@serve.zone/interfaces 27.5.0 → 28.1.0

package/changelog.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 2026-09-06 - 28.1.0
+
+### Features
+
+- add independent node enrollment contracts (node-enrollment)
+  - Export node enrollment data interfaces and helpers for strict snapshots, canonical digests, proof verification, acknowledgement binding, and state snapshots.
+  - Add node TypedRequest contracts for enrollment state checks and node enrollment transactions.
+  - Document node enrollment semantics and add tests for digest binding, proof validation, acknowledgement validation, and TypedRequest ownership.
+
+### Fixes
+
+- use qualified pnpm 11.25.0 for exact release packaging (package)
+  - Select the GitZone-qualified version permitted by the existing release-age policy.
+  - Remove the inactive pnpm 12 bootstrap lock document without changing application dependencies.
+- clarify pnpm release packaging changelog entry (changelog)
+  - Consolidates duplicate pnpm pinning notes into a single package fix entry.
+  - Documents qualified pnpm 11.25.0 selection for release packaging.
+
+## 2026-09-05 - 28.0.0
+
+### Breaking Changes
+
+- require identity for node config and add credential administration contracts (node-credentials)
+  - Add node credential metadata, mutation precondition, and mutation result interfaces for spark and pallet purposes.
+  - Add getNodeCredential, rotateNodeCredential, and revokeNodeCredential typed request contracts with infrastructure-admin identity requirements.
+  - Require identity on getNodeConfig requests, changing the existing request shape.
+  - Document node credential administration semantics and add type-level contract tests.
+
 ## 2026-09-05 - 27.5.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '27.5.0',
+    version: '28.1.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -20,6 +20,8 @@ export * from './immutableimage.js';
 export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
+export * from './nodecredential.js';
+export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
 export * from './secret.js';

package/dist_ts/data/index.js

@@ -20,6 +20,8 @@ export * from './immutableimage.js';
 export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
+export * from './nodecredential.js';
+export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
 export * from './secret.js';
@@ -36,4 +38,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==

package/dist_ts/data/nodecredential.d.ts

@@ -0,0 +1,38 @@
+/** Independent infrastructure credentials; neither purpose grants workload RBAC. */
+export type TNodeCredentialPurpose = 'spark' | 'pallet';
+/**
+ * Public inspection and mutation-result metadata. Never includes bearer material,
+ * hashes, socket peer IDs or controller process IDs. On replay this is historical
+ * evidence, not an assertion that a credential or reporter session is still live.
+ */
+export interface INodeCredentialMetadataV1 {
+    schemaVersion: 1;
+    nodeId: string;
+    purpose: TNodeCredentialPurpose;
+    state: 'active' | 'revoked';
+    generation: number;
+    /** Migrated Spark credentials remain usable only until their staged rotation. */
+    requiresRotation: boolean;
+    sessionEpoch: number;
+    sessionId: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+/**
+ * Infrastructure-admin mutation preconditions. Both counters are exact CAS
+ * preconditions, not minimums. Retrying must retain this complete input and the
+ * original mutationId; a changed request with the same ID must fail closed.
+ */
+export interface INodeCredentialMutationPreconditionsV1 {
+    schemaVersion: 1;
+    nodeId: string;
+    purpose: TNodeCredentialPurpose;
+    mutationId: string;
+    expectedGeneration: number;
+    expectedSessionEpoch: number;
+}
+export interface INodeCredentialMutationResultV1 {
+    metadata: INodeCredentialMetadataV1;
+    /** A replay returns the original result without restoring its authority. */
+    replayed: boolean;
+}

package/dist_ts/data/nodecredential.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZWNyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25vZGVjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist_ts/data/nodeenrollment.d.ts

@@ -0,0 +1,95 @@
+import type { TNodeCredentialPurpose } from './nodecredential.js';
+export interface INodeEnrollmentCredentialProposalV1 {
+    purpose: TNodeCredentialPurpose;
+    installationId: string;
+    mutationId: string;
+    /** SHA-256 of the independently generated, durably prepared bearer UTF-8 bytes. */
+    tokenHash: string;
+    expectedGeneration: number;
+    expectedSessionEpoch: number;
+}
+/** Value-free, immutable proposal. Hashes are still sensitive transport fields. */
+export interface INodeEnrollmentV1 {
+    schemaVersion: 1;
+    /** 32 CSPRNG bytes encoded as lowercase hexadecimal; retain across every retry. */
+    enrollmentId: string;
+    cloudlyOrigin: string;
+    hostname: string;
+    bootstrap: {
+        kind: 'jump';
+        proofHash: string;
+    } | {
+        kind: 'adopt-existing';
+        nodeId: string;
+        proofHash: string;
+    };
+    credentials: [
+        INodeEnrollmentCredentialProposalV1 & {
+            purpose: 'spark';
+        },
+        INodeEnrollmentCredentialProposalV1 & {
+            purpose: 'pallet';
+        }
+    ];
+}
+export interface INodeEnrollmentRequestV1 {
+    enrollment: INodeEnrollmentV1;
+    /** Never persist on the server, log, put in URLs, or expose in transport hooks. */
+    proof: {
+        kind: 'bootstrap' | 'pending-spark';
+        bearer: string;
+    };
+}
+export interface INodeEnrollmentCredentialAcknowledgementV1 {
+    purpose: TNodeCredentialPurpose;
+    installationId: string;
+    mutationId: string;
+    tokenHash: string;
+    generation: number;
+}
+/** Immutable commit evidence, not authorization or workload readiness. */
+export interface INodeEnrollmentAcknowledgementV1 {
+    schemaVersion: 1;
+    enrollmentId: string;
+    cloudlyOrigin: string;
+    nodeId: string;
+    requestDigest: string;
+    credentials: [
+        INodeEnrollmentCredentialAcknowledgementV1 & {
+            purpose: 'spark';
+        },
+        INodeEnrollmentCredentialAcknowledgementV1 & {
+            purpose: 'pallet';
+        }
+    ];
+}
+/** Returned only after current Spark authentication and proof that Pallet is absent. */
+export interface INodeEnrollmentStateV1 {
+    schemaVersion: 1;
+    nodeId: string;
+    spark: {
+        generation: number;
+        sessionEpoch: number;
+    };
+    pallet: 'absent';
+}
+export declare const nodeEnrollmentV1Contract: Readonly<{
+    readonly digestDomain: "serve.zone/node-enrollment-v1";
+    readonly localActivation: "independently-durable-convergence";
+    readonly bootstrapProof: "first-commit-only";
+    readonly pendingSparkProof: "committed-exact-receipt-only";
+}>;
+/** Detached frozen snapshot, captured synchronously before hashing or other awaits. */
+export declare const snapshotNodeEnrollmentV1: (valueArg: unknown) => INodeEnrollmentV1;
+export declare const computeNodeEnrollmentV1Digest: (valueArg: INodeEnrollmentV1) => Promise<string>;
+export declare const snapshotNodeEnrollmentRequestV1: (valueArg: unknown) => INodeEnrollmentRequestV1;
+/**
+ * Pure proof binding/mode check only, NOT authentication. The server must derive
+ * receiptState from its owned transaction, compare the complete stored proposal,
+ * and fence current Jump/Spark/Pallet authority before any commit or replay.
+ */
+export declare const verifyNodeEnrollmentProofV1: (valueArg: INodeEnrollmentRequestV1, receiptStateArg: "absent" | "committed") => Promise<boolean>;
+export declare const snapshotNodeEnrollmentAcknowledgementV1: (valueArg: unknown) => INodeEnrollmentAcknowledgementV1;
+/** Content binding only. Authenticate Cloudly first; persist only the returned snapshot. */
+export declare const bindNodeEnrollmentAcknowledgementV1: (enrollmentArg: INodeEnrollmentV1, acknowledgementArg: INodeEnrollmentAcknowledgementV1) => Promise<INodeEnrollmentAcknowledgementV1>;
+export declare const snapshotNodeEnrollmentStateV1: (valueArg: unknown) => INodeEnrollmentStateV1;

