@serve.zone/interfaces 32.43.0 → 32.45.0

package/dist_ts/data/serviceruntime.d.ts

@@ -73,7 +73,7 @@ export declare const serviceRuntimeContract: Readonly<{
     readonly maximumAssignmentPageSize: 256;
 }>;
 declare const serviceRuntimeWaitingReasons: readonly ["node-network-pending", "conflict", "failure-backoff", "storage-import-pending", "bindings-pending", "legacy-adoption-pending", "objectstorage-retention-pending"];
-declare const serviceRuntimeRefusals: readonly ["cluster-runtime-missing", "organization-missing", "image-plan-missing", "platform-unsupported", "secrets-unsupported", "volumes-unsupported", "port-protocol-unsupported", "ports-too-many", "readiness-target-undeclared", "environment-too-large", "no-eligible-node", "replica-limit", "node-authority-unsupported", "network-policy-missing", "network-policy-mismatch", "network-workload-pool-missing", "network-workload-pool-exhausted", "volume-driver-unsupported", "volume-options-unsupported", "volume-shared-unsupported", "volume-placement-unsupported", "volume-initialization-unknown", "volume-ownership-unknown", "objectstorage-endpoint-missing", "objectstorage-binding-invalid", "objectstorage-environment-conflict", "objectstorage-endpoint-unselected", "database-endpoint-missing", "database-endpoint-unselected", "published-port-reserved", "published-port-symmetric-without-egress"];
+declare const serviceRuntimeRefusals: readonly ["cluster-runtime-missing", "organization-missing", "image-plan-missing", "platform-unsupported", "secrets-unsupported", "volumes-unsupported", "port-protocol-unsupported", "ports-too-many", "readiness-target-undeclared", "environment-too-large", "no-eligible-node", "replica-limit", "node-authority-unsupported", "network-policy-missing", "network-policy-mismatch", "network-workload-pool-missing", "network-workload-pool-exhausted", "volume-driver-unsupported", "volume-options-unsupported", "volume-shared-unsupported", "volume-placement-unsupported", "volume-initialization-unknown", "volume-ownership-unknown", "objectstorage-endpoint-missing", "objectstorage-binding-invalid", "objectstorage-environment-conflict", "objectstorage-endpoint-unselected", "database-endpoint-missing", "database-endpoint-unselected", "published-port-reserved", "published-port-symmetric-without-egress", "readiness-network-unsupported"];
 /**
  * Why the producer is not converging yet, though nothing needs an administrator:
  * `node-network-pending` waits for a node's network readiness, `conflict` for a sweep over inputs
@@ -137,6 +137,13 @@ export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[n
  * which the handoff leases' `runtimeNetworkHandoffSnatPortRange` owns; a document written before
  * that rule can hold one. `published-port-symmetric-without-egress` is a `symmetric` entry in a
  * document whose `publicEgress` is false, which a projection endpoint refuses.
+ *
+ * `readiness-network-unsupported` is a spec whose network is `isolated` and whose readiness probe is
+ * `tcp` or `http`: an isolated workload has no address its node can dial, so the probe could never
+ * pass and the node refuses the run (`TRuntimeAssignmentFailureCause` `refused` for
+ * `unsupported-readiness`). `isServiceRuntimeReadinessReachable` is this rule; a producer answers
+ * what it returns. The spec snapshot still reads such a spec, so a stored one stays readable and
+ * is answered with this refusal rather than refused as data.
  */
 export type TServiceRuntimeRefusal = typeof serviceRuntimeRefusals[number];
 interface IServiceRuntimeStatusBase {
@@ -164,6 +171,32 @@ export type IServiceRuntimeStatus = IServiceRuntimeStatusBase & ({
  * node admitted but has not yet reported on reads as undelivered.
  */
 export type TServiceRuntimeAssignmentDelivery = 'undelivered' | 'delivered';
+/**
+ * Why one dispatch of an assignment revision to its node ended as it did.
+ *
+ * The node holds the revision: `accepted`, `replay` or `historical` is what the node answered to
+ * the push, and `acknowledged` a revision the node's current session acknowledged before, answered
+ * from that acknowledgement without pushing it again.
+ *
+ * The node does not hold it from this dispatch: `node-busy` while the node already carries its limit
+ * of pushes in flight, `node-not-connected` while no live peer holds a session for the node,
+ * `session-moved` when the session the dispatch began on is no longer the node's current one,
+ * `intent-not-current` when the revision is no longer the one the controller wants on that node,
+ * `request-unbound` when the request does not bind to the session it would travel on,
+ * `node-refused` when the node (or the relay carrying it) answered the push with a refusal,
+ * `push-failed` when the push got no answer in time or its carrier failed, and
+ * `acknowledgement-unbound` when the answer names another revision.
+ */
+export declare const assignmentDispatchReasons: readonly ["accepted", "replay", "historical", "acknowledged", "node-busy", "node-not-connected", "session-moved", "intent-not-current", "request-unbound", "node-refused", "push-failed", "acknowledgement-unbound"];
+export type TAssignmentDispatchReason = typeof assignmentDispatchReasons[number];
+/** The last dispatch of a slot's current assignment, as the controller recorded it. Value-free. */
+export interface IServiceRuntimeAssignmentDispatch {
+    /** Whether the node holds the revision after this dispatch. */
+    delivered: boolean;
+    reason: TAssignmentDispatchReason;
+    /** Unix milliseconds on the controller's clock when this dispatch ended. */
+    at: number;
+}
 /** One replica slot's current assignment, as an administrator reads it. */
 export interface IServiceRuntimeAssignmentView {
     serviceId: string;
@@ -180,12 +213,27 @@ export interface IServiceRuntimeAssignmentView {
     /** Joined stop and remove receipts of this attempt. */
     terminalReceiptCount: 0 | 1 | 2;
     delivery: TServiceRuntimeAssignmentDelivery;
+    /**
+     * The last dispatch of the current revision while the controller still remembers one, null when
+     * it remembers none. Absent from a controller that does not report dispatches. Dispatch is the
+     * controller's push; `delivery` stays the node's own evidence.
+     */
+    dispatch?: IServiceRuntimeAssignmentDispatch | null;
 }
 /**
  * Structural snapshot for exact persistence and for a spec write. Whether the cluster, the nodes and
  * the platform endpoints exist, and whether the service declares the readiness target, is Cloudly's.
  */
 export declare const snapshotServiceRuntimeSpec: (value: unknown) => IServiceRuntimeSpec;
+/**
+ * Whether a spec's readiness probe can reach its workload: false exactly for an `isolated` network
+ * with a `tcp` or `http` probe, which the producer answers as `readiness-network-unsupported`. The
+ * spec is read through `snapshotServiceRuntimeSpec`, so a value that is no spec is refused with its
+ * rejection rather than judged.
+ */
+export declare const isServiceRuntimeReadinessReachable: (value: unknown) => boolean;
+/** Exactly a recorded dispatch of an assignment: a known reason and a positive Unix millisecond time. */
+export declare const isServiceRuntimeAssignmentDispatch: (value: unknown) => value is IServiceRuntimeAssignmentDispatch;
 /** Structural snapshot for exact persistence: a reason belongs to exactly one state. */
 export declare const snapshotServiceRuntimeStatus: (value: unknown) => IServiceRuntimeStatus;
 export {};

