@serve.zone/interfaces 28.0.0 → 28.2.0

package/changelog.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## 2026-09-06 - 28.2.0
+
+### Features
+
+- add Pallet node enrollment IPC contracts (pallet-enrollment)
+  - Add Pallet node enrollment preparation, activation, and confirmation data contracts with snapshot and binding helpers.
+  - Export requests.pallet typed methods for prepare, bind, and activate enrollment flows.
+  - Document Pallet IPC framing limits and validation responsibilities with test coverage for enrollment semantics.
+
+## 2026-09-06 - 28.1.0
+
+### Features
+
+- add independent node enrollment contracts (node-enrollment)
+  - Export node enrollment data interfaces and helpers for strict snapshots, canonical digests, proof verification, acknowledgement binding, and state snapshots.
+  - Add node TypedRequest contracts for enrollment state checks and node enrollment transactions.
+  - Document node enrollment semantics and add tests for digest binding, proof validation, acknowledgement validation, and TypedRequest ownership.
+
+### Fixes
+
+- use qualified pnpm 11.25.0 for exact release packaging (package)
+  - Select the GitZone-qualified version permitted by the existing release-age policy.
+  - Remove the inactive pnpm 12 bootstrap lock document without changing application dependencies.
+- clarify pnpm release packaging changelog entry (changelog)
+  - Consolidates duplicate pnpm pinning notes into a single package fix entry.
+  - Documents qualified pnpm 11.25.0 selection for release packaging.
+
 ## 2026-09-05 - 28.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '28.0.0',
+    version: '28.2.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -21,6 +21,7 @@ export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
+export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
 export * from './secret.js';

package/dist_ts/data/index.js

@@ -21,6 +21,7 @@ export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
+export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
 export * from './secret.js';
@@ -37,4 +38,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==

package/dist_ts/data/nodeenrollment.d.ts

@@ -0,0 +1,152 @@
+import type { TNodeCredentialPurpose } from './nodecredential.js';
+export interface INodeEnrollmentCredentialProposalV1 {
+    purpose: TNodeCredentialPurpose;
+    installationId: string;
+    mutationId: string;
+    /** SHA-256 of the independently generated, durably prepared bearer UTF-8 bytes. */
+    tokenHash: string;
+    expectedGeneration: number;
+    expectedSessionEpoch: number;
+}
+/** Value-free, immutable proposal. Hashes are still sensitive transport fields. */
+export interface INodeEnrollmentV1 {
+    schemaVersion: 1;
+    /** 32 CSPRNG bytes encoded as lowercase hexadecimal; retain across every retry. */
+    enrollmentId: string;
+    cloudlyOrigin: string;
+    hostname: string;
+    bootstrap: {
+        kind: 'jump';
+        proofHash: string;
+    } | {
+        kind: 'adopt-existing';
+        nodeId: string;
+        proofHash: string;
+    };
+    credentials: [
+        INodeEnrollmentCredentialProposalV1 & {
+            purpose: 'spark';
+        },
+        INodeEnrollmentCredentialProposalV1 & {
+            purpose: 'pallet';
+        }
+    ];
+}
+export interface INodeEnrollmentRequestV1 {
+    enrollment: INodeEnrollmentV1;
+    /** Never persist on the server, log, put in URLs, or expose in transport hooks. */
+    proof: {
+        kind: 'bootstrap' | 'pending-spark';
+        bearer: string;
+    };
+}
+export interface INodeEnrollmentCredentialAcknowledgementV1 {
+    purpose: TNodeCredentialPurpose;
