@serve.zone/interfaces 31.8.0 → 32.0.0

package/ts/data/networkprojection.ts

@@ -1,21 +1,21 @@
 import type { TSha256Digest } from './immutableimage.js';
-import type { IRuntimeAssignmentReferenceV1, IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
-import { snapshotRuntimeAssignmentV1, validateRuntimeAssignmentV1 } from './runtimeassignment.js';
-import type { IRuntimeNetworkHandoffLeaseV1, IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
-import { bindRuntimeNetworkHandoffLeaseV1, computeRuntimeNetworkProtectedAuthorityV1Digest,
-  snapshotRuntimeNetworkHandoffLeaseV1, snapshotRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
-import type { IPrivateNetworkV1, IServicePrivateNetworksV1, IServicePrivateNetworkDnsPolicyV1 } from './privatenetwork.js';
+import type { IRuntimeAssignmentReference, IRuntimeAuthorityReference, IRuntimeController } from './runtimeassignment.js';
+import { snapshotRuntimeAssignment, validateRuntimeAssignment } from './runtimeassignment.js';
+import type { IRuntimeNetworkHandoffLease, IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import { bindRuntimeNetworkHandoffLease, computeRuntimeNetworkProtectedAuthorityDigest,
+  snapshotRuntimeNetworkHandoffLease, snapshotRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import type { IPrivateNetwork, IServicePrivateNetworks, IServicePrivateNetworkDnsPolicy } from './privatenetwork.js';
 import { routerPacketGrantsOf, snapshotRouterProjection,
-  type IRuntimeNetworkRouterPacketGrantV1, type IRuntimeNetworkRouterProjectionV1 } from './networkrouter.js';
-import { buildPrivateNetworkFqdnV1, composeServicePrivateNetworkDnsPolicyV1,
-  snapshotPrivateNetworkV1, snapshotServicePrivateNetworksV1 } from './privatenetwork.js';
+  type IRuntimeNetworkRouterPacketGrant, type IRuntimeNetworkRouterProjection } from './networkrouter.js';
+import { buildPrivateNetworkFqdn, composeServicePrivateNetworkDnsPolicy,
+  snapshotPrivateNetwork, snapshotServicePrivateNetworks } from './privatenetwork.js';
 import { captureNetwork, failNetwork, networkCanonical, networkContains, networkCounter, networkDigest,
   networkDnsWindow, networkEqual, networkHash, networkId, networkIpv4, networkIpv4Number, networkList, networkMaximumDnsLeaseMs,
   networkOverlaps, networkPrefixBounds, networkRecord, networkReference, networkReferenceOf, networkRevision, networkSafe,
   networkSameScope, networkScope, networkSorted, requireNetwork } from '../private/networkcontract.js';
 
-export interface IRuntimeNetworkNodeScopeV1 {
-  controller: IRuntimeControllerV1;
+export interface IRuntimeNetworkNodeScope {
+  controller: IRuntimeController;
   nodeId: string;
   runtimeNamespace: string;
 }
@@ -31,8 +31,7 @@ export interface IRuntimeNetworkDnsWindow {
 }
 
 /** Immutable per-attempt address material. Membership and projection revisions are independent. */
-export interface IRuntimeNetworkWorkloadLeaseV1 extends IRuntimeNetworkNodeScopeV1 {
-  schemaVersion: 1;
+export interface IRuntimeNetworkWorkloadLease extends IRuntimeNetworkNodeScope {
   id: string;
   /** Allocation incarnation, not a mutable desired-state revision. */
   generation: number;
@@ -41,7 +40,7 @@ export interface IRuntimeNetworkWorkloadLeaseV1 extends IRuntimeNetworkNodeScope
   serviceId: string;
   replicaId: string;
   attemptId: string;
-  protectedAuthority: IRuntimeAuthorityReferenceV1;
+  protectedAuthority: IRuntimeAuthorityReference;
   routerIncarnationId: string;
   ipv4: {
     poolId: string;
@@ -61,7 +60,7 @@ export interface IRuntimeNetworkWorkloadLeaseV1 extends IRuntimeNetworkNodeScope
  * One node-level published port for a workload. Mirrors `IAppStorePublishedPort`
  * without range fields: the runtime publishes exactly one host port per entry.
  */
-export interface IRuntimeNetworkPublishedPortV1 {
+export interface IRuntimeNetworkPublishedPort {
   protocol: 'tcp' | 'udp';
   /** 1..65535 and unique per node across the projection for its protocol. */
   hostPort: number;
@@ -77,49 +76,47 @@ export interface IRuntimeNetworkPublishedPortV1 {
    * The Cloudly decision that authorized this port. It is covered by the
    * projection signature, and a published port without it cannot exist.
    */
-  authorization: IRuntimeAuthorityReferenceV1;
+  authorization: IRuntimeAuthorityReference;
 }
 
