@serve.zone/interfaces 32.34.0 → 32.36.0

package/ts/data/deploymentpreflight.ts

@@ -5,6 +5,8 @@ import type {
 } from './immutableimage.js';
 import { normalizeImmutableReleaseTag, normalizeSha256Digest } from './immutableimage.js';
 import type { TServiceDeploymentCapability } from './user.js';
+import type { ILegacyImageImportReference } from './deploymentlegacyimport.js';
+import { validateLegacyImageImportReference } from './deploymentlegacyimport.js';
 import { validateProtocolOfferOn, type IProtocolOffer } from '../protocol.js';
 import type {
   IDeploymentRouteRequest,
@@ -84,6 +86,19 @@ export const deploymentPreflightBlockerCodes = [
   'RELAY_NAME_RESERVED',
   'ROUTE_VERIFICATION_FAILED',
   'TLS_VERIFICATION_FAILED',
+  /**
+   * A legacy import names no attestation Cloudly holds for that legacy service in the requested
+   * organization. Evidence is captured only while the legacy runtime runs, so there is no later
+   * substitute for a missing one.
+   */
+  'LEGACY_IMPORT_ATTESTATION_MISSING',
+  /**
+   * The attested legacy image is no longer what the request or the registry states: the asserted
+   * root digest differs, the legacy tag moved, or a manifest the attestation names is gone.
+   */
+  'LEGACY_IMPORT_SOURCE_MISMATCH',
+  /** The declared target platforms are not exactly the platforms the attested image carries. */
+  'LEGACY_IMPORT_PLATFORM_MISMATCH',
 ] as const;
 
 export type TDeploymentPreflightBlockerCode = typeof deploymentPreflightBlockerCodes[number];
@@ -93,7 +108,9 @@ export interface IDeploymentPreflightBlocker {
   message: string;
 }
 
-export type TDeploymentPreflightWarningCode = 'RECOVERY_REDEPLOY_OVER_FAILED_RUNTIME';
+export type TDeploymentPreflightWarningCode =
+  | 'RECOVERY_REDEPLOY_OVER_FAILED_RUNTIME'
+  | 'PLATFORM_BINDING_READINESS_DEFERRED';
 
 /**
  * Auditable non-blocking preflight finding. Warnings never veto a decision.
@@ -102,7 +119,16 @@ export type TDeploymentPreflightWarningCode = 'RECOVERY_REDEPLOY_OVER_FAILED_RUN
  * RUNTIME_ATTESTATION_MISMATCH blockers because the current runtime provides
  * no consistent attested digest and the service's most recent deployment
  * operation ended 'failed' or 'cleaned' (a recovery redeploy over a known-bad
- * runtime). No other blocker is ever relaxed.
+ * runtime).
+ * `PLATFORM_BINDING_READINESS_DEFERRED` documents that the promote preflight
+ * of a held greenfield service that was never promoted accepted a Corestore
+ * `database` or `objectstorage` binding that is enabled but not yet `ready`.
+ * A held service receives no credential material, so its binding can become
+ * ready only after promotion releases the hold; for a binding that adopts a
+ * legacy resource the Corestore inventory proved the resource authorized for
+ * exactly that binding. The route preflight still requires the binding
+ * `ready`, so no traffic reaches the service before its binding is.
+ * No other blocker is ever relaxed.
  */
 export interface IDeploymentPreflightWarning {
   code: TDeploymentPreflightWarningCode;
@@ -193,21 +219,39 @@ export interface IDeploymentReleaseEvidence {
   attestations: IDeploymentReleaseEvidenceReference[];
 }
 
