@serve.zone/interfaces 32.10.1 → 32.12.0

package/changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2026-09-20 - 32.12.0
+
+### Features
+
+- Preserve one canonical service on multiple cluster runtime targets. The existing runtime spec,
+  status, write, assignment and push shapes stay unchanged; exact-cluster and paged target reads
+  expose every target, while the scalar read refuses an ambiguous multi-target result. A guarded
+  exact-cluster removal carries only its revision fence, leaving Cloudly to derive held state,
+  completed slot settlement and release, and current runtime-phase authority.
+
+## 2026-09-20 - 32.11.0
+
+### Features
+
+- Add the Spark-authenticated current node runtime routing read and immutable root-local Pallet
+  bind/readback contracts. Both paths bind the routing identity to the exact current Cloudly
+  enrollment origin and node. The persisted binding names routing only; current authenticated
+  runtime sessions remain the sole workload authority.
+
 ## 2026-09-20 - 32.10.1
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.10.1',
+    version: '32.12.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/clusterruntime.d.ts

@@ -21,6 +21,14 @@ export interface IClusterRuntime {
     /** The administrator or producer that made the change. */
     changedBy: string;
 }
+/** Current phase reference without its administrative audit metadata. */
+export interface IClusterRuntimeReference {
+    /** The cluster id. */
+    id: string;
+    phase: TClusterRuntimePhase;
+    /** Exact compare-and-swap generation observed with this phase. */
+    generation: number;
+}
 /**
  * Why a cluster cannot leave `swarm` yet. Each blocker names the node or service it is about, so an
  * administrator can act on it without a second query.
@@ -36,4 +44,6 @@ export type TClusterRuntimeBlocker = {
 };
 /** Structural snapshot for exact persistence; which phase may follow which is the cutover's decision. */
 export declare const snapshotClusterRuntime: (value: unknown) => IClusterRuntime;
+/** Structural snapshot for node routing reads; it grants no right to move or run a phase. */
+export declare const snapshotClusterRuntimeReference: (value: unknown) => IClusterRuntimeReference;
 export {};

package/dist_ts/data/clusterruntime.js

@@ -8,4 +8,10 @@ export const snapshotClusterRuntime = (value) => producerSafe(() => {
     return { id: networkId(item.id), phase: item.phase, generation: networkCounter(item.generation),
         changedAt: networkCounter(item.changedAt), changedBy: networkId(item.changedBy) };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcnJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsY0FBYyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDekgsT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUV2RSxNQUFNLG9CQUFvQixHQUFHLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFVLENBQUM7QUFtQ25GLHlHQUF5RztBQUN6RyxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLEtBQWMsRUFBbUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDM0YsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzNHLGNBQWMsQ0FBQyxPQUFPLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUQsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQztRQUM3RixTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQ3RGLENBQUMsQ0FBQyxDQUFDIn0=
+/** Structural snapshot for node routing reads; it grants no right to move or run a phase. */
+export const snapshotClusterRuntimeReference = (value) => producerSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['id', 'phase', 'generation']);
+    requireNetwork(isOneOf(clusterRuntimePhases, item.phase));
+    return { id: networkId(item.id), phase: item.phase, generation: networkCounter(item.generation) };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcnJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsY0FBYyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFDekgsT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUV2RSxNQUFNLG9CQUFvQixHQUFHLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFVLENBQUM7QUE0Q25GLHlHQUF5RztBQUN6RyxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLEtBQWMsRUFBbUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDM0YsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzNHLGNBQWMsQ0FBQyxPQUFPLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUQsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQztRQUM3RixTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQ3RGLENBQUMsQ0FBQyxDQUFDO0FBRUgsNkZBQTZGO0FBQzdGLE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLENBQUMsS0FBYyxFQUE0QixFQUFFLENBQUMsWUFBWSxDQUFDLEdBQUcsRUFBRTtJQUM3RyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLE9BQU8sRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ2pGLGNBQWMsQ0FBQyxPQUFPLENBQUMsb0JBQW9CLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUQsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDcEcsQ0FBQyxDQUFDLENBQUMifQ==

package/dist_ts/data/index.d.ts

@@ -26,6 +26,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './noderuntimebinding.js';
 export * from './noderetirement.js';
 export * from './networkaddressplan.js';
 export * from './networkauthority.js';

package/dist_ts/data/index.js

@@ -26,6 +26,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './noderuntimebinding.js';
 export * from './noderetirement.js';
 export * from './networkaddressplan.js';
 export * from './networkauthority.js';
@@ -60,4 +61,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyx3QkFBd0IsQ0FBQztBQUV2QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBRXZDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/data/noderuntimebinding.d.ts

@@ -0,0 +1,64 @@
+import type { IClusterRelay } from './cluster.js';
+import type { IClusterRuntimeReference } from './clusterruntime.js';
+import type { IRuntimeController } from './runtimeassignment.js';
+/**
+ * Durable routing identity for one Pallet node.
+ *
+ * This is not a runtime session, a workload grant or a cluster-phase authority. It only names the
+ * Cloudly controller and relay through which the node obtains fresh authenticated session state.
+ */
+export interface INodeRuntimeRoutingBinding {
+    /** Exact immutable enrollment authority; Pallet compares it with its current active identity. */
+    cloudlyOrigin: string;
+    nodeId: string;
+    clusterId: string;
+    controller: IRuntimeController & {
+        kind: 'cloudly';
+    };
+    runtimeNamespace: string;
+    relay: IClusterRelay;
+}
+/** Sensitive authenticated read input; never persist, log, put in a URL or return it. */
+export interface INodeRuntimeBindingRequest {
+    nodeId: string;
+    nodeToken: string;
+}
+/** Current server-owned answer to an authenticated Spark-node read. */
+export interface INodeRuntimeBindingRead {
+    binding: INodeRuntimeRoutingBinding;
+    runtime: IClusterRuntimeReference;
+    /** Generation of the Spark bearer that authenticated this exact answer. */
+    credentialGeneration: number;
+    /** Current Spark session fence; it is observation metadata, not part of the routing binding. */
+    sessionEpoch: number;
+}
+export declare const nodeRuntimeBindingContract: Readonly<{
+    readonly localMutation: "first-bind-or-exact-replay";
+    readonly persistedAuthority: "routing-only";
+    readonly runtimeAuthority: "fresh-authenticated-controller-session-only";
+}>;
+/** Exact detached snapshot; shape checks are not authentication. */
+export declare const snapshotNodeRuntimeRoutingBinding: (valueArg: unknown) => INodeRuntimeRoutingBinding;
+/** Exact detached authenticated-read request; validation never logs or returns the bearer. */
+export declare const snapshotNodeRuntimeBindingRequest: (valueArg: unknown) => INodeRuntimeBindingRequest;
+/** Exact detached current read; its runtime must name the binding's cluster. */
+export declare const snapshotNodeRuntimeBindingRead: (valueArg: unknown) => INodeRuntimeBindingRead;
+/**
+ * Bind a server answer to the Spark identity that made the authenticated read.
+ * Authentication and the current credential transaction remain Cloudly's responsibility.
+ */
+export declare const bindNodeRuntimeBindingRead: (valueArg: unknown, expectedArg: {
+    cloudlyOrigin: string;
+    nodeId: string;
+    credentialGeneration: number;
+}) => INodeRuntimeBindingRead;
+/**
+ * Pure content binding for the root-local bind reply. `activeEnrollmentArg` must come from the
+ * Pallet owner's current durable state; a historical activation receipt is insufficient.
+ */
+export declare const bindPalletNodeRuntimeBinding: (responseArg: unknown, requestArg: unknown, activeEnrollmentArg: unknown) => INodeRuntimeRoutingBinding;
+/**
+ * Pure content binding for offline readback. `activeEnrollmentArg` must come from the Pallet
+ * owner's current durable state; a historical activation receipt is insufficient.
+ */
+export declare const bindPalletNodeRuntimeBindingRead: (responseArg: unknown, requestArg: unknown, activeEnrollmentArg: unknown) => INodeRuntimeRoutingBinding;

