@serve.zone/interfaces 32.10.1 → 32.11.0

package/changelog.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 2026-09-20 - 32.11.0
+
+### Features
+
+- Add the Spark-authenticated current node runtime routing read and immutable root-local Pallet
+  bind/readback contracts. Both paths bind the routing identity to the exact current Cloudly
+  enrollment origin and node. The persisted binding names routing only; current authenticated
+  runtime sessions remain the sole workload authority.
+
 ## 2026-09-20 - 32.10.1
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.10.1',
+    version: '32.11.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/clusterruntime.d.ts

@@ -21,6 +21,14 @@ export interface IClusterRuntime {
     /** The administrator or producer that made the change. */
     changedBy: string;
 }
+/** Current phase reference without its administrative audit metadata. */
+export interface IClusterRuntimeReference {
+    /** The cluster id. */
+    id: string;
+    phase: TClusterRuntimePhase;
+    /** Exact compare-and-swap generation observed with this phase. */
+    generation: number;
+}
 /**
  * Why a cluster cannot leave `swarm` yet. Each blocker names the node or service it is about, so an
  * administrator can act on it without a second query.
@@ -36,4 +44,6 @@ export type TClusterRuntimeBlocker = {
 };
 /** Structural snapshot for exact persistence; which phase may follow which is the cutover's decision. */
 export declare const snapshotClusterRuntime: (value: unknown) => IClusterRuntime;
+/** Structural snapshot for node routing reads; it grants no right to move or run a phase. */
+export declare const snapshotClusterRuntimeReference: (value: unknown) => IClusterRuntimeReference;
 export {};

package/dist_ts/data/clusterruntime.js

@@ -8,4 +8,10 @@ export const snapshotClusterRuntime = (value) => producerSafe(() => {
     return { id: networkId(item.id), phase: item.phase, generation: networkCounter(item.generation),
         changedAt: networkCounter(item.changedAt), changedBy: networkId(item.changedBy) };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcnJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsY0FBYyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDekgsT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUV2RSxNQUFNLG9CQUFvQixHQUFHLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFVLENBQUM7QUFtQ25GLHlHQUF5RztBQUN6RyxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLEtBQWMsRUFBbUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDM0YsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzNHLGNBQWMsQ0FBQyxPQUFPLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUQsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQztRQUM3RixTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQ3RGLENBQUMsQ0FBQyxDQUFDIn0=
+/** Structural snapshot for node routing reads; it grants no right to move or run a phase. */
+export const snapshotClusterRuntimeReference = (value) => producerSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['id', 'phase', 'generation']);
+    requireNetwork(isOneOf(clusterRuntimePhases, item.phase));
+    return { id: networkId(item.id), phase: item.phase, generation: networkCounter(item.generation) };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcnJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsY0FBYyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDekgsT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUV2RSxNQUFNLG9CQUFvQixHQUFHLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFVLENBQUM7QUE0Q25GLHlHQUF5RztBQUN6RyxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLEtBQWMsRUFBbUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDM0YsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzNHLGNBQWMsQ0FBQyxPQUFPLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUQsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQztRQUM3RixTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQ3RGLENBQUMsQ0FBQyxDQUFDO0FBRUgsNkZBQTZGO0FBQzdGLE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLENBQUMsS0FBYyxFQUE0QixFQUFFLENBQUMsWUFBWSxDQUFDLEdBQUcsRUFBRTtJQUM3RyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ2pGLGNBQWMsQ0FBQyxPQUFPLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUQsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDcEcsQ0FBQyxDQUFDLENBQUMifQ==

package/dist_ts/data/index.d.ts

@@ -26,6 +26,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './noderuntimebinding.js';
 export * from './noderetirement.js';
 export * from './networkaddressplan.js';
 export * from './networkauthority.js';

package/dist_ts/data/index.js

@@ -26,6 +26,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './noderuntimebinding.js';
 export * from './noderetirement.js';
 export * from './networkaddressplan.js';
 export * from './networkauthority.js';
@@ -60,4 +61,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyx3QkFBd0IsQ0FBQztBQUV2QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBRXZDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/data/noderuntimebinding.d.ts

