@serve.zone/interfaces 27.4.0 → 28.0.0

package/.smartconfig.json

@@ -20,10 +20,16 @@
       ]
     },
     "release": {
+      "preflight": {
+        "test": true,
+        "build": true
+      },
       "targets": {
         "git": {
           "enabled": true,
-          "remote": "origin"
+          "remote": "origin",
+          "pushBranch": true,
+          "pushTags": true
         },
         "npm": {
           "enabled": true,
@@ -31,7 +37,8 @@
             "https://verdaccio.lossless.digital",
             "https://registry.npmjs.org"
           ],
-          "accessLevel": "public"
+          "accessLevel": "public",
+          "alreadyPublished": "success"
         },
         "docker": {
           "enabled": false,
@@ -41,7 +48,7 @@
     }
   },
   "@git.zone/tsdoc": {
-    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license.md](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
   },
   "@ship.zone/szci": {}
-}
+}

package/changelog.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 2026-09-05 - 28.0.0
+
+### Breaking Changes
+
+- require identity for node config and add credential administration contracts (node-credentials)
+  - Add node credential metadata, mutation precondition, and mutation result interfaces for spark and pallet purposes.
+  - Add getNodeCredential, rotateNodeCredential, and revokeNodeCredential typed request contracts with infrastructure-admin identity requirements.
+  - Require identity on getNodeConfig requests, changing the existing request shape.
+  - Document node credential administration semantics and add type-level contract tests.
+
+## 2026-09-05 - 27.5.0
+
+### Features
+
+- add node-bound runtime assignment contracts (data)
+  - Add runtime assignment interfaces, canonical digest helpers, and data namespace exports.
+  - Add assignment and observation validators/evaluators for scope binding, CAS progression, replay handling, and sequence checks.
+  - Document node-bound runtime assignment semantics and add node test coverage.
+
+### Fixes
+
+- update release workflow and package metadata (release)
+  - Enable test and build preflight checks before releases
+  - Configure git releases to push branches and tags
+  - Update packaged license file references to license.md
+  - Bump dev tooling and package manager versions
+
 ## 2026-08-29 - 27.4.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '27.4.0',
+    version: '28.0.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -20,7 +20,9 @@ export * from './immutableimage.js';
 export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
+export * from './nodecredential.js';
 export * from './registry.js';
+export * from './runtimeassignment.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';

package/dist_ts/data/index.js

@@ -20,7 +20,9 @@ export * from './immutableimage.js';
 export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
+export * from './nodecredential.js';
 export * from './registry.js';
+export * from './runtimeassignment.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';
@@ -35,4 +37,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/data/nodecredential.d.ts

@@ -0,0 +1,38 @@
+/** Independent infrastructure credentials; neither purpose grants workload RBAC. */
+export type TNodeCredentialPurpose = 'spark' | 'pallet';
+/**
+ * Public inspection and mutation-result metadata. Never includes bearer material,
+ * hashes, socket peer IDs or controller process IDs. On replay this is historical
+ * evidence, not an assertion that a credential or reporter session is still live.
+ */
+export interface INodeCredentialMetadataV1 {
+    schemaVersion: 1;
+    nodeId: string;
+    purpose: TNodeCredentialPurpose;
+    state: 'active' | 'revoked';
+    generation: number;
+    /** Migrated Spark credentials remain usable only until their staged rotation. */
+    requiresRotation: boolean;
+    sessionEpoch: number;
+    sessionId: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+/**
+ * Infrastructure-admin mutation preconditions. Both counters are exact CAS
+ * preconditions, not minimums. Retrying must retain this complete input and the
+ * original mutationId; a changed request with the same ID must fail closed.
+ */
+export interface INodeCredentialMutationPreconditionsV1 {
+    schemaVersion: 1;
+    nodeId: string;
+    purpose: TNodeCredentialPurpose;
+    mutationId: string;
+    expectedGeneration: number;
+    expectedSessionEpoch: number;
+}
+export interface INodeCredentialMutationResultV1 {
+    metadata: INodeCredentialMetadataV1;
+    /** A replay returns the original result without restoring its authority. */
+    replayed: boolean;
+}

package/dist_ts/data/nodecredential.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZWNyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25vZGVjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist_ts/data/runtimeassignment.d.ts

@@ -0,0 +1,120 @@
+import type { TSha256Digest, TImmutableContainerPlatform } from './immutableimage.js';
+export interface IRuntimeControllerV1 {
+    kind: 'cloudly' | 'onebox';
+    id: string;
+    /** Persisted authority incarnation; changing it requires explicit re-admission. */
+    epoch: string;
+}
+/** Content-bound reference, not a credential, mount path or permission grant. */
+export interface IRuntimeAuthorityReferenceV1 {
+    id: string;
+    generation: number;
+    digest: TSha256Digest;
+}
+export interface IRuntimeAssignmentReferenceV1 {
+    assignmentId: string;
+    generation: number;
+    digest: TSha256Digest;
+}
+/** Derived from authenticated transport and locally configured ownership. */
+export interface IRuntimeAssignmentScopeV1 {
+    controller: IRuntimeControllerV1;
+    organizationId: string;
+    nodeId: string;
+    runtimeNamespace: string;
+}
+export type TRuntimeAssignmentDispositionV1 = 'run' | 'stop-preserve' | 'remove-runtime-preserve-storage';
+export interface IRuntimeAssignmentV1 extends IRuntimeAssignmentScopeV1 {
+    schemaVersion: 1;
+    assignmentId: string;
+    serviceId: string;
+    /** Stable logical replica; independent of container IDs and execution attempts. */
+    replicaId: string;
+    /** One execution attempt, immutable for this assignment. */
+    attemptId: string;
+    /** Logical topology provenance; placement authority remains nodeId. */
+    workerGroupId: string | null;
+    siteId: string | null;
+    generation: number;
+    /** Exact CAS predecessor; null only at generation 1. */
+    previous: IRuntimeAssignmentReferenceV1 | null;
+    disposition: TRuntimeAssignmentDispositionV1;
+    /** No automatic relocation or expiry-based claim of a stopped writer. */
+    offlinePolicy: 'continue-node-bound';
+    workload: {
+        registryHost: string;
+        repository: string;
+        imageDigest: TSha256Digest;
+        platform: TImmutableContainerPlatform;
+        /** Immutable complete invocation/configuration owned by the controller. */
+        config: IRuntimeAuthorityReferenceV1;
+        network: IRuntimeAuthorityReferenceV1 | null;
+        secrets: IRuntimeAuthorityReferenceV1 | null;
+        /** Sorted unique reference IDs. Empty means no persistent storage claims. */
+        storage: IRuntimeAuthorityReferenceV1[];
+    };
+    digest: TSha256Digest;
+}
+export type TRuntimeAssignmentDecisionV1 = {
+    status: 'accept' | 'replay';
+    assignment: IRuntimeAssignmentV1;
+} | {
+    status: 'reject';
+    reason: 'invalid' | 'scope-mismatch' | 'conflict' | 'stale' | 'predecessor-mismatch' | 'attempt-mismatch' | 'disposition-regression';
+};
+/** Value-free execution evidence. Receipt/acceptance alone never means ready. */
+export interface IRuntimeAssignmentObservationV1 {
+    schemaVersion: 1;
+    assignment: IRuntimeAssignmentReferenceV1;
+    /** Authenticated reporter session; its authority is verified by the receiver. */
+    reporterSessionId: string;
+    /** Durable per-assignment counter; never resets when a reporter reconnects. */
+    sequence: number;
+    observedAt: number;
+    phase: 'pending' | 'running' | 'stopped' | 'removed' | 'failed' | 'unknown';
+    ready: boolean;
+    runtime: {
+        sandboxId: string;
+        containerId: string;
+        imageDigest: TSha256Digest;
+    } | null;
+    digest: TSha256Digest;
+}
+export declare const runtimeAssignmentV1Contract: Readonly<{
+    readonly assignmentDigestDomain: "serve.zone/runtime-assignment-v1";
+    readonly observationDigestDomain: "serve.zone/runtime-assignment-observation-v1";
+    readonly maximumStorageReferences: 64;
+    readonly omission: "no-effect";
+    readonly removal: "retain-assignment-tombstone-and-storage";
+}>;
+/** Digest helpers validate structure and exclude only the object's own digest. */
+export declare const computeRuntimeAssignmentV1Digest: (assignmentArg: IRuntimeAssignmentV1) => Promise<TSha256Digest>;
+export declare const validateRuntimeAssignmentV1: (valueArg: unknown) => Promise<string[]>;
+export declare const getRuntimeAssignmentV1Reference: (assignmentArg: IRuntimeAssignmentV1) => IRuntimeAssignmentReferenceV1;
+/**
+ * Pure CAS decision, not authentication or execution. The caller must persist
+ * acceptance atomically before effects, serialize replica ownership, and retain
+ * removed assignments as tombstones. New attempts require separate stop/fencing
+ * admission for every older writer. An omitted assignment causes no transition.
+ * Persist only the returned detached snapshot, never the mutable input object.
+ */
+export declare const evaluateRuntimeAssignmentV1: (incomingArg: IRuntimeAssignmentV1, acceptedArg: IRuntimeAssignmentV1 | null, trustedScopeArg: IRuntimeAssignmentScopeV1) => Promise<TRuntimeAssignmentDecisionV1>;
+export declare const computeRuntimeAssignmentObservationV1Digest: (observationArg: IRuntimeAssignmentObservationV1) => Promise<TSha256Digest>;
+/** Checks exact assignment evidence; transport must separately bind reporter/session. */
+export declare const validateRuntimeAssignmentObservationV1: (observationArg: unknown, assignmentArg: IRuntimeAssignmentV1) => Promise<string[]>;
+export type TRuntimeObservationDecisionV1 = {
+    status: 'accept' | 'replay';
+    observation: IRuntimeAssignmentObservationV1;
+} | {
+    status: 'reject';
+    reason: 'invalid' | 'session-mismatch' | 'stale' | 'conflict' | 'sequence-gap';
+};
+/**
+ * Receiver must authorize the assignment's node before calling this helper.
+ * Compare/persist the returned snapshot atomically with the old receipt. A new
+ * session continues the durable counter; it does not reset observation history.
+ * Across dispositions, the old receipt must reference the exact predecessor;
+ * receivers must process each revision's observations in order.
+ * These observations are never sufficient authority to relocate a storage writer.
+ */
+export declare const evaluateRuntimeAssignmentObservationV1: (incomingArg: IRuntimeAssignmentObservationV1, acceptedArg: IRuntimeAssignmentObservationV1 | null, assignmentArg: IRuntimeAssignmentV1, trustedReporterSessionIdArg: string) => Promise<TRuntimeObservationDecisionV1>;