package/dist_ts/data/serviceruntime.js

@@ -28,7 +28,28 @@ const serviceRuntimeRefusals = [
     'volume-placement-unsupported', 'volume-initialization-unknown', 'volume-ownership-unknown',
     'objectstorage-endpoint-missing', 'objectstorage-binding-invalid', 'objectstorage-environment-conflict',
     'objectstorage-endpoint-unselected', 'database-endpoint-missing', 'database-endpoint-unselected',
-    'published-port-reserved', 'published-port-symmetric-without-egress',
+    'published-port-reserved', 'published-port-symmetric-without-egress', 'readiness-network-unsupported',
+];
+/**
+ * Why one dispatch of an assignment revision to its node ended as it did.
+ *
+ * The node holds the revision: `accepted`, `replay` or `historical` is what the node answered to
+ * the push, and `acknowledged` a revision the node's current session acknowledged before, answered
+ * from that acknowledgement without pushing it again.
+ *
+ * The node does not hold it from this dispatch: `node-busy` while the node already carries its limit
+ * of pushes in flight, `node-not-connected` while no live peer holds a session for the node,
+ * `session-moved` when the session the dispatch began on is no longer the node's current one,
+ * `intent-not-current` when the revision is no longer the one the controller wants on that node,
+ * `request-unbound` when the request does not bind to the session it would travel on,
+ * `node-refused` when the node (or the relay carrying it) answered the push with a refusal,
+ * `push-failed` when the push got no answer in time or its carrier failed, and
+ * `acknowledgement-unbound` when the answer names another revision.
+ */
+export const assignmentDispatchReasons = [
+    'accepted', 'replay', 'historical', 'acknowledged',
+    'node-busy', 'node-not-connected', 'session-moved', 'intent-not-current', 'request-unbound', 'node-refused',
+    'push-failed', 'acknowledgement-unbound',
 ];
 /** Sorted, duplicate-free and read by the vocabulary the ids belong to: a node's, or the canonical one. */
 const sortedIds = (value, maximum, read) => networkSorted(networkList(value, maximum, read), id => id);
@@ -86,6 +107,27 @@ export const snapshotServiceRuntimeSpec = (value) => producerSafe(() => {
         placement: placementOf(item.placement), replicasPerNode: item.replicasPerNode, hold: item.hold,
         profile: profileOf(item.profile), network: networkOf(item.network), revision: networkCounter(item.revision) };
 });
+/**
+ * Whether a spec's readiness probe can reach its workload: false exactly for an `isolated` network
+ * with a `tcp` or `http` probe, which the producer answers as `readiness-network-unsupported`. The
+ * spec is read through `snapshotServiceRuntimeSpec`, so a value that is no spec is refused with its
+ * rejection rather than judged.
+ */
+export const isServiceRuntimeReadinessReachable = (value) => {
+    const { profile, network } = snapshotServiceRuntimeSpec(value);
+    return network.mode === 'attached' || profile.readiness.kind === 'process';
+};
+/** Exactly a recorded dispatch of an assignment: a known reason and a positive Unix millisecond time. */
+export const isServiceRuntimeAssignmentDispatch = (value) => {
+    try {
+        const item = networkRecord(captureNetwork(value), ['delivered', 'reason', 'at']);
+        networkCounter(item.at);
+        return typeof item.delivered === 'boolean' && isOneOf(assignmentDispatchReasons, item.reason);
+    }
+    catch {
+        return false;
+    }
+};
 /** Structural snapshot for exact persistence: a reason belongs to exactly one state. */
 export const snapshotServiceRuntimeStatus = (value) => producerSafe(() => {
     const item = networkRecord(captureNetwork(value), ['id', 'specRevision', 'state', 'reason', 'changedAt']);
@@ -102,4 +144,4 @@ export const snapshotServiceRuntimeStatus = (value) => producerSafe(() => {
     requireNetwork(item.state === 'refused' && isOneOf(serviceRuntimeRefusals, item.reason));
     return { ...base, state: item.state, reason: item.reason };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF5RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRztJQUNuQyxzQkFBc0IsRUFBRSxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsd0JBQXdCLEVBQUUsa0JBQWtCO0lBQ25HLHlCQUF5QixFQUFFLGlDQUFpQztDQUNwRCxDQUFDO0FBQ1gsTUFBTSxzQkFBc0IsR0FBRztJQUM3Qix5QkFBeUIsRUFBRSxzQkFBc0IsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0I7SUFDL0YscUJBQXFCLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsZ0JBQWdCO0lBQzNGLDZCQUE2QixFQUFFLHVCQUF1QixFQUFFLGtCQUFrQixFQUFFLGVBQWU7SUFDM0YsNEJBQTRCLEVBQUUsd0JBQXdCLEVBQUUseUJBQXlCO0lBQ2pGLCtCQUErQixFQUFFLGlDQUFpQztJQUNsRSwyQkFBMkIsRUFBRSw0QkFBNEIsRUFBRSwyQkFBMkI7SUFDdEYsOEJBQThCLEVBQUUsK0JBQStCLEVBQUUsMEJBQTBCO0lBQzNGLGdDQUFnQyxFQUFFLCtCQUErQixFQUFFLG9DQUFvQztJQUN2RyxtQ0FBbUMsRUFBRSwyQkFBMkIsRUFBRSw4QkFBOEI7SUFDaEcseUJBQXlCLEVBQUUseUNBQXlDO0NBQzVELENBQUM7QUE4R1gsMkdBQTJHO0FBQzNHLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFFLE9BQWUsRUFBRSxJQUErQixFQUFZLEVBQUUsQ0FDL0YsYUFBYSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7QUFFN0QsTUFBTSxXQUFXLEdBQUcsQ0FBQyxLQUFjLEVBQTRCLEVBQUU7SUFDL0QsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0QyxJQUFJLElBQUksS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUMxQixhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLEtBQUssT0FBTyxDQUFDLENBQUM7SUFDakMsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxPQUFPLEVBQUUsc0JBQXNCLENBQUMsa0JBQWtCLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDdkksY0FBYyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbkMsT0FBTyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUMzQixDQUFDLENBQUM7QUFFRixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRTtJQUNsRSxJQUFJLEtBQUssS0FBSyxJQUFJO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDaEMsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3JELGNBQWMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksdUJBQXVCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUYsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUU7SUFDM0QsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLFdBQVcsRUFBRSxhQUFhLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ2hILGNBQWMsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksb0JBQW9CLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQztXQUN0RixrQkFBa0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksT0FBTyxJQUFJLENBQUMsY0FBYyxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ2hGLDRHQUE0RztJQUM1RyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLENBQUMsQ0FBQztJQUNqRSxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQztJQUMxRSxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLEVBQUUsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXO1FBQy9ELFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBNEI7UUFDbEYsSUFBSSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLEVBQUUsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUNySSxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBMEIsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3hCLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9CLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksS0FBSyxVQUFVLENBQUMsQ0FBQztJQUNwQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLGNBQWMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7SUFDbkYsY0FBYyxDQUFDLE9BQU8sSUFBSSxDQUFDLFlBQVksS0FBSyxTQUFTLENBQUMsQ0FBQztJQUN2RCxPQUFPLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtRQUM1QyxtQkFBbUIsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLHNCQUFzQixDQUFDLHdCQUF3QixFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDM0gsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxLQUFjLEVBQXVCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ25HLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFdBQVc7UUFDakcsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNoRSxjQUFjLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDLEVBQUUsc0JBQXNCLENBQUMsc0JBQXNCLENBQUM7V0FDbEcsT0FBTyxJQUFJLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3JDLE9BQU8sRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxjQUFjLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDbkgsU0FBUyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsZUFBZSxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQzlGLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFFBQVEsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7QUFDbEgsQ0FBQyxDQUFDLENBQUM7QUFFSCx3RkFBd0Y7QUFDeEYsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxLQUFjLEVBQXlCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ3ZHLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsY0FBYyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMxRyxNQUFNLElBQUksR0FBOEIsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxZQUFZLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7UUFDL0csU0FBUyxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM5QyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssV0FBVyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDOUQsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDckMsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzdCLGNBQWMsQ0FBQyxPQUFPLENBQUMsNEJBQTRCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDbkUsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDN0QsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDekYsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDN0QsQ0FBQyxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF5RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRztJQUNuQyxzQkFBc0IsRUFBRSxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsd0JBQXdCLEVBQUUsa0JBQWtCO0lBQ25HLHlCQUF5QixFQUFFLGlDQUFpQztDQUNwRCxDQUFDO0FBQ1gsTUFBTSxzQkFBc0IsR0FBRztJQUM3Qix5QkFBeUIsRUFBRSxzQkFBc0IsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0I7SUFDL0YscUJBQXFCLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsZ0JBQWdCO0lBQzNGLDZCQUE2QixFQUFFLHVCQUF1QixFQUFFLGtCQUFrQixFQUFFLGVBQWU7SUFDM0YsNEJBQTRCLEVBQUUsd0JBQXdCLEVBQUUseUJBQXlCO0lBQ2pGLCtCQUErQixFQUFFLGlDQUFpQztJQUNsRSwyQkFBMkIsRUFBRSw0QkFBNEIsRUFBRSwyQkFBMkI7SUFDdEYsOEJBQThCLEVBQUUsK0JBQStCLEVBQUUsMEJBQTBCO0lBQzNGLGdDQUFnQyxFQUFFLCtCQUErQixFQUFFLG9DQUFvQztJQUN2RyxtQ0FBbUMsRUFBRSwyQkFBMkIsRUFBRSw4QkFBOEI7SUFDaEcseUJBQXlCLEVBQUUseUNBQXlDLEVBQUUsK0JBQStCO0NBQzdGLENBQUM7QUFtR1g7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUc7SUFDdkMsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsY0FBYztJQUNsRCxXQUFXLEVBQUUsb0JBQW9CLEVBQUUsZUFBZSxFQUFFLG9CQUFvQixFQUFFLGlCQUFpQixFQUFFLGNBQWM7SUFDM0csYUFBYSxFQUFFLHlCQUF5QjtDQUNoQyxDQUFDO0FBb0NYLDJHQUEyRztBQUMzRyxNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFlLEVBQUUsSUFBK0IsRUFBWSxFQUFFLENBQy9GLGFBQWEsQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBRTdELE1BQU0sV0FBVyxHQUFHLENBQUMsS0FBYyxFQUE0QixFQUFFO0lBQy9ELE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdEMsSUFBSSxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDMUIsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDL0IsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sT0FBTyxHQUFHLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsT0FBTyxFQUFFLHNCQUFzQixDQUFDLGtCQUFrQixFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQ3ZJLGNBQWMsQ0FBQyxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ25DLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUM7QUFDM0IsQ0FBQyxDQUFDO0FBRUYsTUFBTSxPQUFPLEdBQUcsQ0FBQyxLQUFjLEVBQW1DLEVBQUU7SUFDbEUsSUFBSSxLQUFLLEtBQUssSUFBSTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ2hDLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNyRCxjQUFjLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzFGLE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO0FBQ2hELENBQUMsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUEwQixFQUFFO0lBQzNELE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxXQUFXLEVBQUUsYUFBYSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNoSCxjQUFjLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLG9CQUFvQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUM7V0FDdEYsa0JBQWtCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLE9BQU8sSUFBSSxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNoRiw0R0FBNEc7SUFDNUcsc0JBQXNCLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDakUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLG9CQUFvQixFQUFFLFdBQVcsRUFBRSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUM7SUFDMUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztRQUMvRCxTQUFTLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQTRCO1FBQ2xGLElBQUksRUFBRSxFQUFFLGdCQUFnQixFQUFFLG9CQUFvQixFQUFFLFdBQVcsRUFBRSxFQUFFLGNBQWMsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDckksQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUU7SUFDM0QsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0QyxJQUFJLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUN4QixhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLEtBQUssVUFBVSxDQUFDLENBQUM7SUFDcEMsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxjQUFjLEVBQUUscUJBQXFCLENBQUMsQ0FBQyxDQUFDO0lBQ25GLGNBQWMsQ0FBQyxPQUFPLElBQUksQ0FBQyxZQUFZLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDdkQsT0FBTyxFQUFFLElBQUksRUFBRSxZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7UUFDNUMsbUJBQW1CLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxzQkFBc0IsQ0FBQyx3QkFBd0IsRUFBRSxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQzNILENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLENBQUMsS0FBYyxFQUF1QixFQUFFLENBQUMsWUFBWSxDQUFDLEdBQUcsRUFBRTtJQUNuRyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLGdCQUFnQixFQUFFLFdBQVcsRUFBRSxXQUFXO1FBQ2pHLGlCQUFpQixFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDaEUsY0FBYyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQyxFQUFFLHNCQUFzQixDQUFDLHNCQUFzQixDQUFDO1dBQ2xHLE9BQU8sSUFBSSxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNyQyxPQUFPLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsY0FBYyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ25ILFNBQVMsRUFBRSxXQUFXLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtRQUM5RixPQUFPLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO0FBQ2xILENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLEtBQWMsRUFBVyxFQUFFO0lBQzVFLE1BQU0sRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsMEJBQTBCLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDL0QsT0FBTyxPQUFPLENBQUMsSUFBSSxLQUFLLFVBQVUsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUM7QUFDN0UsQ0FBQyxDQUFDO0FBRUYseUdBQXlHO0FBQ3pHLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQUMsS0FBYyxFQUE4QyxFQUFFO0lBQy9HLElBQUksQ0FBQztRQUNILE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxXQUFXLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDakYsY0FBYyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4QixPQUFPLE9BQU8sSUFBSSxDQUFDLFNBQVMsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLHlCQUF5QixFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNoRyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsS0FBYyxFQUF5QixFQUFFLENBQUMsWUFBWSxDQUFDLEdBQUcsRUFBRTtJQUN2RyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLGNBQWMsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDMUcsTUFBTSxJQUFJLEdBQThCLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsWUFBWSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQy9HLFNBQVMsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7SUFDOUMsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFdBQVcsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQzlELGNBQWMsQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDO1FBQ3JDLE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDdEQsQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM3QixjQUFjLENBQUMsT0FBTyxDQUFDLDRCQUE0QixFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ25FLE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQzdELENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxDQUFDLEtBQUssS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLHNCQUFzQixFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3pGLE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0FBQzdELENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/network.d.ts

