@serve.zone/interfaces 32.41.0 → 32.42.0

package/dist_ts/requests/corestorecontrol.d.ts

@@ -0,0 +1,33 @@
+import * as plugins from '../plugins.js';
+import type * as userInterfaces from '../data/user.js';
+import type * as controlTokenInterfaces from '../data/corestorecontroltoken.js';
+/**
+ * Stores the Corestore control token for every cluster relay to read sealed, so an administrator
+ * sets it without an exec into Cloudly's process.
+ *
+ * One token for both Corestore provider configs, stored in one transaction: either both hold the
+ * new token or neither does. `expected` is the state `getCorestoreControlTokenState` answered, and
+ * Cloudly stores only while the token is still exactly there; a set that committed in between is
+ * refused, never overwritten. Only the verified credential of a freshly authenticated
+ * administrator is read, and Cloudly writes the `receipt` in the transaction that stores the token.
+ * The token is in this request and nowhere else: never in the answer, a log, a hook or a receipt.
+ * Cloudly refuses with one of `data.corestoreControlTokenSetRefusals`.
+ */
+export interface IReq_Admin_Cloudly_SetCorestoreControlToken extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_SetCorestoreControlToken> {
+    method: 'setCorestoreControlToken';
+    request: controlTokenInterfaces.ICorestoreControlTokenSetRequest & {
+        identity: userInterfaces.IIdentityCredential;
+    };
+    response: controlTokenInterfaces.ICorestoreControlTokenSetResult;
+}
+/**
+ * Whether Cloudly holds the Corestore control token, at which revision, and every receipt of a set,
+ * oldest first. Value-free: no token, no hash. Requires an administrator.
+ */
+export interface IReq_Admin_Cloudly_GetCorestoreControlTokenState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_GetCorestoreControlTokenState> {
+    method: 'getCorestoreControlTokenState';
+    request: {
+        identity: userInterfaces.IIdentityCredential;
+    };
+    response: controlTokenInterfaces.ICorestoreControlTokenStateRead;
+}

package/dist_ts/requests/corestorecontrol.js

@@ -0,0 +1,2 @@
+import * as plugins from '../plugins.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZXN0b3JlY29udHJvbC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3JlcXVlc3RzL2NvcmVzdG9yZWNvbnRyb2wudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUMifQ==

