@serve.zone/interfaces 31.9.0 → 32.0.0

package/ts/data/networkauthority.ts

@@ -1,15 +1,14 @@
 import type { TSha256Digest } from './immutableimage.js';
-import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+import type { IRuntimeAuthorityReference, IRuntimeController } from './runtimeassignment.js';
 import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
 import { networkPrefix, networkPrivatePrefix } from '../private/networkcontract.js';
 
 /** Controller declaration; a digest does not authenticate completeness or activate a pool. */
-export interface IRuntimeNetworkProtectedAuthorityV1 {
-  schemaVersion: 1;
+export interface IRuntimeNetworkProtectedAuthority {
   id: string;
   generation: number;
-  controller: IRuntimeControllerV1;
-  previous: IRuntimeAuthorityReferenceV1 | null;
+  controller: IRuntimeController;
+  previous: IRuntimeAuthorityReference | null;
   /** Complete canonical IPv4 union, including all pools and protected endpoints. */
   prefixes: string[];
   pools: Array<{ id: string; purpose: 'workload' | 'transit'; prefix: string }>;
@@ -21,33 +20,32 @@ export interface IRuntimeNetworkProtectedAuthorityV1 {
   digest: TSha256Digest;
 }
 
-export interface IRuntimeNetworkHandoffPortRangeV1 {
+export interface IRuntimeNetworkHandoffPortRange {
   protocol: 'tcp' | 'udp';
   first: number;
   last: number;
 }
 
 /** Immutable allocation, retained unchanged while active or quarantined. No expiry implies reuse. */
-export interface IRuntimeNetworkHandoffLeaseV1 {
-  schemaVersion: 1;
+export interface IRuntimeNetworkHandoffLease {
   id: string;
   generation: number;
-  controller: IRuntimeControllerV1;
+  controller: IRuntimeController;
   nodeId: string;
   runtimeNamespace: string;
-  protectedAuthority: IRuntimeAuthorityReferenceV1;
+  protectedAuthority: IRuntimeAuthorityReference;
   /** Logical allocation incarnation, never a path, PID, inode, descriptor or native capability. */
   routerIncarnationId: string;
   transit: { poolId: string; prefix: string; routerAddress: string; hostAddress: string };
-  sourcePortRanges: IRuntimeNetworkHandoffPortRangeV1[];
+  sourcePortRanges: IRuntimeNetworkHandoffPortRange[];
   conntrackZone: number;
   conntrackLabel: string;
   digest: TSha256Digest;
 }
 
-export const runtimeNetworkAuthorityV1Contract = Object.freeze({
-  protectedDigestDomain: 'serve.zone/runtime-network-protected-authority-v1',
-  handoffDigestDomain: 'serve.zone/runtime-network-handoff-lease-v1',
+export const runtimeNetworkAuthorityContract = Object.freeze({
+  protectedDigestDomain: 'serve.zone/runtime-network-protected-authority',
+  handoffDigestDomain: 'serve.zone/runtime-network-handoff-lease',
   maximumPrefixes: 128,
   maximumPools: 64,
   maximumResolvers: 16,
@@ -101,12 +99,12 @@ const digest = (value: unknown): TSha256Digest => {
   requireValue(typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value));
   return value as TSha256Digest;
 };
-const controller = (value: unknown): IRuntimeControllerV1 => {
+const controller = (value: unknown): IRuntimeController => {
   const item = record(value, ['kind', 'id', 'epoch']);
   requireValue(item.kind === 'cloudly' || item.kind === 'onebox');
   return { kind: item.kind, id: id(item.id), epoch: id(item.epoch) };
 };
-const reference = (value: unknown): IRuntimeAuthorityReferenceV1 => {
+const reference = (value: unknown): IRuntimeAuthorityReference => {
   const item = record(value, ['id', 'generation', 'digest']);
   return { id: id(item.id), generation: integer(item.generation), digest: digest(item.digest) };
 };
@@ -151,21 +149,20 @@ const canonical = (value: unknown): string => canonicalizeStrictJson(value, fail
 const equals = (left: unknown, right: unknown): boolean => canonical(left) === canonical(right);
 