-export interface IDeploymentPreflightRequestData {
+/**
+ * A preflight states where the deployment's image comes from, exactly as its reservation will:
+ * a clean source revision with its release evidence, or — for a greenfield successor only — a
+ * legacy import naming an attested legacy image, which has no revision, worktree or build
+ * evidence to state.
+ */
+export type IDeploymentPreflightRequestData = IDeploymentPreflightRequestDataBase & (
+  | {
+    sourceRevision: string;
+    sourceDirty: boolean;
+    releaseEvidence?: IDeploymentReleaseEvidence;
+    legacyImport?: never;
+  }
+  | {
+    legacyImport: ILegacyImageImportReference;
+    sourceRevision?: never;
+    sourceDirty?: never;
+    releaseEvidence?: never;
+  }
+);
+
+interface IDeploymentPreflightRequestDataBase {
   requestId: string;
   serviceId: string;
   organizationId?: string;
   mode?: TDeploymentOperationMode;
   phase?: TDeploymentOperationPhase;
   operationId?: string;
-  sourceRevision: string;
-  sourceDirty: boolean;
   version: string;
   intentDigest: string;
   proposedConfiguration: IDeploymentPreflightProposedConfiguration;
   ociIndexDigest?: string;
   releaseTag?: string;
-  releaseEvidence?: IDeploymentReleaseEvidence;
   routes?: IDeploymentRouteRequest[];
   /** Legacy v14 discriminator. Equivalent to mode: 'greenfield'. */
   greenfield?: true;
@@ -249,13 +293,15 @@ export interface IDeploymentPreflightReport {
   mode?: TDeploymentOperationMode;
   phase?: TDeploymentOperationPhase;
   operation?: IServiceDeploymentOperation;
+  /** The request's image origin as judged: a source revision, or a legacy import. */
   source: {
-    revision: string;
-    dirty: boolean;
     version: string;
     intentDigest: TSha256Digest;
     configurationDigest: TSha256Digest;
-  };
+  } & (
+    | { revision: string; dirty: boolean; legacyImport?: never }
+    | { legacyImport: ILegacyImageImportReference; revision?: never; dirty?: never }
+  );
   currentImage: {
     tag?: string;
     digest?: TSha256Digest;
@@ -339,16 +385,35 @@ export const validateDeploymentPreflightRequest = (
   if (typeof requestArg.serviceId !== 'string' || !requestArg.serviceId.trim() || requestArg.serviceId.length > 200) {
     blockers.push({ code: 'INVALID_REQUEST', message: 'A bounded service identifier is required.' });
   }
-  if (typeof requestArg.sourceRevision !== 'string' || !fullGitRevisionRegex.test(requestArg.sourceRevision)) {
-    blockers.push({ code: 'SOURCE_REVISION_INVALID', message: 'Source revision must be a full lower-case Git commit SHA.' });
-    if (typeof requestArg.sourceRevision !== 'string') {
-      blockers.push({ code: 'INVALID_REQUEST', message: 'Source revision is malformed.' });
+  const legacyImport = requestArg.legacyImport !== undefined;
+  if (legacyImport) {
+    const referenceErrors = validateLegacyImageImportReference(requestArg.legacyImport);
+    if (referenceErrors.length > 0) {
+      blockers.push({
+        code: 'INVALID_REQUEST',
+        message: `The legacy import reference is malformed: ${referenceErrors.join('; ')}.`,
+      });
+    }
+    if (requestArg.sourceRevision !== undefined
+      || requestArg.sourceDirty !== undefined
+      || requestArg.releaseEvidence !== undefined) {
+      blockers.push({
+        code: 'INVALID_REQUEST',
+        message: 'A legacy import states no source revision, worktree state or release evidence.',
+      });
+    }
+  } else {
+    if (typeof requestArg.sourceRevision !== 'string' || !fullGitRevisionRegex.test(requestArg.sourceRevision)) {
+      blockers.push({ code: 'SOURCE_REVISION_INVALID', message: 'Source revision must be a full lower-case Git commit SHA.' });
+      if (typeof requestArg.sourceRevision !== 'string') {
+        blockers.push({ code: 'INVALID_REQUEST', message: 'Source revision is malformed.' });
+      }
+    }
+    if (typeof requestArg.sourceDirty !== 'boolean') {
+      blockers.push({ code: 'INVALID_REQUEST', message: 'Source worktree state must be reported.' });
+    } else if (requestArg.sourceDirty) {
+      blockers.push({ code: 'SOURCE_WORKTREE_DIRTY', message: 'The source worktree contains uncommitted changes.' });
     }
-  }
-  if (typeof requestArg.sourceDirty !== 'boolean') {
-    blockers.push({ code: 'INVALID_REQUEST', message: 'Source worktree state must be reported.' });
-  } else if (requestArg.sourceDirty) {
-    blockers.push({ code: 'SOURCE_WORKTREE_DIRTY', message: 'The source worktree contains uncommitted changes.' });
   }
   if (typeof requestArg.version !== 'string'
     || requestArg.version.length > 100
@@ -397,6 +462,9 @@ export const validateDeploymentPreflightRequest = (
     && (requestArg.greenfield !== true || mode !== 'greenfield')) {
     blockers.push({ code: 'INVALID_REQUEST', message: 'Legacy greenfield mode is contradictory.' });
   }
+  if (legacyImport && mode !== 'greenfield') {
+    blockers.push({ code: 'INVALID_REQUEST', message: 'A legacy import reserves a greenfield successor.' });
+  }
   if (requestArg.phase !== undefined
     && requestArg.phase !== 'reserve'
     && requestArg.phase !== 'promote'