package/dist_ts/data/noderuntimebinding.js

@@ -0,0 +1,134 @@
+import { validateClusterRelay } from './cluster.js';
+import { snapshotClusterRuntimeReference } from './clusterruntime.js';
+import { snapshotPalletNodeEnrollmentConfirmation } from './nodeenrollment.js';
+import { deepFreezeValue } from '../private/canonicaljson.js';
+import { readExactDataRecord } from '../private/dataproperties.js';
+import { isClusterNodeId } from '../private/nodeidentifier.js';
+import { networkController, networkId } from '../private/networkcontract.js';
+export const nodeRuntimeBindingContract = Object.freeze({
+    localMutation: 'first-bind-or-exact-replay',
+    persistedAuthority: 'routing-only',
+    runtimeAuthority: 'fresh-authenticated-controller-session-only',
+});
+const fail = () => { throw new Error('Node runtime binding contract rejected.'); };
+function requireValue(conditionArg) {
+    if (!conditionArg)
+        fail();
+}
+const record = (valueArg, keysArg) => {
+    const result = readExactDataRecord(valueArg, keysArg);
+    requireValue(result !== null);
+    return result;
+};
+const positive = (valueArg) => {
+    requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+        && valueArg > 0 && !Object.is(valueArg, -0));
+    return valueArg;
+};
+const nonNegative = (valueArg) => {
+    requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+        && valueArg >= 0 && !Object.is(valueArg, -0));
+    return valueArg;
+};
+const nodeId = (valueArg) => isClusterNodeId(valueArg) ? valueArg : fail();
+const nodeToken = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^secureToken[a-f0-9]{64}$/.test(valueArg));
+    return valueArg;
+};
+const relay = (valueArg) => {
+    const value = record(valueArg, ['origin']);
+    requireValue(validateClusterRelay(value).length === 0);
+    return { origin: value.origin };
+};
+const cloudlyOrigin = (valueArg) => relay({ origin: valueArg }).origin;
+const activeEnrollment = (valueArg) => {
+    const value = snapshotPalletNodeEnrollmentConfirmation(valueArg);
+    requireValue(value.phase === 'active');
+    return value;
+};
+/** Exact detached snapshot; shape checks are not authentication. */
+export const snapshotNodeRuntimeRoutingBinding = (valueArg) => {
+    try {
+        const value = record(valueArg, ['cloudlyOrigin', 'nodeId', 'clusterId', 'controller', 'runtimeNamespace', 'relay']);
+        const controller = networkController(record(value.controller, ['kind', 'id', 'epoch']));
+        requireValue(controller.kind === 'cloudly');
+        return deepFreezeValue({
+            cloudlyOrigin: cloudlyOrigin(value.cloudlyOrigin),
+            nodeId: nodeId(value.nodeId), clusterId: networkId(value.clusterId),
+            controller: { kind: 'cloudly', id: controller.id, epoch: controller.epoch },
+            runtimeNamespace: networkId(value.runtimeNamespace), relay: relay(value.relay),
+        });
+    }
+    catch {
+        return fail();
+    }
+};
+/** Exact detached authenticated-read request; validation never logs or returns the bearer. */
+export const snapshotNodeRuntimeBindingRequest = (valueArg) => {
+    try {
+        const value = record(valueArg, ['nodeId', 'nodeToken']);
+        return deepFreezeValue({ nodeId: nodeId(value.nodeId), nodeToken: nodeToken(value.nodeToken) });
+    }
+    catch {
+        return fail();
+    }
+};
+/** Exact detached current read; its runtime must name the binding's cluster. */
+export const snapshotNodeRuntimeBindingRead = (valueArg) => {
+    try {
+        const value = record(valueArg, ['binding', 'runtime', 'credentialGeneration', 'sessionEpoch']);
+        const binding = snapshotNodeRuntimeRoutingBinding(value.binding);
+        const runtime = snapshotClusterRuntimeReference(value.runtime);
+        requireValue(runtime.id === binding.clusterId);
+        return deepFreezeValue({ binding, runtime,
+            credentialGeneration: positive(value.credentialGeneration),
+            sessionEpoch: nonNegative(value.sessionEpoch) });
+    }
+    catch {
+        return fail();
+    }
+};
+/**
+ * Bind a server answer to the Spark identity that made the authenticated read.
+ * Authentication and the current credential transaction remain Cloudly's responsibility.
+ */
+export const bindNodeRuntimeBindingRead = (valueArg, expectedArg) => {
+    try {
+        const expected = record(expectedArg, ['cloudlyOrigin', 'nodeId', 'credentialGeneration']);
+        const value = snapshotNodeRuntimeBindingRead(valueArg);
+        requireValue(value.binding.cloudlyOrigin === cloudlyOrigin(expected.cloudlyOrigin)
+            && value.binding.nodeId === nodeId(expected.nodeId)
+            && value.credentialGeneration === positive(expected.credentialGeneration));
+        return value;
+    }
+    catch {
+        return fail();
+    }
+};
+/**
+ * Pure content binding for the root-local bind reply. `activeEnrollmentArg` must come from the
+ * Pallet owner's current durable state; a historical activation receipt is insufficient.
+ */
+export const bindPalletNodeRuntimeBinding = (responseArg, requestArg, activeEnrollmentArg) => {
+    const response = snapshotNodeRuntimeRoutingBinding(responseArg);
+    const request = snapshotNodeRuntimeRoutingBinding(requestArg);
+    const active = activeEnrollment(activeEnrollmentArg);
+    requireValue(request.cloudlyOrigin === active.cloudlyOrigin && request.nodeId === active.nodeId
+        && JSON.stringify(response) === JSON.stringify(request));
+    return response;
+};
+/**
+ * Pure content binding for offline readback. `activeEnrollmentArg` must come from the Pallet
+ * owner's current durable state; a historical activation receipt is insufficient.
+ */
+export const bindPalletNodeRuntimeBindingRead = (responseArg, requestArg, activeEnrollmentArg) => {
+    const request = record(requestArg, ['cloudlyOrigin', 'nodeId']);
+    const response = snapshotNodeRuntimeRoutingBinding(responseArg);
+    const active = activeEnrollment(activeEnrollmentArg);
+    const requestedOrigin = cloudlyOrigin(request.cloudlyOrigin);
+    const requestedNodeId = nodeId(request.nodeId);
+    requireValue(response.cloudlyOrigin === requestedOrigin && response.nodeId === requestedNodeId
+        && requestedOrigin === active.cloudlyOrigin && requestedNodeId === active.nodeId);