package/dist_ts/data/nodeenrollment.js

@@ -0,0 +1,186 @@
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex, createSha256Hex, deepFreezeValue, } from '../private/canonicaljson.js';
+export const nodeEnrollmentV1Contract = Object.freeze({
+    digestDomain: 'serve.zone/node-enrollment-v1',
+    localActivation: 'independently-durable-convergence',
+    bootstrapProof: 'first-commit-only',
+    pendingSparkProof: 'committed-exact-receipt-only',
+});
+const fail = () => { throw new Error('Node enrollment contract rejected.'); };
+function requireValue(valueArg) {
+    if (!valueArg)
+        fail();
+}
+/** Decoded JSON/data records only. No input accessor is executed or preserved. */
+const record = (valueArg, keysArg) => {
+    requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
+    const prototype = Object.getPrototypeOf(valueArg);
+    requireValue(prototype === Object.prototype || prototype === null);
+    const keys = Reflect.ownKeys(valueArg);
+    requireValue(keys.length === keysArg.length);
+    const snapshot = Object.create(null);
+    for (const key of keys) {
+        requireValue(typeof key === 'string' && keysArg.includes(key));
+        const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+        requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+        snapshot[key] = descriptor.value;
+    }
+    return snapshot;
+};
+const pair = (valueArg) => {
+    requireValue(Array.isArray(valueArg) && Object.getPrototypeOf(valueArg) === Array.prototype);
+    requireValue(Reflect.ownKeys(valueArg).length === 3 && valueArg.length === 2);
+    const first = Object.getOwnPropertyDescriptor(valueArg, '0');
+    const second = Object.getOwnPropertyDescriptor(valueArg, '1');
+    requireValue(first?.enumerable && Object.hasOwn(first, 'value'));
+    requireValue(second?.enumerable && Object.hasOwn(second, 'value'));
+    return [first.value, second.value];
+};
+const id = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg));
+    return valueArg;
+};
+const hash = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^[a-f0-9]{64}$/.test(valueArg));
+    return valueArg;
+};
+const counter = (valueArg, minimumArg = 0, incrementArg = false) => {
+    requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+        && !Object.is(valueArg, -0) && valueArg >= minimumArg
+        && (!incrementArg || valueArg < Number.MAX_SAFE_INTEGER));
+    return valueArg;
+};
+const origin = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && valueArg.length <= 2048);
+    let url;
+    try {
+        url = new URL(valueArg);
+    }
+    catch {
+        return fail();
+    }
+    requireValue(url.protocol === 'https:' && !url.username && !url.password && url.origin === valueArg);
+    return valueArg;
+};
+const hostname = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && valueArg.length <= 253 && valueArg.length > 0);
+    requireValue(valueArg.split('.').every((labelArg) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(labelArg)));
+    return valueArg;
+};
+const proposal = (valueArg, purposeArg) => {
+    const value = record(valueArg, ['purpose', 'installationId', 'mutationId', 'tokenHash',
+        'expectedGeneration', 'expectedSessionEpoch']);
+    requireValue(value.purpose === purposeArg);
+    return { purpose: purposeArg, installationId: id(value.installationId), mutationId: id(value.mutationId),
+        tokenHash: hash(value.tokenHash), expectedGeneration: counter(value.expectedGeneration, 0, true),
+        expectedSessionEpoch: counter(value.expectedSessionEpoch, 0, true) };
+};
+const distinctOwners = (sparkArg, palletArg) => {
+    requireValue(sparkArg.installationId !== palletArg.installationId
+        && sparkArg.mutationId !== palletArg.mutationId && sparkArg.tokenHash !== palletArg.tokenHash);
+};
+/** Detached frozen snapshot, captured synchronously before hashing or other awaits. */
+export const snapshotNodeEnrollmentV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'enrollmentId', 'cloudlyOrigin', 'hostname',
+        'bootstrap', 'credentials']);
+    requireValue(value.schemaVersion === 1);
+    // Read the discriminant from its data descriptor, never an input getter.
+    requireValue(value.bootstrap !== null && typeof value.bootstrap === 'object');
+    const kind = Object.getOwnPropertyDescriptor(value.bootstrap, 'kind');
+    requireValue(kind && Object.hasOwn(kind, 'value'));
+    const bootstrap = record(value.bootstrap, kind.value === 'jump'
+        ? ['kind', 'proofHash'] : ['kind', 'nodeId', 'proofHash']);
+    requireValue(bootstrap.kind === 'jump' || bootstrap.kind === 'adopt-existing');
+    const [sparkInput, palletInput] = pair(value.credentials);
+    const spark = proposal(sparkInput, 'spark');
+    const pallet = proposal(palletInput, 'pallet');
+    distinctOwners(spark, pallet);
+    requireValue(pallet.expectedGeneration === 0 && pallet.expectedSessionEpoch === 0);
+    requireValue(bootstrap.kind === 'jump'
+        ? spark.expectedGeneration === 0 && spark.expectedSessionEpoch === 0
+        : spark.expectedGeneration > 0);
+    return deepFreezeValue({ schemaVersion: 1, enrollmentId: hash(value.enrollmentId),
+        cloudlyOrigin: origin(value.cloudlyOrigin), hostname: hostname(value.hostname),
+        bootstrap: bootstrap.kind === 'jump'
+            ? { kind: 'jump', proofHash: hash(bootstrap.proofHash) }
+            : { kind: 'adopt-existing', nodeId: id(bootstrap.nodeId), proofHash: hash(bootstrap.proofHash) },
+        credentials: [spark, pallet] });
+};
+export const computeNodeEnrollmentV1Digest = async (valueArg) => {
+    const payload = snapshotNodeEnrollmentV1(valueArg);
+    return createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+        domain: nodeEnrollmentV1Contract.digestDomain, payload,
+    }, fail), fail);
+};
+export const snapshotNodeEnrollmentRequestV1 = (valueArg) => {
+    const value = record(valueArg, ['enrollment', 'proof']);
+    const enrollment = snapshotNodeEnrollmentV1(value.enrollment);
+    const proof = record(value.proof, ['kind', 'bearer']);
+    requireValue(proof.kind === 'bootstrap' || proof.kind === 'pending-spark');
+    requireValue(typeof proof.bearer === 'string');
+    requireValue(proof.kind === 'bootstrap' && enrollment.bootstrap.kind === 'jump'
+        ? /^[A-Za-z0-9_-]{16}$/.test(proof.bearer) : /^secureToken[a-f0-9]{64}$/.test(proof.bearer));
+    return deepFreezeValue({ enrollment, proof: { kind: proof.kind, bearer: proof.bearer } });
+};
+/**
+ * Pure proof binding/mode check only, NOT authentication. The server must derive
+ * receiptState from its owned transaction, compare the complete stored proposal,
+ * and fence current Jump/Spark/Pallet authority before any commit or replay.
+ */
+export const verifyNodeEnrollmentProofV1 = async (valueArg, receiptStateArg) => {
+    try {
+        const { enrollment, proof } = snapshotNodeEnrollmentRequestV1(valueArg);
+        if (!(proof.kind === 'bootstrap' && receiptStateArg === 'absent')
+            && !(proof.kind === 'pending-spark' && receiptStateArg === 'committed'))
+            return false;
+        // This helper hashes exact UTF-8 text; no JSON quoting or normalization.
+        const actual = await createSha256Hex(new TextEncoder().encode(proof.bearer), fail);
+        return actual === (proof.kind === 'bootstrap'
+            ? enrollment.bootstrap.proofHash : enrollment.credentials[0].tokenHash);
+    }
+    catch {
+        return false;
+    }
+};
+const credentialAcknowledgement = (valueArg, purposeArg) => {
+    const value = record(valueArg, ['purpose', 'installationId', 'mutationId', 'tokenHash', 'generation']);
+    requireValue(value.purpose === purposeArg);
+    return { purpose: purposeArg, installationId: id(value.installationId), mutationId: id(value.mutationId),
+        tokenHash: hash(value.tokenHash), generation: counter(value.generation, 1) };
+};
+export const snapshotNodeEnrollmentAcknowledgementV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'enrollmentId', 'cloudlyOrigin', 'nodeId',
+        'requestDigest', 'credentials']);
+    requireValue(value.schemaVersion === 1);
+    const [sparkInput, palletInput] = pair(value.credentials);
+    const spark = credentialAcknowledgement(sparkInput, 'spark');
+    const pallet = credentialAcknowledgement(palletInput, 'pallet');
+    distinctOwners(spark, pallet);
+    requireValue(pallet.generation === 1);
+    return deepFreezeValue({ schemaVersion: 1, enrollmentId: hash(value.enrollmentId),
+        cloudlyOrigin: origin(value.cloudlyOrigin), nodeId: id(value.nodeId),
+        requestDigest: hash(value.requestDigest), credentials: [spark, pallet] });
+};
+/** Content binding only. Authenticate Cloudly first; persist only the returned snapshot. */
+export const bindNodeEnrollmentAcknowledgementV1 = async (enrollmentArg, acknowledgementArg) => {
+    const enrollment = snapshotNodeEnrollmentV1(enrollmentArg);
+    const ack = snapshotNodeEnrollmentAcknowledgementV1(acknowledgementArg);
+    requireValue(ack.enrollmentId === enrollment.enrollmentId && ack.cloudlyOrigin === enrollment.cloudlyOrigin
+        && (enrollment.bootstrap.kind === 'jump' || ack.nodeId === enrollment.bootstrap.nodeId));
+    for (const index of [0, 1]) {
+        const expected = enrollment.credentials[index];
+        const actual = ack.credentials[index];
+        requireValue(actual.purpose === expected.purpose && actual.installationId === expected.installationId
+            && actual.mutationId === expected.mutationId && actual.tokenHash === expected.tokenHash
+            && actual.generation === expected.expectedGeneration + 1);
+    }
+    requireValue(ack.requestDigest === await computeNodeEnrollmentV1Digest(enrollment));
+    return ack;
+};
+export const snapshotNodeEnrollmentStateV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'nodeId', 'spark', 'pallet']);
+    requireValue(value.schemaVersion === 1 && value.pallet === 'absent');
+    const spark = record(value.spark, ['generation', 'sessionEpoch']);
+    return deepFreezeValue({ schemaVersion: 1, nodeId: id(value.nodeId), pallet: 'absent',
+        spark: { generation: counter(spark.generation, 1, true), sessionEpoch: counter(spark.sessionEpoch, 0, true) } });