@@ -4,6 +4,7 @@ import type { IRuntimeNetworkAddressPlan, TRuntimeNetworkAddressPlanWritableData
 import type { IRuntimeNetworkNodeReadiness, IRuntimeRouterIncarnation } from '../data/networknode.js';
 import type { IPrivateNetwork, IServicePrivateNetworks, ISetServicePrivateNetworks, TPrivateNetworkMutation } from '../data/privatenetwork.js';
 import type { IServiceNetworkEgress, IServicePublishedPorts, ISetServiceNetworkEgress, ISetServicePublishedPorts } from '../data/networkprojection.js';
+import type { IServicePlatformOwnership } from '../data/serviceplatformownership.js';
 /** Current organization picker data. Entries are never cached authorization grants. */
 export interface IReq_Cloudly_ListOwnedOrganizations extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListOwnedOrganizations> {
     method: 'listOwnedOrganizations';
@@ -97,7 +98,14 @@ export interface IReq_Cloudly_SetServicePrivateNetworks extends plugins.typedreq
         replayed: boolean;
     };
 }
-/** null means the service has never had a policy document, neither published ports nor egress. */
+/**
+ * null means the service has never had a policy document, neither published ports nor egress.
+ *
+ * The authority follows the service (`IServicePlatformOwnership`): a platform-owned service is read
+ * by a verified administrator, every other service by a federated sign-in holding the named
+ * organization's freshly introspected `owner` role. A caller without that authority, or naming no
+ * such service, is answered one denial text, whichever it is.
+ */
 export interface IReq_Cloudly_GetServicePublishedPorts extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_GetServicePublishedPorts> {
     method: 'getServicePublishedPorts';
     request: {
@@ -119,6 +127,15 @@ export interface IReq_Cloudly_GetServicePublishedPorts extends plugins.typedrequ
  * attached spec stating `publicEgress: false` and `platformEndpointIds: []` matches it and reaches
  * no public address and no platform endpoint; `network-policy-missing` means the service has no
  * document at all.
+ *
+ * The authority follows the service (`IServicePlatformOwnership`): a platform-owned service is
+ * written by a verified administrator, every other service by a federated sign-in holding the named
+ * organization's freshly introspected `owner` role, and an administrator does not substitute for
+ * that owner. A caller without that authority, or naming no such service, is answered one denial
+ * text, whichever it is. A designation that changes while the write is staged refuses it as the
+ * policy write's own `conflict`, the refusal a stale `expectedRevision` is also answered (read the
+ * document and the authority again); it is a service network policy refusal, not one of
+ * `servicePlatformOwnershipRefusals`.
  */
 export interface IReq_Cloudly_SetServicePublishedPorts extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_SetServicePublishedPorts> {
     method: 'setServicePublishedPorts';
@@ -183,6 +200,64 @@ export interface IReq_Admin_Cloudly_SetServiceNetworkEgress extends plugins.type
         replayed: boolean;
     };
 }
+/**
+ * Designates one service platform-owned (`IServicePlatformOwnership`), so that a verified
+ * administrator, and no organization owner, holds the authority over its published ports.
+ *
+ * Only a verified administrator calls it. Cloudly designates only a service of a platform
+ * organization (`isPlatformOrganizationId`: a canonical identifier carrying `:`, such as
+ * `legacy:Service:<id>` or `Organization:<id>`) and refuses every other organization id, an
+ * idp.global one or one that is no canonical identifier, as `organization-not-platform` before it
+ * reads the service. It refuses a service that is not the named organization's (`service-unknown`)
+ * and a deleting one (`service-deleting`); refusals are `servicePlatformOwnershipRefusals`. A
+ * service already designated answers its stored designation unchanged with `changed: false`.
+ */
+export interface IReq_Admin_Cloudly_DesignatePlatformOwnedService extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_DesignatePlatformOwnedService> {
+    method: 'designatePlatformOwnedService';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: IServicePlatformOwnership;
+        changed: boolean;
+    };
+}
+/**
+ * Withdraws a service's platform-owned designation; its published ports stay as they are, and from
+ * then on the organization-owner rule governs them. A designated service is always a platform
+ * organization's, which has no idp.global owner, so after the withdrawal nobody writes or reads its
+ * published ports until an administrator designates it again: the authority fails closed.
+ *
+ * Only a verified administrator calls it. Refusals are `service-unknown` and `conflict`; a service
+ * without a designation answers `changed: false`.
+ */
+export interface IReq_Admin_Cloudly_UndesignatePlatformOwnedService extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_UndesignatePlatformOwnedService> {
+    method: 'undesignatePlatformOwnedService';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: null;
+        changed: boolean;
+    };
+}
+/** The service's platform-owned designation, or null when it has none. Only a verified administrator reads it. */
+export interface IReq_Admin_Cloudly_GetServicePlatformOwnership extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_GetServicePlatformOwnership> {
+    method: 'getServicePlatformOwnership';
+    /** Refused `service-unknown` when no service of that id belongs to the named organization. */
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: IServicePlatformOwnership | null;
+    };
+}
 export interface IRequest_Any_Cloudly_GetNetworkNodes {
     method: 'getNetworkNodes';
     request: {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.43.0",
+  "version": "32.45.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -27,11 +27,11 @@
     "@tsclass/tsclass": "^9.5.1"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^5.1.1",
-    "@git.zone/tsdoc": "^3.0.1",
+    "@git.zone/tsbuild": "^5.1.2",
+    "@git.zone/tsdoc": "^3.0.2",
     "@git.zone/tsrun": "^3.0.2",
-    "@git.zone/tstest": "6.3.4",
-    "@types/node": "26.6.2"
+    "@git.zone/tstest": "^7.1.0",
+    "@types/node": "26.6.3"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -409,7 +409,17 @@ authorities and their digests are validated, and either that does not validate i
 protection journal separately from projection admission. It binds a complete
 protected-authority reference, node/controller scope, authenticated reporter,
 boot identity and exact native journal reference to a monotonic receipt chain.
-A null `nativeBarrier` explicitly removes allocation eligibility. A boot or
+A null `nativeBarrier` explicitly removes allocation eligibility. A node sends one
+only in answer to the `retirement` request of a signed projection (see
+[Projection Retirement Requests](#projection-retirement-requests)): its egress
+ownership is being retired with the `withdrawn` disposition, and it mints no
+positive receipt for the chain afterwards
+(`runtimeNetworkProtectionContract.withdrawal`). Nothing else withdraws. The
+node's allocation-pool guard is retained in the kernel when the node process
+ends, and its boot unit restores it before networking starts, so a clean stop, a
+crash, a reboot or being offline leaves the last receipt current. A reconnect
+binds a new reporter session, which the old receipt no longer matches, and the
+node's first positive receipt under that session restores eligibility. A boot or
 protection change requires new native journal evidence. These portable values
 do not inspect a kernel or authenticate their own producer.
 