package/dist_ts/data/runtimeassignment.js

@@ -0,0 +1,267 @@
+import { buildDigestPinnedImageReference, isSha256Digest } from './immutableimage.js';
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+export const runtimeAssignmentV1Contract = Object.freeze({
+    assignmentDigestDomain: 'serve.zone/runtime-assignment-v1',
+    observationDigestDomain: 'serve.zone/runtime-assignment-observation-v1',
+    maximumStorageReferences: 64,
+    omission: 'no-effect',
+    removal: 'retain-assignment-tombstone-and-storage',
+});
+const fail = (messageArg) => { throw new Error(messageArg); };
+const isIdentifier = (valueArg) => typeof valueArg === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(valueArg);
+const isPositiveInteger = (valueArg) => typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && valueArg > 0;
+const isDigest = (valueArg) => typeof valueArg === 'string' && isSha256Digest(valueArg);
+/** Reject accessors before reading any fields; do not run input-owned code. */
+const isExactRecord = (valueArg, keysArg) => {
+    if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg))
+        return false;
+    const prototype = Object.getPrototypeOf(valueArg);
+    if (prototype !== Object.prototype && prototype !== null)
+        return false;
+    const keys = Reflect.ownKeys(valueArg);
+    return keys.length === keysArg.length && keys.every((keyArg) => {
+        const descriptor = Object.getOwnPropertyDescriptor(valueArg, keyArg);
+        return typeof keyArg === 'string' && keysArg.includes(keyArg)
+            && descriptor?.enumerable === true && Object.hasOwn(descriptor, 'value');
+    });
+};
+const isController = (valueArg) => isExactRecord(valueArg, ['kind', 'id', 'epoch'])
+    && (valueArg.kind === 'cloudly' || valueArg.kind === 'onebox')
+    && isIdentifier(valueArg.id) && isIdentifier(valueArg.epoch);
+const isAuthorityReference = (valueArg) => isExactRecord(valueArg, ['id', 'generation', 'digest'])
+    && isIdentifier(valueArg.id) && isPositiveInteger(valueArg.generation) && isDigest(valueArg.digest);
+const isAssignmentReference = (valueArg) => isExactRecord(valueArg, ['assignmentId', 'generation', 'digest'])
+    && isIdentifier(valueArg.assignmentId) && isPositiveInteger(valueArg.generation)
+    && isDigest(valueArg.digest);
+const assignmentKeys = [
+    'schemaVersion', 'controller', 'organizationId', 'nodeId', 'runtimeNamespace',
+    'assignmentId', 'serviceId', 'replicaId', 'attemptId', 'workerGroupId', 'siteId',
+    'generation', 'previous', 'disposition', 'offlinePolicy', 'workload', 'digest',
+];
+const assertAssignment = (valueArg) => {
+    if (!isExactRecord(valueArg, assignmentKeys)
+        || valueArg.schemaVersion !== 1 || !isController(valueArg.controller)
+        || !isPositiveInteger(valueArg.generation) || !isDigest(valueArg.digest)
+        || valueArg.offlinePolicy !== 'continue-node-bound'
+        || !['run', 'stop-preserve', 'remove-runtime-preserve-storage'].includes(valueArg.disposition))
+        fail('runtime assignment must use its exact v1 schema');
+    for (const key of ['organizationId', 'nodeId', 'runtimeNamespace', 'assignmentId',
+        'serviceId', 'replicaId', 'attemptId']) {
+        if (!isIdentifier(valueArg[key]))
+            fail(`runtime assignment ${key} must be a canonical identifier`);
+    }
+    for (const key of ['workerGroupId', 'siteId']) {
+        if (valueArg[key] !== null && !isIdentifier(valueArg[key]))
+            fail('invalid runtime topology ID');
+    }
+    if (valueArg.generation === 1 ? valueArg.previous !== null
+        : !isAssignmentReference(valueArg.previous)
+            || valueArg.previous.assignmentId !== valueArg.assignmentId
+            || valueArg.previous.generation !== valueArg.generation - 1) {
+        fail('runtime assignment must bind its exact preceding generation');
+    }
+    const workload = valueArg.workload;
+    if (!isExactRecord(workload, ['registryHost', 'repository', 'imageDigest', 'platform',
+        'config', 'network', 'secrets', 'storage'])
+        || typeof workload.registryHost !== 'string' || workload.registryHost.length > 253
+        || typeof workload.repository !== 'string' || workload.repository.length > 255
+        || !isDigest(workload.imageDigest)
+        || !['linux/amd64', 'linux/arm64'].includes(workload.platform)
+        || !isAuthorityReference(workload.config)
+        || (workload.network !== null && !isAuthorityReference(workload.network))
+        || (workload.secrets !== null && !isAuthorityReference(workload.secrets))
+        || !Array.isArray(workload.storage)
+        || workload.storage.length > runtimeAssignmentV1Contract.maximumStorageReferences) {
+        fail('runtime assignment workload must use exact immutable references');
+    }
+    buildDigestPinnedImageReference(workload.registryHost, workload.repository, workload.imageDigest);
+    let previousId = '';
+    for (let index = 0; index < workload.storage.length; index++) {
+        const descriptor = Object.getOwnPropertyDescriptor(workload.storage, String(index));
+        if (!descriptor || !Object.hasOwn(descriptor, 'value')
+            || !isAuthorityReference(descriptor.value) || descriptor.value.id <= previousId) {
+            fail('runtime assignment storage references must be dense, sorted and unique');
+        }
+        previousId = descriptor.value.id;
+    }
+    canonicalizeStrictJson(valueArg, fail);
+    return valueArg;
+};
+const digestPayload = async (domainArg, valueArg) => {
+    const { digest: _digest, ...payload } = valueArg;
+    return `sha256:${await createCanonicalJsonSha256Hex(canonicalizeStrictJson({ domain: domainArg, payload }, fail), fail)}`;
+};
+/** Digest helpers validate structure and exclude only the object's own digest. */
+export const computeRuntimeAssignmentV1Digest = async (assignmentArg) => digestPayload(runtimeAssignmentV1Contract.assignmentDigestDomain, assertAssignment(assignmentArg));
+export const validateRuntimeAssignmentV1 = async (valueArg) => {
+    try {
+        const assignment = snapshotAssignment(valueArg);
+        return assignment.digest === await computeRuntimeAssignmentV1Digest(assignment)
+            ? [] : ['runtime assignment digest does not match'];
+    }
+    catch {
+        return ['runtime assignment must use its exact canonical v1 schema'];
+    }
+};
+const snapshotAssignment = (valueArg) => JSON.parse(canonicalizeStrictJson(assertAssignment(valueArg), fail));
+export const getRuntimeAssignmentV1Reference = (assignmentArg) => ({
+    assignmentId: assignmentArg.assignmentId,
+    generation: assignmentArg.generation,
+    digest: assignmentArg.digest,
+});
+const canonical = (valueArg) => canonicalizeStrictJson(valueArg, fail);
+const immutableAttempt = (assignmentArg) => {
+    const { generation, previous, disposition, digest, ...attempt } = assignmentArg;
+    return canonical(attempt);
+};
+/**
+ * Pure CAS decision, not authentication or execution. The caller must persist
+ * acceptance atomically before effects, serialize replica ownership, and retain
+ * removed assignments as tombstones. New attempts require separate stop/fencing
+ * admission for every older writer. An omitted assignment causes no transition.
+ * Persist only the returned detached snapshot, never the mutable input object.
+ */
+export const evaluateRuntimeAssignmentV1 = async (incomingArg, acceptedArg, trustedScopeArg) => {
+    try {
+        incomingArg = snapshotAssignment(incomingArg);
+        acceptedArg = acceptedArg === null ? null : snapshotAssignment(acceptedArg);
+        if (!isExactRecord(trustedScopeArg, ['controller', 'organizationId', 'nodeId', 'runtimeNamespace'])
+            || !isController(trustedScopeArg.controller)
+            || !isIdentifier(trustedScopeArg.organizationId) || !isIdentifier(trustedScopeArg.nodeId)
+            || !isIdentifier(trustedScopeArg.runtimeNamespace))
+            return { status: 'reject', reason: 'invalid' };
+        trustedScopeArg = JSON.parse(canonical(trustedScopeArg));
+    }
+    catch {
+        return { status: 'reject', reason: 'invalid' };
+    }
+    if ((await validateRuntimeAssignmentV1(incomingArg)).length
+        || (acceptedArg !== null && (await validateRuntimeAssignmentV1(acceptedArg)).length)) {
+        return { status: 'reject', reason: 'invalid' };
+    }
+    const matchesScope = (assignmentArg) => assignmentArg.controller.kind === trustedScopeArg.controller.kind
+        && assignmentArg.controller.id === trustedScopeArg.controller.id
+        && assignmentArg.controller.epoch === trustedScopeArg.controller.epoch
+        && assignmentArg.organizationId === trustedScopeArg.organizationId
+        && assignmentArg.nodeId === trustedScopeArg.nodeId
+        && assignmentArg.runtimeNamespace === trustedScopeArg.runtimeNamespace;
+    if (!matchesScope(incomingArg) || (acceptedArg !== null && !matchesScope(acceptedArg))) {
+        return { status: 'reject', reason: 'scope-mismatch' };
+    }
+    if (acceptedArg === null) {
+        return incomingArg.generation === 1
+            && incomingArg.disposition === 'run'
+            ? { status: 'accept', assignment: incomingArg }
+            : { status: 'reject', reason: 'predecessor-mismatch' };
+    }
+    if (incomingArg.assignmentId !== acceptedArg.assignmentId) {
+        return { status: 'reject', reason: 'attempt-mismatch' };
+    }
+    if (incomingArg.generation < acceptedArg.generation)
+        return { status: 'reject', reason: 'stale' };
+    if (incomingArg.generation === acceptedArg.generation) {
+        return incomingArg.digest === acceptedArg.digest
+            ? { status: 'replay', assignment: acceptedArg } : { status: 'reject', reason: 'conflict' };
+    }
+    if (canonical(incomingArg.previous) !== canonical(getRuntimeAssignmentV1Reference(acceptedArg))) {
+        return { status: 'reject', reason: 'predecessor-mismatch' };
+    }
+    if (immutableAttempt(incomingArg) !== immutableAttempt(acceptedArg)) {
+        return { status: 'reject', reason: 'attempt-mismatch' };
+    }
+    const order = {
+        run: 0, 'stop-preserve': 1, 'remove-runtime-preserve-storage': 2,
+    };
+    if (order[incomingArg.disposition] !== order[acceptedArg.disposition] + 1) {
+        return { status: 'reject', reason: 'disposition-regression' };
+    }
+    return { status: 'accept', assignment: incomingArg };
+};
+const assertObservation = (valueArg) => {
+    if (!isExactRecord(valueArg, ['schemaVersion', 'assignment', 'reporterSessionId',
+        'sequence', 'observedAt', 'phase', 'ready', 'runtime', 'digest'])
+        || valueArg.schemaVersion !== 1 || !isAssignmentReference(valueArg.assignment)
+        || !isIdentifier(valueArg.reporterSessionId) || !isPositiveInteger(valueArg.sequence)
+        || !isPositiveInteger(valueArg.observedAt) || !isDigest(valueArg.digest)
+        || typeof valueArg.ready !== 'boolean'
+        || !['pending', 'running', 'stopped', 'removed', 'failed', 'unknown'].includes(valueArg.phase)) {
+        fail('runtime observation must use its exact v1 schema');
+    }
+    if (valueArg.runtime !== null && (!isExactRecord(valueArg.runtime, [
+        'sandboxId', 'containerId', 'imageDigest',
+    ]) || !isIdentifier(valueArg.runtime.sandboxId) || !isIdentifier(valueArg.runtime.containerId)
+        || !isDigest(valueArg.runtime.imageDigest)))
+        fail('runtime identity must be canonical');
+    if ((valueArg.ready && valueArg.phase !== 'running')
+        || (valueArg.phase === 'running' && valueArg.runtime === null)
+        || (valueArg.phase === 'removed' && valueArg.runtime !== null)) {
+        fail('runtime observation readiness and identity contradict its phase');
+    }
+    canonical(valueArg);
+    return valueArg;
+};
+export const computeRuntimeAssignmentObservationV1Digest = async (observationArg) => digestPayload(runtimeAssignmentV1Contract.observationDigestDomain, assertObservation(observationArg));
+/** Checks exact assignment evidence; transport must separately bind reporter/session. */
+export const validateRuntimeAssignmentObservationV1 = async (observationArg, assignmentArg) => {
+    try {
+        const observation = JSON.parse(canonical(assertObservation(observationArg)));
+        assignmentArg = snapshotAssignment(assignmentArg);
+        if ((await validateRuntimeAssignmentV1(assignmentArg)).length)
+            return ['invalid assignment'];
+        if (canonical(observation.assignment) !== canonical(getRuntimeAssignmentV1Reference(assignmentArg))) {
+            return ['runtime observation does not match the exact assignment'];
+        }
+        if (observation.digest !== await computeRuntimeAssignmentObservationV1Digest(observation)) {
+            return ['runtime observation digest does not match'];
+        }
+        if (observation.ready && (assignmentArg.disposition !== 'run'
+            || observation.runtime?.imageDigest !== assignmentArg.workload.imageDigest)) {
+            return ['runtime readiness does not match authorized execution'];
+        }
+        return [];
+    }
+    catch {
+        return ['runtime observation must use its exact canonical v1 schema'];
+    }
+};
+/**
+ * Receiver must authorize the assignment's node before calling this helper.
+ * Compare/persist the returned snapshot atomically with the old receipt. A new
+ * session continues the durable counter; it does not reset observation history.
+ * Across dispositions, the old receipt must reference the exact predecessor;
+ * receivers must process each revision's observations in order.
+ * These observations are never sufficient authority to relocate a storage writer.
+ */
+export const evaluateRuntimeAssignmentObservationV1 = async (incomingArg, acceptedArg, assignmentArg, trustedReporterSessionIdArg) => {
+    try {
+        incomingArg = JSON.parse(canonical(assertObservation(incomingArg)));
+        acceptedArg = acceptedArg === null ? null
+            : JSON.parse(canonical(assertObservation(acceptedArg)));
+        assignmentArg = snapshotAssignment(assignmentArg);
+        if (!isIdentifier(trustedReporterSessionIdArg)
+            || (await validateRuntimeAssignmentObservationV1(incomingArg, assignmentArg)).length
+            || (acceptedArg !== null && (acceptedArg.digest !== await computeRuntimeAssignmentObservationV1Digest(acceptedArg)
+                || acceptedArg.assignment.assignmentId !== assignmentArg.assignmentId
+                || (canonical(acceptedArg.assignment) !== canonical(getRuntimeAssignmentV1Reference(assignmentArg))
+                    && canonical(acceptedArg.assignment) !== canonical(assignmentArg.previous)))))
+            return { status: 'reject', reason: 'invalid' };
+        if (incomingArg.reporterSessionId !== trustedReporterSessionIdArg) {
+            return { status: 'reject', reason: 'session-mismatch' };
+        }
+        if (acceptedArg !== null && incomingArg.sequence <= acceptedArg.sequence) {
+            if (incomingArg.sequence < acceptedArg.sequence)
+                return { status: 'reject', reason: 'stale' };