+    return response;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZXJ1bnRpbWViaW5kaW5nLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9ub2RlcnVudGltZWJpbmRpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBRXBELE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRXRFLE9BQU8sRUFBRSx3Q0FBd0MsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBRS9FLE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUM5RCxPQUFPLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUNuRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDL0QsT0FBTyxFQUFFLGlCQUFpQixFQUFFLFNBQVMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBa0M3RSxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3RELGFBQWEsRUFBRSw0QkFBNEI7SUFDM0Msa0JBQWtCLEVBQUUsY0FBYztJQUNsQyxnQkFBZ0IsRUFBRSw2Q0FBNkM7Q0FDdkQsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzFGLFNBQVMsWUFBWSxDQUFDLFlBQXFCO0lBQ3pDLElBQUksQ0FBQyxZQUFZO1FBQUUsSUFBSSxFQUFFLENBQUM7QUFDNUIsQ0FBQztBQUNELE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUEwQixFQUEyQixFQUFFO0lBQ3hGLE1BQU0sTUFBTSxHQUFHLG1CQUFtQixDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUN0RCxZQUFZLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQzlCLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUNGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzdDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDdEUsUUFBUSxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMvQyxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUNoRCxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDO1dBQ3RFLFFBQVEsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUUsQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7QUFDNUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDOUMsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSwyQkFBMkIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN6RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLEtBQUssR0FBRyxDQUFDLFFBQWlCLEVBQWlCLEVBQUU7SUFDakQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDM0MsWUFBWSxDQUFDLG9CQUFvQixDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN2RCxPQUFPLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFnQixFQUFFLENBQUM7QUFDNUMsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxhQUFhLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUM7QUFDeEYsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQWlCLEVBQStCLEVBQUU7SUFDMUUsTUFBTSxLQUFLLEdBQUcsd0NBQXdDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakUsWUFBWSxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDdkMsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDLENBQUM7QUFFRixvRUFBb0U7QUFDcEUsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FDL0MsUUFBaUIsRUFDVyxFQUFFO0lBQzlCLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQzNCLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDdkYsTUFBTSxVQUFVLEdBQUcsaUJBQWlCLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN4RixZQUFZLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQztRQUM1QyxPQUFPLGVBQWUsQ0FBQztZQUNyQixhQUFhLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUM7WUFDakQsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1lBQ25FLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLLEVBQUU7WUFDM0UsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLEtBQUssRUFBRSxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQztTQUMvRSxDQUFDLENBQUM7SUFDTCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNoQixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsOEZBQThGO0FBQzlGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQy9DLFFBQWlCLEVBQ1csRUFBRTtJQUM5QixJQUFJLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7UUFDeEQsT0FBTyxlQUFlLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFDaEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLGdGQUFnRjtBQUNoRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxRQUFpQixFQUNRLEVBQUU7SUFDM0IsSUFBSSxDQUFDO1FBQ0gsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFDM0IsQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLHNCQUFzQixFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7UUFDbEUsTUFBTSxPQUFPLEdBQUcsaUNBQWlDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2pFLE1BQU0sT0FBTyxHQUFHLCtCQUErQixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUMvRCxZQUFZLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDL0MsT0FBTyxlQUFlLENBQUMsRUFBRSxPQUFPLEVBQUUsT0FBTztZQUN2QyxvQkFBb0IsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDO1lBQzFELFlBQVksRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUNoQixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FDeEMsUUFBaUIsRUFDakIsV0FBb0YsRUFDM0QsRUFBRTtJQUMzQixJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxzQkFBc0IsQ0FBQyxDQUFDLENBQUM7UUFDMUYsTUFBTSxLQUFLLEdBQUcsOEJBQThCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDdkQsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxLQUFLLGFBQWEsQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDO2VBQzdFLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO2VBQ2hELEtBQUssQ0FBQyxvQkFBb0IsS0FBSyxRQUFRLENBQUMsUUFBUSxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQztRQUM3RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLElBQUksRUFBRSxDQUFDO0lBQ2hCLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUMxQyxXQUFvQixFQUNwQixVQUFtQixFQUNuQixtQkFBNEIsRUFDQSxFQUFFO0lBQzlCLE1BQU0sUUFBUSxHQUFHLGlDQUFpQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sT0FBTyxHQUFHLGlDQUFpQyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzlELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDckQsWUFBWSxDQUFDLE9BQU8sQ0FBQyxhQUFhLEtBQUssTUFBTSxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxNQUFNO1dBQzFGLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQzNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQzlDLFdBQW9CLEVBQ3BCLFVBQW1CLEVBQ25CLG1CQUE0QixFQUNBLEVBQUU7SUFDOUIsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLGVBQWUsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sUUFBUSxHQUFHLGlDQUFpQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLG1CQUFtQixDQUFDLENBQUM7SUFDckQsTUFBTSxlQUFlLEdBQUcsYUFBYSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUM3RCxNQUFNLGVBQWUsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQy9DLFlBQVksQ0FBQyxRQUFRLENBQUMsYUFBYSxLQUFLLGVBQWUsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLGVBQWU7V0FDekYsZUFBZSxLQUFLLE1BQU0sQ0FBQyxhQUFhLElBQUksZUFBZSxLQUFLLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNwRixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMifQ==