@@ -505,6 +515,34 @@ list is a valid policy meaning the service publishes nothing. Callers never supp
 from the accepted policy revision and digest, and node-level host-port placement
 stays Cloudly's decision.
 
+Who authors a service's published ports follows the service. A service of an
+idp.global organization is that organization's: only a federated sign-in holding
+its freshly introspected `owner` role reads and writes them, and an
+infrastructure administrator does not substitute for it. A platform-owned
+service (`data.IServicePlatformOwnership`: `organizationId`, `serviceId`, the
+designating administrator's `actorId`, `designatedAt`) belongs to no idp.global
+organization, such as the cluster ingress or a platform call router; only a
+verified administrator reads and writes its published ports, as only an
+administrator writes its egress. An administrator designates such a service
+with `designatePlatformOwnedService`, withdraws it with
+`undesignatePlatformOwnedService` and reads it with `getServicePlatformOwnership`
+(`requests.network.IReq_Admin_Cloudly_DesignatePlatformOwnedService`,
+`IReq_Admin_Cloudly_UndesignatePlatformOwnedService`,
+`IReq_Admin_Cloudly_GetServicePlatformOwnership`). Only a platform
+organization's service is designated: `data.isPlatformOrganizationId` is true
+exactly for a canonical identifier that carries `:` (`legacy:Service:<id>`,
+`Organization:<id>`), and false for an idp.global nanoid, whichever character it
+starts with, and for any value that is not a canonical identifier, such as an
+empty or whitespace id. Cloudly refuses every other id as
+`organization-not-platform`, and further designation refusals are
+`service-unknown`, `service-deleting` and `conflict`
+(`data.servicePlatformOwnershipRefusals`). The designation grants no port, egress
+or placement by itself. Withdrawing it leaves the service's published ports as
+they are with no writer, because a platform organization has no idp.global
+owner, until an administrator designates the service again. A published-port
+write staged while the designation changes is refused as the policy write's
+`conflict`.
+
 A published entry with `hostPortEnd` publishes every port from `hostPort` to
 `hostPortEnd` inclusive, each to the same port inside the workload, so its
 `targetPort` equals `hostPort` and a one-port range is written without the member.
@@ -682,6 +720,59 @@ reaches only the endpoints it selects. The platform endpoint contract itself
 (`{ id, address, protocol, port }`) names no node, which is why this statement is
 per projection.
 