+            return incomingArg.digest === acceptedArg.digest
+                ? { status: 'replay', observation: acceptedArg }
+                : { status: 'reject', reason: 'conflict' };
+        }
+        if (incomingArg.sequence !== (acceptedArg?.sequence ?? 0) + 1) {
+            return { status: 'reject', reason: 'sequence-gap' };
+        }
+        return { status: 'accept', observation: incomingArg };
+    }
+    catch {
+        return { status: 'reject', reason: 'invalid' };
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWFzc2lnbm1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVhc3NpZ25tZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN0RixPQUFPLEVBQUUsc0JBQXNCLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQTJGbkcsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RCxzQkFBc0IsRUFBRSxrQ0FBa0M7SUFDMUQsdUJBQXVCLEVBQUUsOENBQThDO0lBQ3ZFLHdCQUF3QixFQUFFLEVBQUU7SUFDNUIsUUFBUSxFQUFFLFdBQVc7SUFDckIsT0FBTyxFQUFFLHlDQUF5QztDQUMxQyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBa0MsQ0FBQyxVQUFVLEVBQUUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDN0YsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQzdELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDdkYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDbEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztBQUNqRixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FDaEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUUzRCwrRUFBK0U7QUFDL0UsTUFBTSxhQUFhLEdBQUcsQ0FDcEIsUUFBaUIsRUFDakIsT0FBMEIsRUFDVyxFQUFFO0lBQ3ZDLElBQUksQ0FBQyxRQUFRLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdkYsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsRCxJQUFJLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxJQUFJLFNBQVMsS0FBSyxJQUFJO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdkUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2QyxPQUFPLElBQUksQ0FBQyxNQUFNLEtBQUssT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUU7UUFDN0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNyRSxPQUFPLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztlQUN4RCxVQUFVLEVBQUUsVUFBVSxLQUFLLElBQUksSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM3RSxDQUFDLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBb0MsRUFBRSxDQUMzRSxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQztPQUM3QyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDO09BQzNELFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLElBQUksWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUMvRCxNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBaUIsRUFBNEMsRUFBRSxDQUMzRixhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQztPQUNwRCxZQUFZLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBQ3RHLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxRQUFpQixFQUE2QyxFQUFFLENBQzdGLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDO09BQzlELFlBQVksQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLElBQUksaUJBQWlCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztPQUM3RSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBRS9CLE1BQU0sY0FBYyxHQUFHO0lBQ3JCLGVBQWUsRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLGtCQUFrQjtJQUM3RSxjQUFjLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLFFBQVE7SUFDaEYsWUFBWSxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxRQUFRO0NBQ3RFLENBQUM7QUFFWCxNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBd0IsRUFBRTtJQUNuRSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxjQUFjLENBQUM7V0FDdkMsUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNsRSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3JFLFFBQVEsQ0FBQyxhQUFhLEtBQUsscUJBQXFCO1dBQ2hELENBQUMsQ0FBQyxLQUFLLEVBQUUsZUFBZSxFQUFFLGlDQUFpQyxDQUFDLENBQUMsUUFBUSxDQUN0RSxRQUFRLENBQUMsV0FBcUIsQ0FDL0I7UUFBRSxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUM3RCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLGtCQUFrQixFQUFFLGNBQWM7UUFDL0UsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQUUsSUFBSSxDQUFDLHNCQUFzQixHQUFHLGlDQUFpQyxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUM5QyxJQUFJLFFBQVEsQ0FBQyxHQUFHLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQUUsSUFBSSxDQUFDLDZCQUE2QixDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLEtBQUssSUFBSTtRQUN4RCxDQUFDLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO2VBQ3RDLFFBQVEsQ0FBQyxRQUFRLENBQUMsWUFBWSxLQUFLLFFBQVEsQ0FBQyxZQUFZO2VBQ3hELFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFNLFFBQVEsQ0FBQyxVQUFxQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzVFLElBQUksQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDO0lBQ25DLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsVUFBVTtRQUNuRixRQUFRLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztXQUN4QyxPQUFPLFFBQVEsQ0FBQyxZQUFZLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxZQUFZLENBQUMsTUFBTSxHQUFHLEdBQUc7V0FDL0UsT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQzNFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDL0IsQ0FBQyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQWtCLENBQUM7V0FDckUsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3RDLENBQUMsUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7V0FDdEUsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxDQUFDLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztXQUN0RSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztXQUNoQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRywyQkFBMkIsQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1FBQ3BGLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCwrQkFBK0IsQ0FBQyxRQUFRLENBQUMsWUFBc0IsRUFDN0QsUUFBUSxDQUFDLFVBQW9CLEVBQUUsUUFBUSxDQUFDLFdBQTRCLENBQUMsQ0FBQztJQUN4RSxJQUFJLFVBQVUsR0FBRyxFQUFFLENBQUM7SUFDcEIsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFJLFFBQVEsQ0FBQyxPQUFxQixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzVFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3BGLElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUM7ZUFDakQsQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxFQUFFLElBQUksVUFBVSxFQUFFLENBQUM7WUFDbEYsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELFVBQVUsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztJQUNuQyxDQUFDO0lBQ0Qsc0JBQXNCLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3ZDLE9BQU8sUUFBMkMsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFFRixNQUFNLGFBQWEsR0FBRyxLQUFLLEVBQUUsU0FBaUIsRUFBRSxRQUFtQyxFQUEwQixFQUFFO0lBQzdHLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsUUFBUSxDQUFDO0lBQ2pELE9BQU8sVUFBVSxNQUFNLDRCQUE0QixDQUNqRCxzQkFBc0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUNuRSxFQUFFLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRixrRkFBa0Y7QUFDbEYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUNuRCxhQUFtQyxFQUNYLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLDJCQUEyQixDQUFDLHNCQUFzQixFQUFFLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxDQUNwRixDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUFFLFFBQWlCLEVBQXFCLEVBQUU7SUFDeEYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxVQUFVLEdBQUcsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDaEQsT0FBTyxVQUFVLENBQUMsTUFBTSxLQUFLLE1BQU0sZ0NBQWdDLENBQUMsVUFBVSxDQUFDO1lBQzdFLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDdkUsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxRQUFpQixFQUF3QixFQUFFLENBQ3JFLElBQUksQ0FBQyxLQUFLLENBQUMsc0JBQXNCLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQXlCLENBQUM7QUFFL0YsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsYUFBbUMsRUFDSixFQUFFLENBQUMsQ0FBQztJQUNuQyxZQUFZLEVBQUUsYUFBYSxDQUFDLFlBQVk7SUFDeEMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVO0lBQ3BDLE1BQU0sRUFBRSxhQUFhLENBQUMsTUFBTTtDQUM3QixDQUFDLENBQUM7QUFFSCxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN4RixNQUFNLGdCQUFnQixHQUFHLENBQUMsYUFBbUMsRUFBVSxFQUFFO0lBQ3ZFLE1BQU0sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRyxhQUFhLENBQUM7SUFDaEYsT0FBTyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxXQUFpQyxFQUNqQyxXQUF3QyxFQUN4QyxlQUEwQyxFQUNILEVBQUU7SUFDekMsSUFBSSxDQUFDO1FBQ0gsV0FBVyxHQUFHLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzlDLFdBQVcsR0FBRyxXQUFXLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzVFLElBQUksQ0FBQyxhQUFhLENBQUMsZUFBZSxFQUFFLENBQUMsWUFBWSxFQUFFLGdCQUFnQixFQUFFLFFBQVEsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO2VBQzlGLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUM7ZUFDekMsQ0FBQyxZQUFZLENBQUMsZUFBZSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUM7ZUFDdEYsQ0FBQyxZQUFZLENBQUMsZUFBZSxDQUFDLGdCQUFnQixDQUFDO1lBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO1FBQ3JHLGVBQWUsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsQ0FBOEIsQ0FBQztJQUN4RixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQ2pELENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLE1BQU07V0FDdEQsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDdkYsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQ2pELENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxDQUFDLGFBQW1DLEVBQVcsRUFBRSxDQUNwRSxhQUFhLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxlQUFlLENBQUMsVUFBVSxDQUFDLElBQUk7V0FDOUQsYUFBYSxDQUFDLFVBQVUsQ0FBQyxFQUFFLEtBQUssZUFBZSxDQUFDLFVBQVUsQ0FBQyxFQUFFO1dBQzdELGFBQWEsQ0FBQyxVQUFVLENBQUMsS0FBSyxLQUFLLGVBQWUsQ0FBQyxVQUFVLENBQUMsS0FBSztXQUNuRSxhQUFhLENBQUMsY0FBYyxLQUFLLGVBQWUsQ0FBQyxjQUFjO1dBQy9ELGFBQWEsQ0FBQyxNQUFNLEtBQUssZUFBZSxDQUFDLE1BQU07V0FDL0MsYUFBYSxDQUFDLGdCQUFnQixLQUFLLGVBQWUsQ0FBQyxnQkFBZ0IsQ0FBQztJQUN6RSxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdkYsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksV0FBVyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3pCLE9BQU8sV0FBVyxDQUFDLFVBQVUsS0FBSyxDQUFDO2VBQzlCLFdBQVcsQ0FBQyxXQUFXLEtBQUssS0FBSztZQUNwQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUU7WUFDL0MsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQztJQUMzRCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsWUFBWSxLQUFLLFdBQVcsQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUMxRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVO1FBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ2xHLElBQUksV0FBVyxDQUFDLFVBQVUsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDdEQsT0FBTyxXQUFXLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxNQUFNO1lBQzlDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRyxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsS0FBSyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3BFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsRUFBRSxDQUFDO0lBQzFELENBQUM7SUFDRCxNQUFNLEtBQUssR0FBb0Q7UUFDN0QsR0FBRyxFQUFFLENBQUMsRUFBRSxlQUFlLEVBQUUsQ0FBQyxFQUFFLGlDQUFpQyxFQUFFLENBQUM7S0FDakUsQ0FBQztJQUNGLElBQUksS0FBSyxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSx3QkFBd0IsRUFBRSxDQUFDO0lBQ2hFLENBQUM7SUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDdkQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQW1DLEVBQUU7SUFDL0UsSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLG1CQUFtQjtRQUM5RSxVQUFVLEVBQUUsWUFBWSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1dBQzlELFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUMzRSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEYsQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztXQUNyRSxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUNuQyxDQUFDLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQWUsQ0FBQyxFQUFFLENBQUM7UUFDM0csSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFO1FBQ2pFLFdBQVcsRUFBRSxhQUFhLEVBQUUsYUFBYTtLQUMxQyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztXQUN6RixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQUUsSUFBSSxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUM7V0FDL0MsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQztXQUMzRCxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNqRSxJQUFJLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BCLE9BQU8sUUFBc0QsQ0FBQztBQUNoRSxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxLQUFLLEVBQzlELGNBQStDLEVBQ3ZCLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLDJCQUEyQixDQUFDLHVCQUF1QixFQUFFLGlCQUFpQixDQUFDLGNBQWMsQ0FBQyxDQUN2RixDQUFDO0FBRUYseUZBQXlGO0FBQ3pGLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLEtBQUssRUFDekQsY0FBdUIsRUFDdkIsYUFBbUMsRUFDaEIsRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFvQyxDQUFDO1FBQ2hILGFBQWEsR0FBRyxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNsRCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLE1BQU07WUFBRSxPQUFPLENBQUMsb0JBQW9CLENBQUMsQ0FBQztRQUM3RixJQUFJLFNBQVMsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLGFBQWEsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNwRyxPQUFPLENBQUMseURBQXlELENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLE1BQU0sMkNBQTJDLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMxRixPQUFPLENBQUMsMkNBQTJDLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsS0FBSyxJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsS0FBSyxLQUFLO2VBQ3hELFdBQVcsQ0FBQyxPQUFPLEVBQUUsV0FBVyxLQUFLLGFBQWEsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUM5RSxPQUFPLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztBQUNILENBQUMsQ0FBQztBQU1GOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQTRDLEVBQzVDLFdBQW1ELEVBQ25ELGFBQW1DLEVBQ25DLDJCQUFtQyxFQUNLLEVBQUU7SUFDMUMsSUFBSSxDQUFDO1FBQ0gsV0FBVyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQW9DLENBQUM7UUFDdkcsV0FBVyxHQUFHLFdBQVcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDdkMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQW9DLENBQUM7UUFDN0YsYUFBYSxHQUFHLGtCQUFrQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ2xELElBQUksQ0FBQyxZQUFZLENBQUMsMkJBQTJCLENBQUM7ZUFDekMsQ0FBQyxNQUFNLHNDQUFzQyxDQUFDLFdBQVcsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDLE1BQU07ZUFDakYsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLENBQzFCLFdBQVcsQ0FBQyxNQUFNLEtBQUssTUFBTSwyQ0FBMkMsQ0FBQyxXQUFXLENBQUM7bUJBQ2xGLFdBQVcsQ0FBQyxVQUFVLENBQUMsWUFBWSxLQUFLLGFBQWEsQ0FBQyxZQUFZO21CQUNsRSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLGFBQWEsQ0FBQyxDQUFDO3VCQUM5RixTQUFTLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FDOUUsQ0FBQztZQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUNyRCxJQUFJLFdBQVcsQ0FBQyxpQkFBaUIsS0FBSywyQkFBMkIsRUFBRSxDQUFDO1lBQ2xFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsRUFBRSxDQUFDO1FBQzFELENBQUM7UUFDRCxJQUFJLFdBQVcsS0FBSyxJQUFJLElBQUksV0FBVyxDQUFDLFFBQVEsSUFBSSxXQUFXLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDekUsSUFBSSxXQUFXLENBQUMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxRQUFRO2dCQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUM5RixPQUFPLFdBQVcsQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLE1BQU07Z0JBQzlDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRTtnQkFDaEQsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDL0MsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLFFBQVEsS0FBSyxDQUFDLFdBQVcsRUFBRSxRQUFRLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDOUQsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxDQUFDO1FBQ3RELENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLENBQUM7SUFDeEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/node.d.ts