package/ts/data/immutableimage.ts

@@ -173,8 +173,7 @@ export interface IImageRelease {
   };
 }
 
-export interface IImageReleaseTrustedEvidence {
-  source: 'cloudly-registry';
+interface IImageReleaseTrustedEvidenceBase {
   /** Deterministic ID for an authenticated registry acceptance event/retry. */
   evidenceId: string;
   operationId: string;
@@ -187,6 +186,30 @@ export interface IImageReleaseTrustedEvidence {
   recordedAt: number;
 }
 
+/** The deployment machine user's own authenticated registry push to its operation's tag. */
+export interface IImageReleaseRegistryPushEvidence extends IImageReleaseTrustedEvidenceBase {
+  source: 'cloudly-registry';
+}
+
+/**
+ * Cloudly's own import of an attested legacy image into a legacy-import operation's tag.
+ *
+ * Nothing was built or pushed: the source fields name the legacy registry root the attestation
+ * proved ran, and `registryRootDigest` is that root or the index Cloudly wrapped around it.
+ */
+export interface IImageReleaseLegacyImportEvidence extends IImageReleaseTrustedEvidenceBase {
+  source: 'cloudly-legacy-import';
+  legacyServiceId: string;
+  attestationId: string;
+  sourceRepository: string;
+  sourceTag: string;
+  sourceRootDigest: TSha256Digest;
+}
+
+export type IImageReleaseTrustedEvidence =
+  | IImageReleaseRegistryPushEvidence
+  | IImageReleaseLegacyImportEvidence;
+
 export const selectTrustedImageReleaseEvidence = (argsArg: {
   release: IImageRelease;
   operationId: string;
@@ -197,7 +220,14 @@ export const selectTrustedImageReleaseEvidence = (argsArg: {
   repository: string;
   tag: string;
   digest: TSha256Digest;
+  /**
+   * The one evidence source the operation's image may have come from: a legacy-import operation
+   * accepts only Cloudly's import, every other operation only its actor's registry push. Omitted,
+   * it is the registry push, the only source an operation without a legacy import has.
+   */
+  evidenceSource?: IImageReleaseTrustedEvidence['source'];
 }): { evidence?: IImageReleaseTrustedEvidence; errors: string[] } => {
+  const evidenceSource = argsArg.evidenceSource ?? 'cloudly-registry';
   const evidenceFingerprint = (evidenceArg: IImageReleaseTrustedEvidence) => [
     evidenceArg.source,
     evidenceArg.evidenceId,
@@ -209,6 +239,15 @@ export const selectTrustedImageReleaseEvidence = (argsArg: {
     evidenceArg.registryRootDigest,
     evidenceArg.manifestMediaType,
     evidenceArg.recordedAt,
+    ...(evidenceArg.source === 'cloudly-legacy-import'
+      ? [
+        evidenceArg.legacyServiceId,
+        evidenceArg.attestationId,
+        evidenceArg.sourceRepository,
+        evidenceArg.sourceTag,
+        evidenceArg.sourceRootDigest,
+      ]
+      : []),
   ].join('\u0000');
   const uniqueEvidence = new Map<string, IImageReleaseTrustedEvidence>();
   const errors: string[] = [];
@@ -221,7 +260,7 @@ export const selectTrustedImageReleaseEvidence = (argsArg: {
     }
   }
   const evidenceMatches = [...uniqueEvidence.values()].filter((evidenceArg) => (
-    evidenceArg.source === 'cloudly-registry'
+    evidenceArg.source === evidenceSource
     && evidenceArg.operationId === argsArg.operationId
     && evidenceArg.actorUserId === argsArg.actorUserId
     && evidenceArg.registryHost === argsArg.registryHost