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZWVucm9sbG1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25vZGVlbnJvbGxtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFDTCxzQkFBc0IsRUFDdEIsNEJBQTRCLEVBQzVCLGVBQWUsRUFDZixlQUFlLEdBQ2hCLE1BQU0sNkJBQTZCLENBQUM7QUErRHJDLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDcEQsWUFBWSxFQUFFLCtCQUErQjtJQUM3QyxlQUFlLEVBQUUsbUNBQW1DO0lBQ3BELGNBQWMsRUFBRSxtQkFBbUI7SUFDbkMsaUJBQWlCLEVBQUUsOEJBQThCO0NBQ3pDLENBQUMsQ0FBQztBQUVaLE1BQU0sSUFBSSxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNyRixTQUFTLFlBQVksQ0FBQyxRQUFpQjtJQUNyQyxJQUFJLENBQUMsUUFBUTtRQUFFLElBQUksRUFBRSxDQUFDO0FBQ3hCLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQTBCLEVBQTJCLEVBQUU7SUFDeEYsWUFBWSxDQUFDLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEQsWUFBWSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxJQUFJLFNBQVMsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUNuRSxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZDLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUM3QyxNQUFNLFFBQVEsR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM5RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ3ZCLFlBQVksQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQy9ELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDbEUsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUMzRSxRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQztJQUNuQyxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxJQUFJLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFO0lBQ3JELFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzdGLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztJQUM5RSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQzdELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDOUQsWUFBWSxDQUFDLEtBQUssRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNqRSxZQUFZLENBQUMsTUFBTSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ25FLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNyQyxDQUFDLENBQUM7QUFDRixNQUFNLEVBQUUsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUN2QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHdCQUF3QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ3pDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDOUUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFVBQVUsR0FBRyxDQUFDLEVBQUUsWUFBWSxHQUFHLEtBQUssRUFBVSxFQUFFO0lBQ2xGLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDdEUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLFFBQVEsSUFBSSxVQUFVO1dBQ2xELENBQUMsQ0FBQyxZQUFZLElBQUksUUFBUSxHQUFHLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDNUQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDM0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxDQUFDO0lBQ3RFLElBQUksR0FBUSxDQUFDO0lBQ2IsSUFBSSxDQUFDO1FBQUMsR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQ3pELFlBQVksQ0FBQyxHQUFHLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDckcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDN0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLEdBQUcsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVGLFlBQVksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQ2xELHdDQUF3QyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxRQUFRLEdBQUcsQ0FDZixRQUFpQixFQUFFLFVBQW9CLEVBQ3NCLEVBQUU7SUFDL0QsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFNBQVMsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsV0FBVztRQUNwRixvQkFBb0IsRUFBRSxzQkFBc0IsQ0FBQyxDQUFDLENBQUM7SUFDakQsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLENBQUM7SUFDM0MsT0FBTyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsY0FBYyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ3RHLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEVBQUUsQ0FBQyxFQUFFLElBQUksQ0FBQztRQUNoRyxvQkFBb0IsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLG9CQUFvQixFQUFFLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3pFLENBQUMsQ0FBQztBQUVGLE1BQU0sY0FBYyxHQUFHLENBQ3JCLFFBQTBGLEVBQzFGLFNBQTJGLEVBQ3JGLEVBQUU7SUFDUixZQUFZLENBQUMsUUFBUSxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsY0FBYztXQUM1RCxRQUFRLENBQUMsVUFBVSxLQUFLLFNBQVMsQ0FBQyxVQUFVLElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDbkcsQ0FBQyxDQUFDO0FBRUYsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsUUFBaUIsRUFBcUIsRUFBRTtJQUMvRSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsZUFBZSxFQUFFLGNBQWMsRUFBRSxlQUFlLEVBQUUsVUFBVTtRQUMxRixXQUFXLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUMvQixZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN4Qyx5RUFBeUU7SUFDekUsWUFBWSxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsQ0FBQztJQUM5RSxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0RSxZQUFZLENBQUMsSUFBSSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDbkQsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLEtBQUssS0FBSyxNQUFNO1FBQzdELENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDN0QsWUFBWSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssTUFBTSxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssZ0JBQWdCLENBQUMsQ0FBQztJQUMvRSxNQUFNLENBQUMsVUFBVSxFQUFFLFdBQVcsQ0FBQyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDMUQsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM1QyxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQy9DLGNBQWMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDOUIsWUFBWSxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLG9CQUFvQixLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ25GLFlBQVksQ0FBQyxTQUFTLENBQUMsSUFBSSxLQUFLLE1BQU07UUFDcEMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLG9CQUFvQixLQUFLLENBQUM7UUFDcEUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNsQyxPQUFPLGVBQWUsQ0FBQyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQy9FLGFBQWEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQztRQUM5RSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNO1lBQ2xDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEVBQUU7WUFDeEQsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFO1FBQ2xHLFdBQVcsRUFBRSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDcEMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUFFLFFBQTJCLEVBQW1CLEVBQUU7SUFDbEcsTUFBTSxPQUFPLEdBQUcsd0JBQXdCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkQsT0FBTyw0QkFBNEIsQ0FBQyxzQkFBc0IsQ0FBQztRQUN6RCxNQUFNLEVBQUUsd0JBQXdCLENBQUMsWUFBWSxFQUFFLE9BQU87S0FDdkQsRUFBRSxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLFFBQWlCLEVBQTRCLEVBQUU7SUFDN0YsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3hELE1BQU0sVUFBVSxHQUFHLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUM5RCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3RELFlBQVksQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGVBQWUsQ0FBQyxDQUFDO0lBQzNFLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDL0MsWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssV0FBVyxJQUFJLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxLQUFLLE1BQU07UUFDN0UsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLDJCQUEyQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMvRixPQUFPLGVBQWUsQ0FBQyxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztBQUM1RixDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxRQUFrQyxFQUFFLGVBQXVDLEVBQ3pELEVBQUU7SUFDcEIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsR0FBRywrQkFBK0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN4RSxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsSUFBSSxlQUFlLEtBQUssUUFBUSxDQUFDO2VBQzVELENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLGVBQWUsSUFBSSxlQUFlLEtBQUssV0FBVyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDeEYseUVBQXlFO1FBQ3pFLE1BQU0sTUFBTSxHQUFHLE1BQU0sZUFBZSxDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNuRixPQUFPLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssV0FBVztZQUMzQyxDQUFDLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sS0FBSyxDQUFDO0lBQUMsQ0FBQztBQUMzQixDQUFDLENBQUM7QUFFRixNQUFNLHlCQUF5QixHQUFHLENBQ2hDLFFBQWlCLEVBQUUsVUFBb0IsRUFDNkIsRUFBRTtJQUN0RSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsU0FBUyxFQUFFLGdCQUFnQixFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUN2RyxZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sS0FBSyxVQUFVLENBQUMsQ0FBQztJQUMzQyxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxjQUFjLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsRUFBRSxVQUFVLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDdEcsU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsVUFBVSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQyxFQUFFLENBQUM7QUFDakYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsUUFBaUIsRUFDaUIsRUFBRTtJQUNwQyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsZUFBZSxFQUFFLGNBQWMsRUFBRSxlQUFlLEVBQUUsUUFBUTtRQUN4RixlQUFlLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUNuQyxZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN4QyxNQUFNLENBQUMsVUFBVSxFQUFFLFdBQVcsQ0FBQyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDMUQsTUFBTSxLQUFLLEdBQUcseUJBQXlCLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzdELE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNoRSxjQUFjLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzlCLFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3RDLE9BQU8sZUFBZSxDQUFDLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxZQUFZLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7UUFDL0UsYUFBYSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQUUsTUFBTSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3BFLGFBQWEsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDOUUsQ0FBQyxDQUFDO0FBRUYsNEZBQTRGO0FBQzVGLE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLEtBQUssRUFDdEQsYUFBZ0MsRUFBRSxrQkFBb0QsRUFDM0MsRUFBRTtJQUM3QyxNQUFNLFVBQVUsR0FBRyx3QkFBd0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMzRCxNQUFNLEdBQUcsR0FBRyx1Q0FBdUMsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ3hFLFlBQVksQ0FBQyxHQUFHLENBQUMsWUFBWSxLQUFLLFVBQVUsQ0FBQyxZQUFZLElBQUksR0FBRyxDQUFDLGFBQWEsS0FBSyxVQUFVLENBQUMsYUFBYTtXQUN0RyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxLQUFLLE1BQU0sSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMzRixLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBVSxFQUFFLENBQUM7UUFDcEMsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3RDLFlBQVksQ0FBQyxNQUFNLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxPQUFPLElBQUksTUFBTSxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsY0FBYztlQUNoRyxNQUFNLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUztlQUNwRixNQUFNLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxrQkFBa0IsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsWUFBWSxDQUFDLEdBQUcsQ0FBQyxhQUFhLEtBQUssTUFBTSw2QkFBNkIsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FBQyxRQUFpQixFQUEwQixFQUFFO0lBQ3pGLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQy9FLFlBQVksQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ3JFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUMsWUFBWSxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDbEUsT0FBTyxlQUFlLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRO1FBQ25GLEtBQUssRUFBRSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztBQUNySCxDQUFDLENBQUMifQ==