@@ -4,15 +4,54 @@ import type { ICluster } from '../data/cluster.js';
 import type { IClusterNode, IClusterNodeMetrics, INodeAction, INodeMetricsSample, ISparkNodeRuntimeInfo, TNodeActionName } from '../data/clusternode.js';
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
-export interface IRequest_Any_Cloudly_GetNodeConfig {
+import type { INodeCredentialMetadataV1, INodeCredentialMutationPreconditionsV1, INodeCredentialMutationResultV1, TNodeCredentialPurpose } from '../data/nodecredential.js';
+/** Requires verified platform-infrastructure admin authority; returns public data only. */
+export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetNodeConfig> {
     method: 'getNodeConfig';
     request: {
+        identity: IIdentity;
         nodeId: string;
     };
     response: {
         configData: IClusterNode;
     };
 }
+/** These credential methods require verified infrastructure-admin authority. */
+export interface IReq_Any_Cloudly_GetNodeCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetNodeCredential> {
+    method: 'getNodeCredential';
+    request: {
+        identity: IIdentity;
+        nodeId: string;
+        purpose: TNodeCredentialPurpose;
+    };
+    response: {
+        metadata: INodeCredentialMetadataV1 | null;
+    };
+}
+export interface IReq_Any_Cloudly_RotateNodeCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_RotateNodeCredential> {
+    method: 'rotateNodeCredential';
+    request: {
+        identity: IIdentity;
+        mutation: INodeCredentialMutationPreconditionsV1 & {
+            /**
+             * SHA-256(token UTF-8 bytes), exactly 64 lowercase hexadecimal characters.
+             * The node must durably retain its pending CSPRNG credential and mutation
+             * identity before this request. A metadata-only retry never issues plaintext.
+             * Treat this request field as sensitive; never include it in hooks or logs.
+             */
+            newTokenHash: string;
+        };
+    };
+    response: INodeCredentialMutationResultV1;
+}
+export interface IReq_Any_Cloudly_RevokeNodeCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_RevokeNodeCredential> {
+    method: 'revokeNodeCredential';
+    request: {
+        identity: IIdentity;
+        mutation: INodeCredentialMutationPreconditionsV1;
+    };
+    response: INodeCredentialMutationResultV1;
+}
 export interface IRequest_Any_Cloudly_GetNodesByCluster {
     method: 'getNodesByCluster';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "27.4.0",
+  "version": "28.0.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -28,10 +28,10 @@
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^4.4.2",
-    "@git.zone/tsdoc": "^2.1.1",
+    "@git.zone/tsdoc": "^2.2.0",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "^4.0.0",
-    "@types/node": "^26.2.0"
+    "@types/node": "^26.4.1"
   },
   "files": [
     "ts/**/*",
@@ -41,7 +41,7 @@
     ".smartconfig.json",
     "readme.md",
     "changelog.md",
-    "license"
+    "license.md"
   ],
   "repository": {
     "type": "git",