+    installationId: string;
+    mutationId: string;
+    tokenHash: string;
+    generation: number;
+}
+/** Immutable commit evidence, not authorization or workload readiness. */
+export interface INodeEnrollmentAcknowledgementV1 {
+    schemaVersion: 1;
+    enrollmentId: string;
+    cloudlyOrigin: string;
+    nodeId: string;
+    requestDigest: string;
+    credentials: [
+        INodeEnrollmentCredentialAcknowledgementV1 & {
+            purpose: 'spark';
+        },
+        INodeEnrollmentCredentialAcknowledgementV1 & {
+            purpose: 'pallet';
+        }
+    ];
+}
+/** Returned only after current Spark authentication and proof that Pallet is absent. */
+export interface INodeEnrollmentStateV1 {
+    schemaVersion: 1;
+    nodeId: string;
+    spark: {
+        generation: number;
+        sessionEpoch: number;
+    };
+    pallet: 'absent';
+}
+/** Root-authenticated, node-local IPC only. Initial Pallet authority is always absent. */
+export interface IPalletNodeEnrollmentPreparationV1 {
+    schemaVersion: 1;
+    purpose: 'pallet';
+    installationId: string;
+    mutationId: string;
+    cloudlyOrigin: string;
+    nodeId: string | null;
+}
+/** Full exact activation wire body; Cloudly authentication remains the coordinator's responsibility. */
+export interface IPalletNodeEnrollmentActivationV1 {
+    enrollment: INodeEnrollmentV1;
+    acknowledgement: INodeEnrollmentAcknowledgementV1;
+}
+interface IPalletNodeEnrollmentConfirmationBaseV1 {
+    schemaVersion: 1;
+    purpose: 'pallet';
+    enrollmentId: string;
+    cloudlyOrigin: string;
+    requestDigest: string;
+}
+/** The exact pending binding is durable now, not merely a historical receipt. */
+export interface IPalletNodeEnrollmentBoundV1 extends IPalletNodeEnrollmentConfirmationBaseV1 {
+    phase: 'bound';
+    /** Null before Cloudly assigns a fresh Jump node; exact existing node for adoption. */
+    nodeId: string | null;
+}
+/** Exact CURRENT local Pallet identity, not Spark activation or remote authorization. */
+export interface IPalletNodeEnrollmentActiveV1 extends IPalletNodeEnrollmentConfirmationBaseV1 {
+    phase: 'active';
+    nodeId: string;
+}
+export type TPalletNodeEnrollmentConfirmationV1 = IPalletNodeEnrollmentBoundV1 | IPalletNodeEnrollmentActiveV1;
+/** Wire bounds, not a listener, permission check, timeout implementation or storage API. */
+export declare const palletNodeEnrollmentV1Contract: Readonly<{
+    readonly socketPath: "/run/serve.zone/pallet/control.sock";
+    readonly frame: "u32be-length-prefixed-utf8-json-then-write-half-close";
+    readonly requestsPerConnection: 1;
+    readonly maxRequestBytes: 32768;
+    readonly maxResponseBytes: 16384;
+}>;
+export declare const nodeEnrollmentV1Contract: Readonly<{
+    readonly digestDomain: "serve.zone/node-enrollment-v1";
+    readonly localActivation: "independently-durable-convergence";
+    readonly bootstrapProof: "first-commit-only";
+    readonly pendingSparkProof: "committed-exact-receipt-only";
+}>;
+/** Detached frozen snapshot, captured synchronously before hashing or other awaits. */
+export declare const snapshotNodeEnrollmentV1: (valueArg: unknown) => INodeEnrollmentV1;
+export declare const computeNodeEnrollmentV1Digest: (valueArg: INodeEnrollmentV1) => Promise<string>;
+export declare const snapshotNodeEnrollmentRequestV1: (valueArg: unknown) => INodeEnrollmentRequestV1;
+/**
+ * Pure proof binding/mode check only, NOT authentication. The server must derive
+ * receiptState from its owned transaction, compare the complete stored proposal,
+ * and fence current Jump/Spark/Pallet authority before any commit or replay.