package/ts/data/index.ts

@@ -12,6 +12,7 @@ export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
+export * from './deploymentlegacyimport.js';
 export * from './deploymentmachineuser.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
@@ -52,9 +53,13 @@ export * from './privatenetwork.js';
 export * from './registry.js';
 export * from './releaseversion.js';
 export * from './runtimeassignment.js';
+export * from './runtimeassignmentexec.js';
+export * from './runtimeassignmentlogs.js';
+export * from './runtimeassignmentstats.js';
 export * from './runtimeconfig.js';
 export * from './runtimestorageclaim.js';
 export * from './runtimelocalstorageclaim.js';
+export * from './runtimelocalvolumearchive.js';
 export * from './runtimesession.js';
 export * from './runtimeterminalreceipt.js';
 export * from './secret.js';

package/ts/data/networknode.ts

@@ -4,13 +4,20 @@ import { captureNetwork, networkCounter, networkNodeId, networkRecord, networkSa
 type TEgressOwner = IRuntimeNetworkProtectedAuthority['egressAuthorities'][number];
 
 /**
- * One unmet condition of a node's runtime network readiness, in the order the node producer meets
- * them: the node joins the protected authority's egress, every egress owner reports current
- * protection, a handoff is reserved, the router selection carries it, the node's acknowledged
- * projection carries it, and the node is a managed VPN member. `protection-receipts-pending` names
- * the egress owners whose current receipts are still missing.
+ * One unmet condition of a node's runtime network readiness. The first is liveness: the node is
+ * observed running. The rest follow the order the node producer meets them: the node joins the
+ * protected authority's egress, every egress owner reports current protection, a handoff is
+ * reserved, the router selection carries it, the node's acknowledged projection carries it, and the
+ * node is a managed VPN member. `protection-receipts-pending` names the egress owners whose current
+ * receipts are still missing.
  */
 export type TRuntimeNetworkNodeReadinessGap =
+  /**
+   * No accepted report newer than `clusterNodeObservationFreshnessMs` shows the node running.
+   * `lastObservedAt` is when Cloudly accepted the node's last report, or `null` when the node's
+   * status is not `online`, so no report shows it running.
+   */
+  | { condition: 'node-observation-stale'; lastObservedAt: number | null }
   | { condition: 'egress-pending' | 'handoff-pending' | 'selection-pending' | 'projection-pending' | 'vpn-member-pending' }
   | { condition: 'protection-receipts-pending'; owners: [TEgressOwner, ...TEgressOwner[]] };
 