 /** Structural snapshot only. Complete inventory, signatures and activation barriers are caller-owned. */
-export const snapshotRuntimeNetworkProtectedAuthorityV1 = (value: unknown): IRuntimeNetworkProtectedAuthorityV1 => safe(() => {
-  const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'previous', 'prefixes',
+export const snapshotRuntimeNetworkProtectedAuthority = (value: unknown): IRuntimeNetworkProtectedAuthority => safe(() => {
+  const item = record(value, ['id', 'generation', 'controller', 'previous', 'prefixes',
     'pools', 'resolvers', 'platformEndpoints', 'egressAuthorities', 'digest']);
-  requireValue(item.schemaVersion === 1);
   const identity = id(item.id), generation = integer(item.generation);
   const previous = item.previous === null ? null : reference(item.previous);
   requireValue(generation === 1 ? previous === null : previous?.id === identity && previous.generation === generation - 1);
-  const prefixes = sorted(list(item.prefixes, runtimeNetworkAuthorityV1Contract.maximumPrefixes, networkPrefix), value => value);
+  const prefixes = sorted(list(item.prefixes, runtimeNetworkAuthorityContract.maximumPrefixes, networkPrefix), value => value);
   requireValue(prefixes.length > 0);
   nonoverlapping(prefixes);
   const protectedPrefix = (value: string) => requireValue(prefixes.some(range => contains(range, value)));
-  const pools = sorted(list(item.pools, runtimeNetworkAuthorityV1Contract.maximumPools, value => {
+  const pools = sorted(list(item.pools, runtimeNetworkAuthorityContract.maximumPools, value => {
     const pool = record(value, ['id', 'purpose', 'prefix']);
     requireValue(pool.purpose === 'workload' || pool.purpose === 'transit');
-    const result: IRuntimeNetworkProtectedAuthorityV1['pools'][number] = {
+    const result: IRuntimeNetworkProtectedAuthority['pools'][number] = {
       id: id(pool.id), purpose: pool.purpose, prefix: networkPrivatePrefix(pool.prefix),
     };
     protectedPrefix(result.prefix);
@@ -179,26 +176,25 @@ export const snapshotRuntimeNetworkProtectedAuthorityV1 = (value: unknown): IRun
     requireValue(pools.every(pool => !contains(pool.prefix, `${result.address}/32`)));
     return withProtocol ? { ...result, protocol: protocol(endpoint.protocol) } : result;
   };
-  const resolvers = sorted(list(item.resolvers, runtimeNetworkAuthorityV1Contract.maximumResolvers,
+  const resolvers = sorted(list(item.resolvers, runtimeNetworkAuthorityContract.maximumResolvers,
     value => readEndpoint(value, false)), value => value.id);
-  const platformEndpoints = sorted(list(item.platformEndpoints, runtimeNetworkAuthorityV1Contract.maximumPlatformEndpoints,
-    value => readEndpoint(value, true) as IRuntimeNetworkProtectedAuthorityV1['platformEndpoints'][number]), value => value.id);
+  const platformEndpoints = sorted(list(item.platformEndpoints, runtimeNetworkAuthorityContract.maximumPlatformEndpoints,
+    value => readEndpoint(value, true) as IRuntimeNetworkProtectedAuthority['platformEndpoints'][number]), value => value.id);
   const allEndpointKeys = [...resolvers.flatMap(value => ['tcp', 'udp'].map(transport => `${value.address}:${value.port}:${transport}`)),
     ...platformEndpoints.map(value => `${value.address}:${value.port}:${value.protocol}`)];
   requireValue(new Set(allEndpointKeys).size === allEndpointKeys.length);
-  const egressAuthorities = sorted(list(item.egressAuthorities, runtimeNetworkAuthorityV1Contract.maximumEgressAuthorities, value => {
+  const egressAuthorities = sorted(list(item.egressAuthorities, runtimeNetworkAuthorityContract.maximumEgressAuthorities, value => {
     const authority = record(value, ['nodeId', 'runtimeNamespace']);
     return { nodeId: id(authority.nodeId), runtimeNamespace: id(authority.runtimeNamespace) };
   }), value => canonical([value.nodeId, value.runtimeNamespace]));
   requireValue(egressAuthorities.length > 0);
-  return { schemaVersion: 1, id: identity, generation, controller: controller(item.controller), previous,
+  return { id: identity, generation, controller: controller(item.controller), previous,
     prefixes, pools, resolvers, platformEndpoints, egressAuthorities, digest: digest(item.digest) };
 });
 