package/dist_ts/data/serviceruntime.d.ts

@@ -66,6 +66,8 @@ export declare const serviceRuntimeContract: Readonly<{
     /** A node can run workloads only as an egress member of the protected authority, which admits at most this many. */
     readonly maximumPinnedNodes: 256;
     readonly maximumPlatformEndpoints: 64;
+    /** The largest `limit` `getServiceRuntimeSpecs` accepts; Cloudly refuses a larger one. */
+    readonly maximumSpecPageSize: 256;
     /** The largest `limit` `getClusterRuntimeAssignments` accepts; Cloudly refuses a larger one. */
     readonly maximumAssignmentPageSize: 256;
 }>;

package/dist_ts/data/serviceruntime.js

@@ -9,6 +9,8 @@ export const serviceRuntimeContract = Object.freeze({
     /** A node can run workloads only as an egress member of the protected authority, which admits at most this many. */
     maximumPinnedNodes: runtimeNetworkAuthorityContract.maximumEgressAuthorities,
     maximumPlatformEndpoints: runtimeNetworkAuthorityContract.maximumPlatformEndpoints,
+    /** The largest `limit` `getServiceRuntimeSpecs` accepts; Cloudly refuses a larger one. */
+    maximumSpecPageSize: 256,
     /** The largest `limit` `getClusterRuntimeAssignments` accepts; Cloudly refuses a larger one. */
     maximumAssignmentPageSize: 256,
 });
@@ -92,4 +94,4 @@ export const snapshotServiceRuntimeStatus = (value) => producerSafe(() => {
     requireNetwork(item.state === 'refused' && isOneOf(serviceRuntimeRefusals, item.reason));
     return { ...base, state: item.state, reason: item.reason };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF3RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRyxDQUFDLHNCQUFzQixFQUFFLFVBQVUsRUFBRSxpQkFBaUIsQ0FBVSxDQUFDO0FBQ3RHLE1BQU0sc0JBQXNCLEdBQUc7SUFDN0IseUJBQXlCLEVBQUUsc0JBQXNCLEVBQUUsb0JBQW9CLEVBQUUsc0JBQXNCO0lBQy9GLHFCQUFxQixFQUFFLHFCQUFxQixFQUFFLDJCQUEyQixFQUFFLGdCQUFnQjtJQUMzRiw2QkFBNkIsRUFBRSx1QkFBdUIsRUFBRSxrQkFBa0IsRUFBRSxlQUFlO0lBQzNGLDRCQUE0QixFQUFFLHdCQUF3QixFQUFFLHlCQUF5QjtJQUNqRiwrQkFBK0IsRUFBRSxpQ0FBaUM7Q0FDMUQsQ0FBQztBQTJEWCwyR0FBMkc7QUFDM0csTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBZSxFQUFFLElBQStCLEVBQVksRUFBRSxDQUMvRixhQUFhLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUU3RCxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBNEIsRUFBRTtJQUMvRCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQzFCLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9CLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsQ0FBQztJQUNqQyxNQUFNLE9BQU8sR0FBRyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxzQkFBc0IsQ0FBQyxrQkFBa0IsRUFBRSxhQUFhLENBQUMsQ0FBQztJQUN2SSxjQUFjLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNuQyxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQzNCLENBQUMsQ0FBQztBQUVGLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYyxFQUFtQyxFQUFFO0lBQ2xFLElBQUksS0FBSyxLQUFLLElBQUk7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNoQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDckQsY0FBYyxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUMxRixPQUFPLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztBQUNoRCxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBMEIsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsV0FBVyxFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDaEgsY0FBYyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO1dBQ3RGLGtCQUFrQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxPQUFPLElBQUksQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDaEYsNEdBQTRHO0lBQzVHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQ2pFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDO0lBQzFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRSxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7UUFDL0QsU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUE0QjtRQUNsRixJQUFJLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsRUFBRSxjQUFjLEVBQUUsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQ3JJLENBQUMsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUEwQixFQUFFO0lBQzNELE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdEMsSUFBSSxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEIsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDL0IsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsY0FBYyxFQUFFLHFCQUFxQixDQUFDLENBQUMsQ0FBQztJQUNuRixjQUFjLENBQUMsT0FBTyxJQUFJLENBQUMsWUFBWSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZELE9BQU8sRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1FBQzVDLG1CQUFtQixFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsc0JBQXNCLENBQUMsd0JBQXdCLEVBQUUsU0FBUyxDQUFDLEVBQUUsQ0FBQztBQUMzSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLEtBQWMsRUFBdUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDbkcsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsV0FBVztRQUNqRyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUMsRUFBRSxzQkFBc0IsQ0FBQyxzQkFBc0IsQ0FBQztXQUNsRyxPQUFPLElBQUksQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDckMsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLGNBQWMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNuSCxTQUFTLEVBQUUsV0FBVyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWUsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7UUFDOUYsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsUUFBUSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztBQUNsSCxDQUFDLENBQUMsQ0FBQztBQUVILHdGQUF3RjtBQUN4RixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLEtBQWMsRUFBeUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDdkcsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzFHLE1BQU0sSUFBSSxHQUE4QixFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLFlBQVksRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQztRQUMvRyxTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0lBQzlDLElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxXQUFXLElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUM5RCxjQUFjLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQztRQUNyQyxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDN0IsY0FBYyxDQUFDLE9BQU8sQ0FBQyw0QkFBNEIsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUNuRSxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxzQkFBc0IsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN6RixPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUM3RCxDQUFDLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF3RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRyxDQUFDLHNCQUFzQixFQUFFLFVBQVUsRUFBRSxpQkFBaUIsQ0FBVSxDQUFDO0FBQ3RHLE1BQU0sc0JBQXNCLEdBQUc7SUFDN0IseUJBQXlCLEVBQUUsc0JBQXNCLEVBQUUsb0JBQW9CLEVBQUUsc0JBQXNCO0lBQy9GLHFCQUFxQixFQUFFLHFCQUFxQixFQUFFLDJCQUEyQixFQUFFLGdCQUFnQjtJQUMzRiw2QkFBNkIsRUFBRSx1QkFBdUIsRUFBRSxrQkFBa0IsRUFBRSxlQUFlO0lBQzNGLDRCQUE0QixFQUFFLHdCQUF3QixFQUFFLHlCQUF5QjtJQUNqRiwrQkFBK0IsRUFBRSxpQ0FBaUM7Q0FDMUQsQ0FBQztBQTJEWCwyR0FBMkc7QUFDM0csTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBZSxFQUFFLElBQStCLEVBQVksRUFBRSxDQUMvRixhQUFhLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUU3RCxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBNEIsRUFBRTtJQUMvRCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQzFCLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9CLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsQ0FBQztJQUNqQyxNQUFNLE9BQU8sR0FBRyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxzQkFBc0IsQ0FBQyxrQkFBa0IsRUFBRSxhQUFhLENBQUMsQ0FBQztJQUN2SSxjQUFjLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNuQyxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQzNCLENBQUMsQ0FBQztBQUVGLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYyxFQUFtQyxFQUFFO0lBQ2xFLElBQUksS0FBSyxLQUFLLElBQUk7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNoQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDckQsY0FBYyxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUMxRixPQUFPLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztBQUNoRCxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBMEIsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsV0FBVyxFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDaEgsY0FBYyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO1dBQ3RGLGtCQUFrQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxPQUFPLElBQUksQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDaEYsNEdBQTRHO0lBQzVHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQ2pFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDO0lBQzFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRSxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7UUFDL0QsU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUE0QjtRQUNsRixJQUFJLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsRUFBRSxjQUFjLEVBQUUsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQ3JJLENBQUMsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUEwQixFQUFFO0lBQzNELE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdEMsSUFBSSxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEIsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDL0IsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsY0FBYyxFQUFFLHFCQUFxQixDQUFDLENBQUMsQ0FBQztJQUNuRixjQUFjLENBQUMsT0FBTyxJQUFJLENBQUMsWUFBWSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZELE9BQU8sRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1FBQzVDLG1CQUFtQixFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsc0JBQXNCLENBQUMsd0JBQXdCLEVBQUUsU0FBUyxDQUFDLEVBQUUsQ0FBQztBQUMzSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLEtBQWMsRUFBdUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDbkcsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsV0FBVztRQUNqRyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUMsRUFBRSxzQkFBc0IsQ0FBQyxzQkFBc0IsQ0FBQztXQUNsRyxPQUFPLElBQUksQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDckMsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLGNBQWMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNuSCxTQUFTLEVBQUUsV0FBVyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWUsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7UUFDOUYsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsUUFBUSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztBQUNsSCxDQUFDLENBQUMsQ0FBQztBQUVILHdGQUF3RjtBQUN4RixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLEtBQWMsRUFBeUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDdkcsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzFHLE1BQU0sSUFBSSxHQUE4QixFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLFlBQVksRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQztRQUMvRyxTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0lBQzlDLElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxXQUFXLElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUM5RCxjQUFjLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQztRQUNyQyxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDN0IsY0FBYyxDQUFDLE9BQU8sQ0FBQyw0QkFBNEIsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUNuRSxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxzQkFBc0IsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN6RixPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUM3RCxDQUFDLENBQUMsQ0FBQyJ9

package/dist_ts/requests/node.d.ts

@@ -6,6 +6,7 @@ import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
 import type { INodeCredentialMetadata, INodeCredentialMutationPreconditions, INodeCredentialMutationResult, TNodeCredentialPurpose } from '../data/nodecredential.js';
 import type { INodeRuntimeRetirement } from '../data/noderetirement.js';
+import type { INodeRuntimeBindingRead, INodeRuntimeBindingRequest } from '../data/noderuntimebinding.js';
 import type { INodeEnrollmentRequest, INodeEnrollmentAcknowledgement, INodeEnrollmentState } from '../data/nodeenrollment.js';
 /** Node-self adoption preconditions, not an admin or workload RBAC grant. */
 export interface IReq_Spark_Cloudly_GetNodeEnrollmentState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Cloudly_GetNodeEnrollmentState> {
@@ -24,6 +25,16 @@ export interface IReq_Spark_Cloudly_EnrollNode extends plugins.typedrequestInter
     /** Replays require the exact receipt AND both current credential authorities. */
     response: INodeEnrollmentAcknowledgement;
 }
+/**
+ * Current Spark-node-authenticated routing read. Cloudly derives every response identity from its
+ * node, cluster, runtime-controller, relay and credential records in one consistent read.
+ */
+export interface IReq_Spark_Cloudly_GetNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Cloudly_GetNodeRuntimeBinding> {
+    method: 'getNodeRuntimeBinding';
+    request: INodeRuntimeBindingRequest;
+    /** Routing and current phase observation only; this grants no workload or phase authority. */
+    response: INodeRuntimeBindingRead;
+}
 /** Requires verified platform-infrastructure admin authority; returns public data only. */
 export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetNodeConfig> {
     method: 'getNodeConfig';