package/dist_ts/requests/index.d.ts

@@ -10,6 +10,7 @@ import * as configRequests from './config.js';
 import * as coreMailRequests from './coremail.js';
 import * as coreMailAdminRequests from './coremail.admin.js';
 import * as corestoreRequests from './corestore.js';
+import * as corestoreControlRequests from './corestorecontrol.js';
 import * as deploymentRequests from './deployment.js';
 import * as dnsRequests from './dns.js';
 import * as domainRequests from './domain.js';
@@ -36,7 +37,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, fleetCutoverRequests as fleetcutover, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, corestoreControlRequests as corestorecontrol, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, fleetCutoverRequests as fleetcutover, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -11,6 +11,7 @@ import * as configRequests from './config.js';
 import * as coreMailRequests from './coremail.js';
 import * as coreMailAdminRequests from './coremail.admin.js';
 import * as corestoreRequests from './corestore.js';
+import * as corestoreControlRequests from './corestorecontrol.js';
 import * as deploymentRequests from './deployment.js';
 import * as dnsRequests from './dns.js';
 import * as domainRequests from './domain.js';
@@ -37,9 +38,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, fleetCutoverRequests as fleetcutover, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, corestoreControlRequests as corestorecontrol, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, fleetCutoverRequests as fleetcutover, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLHNCQUFzQixNQUFNLHFCQUFxQixDQUFDO0FBQzlELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLHFCQUFxQixNQUFNLHFCQUFxQixDQUFDO0FBQzdELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssa0JBQWtCLE1BQU0saUJBQWlCLENBQUM7QUFDdEQsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLHdCQUF3QixNQUFNLHVCQUF1QixDQUFDO0FBQ2xFLE9BQU8sS0FBSyxvQkFBb0IsTUFBTSxtQkFBbUIsQ0FBQztBQUMxRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssc0JBQXNCLE1BQU0scUJBQXFCLENBQUM7QUFDOUQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUVoRCxPQUFPLEVBQ0wsYUFBYSxJQUFJLEtBQUssRUFDdEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLG1CQUFtQixJQUFJLFdBQVcsRUFDbEMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsc0JBQXNCLElBQUksY0FBYyxFQUN4QyxjQUFjLElBQUksTUFBTSxFQUN4QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLHFCQUFxQixJQUFJLGFBQWEsRUFDdEMsaUJBQWlCLElBQUksU0FBUyxFQUM5QixrQkFBa0IsSUFBSSxVQUFVLEVBQ2hDLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLHdCQUF3QixJQUFJLGdCQUFnQixFQUM1QyxvQkFBb0IsSUFBSSxZQUFZLEVBQ3BDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsc0JBQXNCLElBQUksY0FBYyxFQUN4QyxjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLHNCQUFzQixNQUFNLHFCQUFxQixDQUFDO0FBQzlELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLHFCQUFxQixNQUFNLHFCQUFxQixDQUFDO0FBQzdELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssd0JBQXdCLE1BQU0sdUJBQXVCLENBQUM7QUFDbEUsT0FBTyxLQUFLLGtCQUFrQixNQUFNLGlCQUFpQixDQUFDO0FBQ3RELE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEtBQUssb0JBQW9CLE1BQU0sbUJBQW1CLENBQUM7QUFDMUQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGFBQWEsTUFBTSxZQUFZLENBQUM7QUFDNUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLHNCQUFzQixNQUFNLHFCQUFxQixDQUFDO0FBQzlELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFFaEQsT0FBTyxFQUNMLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixtQkFBbUIsSUFBSSxXQUFXLEVBQ2xDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLHNCQUFzQixJQUFJLGNBQWMsRUFDeEMsY0FBYyxJQUFJLE1BQU0sRUFDeEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixxQkFBcUIsSUFBSSxhQUFhLEVBQ3RDLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLG9CQUFvQixJQUFJLFlBQVksRUFDcEMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsWUFBWSxJQUFJLElBQUksRUFDcEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixlQUFlLElBQUksT0FBTyxFQUMxQixzQkFBc0IsSUFBSSxjQUFjLEVBQ3hDLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsWUFBWSxJQUFJLElBQUksRUFDcEIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsZUFBZSxJQUFJLE9BQU8sR0FDM0IsQ0FBQztBQUVGLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUMifQ==

package/dist_ts/requests/node.d.ts

@@ -7,7 +7,7 @@ import type { IIdentity } from '../data/user.js';
 import type { IPlatformObjectStorageEndpoint } from '../platform/objectstorage.js';
 import type { IPlatformDatabaseEndpoint } from '../platform/database.js';
 import type { INodeCredentialMetadata, INodeCredentialMutationPreconditions, INodeCredentialMutationResult, TNodeCredentialPurpose } from '../data/nodecredential.js';
-import type { INodeRuntimeRetirement } from '../data/noderetirement.js';
+import type { INodeRuntimeRetirement, TNodeRuntimeRetirementDisposition } from '../data/noderetirement.js';
 import type { INodeRuntimeBindingRead, INodeRuntimeBindingRequest } from '../data/noderuntimebinding.js';
 import type { INodeEnrollmentRequest, INodeEnrollmentAcknowledgement, INodeEnrollmentState } from '../data/nodeenrollment.js';
 /** Node-self adoption preconditions, not an admin or workload RBAC grant. */
@@ -175,6 +175,13 @@ export interface IReq_Any_Cloudly_DeleteNodeById extends plugins.typedrequestInt
  * `expectedGeneration` is the cluster runtime generation the caller read with `getClusterRuntime`:
  * retirement is a statement about a node of a Pallet cluster, so a cutover that moved the phase
  * meanwhile refuses the write instead of retiring a node out of a runtime it no longer runs in.
+ *
+ * `disposition` states how the node leaves (`data.TNodeRuntimeRetirementDisposition`). A request
+ * that states none asks for `withdrawn`, the retirement this request always described: the node
+ * takes part, and nothing is abandoned. `lost` is taken only when stated, is refused as
+ * `node-still-reporting` for a node that still reports, and escalates a `withdrawn` retirement that
+ * is still `retiring`. Neither disposition shortens the egress fence: the node leaves the protected
+ * authority only behind its `data.IRuntimeNetworkEgressRetirement`.
  * Every refusal is one of `data.nodeRuntimeRetirementRefusals` and takes nothing away.
  */
 export interface IReq_Any_Cloudly_RetireClusterNode extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_RetireClusterNode> {
@@ -183,6 +190,7 @@ export interface IReq_Any_Cloudly_RetireClusterNode extends plugins.typedrequest
         identity: IIdentity;
         nodeId: string;
         expectedGeneration: number;
+        disposition?: TNodeRuntimeRetirementDisposition;
     };
     response: {
         retirement: INodeRuntimeRetirement;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.41.0",
+  "version": "32.42.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -23,11 +23,11 @@
   "dependencies": {
     "@api.global/typedrequest-interfaces": "^7.1.0",
     "@push.rocks/smartcrypto": "^3.0.0",
-    "@push.rocks/smartlog": "^4.0.0",
+    "@push.rocks/smartlog": "^4.0.3",
     "@tsclass/tsclass": "^9.5.1"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^5.1.0",
+    "@git.zone/tsbuild": "^5.1.1",
     "@git.zone/tsdoc": "^3.0.1",
     "@git.zone/tsrun": "^3.0.2",
     "@git.zone/tstest": "6.3.2",