+#### Projection Retirement Requests
+
+The optional `IRuntimeNetworkProjection.retirement`
+(`IRuntimeNetworkProjectionRetirement { disposition: 'withdrawn', protectedAuthority }`)
+is Cloudly's request that a running node withdraw its allocation protection,
+because its egress ownership is being retired with the `withdrawn` disposition.
+It travels in the projection because that is the one authenticated, monotonic
+channel the node already admits, journals and reads on every pass, and whose
+acknowledged head Cloudly already tracks: the controller's signature covers it, so
+a node cannot invent it; the projection chain is bound to the controller epoch,
+node and runtime namespace, so it cannot be carried elsewhere; and a node's
+acknowledged head proves the node admitted it. A retired node never returns
+(`runtimeNetworkEgressRetirementContract.reentry`), so no later chain of the same
+node can meet a stale request.
+
+`protectedAuthority` is the authority current when Cloudly first signed the
+request; its `id` names the receipt chain's authority chain.
+`validateRuntimeNetworkProjection` accepts it only on a `cloudly` projection and
+only naming the projection's own authority chain at a generation the projection
+has reached (the current authority itself at the same generation).
+`admitRuntimeNetworkProjection` latches it: it may first appear on any projection,
+including the first, and that first appearance names exactly the projection's
+current `protectedAuthority` (an older generation is refused, because the node's
+positive receipt under the current authority would then be newer than the request
+and the withdrawal could never complete). Afterwards every successor carries it
+unchanged, never dropped and never rewritten, so it stays fixed while the
+authority chain moves on. Omitted, it keeps the canonical bytes and asks for
+nothing; it grants and withdraws no packet flow. Consumers on interfaces earlier
+than 32.44.0 read projections with exact keys and refuse one that carries
+`retirement`, so Cloudly sends the request only to nodes that report a compatible
+interfaces version.
+`snapshotRuntimeNetworkProjectionRetirement` is the exact-key reader and
+`runtimeNetworkProjectionRetirementContract` states the rules.
+
+The node answers with the null-barrier successor of its protection receipt chain
+and mints no positive receipt for that chain again. Its allocation-pool guard
+stays enforced: the answer withdraws eligibility, not protection.
+
+`bindRuntimeNetworkProtectionReceiptRetirement(receipt, previous, retirement)` is
+the receiver's gate for every report from a node whose projections carry the
+request, beside `admitRuntimeNetworkProtectionReceipt` with the same `previous`
+(the receiver's current receipt for the node, or null). The receipt must belong to
+the retiring authority chain and `previous`, when given, must be the same chain's
+exact predecessor or the receipt itself. The null answer always passes. A positive
+receipt passes only while it can predate the node's admission of the request, so a
+receipt the node minted before it saw the request still drains from its outbox
+and the withdrawal behind it is never wedged: it names no authority newer than the
+request's (a newer one could only come from a projection already carrying the
+request), and its predecessor is not a null withdrawal (once the receiver holds
+the answer, no positive receipt follows). A positive receipt minted after the
+request against the same authority cannot be told apart from one minted before;
+the node's obligation is never to mint one.
+
 `admitRuntimeNetworkProjection` checks exact predecessor/replay identity and
 rejects changed same-generation content, regressed membership/readiness evidence,
 changed immutable address/DNS keys, and omitted packet grants without explicit
@@ -803,7 +894,8 @@ exact protected authority the owner is about to leave, once all five hold:
    its own fence. Every other remaining owner has exactly one entry.
 
 `lastReceipt` is the node's last accepted protection receipt. A `withdrawn` node
-took part in its own retirement, so it always has one (its null withdrawal); a
+took part in its own retirement, so it always has one (its null withdrawal, the
+answer to its projection's `retirement` request); a
 `lost` node may have none. Neither disposition shortens the fence: a lost node
 leaves behind exactly the same controller-owned evidence as a withdrawn one.
 `snapshotRuntimeNetworkEgressRetirement` is the exact-key reader and
@@ -1927,8 +2019,10 @@ document. `snapshotNodeRuntimeRetirement` checks the record.
 
 `TNodeRuntimeRetirementDisposition` (`nodeRuntimeRetirementDispositions`,
 `snapshotNodeRuntimeRetirementDisposition`) says how the node leaves. `withdrawn`: the node still
-runs and takes part — its slots are removed against its own removal receipts and its Pallet
-withdraws its protection receipt before its credentials are revoked. `lost`: an administrator
+runs and takes part — its slots are removed against its own removal receipts, Cloudly asks it
+through its projection's `retirement` request (see
+[Projection Retirement Requests](#projection-retirement-requests)), and its Pallet answers by
+withdrawing its protection receipt before its credentials are revoked. `lost`: an administrator
 states the node will never report again, which authorizes abandoning its slots without removal
 receipts and nothing else; its egress fence is the same as a withdrawn node's.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.43.0',
+  version: '32.45.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -49,6 +49,8 @@ export { runtimeNetworkHostContract } from './networkhost.js';
 export type { IRuntimeNetworkWorkloadIngress, IRuntimeNetworkWorkloadIngressPacketGrant,
   IRuntimeNetworkWorkloadIngressProjection } from './networkworkloadingress.js';
 export { runtimeNetworkWorkloadIngressContract } from './networkworkloadingress.js';
+export type { IRuntimeNetworkProjectionRetirement } from './networkprojectionretirement.js';
+export { runtimeNetworkProjectionRetirementContract, snapshotRuntimeNetworkProjectionRetirement } from './networkprojectionretirement.js';
 export * from './networkprotection.js';
 export * from './networksigning.js';
 export * from './privatenetwork.js';
@@ -74,6 +76,7 @@ export * from './sparklegacyretirement.js';
 export * from './sparknodereport.js';
 export * from './service.js';
 export * from './servicecredential.js';
+export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
 export * from './servicevolumeinitialization.js';

