRuntimeNetworkDnsLeaseRenewalReference, snapshotSignedRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope,
   requireNetwork } from '../private/networkcontract.js';
 
-export interface IApplyRuntimeNetworkSigningAuthorityRequestV1 {
-  session: IRuntimeSessionBindingV1;
-  authority: IRuntimeNetworkSigningAuthorityV1;
+export interface IApplyRuntimeNetworkSigningAuthorityRequest {
+  session: IRuntimeSessionBinding;
+  authority: IRuntimeNetworkSigningAuthority;
 }
-export interface IApplyRuntimeNetworkProjectionRequestV1 {
-  session: IRuntimeSessionBindingV1;
-  signed: ISignedRuntimeNetworkProjectionV1;
+export interface IApplyRuntimeNetworkProjectionRequest {
+  session: IRuntimeSessionBinding;
+  signed: ISignedRuntimeNetworkProjection;
 }
 /** Durable admission only. No packet, DNS, pool-activation, fencing or readiness assertion. */
-export interface IApplyRuntimeNetworkAuthorityResponseV1 {
+export interface IApplyRuntimeNetworkAuthorityResponse {
   status: 'accepted' | 'replay';
-  authority: IRuntimeAuthorityReferenceV1;
+  authority: IRuntimeAuthorityReference;
 }
 export interface IApplyRuntimeNetworkDnsLeaseRenewalRequest {
-  session: IRuntimeSessionBindingV1;
+  session: IRuntimeSessionBinding;
   signed: ISignedRuntimeNetworkDnsLeaseRenewal;
 }
 /** Durable admission only. It does not assert that the node converted the window or serves DNS. */
@@ -36,22 +36,22 @@ const admissionStatus = (value: unknown): 'accepted' | 'replay' => {
   requireNetwork(value === 'accepted' || value === 'replay'); return value;
 };
 
-export const snapshotApplyRuntimeNetworkSigningAuthorityRequestV1 = (value: unknown): IApplyRuntimeNetworkSigningAuthorityRequestV1 => networkSafe(() => {
+export const snapshotApplyRuntimeNetworkSigningAuthorityRequest = (value: unknown): IApplyRuntimeNetworkSigningAuthorityRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'authority']);
-  return { session: snapshotRuntimeSessionBindingV1(item.session), authority: snapshotRuntimeNetworkSigningAuthorityV1(item.authority) };
+  return { session: snapshotRuntimeSessionBinding(item.session), authority: snapshotRuntimeNetworkSigningAuthority(item.authority) };
 });
-export const snapshotApplyRuntimeNetworkProjectionRequestV1 = (value: unknown): IApplyRuntimeNetworkProjectionRequestV1 => networkSafe(() => {
+export const snapshotApplyRuntimeNetworkProjectionRequest = (value: unknown): IApplyRuntimeNetworkProjectionRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'signed']);
-  return { session: snapshotRuntimeSessionBindingV1(item.session), signed: snapshotSignedRuntimeNetworkProjectionV1(item.signed) };
+  return { session: snapshotRuntimeSessionBinding(item.session), signed: snapshotSignedRuntimeNetworkProjection(item.signed) };
 });
-export const snapshotApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown): IApplyRuntimeNetworkAuthorityResponseV1 => networkSafe(() => {
+export const snapshotApplyRuntimeNetworkAuthorityResponse = (value: unknown): IApplyRuntimeNetworkAuthorityResponse => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['status', 'authority']);
   return { status: admissionStatus(item.status), authority: networkReference(item.authority) };
 });
 
 export const snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest = (value: unknown): IApplyRuntimeNetworkDnsLeaseRenewalRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'signed']);
-  return { session: snapshotRuntimeSessionBindingV1(item.session), signed: snapshotSignedRuntimeNetworkDnsLeaseRenewal(item.signed) };
+  return { session: snapshotRuntimeSessionBinding(item.session), signed: snapshotSignedRuntimeNetworkDnsLeaseRenewal(item.signed) };
 });
 export const snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse = (value: unknown): IApplyRuntimeNetworkDnsLeaseRenewalResponse => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['status', 'renewal']);
@@ -59,22 +59,22 @@ export const snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse = (value: unknow
 });
 
 /** trustedSessionValue must come from the receiving CURRENT physical connection. */
-export const bindApplyRuntimeNetworkSigningAuthorityRequestV1 = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkSigningAuthorityRequestV1 => networkSafe(() => {
-  const request = snapshotApplyRuntimeNetworkSigningAuthorityRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+export const bindApplyRuntimeNetworkSigningAuthorityRequest = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkSigningAuthorityRequest => networkSafe(() => {
+  const request = snapshotApplyRuntimeNetworkSigningAuthorityRequest(value), session = snapshotRuntimeSessionBinding(trustedSessionValue);
   requireNetwork(networkEqual(request.session, session) && networkEqual(request.authority.controller, session.controller));
   return request;
 });
 
 /** Content binding only. Verify signature with stored trust and atomically fence admission. */
-export const bindApplyRuntimeNetworkProjectionRequestV1 = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkProjectionRequestV1 => networkSafe(() => {
-  const request = snapshotApplyRuntimeNetworkProjectionRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+export const bindApplyRuntimeNetworkProjectionRequest = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkProjectionRequest => networkSafe(() => {
+  const request = snapshotApplyRuntimeNetworkProjectionRequest(value), session = snapshotRuntimeSessionBinding(trustedSessionValue);
   requireNetwork(networkEqual(request.session, session) && networkSameScope(request.signed.projection, session));
   return request;
 });
 
 /** Compare ACK with the exact SENT key or projection reference, never with a response-derived value. */
-export const bindApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown, sentReferenceValue: unknown): IApplyRuntimeNetworkAuthorityResponseV1 => networkSafe(() => {
-  const response = snapshotApplyRuntimeNetworkAuthorityResponseV1(value);
+export const bindApplyRuntimeNetworkAuthorityResponse = (value: unknown, sentReferenceValue: unknown): IApplyRuntimeNetworkAuthorityResponse => networkSafe(() => {
+  const response = snapshotApplyRuntimeNetworkAuthorityResponse(value);
   const expected = networkReference(captureNetwork(sentReferenceValue));
   requireNetwork(networkEqual(response.authority, networkReferenceOf(expected)));
   return response;
@@ -87,7 +87,7 @@ export const bindApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown, sentR
  * stored trust, then admit and fence atomically.
  */
 export const bindApplyRuntimeNetworkDnsLeaseRenewalRequest = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkDnsLeaseRenewalRequest => networkSafe(() => {
-  const request = snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+  const request = snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest(value), session = snapshotRuntimeSessionBinding(trustedSessionValue);
   requireNetwork(networkEqual(request.session, session) && networkSameScope(request.signed.renewal, session));
   return request;
 });