package/readme.md

@@ -395,6 +395,16 @@ the declaration is not a revocation acknowledgement. Prefix arrays are sorted
 lexically and nonoverlapping; pools and endpoints are sorted by ID; egress owners
 are ordered by canonical JSON of `[nodeId, runtimeNamespace]`.
 
+`continuesRuntimeNetworkProtection(previous, next)` states which successor of a protected authority
+only adds. It answers `true` when `next` is `previous` itself, or exactly the next step of its chain
+(the same `id` and controller, `next.previous` naming `previous`) in which every egress owner, pool,
+resolver and platform endpoint of `previous` is still present with the same content and the prefixes
+still cover every address `previous` protected, however they are split. A cluster topology change is
+such a step: a node joins the egress, or a cluster's hub joins the platform endpoints. The step keeps
+its barrier: every egress owner still reports a receipt for `next` before an allocation binds to it.
+Any removal or change, a jump over a step, another chain or another controller answers `false`. Both
+authorities and their digests are validated, and either that does not validate is rejected.
+
 `IRuntimeNetworkProtectionReceipt` reports a worker's durable, joined native
 protection journal separately from projection admission. It binds a complete
 protected-authority reference, node/controller scope, authenticated reporter,
@@ -411,9 +421,11 @@ current persisted protection receipt and durable session for every declared
 egress owner, in canonical owner order. Missing, unavailable, stale-protection
 and superseded-session evidence reject. An offline owner cannot be omitted.
 The controller must fence all those records together with lease insertion, before
-reserving any handoff or workload address. No generic independent-fence flag is
-provided; such a mechanism needs its own verified owner. Protection receipts
-neither prove workload readiness nor release packet/address/name quarantine.
+reserving any handoff or workload address. There is no generic independent-fence
+flag, quorum or expiry: the one way an owner leaves is
+[Egress Owner Retirement](#egress-owner-retirement).
+Protection receipts neither prove workload readiness nor release
+packet/address/name quarantine.
 
 `IRuntimeNetworkHandoffLease` binds an immutable node/router incarnation to its
 protected-authority reference, transit subnet and peers, protocol-qualified source
@@ -732,9 +744,12 @@ A credential names one projection, but its key pair belongs to the node's manage
 membership, which outlives it. Every workload add, removal, readiness change or policy change
 signs a new projection generation; none of them changes who the member is.
 `continuesRuntimeManagedVpnMembership(previous, next)` is that rule: `next` continues the
-membership when it is the same projection lineage (`id`) under the same protected authority and
-the same handoff lease (which names the node scope and carries the router incarnation), and is
-`previous` itself or a later generation. A protection bump, a fresh handoff (router
+membership when it is the same projection lineage (`id`), under a protected authority that
+continues the previous one (`continuesRuntimeNetworkProtection`: the same authority or its next
+step that only adds), with the same handoff lease (which names the node scope and carries the
+router incarnation), and is `previous` itself or a later generation. A node joining the egress or a
+cluster hub joining the platform endpoints therefore keeps every member's key pair and hub session.
+A protection step that removes or changes anything or skips a step, a fresh handoff (router
 reincarnation) or a new controller epoch is a new membership; an earlier generation or another
 projection of the same generation continues nothing. It validates both projections and rejects
 one that does not validate.
@@ -761,6 +776,59 @@ Noise implementation owns cryptographic validation and authentication. Credentia
 delivery does not prove a connected VPN, TUN ownership, packet enforcement or
 workload readiness, and does not replace explicit packet withdrawals.
 