@@ -0,0 +1,64 @@
+import type { IClusterRelay } from './cluster.js';
+import type { IClusterRuntimeReference } from './clusterruntime.js';
+import type { IRuntimeController } from './runtimeassignment.js';
+/**
+ * Durable routing identity for one Pallet node.
+ *
+ * This is not a runtime session, a workload grant or a cluster-phase authority. It only names the
+ * Cloudly controller and relay through which the node obtains fresh authenticated session state.
+ */
+export interface INodeRuntimeRoutingBinding {
+    /** Exact immutable enrollment authority; Pallet compares it with its current active identity. */
+    cloudlyOrigin: string;
+    nodeId: string;
+    clusterId: string;
+    controller: IRuntimeController & {
+        kind: 'cloudly';
+    };
+    runtimeNamespace: string;
+    relay: IClusterRelay;
+}
+/** Sensitive authenticated read input; never persist, log, put in a URL or return it. */
+export interface INodeRuntimeBindingRequest {
+    nodeId: string;
+    nodeToken: string;
+}
+/** Current server-owned answer to an authenticated Spark-node read. */
+export interface INodeRuntimeBindingRead {
+    binding: INodeRuntimeRoutingBinding;
+    runtime: IClusterRuntimeReference;
+    /** Generation of the Spark bearer that authenticated this exact answer. */
+    credentialGeneration: number;
+    /** Current Spark session fence; it is observation metadata, not part of the routing binding. */
+    sessionEpoch: number;
+}
+export declare const nodeRuntimeBindingContract: Readonly<{
+    readonly localMutation: "first-bind-or-exact-replay";
+    readonly persistedAuthority: "routing-only";
+    readonly runtimeAuthority: "fresh-authenticated-controller-session-only";
+}>;
+/** Exact detached snapshot; shape checks are not authentication. */
+export declare const snapshotNodeRuntimeRoutingBinding: (valueArg: unknown) => INodeRuntimeRoutingBinding;
+/** Exact detached authenticated-read request; validation never logs or returns the bearer. */
+export declare const snapshotNodeRuntimeBindingRequest: (valueArg: unknown) => INodeRuntimeBindingRequest;
+/** Exact detached current read; its runtime must name the binding's cluster. */
+export declare const snapshotNodeRuntimeBindingRead: (valueArg: unknown) => INodeRuntimeBindingRead;
+/**
+ * Bind a server answer to the Spark identity that made the authenticated read.
+ * Authentication and the current credential transaction remain Cloudly's responsibility.
+ */
+export declare const bindNodeRuntimeBindingRead: (valueArg: unknown, expectedArg: {
+    cloudlyOrigin: string;
+    nodeId: string;
+    credentialGeneration: number;
+}) => INodeRuntimeBindingRead;
+/**
+ * Pure content binding for the root-local bind reply. `activeEnrollmentArg` must come from the
+ * Pallet owner's current durable state; a historical activation receipt is insufficient.
+ */
+export declare const bindPalletNodeRuntimeBinding: (responseArg: unknown, requestArg: unknown, activeEnrollmentArg: unknown) => INodeRuntimeRoutingBinding;
+/**
+ * Pure content binding for offline readback. `activeEnrollmentArg` must come from the Pallet
+ * owner's current durable state; a historical activation receipt is insufficient.
+ */
+export declare const bindPalletNodeRuntimeBindingRead: (responseArg: unknown, requestArg: unknown, activeEnrollmentArg: unknown) => INodeRuntimeRoutingBinding;