-export const snapshotRuntimeNetworkHandoffLeaseV1 = (value: unknown): IRuntimeNetworkHandoffLeaseV1 => safe(() => {
-  const item = record(value, ['schemaVersion', 'id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
+export const snapshotRuntimeNetworkHandoffLease = (value: unknown): IRuntimeNetworkHandoffLease => safe(() => {
+  const item = record(value, ['id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
     'protectedAuthority', 'routerIncarnationId', 'transit', 'sourcePortRanges', 'conntrackZone', 'conntrackLabel', 'digest']);
-  requireValue(item.schemaVersion === 1);
   const transit = record(item.transit, ['poolId', 'prefix', 'routerAddress', 'hostAddress']);
   const transitPrefix = networkPrivatePrefix(transit.prefix), [first, last] = bounds(transitPrefix);
   const routerAddress = endpointAddress(transit.routerAddress), hostAddress = endpointAddress(transit.hostAddress);
@@ -207,7 +203,7 @@ export const snapshotRuntimeNetworkHandoffLeaseV1 = (value: unknown): IRuntimeNe
     const number = numericAddress(value);
     requireValue(number >= first && number <= last && (last - first === 1 || (number !== first && number !== last)));
   }
-  const sourcePortRanges = list(item.sourcePortRanges, runtimeNetworkAuthorityV1Contract.maximumPortRanges, value => {
+  const sourcePortRanges = list(item.sourcePortRanges, runtimeNetworkAuthorityContract.maximumPortRanges, value => {
     const range = record(value, ['protocol', 'first', 'last']);
     const result = { protocol: protocol(range.protocol), first: integer(range.first, 65535), last: integer(range.last, 65535) };
     requireValue(result.first <= result.last);
@@ -220,7 +216,7 @@ export const snapshotRuntimeNetworkHandoffLeaseV1 = (value: unknown): IRuntimeNe
   }
   requireValue(typeof item.conntrackLabel === 'string' && /^[a-f0-9]{32}$/.test(item.conntrackLabel)
     && item.conntrackLabel !== '0'.repeat(32));
-  return { schemaVersion: 1, id: id(item.id), generation: integer(item.generation), controller: controller(item.controller),
+  return { id: id(item.id), generation: integer(item.generation), controller: controller(item.controller),
     nodeId: id(item.nodeId), runtimeNamespace: id(item.runtimeNamespace), protectedAuthority: reference(item.protectedAuthority),
     routerIncarnationId: id(item.routerIncarnationId), transit: { poolId: id(transit.poolId), prefix: transitPrefix, routerAddress, hostAddress },
     sourcePortRanges, conntrackZone: integer(item.conntrackZone, 65535), conntrackLabel: item.conntrackLabel, digest: digest(item.digest) };
@@ -230,19 +226,19 @@ const computeDigest = async (domain: string, value: { digest: TSha256Digest }):
   const { digest: omitted, ...payload } = value;
   return `sha256:${await createCanonicalJsonSha256Hex(canonical({ domain, payload }), fail)}`;
 };
-export const computeRuntimeNetworkProtectedAuthorityV1Digest = (value: IRuntimeNetworkProtectedAuthorityV1): Promise<TSha256Digest> =>
-  computeDigest(runtimeNetworkAuthorityV1Contract.protectedDigestDomain, snapshotRuntimeNetworkProtectedAuthorityV1(value));
-export const computeRuntimeNetworkHandoffLeaseV1Digest = (value: IRuntimeNetworkHandoffLeaseV1): Promise<TSha256Digest> =>
-  computeDigest(runtimeNetworkAuthorityV1Contract.handoffDigestDomain, snapshotRuntimeNetworkHandoffLeaseV1(value));
+export const computeRuntimeNetworkProtectedAuthorityDigest = (value: IRuntimeNetworkProtectedAuthority): Promise<TSha256Digest> =>
+  computeDigest(runtimeNetworkAuthorityContract.protectedDigestDomain, snapshotRuntimeNetworkProtectedAuthority(value));
+export const computeRuntimeNetworkHandoffLeaseDigest = (value: IRuntimeNetworkHandoffLease): Promise<TSha256Digest> =>
+  computeDigest(runtimeNetworkAuthorityContract.handoffDigestDomain, snapshotRuntimeNetworkHandoffLease(value));
 
 /** Detached, digest-verified allocation binding. Does not establish pool activation or live link identity. */
-export const bindRuntimeNetworkHandoffLeaseV1 = async (leaseValue: unknown, authorityValue: unknown): Promise<{
-  lease: IRuntimeNetworkHandoffLeaseV1; authority: IRuntimeNetworkProtectedAuthorityV1;
+export const bindRuntimeNetworkHandoffLease = async (leaseValue: unknown, authorityValue: unknown): Promise<{
+  lease: IRuntimeNetworkHandoffLease; authority: IRuntimeNetworkProtectedAuthority;
 }> => {
-  const lease = snapshotRuntimeNetworkHandoffLeaseV1(leaseValue);
-  const authority = snapshotRuntimeNetworkProtectedAuthorityV1(authorityValue);
-  requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
-  requireValue(authority.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(authority));
+  const lease = snapshotRuntimeNetworkHandoffLease(leaseValue);
+  const authority = snapshotRuntimeNetworkProtectedAuthority(authorityValue);
+  requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseDigest(lease));
+  requireValue(authority.digest === await computeRuntimeNetworkProtectedAuthorityDigest(authority));
   requireValue(equals(lease.controller, authority.controller)
     && equals(lease.protectedAuthority, { id: authority.id, generation: authority.generation, digest: authority.digest })
     && authority.egressAuthorities.some(value => value.nodeId === lease.nodeId && value.runtimeNamespace === lease.runtimeNamespace));
@@ -256,12 +252,12 @@ export const bindRuntimeNetworkHandoffLeaseV1 = async (leaseValue: unknown, auth
  * The owning transactional ledger must supply its complete history and serialize reservations.
  * Namespace replacement, an empty CT dump or process exit never removes an entry from this set.
  */
-export const snapshotRuntimeNetworkHandoffLedgerV1 = async (value: unknown): Promise<IRuntimeNetworkHandoffLeaseV1[]> => {
-  const leases = safe(() => list(value, runtimeNetworkAuthorityV1Contract.maximumRetainedHandoffLeases,
-    snapshotRuntimeNetworkHandoffLeaseV1));
+export const snapshotRuntimeNetworkHandoffLedger = async (value: unknown): Promise<IRuntimeNetworkHandoffLease[]> => {
+  const leases = safe(() => list(value, runtimeNetworkAuthorityContract.maximumRetainedHandoffLeases,
+    snapshotRuntimeNetworkHandoffLease));
   for (let index = 0; index < leases.length; index++) {
     const lease = leases[index];
-    requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseV1Digest(lease));
+    requireValue(lease.digest === await computeRuntimeNetworkHandoffLeaseDigest(lease));
     for (let other = 0; other < index; other++) {
       const previous = leases[other];
       requireValue(lease.nodeId === previous.nodeId && equals(lease.controller, previous.controller));