package/dist_ts/requests/node.d.ts

@@ -4,15 +4,72 @@ import type { ICluster } from '../data/cluster.js';
 import type { IClusterNode, IClusterNodeMetrics, INodeAction, INodeMetricsSample, ISparkNodeRuntimeInfo, TNodeActionName } from '../data/clusternode.js';
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
-export interface IRequest_Any_Cloudly_GetNodeConfig {
+import type { INodeCredentialMetadataV1, INodeCredentialMutationPreconditionsV1, INodeCredentialMutationResultV1, TNodeCredentialPurpose } from '../data/nodecredential.js';
+import type { INodeEnrollmentRequestV1, INodeEnrollmentAcknowledgementV1, INodeEnrollmentStateV1 } from '../data/nodeenrollment.js';
+/** Node-self adoption preconditions, not an admin or workload RBAC grant. */
+export interface IReq_Spark_Cloudly_GetNodeEnrollmentStateV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Cloudly_GetNodeEnrollmentStateV1> {
+    method: 'getNodeEnrollmentStateV1';
+    request: {
+        nodeId: string;
+        nodeToken: string;
+    };
+    /** Reject unless Spark is currently authenticated and Pallet authority is absent. */
+    response: INodeEnrollmentStateV1;
+}
+/** One server transaction; each node-local owner durably activates independently. */
+export interface IReq_Spark_Cloudly_EnrollNodeV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Cloudly_EnrollNodeV1> {
+    method: 'enrollNodeV1';
+    request: INodeEnrollmentRequestV1;
+    /** Replays require the exact receipt AND both current credential authorities. */
+    response: INodeEnrollmentAcknowledgementV1;
+}
+/** Requires verified platform-infrastructure admin authority; returns public data only. */
+export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetNodeConfig> {
     method: 'getNodeConfig';
     request: {
+        identity: IIdentity;
         nodeId: string;
     };
     response: {
         configData: IClusterNode;
     };
 }
+/** These credential methods require verified infrastructure-admin authority. */
+export interface IReq_Any_Cloudly_GetNodeCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetNodeCredential> {
+    method: 'getNodeCredential';
+    request: {
+        identity: IIdentity;
+        nodeId: string;
+        purpose: TNodeCredentialPurpose;
+    };
+    response: {
+        metadata: INodeCredentialMetadataV1 | null;
+    };
+}
+export interface IReq_Any_Cloudly_RotateNodeCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_RotateNodeCredential> {
+    method: 'rotateNodeCredential';
+    request: {
+        identity: IIdentity;
+        mutation: INodeCredentialMutationPreconditionsV1 & {
+            /**
+             * SHA-256(token UTF-8 bytes), exactly 64 lowercase hexadecimal characters.
+             * The node must durably retain its pending CSPRNG credential and mutation
+             * identity before this request. A metadata-only retry never issues plaintext.
+             * Treat this request field as sensitive; never include it in hooks or logs.
+             */
+            newTokenHash: string;
+        };
+    };
+    response: INodeCredentialMutationResultV1;
+}
+export interface IReq_Any_Cloudly_RevokeNodeCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_RevokeNodeCredential> {
+    method: 'revokeNodeCredential';
+    request: {
+        identity: IIdentity;
+        mutation: INodeCredentialMutationPreconditionsV1;
+    };
+    response: INodeCredentialMutationResultV1;
+}
 export interface IRequest_Any_Cloudly_GetNodesByCluster {
     method: 'getNodesByCluster';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "27.5.0",
+  "version": "28.1.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -47,6 +47,65 @@ validator; unlike `@serve.zone/interfaces/runtime`, it does not load the general
 runtime graph, `plugins.js`, SmartCrypto, TypedRequest, Corestore, or settlement
 runtime modules.
 
+### Node Credential Administration
+
+`requests.node` defines `getNodeCredential`, `rotateNodeCredential` and
+`revokeNodeCredential` for verified platform-infrastructure administrators.
+`getNodeConfig` now also requires `identity`; callers using the previous
+unauthenticated request shape must update. Its response remains the public
+`IClusterNode`, never a persisted backend document.
+
+`data.INodeCredentialMetadataV1` separates `spark` and `pallet` purposes and
+exposes lifecycle state, generation, rotation-required status and session epoch,
+but no bearer, hash, socket peer or controller process identity. Infrastructure
+credentials do not grant organization or workload permissions.
+
+Mutations require the exact generation and session epoch plus a stable mutation
+ID. Rotation takes the SHA-256 hash of a node-generated CSPRNG credential that the
+node has already durably retained with that mutation ID. Lost-response retries
+repeat the complete request and receive the original metadata, never newly minted
+plaintext. A replay result is historical and cannot authorize a current session.
+Treat rotation request hashes as sensitive in transport hooks and logs.
+
+These types do not implement authentication, storage, enrollment or endpoints.
+Cloudly must verify current administrator authority, validate complete inputs,
+atomically persist the credential transition and immutable actor-bound receipt,
+and fence subsequent control effects against current durable credential/session
+authority. Node identity storage and transport integration must be qualified
+before enabling rotation or Pallet enrollment.
+
+### Independent Node Enrollment
+
+`requests.node` defines `getNodeEnrollmentStateV1` for current Spark-authenticated
+adoption preconditions and `enrollNodeV1` for atomic Spark/Pallet enrollment. These
+contracts do not implement endpoints, authentication, a database or a daemon.
+
+The enrollment proposal binds the canonical HTTPS Cloudly origin, hostname,
+enrollment identity, original bootstrap proof hash and an exact ordered pair of
+independently prepared Spark/Pallet credential hashes and CAS counters. Fresh Jump
+starts both at zero; existing-node adoption rotates current Spark and requires
+Pallet authority to be absent. `snapshotNodeEnrollmentV1` returns a detached,
+frozen snapshot; `computeNodeEnrollmentV1Digest` hashes domain-separated strict
+canonical JSON. Neither helper generates or persists credential material.
+
+Transport proof is excluded from the digest to permit exact lost-response
+recovery. Bootstrap proof must hash to the original proof hash and is allowed only
+before a receipt exists. Pending-Spark proof must hash to the prepared Spark hash
+and is allowed only for an existing exact receipt. `verifyNodeEnrollmentProofV1`
+checks this binding and mode only: Cloudly must derive receipt state itself and
+fence live bootstrap/credential authority in the same owned transaction. Current
+Jump codes are 12 random bytes encoded as 16 canonical base64url characters.
+
+`bindNodeEnrollmentAcknowledgementV1` checks the complete digest, both owners,
+exact next generations and unchanged adopted node ID, returning a detached frozen
+acknowledgement. Authenticate Cloudly before accepting it. The acknowledgement is
+immutable commit evidence, not ongoing authority or workload readiness. Server
+replay must still verify both active credential generations and hashes; reporter
+reconnect alone does not invalidate the credential. Spark and Pallet commit their
+local activation independently and converge after restart; there is no shared
+plaintext vault or cross-local-database ACID claim. Never log proof/request bodies
+or hashes, put them in URLs, or expose them through transport hooks.
+
 ### Node-Bound Runtime Assignments
 