package/dist_ts/data/noderuntimebinding.js

@@ -0,0 +1,134 @@
+import { validateClusterRelay } from './cluster.js';
+import { snapshotClusterRuntimeReference } from './clusterruntime.js';
+import { snapshotPalletNodeEnrollmentConfirmation } from './nodeenrollment.js';
+import { deepFreezeValue } from '../private/canonicaljson.js';
+import { readExactDataRecord } from '../private/dataproperties.js';
+import { isClusterNodeId } from '../private/nodeidentifier.js';
+import { networkController, networkId } from '../private/networkcontract.js';
+export const nodeRuntimeBindingContract = Object.freeze({
+    localMutation: 'first-bind-or-exact-replay',
+    persistedAuthority: 'routing-only',
+    runtimeAuthority: 'fresh-authenticated-controller-session-only',
+});
+const fail = () => { throw new Error('Node runtime binding contract rejected.'); };
+function requireValue(conditionArg) {
+    if (!conditionArg)
+        fail();
+}
+const record = (valueArg, keysArg) => {
+    const result = readExactDataRecord(valueArg, keysArg);
+    requireValue(result !== null);
+    return result;
+};
+const positive = (valueArg) => {
+    requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+        && valueArg > 0 && !Object.is(valueArg, -0));
+    return valueArg;
+};
+const nonNegative = (valueArg) => {
+    requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+        && valueArg >= 0 && !Object.is(valueArg, -0));
+    return valueArg;
+};
+const nodeId = (valueArg) => isClusterNodeId(valueArg) ? valueArg : fail();
+const nodeToken = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^secureToken[a-f0-9]{64}$/.test(valueArg));
+    return valueArg;
+};
+const relay = (valueArg) => {
+    const value = record(valueArg, ['origin']);
+    requireValue(validateClusterRelay(value).length === 0);
+    return { origin: value.origin };
+};
+const cloudlyOrigin = (valueArg) => relay({ origin: valueArg }).origin;
+const activeEnrollment = (valueArg) => {
+    const value = snapshotPalletNodeEnrollmentConfirmation(valueArg);
+    requireValue(value.phase === 'active');
+    return value;
+};
+/** Exact detached snapshot; shape checks are not authentication. */
+export const snapshotNodeRuntimeRoutingBinding = (valueArg) => {
+    try {
+        const value = record(valueArg, ['cloudlyOrigin', 'nodeId', 'clusterId', 'controller', 'runtimeNamespace', 'relay']);
+        const controller = networkController(record(value.controller, ['kind', 'id', 'epoch']));
+        requireValue(controller.kind === 'cloudly');
+        return deepFreezeValue({
+            cloudlyOrigin: cloudlyOrigin(value.cloudlyOrigin),
+            nodeId: nodeId(value.nodeId), clusterId: networkId(value.clusterId),
+            controller: { kind: 'cloudly', id: controller.id, epoch: controller.epoch },
+            runtimeNamespace: networkId(value.runtimeNamespace), relay: relay(value.relay),
+        });
+    }
+    catch {
+        return fail();
+    }
+};
+/** Exact detached authenticated-read request; validation never logs or returns the bearer. */
+export const snapshotNodeRuntimeBindingRequest = (valueArg) => {
+    try {
+        const value = record(valueArg, ['nodeId', 'nodeToken']);
+        return deepFreezeValue({ nodeId: nodeId(value.nodeId), nodeToken: nodeToken(value.nodeToken) });
+    }
+    catch {
+        return fail();
+    }
+};
+/** Exact detached current read; its runtime must name the binding's cluster. */
+export const snapshotNodeRuntimeBindingRead = (valueArg) => {
+    try {
+        const value = record(valueArg, ['binding', 'runtime', 'credentialGeneration', 'sessionEpoch']);
+        const binding = snapshotNodeRuntimeRoutingBinding(value.binding);
+        const runtime = snapshotClusterRuntimeReference(value.runtime);
+        requireValue(runtime.id === binding.clusterId);
+        return deepFreezeValue({ binding, runtime,
+            credentialGeneration: positive(value.credentialGeneration),
+            sessionEpoch: nonNegative(value.sessionEpoch) });
+    }
+    catch {
+        return fail();
+    }
+};
+/**
+ * Bind a server answer to the Spark identity that made the authenticated read.
+ * Authentication and the current credential transaction remain Cloudly's responsibility.
+ */
+export const bindNodeRuntimeBindingRead = (valueArg, expectedArg) => {
+    try {
+        const expected = record(expectedArg, ['cloudlyOrigin', 'nodeId', 'credentialGeneration']);
+        const value = snapshotNodeRuntimeBindingRead(valueArg);
+        requireValue(value.binding.cloudlyOrigin === cloudlyOrigin(expected.cloudlyOrigin)
+            && value.binding.nodeId === nodeId(expected.nodeId)
+            && value.credentialGeneration === positive(expected.credentialGeneration));
+        return value;
+    }
+    catch {
+        return fail();
+    }
+};
+/**
+ * Pure content binding for the root-local bind reply. `activeEnrollmentArg` must come from the
+ * Pallet owner's current durable state; a historical activation receipt is insufficient.
+ */
+export const bindPalletNodeRuntimeBinding = (responseArg, requestArg, activeEnrollmentArg) => {
+    const response = snapshotNodeRuntimeRoutingBinding(responseArg);
+    const request = snapshotNodeRuntimeRoutingBinding(requestArg);
+    const active = activeEnrollment(activeEnrollmentArg);
+    requireValue(request.cloudlyOrigin === active.cloudlyOrigin && request.nodeId === active.nodeId
+        && JSON.stringify(response) === JSON.stringify(request));
+    return response;
+};
+/**
+ * Pure content binding for offline readback. `activeEnrollmentArg` must come from the Pallet
+ * owner's current durable state; a historical activation receipt is insufficient.
+ */
+export const bindPalletNodeRuntimeBindingRead = (responseArg, requestArg, activeEnrollmentArg) => {
+    const request = record(requestArg, ['cloudlyOrigin', 'nodeId']);
+    const response = snapshotNodeRuntimeRoutingBinding(responseArg);
+    const active = activeEnrollment(activeEnrollmentArg);
+    const requestedOrigin = cloudlyOrigin(request.cloudlyOrigin);
+    const requestedNodeId = nodeId(request.nodeId);
+    requireValue(response.cloudlyOrigin === requestedOrigin && response.nodeId === requestedNodeId
+        && requestedOrigin === active.cloudlyOrigin && requestedNodeId === active.nodeId);