package/dist_ts/requests/pallet.d.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../plugins.js';
 import type { INodeEnrollment, IPalletNodeEnrollmentActivation, IPalletNodeEnrollmentPreparation, IPalletNodeEnrollmentBound, IPalletNodeEnrollmentActive } from '../data/nodeenrollment.js';
+import type { INodeRuntimeRoutingBinding } from '../data/noderuntimebinding.js';
 /** Root-authenticated node-local IPC only; never expose on a network router. */
 export interface IReq_Spark_Pallet_PrepareNodeEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_PrepareNodeEnrollment> {
     method: 'preparePalletNodeEnrollment';
@@ -21,3 +22,25 @@ export interface IReq_Spark_Pallet_ActivateNodeEnrollment extends plugins.typedr
     /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
     response: IPalletNodeEnrollmentActive;
 }
+/**
+ * First immutable routing bind or exact replay. The local owner rejects unless `cloudlyOrigin` and
+ * `nodeId` match its current active enrollment; this never mutates credentials, workload state or runtime phase.
+ */
+export interface IReq_Spark_Pallet_BindNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_BindNodeRuntimeBinding> {
+    method: 'bindPalletNodeRuntimeBinding';
+    request: INodeRuntimeRoutingBinding;
+    /** Exact currently persisted binding, answered only after the durable write or exact replay. */
+    response: INodeRuntimeRoutingBinding;
+}
+/**
+ * Offline routing readback. The root-local owner rejects an absent binding, an inactive enrollment
+ * or a requested origin/node different from both its active enrollment and persisted binding.
+ */
+export interface IReq_Spark_Pallet_ReadNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_ReadNodeRuntimeBinding> {
+    method: 'readPalletNodeRuntimeBinding';
+    request: {
+        cloudlyOrigin: string;
+        nodeId: string;
+    };
+    response: INodeRuntimeRoutingBinding;
+}

package/dist_ts/requests/service.d.ts

@@ -270,9 +270,10 @@ export interface IRequest_Any_Cloudly_DeleteServiceById extends plugins.typedreq
 /**
  * Writes the complete runtime spec of one service.
  *
- * `expectedRevision` is the revision the caller read, or `null` when the service has never had a
- * spec; any other stored revision refuses the write. Cloudly copies the organization from the
- * service and answers with the stored spec at its new revision.
+ * `expectedRevision` is the revision the caller read for the target `(serviceId, spec.clusterId)`,
+ * or `null` when that target has never had a spec; any other stored revision refuses the write.
+ * Cloudly copies the organization from the service and answers with the stored spec at its new
+ * target-local revision.
  */
 export interface IRequest_Any_Cloudly_SetServiceRuntimeSpec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_SetServiceRuntimeSpec> {
     method: 'setServiceRuntimeSpec';
@@ -287,8 +288,19 @@ export interface IRequest_Any_Cloudly_SetServiceRuntimeSpec extends plugins.type
     };
 }
 /**
- * A service's runtime spec and the producer's verdict on it. Both are `null` before the first spec;
- * a spec's status is `null` until the producer first decides it.
+ * The named refusal data when a scalar runtime-spec read finds more than one cluster target.
+ *
+ * This travels as `TypedResponseError.errorData`. The condition needs an explicit cluster or the
+ * paged read, never a retry of the same ambiguous request.
+ */
+export interface IServiceRuntimeSpecAmbiguityErrorData {
+    code: 'service-runtime-spec-ambiguous';
+    retryable: false;
+}
+/**
+ * The only runtime spec of a service and the producer's verdict on it. Zero targets answer both
+ * members as `null`; one target answers it, with `status: null` until the producer first decides it.
+ * More than one target refuses with `IServiceRuntimeSpecAmbiguityErrorData`; Cloudly never picks one.
  */
 export interface IRequest_Any_Cloudly_GetServiceRuntimeSpec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetServiceRuntimeSpec> {
     method: 'getServiceRuntimeSpec';
@@ -304,6 +316,63 @@ export interface IRequest_Any_Cloudly_GetServiceRuntimeSpec extends plugins.type
         status: IServiceRuntimeStatus | null;
     };
 }
+/** One service's runtime spec for one exact cluster target, or no such target. */
+export interface IRequest_Any_Cloudly_GetServiceRuntimeSpecForCluster extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetServiceRuntimeSpecForCluster> {
+    method: 'getServiceRuntimeSpecForCluster';
+    request: {
+        identity: IIdentity;
+        serviceId: string;
+        clusterId: string;
+    };
+    response: {
+        spec: null;
+        status: null;
+    } | {
+        spec: IServiceRuntimeSpec;
+        status: IServiceRuntimeStatus | null;
+    };
+}
+/**
+ * Every cluster target of one service, ordered by cluster id and read a bounded page at a time.
+ * `cursor` is opaque and `limit` runs from 1 through `serviceRuntimeContract.maximumSpecPageSize`;
+ * Cloudly refuses any other limit. A returned status belongs to the spec beside it.
+ */
+export interface IRequest_Any_Cloudly_GetServiceRuntimeSpecs extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetServiceRuntimeSpecs> {
+    method: 'getServiceRuntimeSpecs';
+    request: {
+        identity: IIdentity;
+        serviceId: string;
+        cursor: string | null;
+        limit: number;
+    };
+    response: {
+        entries: Array<{
+            spec: IServiceRuntimeSpec;
+            status: IServiceRuntimeStatus | null;
+        }>;
+        nextCursor: string | null;
+    };
+}
+/**
+ * Removes one exact cluster target at the revision the administrator read.
+ *
+ * Cloudly derives every safety fact itself and fences them in the removal transaction: the current
+ * spec revision equals `expectedRevision`, that spec is held, every slot of this service on this
+ * cluster is fully settled and released, and the cluster's current phase still gives the spec
+ * producer authority. The caller supplies no phase, settlement, release or authority proof.
+ */
+export interface IRequest_Any_Cloudly_RemoveServiceRuntimeSpecForCluster extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_RemoveServiceRuntimeSpecForCluster> {
+    method: 'removeServiceRuntimeSpecForCluster';
+    request: {
+        identity: IIdentity;
+        serviceId: string;
+        clusterId: string;
+        expectedRevision: number;
+    };
+    response: {
+        removed: true;
+    };
+}
 /** Every current runtime assignment of one service, one per replica slot. */
 export interface IRequest_Any_Cloudly_GetServiceRuntimeAssignments extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetServiceRuntimeAssignments> {
     method: 'getServiceRuntimeAssignments';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.10.1",
+  "version": "32.12.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -266,6 +266,37 @@ bounded time/concurrency, root-only directory/socket permissions and drained
 cleanup. The package supplies no listener, permission checks or persistent state.
 No bearer, generic rotation operation or database access is part of this IPC API.
 