 /**
- * Caller-authored published-port request. v1 carries no `hostIp` (an omitted
+ * Caller-authored published-port request. It carries no `hostIp` (an omitted
  * address means the node uplink) and no ranges: exactly one host port per entry.
  * The `authorization` reference of the resulting projection entry is derived by
  * Cloudly from the policy revision and digest, never supplied by the caller.
  */
-export interface IRuntimeNetworkPublishedPortRequestV1 {
+export interface IRuntimeNetworkPublishedPortRequest {
   protocol: 'tcp' | 'udp';
   hostPort: number;
   targetPort: number;
 }
 
 /** Current authorized published-port policy for one service. */
-export interface IServicePublishedPortsV1 {
-  schemaVersion: 1;
+export interface IServicePublishedPorts {
   organizationId: string;
   serviceId: string;
   revision: number;
   /** Sorted by protocol and host port. Empty means the service publishes nothing. */
-  publishedPorts: IRuntimeNetworkPublishedPortRequestV1[];
+  publishedPorts: IRuntimeNetworkPublishedPortRequest[];
 }
 
 /** Exact desired policy. Node-level host-port placement remains Cloudly's decision. */
-export interface ISetServicePublishedPortsV1 {
-  schemaVersion: 1;
+export interface ISetServicePublishedPorts {
   organizationId: string;
   serviceId: string;
   /** Retain the exact body and this identifier across retries. */
   mutationId: string;
   /** null means the service has never had a published-port document; not an empty list. */
   expectedRevision: number | null;
-  publishedPorts: IRuntimeNetworkPublishedPortRequestV1[];
+  publishedPorts: IRuntimeNetworkPublishedPortRequest[];
 }
 
 /** Controller-owned readiness evidence. A signature does not prove this evidence's provenance. */
-export interface IRuntimeNetworkEndpointV1 {
-  lease: IRuntimeNetworkWorkloadLeaseV1;
+export interface IRuntimeNetworkEndpoint {
+  lease: IRuntimeNetworkWorkloadLease;
   ready: boolean;
   observation: {
-    assignment: IRuntimeAssignmentReferenceV1;
+    assignment: IRuntimeAssignmentReference;
     reporterSessionId: string;
     sequence: number;
     digest: TSha256Digest;
@@ -128,53 +125,55 @@ export interface IRuntimeNetworkEndpointV1 {
   publicEgress: boolean;
   platformEndpointIds: string[];
   /** Sorted by protocol and host port. Absent publishes nothing; a present member is never empty. */
-  publishedPorts?: IRuntimeNetworkPublishedPortV1[];
+  publishedPorts?: IRuntimeNetworkPublishedPort[];
 }
 
 /** Exact directed grant identity; receiver-owned realization resolves the lease to kernel facts. */
-export interface IRuntimeNetworkPacketGrantV1 {
-  source: IRuntimeAuthorityReferenceV1;
+export interface IRuntimeNetworkPacketGrant {
+  source: IRuntimeAuthorityReference;
   destination:
-    | { kind: 'workload'; lease: IRuntimeAuthorityReferenceV1 }
+    | { kind: 'workload'; lease: IRuntimeAuthorityReference }
     | { kind: 'public' }
     | { kind: 'platform'; id: string; address: string; protocol: 'tcp' | 'udp'; port: number };
 }
 
-export interface IRuntimeNetworkProjectionV1 extends IRuntimeNetworkNodeScopeV1 {
-  schemaVersion: 1;
+export interface IRuntimeNetworkProjection extends IRuntimeNetworkNodeScope {
   id: string;
   generation: number;
-  previous: IRuntimeAuthorityReferenceV1 | null;
-  protectedAuthority: IRuntimeNetworkProtectedAuthorityV1;
+  previous: IRuntimeAuthorityReference | null;
+  protectedAuthority: IRuntimeNetworkProtectedAuthority;
   /** Exact historical authorities needed to authenticate retained allocation material. */
-  allocationAuthorities: IRuntimeNetworkProtectedAuthorityV1[];
-  handoff: IRuntimeNetworkHandoffLeaseV1 | null;
+  allocationAuthorities: IRuntimeNetworkProtectedAuthority[];
+  handoff: IRuntimeNetworkHandoffLease | null;
   /** COMPLETE relevant definitions, including declared names with no ready replicas. */
-  networks: IPrivateNetworkV1[];
-  memberships: IServicePrivateNetworksV1[];
-  endpoints: IRuntimeNetworkEndpointV1[];
+  networks: IPrivateNetwork[];
+  memberships: IServicePrivateNetworks[];
+  endpoints: IRuntimeNetworkEndpoint[];
   dns: IRuntimeNetworkDnsWindow;
   /** Explicit denial intent. Carry until the exact predecessor's application is proven. */
-  withdrawals: IRuntimeNetworkPacketGrantV1[];
-  retiredLeases: IRuntimeAuthorityReferenceV1[];
-  retiredHandoffs: IRuntimeAuthorityReferenceV1[];
-  /** Absent in existing persisted V1 projections: no router-origin authority. */
-  router?: IRuntimeNetworkRouterProjectionV1;
+  withdrawals: IRuntimeNetworkPacketGrant[];
+  retiredLeases: IRuntimeAuthorityReference[];
+  retiredHandoffs: IRuntimeAuthorityReference[];
+  /**
+   * Omitted when the issuer selects no router-origin egress; its absence keeps the
+   * projection's canonical bytes and grants no router-origin flows.
+   */
+  router?: IRuntimeNetworkRouterProjection;
   digest: TSha256Digest;
 }
 