+### Egress Owner Retirement
+
+An owner that is offline, revoked or gone can never acknowledge a successor, so
+while it stays declared no allocation is possible after the next protection change.
+`IRuntimeNetworkEgressRetirement` is the independent fence that lets it leave. Its
+owner is the controller, which records it from its own durable state against the
+exact protected authority the owner is about to leave, once all five hold:
+
+1. the node carries an `INodeRuntimeRetirement` row, whose `disposition` the fence
+   copies;
+2. both node credentials are revoked (`revokedCredentials`, committed at
+   `revokedAt`), so the node can no longer register, renew a DNS lease or fetch a
+   managed VPN credential;
+3. every DNS and managed VPN window the node was ever issued has ended
+   (`packetWindowExpiresAt`, or `revokedAt` when it was issued none), so no hub
+   relays for it even if it was never told to stop, and `fencedAt` is not earlier;
+4. every handoff and workload lease the node was granted is quarantined
+   (`quarantinedHandoffs`, at most 256, and `quarantinedWorkloads`, at most 512,
+   both in canonical order) and is never handed out again;
+5. every remaining owner of that authority acknowledged a projection head that
+   carries no endpoint of the node (`clearedProjections`, one per remaining owner
+   in canonical owner order, never the node itself).
+
+`lastReceipt` is the node's last accepted protection receipt. A `withdrawn` node
+took part in its own retirement, so it always has one (its null withdrawal); a
+`lost` node may have none. Neither disposition shortens the fence: a lost node
+leaves behind exactly the same controller-owned evidence as a withdrawn one.
+`snapshotRuntimeNetworkEgressRetirement` is the exact-key reader and
+`computeRuntimeNetworkEgressRetirementDigest` seals it under
+`serve.zone/runtime-network-egress-retirement`. Neither authenticates the
+evidence; the controller fences the rows it read together with the authority it
+stages.
+
+`bindRuntimeNetworkProtectedAuthorityRetirement(previous, next, fences,
+retiredOwners)` is the pure successor rule for the egress owners and the address
+space of any step. `next` must be the exact successor of `previous` under the same
+controller, with both digests verified. An owner of `previous` may be absent from
+`next` only when exactly one fence recorded against the exact `previous` reference,
+verified by its digest, names it; a fence for an owner `next` still names, or one
+`previous` never named, refuses the step, and every fence's `clearedProjections`
+must name exactly the owners the step keeps. `retiredOwners` is the complete,
+canonically ordered list of owners earlier steps fenced, which the caller's
+durable history supplies; neither side may name any of them, so a fenced owner
+never returns. Every pool of `previous` stays unchanged and the prefixes of `next`
+cover those of `previous`; a step that removes an owner also keeps every resolver.
+Owners may join in the same step, and a step without fences is the additive rule.
+One step consumes at most 16 fences (`runtimeNetworkEgressRetirementContract`).
+
+A retirement step is a new protected authority: every remaining owner reports a
+receipt citing it before anything new is allocated, while existing leases keep
+their historical eligibility. It also ends every managed VPN membership, as every
+protection change does, so each retirement costs the fleet one reconnect.
+
 ### DNS Lease Renewals
 
 A projection's `dns` window lasts at most fifteen minutes and is signed content, so a node's
@@ -1822,20 +1890,33 @@ status or assignments changed; it carries no state, so a late push never overwri
 