package/ts/data/runtimeassignmentexec.ts

@@ -0,0 +1,271 @@
+import type { IRuntimeAssignment, IRuntimeAssignmentReference } from './runtimeassignment.js';
+import { getRuntimeAssignmentReference, snapshotRuntimeAssignment, validateRuntimeAssignment } from './runtimeassignment.js';
+import type { IRuntimeSessionBinding } from './runtimesession.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
+import {
+  captureNetwork, networkCounter, networkDigest, networkEqual, networkId, networkRecord, requireNetwork,
+} from '../private/networkcontract.js';
+
+/** A terminal's size in character cells. */
+export interface IRuntimeTerminalSize {
+  columns: number;
+  rows: number;
+}
+
+/**
+ * A controller's request to run one command inside one running attempt's container.
+ *
+ * `command` is the argument vector the runtime executes directly: no shell parses it unless its
+ * first element names one. With `tty` the process runs on a terminal of `terminalSize`, which is
+ * stated exactly then; its output arrives on one stream. Without it stdout and stderr arrive on
+ * separate streams. Standard input is the optional stream the TypedRequest carries beside this
+ * body; its end is the process's end of input.
+ */
+export interface IOpenRuntimeAssignmentExecRequest {
+  session: IRuntimeSessionBinding;
+  /** The exact current revision of a `run` assignment on this node. */
+  assignment: IRuntimeAssignmentReference;
+  command: string[];
+  tty: boolean;
+  terminalSize: IRuntimeTerminalSize | null;
+}
+
+/**
+ * The node's answer once the process runs. `execId` names the session in later requests;
+ * `idleTimeoutMs` is how long the session may carry no byte in either direction before the node
+ * ends it.
+ */
+export interface IOpenRuntimeAssignmentExecResponse {
+  execId: string;
+  assignment: IRuntimeAssignmentReference;
+  tty: boolean;
+  idleTimeoutMs: number;
+}
+
+/** A new terminal size for a `tty` session. */
+export interface IResizeRuntimeAssignmentExecRequest {
+  session: IRuntimeSessionBinding;
+  execId: string;
+  terminalSize: IRuntimeTerminalSize;
+}
+
+export interface IResizeRuntimeAssignmentExecResponse {
+  execId: string;
+}
+
+/** Ends a session and releases its slot, whether or not its process has exited. */
+export interface ICloseRuntimeAssignmentExecRequest {
+  session: IRuntimeSessionBinding;
+  execId: string;
+}
+
+/**
+ * Why the node ended a process before it exited: `closed` by this request, `idle-timeout` after
+ * `idleTimeoutMs` without a byte, `container-stopped` because its container stopped.
+ */
+export type TRuntimeAssignmentExecTermination = 'closed' | 'idle-timeout' | 'container-stopped';
+
+/**
+ * How the session ended. `exited` carries the process's `exitCode`, 128 plus the signal number
+ * for a process a signal ended; `terminated` states why the node ended it and carries no code.
+ */
+export interface ICloseRuntimeAssignmentExecResponse {
+  execId: string;
+  outcome: 'exited' | 'terminated';
+  exitCode: number | null;
+  termination: TRuntimeAssignmentExecTermination | null;
+}
+
+/**
+ * Exec runs only for a controller on the node's own host (`controller.kind: 'onebox'`, which only a
+ * local controller binding carries), and only on the connection that holds its session. A session
+ * lives until it is closed, or until the node ends it: after `idleTimeoutMs` without a byte, when
+ * its container stops, or when the controller session it was opened under ends, in which case its
+ * `execId` is gone with it. An ended session keeps its slot and its outcome until it is closed.
+ */
+export const runtimeAssignmentExecContract = Object.freeze({
+  error: 'Runtime assignment exec contract rejected.',
+  controllerKind: 'onebox',
+  /** Open sessions per node, ended ones not yet closed included; one more is refused. */
+  maximumSessions: 4,
+  idleTimeoutMs: 900_000,
+  maximumCommandArguments: 256,
+  /** The UTF-8 bytes of every argument together. */
+  maximumCommandBytes: 65_536,
+  /** The largest terminal dimension, the width of the runtime's own size field. */
+  maximumTerminalDimension: 65_535,
+  maximumExitCode: 255,
+} as const);
+
+const fail = (): never => { throw new Error(runtimeAssignmentExecContract.error); };