-export interface IRuntimeNetworkDnsViewV1 {
-  source: IRuntimeAuthorityReferenceV1;
+export interface IRuntimeNetworkDnsView {
+  source: IRuntimeAuthorityReference;
   sourceAddress: string;
   dnsServer: string;
-  policy: IServicePrivateNetworkDnsPolicyV1;
+  policy: IServicePrivateNetworkDnsPolicy;
   /** Sorted complete A sets; [] is declared NODATA, never an omitted name. AAAA is NODATA. */
   records: Array<{ name: string; addresses: string[] }>;
 }
 
-export const runtimeNetworkProjectionV1Contract = Object.freeze({
-  workloadDigestDomain: 'serve.zone/runtime-network-workload-lease-v1',
-  projectionDigestDomain: 'serve.zone/runtime-network-projection-v1',
+export const runtimeNetworkProjectionContract = Object.freeze({
+  workloadDigestDomain: 'serve.zone/runtime-network-workload-lease',
+  projectionDigestDomain: 'serve.zone/runtime-network-projection',
   maximumCanonicalBytes: 917_504,
   maximumAllocationAuthorities: 16,
   maximumNetworks: 128,
@@ -193,19 +192,18 @@ export const runtimeNetworkProjectionV1Contract = Object.freeze({
 } as const);
 
 const ownerKey = (value: { organizationId: string; serviceId: string }): string => networkCanonical([value.organizationId, value.serviceId]);
-const attemptKey = (value: IRuntimeNetworkWorkloadLeaseV1): string =>
+const attemptKey = (value: IRuntimeNetworkWorkloadLease): string =>
   networkCanonical([value.organizationId, value.serviceId, value.replicaId, value.attemptId]);
-const refKey = (value: IRuntimeAuthorityReferenceV1): string => networkCanonical(networkReferenceOf(value));
-const sortedReferences = (value: unknown): IRuntimeAuthorityReferenceV1[] =>
+const refKey = (value: IRuntimeAuthorityReference): string => networkCanonical(networkReferenceOf(value));
+const sortedReferences = (value: unknown): IRuntimeAuthorityReference[] =>
   networkSorted(networkList(value, 256, networkReference), refKey);
 
-export const snapshotRuntimeNetworkNodeScopeV1 = (value: unknown): IRuntimeNetworkNodeScopeV1 => networkSafe(() =>
+export const snapshotRuntimeNetworkNodeScope = (value: unknown): IRuntimeNetworkNodeScope => networkSafe(() =>
   networkScope(networkRecord(captureNetwork(value), ['controller', 'nodeId', 'runtimeNamespace'])));
 
-export const snapshotRuntimeNetworkWorkloadLeaseV1 = (value: unknown): IRuntimeNetworkWorkloadLeaseV1 => networkSafe(() => {
-  const item = networkRecord(captureNetwork(value), ['schemaVersion', 'id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
+export const snapshotRuntimeNetworkWorkloadLease = (value: unknown): IRuntimeNetworkWorkloadLease => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
     'organizationId', 'assignmentId', 'serviceId', 'replicaId', 'attemptId', 'protectedAuthority', 'routerIncarnationId', 'ipv4', 'dnsServer', 'digest']);
-  requireNetwork(item.schemaVersion === 1);
   const ip = networkRecord(item.ipv4, ['poolId', 'linkSubnet', 'address', 'sourcePrefix', 'gateway']);
   requireNetwork(typeof ip.linkSubnet === 'string' && ip.linkSubnet.length <= 18);
   const pieces = ip.linkSubnet.split('/');
@@ -220,17 +218,17 @@ export const snapshotRuntimeNetworkWorkloadLeaseV1 = (value: unknown): IRuntimeN
     requireNetwork(number >= low && number <= high && (high - low === 1 || (number !== low && number !== high)));
   }
   requireNetwork(item.dnsServer === gateway);
-  return { schemaVersion: 1, id: networkId(item.id), generation: networkCounter(item.generation), ...networkScope(item),
+  return { id: networkId(item.id), generation: networkCounter(item.generation), ...networkScope(item),
     organizationId: networkId(item.organizationId), assignmentId: networkId(item.assignmentId), serviceId: networkId(item.serviceId),
     replicaId: networkId(item.replicaId), attemptId: networkId(item.attemptId), protectedAuthority: networkReference(item.protectedAuthority),
     routerIncarnationId: networkId(item.routerIncarnationId), ipv4: { poolId: networkId(ip.poolId), linkSubnet: ip.linkSubnet,
       address, sourcePrefix: ip.sourcePrefix, gateway }, dnsServer: gateway, digest: networkDigest(item.digest) };
 });
 