 ### Node Retirement
 
-`data.INodeRuntimeRetirement { id, clusterId, state, actorId, since }` records that one node leaves
-its cluster's Pallet runtime. `TNodeRuntimeRetirementState` is `retiring` while the producer still
-stops and removes the node's slots, the compiler quarantines its handoff and both node credentials
-are revoked, and `retired` once that has settled. It is stored beside the node document, because a
-node update merges caller data and no caller may retire a node with it. The producers read the row's
-presence rather than its state: a node that has one is no longer an egress member and desires no
-slots, so the row is written before anything is taken away and stays as long as the node document.
-`snapshotNodeRuntimeRetirement` checks the record.
-
-`requests.node.retireClusterNode { identity, nodeId, expectedGeneration }` answers `{ retirement }`.
-`expectedGeneration` is the cluster runtime generation the caller read with `getClusterRuntime`, so a
-cutover that moved the phase meanwhile refuses the write. Every refusal is one of
-`data.nodeRuntimeRetirementRefusals` — `node-missing`, `cluster-runtime-not-pallet`,
-`node-already-retired` or `conflict` — and takes nothing away.
+`data.INodeRuntimeRetirement { id, clusterId, state, disposition, actorId, since }` records that one
+node leaves its cluster's Pallet runtime. `TNodeRuntimeRetirementState` is `retiring` while the
+producer still stops and removes the node's slots, the compiler quarantines its handoff and leases,
+both node credentials are revoked and the node's egress fence is not yet recorded, and `retired`
+once the protected authority no longer names the node (see
+[Egress Owner Retirement](#egress-owner-retirement)). It is stored beside the node document, because
+a node update merges caller data and no caller may retire a node with it. The producers read the
+row's presence rather than its state: a node that has one is no longer an egress member and desires
+no slots, so the row is written before anything is taken away and stays as long as the node
+document. `snapshotNodeRuntimeRetirement` checks the record.
+
+`TNodeRuntimeRetirementDisposition` (`nodeRuntimeRetirementDispositions`,
+`snapshotNodeRuntimeRetirementDisposition`) says how the node leaves. `withdrawn`: the node still
+runs and takes part — its slots are removed against its own removal receipts and its Pallet
+withdraws its protection receipt before its credentials are revoked. `lost`: an administrator
+states the node will never report again, which authorizes abandoning its slots without removal
+receipts and nothing else; its egress fence is the same as a withdrawn node's.
+
+`requests.node.retireClusterNode { identity, nodeId, expectedGeneration, disposition? }` answers
+`{ retirement }`. `expectedGeneration` is the cluster runtime generation the caller read with
+`getClusterRuntime`, so a cutover that moved the phase meanwhile refuses the write. A request that
+states no disposition asks for `withdrawn`, the retirement this request always described; `lost`
+is taken only when stated, and asking again as `lost` escalates a `withdrawn` retirement that is
+still `retiring`. Every refusal is one of `data.nodeRuntimeRetirementRefusals` — `node-missing`,
+`cluster-runtime-not-pallet`, `node-already-retired`, `conflict` or `node-still-reporting` (a `lost`
+retirement of a node whose last accepted report is younger than
+`clusterNodeObservationFreshnessMs`) — and takes nothing away.
 
 ### Corestore Database Export Packaging
 
@@ -3611,6 +3692,7 @@ Request groups are exported by product area:
 - `requests.coremail`
 - `requests.coremailAdmin`
 - `requests.corestore`
+- `requests.corestorecontrol`
 - `requests.deployment`
 - `requests.dns`
 - `requests.domain`
@@ -3724,6 +3806,47 @@ bytes and digests exactly.
 payload, one-byte-larger framed snapshot-original, 128 MiB verified closure
 plaintext, and 256 MiB closure boundaries used by Corestore.
 
+### Corestore Control Token Administration
+
+The elected relay of every cluster calls its nodes' Corestore control API with one control token
+(`CORESTORE_API_TOKEN`), which Cloudly stores for both Corestore provider configs and hands to the
+relay sealed (see Corestore Runtime Credentials). `requests.corestorecontrol` lets an administrator
+store that token without an exec into Cloudly's process.
+
+`setCorestoreControlToken { identity, token, expected }` stores `token` under both provider configs
+in one transaction, so either both hold it or neither does. `token` must pass
+`isCorestoreControlToken` (32 to 4096 UTF-8 bytes, no whitespace) and is the only member of this
+contract that carries the token: it is never in an answer, a receipt, a log or a hook, and a sender
+never persists the request. `expected` is the `data.TCorestoreControlTokenState` the administrator
+last read: `{ state: 'absent' }` or `{ state: 'present', revision }`, never a minimum, so a set that
+committed in between is refused rather than overwritten. `revision` is 1 for the first token ever
+stored and advances by exactly one with every accepted set; no request removes a token. It requires
+a freshly authenticated administrator, exactly as a relay credential mutation does. The answer,
+`data.ICorestoreControlTokenSetResult`, is the state the set produced and its receipt. Refusals are
+`data.corestoreControlTokenSetRefusals` (`data.TCorestoreControlTokenSetRefusal`):
+`token-invalid`, `token-present`, `token-absent`, `token-revision-mismatch` and
+`provider-unavailable`.
+
+Every accepted set is audited: Cloudly writes `data.ICorestoreControlTokenSetReceipt` (`id`,
+`revision`, `via`, `actorId`, `setAt`) in the transaction that stores the token. `via` is
+`admin-request` with the administrator's `actorId`, or `container-cli` with
+`data.corestoreControlTokenContainerCliActorId` (`operator:secrets-cli`) when Cloudly's in-container
+`secrets set-corestore-control-token` stored it; that command advances the same revision. A receipt
+is value-free: no token, no hash. `getCorestoreControlTokenState { identity }` answers
+`data.ICorestoreControlTokenStateRead`: the state and its receipts, oldest first, contiguous and
+ending at the state's revision; no token stored means no receipt. Only a token stored before
+receipts existed, which Cloudly's migration records as revision 1, has no receipt, so the receipts
+start at revision 1 or 2. A read answers at most `data.corestoreControlTokenMaximumReceipts` (4096)
+receipts: past that many sets it answers the latest 4096, whose oldest may name any revision.
+
+A reader checks a set answer with `bindCorestoreControlTokenSet(answer, request)`: the state is
+present at revision 1 after an absent expectation and at the expected revision plus one otherwise,
+and the receipt is an `admin-request` receipt for exactly that revision.
+`snapshotCorestoreControlTokenSetRequest`, `snapshotCorestoreControlTokenSetResult`,
+`snapshotCorestoreControlTokenSetReceipt`, `snapshotCorestoreControlTokenState` and
+`snapshotCorestoreControlTokenStateRead` are the exact-keyed readers. Every refusal is the
+contract's one value-free message and never quotes the token.
+
 ### Corestore Through The Relay
 