+ */
+export declare const verifyNodeEnrollmentProofV1: (valueArg: INodeEnrollmentRequestV1, receiptStateArg: "absent" | "committed") => Promise<boolean>;
+export declare const snapshotNodeEnrollmentAcknowledgementV1: (valueArg: unknown) => INodeEnrollmentAcknowledgementV1;
+/** Content binding only. Authenticate Cloudly first; persist only the returned snapshot. */
+export declare const bindNodeEnrollmentAcknowledgementV1: (enrollmentArg: INodeEnrollmentV1, acknowledgementArg: INodeEnrollmentAcknowledgementV1) => Promise<INodeEnrollmentAcknowledgementV1>;
+export declare const snapshotNodeEnrollmentStateV1: (valueArg: unknown) => INodeEnrollmentStateV1;
+/** Decoded JSON/data records only, captured synchronously; never invokes getters. */
+export declare const snapshotPalletNodeEnrollmentPreparationV1: (valueArg: unknown) => IPalletNodeEnrollmentPreparationV1;
+/** Content binding only. Authenticate the local Pallet transport before trusting this proposal. */
+export declare const bindPalletNodeEnrollmentPreparationV1: (preparationArg: IPalletNodeEnrollmentPreparationV1, proposalArg: unknown) => INodeEnrollmentV1["credentials"][1];
+/** Capture the exact wrapper and both nested values before any asynchronous content binding. */
+export declare const snapshotPalletNodeEnrollmentActivationV1: (valueArg: unknown) => IPalletNodeEnrollmentActivationV1;
+export declare const snapshotPalletNodeEnrollmentConfirmationV1: (valueArg: unknown) => TPalletNodeEnrollmentConfirmationV1;
+/** Pure binding only. Pallet must prove its durable pending binding before issuing this response. */
+export declare const bindPalletNodeEnrollmentBoundV1: (enrollmentArg: INodeEnrollmentV1, confirmationArg: IPalletNodeEnrollmentBoundV1) => Promise<IPalletNodeEnrollmentBoundV1>;
+/**
+ * Pure binding only, NOT authentication or a database check. The root-authenticated
+ * Pallet owner must first prove its exact CURRENT local identity, not just a receipt.
+ * This does not assert Spark activation, current Cloudly authority or workload readiness.
+ */
+export declare const bindPalletNodeEnrollmentActiveV1: (activationArg: IPalletNodeEnrollmentActivationV1, confirmationArg: IPalletNodeEnrollmentActiveV1) => Promise<IPalletNodeEnrollmentActiveV1>;
+export {};

package/dist_ts/data/nodeenrollment.js

@@ -0,0 +1,255 @@
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex, createSha256Hex, deepFreezeValue, } from '../private/canonicaljson.js';
+/** Wire bounds, not a listener, permission check, timeout implementation or storage API. */
+export const palletNodeEnrollmentV1Contract = Object.freeze({
+    socketPath: '/run/serve.zone/pallet/control.sock',
+    frame: 'u32be-length-prefixed-utf8-json-then-write-half-close',
+    requestsPerConnection: 1,
+    maxRequestBytes: 32768,
+    maxResponseBytes: 16384,
+});
+export const nodeEnrollmentV1Contract = Object.freeze({
+    digestDomain: 'serve.zone/node-enrollment-v1',
+    localActivation: 'independently-durable-convergence',
+    bootstrapProof: 'first-commit-only',
+    pendingSparkProof: 'committed-exact-receipt-only',
+});
+const fail = () => { throw new Error('Node enrollment contract rejected.'); };
+function requireValue(valueArg) {
+    if (!valueArg)
+        fail();
+}
+/** Decoded JSON/data records only. No input accessor is executed or preserved. */
+const record = (valueArg, keysArg) => {
+    requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
+    const prototype = Object.getPrototypeOf(valueArg);
+    requireValue(prototype === Object.prototype || prototype === null);
+    const keys = Reflect.ownKeys(valueArg);
+    requireValue(keys.length === keysArg.length);
+    const snapshot = Object.create(null);
+    for (const key of keys) {
+        requireValue(typeof key === 'string' && keysArg.includes(key));
+        const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+        requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+        snapshot[key] = descriptor.value;
+    }
+    return snapshot;
+};
+const pair = (valueArg) => {
+    requireValue(Array.isArray(valueArg) && Object.getPrototypeOf(valueArg) === Array.prototype);
+    requireValue(Reflect.ownKeys(valueArg).length === 3 && valueArg.length === 2);
+    const first = Object.getOwnPropertyDescriptor(valueArg, '0');
+    const second = Object.getOwnPropertyDescriptor(valueArg, '1');
+    requireValue(first?.enumerable && Object.hasOwn(first, 'value'));
+    requireValue(second?.enumerable && Object.hasOwn(second, 'value'));
+    return [first.value, second.value];
+};
+const id = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg));
+    return valueArg;
+};