 The `data` namespace exports `IRuntimeAssignmentV1`, canonical digest helpers,

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '27.5.0',
+  version: '28.1.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -20,6 +20,8 @@ export * from './immutableimage.js';
 export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
+export * from './nodecredential.js';
+export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
 export * from './secret.js';

package/ts/data/nodecredential.ts

@@ -0,0 +1,41 @@
+/** Independent infrastructure credentials; neither purpose grants workload RBAC. */
+export type TNodeCredentialPurpose = 'spark' | 'pallet';
+
+/**
+ * Public inspection and mutation-result metadata. Never includes bearer material,
+ * hashes, socket peer IDs or controller process IDs. On replay this is historical
+ * evidence, not an assertion that a credential or reporter session is still live.
+ */
+export interface INodeCredentialMetadataV1 {
+  schemaVersion: 1;
+  nodeId: string;
+  purpose: TNodeCredentialPurpose;
+  state: 'active' | 'revoked';
+  generation: number;
+  /** Migrated Spark credentials remain usable only until their staged rotation. */
+  requiresRotation: boolean;
+  sessionEpoch: number;
+  sessionId: string | null;
+  createdAt: number;
+  updatedAt: number;
+}
+
+/**
+ * Infrastructure-admin mutation preconditions. Both counters are exact CAS
+ * preconditions, not minimums. Retrying must retain this complete input and the
+ * original mutationId; a changed request with the same ID must fail closed.
+ */
+export interface INodeCredentialMutationPreconditionsV1 {
+  schemaVersion: 1;
+  nodeId: string;
+  purpose: TNodeCredentialPurpose;
+  mutationId: string;
+  expectedGeneration: number;
+  expectedSessionEpoch: number;
+}
+
+export interface INodeCredentialMutationResultV1 {
+  metadata: INodeCredentialMetadataV1;
+  /** A replay returns the original result without restoring its authority. */
+  replayed: boolean;
+}