 A serve.zone cluster is outbound-only and Corestore is node-local, so Cloudly never reaches a

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.41.0',
+  version: '32.42.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/corestorecontroltoken.ts

@@ -0,0 +1,195 @@
+import { isCorestoreControlToken } from '../runtime.corestore.js';
+import {
+  captureNetwork,
+  networkCounter,
+  networkId,
+  networkList,
+  networkRecord,
+  requireNetwork,
+} from '../private/networkcontract.js';
+
+/**
+ * Whether Cloudly holds the Corestore control token, and at which revision. Value-free.
+ *
+ * There is one token for both Corestore provider configs, so this is one state rather than one per
+ * provider. `revision` is 1 for the first token ever stored and advances by exactly one with every
+ * accepted set, whichever path set it. No request removes a token, so a present token never turns
+ * absent again.
+ */
+export type TCorestoreControlTokenState =
+  | { state: 'absent' }
+  | { state: 'present'; revision: number };
+
+/**
+ * What an administrator names to store the Corestore control token: the token, and the state the
+ * administrator last read. Never a minimum: a set that committed after that read is refused rather
+ * than overwritten.
+ *
+ * `token` is the secret itself, the only member of this contract that carries it. A sender never
+ * logs, hooks or persists the request; Cloudly never answers or records the token.
+ */
+export interface ICorestoreControlTokenSetRequest {
+  token: string;
+  expected: TCorestoreControlTokenState;
+}
+
+/**
+ * Which path stored a token: an administrator's typed request, or the `secrets
+ * set-corestore-control-token` command run inside Cloudly's container.
+ */
+export type TCorestoreControlTokenSetPath = 'admin-request' | 'container-cli';
+
+/**
+ * The audit record of one accepted set, which Cloudly writes in the transaction that stores the
+ * token. Append-only and value-free: it names which revision was stored, by whom, how and when,
+ * never the token or a hash of it.
+ */
+export interface ICorestoreControlTokenSetReceipt {
+  id: string;
+  /** The revision this set stored. */
+  revision: number;
+  via: TCorestoreControlTokenSetPath;
+  /** The administrator read from the verified credential, or `operator:secrets-cli`. */
+  actorId: string;
+  setAt: number;
+}
+
+/** What Cloudly answers to an accepted set: the state it produced and its receipt. Value-free. */
+export interface ICorestoreControlTokenSetResult {
+  state: { state: 'present'; revision: number };
+  receipt: ICorestoreControlTokenSetReceipt;
+}
+
+/**
+ * The token's state and its most recent receipts, oldest first: every receipt while the token has
+ * been set at most `corestoreControlTokenMaximumReceipts` times, the latest that many after. Value-free.
+ */
+export interface ICorestoreControlTokenStateRead {
+  state: TCorestoreControlTokenState;
+  receipts: ICorestoreControlTokenSetReceipt[];
+}
+
+/** Every reason Cloudly answers instead of storing a Corestore control token. */
+export const corestoreControlTokenSetRefusals = Object.freeze([
+  /** The token is outside the contract: its length, encoding or whitespace (`isCorestoreControlToken`). */
+  'token-invalid',
+  /** `expected` said absent, and a token is stored. */
+  'token-present',
+  /** `expected` named a revision, and no token is stored. */
+  'token-absent',
+  /** `expected` named a revision, and the stored token is at another one. */
+  'token-revision-mismatch',
+  /** A Corestore provider config is missing or disabled, so there is nothing to store it under. */
+  'provider-unavailable',
+] as const);
+
+export type TCorestoreControlTokenSetRefusal = typeof corestoreControlTokenSetRefusals[number];
+
+/** The actor a receipt names when the in-container command stored the token. */
+export const corestoreControlTokenContainerCliActorId = 'operator:secrets-cli' as const;
+
+/** The most receipts one state read answers: the latest ones, once a token has been set more often. */
+export const corestoreControlTokenMaximumReceipts = 4096;
+
+const fail = (): never => { throw new Error('Corestore control token contract rejected.'); };
+const safe = <T>(operationArg: () => T): T => {
+  try { return operationArg(); } catch { return fail(); }
+};
+