package/ts/data/networkcredential.ts

@@ -1,19 +1,19 @@
-import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
-import { snapshotRuntimeSessionBindingV1, type IRuntimeSessionBindingV1 } from './runtimesession.js';
-import { validateRuntimeNetworkProjectionV1, type IRuntimeNetworkProjectionV1 } from './networkprojection.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import { snapshotRuntimeSessionBinding, type IRuntimeSessionBinding } from './runtimesession.js';
+import { validateRuntimeNetworkProjection, type IRuntimeNetworkProjection } from './networkprojection.js';
 import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { captureNetwork, failNetwork, networkCounter, networkEffectiveDnsWindow, networkEqual, networkId, networkIpv4,
   networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
 
-export interface IGetRuntimeManagedVpnCredentialRequestV1 {
-  session: IRuntimeSessionBindingV1;
-  projection: IRuntimeAuthorityReferenceV1;
+export interface IGetRuntimeManagedVpnCredentialRequest {
+  session: IRuntimeSessionBinding;
+  projection: IRuntimeAuthorityReference;
 }
 
 /** Secret response over the current authenticated physical peer only. Never
  * persist, hash, log, or include it in a signed network projection. The native
  * Noise owner validates and uses the keys; these shapes confer no TUN readiness. */
-export interface IGetRuntimeManagedVpnCredentialResponseV1 extends IGetRuntimeManagedVpnCredentialRequestV1 {
+export interface IGetRuntimeManagedVpnCredentialResponse extends IGetRuntimeManagedVpnCredentialRequest {
   transport: 'quic';
   relay: { id: string; address: string; port: number };
   authorityId: string;
@@ -36,35 +36,35 @@ const key = (value: unknown): string => {
   return value;
 };
 
-export const snapshotGetRuntimeManagedVpnCredentialRequestV1 = (value: unknown): IGetRuntimeManagedVpnCredentialRequestV1 => networkSafe(() => {
+export const snapshotGetRuntimeManagedVpnCredentialRequest = (value: unknown): IGetRuntimeManagedVpnCredentialRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'projection']);
-  return { session: snapshotRuntimeSessionBindingV1(item.session), projection: networkReference(item.projection) };
+  return { session: snapshotRuntimeSessionBinding(item.session), projection: networkReference(item.projection) };
 });
 
-export const snapshotGetRuntimeManagedVpnCredentialResponseV1 = (value: unknown): IGetRuntimeManagedVpnCredentialResponseV1 => networkSafe(() => {
+export const snapshotGetRuntimeManagedVpnCredentialResponse = (value: unknown): IGetRuntimeManagedVpnCredentialResponse => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'projection', 'transport', 'relay', 'authorityId',
     'serverPublicKey', 'clientPublicKey', 'clientPrivateKey', 'expiresAt']);
   const relay = networkRecord(item.relay, ['id', 'address', 'port']); requireNetwork(item.transport === 'quic');
-  return { session: snapshotRuntimeSessionBindingV1(item.session), projection: networkReference(item.projection), transport: 'quic',
+  return { session: snapshotRuntimeSessionBinding(item.session), projection: networkReference(item.projection), transport: 'quic',
     relay: { id: networkId(relay.id), address: networkIpv4(relay.address), port: networkCounter(relay.port, 65535) },
     authorityId: networkId(item.authorityId), serverPublicKey: key(item.serverPublicKey), clientPublicKey: key(item.clientPublicKey),
     clientPrivateKey: key(item.clientPrivateKey), expiresAt: networkCounter(item.expiresAt) };
 });
 