-export const computeRuntimeNetworkWorkloadLeaseV1Digest = (value: IRuntimeNetworkWorkloadLeaseV1): Promise<TSha256Digest> =>
-  networkHash(runtimeNetworkProjectionV1Contract.workloadDigestDomain, snapshotRuntimeNetworkWorkloadLeaseV1(value));
+export const computeRuntimeNetworkWorkloadLeaseDigest = (value: IRuntimeNetworkWorkloadLease): Promise<TSha256Digest> =>
+  networkHash(runtimeNetworkProjectionContract.workloadDigestDomain, snapshotRuntimeNetworkWorkloadLease(value));
 
-const packetGrant = (value: unknown): IRuntimeNetworkPacketGrantV1 => {
+const packetGrant = (value: unknown): IRuntimeNetworkPacketGrant => {
   const item = networkRecord(value, ['source', 'destination']);
   requireNetwork(item.destination !== null && typeof item.destination === 'object');
   const kind = (item.destination as Record<string, unknown>).kind;
@@ -251,7 +249,7 @@ const packetGrant = (value: unknown): IRuntimeNetworkPacketGrantV1 => {
 };
 const publishedPortKey = (value: { protocol: 'tcp' | 'udp'; hostPort: number }): string =>
   `${value.protocol}/${String(value.hostPort).padStart(5, '0')}`;
-const publishedPort = (value: unknown): IRuntimeNetworkPublishedPortV1 => {
+const publishedPort = (value: unknown): IRuntimeNetworkPublishedPort => {
   const hasHostIp = value !== null && typeof value === 'object' && Object.hasOwn(value, 'hostIp');
   const item = networkRecord(value, ['protocol', 'hostPort', 'targetPort', 'authorization', ...(hasHostIp ? ['hostIp'] : [])]);
   requireNetwork(item.protocol === 'tcp' || item.protocol === 'udp');
@@ -260,41 +258,39 @@ const publishedPort = (value: unknown): IRuntimeNetworkPublishedPortV1 => {
   return { protocol: item.protocol, hostPort: networkCounter(item.hostPort, 65535), targetPort: networkCounter(item.targetPort, 65535),
     ...(hostIp === null ? {} : { hostIp }), authorization: networkReference(item.authorization) };
 };
-const publishedPorts = (value: unknown): IRuntimeNetworkPublishedPortV1[] => {
+const publishedPorts = (value: unknown): IRuntimeNetworkPublishedPort[] => {
   const ports = networkSorted(networkList(value, 64, publishedPort), publishedPortKey);
   requireNetwork(ports.length > 0); return ports;
 };
-const publishedPortRequest = (value: unknown): IRuntimeNetworkPublishedPortRequestV1 => {
+const publishedPortRequest = (value: unknown): IRuntimeNetworkPublishedPortRequest => {
   const item = networkRecord(value, ['protocol', 'hostPort', 'targetPort']);
   requireNetwork(item.protocol === 'tcp' || item.protocol === 'udp');
   return { protocol: item.protocol, hostPort: networkCounter(item.hostPort, 65535), targetPort: networkCounter(item.targetPort, 65535) };
 };
-const publishedPortRequests = (value: unknown): IRuntimeNetworkPublishedPortRequestV1[] =>
+const publishedPortRequests = (value: unknown): IRuntimeNetworkPublishedPortRequest[] =>
   networkSorted(networkList(value, 64, publishedPortRequest), publishedPortKey);
 
 /** Structural snapshot only; node placement, quota and authorization remain Cloudly's decision. */
-export const snapshotServicePublishedPortsV1 = (value: unknown): IServicePublishedPortsV1 => networkSafe(() => {
-  const item = networkRecord(value, ['schemaVersion', 'organizationId', 'serviceId', 'revision', 'publishedPorts']);
-  requireNetwork(item.schemaVersion === 1);
-  return { schemaVersion: 1, organizationId: networkId(item.organizationId), serviceId: networkId(item.serviceId),
+export const snapshotServicePublishedPorts = (value: unknown): IServicePublishedPorts => networkSafe(() => {
+  const item = networkRecord(value, ['organizationId', 'serviceId', 'revision', 'publishedPorts']);
+  return { organizationId: networkId(item.organizationId), serviceId: networkId(item.serviceId),
     revision: networkCounter(item.revision), publishedPorts: publishedPortRequests(item.publishedPorts) };
 });
 
-export const snapshotSetServicePublishedPortsV1 = (value: unknown): ISetServicePublishedPortsV1 => networkSafe(() => {
-  const item = networkRecord(value, ['schemaVersion', 'organizationId', 'serviceId', 'mutationId', 'expectedRevision', 'publishedPorts']);
-  requireNetwork(item.schemaVersion === 1);
-  return { schemaVersion: 1, organizationId: networkId(item.organizationId), serviceId: networkId(item.serviceId),
+export const snapshotSetServicePublishedPorts = (value: unknown): ISetServicePublishedPorts => networkSafe(() => {
+  const item = networkRecord(value, ['organizationId', 'serviceId', 'mutationId', 'expectedRevision', 'publishedPorts']);
+  return { organizationId: networkId(item.organizationId), serviceId: networkId(item.serviceId),
     mutationId: networkId(item.mutationId), expectedRevision: item.expectedRevision === null ? null : networkCounter(item.expectedRevision),
     publishedPorts: publishedPortRequests(item.publishedPorts) };
 });
 