+const readState = (valueArg: unknown): TCorestoreControlTokenState => {
+  const value = networkRecord(valueArg, ['state'], ['revision']);
+  if (value.state === 'absent') {
+    networkRecord(value, ['state']);
+    return { state: 'absent' };
+  }
+  requireNetwork(value.state === 'present');
+  return { state: 'present', revision: networkCounter(networkRecord(value, ['state', 'revision']).revision) };
+};
+
+export const snapshotCorestoreControlTokenState = (
+  valueArg: unknown,
+): TCorestoreControlTokenState => safe(() => readState(captureNetwork(valueArg)));
+
+/**
+ * Structural copy of a set request. A refusal never quotes the request, because it carries the
+ * token: every failure is the contract's one value-free message.
+ */
+export const snapshotCorestoreControlTokenSetRequest = (
+  valueArg: unknown,
+): ICorestoreControlTokenSetRequest => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['token', 'expected']);
+  requireNetwork(isCorestoreControlToken(value.token));
+  return { token: value.token, expected: readState(value.expected) };
+});
+
+const readReceipt = (valueArg: unknown): ICorestoreControlTokenSetReceipt => {
+  const value = networkRecord(valueArg, ['id', 'revision', 'via', 'actorId', 'setAt']);
+  requireNetwork(value.via === 'admin-request' || value.via === 'container-cli');
+  const actorId = networkId(value.actorId);
+  requireNetwork(value.via === 'admin-request'
+    ? actorId !== corestoreControlTokenContainerCliActorId
+    : actorId === corestoreControlTokenContainerCliActorId);
+  return {
+    id: networkId(value.id),
+    revision: networkCounter(value.revision),
+    via: value.via,
+    actorId,
+    setAt: networkCounter(value.setAt),
+  };
+};
+
+export const snapshotCorestoreControlTokenSetReceipt = (
+  valueArg: unknown,
+): ICorestoreControlTokenSetReceipt => safe(() => readReceipt(captureNetwork(valueArg)));
+
+export const snapshotCorestoreControlTokenSetResult = (
+  valueArg: unknown,
+): ICorestoreControlTokenSetResult => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['state', 'receipt']);
+  const state = readState(value.state);
+  requireNetwork(state.state === 'present');
+  return { state, receipt: readReceipt(value.receipt) };
+});
+
+/**
+ * Structural copy of a state read. No token stored means no receipt. A stored token's receipts are
+ * contiguous and end at its revision, and they start at revision 1 -- or at 2, because only a token
+ * stored before receipts existed reaches revision 1 without one -- unless the read is a full window
+ * of `corestoreControlTokenMaximumReceipts`, whose oldest receipt may name any later revision.
+ */
+export const snapshotCorestoreControlTokenStateRead = (
+  valueArg: unknown,
+): ICorestoreControlTokenStateRead => safe(() => {
+  const value = networkRecord(captureNetwork(valueArg), ['state', 'receipts']);
+  const state = readState(value.state);
+  const receipts = networkList(value.receipts, corestoreControlTokenMaximumReceipts, readReceipt);
+  if (state.state === 'absent') {
+    requireNetwork(receipts.length === 0);
+    return { state, receipts };
+  }
+  const first = state.revision - receipts.length + 1;
+  requireNetwork(first >= 1
+    && (first <= 2 || receipts.length === corestoreControlTokenMaximumReceipts)
+    && receipts.every((receipt, index) => receipt.revision === first + index));
+  return { state, receipts };
+});
+
+/**
+ * Joins a set answer to the request it answers. The answered state is the one the request
+ * produces -- revision 1 when no token was stored, the expected revision plus one otherwise -- and
+ * the receipt is an administrator's receipt for exactly that revision. Content join only: whether
+ * the token was stored is Cloudly's to prove, and the answer never carries it.
+ */
+export const bindCorestoreControlTokenSet = (
+  resultArg: unknown,
+  requestArg: unknown,
+): ICorestoreControlTokenSetResult => safe(() => {
+  const request = snapshotCorestoreControlTokenSetRequest(requestArg);
+  const result = snapshotCorestoreControlTokenSetResult(resultArg);
+  const produced = request.expected.state === 'absent' ? 1 : request.expected.revision + 1;
+  requireNetwork(Number.isSafeInteger(produced)
+    && result.state.revision === produced
+    && result.receipt.revision === produced
+    && result.receipt.via === 'admin-request');
+  return result;
+});