+const hash = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^[a-f0-9]{64}$/.test(valueArg));
+    return valueArg;
+};
+const counter = (valueArg, minimumArg = 0, incrementArg = false) => {
+    requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+        && !Object.is(valueArg, -0) && valueArg >= minimumArg
+        && (!incrementArg || valueArg < Number.MAX_SAFE_INTEGER));
+    return valueArg;
+};
+const origin = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && valueArg.length <= 2048);
+    let url;
+    try {
+        url = new URL(valueArg);
+    }
+    catch {
+        return fail();
+    }
+    requireValue(url.protocol === 'https:' && !url.username && !url.password && url.origin === valueArg);
+    return valueArg;
+};
+const hostname = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && valueArg.length <= 253 && valueArg.length > 0);
+    requireValue(valueArg.split('.').every((labelArg) => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(labelArg)));
+    return valueArg;
+};
+const proposal = (valueArg, purposeArg) => {
+    const value = record(valueArg, ['purpose', 'installationId', 'mutationId', 'tokenHash',
+        'expectedGeneration', 'expectedSessionEpoch']);
+    requireValue(value.purpose === purposeArg);
+    return { purpose: purposeArg, installationId: id(value.installationId), mutationId: id(value.mutationId),
+        tokenHash: hash(value.tokenHash), expectedGeneration: counter(value.expectedGeneration, 0, true),
+        expectedSessionEpoch: counter(value.expectedSessionEpoch, 0, true) };
+};
+const distinctOwners = (sparkArg, palletArg) => {
+    requireValue(sparkArg.installationId !== palletArg.installationId
+        && sparkArg.mutationId !== palletArg.mutationId && sparkArg.tokenHash !== palletArg.tokenHash);
+};
+/** Detached frozen snapshot, captured synchronously before hashing or other awaits. */
+export const snapshotNodeEnrollmentV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'enrollmentId', 'cloudlyOrigin', 'hostname',
+        'bootstrap', 'credentials']);
+    requireValue(value.schemaVersion === 1);
+    // Read the discriminant from its data descriptor, never an input getter.
+    requireValue(value.bootstrap !== null && typeof value.bootstrap === 'object');
+    const kind = Object.getOwnPropertyDescriptor(value.bootstrap, 'kind');
+    requireValue(kind && Object.hasOwn(kind, 'value'));
+    const bootstrap = record(value.bootstrap, kind.value === 'jump'
+        ? ['kind', 'proofHash'] : ['kind', 'nodeId', 'proofHash']);
+    requireValue(bootstrap.kind === 'jump' || bootstrap.kind === 'adopt-existing');
+    const [sparkInput, palletInput] = pair(value.credentials);
+    const spark = proposal(sparkInput, 'spark');
+    const pallet = proposal(palletInput, 'pallet');
+    distinctOwners(spark, pallet);
+    requireValue(pallet.expectedGeneration === 0 && pallet.expectedSessionEpoch === 0);
+    requireValue(bootstrap.kind === 'jump'
+        ? spark.expectedGeneration === 0 && spark.expectedSessionEpoch === 0
+        : spark.expectedGeneration > 0);
+    return deepFreezeValue({ schemaVersion: 1, enrollmentId: hash(value.enrollmentId),
+        cloudlyOrigin: origin(value.cloudlyOrigin), hostname: hostname(value.hostname),
+        bootstrap: bootstrap.kind === 'jump'
+            ? { kind: 'jump', proofHash: hash(bootstrap.proofHash) }
+            : { kind: 'adopt-existing', nodeId: id(bootstrap.nodeId), proofHash: hash(bootstrap.proofHash) },
+        credentials: [spark, pallet] });
+};
+export const computeNodeEnrollmentV1Digest = async (valueArg) => {
+    const payload = snapshotNodeEnrollmentV1(valueArg);
+    return createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+        domain: nodeEnrollmentV1Contract.digestDomain, payload,
+    }, fail), fail);
+};
+export const snapshotNodeEnrollmentRequestV1 = (valueArg) => {
+    const value = record(valueArg, ['enrollment', 'proof']);
+    const enrollment = snapshotNodeEnrollmentV1(value.enrollment);
+    const proof = record(value.proof, ['kind', 'bearer']);
+    requireValue(proof.kind === 'bootstrap' || proof.kind === 'pending-spark');
+    requireValue(typeof proof.bearer === 'string');
+    requireValue(proof.kind === 'bootstrap' && enrollment.bootstrap.kind === 'jump'
+        ? /^[A-Za-z0-9_-]{16}$/.test(proof.bearer) : /^secureToken[a-f0-9]{64}$/.test(proof.bearer));
+    return deepFreezeValue({ enrollment, proof: { kind: proof.kind, bearer: proof.bearer } });
+};
+/**
+ * Pure proof binding/mode check only, NOT authentication. The server must derive
+ * receiptState from its owned transaction, compare the complete stored proposal,
+ * and fence current Jump/Spark/Pallet authority before any commit or replay.