+### Node Runtime Routing Binding
+
+`requests.node.getNodeRuntimeBinding { nodeId, nodeToken }` is a current
+Spark-node-authenticated read. Cloudly derives `data.INodeRuntimeBindingRead`
+from its current credential, node, cluster, durable runtime-controller, relay and
+cluster-runtime records. The answer contains the exact routing identity
+`{ cloudlyOrigin, nodeId, clusterId, controller, runtimeNamespace, relay }`, the
+current `{ id, phase, generation }` runtime reference and the Spark credential
+generation and session epoch that authenticated the read.
+`snapshotNodeRuntimeBindingRead` requires the runtime id to equal the routing
+cluster, and `bindNodeRuntimeBindingRead` binds the answer to Spark's exact
+immutable Cloudly origin, node and credential generation. Neither helper
+authenticates the server.
+
+`requests.pallet.bindPalletNodeRuntimeBinding` and
+`readPalletNodeRuntimeBinding` belong on the existing root-owned Pallet enrollment
+control socket. Bind is absent-to-present only: the current active Pallet
+enrollment must name the same canonical Cloudly origin and node, an exact replay
+is idempotent and every different origin, node, cluster, controller, namespace
+or relay conflicts. Read requires the requested origin and node to equal both
+the active enrollment and the stored binding; an absent binding rejects. Spark
+applies and reads back the binding before starting `runtime-serve`. On an
+offline reboot it may read the exact persisted routing identity to select the
+relay, but that record grants no workload permission and no right to advance or
+run a cluster phase. Fresh authenticated runtime-session state remains the only
+workload authority.
+
+The local operations carry no bearer, signing key, generic configuration field,
+phase mutation or caller-authored permission. `nodeRuntimeBindingContract`
+states the immutable local mutation and routing-only persistence rules.
+
 ### Service Machine Credentials
 
 `requests.admin.getServiceMachineCredential` inspects redacted metadata;
@@ -1024,10 +1055,32 @@ an operator's service edit.
   with sorted unique endpoint ids.
 
 `snapshotServiceRuntimeSpec` checks all of that; whether the cluster, the nodes and the endpoints
-exist is Cloudly's. `requests.service.setServiceRuntimeSpec { identity, serviceId, expectedRevision, spec }`
-writes `TServiceRuntimeSpecWritableData`, and Cloudly copies the organization from the service.
-`getServiceRuntimeSpec` answers `{ spec, status }`: both `null` before the first spec, and `status`
-`null` until the producer first decides the spec. A status never comes without its spec.
+exist is Cloudly's. One canonical service may have one runtime target on each of several clusters.
+Every public target keeps the same `IServiceRuntimeSpec`: `id` is the exact service id and
+`clusterId` names that target. Cloudly's private persistence joins those two values; no composite
+public service id is introduced.
+
+`requests.service.setServiceRuntimeSpec { identity, serviceId, expectedRevision, spec }` writes
+`TServiceRuntimeSpecWritableData`, and Cloudly copies the organization from the service. Its
+compare-and-swap is for `(serviceId, spec.clusterId)`: `null` means that exact target is absent, and
+each target advances its own revision. The request bytes and public spec shape are unchanged.
+
+`getServiceRuntimeSpecForCluster { identity, serviceId, clusterId }` reads one exact target.
+`getServiceRuntimeSpecs { identity, serviceId, cursor, limit }` reads targets in cluster-id order,
+with an opaque cursor and a limit from 1 through `serviceRuntimeContract.maximumSpecPageSize`.
+Both reads answer each spec with its producer status, which is `null` until the producer first
+decides the spec. A status never comes without its spec.
+
+The original `getServiceRuntimeSpec { identity, serviceId }` remains a scalar compatibility read:
+zero targets answer `{ spec: null, status: null }`, and one target answers it. More than one target
+is refused with `IServiceRuntimeSpecAmbiguityErrorData { code: 'service-runtime-spec-ambiguous',
+retryable: false }` in `TypedResponseError.errorData`; Cloudly never selects a target implicitly.
+
+`removeServiceRuntimeSpecForCluster { identity, serviceId, clusterId, expectedRevision }` removes
+one exact target only after Cloudly transactionally derives and fences all authority and safety
+facts: the revision still matches, the target is held, every target slot is fully settled and
+released, and the cluster's current phase still belongs to the spec producer. Callers provide no
+phase, settlement, release or authority booleans or evidence.
 
 `data.IServiceRuntimeStatus { id, specRevision, state, reason, changedAt }` is the producer's verdict
 on one spec revision, and each reason belongs to exactly one state. `converged` and `converging`

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.10.1',
+  version: '32.12.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusterruntime.ts

@@ -27,6 +27,15 @@ export interface IClusterRuntime {
   changedBy: string;
 }
 
+/** Current phase reference without its administrative audit metadata. */
+export interface IClusterRuntimeReference {
+  /** The cluster id. */
+  id: string;
+  phase: TClusterRuntimePhase;
+  /** Exact compare-and-swap generation observed with this phase. */
+  generation: number;
+}
+
 /**
  * Why a cluster cannot leave `swarm` yet. Each blocker names the node or service it is about, so an
  * administrator can act on it without a second query.
@@ -43,3 +52,10 @@ export const snapshotClusterRuntime = (value: unknown): IClusterRuntime => produ
   return { id: networkId(item.id), phase: item.phase, generation: networkCounter(item.generation),
     changedAt: networkCounter(item.changedAt), changedBy: networkId(item.changedBy) };
 });
+
+/** Structural snapshot for node routing reads; it grants no right to move or run a phase. */
+export const snapshotClusterRuntimeReference = (value: unknown): IClusterRuntimeReference => producerSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['id', 'phase', 'generation']);
+  requireNetwork(isOneOf(clusterRuntimePhases, item.phase));
+  return { id: networkId(item.id), phase: item.phase, generation: networkCounter(item.generation) };
+});

package/ts/data/index.ts

@@ -26,6 +26,7 @@ export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
 export * from './nodeenrollment.js';
+export * from './noderuntimebinding.js';
 export * from './noderetirement.js';
 export * from './networkaddressplan.js';
 export * from './networkauthority.js';