+const safe = <T>(operationArg: () => T): T => { try { return operationArg(); } catch { return fail(); } };
+const encoder = new TextEncoder();
+const terminations = ['closed', 'idle-timeout', 'container-stopped'] as const;
+
+const referenceOf = (valueArg: unknown): IRuntimeAssignmentReference => {
+  const value = networkRecord(valueArg, ['assignmentId', 'generation', 'digest']);
+  return {
+    assignmentId: networkId(value.assignmentId), generation: networkCounter(value.generation),
+    digest: networkDigest(value.digest),
+  };
+};
+const terminalSizeOf = (valueArg: unknown): IRuntimeTerminalSize => {
+  const value = networkRecord(valueArg, ['columns', 'rows']);
+  return {
+    columns: networkCounter(value.columns, runtimeAssignmentExecContract.maximumTerminalDimension),
+    rows: networkCounter(value.rows, runtimeAssignmentExecContract.maximumTerminalDimension),
+  };
+};
+const commandOf = (valueArg: unknown): string[] => {
+  requireNetwork(Array.isArray(valueArg) && valueArg.length > 0
+    && valueArg.length <= runtimeAssignmentExecContract.maximumCommandArguments);
+  let bytes = 0;
+  const command = (valueArg as unknown[]).map((argumentArg) => {
+    requireNetwork(typeof argumentArg === 'string' && !argumentArg.includes('\0'));
+    bytes += encoder.encode(argumentArg).byteLength;
+    return argumentArg;
+  });
+  requireNetwork(command[0].length > 0 && bytes <= runtimeAssignmentExecContract.maximumCommandBytes);
+  return command;
+};
+
+export const snapshotOpenRuntimeAssignmentExecRequest = (
+  valueArg: unknown,
+): IOpenRuntimeAssignmentExecRequest => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['session', 'assignment', 'command', 'tty', 'terminalSize']);
+  requireNetwork(typeof value.tty === 'boolean' && (value.tty === (value.terminalSize !== null)));
+  return {
+    session: snapshotRuntimeSessionBinding(value.session), assignment: referenceOf(value.assignment),
+    command: commandOf(value.command), tty: value.tty,
+    terminalSize: value.terminalSize === null ? null : terminalSizeOf(value.terminalSize),
+  };
+});
+
+export const snapshotOpenRuntimeAssignmentExecResponse = (
+  valueArg: unknown,
+): IOpenRuntimeAssignmentExecResponse => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['execId', 'assignment', 'tty', 'idleTimeoutMs']);
+  requireNetwork(typeof value.tty === 'boolean'
+    && value.idleTimeoutMs === runtimeAssignmentExecContract.idleTimeoutMs);
+  return {
+    execId: networkId(value.execId), assignment: referenceOf(value.assignment), tty: value.tty,
+    idleTimeoutMs: runtimeAssignmentExecContract.idleTimeoutMs,
+  };
+});
+
+export const snapshotResizeRuntimeAssignmentExecRequest = (
+  valueArg: unknown,
+): IResizeRuntimeAssignmentExecRequest => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['session', 'execId', 'terminalSize']);
+  return {
+    session: snapshotRuntimeSessionBinding(value.session), execId: networkId(value.execId),
+    terminalSize: terminalSizeOf(value.terminalSize),
+  };
+});
+
+export const snapshotResizeRuntimeAssignmentExecResponse = (
+  valueArg: unknown,
+): IResizeRuntimeAssignmentExecResponse => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['execId']);
+  return { execId: networkId(value.execId) };
+});
+
+export const snapshotCloseRuntimeAssignmentExecRequest = (
+  valueArg: unknown,
+): ICloseRuntimeAssignmentExecRequest => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['session', 'execId']);
+  return { session: snapshotRuntimeSessionBinding(value.session), execId: networkId(value.execId) };
+});
+
+export const snapshotCloseRuntimeAssignmentExecResponse = (
+  valueArg: unknown,
+): ICloseRuntimeAssignmentExecResponse => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['execId', 'outcome', 'exitCode', 'termination']);
+  const execId = networkId(value.execId);
+  if (value.outcome === 'exited') {
+    requireNetwork(typeof value.exitCode === 'number' && Number.isSafeInteger(value.exitCode)
+      && value.exitCode >= 0 && !Object.is(value.exitCode, -0)
+      && value.exitCode <= runtimeAssignmentExecContract.maximumExitCode && value.termination === null);
+    return { execId, outcome: 'exited', exitCode: value.exitCode, termination: null };