+ */
+export const verifyNodeEnrollmentProofV1 = async (valueArg, receiptStateArg) => {
+    try {
+        const { enrollment, proof } = snapshotNodeEnrollmentRequestV1(valueArg);
+        if (!(proof.kind === 'bootstrap' && receiptStateArg === 'absent')
+            && !(proof.kind === 'pending-spark' && receiptStateArg === 'committed'))
+            return false;
+        // This helper hashes exact UTF-8 text; no JSON quoting or normalization.
+        const actual = await createSha256Hex(new TextEncoder().encode(proof.bearer), fail);
+        return actual === (proof.kind === 'bootstrap'
+            ? enrollment.bootstrap.proofHash : enrollment.credentials[0].tokenHash);
+    }
+    catch {
+        return false;
+    }
+};
+const credentialAcknowledgement = (valueArg, purposeArg) => {
+    const value = record(valueArg, ['purpose', 'installationId', 'mutationId', 'tokenHash', 'generation']);
+    requireValue(value.purpose === purposeArg);
+    return { purpose: purposeArg, installationId: id(value.installationId), mutationId: id(value.mutationId),
+        tokenHash: hash(value.tokenHash), generation: counter(value.generation, 1) };
+};
+export const snapshotNodeEnrollmentAcknowledgementV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'enrollmentId', 'cloudlyOrigin', 'nodeId',
+        'requestDigest', 'credentials']);
+    requireValue(value.schemaVersion === 1);
+    const [sparkInput, palletInput] = pair(value.credentials);
+    const spark = credentialAcknowledgement(sparkInput, 'spark');
+    const pallet = credentialAcknowledgement(palletInput, 'pallet');
+    distinctOwners(spark, pallet);
+    requireValue(pallet.generation === 1);
+    return deepFreezeValue({ schemaVersion: 1, enrollmentId: hash(value.enrollmentId),
+        cloudlyOrigin: origin(value.cloudlyOrigin), nodeId: id(value.nodeId),
+        requestDigest: hash(value.requestDigest), credentials: [spark, pallet] });
+};
+/** Content binding only. Authenticate Cloudly first; persist only the returned snapshot. */
+export const bindNodeEnrollmentAcknowledgementV1 = async (enrollmentArg, acknowledgementArg) => {
+    const enrollment = snapshotNodeEnrollmentV1(enrollmentArg);
+    const ack = snapshotNodeEnrollmentAcknowledgementV1(acknowledgementArg);
+    requireValue(ack.enrollmentId === enrollment.enrollmentId && ack.cloudlyOrigin === enrollment.cloudlyOrigin
+        && (enrollment.bootstrap.kind === 'jump' || ack.nodeId === enrollment.bootstrap.nodeId));
+    for (const index of [0, 1]) {
+        const expected = enrollment.credentials[index];
+        const actual = ack.credentials[index];
+        requireValue(actual.purpose === expected.purpose && actual.installationId === expected.installationId
+            && actual.mutationId === expected.mutationId && actual.tokenHash === expected.tokenHash
+            && actual.generation === expected.expectedGeneration + 1);
+    }
+    requireValue(ack.requestDigest === await computeNodeEnrollmentV1Digest(enrollment));
+    return ack;
+};
+export const snapshotNodeEnrollmentStateV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'nodeId', 'spark', 'pallet']);
+    requireValue(value.schemaVersion === 1 && value.pallet === 'absent');
+    const spark = record(value.spark, ['generation', 'sessionEpoch']);
+    return deepFreezeValue({ schemaVersion: 1, nodeId: id(value.nodeId), pallet: 'absent',