-const endpoint = (value: unknown): IRuntimeNetworkEndpointV1 => {
+const endpoint = (value: unknown): IRuntimeNetworkEndpoint => {
   const hasPublishedPorts = value !== null && typeof value === 'object' && Object.hasOwn(value, 'publishedPorts');
   const item = networkRecord(value, ['lease', 'ready', 'observation', 'publicEgress', 'platformEndpointIds',
     ...(hasPublishedPorts ? ['publishedPorts'] : [])]);
   requireNetwork(typeof item.ready === 'boolean' && typeof item.publicEgress === 'boolean');
-  const lease = snapshotRuntimeNetworkWorkloadLeaseV1(item.lease);
-  let observation: IRuntimeNetworkEndpointV1['observation'] = null;
+  const lease = snapshotRuntimeNetworkWorkloadLease(item.lease);
+  let observation: IRuntimeNetworkEndpoint['observation'] = null;
   if (item.observation !== null) {
     const observed = networkRecord(item.observation, ['assignment', 'reporterSessionId', 'sequence', 'digest']);
     const assignment = networkRecord(observed.assignment, ['assignmentId', 'generation', 'digest']);
@@ -309,30 +305,29 @@ const endpoint = (value: unknown): IRuntimeNetworkEndpointV1 => {
 };
 
 /** Structural snapshot only; use validate/signature/admission helpers before accepting authority. */
-export const snapshotRuntimeNetworkProjectionV1 = (value: unknown): IRuntimeNetworkProjectionV1 => networkSafe(() => {
+export const snapshotRuntimeNetworkProjection = (value: unknown): IRuntimeNetworkProjection => networkSafe(() => {
   const captured = captureNetwork(value);
-  requireNetwork(new TextEncoder().encode(networkCanonical(captured)).length <= runtimeNetworkProjectionV1Contract.maximumCanonicalBytes);
+  requireNetwork(new TextEncoder().encode(networkCanonical(captured)).length <= runtimeNetworkProjectionContract.maximumCanonicalBytes);
   const hasRouter = captured !== null && typeof captured === 'object' && Object.hasOwn(captured, 'router');
-  const item = networkRecord(captured, ['schemaVersion', 'id', 'generation', 'previous', 'controller', 'nodeId', 'runtimeNamespace',
+  const item = networkRecord(captured, ['id', 'generation', 'previous', 'controller', 'nodeId', 'runtimeNamespace',
     'protectedAuthority', 'allocationAuthorities', 'handoff', 'networks', 'memberships', 'endpoints', 'dns', 'withdrawals', 'retiredLeases', 'retiredHandoffs', 'digest',
     ...(hasRouter ? ['router'] : [])]);
-  requireNetwork(item.schemaVersion === 1);
-  return { schemaVersion: 1, ...networkRevision(item), ...networkScope(item),
-    protectedAuthority: snapshotRuntimeNetworkProtectedAuthorityV1(item.protectedAuthority),
-    allocationAuthorities: networkSorted(networkList(item.allocationAuthorities, 16, snapshotRuntimeNetworkProtectedAuthorityV1), refKey),
-    handoff: item.handoff === null ? null : snapshotRuntimeNetworkHandoffLeaseV1(item.handoff),
-    networks: networkSorted(networkList(item.networks, 128, snapshotPrivateNetworkV1), value => value.id),
-    memberships: networkSorted(networkList(item.memberships, 256, snapshotServicePrivateNetworksV1), ownerKey),
+  return { ...networkRevision(item), ...networkScope(item),
+    protectedAuthority: snapshotRuntimeNetworkProtectedAuthority(item.protectedAuthority),
+    allocationAuthorities: networkSorted(networkList(item.allocationAuthorities, 16, snapshotRuntimeNetworkProtectedAuthority), refKey),
+    handoff: item.handoff === null ? null : snapshotRuntimeNetworkHandoffLease(item.handoff),
+    networks: networkSorted(networkList(item.networks, 128, snapshotPrivateNetwork), value => value.id),
+    memberships: networkSorted(networkList(item.memberships, 256, snapshotServicePrivateNetworks), ownerKey),
     endpoints: networkSorted(networkList(item.endpoints, 256, endpoint), value => value.lease.id), dns: networkDnsWindow(item.dns),
     withdrawals: networkSorted(networkList(item.withdrawals, 4096, packetGrant), networkCanonical),
     ...(hasRouter ? { router: snapshotRouterProjection(item.router) } : {}),
     retiredLeases: sortedReferences(item.retiredLeases), retiredHandoffs: sortedReferences(item.retiredHandoffs), digest: networkDigest(item.digest) };
 });
 