+    return response;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZXJ1bnRpbWViaW5kaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9ub2RlcnVudGltZWJpbmRpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBRXBELE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRXRFLE9BQU8sRUFBRSx3Q0FBd0MsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRS9FLE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUM5RCxPQUFPLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUNuRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDL0QsT0FBTyxFQUFFLGlCQUFpQixFQUFFLFNBQVMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBa0M3RSxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3RELGFBQWEsRUFBRSw0QkFBNEI7SUFDM0Msa0JBQWtCLEVBQUUsY0FBYztJQUNsQyxnQkFBZ0IsRUFBRSw2Q0FBNkM7Q0FDdkQsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzFGLFNBQVMsWUFBWSxDQUFDLFlBQXFCO0lBQ3pDLElBQUksQ0FBQyxZQUFZO1FBQUUsSUFBSSxFQUFFLENBQUM7QUFDNUIsQ0FBQztBQUNELE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUEwQixFQUEyQixFQUFFO0lBQ3hGLE1BQU0sTUFBTSxHQUFHLG1CQUFtQixDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUN0RCxZQUFZLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQzlCLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUNGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzdDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDdEUsUUFBUSxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMvQyxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUNoRCxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDO1dBQ3RFLFFBQVEsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUUsQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7QUFDNUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDOUMsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSwyQkFBMkIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN6RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLEtBQUssR0FBRyxDQUFDLFFBQWlCLEVBQWlCLEVBQUU7SUFDakQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDM0MsWUFBWSxDQUFDLG9CQUFvQixDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN2RCxPQUFPLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFnQixFQUFFLENBQUM7QUFDNUMsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxhQUFhLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUM7QUFDeEYsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQWlCLEVBQStCLEVBQUU7SUFDMUUsTUFBTSxLQUFLLEdBQUcsd0NBQXdDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakUsWUFBWSxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDdkMsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDLENBQUM7QUFFRixvRUFBb0U7QUFDcEUsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FDL0MsUUFBaUIsRUFDVyxFQUFFO0lBQzlCLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQzNCLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDdkYsTUFBTSxVQUFVLEdBQUcsaUJBQWlCLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN4RixZQUFZLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQztRQUM1QyxPQUFPLGVBQWUsQ0FBQztZQUNyQixhQUFhLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUM7WUFDakQsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1lBQ25FLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLLEVBQUU7WUFDM0UsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQztTQUMvRSxDQUFDLENBQUM7SUFDTCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNoQixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsOEZBQThGO0FBQzlGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQy9DLFFBQWlCLEVBQ1csRUFBRTtJQUM5QixJQUFJLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7UUFDeEQsT0FBTyxlQUFlLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFDaEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLGdGQUFnRjtBQUNoRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxRQUFpQixFQUNRLEVBQUU7SUFDM0IsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFDM0IsQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLHNCQUFzQixFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7UUFDbEUsTUFBTSxPQUFPLEdBQUcsaUNBQWlDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2pFLE1BQU0sT0FBTyxHQUFHLCtCQUErQixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUMvRCxZQUFZLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDL0MsT0FBTyxlQUFlLENBQUMsRUFBRSxPQUFPLEVBQUUsT0FBTztZQUN2QyxvQkFBb0IsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDO1lBQzFELFlBQVksRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNoQixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FDeEMsUUFBaUIsRUFDakIsV0FBb0YsRUFDM0QsRUFBRTtJQUMzQixJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxzQkFBc0IsQ0FBQyxDQUFDLENBQUM7UUFDMUYsTUFBTSxLQUFLLEdBQUcsOEJBQThCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDdkQsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxLQUFLLGFBQWEsQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDO2VBQzdFLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO2VBQ2hELEtBQUssQ0FBQyxvQkFBb0IsS0FBSyxRQUFRLENBQUMsUUFBUSxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQztRQUM3RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUMxQyxXQUFvQixFQUNwQixVQUFtQixFQUNuQixtQkFBNEIsRUFDQSxFQUFFO0lBQzlCLE1BQU0sUUFBUSxHQUFHLGlDQUFpQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sT0FBTyxHQUFHLGlDQUFpQyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzlELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDckQsWUFBWSxDQUFDLE9BQU8sQ0FBQyxhQUFhLEtBQUssTUFBTSxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxNQUFNO1dBQzFGLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQzNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQzlDLFdBQW9CLEVBQ3BCLFVBQW1CLEVBQ25CLG1CQUE0QixFQUNBLEVBQUU7SUFDOUIsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLGVBQWUsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sUUFBUSxHQUFHLGlDQUFpQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDckQsTUFBTSxlQUFlLEdBQUcsYUFBYSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUM3RCxNQUFNLGVBQWUsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQy9DLFlBQVksQ0FBQyxRQUFRLENBQUMsYUFBYSxLQUFLLGVBQWUsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLGVBQWU7V0FDekYsZUFBZSxLQUFLLE1BQU0sQ0FBQyxhQUFhLElBQUksZUFBZSxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNwRixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMifQ==