package/ts/data/networkegressretirement.ts

@@ -44,7 +44,8 @@ export interface IRuntimeNetworkEgressRetirementClearance extends IRuntimeNetwor
  *    so it can never clear another owner's endpoints, and it leaves behind its own fence.
  *
  * `lastReceipt` is the node's last accepted protection receipt. A `withdrawn` node took part in its
- * retirement, so it always has one — its null withdrawal; a `lost` node may never have reported.
+ * retirement, so it always has one — its null withdrawal, the answer to its projection's
+ * `retirement` request; a `lost` node may never have reported.
  *
  * A structural snapshot and digest do not authenticate any of it: the controller must fence the
  * rows it read together with the authority it stages.

package/ts/data/networkprojection.ts

@@ -11,6 +11,8 @@ import { hostPacketGrantsOf, snapshotHostProjection,
   type IRuntimeNetworkHostPacketGrant, type IRuntimeNetworkHostProjection } from './networkhost.js';
 import { snapshotWorkloadIngressProjection, workloadIngressPacketGrantsOf,
   type IRuntimeNetworkWorkloadIngressPacketGrant, type IRuntimeNetworkWorkloadIngressProjection } from './networkworkloadingress.js';
+import { requireFirstProjectionRetirement, requireProjectionRetirement, snapshotRuntimeNetworkProjectionRetirement,
+  type IRuntimeNetworkProjectionRetirement } from './networkprojectionretirement.js';
 import { buildPrivateNetworkFqdn, composeServicePrivateNetworkDnsPolicy,
   snapshotPrivateNetwork, snapshotServicePrivateNetworks } from './privatenetwork.js';
 import { captureNetwork, failNetwork, networkCanonical, networkContains, networkCounter, networkDigest,
@@ -299,6 +301,15 @@ export interface IRuntimeNetworkProjection extends IRuntimeNetworkNodeScope {
    * It grants nothing: a workload still reaches only the endpoints it selects.
    */
   hostPlatformEndpointIds?: string[];
+  /**
+   * Present once Cloudly retires this node's egress ownership with the `withdrawn` disposition:
+   * the node withdraws its allocation protection with the null-barrier successor of its receipt
+   * chain and mints no positive receipt for it again (`IRuntimeNetworkProjectionRetirement`). Only
+   * a `cloudly` projection may carry it; it first appears naming exactly the projection's current
+   * `protectedAuthority`, and every successor carries it unchanged. Omitted, it keeps the canonical
+   * bytes and asks for nothing.
+   */
+  retirement?: IRuntimeNetworkProjectionRetirement;
   digest: TSha256Digest;
 }
 
@@ -566,10 +577,11 @@ export const snapshotRuntimeNetworkProjection = (value: unknown): IRuntimeNetwor
   const hasWorkloadIngress = captured !== null && typeof captured === 'object' && Object.hasOwn(captured, 'workloadIngress');
   const hasHostPlatformEndpoints = captured !== null && typeof captured === 'object'
     && Object.hasOwn(captured, 'hostPlatformEndpointIds');
+  const hasRetirement = captured !== null && typeof captured === 'object' && Object.hasOwn(captured, 'retirement');
   const item = networkRecord(captured, ['id', 'generation', 'previous', 'controller', 'nodeId', 'runtimeNamespace',
     'protectedAuthority', 'allocationAuthorities', 'handoff', 'networks', 'memberships', 'endpoints', 'dns', 'withdrawals', 'retiredLeases', 'retiredHandoffs', 'digest',
     ...(hasRouter ? ['router'] : []), ...(hasHost ? ['host'] : []), ...(hasWorkloadIngress ? ['workloadIngress'] : []),
-    ...(hasHostPlatformEndpoints ? ['hostPlatformEndpointIds'] : [])]);
+    ...(hasHostPlatformEndpoints ? ['hostPlatformEndpointIds'] : []), ...(hasRetirement ? ['retirement'] : [])]);
   const hostPlatformEndpointIds = hasHostPlatformEndpoints
     ? networkSorted(networkList(item.hostPlatformEndpointIds, 64, networkId), value => value) : [];
   requireNetwork(!hasHostPlatformEndpoints || hostPlatformEndpointIds.length > 0);
@@ -585,6 +597,7 @@ export const snapshotRuntimeNetworkProjection = (value: unknown): IRuntimeNetwor
     ...(hasHost ? { host: snapshotHostProjection(item.host) } : {}),
     ...(hasWorkloadIngress ? { workloadIngress: snapshotWorkloadIngressProjection(item.workloadIngress) } : {}),
     ...(hasHostPlatformEndpoints ? { hostPlatformEndpointIds } : {}),
+    ...(hasRetirement ? { retirement: snapshotRuntimeNetworkProjectionRetirement(item.retirement) } : {}),
     retiredLeases: sortedReferences(item.retiredLeases), retiredHandoffs: sortedReferences(item.retiredHandoffs), digest: networkDigest(item.digest) };
 });
 