-const grantsOf = (projection: IRuntimeNetworkProjectionV1): IRuntimeNetworkPacketGrantV1[] => {
-  const result: IRuntimeNetworkPacketGrantV1[] = [];
+const grantsOf = (projection: IRuntimeNetworkProjection): IRuntimeNetworkPacketGrant[] => {
+  const result: IRuntimeNetworkPacketGrant[] = [];
   const memberships = new Map(projection.memberships.map(member => [ownerKey(member), member]));
-  const append = (grant: IRuntimeNetworkPacketGrantV1) => {
+  const append = (grant: IRuntimeNetworkPacketGrant) => {
     requireNetwork(result.length < 4096); result.push(grant);
   };
   for (const source of projection.endpoints) {
@@ -355,26 +350,26 @@ const grantsOf = (projection: IRuntimeNetworkProjectionV1): IRuntimeNetworkPacke
   return result.sort((left, right) => networkCanonical(left) < networkCanonical(right) ? -1 : 1);
 };
 
-export const computeRuntimeNetworkProjectionV1Digest = (value: IRuntimeNetworkProjectionV1): Promise<TSha256Digest> =>
-  networkHash(runtimeNetworkProjectionV1Contract.projectionDigestDomain, snapshotRuntimeNetworkProjectionV1(value));
+export const computeRuntimeNetworkProjectionDigest = (value: IRuntimeNetworkProjection): Promise<TSha256Digest> =>
+  networkHash(runtimeNetworkProjectionContract.projectionDigestDomain, snapshotRuntimeNetworkProjection(value));
 
 /** Complete structural, digest, allocation and policy binding. Not an allocation/barrier/readiness proof. */
-export const validateRuntimeNetworkProjectionV1 = async (value: unknown): Promise<IRuntimeNetworkProjectionV1> => {
+export const validateRuntimeNetworkProjection = async (value: unknown): Promise<IRuntimeNetworkProjection> => {
   try {
-    const projection = snapshotRuntimeNetworkProjectionV1(value), current = projection.protectedAuthority;
+    const projection = snapshotRuntimeNetworkProjection(value), current = projection.protectedAuthority;
     requireNetwork(networkEqual(current.controller, projection.controller) && current.egressAuthorities.some(owner =>
       owner.nodeId === projection.nodeId && owner.runtimeNamespace === projection.runtimeNamespace));
     const authorities = [current, ...projection.allocationAuthorities];
     requireNetwork(new Set(authorities.map(refKey)).size === authorities.length);
     for (const authority of authorities) {
       requireNetwork(networkEqual(authority.controller, projection.controller)
-        && authority.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(authority));
+        && authority.digest === await computeRuntimeNetworkProtectedAuthorityDigest(authority));
     }
-    const allocationAuthority = (reference: IRuntimeAuthorityReferenceV1) => {
+    const allocationAuthority = (reference: IRuntimeAuthorityReference) => {
       const result = authorities.find(authority => networkEqual(networkReferenceOf(authority), reference)); requireNetwork(result); return result;
     };
     if (projection.handoff !== null) {
-      await bindRuntimeNetworkHandoffLeaseV1(projection.handoff, allocationAuthority(projection.handoff.protectedAuthority));
+      await bindRuntimeNetworkHandoffLease(projection.handoff, allocationAuthority(projection.handoff.protectedAuthority));
       requireNetwork(networkSameScope(projection.handoff, projection));
       requireNetwork(current.pools.some(pool => pool.id === projection.handoff!.transit.poolId && pool.purpose === 'transit'
         && networkContains(pool.prefix, projection.handoff!.transit.prefix)));
@@ -394,9 +389,9 @@ export const validateRuntimeNetworkProjectionV1 = async (value: unknown): Promis
     }
     const members = new Map(projection.memberships.map(member => [ownerKey(member), member])), aliases = new Set<string>();
     for (const member of projection.memberships) {
-      composeServicePrivateNetworkDnsPolicyV1(member, member.attachments.map(attachment => networks.get(attachment.networkId)));
+      composeServicePrivateNetworkDnsPolicy(member, member.attachments.map(attachment => networks.get(attachment.networkId)));
       for (const attachment of member.attachments) for (const alias of attachment.aliases) {
-        const name = buildPrivateNetworkFqdnV1(networks.get(attachment.networkId), alias);
+        const name = buildPrivateNetworkFqdn(networks.get(attachment.networkId), alias);
         requireNetwork(!aliases.has(name)); aliases.add(name);
       }
     }
@@ -410,7 +405,7 @@ export const validateRuntimeNetworkProjectionV1 = async (value: unknown): Promis
         const replica = networkCanonical([lease.organizationId, lease.serviceId, lease.replicaId]);
         requireNetwork(!readyReplicas.has(replica)); readyReplicas.add(replica);
       }
-      requireNetwork(lease.digest === await computeRuntimeNetworkWorkloadLeaseV1Digest(lease));
+      requireNetwork(lease.digest === await computeRuntimeNetworkWorkloadLeaseDigest(lease));
       requireNetwork(authority.egressAuthorities.some(owner => owner.nodeId === lease.nodeId && owner.runtimeNamespace === lease.runtimeNamespace)
         && current.egressAuthorities.some(owner => owner.nodeId === lease.nodeId && owner.runtimeNamespace === lease.runtimeNamespace));
       for (const protection of [authority, current]) requireNetwork(protection.pools.some(pool =>
@@ -431,27 +426,27 @@ export const validateRuntimeNetworkProjectionV1 = async (value: unknown): Promis
     requireNetwork(projection.withdrawals.every(grant => !grants.has(networkCanonical(grant))));
     const routerGrants = new Set(routerPacketGrantsOf(projection).map(networkCanonical));
     requireNetwork((projection.router?.withdrawals ?? []).every(grant => !routerGrants.has(networkCanonical(grant))));
-    requireNetwork(projection.digest === await computeRuntimeNetworkProjectionV1Digest(projection));
+    requireNetwork(projection.digest === await computeRuntimeNetworkProjectionDigest(projection));
     return projection;
   } catch { return failNetwork(); }
 };
 