package/ts/data/nodeenrollment.ts

@@ -0,0 +1,270 @@
+import type { TNodeCredentialPurpose } from './nodecredential.js';
+import {
+  canonicalizeStrictJson,
+  createCanonicalJsonSha256Hex,
+  createSha256Hex,
+  deepFreezeValue,
+} from '../private/canonicaljson.js';
+
+export interface INodeEnrollmentCredentialProposalV1 {
+  purpose: TNodeCredentialPurpose;
+  installationId: string;
+  mutationId: string;
+  /** SHA-256 of the independently generated, durably prepared bearer UTF-8 bytes. */
+  tokenHash: string;
+  expectedGeneration: number;
+  expectedSessionEpoch: number;
+}
+
+/** Value-free, immutable proposal. Hashes are still sensitive transport fields. */
+export interface INodeEnrollmentV1 {
+  schemaVersion: 1;
+  /** 32 CSPRNG bytes encoded as lowercase hexadecimal; retain across every retry. */
+  enrollmentId: string;
+  cloudlyOrigin: string;
+  hostname: string;
+  bootstrap:
+    | { kind: 'jump'; proofHash: string }
+    | { kind: 'adopt-existing'; nodeId: string; proofHash: string };
+  credentials: [
+    INodeEnrollmentCredentialProposalV1 & { purpose: 'spark' },
+    INodeEnrollmentCredentialProposalV1 & { purpose: 'pallet' },
+  ];
+}
+
+export interface INodeEnrollmentRequestV1 {
+  enrollment: INodeEnrollmentV1;
+  /** Never persist on the server, log, put in URLs, or expose in transport hooks. */
+  proof: { kind: 'bootstrap' | 'pending-spark'; bearer: string };
+}
+
+export interface INodeEnrollmentCredentialAcknowledgementV1 {
+  purpose: TNodeCredentialPurpose;
+  installationId: string;
+  mutationId: string;
+  tokenHash: string;
+  generation: number;
+}
+
+/** Immutable commit evidence, not authorization or workload readiness. */
+export interface INodeEnrollmentAcknowledgementV1 {
+  schemaVersion: 1;
+  enrollmentId: string;
+  cloudlyOrigin: string;
+  nodeId: string;
+  requestDigest: string;
+  credentials: [
+    INodeEnrollmentCredentialAcknowledgementV1 & { purpose: 'spark' },
+    INodeEnrollmentCredentialAcknowledgementV1 & { purpose: 'pallet' },
+  ];
+}
+
+/** Returned only after current Spark authentication and proof that Pallet is absent. */
+export interface INodeEnrollmentStateV1 {
+  schemaVersion: 1;
+  nodeId: string;
+  spark: { generation: number; sessionEpoch: number };
+  pallet: 'absent';
+}
+
+export const nodeEnrollmentV1Contract = Object.freeze({
+  digestDomain: 'serve.zone/node-enrollment-v1',
+  localActivation: 'independently-durable-convergence',
+  bootstrapProof: 'first-commit-only',
+  pendingSparkProof: 'committed-exact-receipt-only',
+} as const);
+
+const fail = (): never => { throw new Error('Node enrollment contract rejected.'); };
+function requireValue(valueArg: unknown): asserts valueArg {
+  if (!valueArg) fail();
+}
+
+/** Decoded JSON/data records only. No input accessor is executed or preserved. */
+const record = (valueArg: unknown, keysArg: readonly string[]): Record<string, unknown> => {
+  requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
+  const prototype = Object.getPrototypeOf(valueArg);
+  requireValue(prototype === Object.prototype || prototype === null);
+  const keys = Reflect.ownKeys(valueArg);
+  requireValue(keys.length === keysArg.length);
+  const snapshot: Record<string, unknown> = Object.create(null);
+  for (const key of keys) {
+    requireValue(typeof key === 'string' && keysArg.includes(key));
+    const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+    snapshot[key] = descriptor.value;
+  }
+  return snapshot;
+};
+
+const pair = (valueArg: unknown): [unknown, unknown] => {
+  requireValue(Array.isArray(valueArg) && Object.getPrototypeOf(valueArg) === Array.prototype);
+  requireValue(Reflect.ownKeys(valueArg).length === 3 && valueArg.length === 2);
+  const first = Object.getOwnPropertyDescriptor(valueArg, '0');
+  const second = Object.getOwnPropertyDescriptor(valueArg, '1');
+  requireValue(first?.enumerable && Object.hasOwn(first, 'value'));
+  requireValue(second?.enumerable && Object.hasOwn(second, 'value'));
+  return [first.value, second.value];
+};
+const id = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg));
+  return valueArg;
+};
+const hash = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && /^[a-f0-9]{64}$/.test(valueArg));
+  return valueArg;
+};
+const counter = (valueArg: unknown, minimumArg = 0, incrementArg = false): number => {
+  requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+    && !Object.is(valueArg, -0) && valueArg >= minimumArg
+    && (!incrementArg || valueArg < Number.MAX_SAFE_INTEGER));
+  return valueArg;
+};
+const origin = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && valueArg.length <= 2048);
+  let url: URL;
+  try { url = new URL(valueArg); } catch { return fail(); }
+  requireValue(url.protocol === 'https:' && !url.username && !url.password && url.origin === valueArg);
+  return valueArg;
+};
+const hostname = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && valueArg.length <= 253 && valueArg.length > 0);
+  requireValue(valueArg.split('.').every((labelArg) =>
+    /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(labelArg)));
+  return valueArg;
+};
+
+const proposal = <TPurpose extends TNodeCredentialPurpose>(
+  valueArg: unknown, purposeArg: TPurpose,
+): INodeEnrollmentCredentialProposalV1 & { purpose: TPurpose } => {
+  const value = record(valueArg, ['purpose', 'installationId', 'mutationId', 'tokenHash',
+    'expectedGeneration', 'expectedSessionEpoch']);
+  requireValue(value.purpose === purposeArg);
+  return { purpose: purposeArg, installationId: id(value.installationId), mutationId: id(value.mutationId),
+    tokenHash: hash(value.tokenHash), expectedGeneration: counter(value.expectedGeneration, 0, true),
+    expectedSessionEpoch: counter(value.expectedSessionEpoch, 0, true) };
+};
+
+const distinctOwners = (
+  sparkArg: INodeEnrollmentCredentialAcknowledgementV1 | INodeEnrollmentCredentialProposalV1,
+  palletArg: INodeEnrollmentCredentialAcknowledgementV1 | INodeEnrollmentCredentialProposalV1,
+): void => {
+  requireValue(sparkArg.installationId !== palletArg.installationId
+    && sparkArg.mutationId !== palletArg.mutationId && sparkArg.tokenHash !== palletArg.tokenHash);
+};
+
+/** Detached frozen snapshot, captured synchronously before hashing or other awaits. */
+export const snapshotNodeEnrollmentV1 = (valueArg: unknown): INodeEnrollmentV1 => {
+  const value = record(valueArg, ['schemaVersion', 'enrollmentId', 'cloudlyOrigin', 'hostname',