package/ts/data/noderuntimebinding.ts

@@ -0,0 +1,191 @@
+import type { IClusterRelay } from './cluster.js';
+import { validateClusterRelay } from './cluster.js';
+import type { IClusterRuntimeReference } from './clusterruntime.js';
+import { snapshotClusterRuntimeReference } from './clusterruntime.js';
+import type { IPalletNodeEnrollmentActive } from './nodeenrollment.js';
+import { snapshotPalletNodeEnrollmentConfirmation } from './nodeenrollment.js';
+import type { IRuntimeController } from './runtimeassignment.js';
+import { deepFreezeValue } from '../private/canonicaljson.js';
+import { readExactDataRecord } from '../private/dataproperties.js';
+import { isClusterNodeId } from '../private/nodeidentifier.js';
+import { networkController, networkId } from '../private/networkcontract.js';
+
+/**
+ * Durable routing identity for one Pallet node.
+ *
+ * This is not a runtime session, a workload grant or a cluster-phase authority. It only names the
+ * Cloudly controller and relay through which the node obtains fresh authenticated session state.
+ */
+export interface INodeRuntimeRoutingBinding {
+  /** Exact immutable enrollment authority; Pallet compares it with its current active identity. */
+  cloudlyOrigin: string;
+  nodeId: string;
+  clusterId: string;
+  controller: IRuntimeController & { kind: 'cloudly' };
+  runtimeNamespace: string;
+  relay: IClusterRelay;
+}
+
+/** Sensitive authenticated read input; never persist, log, put in a URL or return it. */
+export interface INodeRuntimeBindingRequest {
+  nodeId: string;
+  nodeToken: string;
+}
+
+/** Current server-owned answer to an authenticated Spark-node read. */
+export interface INodeRuntimeBindingRead {
+  binding: INodeRuntimeRoutingBinding;
+  runtime: IClusterRuntimeReference;
+  /** Generation of the Spark bearer that authenticated this exact answer. */
+  credentialGeneration: number;
+  /** Current Spark session fence; it is observation metadata, not part of the routing binding. */
+  sessionEpoch: number;
+}
+
+export const nodeRuntimeBindingContract = Object.freeze({
+  localMutation: 'first-bind-or-exact-replay',
+  persistedAuthority: 'routing-only',
+  runtimeAuthority: 'fresh-authenticated-controller-session-only',
+} as const);
+
+const fail = (): never => { throw new Error('Node runtime binding contract rejected.'); };
+function requireValue(conditionArg: unknown): asserts conditionArg {
+  if (!conditionArg) fail();
+}
+const record = (valueArg: unknown, keysArg: readonly string[]): Record<string, unknown> => {
+  const result = readExactDataRecord(valueArg, keysArg);
+  requireValue(result !== null);
+  return result;
+};
+const positive = (valueArg: unknown): number => {
+  requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+    && valueArg > 0 && !Object.is(valueArg, -0));
+  return valueArg;
+};
+const nonNegative = (valueArg: unknown): number => {
+  requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+    && valueArg >= 0 && !Object.is(valueArg, -0));
+  return valueArg;
+};
+const nodeId = (valueArg: unknown): string => isClusterNodeId(valueArg) ? valueArg : fail();
+const nodeToken = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && /^secureToken[a-f0-9]{64}$/.test(valueArg));
+  return valueArg;
+};
+const relay = (valueArg: unknown): IClusterRelay => {
+  const value = record(valueArg, ['origin']);
+  requireValue(validateClusterRelay(value).length === 0);
+  return { origin: value.origin as string };
+};
+const cloudlyOrigin = (valueArg: unknown): string => relay({ origin: valueArg }).origin;
+const activeEnrollment = (valueArg: unknown): IPalletNodeEnrollmentActive => {
+  const value = snapshotPalletNodeEnrollmentConfirmation(valueArg);
+  requireValue(value.phase === 'active');
+  return value;
+};
+
+/** Exact detached snapshot; shape checks are not authentication. */
+export const snapshotNodeRuntimeRoutingBinding = (
+  valueArg: unknown,
+): INodeRuntimeRoutingBinding => {
+  try {
+    const value = record(valueArg,
+      ['cloudlyOrigin', 'nodeId', 'clusterId', 'controller', 'runtimeNamespace', 'relay']);
+    const controller = networkController(record(value.controller, ['kind', 'id', 'epoch']));
+    requireValue(controller.kind === 'cloudly');
+    return deepFreezeValue({
+      cloudlyOrigin: cloudlyOrigin(value.cloudlyOrigin),
+      nodeId: nodeId(value.nodeId), clusterId: networkId(value.clusterId),
+      controller: { kind: 'cloudly', id: controller.id, epoch: controller.epoch },
+      runtimeNamespace: networkId(value.runtimeNamespace), relay: relay(value.relay),
+    });
+  } catch {
+    return fail();
+  }
+};
+
+/** Exact detached authenticated-read request; validation never logs or returns the bearer. */
+export const snapshotNodeRuntimeBindingRequest = (
+  valueArg: unknown,
+): INodeRuntimeBindingRequest => {
+  try {
+    const value = record(valueArg, ['nodeId', 'nodeToken']);
+    return deepFreezeValue({ nodeId: nodeId(value.nodeId), nodeToken: nodeToken(value.nodeToken) });
+  } catch {
+    return fail();
+  }
+};
+
+/** Exact detached current read; its runtime must name the binding's cluster. */
+export const snapshotNodeRuntimeBindingRead = (
+  valueArg: unknown,
+): INodeRuntimeBindingRead => {
+  try {
+    const value = record(valueArg,
+      ['binding', 'runtime', 'credentialGeneration', 'sessionEpoch']);
+    const binding = snapshotNodeRuntimeRoutingBinding(value.binding);
+    const runtime = snapshotClusterRuntimeReference(value.runtime);
+    requireValue(runtime.id === binding.clusterId);
+    return deepFreezeValue({ binding, runtime,
+      credentialGeneration: positive(value.credentialGeneration),
+      sessionEpoch: nonNegative(value.sessionEpoch) });
+  } catch {
+    return fail();
+  }
+};
+
+/**
+ * Bind a server answer to the Spark identity that made the authenticated read.
+ * Authentication and the current credential transaction remain Cloudly's responsibility.
+ */
+export const bindNodeRuntimeBindingRead = (
+  valueArg: unknown,
+  expectedArg: { cloudlyOrigin: string; nodeId: string; credentialGeneration: number },
+): INodeRuntimeBindingRead => {
+  try {
+    const expected = record(expectedArg, ['cloudlyOrigin', 'nodeId', 'credentialGeneration']);
+    const value = snapshotNodeRuntimeBindingRead(valueArg);
+    requireValue(value.binding.cloudlyOrigin === cloudlyOrigin(expected.cloudlyOrigin)
+      && value.binding.nodeId === nodeId(expected.nodeId)
+      && value.credentialGeneration === positive(expected.credentialGeneration));
+    return value;
+  } catch {
+    return fail();
+  }
+};
+
+/**
+ * Pure content binding for the root-local bind reply. `activeEnrollmentArg` must come from the
+ * Pallet owner's current durable state; a historical activation receipt is insufficient.
+ */
+export const bindPalletNodeRuntimeBinding = (
+  responseArg: unknown,
+  requestArg: unknown,
+  activeEnrollmentArg: unknown,
+): INodeRuntimeRoutingBinding => {
+  const response = snapshotNodeRuntimeRoutingBinding(responseArg);
+  const request = snapshotNodeRuntimeRoutingBinding(requestArg);
+  const active = activeEnrollment(activeEnrollmentArg);
+  requireValue(request.cloudlyOrigin === active.cloudlyOrigin && request.nodeId === active.nodeId
+    && JSON.stringify(response) === JSON.stringify(request));
+  return response;
+};
+
+/**
+ * Pure content binding for offline readback. `activeEnrollmentArg` must come from the Pallet
+ * owner's current durable state; a historical activation receipt is insufficient.
+ */
+export const bindPalletNodeRuntimeBindingRead = (
+  responseArg: unknown,
+  requestArg: unknown,
+  activeEnrollmentArg: unknown,
+): INodeRuntimeRoutingBinding => {
+  const request = record(requestArg, ['cloudlyOrigin', 'nodeId']);
+  const response = snapshotNodeRuntimeRoutingBinding(responseArg);
+  const active = activeEnrollment(activeEnrollmentArg);
+  const requestedOrigin = cloudlyOrigin(request.cloudlyOrigin);
+  const requestedNodeId = nodeId(request.nodeId);
+  requireValue(response.cloudlyOrigin === requestedOrigin && response.nodeId === requestedNodeId
+    && requestedOrigin === active.cloudlyOrigin && requestedNodeId === active.nodeId);
+  return response;
+};

package/ts/data/serviceruntime.ts

@@ -70,6 +70,8 @@ export const serviceRuntimeContract = Object.freeze({
   /** A node can run workloads only as an egress member of the protected authority, which admits at most this many. */
   maximumPinnedNodes: runtimeNetworkAuthorityContract.maximumEgressAuthorities,
   maximumPlatformEndpoints: runtimeNetworkAuthorityContract.maximumPlatformEndpoints,
+  /** The largest `limit` `getServiceRuntimeSpecs` accepts; Cloudly refuses a larger one. */
+  maximumSpecPageSize: 256,
   /** The largest `limit` `getClusterRuntimeAssignments` accepts; Cloudly refuses a larger one. */
   maximumAssignmentPageSize: 256,
 } as const);

package/ts/requests/node.ts

@@ -11,6 +11,7 @@ import type {
   TNodeCredentialPurpose,
 } from '../data/nodecredential.js';
 import type { INodeRuntimeRetirement } from '../data/noderetirement.js';
+import type { INodeRuntimeBindingRead, INodeRuntimeBindingRequest } from '../data/noderuntimebinding.js';
 import type {
   INodeEnrollmentRequest,
   INodeEnrollmentAcknowledgement,
@@ -39,6 +40,20 @@ export interface IReq_Spark_Cloudly_EnrollNode extends plugins.typedrequestInter
   response: INodeEnrollmentAcknowledgement;
 }
 