package/readme.md

@@ -47,6 +47,67 @@ validator; unlike `@serve.zone/interfaces/runtime`, it does not load the general
 runtime graph, `plugins.js`, SmartCrypto, TypedRequest, Corestore, or settlement
 runtime modules.
 
+### Node Credential Administration
+
+`requests.node` defines `getNodeCredential`, `rotateNodeCredential` and
+`revokeNodeCredential` for verified platform-infrastructure administrators.
+`getNodeConfig` now also requires `identity`; callers using the previous
+unauthenticated request shape must update. Its response remains the public
+`IClusterNode`, never a persisted backend document.
+
+`data.INodeCredentialMetadataV1` separates `spark` and `pallet` purposes and
+exposes lifecycle state, generation, rotation-required status and session epoch,
+but no bearer, hash, socket peer or controller process identity. Infrastructure
+credentials do not grant organization or workload permissions.
+
+Mutations require the exact generation and session epoch plus a stable mutation
+ID. Rotation takes the SHA-256 hash of a node-generated CSPRNG credential that the
+node has already durably retained with that mutation ID. Lost-response retries
+repeat the complete request and receive the original metadata, never newly minted
+plaintext. A replay result is historical and cannot authorize a current session.
+Treat rotation request hashes as sensitive in transport hooks and logs.
+
+These types do not implement authentication, storage, enrollment or endpoints.
+Cloudly must verify current administrator authority, validate complete inputs,
+atomically persist the credential transition and immutable actor-bound receipt,
+and fence subsequent control effects against current durable credential/session
+authority. Node identity storage and transport integration must be qualified
+before enabling rotation or Pallet enrollment.
+
+### Node-Bound Runtime Assignments
+
+The `data` namespace exports `IRuntimeAssignmentV1`, canonical digest helpers,
+`evaluateRuntimeAssignmentV1`, and assignment observation validators/evaluators
+for Cloudly/Onebox controllers and Pallet nodes. These are shared contracts;
+they do not install a runtime, schedule containers or expose an RPC endpoint.
+
+Each assignment binds a controller incarnation, organization, stable node and
+replica IDs, one immutable execution attempt, image/configuration and opaque
+network/storage/secret references. Group and site IDs are nullable topology
+provenance. All fields except the digest itself participate in a domain-separated
+SHA-256 digest. Digests provide integrity and compare-and-swap identity;
+authentication must separately establish the trusted controller/node scope.
+
+An attempt starts at generation one with `run`, then advances through
+`stop-preserve` and `remove-runtime-preserve-storage` using exact predecessor
+generation/digest references. Exact retries return `replay`; conflicts, stale
+revisions, gaps, changed execution specifications and resurrection are rejected.
+Consumers must atomically persist the evaluator's detached snapshot before effects,
+retain removal tombstones and storage, and serialize ownership of each replica.
+Omission causes no change. A new attempt requires separate admission proving any
+older exclusive writer stopped or fenced. The supported offline policy is
+`continue-node-bound`; no heartbeat timeout or lease expiry proves a writer absent.
+
+Observations bind the exact assignment, authenticated reporter session, durable
+per-assignment sequence and digest. Reconnect does not reset the counter. Observation
+history must reference the same assignment revision or its exact predecessor;
+receivers process each disposition's observations in order. Session
+authorization, clock/freshness policy and durable receipt persistence belong to
+the receiving service. Readiness requires matching running image evidence and
+`run` intent; assignment acceptance alone is never readiness. A valid observation
+can describe drift (such as a removed runtime while intent remains `run`), and
+does not authorize storage relocation or prove fencing.
+
 ### Offline SmartDB Settlement And Packaging
 
 The Node-only `@serve.zone/interfaces/runtime` export includes isolated V1
@@ -1108,7 +1169,7 @@ The package is authored as ESM TypeScript and built with `tsbuild tsfolders`.
 