package/dist_ts/requests/node.d.ts

@@ -6,6 +6,7 @@ import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
 import type { INodeCredentialMetadata, INodeCredentialMutationPreconditions, INodeCredentialMutationResult, TNodeCredentialPurpose } from '../data/nodecredential.js';
 import type { INodeRuntimeRetirement } from '../data/noderetirement.js';
+import type { INodeRuntimeBindingRead, INodeRuntimeBindingRequest } from '../data/noderuntimebinding.js';
 import type { INodeEnrollmentRequest, INodeEnrollmentAcknowledgement, INodeEnrollmentState } from '../data/nodeenrollment.js';
 /** Node-self adoption preconditions, not an admin or workload RBAC grant. */
 export interface IReq_Spark_Cloudly_GetNodeEnrollmentState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Cloudly_GetNodeEnrollmentState> {
@@ -24,6 +25,16 @@ export interface IReq_Spark_Cloudly_EnrollNode extends plugins.typedrequestInter
     /** Replays require the exact receipt AND both current credential authorities. */
     response: INodeEnrollmentAcknowledgement;
 }
+/**
+ * Current Spark-node-authenticated routing read. Cloudly derives every response identity from its
+ * node, cluster, runtime-controller, relay and credential records in one consistent read.
+ */
+export interface IReq_Spark_Cloudly_GetNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Cloudly_GetNodeRuntimeBinding> {
+    method: 'getNodeRuntimeBinding';
+    request: INodeRuntimeBindingRequest;
+    /** Routing and current phase observation only; this grants no workload or phase authority. */
+    response: INodeRuntimeBindingRead;
+}
 /** Requires verified platform-infrastructure admin authority; returns public data only. */
 export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetNodeConfig> {
     method: 'getNodeConfig';

package/dist_ts/requests/pallet.d.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../plugins.js';
 import type { INodeEnrollment, IPalletNodeEnrollmentActivation, IPalletNodeEnrollmentPreparation, IPalletNodeEnrollmentBound, IPalletNodeEnrollmentActive } from '../data/nodeenrollment.js';
+import type { INodeRuntimeRoutingBinding } from '../data/noderuntimebinding.js';
 /** Root-authenticated node-local IPC only; never expose on a network router. */
 export interface IReq_Spark_Pallet_PrepareNodeEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_PrepareNodeEnrollment> {
     method: 'preparePalletNodeEnrollment';
@@ -21,3 +22,25 @@ export interface IReq_Spark_Pallet_ActivateNodeEnrollment extends plugins.typedr
     /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
     response: IPalletNodeEnrollmentActive;
 }
+/**
+ * First immutable routing bind or exact replay. The local owner rejects unless `cloudlyOrigin` and
+ * `nodeId` match its current active enrollment; this never mutates credentials, workload state or runtime phase.
+ */
+export interface IReq_Spark_Pallet_BindNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_BindNodeRuntimeBinding> {
+    method: 'bindPalletNodeRuntimeBinding';
+    request: INodeRuntimeRoutingBinding;
+    /** Exact currently persisted binding, answered only after the durable write or exact replay. */
+    response: INodeRuntimeRoutingBinding;
+}
+/**
+ * Offline routing readback. The root-local owner rejects an absent binding, an inactive enrollment
+ * or a requested origin/node different from both its active enrollment and persisted binding.
+ */
+export interface IReq_Spark_Pallet_ReadNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_ReadNodeRuntimeBinding> {
+    method: 'readPalletNodeRuntimeBinding';
+    request: {
+        cloudlyOrigin: string;
+        nodeId: string;
+    };
+    response: INodeRuntimeRoutingBinding;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.10.1",
+  "version": "32.11.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -266,6 +266,37 @@ bounded time/concurrency, root-only directory/socket permissions and drained
 cleanup. The package supplies no listener, permission checks or persistent state.
 No bearer, generic rotation operation or database access is part of this IPC API.
 
+### Node Runtime Routing Binding
+
+`requests.node.getNodeRuntimeBinding { nodeId, nodeToken }` is a current
+Spark-node-authenticated read. Cloudly derives `data.INodeRuntimeBindingRead`
+from its current credential, node, cluster, durable runtime-controller, relay and
+cluster-runtime records. The answer contains the exact routing identity
+`{ cloudlyOrigin, nodeId, clusterId, controller, runtimeNamespace, relay }`, the
+current `{ id, phase, generation }` runtime reference and the Spark credential
+generation and session epoch that authenticated the read.
+`snapshotNodeRuntimeBindingRead` requires the runtime id to equal the routing
+cluster, and `bindNodeRuntimeBindingRead` binds the answer to Spark's exact
+immutable Cloudly origin, node and credential generation. Neither helper
+authenticates the server.
+
+`requests.pallet.bindPalletNodeRuntimeBinding` and
+`readPalletNodeRuntimeBinding` belong on the existing root-owned Pallet enrollment
+control socket. Bind is absent-to-present only: the current active Pallet
+enrollment must name the same canonical Cloudly origin and node, an exact replay
+is idempotent and every different origin, node, cluster, controller, namespace
+or relay conflicts. Read requires the requested origin and node to equal both
+the active enrollment and the stored binding; an absent binding rejects. Spark
+applies and reads back the binding before starting `runtime-serve`. On an
+offline reboot it may read the exact persisted routing identity to select the
+relay, but that record grants no workload permission and no right to advance or
+run a cluster phase. Fresh authenticated runtime-session state remains the only
+workload authority.
+
+The local operations carry no bearer, signing key, generic configuration field,
+phase mutation or caller-authored permission. `nodeRuntimeBindingContract`
+states the immutable local mutation and routing-only persistence rules.
+
 ### Service Machine Credentials
 