 /** Complete directed full-mesh and explicitly authorized egress; no DNS readiness dependency. */
-export const getRuntimeNetworkProjectionPacketGrantsV1 = async (value: unknown): Promise<IRuntimeNetworkPacketGrantV1[]> =>
-  grantsOf(await validateRuntimeNetworkProjectionV1(value));
+export const getRuntimeNetworkProjectionPacketGrants = async (value: unknown): Promise<IRuntimeNetworkPacketGrant[]> =>
+  grantsOf(await validateRuntimeNetworkProjection(value));
 
 /** Router-origin authority comes only from explicit signed selections, never DNS names or workload grants. */
-export const getRuntimeNetworkProjectionRouterPacketGrantsV1 = async (value: unknown): Promise<IRuntimeNetworkRouterPacketGrantV1[]> =>
-  routerPacketGrantsOf(await validateRuntimeNetworkProjectionV1(value));
+export const getRuntimeNetworkProjectionRouterPacketGrants = async (value: unknown): Promise<IRuntimeNetworkRouterPacketGrant[]> =>
+  routerPacketGrantsOf(await validateRuntimeNetworkProjection(value));
 
 /** Complete offline DNS material, including authorized names never previously queried. */
 /** Select exact local receivers before expansion; all targets still come from
  * the complete validated projection. Selection supplies no attachment authority. */
-export const composeRuntimeNetworkProjectionDnsViewsV1 = async (
-  value: unknown, sourcesValue?: readonly IRuntimeAuthorityReferenceV1[],
-): Promise<IRuntimeNetworkDnsViewV1[]> => {
+export const composeRuntimeNetworkProjectionDnsViews = async (
+  value: unknown, sourcesValue?: readonly IRuntimeAuthorityReference[],
+): Promise<IRuntimeNetworkDnsView[]> => {
   const selected = sourcesValue === undefined ? null : networkList(captureNetwork(sourcesValue), 256, networkReference);
-  const projection = await validateRuntimeNetworkProjectionV1(value);
+  const projection = await validateRuntimeNetworkProjection(value);
   const local = projection.endpoints.filter(endpoint => networkSameScope(endpoint.lease, projection));
   if (selected !== null) {
     requireNetwork(new Set(selected.map(source => source.id)).size === selected.length);
@@ -461,15 +456,15 @@ export const composeRuntimeNetworkProjectionDnsViewsV1 = async (
   const members = new Map(projection.memberships.map(member => [ownerKey(member), member]));
   return local.filter(endpoint => selected === null || selected.some(source => networkEqual(networkReferenceOf(endpoint.lease), source))).map(endpoint => {
     const member = members.get(ownerKey(endpoint.lease))!;
-    const policy = composeServicePrivateNetworkDnsPolicyV1(member, member.attachments.map(attachment => networks.get(attachment.networkId)));
-    const records: IRuntimeNetworkDnsViewV1['records'] = [];
+    const policy = composeServicePrivateNetworkDnsPolicy(member, member.attachments.map(attachment => networks.get(attachment.networkId)));
+    const records: IRuntimeNetworkDnsView['records'] = [];
     for (const target of projection.memberships) {
       if (target.organizationId !== member.organizationId) continue;
       const addresses = projection.endpoints.filter(candidate => candidate.ready && ownerKey(candidate.lease) === ownerKey(target))
         .map(candidate => candidate.lease.ipv4.address).sort();
       for (const attachment of target.attachments) {
         if (!member.attachments.some(own => own.networkId === attachment.networkId)) continue;
-        for (const alias of attachment.aliases) records.push({ name: buildPrivateNetworkFqdnV1(networks.get(attachment.networkId), alias), addresses: [...addresses] });
+        for (const alias of attachment.aliases) records.push({ name: buildPrivateNetworkFqdn(networks.get(attachment.networkId), alias), addresses: [...addresses] });
       }
     }
     records.sort((left, right) => left.name < right.name ? -1 : 1);
@@ -478,14 +473,14 @@ export const composeRuntimeNetworkProjectionDnsViewsV1 = async (
 };
 