-const bindRequest = (request: IGetRuntimeManagedVpnCredentialRequestV1,
-  projection: IRuntimeNetworkProjectionV1, trusted: IRuntimeSessionBindingV1): void => {
+const bindRequest = (request: IGetRuntimeManagedVpnCredentialRequest,
+  projection: IRuntimeNetworkProjection, trusted: IRuntimeSessionBinding): void => {
   requireNetwork(networkEqual(request.session, trusted) && networkEqual(request.projection, networkReferenceOf(projection))
     && networkSameScope(projection, trusted) && projection.handoff);
 };
 
 /** Content binding only. The caller must resolve the exact current projection
  * and authenticate/fence the current physical peer before and after native work. */
-export const bindGetRuntimeManagedVpnCredentialRequestV1 = async (value: unknown, projectionValue: unknown,
-  trustedSessionValue: unknown): Promise<IGetRuntimeManagedVpnCredentialRequestV1> => {
+export const bindGetRuntimeManagedVpnCredentialRequest = async (value: unknown, projectionValue: unknown,
+  trustedSessionValue: unknown): Promise<IGetRuntimeManagedVpnCredentialRequest> => {
   try {
-    const request = snapshotGetRuntimeManagedVpnCredentialRequestV1(value);
-    const trusted = snapshotRuntimeSessionBindingV1(trustedSessionValue);
-    const projection = await validateRuntimeNetworkProjectionV1(projectionValue);
+    const request = snapshotGetRuntimeManagedVpnCredentialRequest(value);
+    const trusted = snapshotRuntimeSessionBinding(trustedSessionValue);
+    const projection = await validateRuntimeNetworkProjection(projectionValue);
     bindRequest(request, projection, trusted);
     return request;
   } catch { return failNetwork(); }
@@ -76,15 +76,15 @@ export const bindGetRuntimeManagedVpnCredentialRequestV1 = async (value: unknown
  * projection, or null; this helper verifies no signature. Time is caller-qualified;
  * this helper does not sample a clock, authenticate a transport, admit policy or
  * prove a running managed connection. */
-export const bindGetRuntimeManagedVpnCredentialResponseV1 = async (value: unknown, requestValue: unknown,
+export const bindGetRuntimeManagedVpnCredentialResponse = async (value: unknown, requestValue: unknown,
   projectionValue: unknown, trustedSessionValue: unknown, nowValue: unknown,
-  renewalValue: unknown | null = null): Promise<IGetRuntimeManagedVpnCredentialResponseV1> => {
+  renewalValue: unknown | null = null): Promise<IGetRuntimeManagedVpnCredentialResponse> => {
   try {
-    const response = snapshotGetRuntimeManagedVpnCredentialResponseV1(value);
-    const request = snapshotGetRuntimeManagedVpnCredentialRequestV1(requestValue);
-    const trusted = snapshotRuntimeSessionBindingV1(trustedSessionValue), now = networkCounter(nowValue);
+    const response = snapshotGetRuntimeManagedVpnCredentialResponse(value);
+    const request = snapshotGetRuntimeManagedVpnCredentialRequest(requestValue);
+    const trusted = snapshotRuntimeSessionBinding(trustedSessionValue), now = networkCounter(nowValue);
     const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
-    const projection = await validateRuntimeNetworkProjectionV1(projectionValue);
+    const projection = await validateRuntimeNetworkProjection(projectionValue);
     const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
     const window = networkEffectiveDnsWindow(projection, renewal);
     bindRequest(request, projection, trusted);

package/ts/data/networkdelivery.ts

@@ -1,29 +1,29 @@
-import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
-import type { IRuntimeSessionBindingV1 } from './runtimesession.js';
-import { snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
-import type { IRuntimeNetworkSigningAuthorityV1, ISignedRuntimeNetworkProjectionV1 } from './networksigning.js';
-import { snapshotRuntimeNetworkSigningAuthorityV1, snapshotSignedRuntimeNetworkProjectionV1 } from './networksigning.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeSessionBinding } from './runtimesession.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
+import type { IRuntimeNetworkSigningAuthority, ISignedRuntimeNetworkProjection } from './networksigning.js';
+import { snapshotRuntimeNetworkSigningAuthority, snapshotSignedRuntimeNetworkProjection } from './networksigning.js';
 import type { IRuntimeNetworkDnsLeaseRenewalReference, ISignedRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { getRuntimeNetworkDnsLeaseRenewalReference, snapshotRuntimeNetworkDnsLeaseRenewal,
   snapshotRuntimeNetworkDnsLeaseRenewalReference, snapshotSignedRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope,
   requireNetwork } from '../private/networkcontract.js';
 