 `requests.admin.getServiceMachineCredential` inspects redacted metadata;

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.10.1',
+  version: '32.11.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusterruntime.ts

@@ -27,6 +27,15 @@ export interface IClusterRuntime {
   changedBy: string;
 }
 
+/** Current phase reference without its administrative audit metadata. */
+export interface IClusterRuntimeReference {
+  /** The cluster id. */
+  id: string;
+  phase: TClusterRuntimePhase;
+  /** Exact compare-and-swap generation observed with this phase. */
+  generation: number;
+}
+
 /**
  * Why a cluster cannot leave `swarm` yet. Each blocker names the node or service it is about, so an
  * administrator can act on it without a second query.
@@ -43,3 +52,10 @@ export const snapshotClusterRuntime = (value: unknown): IClusterRuntime => produ
   return { id: networkId(item.id), phase: item.phase, generation: networkCounter(item.generation),
     changedAt: networkCounter(item.changedAt), changedBy: networkId(item.changedBy) };
 });
+
+/** Structural snapshot for node routing reads; it grants no right to move or run a phase. */
+export const snapshotClusterRuntimeReference = (value: unknown): IClusterRuntimeReference => producerSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['id', 'phase', 'generation']);
+  requireNetwork(isOneOf(clusterRuntimePhases, item.phase));
+  return { id: networkId(item.id), phase: item.phase, generation: networkCounter(item.generation) };
+});

package/ts/data/index.ts

@@ -26,6 +26,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './noderuntimebinding.js';
 export * from './noderetirement.js';
 export * from './networkaddressplan.js';
 export * from './networkauthority.js';