 ## License and Legal Information
 
-This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license](./license) file.
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [license.md](./license.md) file.
 
 **Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '27.4.0',
+  version: '28.0.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -20,7 +20,9 @@ export * from './immutableimage.js';
 export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
+export * from './nodecredential.js';
 export * from './registry.js';
+export * from './runtimeassignment.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';

package/ts/data/nodecredential.ts

@@ -0,0 +1,41 @@
+/** Independent infrastructure credentials; neither purpose grants workload RBAC. */
+export type TNodeCredentialPurpose = 'spark' | 'pallet';
+
+/**
+ * Public inspection and mutation-result metadata. Never includes bearer material,
+ * hashes, socket peer IDs or controller process IDs. On replay this is historical
+ * evidence, not an assertion that a credential or reporter session is still live.
+ */
+export interface INodeCredentialMetadataV1 {
+  schemaVersion: 1;
+  nodeId: string;
+  purpose: TNodeCredentialPurpose;
+  state: 'active' | 'revoked';
+  generation: number;
+  /** Migrated Spark credentials remain usable only until their staged rotation. */
+  requiresRotation: boolean;
+  sessionEpoch: number;
+  sessionId: string | null;
+  createdAt: number;
+  updatedAt: number;
+}
+
+/**
+ * Infrastructure-admin mutation preconditions. Both counters are exact CAS
+ * preconditions, not minimums. Retrying must retain this complete input and the
+ * original mutationId; a changed request with the same ID must fail closed.
+ */
+export interface INodeCredentialMutationPreconditionsV1 {
+  schemaVersion: 1;
+  nodeId: string;
+  purpose: TNodeCredentialPurpose;
+  mutationId: string;
+  expectedGeneration: number;
+  expectedSessionEpoch: number;
+}
+
+export interface INodeCredentialMutationResultV1 {
+  metadata: INodeCredentialMetadataV1;
+  /** A replay returns the original result without restoring its authority. */
+  replayed: boolean;
+}