-export interface IApplyRuntimeNetworkSigningAuthorityRequestV1 {
-  session: IRuntimeSessionBindingV1;
-  authority: IRuntimeNetworkSigningAuthorityV1;
+export interface IApplyRuntimeNetworkSigningAuthorityRequest {
+  session: IRuntimeSessionBinding;
+  authority: IRuntimeNetworkSigningAuthority;
 }
-export interface IApplyRuntimeNetworkProjectionRequestV1 {
-  session: IRuntimeSessionBindingV1;
-  signed: ISignedRuntimeNetworkProjectionV1;
+export interface IApplyRuntimeNetworkProjectionRequest {
+  session: IRuntimeSessionBinding;
+  signed: ISignedRuntimeNetworkProjection;
 }
 /** Durable admission only. No packet, DNS, pool-activation, fencing or readiness assertion. */
-export interface IApplyRuntimeNetworkAuthorityResponseV1 {
+export interface IApplyRuntimeNetworkAuthorityResponse {
   status: 'accepted' | 'replay';
-  authority: IRuntimeAuthorityReferenceV1;
+  authority: IRuntimeAuthorityReference;
 }
 export interface IApplyRuntimeNetworkDnsLeaseRenewalRequest {
-  session: IRuntimeSessionBindingV1;
+  session: IRuntimeSessionBinding;
   signed: ISignedRuntimeNetworkDnsLeaseRenewal;
 }
 /** Durable admission only. It does not assert that the node converted the window or serves DNS. */
@@ -36,22 +36,22 @@ const admissionStatus = (value: unknown): 'accepted' | 'replay' => {
   requireNetwork(value === 'accepted' || value === 'replay'); return value;
 };
 
-export const snapshotApplyRuntimeNetworkSigningAuthorityRequestV1 = (value: unknown): IApplyRuntimeNetworkSigningAuthorityRequestV1 => networkSafe(() => {
+export const snapshotApplyRuntimeNetworkSigningAuthorityRequest = (value: unknown): IApplyRuntimeNetworkSigningAuthorityRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'authority']);
-  return { session: snapshotRuntimeSessionBindingV1(item.session), authority: snapshotRuntimeNetworkSigningAuthorityV1(item.authority) };
+  return { session: snapshotRuntimeSessionBinding(item.session), authority: snapshotRuntimeNetworkSigningAuthority(item.authority) };
 });
-export const snapshotApplyRuntimeNetworkProjectionRequestV1 = (value: unknown): IApplyRuntimeNetworkProjectionRequestV1 => networkSafe(() => {
+export const snapshotApplyRuntimeNetworkProjectionRequest = (value: unknown): IApplyRuntimeNetworkProjectionRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'signed']);
-  return { session: snapshotRuntimeSessionBindingV1(item.session), signed: snapshotSignedRuntimeNetworkProjectionV1(item.signed) };
+  return { session: snapshotRuntimeSessionBinding(item.session), signed: snapshotSignedRuntimeNetworkProjection(item.signed) };
 });
-export const snapshotApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown): IApplyRuntimeNetworkAuthorityResponseV1 => networkSafe(() => {
+export const snapshotApplyRuntimeNetworkAuthorityResponse = (value: unknown): IApplyRuntimeNetworkAuthorityResponse => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['status', 'authority']);
   return { status: admissionStatus(item.status), authority: networkReference(item.authority) };
 });
 
 export const snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest = (value: unknown): IApplyRuntimeNetworkDnsLeaseRenewalRequest => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['session', 'signed']);
-  return { session: snapshotRuntimeSessionBindingV1(item.session), signed: snapshotSignedRuntimeNetworkDnsLeaseRenewal(item.signed) };
+  return { session: snapshotRuntimeSessionBinding(item.session), signed: snapshotSignedRuntimeNetworkDnsLeaseRenewal(item.signed) };
 });
 export const snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse = (value: unknown): IApplyRuntimeNetworkDnsLeaseRenewalResponse => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['status', 'renewal']);
@@ -59,22 +59,22 @@ export const snapshotApplyRuntimeNetworkDnsLeaseRenewalResponse = (value: unknow
 });
 
 /** trustedSessionValue must come from the receiving CURRENT physical connection. */
-export const bindApplyRuntimeNetworkSigningAuthorityRequestV1 = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkSigningAuthorityRequestV1 => networkSafe(() => {
-  const request = snapshotApplyRuntimeNetworkSigningAuthorityRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+export const bindApplyRuntimeNetworkSigningAuthorityRequest = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkSigningAuthorityRequest => networkSafe(() => {
+  const request = snapshotApplyRuntimeNetworkSigningAuthorityRequest(value), session = snapshotRuntimeSessionBinding(trustedSessionValue);
   requireNetwork(networkEqual(request.session, session) && networkEqual(request.authority.controller, session.controller));
   return request;
 });
 