package/ts/data/noderuntimebinding.ts

@@ -0,0 +1,191 @@
+import type { IClusterRelay } from './cluster.js';
+import { validateClusterRelay } from './cluster.js';
+import type { IClusterRuntimeReference } from './clusterruntime.js';
+import { snapshotClusterRuntimeReference } from './clusterruntime.js';
+import type { IPalletNodeEnrollmentActive } from './nodeenrollment.js';
+import { snapshotPalletNodeEnrollmentConfirmation } from './nodeenrollment.js';
+import type { IRuntimeController } from './runtimeassignment.js';
+import { deepFreezeValue } from '../private/canonicaljson.js';
+import { readExactDataRecord } from '../private/dataproperties.js';
+import { isClusterNodeId } from '../private/nodeidentifier.js';
+import { networkController, networkId } from '../private/networkcontract.js';
+
+/**
+ * Durable routing identity for one Pallet node.
+ *
+ * This is not a runtime session, a workload grant or a cluster-phase authority. It only names the
+ * Cloudly controller and relay through which the node obtains fresh authenticated session state.
+ */
+export interface INodeRuntimeRoutingBinding {
+  /** Exact immutable enrollment authority; Pallet compares it with its current active identity. */
+  cloudlyOrigin: string;
+  nodeId: string;
+  clusterId: string;
+  controller: IRuntimeController & { kind: 'cloudly' };
+  runtimeNamespace: string;
+  relay: IClusterRelay;
+}
+
+/** Sensitive authenticated read input; never persist, log, put in a URL or return it. */
+export interface INodeRuntimeBindingRequest {
+  nodeId: string;
+  nodeToken: string;
+}
+
+/** Current server-owned answer to an authenticated Spark-node read. */
+export interface INodeRuntimeBindingRead {
+  binding: INodeRuntimeRoutingBinding;
+  runtime: IClusterRuntimeReference;
+  /** Generation of the Spark bearer that authenticated this exact answer. */
+  credentialGeneration: number;
+  /** Current Spark session fence; it is observation metadata, not part of the routing binding. */
+  sessionEpoch: number;
+}
+
+export const nodeRuntimeBindingContract = Object.freeze({
+  localMutation: 'first-bind-or-exact-replay',
+  persistedAuthority: 'routing-only',
+  runtimeAuthority: 'fresh-authenticated-controller-session-only',
+} as const);
+
+const fail = (): never => { throw new Error('Node runtime binding contract rejected.'); };
+function requireValue(conditionArg: unknown): asserts conditionArg {
+  if (!conditionArg) fail();
+}
+const record = (valueArg: unknown, keysArg: readonly string[]): Record<string, unknown> => {
+  const result = readExactDataRecord(valueArg, keysArg);
+  requireValue(result !== null);
+  return result;
+};
+const positive = (valueArg: unknown): number => {
+  requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+    && valueArg > 0 && !Object.is(valueArg, -0));
+  return valueArg;
+};
+const nonNegative = (valueArg: unknown): number => {
+  requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+    && valueArg >= 0 && !Object.is(valueArg, -0));
+  return valueArg;
+};
+const nodeId = (valueArg: unknown): string => isClusterNodeId(valueArg) ? valueArg : fail();
+const nodeToken = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && /^secureToken[a-f0-9]{64}$/.test(valueArg));
+  return valueArg;
+};
+const relay = (valueArg: unknown): IClusterRelay => {
+  const value = record(valueArg, ['origin']);
+  requireValue(validateClusterRelay(value).length === 0);
+  return { origin: value.origin as string };
+};
+const cloudlyOrigin = (valueArg: unknown): string => relay({ origin: valueArg }).origin;
+const activeEnrollment = (valueArg: unknown): IPalletNodeEnrollmentActive => {
+  const value = snapshotPalletNodeEnrollmentConfirmation(valueArg);
+  requireValue(value.phase === 'active');
+  return value;
+};
+
+/** Exact detached snapshot; shape checks are not authentication. */
+export const snapshotNodeRuntimeRoutingBinding = (
+  valueArg: unknown,
+): INodeRuntimeRoutingBinding => {
+  try {
+    const value = record(valueArg,
+      ['cloudlyOrigin', 'nodeId', 'clusterId', 'controller', 'runtimeNamespace', 'relay']);
+    const controller = networkController(record(value.controller, ['kind', 'id', 'epoch']));
+    requireValue(controller.kind === 'cloudly');
+    return deepFreezeValue({
+      cloudlyOrigin: cloudlyOrigin(value.cloudlyOrigin),
+      nodeId: nodeId(value.nodeId), clusterId: networkId(value.clusterId),
+      controller: { kind: 'cloudly', id: controller.id, epoch: controller.epoch },
+      runtimeNamespace: networkId(value.runtimeNamespace), relay: relay(value.relay),
+    });
+  } catch {
+    return fail();
+  }
+};
+
+/** Exact detached authenticated-read request; validation never logs or returns the bearer. */
+export const snapshotNodeRuntimeBindingRequest = (
+  valueArg: unknown,
+): INodeRuntimeBindingRequest => {
+  try {
+    const value = record(valueArg, ['nodeId', 'nodeToken']);
+    return deepFreezeValue({ nodeId: nodeId(value.nodeId), nodeToken: nodeToken(value.nodeToken) });
+  } catch {
+    return fail();
+  }
+};
+
+/** Exact detached current read; its runtime must name the binding's cluster. */
+export const snapshotNodeRuntimeBindingRead = (
+  valueArg: unknown,
+): INodeRuntimeBindingRead => {
+  try {
+    const value = record(valueArg,
+      ['binding', 'runtime', 'credentialGeneration', 'sessionEpoch']);
+    const binding = snapshotNodeRuntimeRoutingBinding(value.binding);
+    const runtime = snapshotClusterRuntimeReference(value.runtime);
+    requireValue(runtime.id === binding.clusterId);
+    return deepFreezeValue({ binding, runtime,
+      credentialGeneration: positive(value.credentialGeneration),
+      sessionEpoch: nonNegative(value.sessionEpoch) });
+  } catch {
+    return fail();
+  }
+};
+
+/**
+ * Bind a server answer to the Spark identity that made the authenticated read.
+ * Authentication and the current credential transaction remain Cloudly's responsibility.
+ */
+export const bindNodeRuntimeBindingRead = (
+  valueArg: unknown,
+  expectedArg: { cloudlyOrigin: string; nodeId: string; credentialGeneration: number },
+): INodeRuntimeBindingRead => {
+  try {
+    const expected = record(expectedArg, ['cloudlyOrigin', 'nodeId', 'credentialGeneration']);
+    const value = snapshotNodeRuntimeBindingRead(valueArg);
+    requireValue(value.binding.cloudlyOrigin === cloudlyOrigin(expected.cloudlyOrigin)
+      && value.binding.nodeId === nodeId(expected.nodeId)
+      && value.credentialGeneration === positive(expected.credentialGeneration));
+    return value;
+  } catch {
+    return fail();
+  }
+};
+
+/**
+ * Pure content binding for the root-local bind reply. `activeEnrollmentArg` must come from the
+ * Pallet owner's current durable state; a historical activation receipt is insufficient.
+ */
+export const bindPalletNodeRuntimeBinding = (
+  responseArg: unknown,
+  requestArg: unknown,
+  activeEnrollmentArg: unknown,
+): INodeRuntimeRoutingBinding => {
+  const response = snapshotNodeRuntimeRoutingBinding(responseArg);
+  const request = snapshotNodeRuntimeRoutingBinding(requestArg);
+  const active = activeEnrollment(activeEnrollmentArg);
+  requireValue(request.cloudlyOrigin === active.cloudlyOrigin && request.nodeId === active.nodeId
+    && JSON.stringify(response) === JSON.stringify(request));
+  return response;
+};
+
+/**
+ * Pure content binding for offline readback. `activeEnrollmentArg` must come from the Pallet
+ * owner's current durable state; a historical activation receipt is insufficient.
+ */
+export const bindPalletNodeRuntimeBindingRead = (
+  responseArg: unknown,
+  requestArg: unknown,
+  activeEnrollmentArg: unknown,
+): INodeRuntimeRoutingBinding => {
+  const request = record(requestArg, ['cloudlyOrigin', 'nodeId']);
+  const response = snapshotNodeRuntimeRoutingBinding(responseArg);
+  const active = activeEnrollment(activeEnrollmentArg);
+  const requestedOrigin = cloudlyOrigin(request.cloudlyOrigin);
+  const requestedNodeId = nodeId(request.nodeId);
+  requireValue(response.cloudlyOrigin === requestedOrigin && response.nodeId === requestedNodeId
+    && requestedOrigin === active.cloudlyOrigin && requestedNodeId === active.nodeId);
+  return response;
+};