package/ts/data/runtimeassignment.ts

@@ -0,0 +1,402 @@
+import type { TSha256Digest, TImmutableContainerPlatform } from './immutableimage.js';
+import { buildDigestPinnedImageReference, isSha256Digest } from './immutableimage.js';
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+
+export interface IRuntimeControllerV1 {
+  kind: 'cloudly' | 'onebox';
+  id: string;
+  /** Persisted authority incarnation; changing it requires explicit re-admission. */
+  epoch: string;
+}
+
+/** Content-bound reference, not a credential, mount path or permission grant. */
+export interface IRuntimeAuthorityReferenceV1 {
+  id: string;
+  generation: number;
+  digest: TSha256Digest;
+}
+
+export interface IRuntimeAssignmentReferenceV1 {
+  assignmentId: string;
+  generation: number;
+  digest: TSha256Digest;
+}
+
+/** Derived from authenticated transport and locally configured ownership. */
+export interface IRuntimeAssignmentScopeV1 {
+  controller: IRuntimeControllerV1;
+  organizationId: string;
+  nodeId: string;
+  runtimeNamespace: string;
+}
+
+export type TRuntimeAssignmentDispositionV1 =
+  | 'run'
+  | 'stop-preserve'
+  | 'remove-runtime-preserve-storage';
+
+export interface IRuntimeAssignmentV1 extends IRuntimeAssignmentScopeV1 {
+  schemaVersion: 1;
+  assignmentId: string;
+  serviceId: string;
+  /** Stable logical replica; independent of container IDs and execution attempts. */
+  replicaId: string;
+  /** One execution attempt, immutable for this assignment. */
+  attemptId: string;
+  /** Logical topology provenance; placement authority remains nodeId. */
+  workerGroupId: string | null;
+  siteId: string | null;
+  generation: number;
+  /** Exact CAS predecessor; null only at generation 1. */
+  previous: IRuntimeAssignmentReferenceV1 | null;
+  disposition: TRuntimeAssignmentDispositionV1;
+  /** No automatic relocation or expiry-based claim of a stopped writer. */
+  offlinePolicy: 'continue-node-bound';
+  workload: {
+    registryHost: string;
+    repository: string;
+    imageDigest: TSha256Digest;
+    platform: TImmutableContainerPlatform;
+    /** Immutable complete invocation/configuration owned by the controller. */
+    config: IRuntimeAuthorityReferenceV1;
+    network: IRuntimeAuthorityReferenceV1 | null;
+    secrets: IRuntimeAuthorityReferenceV1 | null;
+    /** Sorted unique reference IDs. Empty means no persistent storage claims. */
+    storage: IRuntimeAuthorityReferenceV1[];
+  };
+  digest: TSha256Digest;
+}
+
+export type TRuntimeAssignmentDecisionV1 =
+  | { status: 'accept' | 'replay'; assignment: IRuntimeAssignmentV1 }
+  | { status: 'reject'; reason: 'invalid' | 'scope-mismatch' | 'conflict' | 'stale'
+      | 'predecessor-mismatch' | 'attempt-mismatch' | 'disposition-regression' };
+
+/** Value-free execution evidence. Receipt/acceptance alone never means ready. */
+export interface IRuntimeAssignmentObservationV1 {
+  schemaVersion: 1;
+  assignment: IRuntimeAssignmentReferenceV1;
+  /** Authenticated reporter session; its authority is verified by the receiver. */
+  reporterSessionId: string;
+  /** Durable per-assignment counter; never resets when a reporter reconnects. */
+  sequence: number;
+  observedAt: number;
+  phase: 'pending' | 'running' | 'stopped' | 'removed' | 'failed' | 'unknown';
+  ready: boolean;
+  runtime: {
+    sandboxId: string;
+    containerId: string;
+    imageDigest: TSha256Digest;
+  } | null;
+  digest: TSha256Digest;
+}
+
+export const runtimeAssignmentV1Contract = Object.freeze({
+  assignmentDigestDomain: 'serve.zone/runtime-assignment-v1',
+  observationDigestDomain: 'serve.zone/runtime-assignment-observation-v1',
+  maximumStorageReferences: 64,
+  omission: 'no-effect',
+  removal: 'retain-assignment-tombstone-and-storage',
+} as const);
+
+const fail: (messageArg: string) => never = (messageArg) => { throw new Error(messageArg); };
+const isIdentifier = (valueArg: unknown): valueArg is string =>
+  typeof valueArg === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(valueArg);
+const isPositiveInteger = (valueArg: unknown): valueArg is number =>
+  typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && valueArg > 0;
+const isDigest = (valueArg: unknown): valueArg is TSha256Digest =>
+  typeof valueArg === 'string' && isSha256Digest(valueArg);
+
+/** Reject accessors before reading any fields; do not run input-owned code. */
+const isExactRecord = (
+  valueArg: unknown,
+  keysArg: readonly string[],
+): valueArg is Record<string, unknown> => {
+  if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) return false;
+  const prototype = Object.getPrototypeOf(valueArg);
+  if (prototype !== Object.prototype && prototype !== null) return false;
+  const keys = Reflect.ownKeys(valueArg);
+  return keys.length === keysArg.length && keys.every((keyArg) => {
+    const descriptor = Object.getOwnPropertyDescriptor(valueArg, keyArg);
+    return typeof keyArg === 'string' && keysArg.includes(keyArg)
+      && descriptor?.enumerable === true && Object.hasOwn(descriptor, 'value');
+  });
+};
+
+const isController = (valueArg: unknown): valueArg is IRuntimeControllerV1 =>
+  isExactRecord(valueArg, ['kind', 'id', 'epoch'])
+  && (valueArg.kind === 'cloudly' || valueArg.kind === 'onebox')
+  && isIdentifier(valueArg.id) && isIdentifier(valueArg.epoch);
+const isAuthorityReference = (valueArg: unknown): valueArg is IRuntimeAuthorityReferenceV1 =>
+  isExactRecord(valueArg, ['id', 'generation', 'digest'])
+  && isIdentifier(valueArg.id) && isPositiveInteger(valueArg.generation) && isDigest(valueArg.digest);
+const isAssignmentReference = (valueArg: unknown): valueArg is IRuntimeAssignmentReferenceV1 =>
+  isExactRecord(valueArg, ['assignmentId', 'generation', 'digest'])
+  && isIdentifier(valueArg.assignmentId) && isPositiveInteger(valueArg.generation)
+  && isDigest(valueArg.digest);
+
+const assignmentKeys = [
+  'schemaVersion', 'controller', 'organizationId', 'nodeId', 'runtimeNamespace',
+  'assignmentId', 'serviceId', 'replicaId', 'attemptId', 'workerGroupId', 'siteId',
+  'generation', 'previous', 'disposition', 'offlinePolicy', 'workload', 'digest',
+] as const;
+
+const assertAssignment = (valueArg: unknown): IRuntimeAssignmentV1 => {
+  if (!isExactRecord(valueArg, assignmentKeys)
+    || valueArg.schemaVersion !== 1 || !isController(valueArg.controller)
+    || !isPositiveInteger(valueArg.generation) || !isDigest(valueArg.digest)
+    || valueArg.offlinePolicy !== 'continue-node-bound'
+    || !['run', 'stop-preserve', 'remove-runtime-preserve-storage'].includes(
+      valueArg.disposition as string,
+    )) fail('runtime assignment must use its exact v1 schema');
+  for (const key of ['organizationId', 'nodeId', 'runtimeNamespace', 'assignmentId',
+    'serviceId', 'replicaId', 'attemptId']) {
+    if (!isIdentifier(valueArg[key])) fail(`runtime assignment ${key} must be a canonical identifier`);
+  }
+  for (const key of ['workerGroupId', 'siteId']) {
+    if (valueArg[key] !== null && !isIdentifier(valueArg[key])) fail('invalid runtime topology ID');
+  }
+  if (valueArg.generation === 1 ? valueArg.previous !== null
+    : !isAssignmentReference(valueArg.previous)
+      || valueArg.previous.assignmentId !== valueArg.assignmentId
+      || valueArg.previous.generation !== (valueArg.generation as number) - 1) {
+    fail('runtime assignment must bind its exact preceding generation');
+  }
+  const workload = valueArg.workload;
+  if (!isExactRecord(workload, ['registryHost', 'repository', 'imageDigest', 'platform',
+    'config', 'network', 'secrets', 'storage'])
+    || typeof workload.registryHost !== 'string' || workload.registryHost.length > 253
+    || typeof workload.repository !== 'string' || workload.repository.length > 255
+    || !isDigest(workload.imageDigest)
+    || !['linux/amd64', 'linux/arm64'].includes(workload.platform as string)
+    || !isAuthorityReference(workload.config)
+    || (workload.network !== null && !isAuthorityReference(workload.network))
+    || (workload.secrets !== null && !isAuthorityReference(workload.secrets))
+    || !Array.isArray(workload.storage)
+    || workload.storage.length > runtimeAssignmentV1Contract.maximumStorageReferences) {
+    fail('runtime assignment workload must use exact immutable references');
+  }
+  buildDigestPinnedImageReference(workload.registryHost as string,
+    workload.repository as string, workload.imageDigest as TSha256Digest);
+  let previousId = '';
+  for (let index = 0; index < (workload.storage as unknown[]).length; index++) {
+    const descriptor = Object.getOwnPropertyDescriptor(workload.storage, String(index));
+    if (!descriptor || !Object.hasOwn(descriptor, 'value')
+      || !isAuthorityReference(descriptor.value) || descriptor.value.id <= previousId) {
+      fail('runtime assignment storage references must be dense, sorted and unique');
+    }
+    previousId = descriptor.value.id;
+  }
+  canonicalizeStrictJson(valueArg, fail);
+  return valueArg as unknown as IRuntimeAssignmentV1;
+};
+
+const digestPayload = async (domainArg: string, valueArg: { digest: TSha256Digest }): Promise<TSha256Digest> => {
+  const { digest: _digest, ...payload } = valueArg;
+  return `sha256:${await createCanonicalJsonSha256Hex(
+    canonicalizeStrictJson({ domain: domainArg, payload }, fail), fail,
+  )}`;
+};
+
+/** Digest helpers validate structure and exclude only the object's own digest. */
+export const computeRuntimeAssignmentV1Digest = async (
+  assignmentArg: IRuntimeAssignmentV1,
+): Promise<TSha256Digest> => digestPayload(
+  runtimeAssignmentV1Contract.assignmentDigestDomain, assertAssignment(assignmentArg),
+);
+
+export const validateRuntimeAssignmentV1 = async (valueArg: unknown): Promise<string[]> => {
+  try {
+    const assignment = snapshotAssignment(valueArg);
+    return assignment.digest === await computeRuntimeAssignmentV1Digest(assignment)
+      ? [] : ['runtime assignment digest does not match'];
+  } catch {
+    return ['runtime assignment must use its exact canonical v1 schema'];
+  }
+};
+
+const snapshotAssignment = (valueArg: unknown): IRuntimeAssignmentV1 =>
+  JSON.parse(canonicalizeStrictJson(assertAssignment(valueArg), fail)) as IRuntimeAssignmentV1;
+
+export const getRuntimeAssignmentV1Reference = (
+  assignmentArg: IRuntimeAssignmentV1,
+): IRuntimeAssignmentReferenceV1 => ({
+  assignmentId: assignmentArg.assignmentId,
+  generation: assignmentArg.generation,
+  digest: assignmentArg.digest,
+});
+
+const canonical = (valueArg: unknown): string => canonicalizeStrictJson(valueArg, fail);
+const immutableAttempt = (assignmentArg: IRuntimeAssignmentV1): string => {
+  const { generation, previous, disposition, digest, ...attempt } = assignmentArg;
+  return canonical(attempt);
+};
+
+/**
+ * Pure CAS decision, not authentication or execution. The caller must persist
+ * acceptance atomically before effects, serialize replica ownership, and retain
+ * removed assignments as tombstones. New attempts require separate stop/fencing
+ * admission for every older writer. An omitted assignment causes no transition.
+ * Persist only the returned detached snapshot, never the mutable input object.
+ */
+export const evaluateRuntimeAssignmentV1 = async (
+  incomingArg: IRuntimeAssignmentV1,
+  acceptedArg: IRuntimeAssignmentV1 | null,
+  trustedScopeArg: IRuntimeAssignmentScopeV1,
+): Promise<TRuntimeAssignmentDecisionV1> => {
+  try {
+    incomingArg = snapshotAssignment(incomingArg);
+    acceptedArg = acceptedArg === null ? null : snapshotAssignment(acceptedArg);
+    if (!isExactRecord(trustedScopeArg, ['controller', 'organizationId', 'nodeId', 'runtimeNamespace'])
+      || !isController(trustedScopeArg.controller)
+      || !isIdentifier(trustedScopeArg.organizationId) || !isIdentifier(trustedScopeArg.nodeId)
+      || !isIdentifier(trustedScopeArg.runtimeNamespace)) return { status: 'reject', reason: 'invalid' };
+    trustedScopeArg = JSON.parse(canonical(trustedScopeArg)) as IRuntimeAssignmentScopeV1;
+  } catch {
+    return { status: 'reject', reason: 'invalid' };
+  }
+  if ((await validateRuntimeAssignmentV1(incomingArg)).length
+    || (acceptedArg !== null && (await validateRuntimeAssignmentV1(acceptedArg)).length)) {
+    return { status: 'reject', reason: 'invalid' };
+  }
+  const matchesScope = (assignmentArg: IRuntimeAssignmentV1): boolean =>
+    assignmentArg.controller.kind === trustedScopeArg.controller.kind
+    && assignmentArg.controller.id === trustedScopeArg.controller.id
+    && assignmentArg.controller.epoch === trustedScopeArg.controller.epoch
+    && assignmentArg.organizationId === trustedScopeArg.organizationId
+    && assignmentArg.nodeId === trustedScopeArg.nodeId
+    && assignmentArg.runtimeNamespace === trustedScopeArg.runtimeNamespace;
+  if (!matchesScope(incomingArg) || (acceptedArg !== null && !matchesScope(acceptedArg))) {
+    return { status: 'reject', reason: 'scope-mismatch' };
+  }
+  if (acceptedArg === null) {
+    return incomingArg.generation === 1
+      && incomingArg.disposition === 'run'
+      ? { status: 'accept', assignment: incomingArg }
+      : { status: 'reject', reason: 'predecessor-mismatch' };
+  }
+  if (incomingArg.assignmentId !== acceptedArg.assignmentId) {
+    return { status: 'reject', reason: 'attempt-mismatch' };
+  }
+  if (incomingArg.generation < acceptedArg.generation) return { status: 'reject', reason: 'stale' };
+  if (incomingArg.generation === acceptedArg.generation) {
+    return incomingArg.digest === acceptedArg.digest
+      ? { status: 'replay', assignment: acceptedArg } : { status: 'reject', reason: 'conflict' };
+  }
+  if (canonical(incomingArg.previous) !== canonical(getRuntimeAssignmentV1Reference(acceptedArg))) {
+    return { status: 'reject', reason: 'predecessor-mismatch' };
+  }
+  if (immutableAttempt(incomingArg) !== immutableAttempt(acceptedArg)) {
+    return { status: 'reject', reason: 'attempt-mismatch' };
+  }
+  const order: Record<TRuntimeAssignmentDispositionV1, number> = {
+    run: 0, 'stop-preserve': 1, 'remove-runtime-preserve-storage': 2,
+  };
+  if (order[incomingArg.disposition] !== order[acceptedArg.disposition] + 1) {
+    return { status: 'reject', reason: 'disposition-regression' };
+  }
+  return { status: 'accept', assignment: incomingArg };
+};
+
+const assertObservation = (valueArg: unknown): IRuntimeAssignmentObservationV1 => {
+  if (!isExactRecord(valueArg, ['schemaVersion', 'assignment', 'reporterSessionId',
+    'sequence', 'observedAt', 'phase', 'ready', 'runtime', 'digest'])
+    || valueArg.schemaVersion !== 1 || !isAssignmentReference(valueArg.assignment)
+    || !isIdentifier(valueArg.reporterSessionId) || !isPositiveInteger(valueArg.sequence)
+    || !isPositiveInteger(valueArg.observedAt) || !isDigest(valueArg.digest)
+    || typeof valueArg.ready !== 'boolean'
+    || !['pending', 'running', 'stopped', 'removed', 'failed', 'unknown'].includes(valueArg.phase as string)) {
+    fail('runtime observation must use its exact v1 schema');
+  }
+  if (valueArg.runtime !== null && (!isExactRecord(valueArg.runtime, [
+    'sandboxId', 'containerId', 'imageDigest',
+  ]) || !isIdentifier(valueArg.runtime.sandboxId) || !isIdentifier(valueArg.runtime.containerId)
+    || !isDigest(valueArg.runtime.imageDigest))) fail('runtime identity must be canonical');
+  if ((valueArg.ready && valueArg.phase !== 'running')
+    || (valueArg.phase === 'running' && valueArg.runtime === null)
+    || (valueArg.phase === 'removed' && valueArg.runtime !== null)) {
+    fail('runtime observation readiness and identity contradict its phase');
+  }
+  canonical(valueArg);
+  return valueArg as unknown as IRuntimeAssignmentObservationV1;
+};
+
+export const computeRuntimeAssignmentObservationV1Digest = async (
+  observationArg: IRuntimeAssignmentObservationV1,
+): Promise<TSha256Digest> => digestPayload(
+  runtimeAssignmentV1Contract.observationDigestDomain, assertObservation(observationArg),
+);
+
+/** Checks exact assignment evidence; transport must separately bind reporter/session. */
+export const validateRuntimeAssignmentObservationV1 = async (
+  observationArg: unknown,
+  assignmentArg: IRuntimeAssignmentV1,
+): Promise<string[]> => {
+  try {
+    const observation = JSON.parse(canonical(assertObservation(observationArg))) as IRuntimeAssignmentObservationV1;
+    assignmentArg = snapshotAssignment(assignmentArg);
+    if ((await validateRuntimeAssignmentV1(assignmentArg)).length) return ['invalid assignment'];
+    if (canonical(observation.assignment) !== canonical(getRuntimeAssignmentV1Reference(assignmentArg))) {
+      return ['runtime observation does not match the exact assignment'];
+    }
+    if (observation.digest !== await computeRuntimeAssignmentObservationV1Digest(observation)) {
+      return ['runtime observation digest does not match'];
+    }
+    if (observation.ready && (assignmentArg.disposition !== 'run'
+      || observation.runtime?.imageDigest !== assignmentArg.workload.imageDigest)) {
+      return ['runtime readiness does not match authorized execution'];
+    }
+    return [];
+  } catch {
+    return ['runtime observation must use its exact canonical v1 schema'];
+  }
+};
+
+export type TRuntimeObservationDecisionV1 =
+  | { status: 'accept' | 'replay'; observation: IRuntimeAssignmentObservationV1 }
+  | { status: 'reject'; reason: 'invalid' | 'session-mismatch' | 'stale' | 'conflict' | 'sequence-gap' };
+
+/**
+ * Receiver must authorize the assignment's node before calling this helper.
+ * Compare/persist the returned snapshot atomically with the old receipt. A new
+ * session continues the durable counter; it does not reset observation history.
+ * Across dispositions, the old receipt must reference the exact predecessor;
+ * receivers must process each revision's observations in order.
+ * These observations are never sufficient authority to relocate a storage writer.
+ */
+export const evaluateRuntimeAssignmentObservationV1 = async (
+  incomingArg: IRuntimeAssignmentObservationV1,
+  acceptedArg: IRuntimeAssignmentObservationV1 | null,
+  assignmentArg: IRuntimeAssignmentV1,
+  trustedReporterSessionIdArg: string,
+): Promise<TRuntimeObservationDecisionV1> => {
+  try {
+    incomingArg = JSON.parse(canonical(assertObservation(incomingArg))) as IRuntimeAssignmentObservationV1;
+    acceptedArg = acceptedArg === null ? null
+      : JSON.parse(canonical(assertObservation(acceptedArg))) as IRuntimeAssignmentObservationV1;
+    assignmentArg = snapshotAssignment(assignmentArg);
+    if (!isIdentifier(trustedReporterSessionIdArg)
+      || (await validateRuntimeAssignmentObservationV1(incomingArg, assignmentArg)).length
+      || (acceptedArg !== null && (
+        acceptedArg.digest !== await computeRuntimeAssignmentObservationV1Digest(acceptedArg)
+        || acceptedArg.assignment.assignmentId !== assignmentArg.assignmentId
+        || (canonical(acceptedArg.assignment) !== canonical(getRuntimeAssignmentV1Reference(assignmentArg))
+          && canonical(acceptedArg.assignment) !== canonical(assignmentArg.previous))
+      ))) return { status: 'reject', reason: 'invalid' };
+    if (incomingArg.reporterSessionId !== trustedReporterSessionIdArg) {
+      return { status: 'reject', reason: 'session-mismatch' };
+    }
+    if (acceptedArg !== null && incomingArg.sequence <= acceptedArg.sequence) {
+      if (incomingArg.sequence < acceptedArg.sequence) return { status: 'reject', reason: 'stale' };
+      return incomingArg.digest === acceptedArg.digest
+        ? { status: 'replay', observation: acceptedArg }
+        : { status: 'reject', reason: 'conflict' };
+    }
+    if (incomingArg.sequence !== (acceptedArg?.sequence ?? 0) + 1) {
+      return { status: 'reject', reason: 'sequence-gap' };
+    }
+    return { status: 'accept', observation: incomingArg };
+  } catch {
+    return { status: 'reject', reason: 'invalid' };
+  }
+};