+    'bootstrap', 'credentials']);
+  requireValue(value.schemaVersion === 1);
+  // Read the discriminant from its data descriptor, never an input getter.
+  requireValue(value.bootstrap !== null && typeof value.bootstrap === 'object');
+  const kind = Object.getOwnPropertyDescriptor(value.bootstrap, 'kind');
+  requireValue(kind && Object.hasOwn(kind, 'value'));
+  const bootstrap = record(value.bootstrap, kind.value === 'jump'
+    ? ['kind', 'proofHash'] : ['kind', 'nodeId', 'proofHash']);
+  requireValue(bootstrap.kind === 'jump' || bootstrap.kind === 'adopt-existing');
+  const [sparkInput, palletInput] = pair(value.credentials);
+  const spark = proposal(sparkInput, 'spark');
+  const pallet = proposal(palletInput, 'pallet');
+  distinctOwners(spark, pallet);
+  requireValue(pallet.expectedGeneration === 0 && pallet.expectedSessionEpoch === 0);
+  requireValue(bootstrap.kind === 'jump'
+    ? spark.expectedGeneration === 0 && spark.expectedSessionEpoch === 0
+    : spark.expectedGeneration > 0);
+  return deepFreezeValue({ schemaVersion: 1, enrollmentId: hash(value.enrollmentId),
+    cloudlyOrigin: origin(value.cloudlyOrigin), hostname: hostname(value.hostname),
+    bootstrap: bootstrap.kind === 'jump'
+      ? { kind: 'jump', proofHash: hash(bootstrap.proofHash) }
+      : { kind: 'adopt-existing', nodeId: id(bootstrap.nodeId), proofHash: hash(bootstrap.proofHash) },
+    credentials: [spark, pallet] });
+};
+
+export const computeNodeEnrollmentV1Digest = async (valueArg: INodeEnrollmentV1): Promise<string> => {
+  const payload = snapshotNodeEnrollmentV1(valueArg);
+  return createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+    domain: nodeEnrollmentV1Contract.digestDomain, payload,
+  }, fail), fail);
+};
+
+export const snapshotNodeEnrollmentRequestV1 = (valueArg: unknown): INodeEnrollmentRequestV1 => {
+  const value = record(valueArg, ['enrollment', 'proof']);
+  const enrollment = snapshotNodeEnrollmentV1(value.enrollment);
+  const proof = record(value.proof, ['kind', 'bearer']);
+  requireValue(proof.kind === 'bootstrap' || proof.kind === 'pending-spark');
+  requireValue(typeof proof.bearer === 'string');
+  requireValue(proof.kind === 'bootstrap' && enrollment.bootstrap.kind === 'jump'
+    ? /^[A-Za-z0-9_-]{16}$/.test(proof.bearer) : /^secureToken[a-f0-9]{64}$/.test(proof.bearer));
+  return deepFreezeValue({ enrollment, proof: { kind: proof.kind, bearer: proof.bearer } });
+};
+
+/**
+ * Pure proof binding/mode check only, NOT authentication. The server must derive
+ * receiptState from its owned transaction, compare the complete stored proposal,
+ * and fence current Jump/Spark/Pallet authority before any commit or replay.
+ */
+export const verifyNodeEnrollmentProofV1 = async (
+  valueArg: INodeEnrollmentRequestV1, receiptStateArg: 'absent' | 'committed',
+): Promise<boolean> => {
+  try {
+    const { enrollment, proof } = snapshotNodeEnrollmentRequestV1(valueArg);
+    if (!(proof.kind === 'bootstrap' && receiptStateArg === 'absent')
+      && !(proof.kind === 'pending-spark' && receiptStateArg === 'committed')) return false;
+    // This helper hashes exact UTF-8 text; no JSON quoting or normalization.
+    const actual = await createSha256Hex(new TextEncoder().encode(proof.bearer), fail);
+    return actual === (proof.kind === 'bootstrap'
+      ? enrollment.bootstrap.proofHash : enrollment.credentials[0].tokenHash);
+  } catch { return false; }
+};
+
+const credentialAcknowledgement = <TPurpose extends TNodeCredentialPurpose>(
+  valueArg: unknown, purposeArg: TPurpose,
+): INodeEnrollmentCredentialAcknowledgementV1 & { purpose: TPurpose } => {
+  const value = record(valueArg, ['purpose', 'installationId', 'mutationId', 'tokenHash', 'generation']);
+  requireValue(value.purpose === purposeArg);
+  return { purpose: purposeArg, installationId: id(value.installationId), mutationId: id(value.mutationId),
+    tokenHash: hash(value.tokenHash), generation: counter(value.generation, 1) };
+};
+
+export const snapshotNodeEnrollmentAcknowledgementV1 = (
+  valueArg: unknown,
+): INodeEnrollmentAcknowledgementV1 => {
+  const value = record(valueArg, ['schemaVersion', 'enrollmentId', 'cloudlyOrigin', 'nodeId',
+    'requestDigest', 'credentials']);
+  requireValue(value.schemaVersion === 1);
+  const [sparkInput, palletInput] = pair(value.credentials);
+  const spark = credentialAcknowledgement(sparkInput, 'spark');
+  const pallet = credentialAcknowledgement(palletInput, 'pallet');
+  distinctOwners(spark, pallet);
+  requireValue(pallet.generation === 1);
+  return deepFreezeValue({ schemaVersion: 1, enrollmentId: hash(value.enrollmentId),
+    cloudlyOrigin: origin(value.cloudlyOrigin), nodeId: id(value.nodeId),
+    requestDigest: hash(value.requestDigest), credentials: [spark, pallet] });
+};
+
+/** Content binding only. Authenticate Cloudly first; persist only the returned snapshot. */
+export const bindNodeEnrollmentAcknowledgementV1 = async (
+  enrollmentArg: INodeEnrollmentV1, acknowledgementArg: INodeEnrollmentAcknowledgementV1,
+): Promise<INodeEnrollmentAcknowledgementV1> => {
+  const enrollment = snapshotNodeEnrollmentV1(enrollmentArg);
+  const ack = snapshotNodeEnrollmentAcknowledgementV1(acknowledgementArg);
+  requireValue(ack.enrollmentId === enrollment.enrollmentId && ack.cloudlyOrigin === enrollment.cloudlyOrigin
+    && (enrollment.bootstrap.kind === 'jump' || ack.nodeId === enrollment.bootstrap.nodeId));
+  for (const index of [0, 1] as const) {
+    const expected = enrollment.credentials[index];
+    const actual = ack.credentials[index];
+    requireValue(actual.purpose === expected.purpose && actual.installationId === expected.installationId
+      && actual.mutationId === expected.mutationId && actual.tokenHash === expected.tokenHash
+      && actual.generation === expected.expectedGeneration + 1);
+  }
+  requireValue(ack.requestDigest === await computeNodeEnrollmentV1Digest(enrollment));
+  return ack;
+};
+
+export const snapshotNodeEnrollmentStateV1 = (valueArg: unknown): INodeEnrollmentStateV1 => {
+  const value = record(valueArg, ['schemaVersion', 'nodeId', 'spark', 'pallet']);
+  requireValue(value.schemaVersion === 1 && value.pallet === 'absent');
+  const spark = record(value.spark, ['generation', 'sessionEpoch']);
+  return deepFreezeValue({ schemaVersion: 1, nodeId: id(value.nodeId), pallet: 'absent',
+    spark: { generation: counter(spark.generation, 1, true), sessionEpoch: counter(spark.sessionEpoch, 0, true) } });
+};