package/ts/requests/node.ts

@@ -11,6 +11,7 @@ import type {
   TNodeCredentialPurpose,
 } from '../data/nodecredential.js';
 import type { INodeRuntimeRetirement } from '../data/noderetirement.js';
+import type { INodeRuntimeBindingRead, INodeRuntimeBindingRequest } from '../data/noderuntimebinding.js';
 import type {
   INodeEnrollmentRequest,
   INodeEnrollmentAcknowledgement,
@@ -39,6 +40,20 @@ export interface IReq_Spark_Cloudly_EnrollNode extends plugins.typedrequestInter
   response: INodeEnrollmentAcknowledgement;
 }
 
+/**
+ * Current Spark-node-authenticated routing read. Cloudly derives every response identity from its
+ * node, cluster, runtime-controller, relay and credential records in one consistent read.
+ */
+export interface IReq_Spark_Cloudly_GetNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Cloudly_GetNodeRuntimeBinding
+> {
+  method: 'getNodeRuntimeBinding';
+  request: INodeRuntimeBindingRequest;
+  /** Routing and current phase observation only; this grants no workload or phase authority. */
+  response: INodeRuntimeBindingRead;
+}
+
 /** Requires verified platform-infrastructure admin authority; returns public data only. */
 export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,

package/ts/requests/pallet.ts

@@ -3,6 +3,7 @@ import type {
   INodeEnrollment, IPalletNodeEnrollmentActivation, IPalletNodeEnrollmentPreparation,
   IPalletNodeEnrollmentBound, IPalletNodeEnrollmentActive,
 } from '../data/nodeenrollment.js';
+import type { INodeRuntimeRoutingBinding } from '../data/noderuntimebinding.js';
 
 /** Root-authenticated node-local IPC only; never expose on a network router. */
 export interface IReq_Spark_Pallet_PrepareNodeEnrollment extends plugins.typedrequestInterfaces.implementsTR<
@@ -36,3 +37,30 @@ export interface IReq_Spark_Pallet_ActivateNodeEnrollment extends plugins.typedr
   /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
   response: IPalletNodeEnrollmentActive;
 }
+
+/**
+ * First immutable routing bind or exact replay. The local owner rejects unless `cloudlyOrigin` and
+ * `nodeId` match its current active enrollment; this never mutates credentials, workload state or runtime phase.
+ */
+export interface IReq_Spark_Pallet_BindNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_BindNodeRuntimeBinding
+> {
+  method: 'bindPalletNodeRuntimeBinding';
+  request: INodeRuntimeRoutingBinding;
+  /** Exact currently persisted binding, answered only after the durable write or exact replay. */
+  response: INodeRuntimeRoutingBinding;
+}
+
+/**
+ * Offline routing readback. The root-local owner rejects an absent binding, an inactive enrollment
+ * or a requested origin/node different from both its active enrollment and persisted binding.
+ */
+export interface IReq_Spark_Pallet_ReadNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_ReadNodeRuntimeBinding
+> {
+  method: 'readPalletNodeRuntimeBinding';
+  request: { cloudlyOrigin: string; nodeId: string };
+  response: INodeRuntimeRoutingBinding;
+}