 /** Content binding only. Verify signature with stored trust and atomically fence admission. */
-export const bindApplyRuntimeNetworkProjectionRequestV1 = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkProjectionRequestV1 => networkSafe(() => {
-  const request = snapshotApplyRuntimeNetworkProjectionRequestV1(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+export const bindApplyRuntimeNetworkProjectionRequest = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkProjectionRequest => networkSafe(() => {
+  const request = snapshotApplyRuntimeNetworkProjectionRequest(value), session = snapshotRuntimeSessionBinding(trustedSessionValue);
   requireNetwork(networkEqual(request.session, session) && networkSameScope(request.signed.projection, session));
   return request;
 });
 
 /** Compare ACK with the exact SENT key or projection reference, never with a response-derived value. */
-export const bindApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown, sentReferenceValue: unknown): IApplyRuntimeNetworkAuthorityResponseV1 => networkSafe(() => {
-  const response = snapshotApplyRuntimeNetworkAuthorityResponseV1(value);
+export const bindApplyRuntimeNetworkAuthorityResponse = (value: unknown, sentReferenceValue: unknown): IApplyRuntimeNetworkAuthorityResponse => networkSafe(() => {
+  const response = snapshotApplyRuntimeNetworkAuthorityResponse(value);
   const expected = networkReference(captureNetwork(sentReferenceValue));
   requireNetwork(networkEqual(response.authority, networkReferenceOf(expected)));
   return response;
@@ -87,7 +87,7 @@ export const bindApplyRuntimeNetworkAuthorityResponseV1 = (value: unknown, sentR
  * stored trust, then admit and fence atomically.
  */
 export const bindApplyRuntimeNetworkDnsLeaseRenewalRequest = (value: unknown, trustedSessionValue: unknown): IApplyRuntimeNetworkDnsLeaseRenewalRequest => networkSafe(() => {
-  const request = snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest(value), session = snapshotRuntimeSessionBindingV1(trustedSessionValue);
+  const request = snapshotApplyRuntimeNetworkDnsLeaseRenewalRequest(value), session = snapshotRuntimeSessionBinding(trustedSessionValue);
   requireNetwork(networkEqual(request.session, session) && networkSameScope(request.signed.renewal, session));
   return request;
 });

package/ts/data/networklease.ts

@@ -1,7 +1,7 @@
 import type { TSha256Digest } from './immutableimage.js';
-import type { IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
-import type { IRuntimeNetworkDnsWindow, IRuntimeNetworkNodeScopeV1 } from './networkprojection.js';
-import { snapshotRuntimeNetworkNodeScopeV1, snapshotRuntimeNetworkProjectionV1, validateRuntimeNetworkProjectionV1 } from './networkprojection.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeNetworkDnsWindow, IRuntimeNetworkNodeScope } from './networkprojection.js';
+import { snapshotRuntimeNetworkNodeScope, snapshotRuntimeNetworkProjection, validateRuntimeNetworkProjection } from './networkprojection.js';
 import { captureNetwork, failNetwork, networkCounter, networkDigest, networkDnsWindow, networkEffectiveDnsWindow, networkEqual,
   networkHash, networkId, networkList, networkMaximumDnsLeaseMs, networkRecord, networkReference, networkReferenceOf,
   networkRenewsProjection, networkSafe, networkSameScope, networkScope, networkSignature, requireNetwork } from '../private/networkcontract.js';
@@ -15,8 +15,8 @@ import { captureNetwork, failNetwork, networkCounter, networkDigest, networkDnsW
  * projection by exact reference, so it never joins the projection chain and stops being
  * admissible the moment a successor projection is admitted.
  */
-export interface IRuntimeNetworkDnsLeaseRenewal extends IRuntimeNetworkNodeScopeV1 {
-  projection: IRuntimeAuthorityReferenceV1;
+export interface IRuntimeNetworkDnsLeaseRenewal extends IRuntimeNetworkNodeScope {
+  projection: IRuntimeAuthorityReference;
   /** Orders the renewals of one projection. A receiver may skip sequences, never go back. */
   sequence: number;
   /**
@@ -29,14 +29,14 @@ export interface IRuntimeNetworkDnsLeaseRenewal extends IRuntimeNetworkNodeScope
 
 /** Names one renewal without its window: what a receiver records and what an ACK repeats. */
 export interface IRuntimeNetworkDnsLeaseRenewalReference {
-  projection: IRuntimeAuthorityReferenceV1;
+  projection: IRuntimeAuthorityReference;
   sequence: number;
   digest: TSha256Digest;
 }
 
 export interface ISignedRuntimeNetworkDnsLeaseRenewal {
   /** The signing authority revision that also signs this controller's projections. */
-  authority: IRuntimeAuthorityReferenceV1;
+  authority: IRuntimeAuthorityReference;
   renewal: IRuntimeNetworkDnsLeaseRenewal;
   /** Ed25519 signature of the complete domain-separated envelope, lowercase hex. */
   signature: string;
@@ -51,7 +51,7 @@ export interface ISignedRuntimeNetworkDnsLeaseRenewal {
 export interface IHoldRuntimeNetworkDnsLeaseRenewalsRequest {
   /** The relay's own socket names the cluster; one relay carries every node of it, so the node is named here. */
   nodeId: string;
-  projection: IRuntimeAuthorityReferenceV1;
+  projection: IRuntimeAuthorityReference;
   /** Ascending by sequence. Empty holds nothing for this node. */
   renewals: ISignedRuntimeNetworkDnsLeaseRenewal[];
 }
@@ -75,6 +75,33 @@ export const runtimeNetworkDnsLeaseRenewalContract = Object.freeze({
   revocationLatency: 'a-detached-cluster-keeps-dns-authority-until-its-last-held-window-ends',
 } as const);
 