 /** Bind immutable address material without a circular assignment-digest dependency. */
-export const bindRuntimeNetworkWorkloadLeaseToAssignmentV1 = async (leaseValue: unknown, assignmentValue: unknown): Promise<IRuntimeNetworkWorkloadLeaseV1> => {
+export const bindRuntimeNetworkWorkloadLeaseToAssignment = async (leaseValue: unknown, assignmentValue: unknown): Promise<IRuntimeNetworkWorkloadLease> => {
   try {
-    const lease = snapshotRuntimeNetworkWorkloadLeaseV1(leaseValue), assignment = snapshotRuntimeAssignmentV1(assignmentValue);
-    requireNetwork((await validateRuntimeAssignmentV1(assignment)).length === 0 && networkSameScope(lease, assignment)
+    const lease = snapshotRuntimeNetworkWorkloadLease(leaseValue), assignment = snapshotRuntimeAssignment(assignmentValue);
+    requireNetwork((await validateRuntimeAssignment(assignment)).length === 0 && networkSameScope(lease, assignment)
       && lease.organizationId === assignment.organizationId && lease.assignmentId === assignment.assignmentId
       && lease.serviceId === assignment.serviceId && lease.replicaId === assignment.replicaId && lease.attemptId === assignment.attemptId
       && networkEqual(networkReferenceOf(lease), assignment.workload.network)
-      && lease.digest === await computeRuntimeNetworkWorkloadLeaseV1Digest(lease));
+      && lease.digest === await computeRuntimeNetworkWorkloadLeaseDigest(lease));
     return lease;
   } catch { return failNetwork(); }
 };
@@ -495,16 +490,16 @@ export const bindRuntimeNetworkWorkloadLeaseToAssignmentV1 = async (leaseValue:
  * joined application receipt, never an incoming ACK field. All prior accepted
  * material/apply journals survive until effects and DNS/allocation quarantine end.
  */
-export const admitRuntimeNetworkProjectionV1 = async (
+export const admitRuntimeNetworkProjection = async (
   value: unknown, previousValue: unknown | null, trustedScopeValue: unknown, appliedPreviousValue: unknown | null,
-): Promise<{ status: 'accepted' | 'replay'; projection: IRuntimeNetworkProjectionV1 }> => {
+): Promise<{ status: 'accepted' | 'replay'; projection: IRuntimeNetworkProjection }> => {
   try {
     // Snapshot ALL caller-owned inputs before the first asynchronous operation.
-    const incoming = snapshotRuntimeNetworkProjectionV1(value);
-    const previousInput = previousValue === null ? null : snapshotRuntimeNetworkProjectionV1(previousValue);
-    const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
+    const incoming = snapshotRuntimeNetworkProjection(value);
+    const previousInput = previousValue === null ? null : snapshotRuntimeNetworkProjection(previousValue);
+    const trusted = snapshotRuntimeNetworkNodeScope(trustedScopeValue);
     const applied = appliedPreviousValue === null ? null : networkReference(captureNetwork(appliedPreviousValue));
-    const projection = await validateRuntimeNetworkProjectionV1(incoming);
+    const projection = await validateRuntimeNetworkProjection(incoming);
     requireNetwork(networkSameScope(projection, trusted));
     if (previousInput === null) {
       requireNetwork(projection.generation === 1 && applied === null && projection.withdrawals.length === 0
@@ -512,7 +507,7 @@ export const admitRuntimeNetworkProjectionV1 = async (
         && projection.retiredLeases.length === 0 && projection.retiredHandoffs.length === 0);
       return { status: 'accepted', projection };
     }
-    const previous = await validateRuntimeNetworkProjectionV1(previousInput);
+    const previous = await validateRuntimeNetworkProjection(previousInput);
     requireNetwork(networkSameScope(previous, trusted) && previous.id === projection.id);
     requireNetwork(applied === null || networkEqual(applied, networkReferenceOf(previous)));
     if (projection.generation === previous.generation) {
@@ -548,7 +543,7 @@ export const admitRuntimeNetworkProjectionV1 = async (
     const knownHandoffs = [...(previous.handoff ? [networkReferenceOf(previous.handoff)] : []), ...previous.retiredHandoffs];
     requireNetwork(projection.retiredLeases.every(retired => knownLeases.some(known => networkEqual(known, retired)))
       && projection.retiredHandoffs.every(retired => knownHandoffs.some(known => networkEqual(known, retired))));
-    const requireCarried = (old: IRuntimeAuthorityReferenceV1[], next: IRuntimeAuthorityReferenceV1[]) => {
+    const requireCarried = (old: IRuntimeAuthorityReference[], next: IRuntimeAuthorityReference[]) => {
       for (const reference of old) requireNetwork(next.some(item => networkEqual(item, reference)));
     };
     if (applied === null) {