package/ts/requests/node.ts

@@ -4,10 +4,48 @@ import type { ICluster } from '../data/cluster.js';
 import type { IClusterNode, IClusterNodeMetrics, INodeAction, INodeMetricsSample, ISparkNodeRuntimeInfo, TNodeActionName } from '../data/clusternode.js';
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
+import type {
+  INodeCredentialMetadataV1,
+  INodeCredentialMutationPreconditionsV1,
+  INodeCredentialMutationResultV1,
+  TNodeCredentialPurpose,
+} from '../data/nodecredential.js';
+import type {
+  INodeEnrollmentRequestV1,
+  INodeEnrollmentAcknowledgementV1,
+  INodeEnrollmentStateV1,
+} from '../data/nodeenrollment.js';
 
-export interface IRequest_Any_Cloudly_GetNodeConfig {
+/** Node-self adoption preconditions, not an admin or workload RBAC grant. */
+export interface IReq_Spark_Cloudly_GetNodeEnrollmentStateV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Cloudly_GetNodeEnrollmentStateV1
+> {
+  method: 'getNodeEnrollmentStateV1';
+  request: { nodeId: string; nodeToken: string };
+  /** Reject unless Spark is currently authenticated and Pallet authority is absent. */
+  response: INodeEnrollmentStateV1;
+}
+
+/** One server transaction; each node-local owner durably activates independently. */
+export interface IReq_Spark_Cloudly_EnrollNodeV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Cloudly_EnrollNodeV1
+> {
+  method: 'enrollNodeV1';
+  request: INodeEnrollmentRequestV1;
+  /** Replays require the exact receipt AND both current credential authorities. */
+  response: INodeEnrollmentAcknowledgementV1;
+}
+
+/** Requires verified platform-infrastructure admin authority; returns public data only. */
+export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IRequest_Any_Cloudly_GetNodeConfig
+> {
   method: 'getNodeConfig';
   request: {
+    identity: IIdentity;
     nodeId: string;
   };
   response: {
@@ -15,6 +53,54 @@ export interface IRequest_Any_Cloudly_GetNodeConfig {
   };
 }
 
+/** These credential methods require verified infrastructure-admin authority. */
+export interface IReq_Any_Cloudly_GetNodeCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Any_Cloudly_GetNodeCredential
+> {
+  method: 'getNodeCredential';
+  request: {
+    identity: IIdentity;
+    nodeId: string;
+    purpose: TNodeCredentialPurpose;
+  };
+  response: {
+    metadata: INodeCredentialMetadataV1 | null;
+  };
+}
+
+export interface IReq_Any_Cloudly_RotateNodeCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Any_Cloudly_RotateNodeCredential
+> {
+  method: 'rotateNodeCredential';
+  request: {
+    identity: IIdentity;
+    mutation: INodeCredentialMutationPreconditionsV1 & {
+      /**
+       * SHA-256(token UTF-8 bytes), exactly 64 lowercase hexadecimal characters.
+       * The node must durably retain its pending CSPRNG credential and mutation
+       * identity before this request. A metadata-only retry never issues plaintext.
+       * Treat this request field as sensitive; never include it in hooks or logs.
+       */
+      newTokenHash: string;
+    };
+  };
+  response: INodeCredentialMutationResultV1;
+}
+
+export interface IReq_Any_Cloudly_RevokeNodeCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Any_Cloudly_RevokeNodeCredential
+> {
+  method: 'revokeNodeCredential';
+  request: {
+    identity: IIdentity;
+    mutation: INodeCredentialMutationPreconditionsV1;
+  };
+  response: INodeCredentialMutationResultV1;
+}
+
 export interface IRequest_Any_Cloudly_GetNodesByCluster {
   method: 'getNodesByCluster';
   request: {