+/**
+ * Every reason a relay refuses to hold a run, in the words the refusal leads with.
+ *
+ * A hold is the one call whose outcome a controller cannot read back from its own records: the
+ * run lives in the relay's memory, so the refusal is the only statement about whether that node's
+ * windows are carried. The relay writes `<name>: <reason>` and the controller matches the name,
+ * which is why the names are stated here instead of being spelled out on both sides.
+ */
+export const holdRuntimeNetworkDnsLeaseRenewalsRefusals = Object.freeze([
+  /** The run itself is not a valid one, so nothing of it was held. */
+  'escrow-run-invalid',
+  /** This relay carries no session for that node; its renewals were not held. */
+  'escrow-node-not-carried',
+  /** The node's session changed while the run waited, so the run is for a session that is gone. */
+  'escrow-run-foreign-session',
+  /** The relay already holds a run that is provably newer for the same projection. */
+  'escrow-run-stale',
+  /** The run renews a projection that cannot be ordered against the held one. */
+  'escrow-run-unordered',
+  /** A node reached this method: a run is held only for the controller, over the relay's session. */
+  'escrow-cloudly-only',
+] as const);
+
+/** One of the reasons a relay answers instead of holding a run. */
+export type THoldRuntimeNetworkDnsLeaseRenewalsRefusal =
+  typeof holdRuntimeNetworkDnsLeaseRenewalsRefusals[number];
+
 export const snapshotRuntimeNetworkDnsLeaseRenewal = (value: unknown): IRuntimeNetworkDnsLeaseRenewal => networkSafe(() => {
   const item = networkRecord(captureNetwork(value), ['controller', 'nodeId', 'runtimeNamespace', 'projection', 'sequence', 'dns', 'digest']);
   return { ...networkScope(item), projection: networkReference(item.projection), sequence: networkCounter(item.sequence),
@@ -130,9 +157,9 @@ export const getRuntimeNetworkEffectiveDnsWindow = async (
   projectionValue: unknown, renewalValue: unknown | null,
 ): Promise<IRuntimeNetworkDnsWindow> => {
   try {
-    const projectionInput = snapshotRuntimeNetworkProjectionV1(projectionValue);
+    const projectionInput = snapshotRuntimeNetworkProjection(projectionValue);
     const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
-    const projection = await validateRuntimeNetworkProjectionV1(projectionInput);
+    const projection = await validateRuntimeNetworkProjection(projectionInput);
     const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
     return networkEffectiveDnsWindow(projection, renewal);
   } catch { return failNetwork(); }
@@ -158,12 +185,12 @@ export const admitRuntimeNetworkDnsLeaseRenewal = async (
   try {
     // Snapshot ALL caller-owned inputs before the first asynchronous operation.
     const incoming = snapshotRuntimeNetworkDnsLeaseRenewal(value);
-    const projectionInput = snapshotRuntimeNetworkProjectionV1(currentProjectionValue);
+    const projectionInput = snapshotRuntimeNetworkProjection(currentProjectionValue);
     const previousInput = previousValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(previousValue);
-    const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
+    const trusted = snapshotRuntimeNetworkNodeScope(trustedScopeValue);
     const now = networkCounter(nowValue);
     const renewal = await validateRuntimeNetworkDnsLeaseRenewal(incoming);
-    const projection = await validateRuntimeNetworkProjectionV1(projectionInput);
+    const projection = await validateRuntimeNetworkProjection(projectionInput);
     requireNetwork(networkSameScope(projection, trusted) && networkRenewsProjection(renewal, projection));
     const previous = previousInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(previousInput);
     if (previous !== null) {

package/ts/data/networknode.ts

@@ -1,7 +1,7 @@
-import type { IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import type { IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
 import { captureNetwork, networkCounter, networkId, networkRecord, networkSafe } from '../private/networkcontract.js';
 
-type TEgressOwner = IRuntimeNetworkProtectedAuthorityV1['egressAuthorities'][number];
+type TEgressOwner = IRuntimeNetworkProtectedAuthority['egressAuthorities'][number];
 
 /**
  * One unmet condition of a node's runtime network readiness, in the order the node producer meets