+/**
+ * Current Spark-node-authenticated routing read. Cloudly derives every response identity from its
+ * node, cluster, runtime-controller, relay and credential records in one consistent read.
+ */
+export interface IReq_Spark_Cloudly_GetNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Cloudly_GetNodeRuntimeBinding
+> {
+  method: 'getNodeRuntimeBinding';
+  request: INodeRuntimeBindingRequest;
+  /** Routing and current phase observation only; this grants no workload or phase authority. */
+  response: INodeRuntimeBindingRead;
+}
+
 /** Requires verified platform-infrastructure admin authority; returns public data only. */
 export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,

package/ts/requests/pallet.ts

@@ -3,6 +3,7 @@ import type {
   INodeEnrollment, IPalletNodeEnrollmentActivation, IPalletNodeEnrollmentPreparation,
   IPalletNodeEnrollmentBound, IPalletNodeEnrollmentActive,
 } from '../data/nodeenrollment.js';
+import type { INodeRuntimeRoutingBinding } from '../data/noderuntimebinding.js';
 
 /** Root-authenticated node-local IPC only; never expose on a network router. */
 export interface IReq_Spark_Pallet_PrepareNodeEnrollment extends plugins.typedrequestInterfaces.implementsTR<
@@ -36,3 +37,30 @@ export interface IReq_Spark_Pallet_ActivateNodeEnrollment extends plugins.typedr
   /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
   response: IPalletNodeEnrollmentActive;
 }
+
+/**
+ * First immutable routing bind or exact replay. The local owner rejects unless `cloudlyOrigin` and
+ * `nodeId` match its current active enrollment; this never mutates credentials, workload state or runtime phase.
+ */
+export interface IReq_Spark_Pallet_BindNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_BindNodeRuntimeBinding
+> {
+  method: 'bindPalletNodeRuntimeBinding';
+  request: INodeRuntimeRoutingBinding;
+  /** Exact currently persisted binding, answered only after the durable write or exact replay. */
+  response: INodeRuntimeRoutingBinding;
+}
+
+/**
+ * Offline routing readback. The root-local owner rejects an absent binding, an inactive enrollment
+ * or a requested origin/node different from both its active enrollment and persisted binding.
+ */
+export interface IReq_Spark_Pallet_ReadNodeRuntimeBinding extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_ReadNodeRuntimeBinding
+> {
+  method: 'readPalletNodeRuntimeBinding';
+  request: { cloudlyOrigin: string; nodeId: string };
+  response: INodeRuntimeRoutingBinding;
+}

package/ts/requests/service.ts

@@ -393,9 +393,10 @@ extends plugins.typedrequestInterfaces.implementsTR<
 /**
  * Writes the complete runtime spec of one service.
  *
- * `expectedRevision` is the revision the caller read, or `null` when the service has never had a
- * spec; any other stored revision refuses the write. Cloudly copies the organization from the
- * service and answers with the stored spec at its new revision.
+ * `expectedRevision` is the revision the caller read for the target `(serviceId, spec.clusterId)`,
+ * or `null` when that target has never had a spec; any other stored revision refuses the write.
+ * Cloudly copies the organization from the service and answers with the stored spec at its new
+ * target-local revision.
  */
 export interface IRequest_Any_Cloudly_SetServiceRuntimeSpec
 extends plugins.typedrequestInterfaces.implementsTR<
@@ -415,8 +416,20 @@ extends plugins.typedrequestInterfaces.implementsTR<
 }
 
 /**
- * A service's runtime spec and the producer's verdict on it. Both are `null` before the first spec;
- * a spec's status is `null` until the producer first decides it.
+ * The named refusal data when a scalar runtime-spec read finds more than one cluster target.
+ *
+ * This travels as `TypedResponseError.errorData`. The condition needs an explicit cluster or the
+ * paged read, never a retry of the same ambiguous request.
+ */
+export interface IServiceRuntimeSpecAmbiguityErrorData {
+  code: 'service-runtime-spec-ambiguous';
+  retryable: false;
+}
+
+/**
+ * The only runtime spec of a service and the producer's verdict on it. Zero targets answer both
+ * members as `null`; one target answers it, with `status: null` until the producer first decides it.
+ * More than one target refuses with `IServiceRuntimeSpecAmbiguityErrorData`; Cloudly never picks one.
  */
 export interface IRequest_Any_Cloudly_GetServiceRuntimeSpec
 extends plugins.typedrequestInterfaces.implementsTR<
@@ -433,6 +446,71 @@ extends plugins.typedrequestInterfaces.implementsTR<
     | { spec: IServiceRuntimeSpec; status: IServiceRuntimeStatus | null };
 }
 
+/** One service's runtime spec for one exact cluster target, or no such target. */
+export interface IRequest_Any_Cloudly_GetServiceRuntimeSpecForCluster
+extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IRequest_Any_Cloudly_GetServiceRuntimeSpecForCluster
+> {
+  method: 'getServiceRuntimeSpecForCluster';
+  request: {
+    identity: IIdentity;
+    serviceId: string;
+    clusterId: string;
+  };
+  response:
+    | { spec: null; status: null }
+    | { spec: IServiceRuntimeSpec; status: IServiceRuntimeStatus | null };
+}
+
+/**
+ * Every cluster target of one service, ordered by cluster id and read a bounded page at a time.
+ * `cursor` is opaque and `limit` runs from 1 through `serviceRuntimeContract.maximumSpecPageSize`;
+ * Cloudly refuses any other limit. A returned status belongs to the spec beside it.
+ */
+export interface IRequest_Any_Cloudly_GetServiceRuntimeSpecs
+extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IRequest_Any_Cloudly_GetServiceRuntimeSpecs
+> {
+  method: 'getServiceRuntimeSpecs';
+  request: {
+    identity: IIdentity;
+    serviceId: string;
+    cursor: string | null;
+    limit: number;
+  };
+  response: {
+    entries: Array<{ spec: IServiceRuntimeSpec; status: IServiceRuntimeStatus | null }>;
+    nextCursor: string | null;
+  };
+}
+
+/**
+ * Removes one exact cluster target at the revision the administrator read.
+ *
+ * Cloudly derives every safety fact itself and fences them in the removal transaction: the current
+ * spec revision equals `expectedRevision`, that spec is held, every slot of this service on this
+ * cluster is fully settled and released, and the cluster's current phase still gives the spec
+ * producer authority. The caller supplies no phase, settlement, release or authority proof.
+ */
+export interface IRequest_Any_Cloudly_RemoveServiceRuntimeSpecForCluster
+extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IRequest_Any_Cloudly_RemoveServiceRuntimeSpecForCluster
+> {
+  method: 'removeServiceRuntimeSpecForCluster';
+  request: {
+    identity: IIdentity;
+    serviceId: string;
+    clusterId: string;
+    expectedRevision: number;
+  };
+  response: {
+    removed: true;
+  };
+}
+
 /** Every current runtime assignment of one service, one per replica slot. */
 export interface IRequest_Any_Cloudly_GetServiceRuntimeAssignments
 extends plugins.typedrequestInterfaces.implementsTR<