+  }
+  requireNetwork(value.outcome === 'terminated' && value.exitCode === null
+    && (terminations as readonly unknown[]).includes(value.termination));
+  return {
+    execId, outcome: 'terminated', exitCode: null,
+    termination: value.termination as TRuntimeAssignmentExecTermination,
+  };
+});
+
+/** Exec is a local controller's alone; `trustedSessionArg` decides, never a request field. */
+const requireLocalSession = (requestSessionArg: IRuntimeSessionBinding, trustedSessionArg: unknown): void => {
+  const trustedSession = safe(() => snapshotRuntimeSessionBinding(trustedSessionArg));
+  safe(() => requireNetwork(networkEqual(requestSessionArg, trustedSession)
+    && trustedSession.controller.kind === runtimeAssignmentExecContract.controllerKind));
+};
+
+/**
+ * Node-side content binding, not authentication. `trustedSessionArg` is the node's CURRENT
+ * session, the request must have arrived on that session's own connection, and that session must
+ * be a local controller's. `assignmentArg` is the node's current admitted revision of the named
+ * assignment: the request must name exactly it, it must be a `run` assignment, and it must belong
+ * to the session's controller, node and runtime namespace. Whether its container runs is the
+ * node's own check.
+ */
+export const bindOpenRuntimeAssignmentExecRequest = async (
+  valueArg: unknown, assignmentArg: unknown, trustedSessionArg: unknown,
+): Promise<{ request: IOpenRuntimeAssignmentExecRequest; assignment: IRuntimeAssignment }> => {
+  const request = snapshotOpenRuntimeAssignmentExecRequest(valueArg);
+  requireLocalSession(request.session, trustedSessionArg);
+  const assignment = safe(() => snapshotRuntimeAssignment(assignmentArg));
+  if ((await validateRuntimeAssignment(assignment)).length) fail();
+  safe(() => requireNetwork(assignment.disposition === 'run'
+    && networkEqual(assignment.controller, request.session.controller)
+    && assignment.nodeId === request.session.nodeId
+    && assignment.runtimeNamespace === request.session.runtimeNamespace
+    && networkEqual(request.assignment, getRuntimeAssignmentReference(assignment))));
+  return { request, assignment };
+};
+
+/** Matches an opened session to the request: the same assignment revision and terminal mode. */
+export const bindOpenRuntimeAssignmentExecResponse = (
+  valueArg: unknown, requestArg: unknown,
+): IOpenRuntimeAssignmentExecResponse => safe(() => {
+  const response = snapshotOpenRuntimeAssignmentExecResponse(valueArg);
+  const request = snapshotOpenRuntimeAssignmentExecRequest(requestArg);
+  requireNetwork(networkEqual(response.assignment, request.assignment) && response.tty === request.tty);
+  return response;
+});
+
+/** Node-side content binding of a resize; which sessions exist and are `tty` is the node's check. */
+export const bindResizeRuntimeAssignmentExecRequest = (
+  valueArg: unknown, trustedSessionArg: unknown,
+): IResizeRuntimeAssignmentExecRequest => {
+  const request = snapshotResizeRuntimeAssignmentExecRequest(valueArg);
+  requireLocalSession(request.session, trustedSessionArg);
+  return request;
+};
+
+export const bindResizeRuntimeAssignmentExecResponse = (
+  valueArg: unknown, requestArg: unknown,
+): IResizeRuntimeAssignmentExecResponse => safe(() => {
+  const response = snapshotResizeRuntimeAssignmentExecResponse(valueArg);
+  requireNetwork(response.execId === snapshotResizeRuntimeAssignmentExecRequest(requestArg).execId);
+  return response;
+});
+
+/** Node-side content binding of a close; which sessions exist is the node's check. */
+export const bindCloseRuntimeAssignmentExecRequest = (
+  valueArg: unknown, trustedSessionArg: unknown,
+): ICloseRuntimeAssignmentExecRequest => {
+  const request = snapshotCloseRuntimeAssignmentExecRequest(valueArg);
+  requireLocalSession(request.session, trustedSessionArg);
+  return request;
+};
+
+export const bindCloseRuntimeAssignmentExecResponse = (
+  valueArg: unknown, requestArg: unknown,
+): ICloseRuntimeAssignmentExecResponse => safe(() => {
+  const response = snapshotCloseRuntimeAssignmentExecResponse(valueArg);
+  requireNetwork(response.execId === snapshotCloseRuntimeAssignmentExecRequest(requestArg).execId);
+  return response;
+});