package/ts/data/index.ts

@@ -7,6 +7,7 @@ export * from './clusteringressdesignation.js';
 export * from './clusterrelaycredential.js';
 export * from './config.js';
 export * from './corestore.js';
+export * from './corestorecontroltoken.js';
 export * from './corestorelegacyadoption.js';
 export * from './coremail.js';
 export * from './coremail.runtime.js';
@@ -38,6 +39,7 @@ export * from './networkaddressplan.js';
 export * from './networkauthority.js';
 export * from './networkcredential.js';
 export * from './networkdelivery.js';
+export * from './networkegressretirement.js';
 export * from './networklease.js';
 export * from './networknode.js';
 export * from './networkprojection.js';

package/ts/data/networkaddressplan.ts

@@ -2,8 +2,8 @@ import type { TSha256Digest } from './immutableimage.js';
 import type { IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
 import { computeRuntimeNetworkProtectedAuthorityDigest, runtimeNetworkAuthorityContract,
   snapshotRuntimeNetworkProtectedAuthority } from './networkauthority.js';
-import { captureNetwork, failNetwork, networkContains, networkCounter, networkEqual, networkId, networkIpv4, networkList,
-  networkOverlaps, networkPrefix, networkPrefixBounds, networkPrivatePrefix, networkRecord, networkSafe,
+import { captureNetwork, failNetwork, networkContains, networkCounter, networkCoveredBy, networkEqual, networkId, networkIpv4, networkList,
+  networkOverlaps, networkPrefix, networkPrivatePrefix, networkRecord, networkSafe,
   requireNetwork, RuntimeNetworkAddressPlanStructureError, type TRuntimeNetworkAddressPlanOrderedField,
 } from '../private/networkcontract.js';
 
@@ -279,16 +279,6 @@ export const composeRuntimeNetworkProtectedAuthority = async (
   } catch { return failNetwork(); }
 };
 
-/** Whether the union of `prefixes`, which never overlap one another, covers every address of `prefix`. */
-const coveredBy = (prefixes: string[], prefix: string): boolean => {
-  const [first, last] = networkPrefixBounds(prefix);
-  const covered = prefixes.reduce((sum, candidate) => {
-    const [low, high] = networkPrefixBounds(candidate);
-    return sum + Math.max(0, Math.min(last, high) - Math.max(first, low) + 1);
-  }, 0);
-  return covered === last - first + 1;
-};
-
 /**
  * The entries of `previous` that `next` does not hold exactly as they were. An entry changed under its
  * old id counts: whatever still names that id would now reach something else.
@@ -314,7 +304,7 @@ export const admitRuntimeNetworkAddressPlanChange = (previousValue: unknown | nu
     if (networkEqual({ ...previous, revision: next.revision }, next)) return { status: 'unchanged' };
     if (!networkEqual(previous.vpn, next.vpn)) return { status: 'refused', reason: 'plan-vpn-immutable' };
     if (removedOrChanged(previous.pools, next.pools).length > 0) return { status: 'refused', reason: 'plan-pool-removed' };
-    if (!previous.prefixes.every(prefix => coveredBy(next.prefixes, prefix))) return { status: 'refused', reason: 'plan-prefix-shrunk' };
+    if (!previous.prefixes.every(prefix => networkCoveredBy(next.prefixes, prefix))) return { status: 'refused', reason: 'plan-prefix-shrunk' };
     return { status: 'accepted', removed: { resolverIds: idsOf(removedOrChanged(previous.resolvers, next.resolvers)),
       platformEndpointIds: idsOf(removedOrChanged(previous.platformEndpoints, next.platformEndpoints)) } };
   });