@@ -690,6 +703,7 @@ export const validateRuntimeNetworkProjection = async (value: unknown): Promise<
       requireNetwork(previous.node !== current.node || previous.last < current.first);
     }
     for (const id of projection.hostPlatformEndpointIds ?? []) requireNetwork(current.platformEndpoints.some(platform => platform.id === id));
+    if (projection.retirement) requireProjectionRetirement(projection.retirement, projection.controller.kind, current);
     for (let index = 0; index < projection.endpoints.length; index++) for (let previous = 0; previous < index; previous++) {
       requireNetwork(!networkOverlaps(projection.endpoints[index].lease.ipv4.linkSubnet, projection.endpoints[previous].lease.ipv4.linkSubnet));
     }
@@ -792,6 +806,7 @@ export const admitRuntimeNetworkProjection = async (
         && (projection.router?.withdrawals.length ?? 0) === 0 && (projection.host?.withdrawals.length ?? 0) === 0
         && (projection.workloadIngress?.withdrawals.length ?? 0) === 0
         && projection.retiredLeases.length === 0 && projection.retiredHandoffs.length === 0);
+      if (projection.retirement) requireFirstProjectionRetirement(projection.retirement, projection.protectedAuthority);
       return { status: 'accepted', projection };
     }
     const previous = await validateRuntimeNetworkProjection(previousInput);
@@ -881,6 +896,10 @@ export const admitRuntimeNetworkProjection = async (
     }
     if (previous.handoff && !networkEqual(previous.handoff, projection.handoff)) requireNetwork(projection.retiredHandoffs.some(item =>
       networkEqual(item, networkReferenceOf(previous.handoff!))));
+    // A retirement request first names the current authority, then is never taken back or
+    // rewritten: every successor carries it unchanged.
+    if (previous.retirement) requireNetwork(networkEqual(projection.retirement ?? null, previous.retirement));
+    else if (projection.retirement) requireFirstProjectionRetirement(projection.retirement, projection.protectedAuthority);
     const protection = projection.protectedAuthority, oldProtection = previous.protectedAuthority;
     requireNetwork(networkEqual(protection, oldProtection) || (protection.id === oldProtection.id
       && networkEqual(protection.previous, networkReferenceOf(oldProtection))));

package/ts/data/networkprojectionretirement.ts

@@ -0,0 +1,72 @@
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import { captureNetwork, networkEqual, networkRecord, networkReference, networkReferenceOf, networkSafe,
+  requireNetwork } from '../private/networkcontract.js';
+
+/**
+ * Cloudly's request that a running node withdraw its allocation protection, because its egress
+ * ownership is being retired with the `withdrawn` disposition (`INodeRuntimeRetirement`).
+ *
+ * It travels as `IRuntimeNetworkProjection.retirement`: the one authenticated, monotonic channel a
+ * node already admits and journals on every pass. The controller's signature covers it, so a node
+ * cannot invent it; the projection chain is bound to the controller epoch, node and runtime
+ * namespace, so it cannot be carried to another node or controller; and once a projection carries
+ * it, every successor carries it unchanged, so it is never taken back. A retired node never
+ * returns (`runtimeNetworkEgressRetirementContract.reentry`): no later chain of the same node can
+ * meet a stale signal.
+ *
+ * The node answers with the null-barrier successor of its protection receipt chain
+ * (`IRuntimeNetworkProtectionReceipt.nativeBarrier: null`) and mints no positive receipt for that
+ * chain again. Its native allocation-pool guard stays enforced; the answer withdraws eligibility,
+ * not protection. Nothing else withdraws: a clean stop, a crash, a reboot or being offline keeps the
+ * node's last receipt current.
+ */
+export interface IRuntimeNetworkProjectionRetirement {
+  /** The retirement row's disposition. A `lost` node never reports again, so it is never asked. */
+  disposition: 'withdrawn';
+  /**
+   * The protected authority current when Cloudly first signed the request: the projection that
+   * first carries it names exactly its own `protectedAuthority`. Its `id` names the authority chain
+   * the node's receipts belong to; the value then stays fixed while later projections carry a newer
+   * authority of the same chain, never an older one.
+   */
+  protectedAuthority: IRuntimeAuthorityReference;
+}
+
+export const runtimeNetworkProjectionRetirementContract = Object.freeze({
+  controllerKind: 'cloudly',
+  disposition: 'withdrawn',
+  firstAppearance: 'names-the-current-protected-authority',
+  latch: 'every-successor-carries-it-unchanged',
+  answer: 'null-native-barrier-receipt-successor',
+  positive: 'never-again-for-the-retiring-receipt-chain',
+} as const);
+
+/** Exact-key structural snapshot, detached from its input. */
+export const snapshotRuntimeNetworkProjectionRetirement = (value: unknown): IRuntimeNetworkProjectionRetirement => networkSafe(() => {
+  const item = networkRecord(captureNetwork(value), ['disposition', 'protectedAuthority']);
+  requireNetwork(item.disposition === runtimeNetworkProjectionRetirementContract.disposition);
+  return { disposition: item.disposition, protectedAuthority: networkReference(item.protectedAuthority) };
+});
+
+/**
+ * The request belongs to a `cloudly` projection and names the projection's own authority chain at
+ * a generation the projection has reached: the current authority itself, or one of its predecessors.
+ */
+export const requireProjectionRetirement = (
+  retirement: IRuntimeNetworkProjectionRetirement, controllerKind: string, current: IRuntimeNetworkProtectedAuthority,
+): void => {
+  const named = retirement.protectedAuthority;
+  requireNetwork(controllerKind === runtimeNetworkProjectionRetirementContract.controllerKind
+    && named.id === current.id && named.generation <= current.generation);
+  if (named.generation === current.generation) requireNetwork(networkEqual(named, networkReferenceOf(current)));
+};
+
+/**
+ * The request's first appearance names exactly the projection's current authority. An older
+ * generation would make the node's positive receipt under the current authority newer than the
+ * request, so the receipt gate refuses it and the withdrawal could never complete.
+ */
+export const requireFirstProjectionRetirement = (
+  retirement: IRuntimeNetworkProjectionRetirement, current: IRuntimeNetworkProtectedAuthority,
+): void => requireNetwork(networkEqual(retirement.protectedAuthority, networkReferenceOf(current)));