package/ts/requests/node.ts

@@ -4,10 +4,21 @@ import type { ICluster } from '../data/cluster.js';
 import type { IClusterNode, IClusterNodeMetrics, INodeAction, INodeMetricsSample, ISparkNodeRuntimeInfo, TNodeActionName } from '../data/clusternode.js';
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
+import type {
+  INodeCredentialMetadataV1,
+  INodeCredentialMutationPreconditionsV1,
+  INodeCredentialMutationResultV1,
+  TNodeCredentialPurpose,
+} from '../data/nodecredential.js';
 
-export interface IRequest_Any_Cloudly_GetNodeConfig {
+/** Requires verified platform-infrastructure admin authority; returns public data only. */
+export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IRequest_Any_Cloudly_GetNodeConfig
+> {
   method: 'getNodeConfig';
   request: {
+    identity: IIdentity;
     nodeId: string;
   };
   response: {
@@ -15,6 +26,54 @@ export interface IRequest_Any_Cloudly_GetNodeConfig {
   };
 }
 
+/** These credential methods require verified infrastructure-admin authority. */
+export interface IReq_Any_Cloudly_GetNodeCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Any_Cloudly_GetNodeCredential
+> {
+  method: 'getNodeCredential';
+  request: {
+    identity: IIdentity;
+    nodeId: string;
+    purpose: TNodeCredentialPurpose;
+  };
+  response: {
+    metadata: INodeCredentialMetadataV1 | null;
+  };
+}
+
+export interface IReq_Any_Cloudly_RotateNodeCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Any_Cloudly_RotateNodeCredential
+> {
+  method: 'rotateNodeCredential';
+  request: {
+    identity: IIdentity;
+    mutation: INodeCredentialMutationPreconditionsV1 & {
+      /**
+       * SHA-256(token UTF-8 bytes), exactly 64 lowercase hexadecimal characters.
+       * The node must durably retain its pending CSPRNG credential and mutation
+       * identity before this request. A metadata-only retry never issues plaintext.
+       * Treat this request field as sensitive; never include it in hooks or logs.
+       */
+      newTokenHash: string;
+    };
+  };
+  response: INodeCredentialMutationResultV1;
+}
+
+export interface IReq_Any_Cloudly_RevokeNodeCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Any_Cloudly_RevokeNodeCredential
+> {
+  method: 'revokeNodeCredential';
+  request: {
+    identity: IIdentity;
+    mutation: INodeCredentialMutationPreconditionsV1;
+  };
+  response: INodeCredentialMutationResultV1;
+}
+
 export interface IRequest_Any_Cloudly_GetNodesByCluster {
   method: 'getNodesByCluster';
   request: {