+        spark: { generation: counter(spark.generation, 1, true), sessionEpoch: counter(spark.sessionEpoch, 0, true) } });
+};
+/** Decoded JSON/data records only, captured synchronously; never invokes getters. */
+export const snapshotPalletNodeEnrollmentPreparationV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'purpose', 'installationId', 'mutationId',
+        'cloudlyOrigin', 'nodeId']);
+    requireValue(value.schemaVersion === 1 && value.purpose === 'pallet');
+    return deepFreezeValue({ schemaVersion: 1, purpose: 'pallet',
+        installationId: id(value.installationId), mutationId: id(value.mutationId),
+        cloudlyOrigin: origin(value.cloudlyOrigin), nodeId: value.nodeId === null ? null : id(value.nodeId) });
+};
+/** Content binding only. Authenticate the local Pallet transport before trusting this proposal. */
+export const bindPalletNodeEnrollmentPreparationV1 = (preparationArg, proposalArg) => {
+    const preparation = snapshotPalletNodeEnrollmentPreparationV1(preparationArg);
+    const result = proposal(proposalArg, 'pallet');
+    requireValue(result.installationId === preparation.installationId
+        && result.mutationId === preparation.mutationId
+        && result.expectedGeneration === 0 && result.expectedSessionEpoch === 0);
+    return deepFreezeValue(result);
+};
+/** Capture the exact wrapper and both nested values before any asynchronous content binding. */
+export const snapshotPalletNodeEnrollmentActivationV1 = (valueArg) => {
+    const value = record(valueArg, ['enrollment', 'acknowledgement']);
+    return deepFreezeValue({ enrollment: snapshotNodeEnrollmentV1(value.enrollment),
+        acknowledgement: snapshotNodeEnrollmentAcknowledgementV1(value.acknowledgement) });
+};
+export const snapshotPalletNodeEnrollmentConfirmationV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'purpose', 'enrollmentId', 'cloudlyOrigin',
+        'requestDigest', 'phase', 'nodeId']);
+    requireValue(value.schemaVersion === 1 && value.purpose === 'pallet'
+        && (value.phase === 'bound' || value.phase === 'active'));
+    const common = { schemaVersion: 1, purpose: 'pallet',
+        enrollmentId: hash(value.enrollmentId), cloudlyOrigin: origin(value.cloudlyOrigin),
+        requestDigest: hash(value.requestDigest) };
+    return deepFreezeValue(value.phase === 'bound'
+        ? { ...common, phase: 'bound', nodeId: value.nodeId === null ? null : id(value.nodeId) }
+        : { ...common, phase: 'active', nodeId: id(value.nodeId) });
+};
+/** Pure binding only. Pallet must prove its durable pending binding before issuing this response. */
+export const bindPalletNodeEnrollmentBoundV1 = async (enrollmentArg, confirmationArg) => {
+    const enrollment = snapshotNodeEnrollmentV1(enrollmentArg);
+    const confirmation = snapshotPalletNodeEnrollmentConfirmationV1(confirmationArg);
+    requireValue(confirmation.phase === 'bound' && confirmation.enrollmentId === enrollment.enrollmentId
+        && confirmation.cloudlyOrigin === enrollment.cloudlyOrigin
+        && confirmation.nodeId === (enrollment.bootstrap.kind === 'jump' ? null : enrollment.bootstrap.nodeId));
+    requireValue(confirmation.requestDigest === await computeNodeEnrollmentV1Digest(enrollment));
+    return confirmation;
+};
+/**
+ * Pure binding only, NOT authentication or a database check. The root-authenticated
+ * Pallet owner must first prove its exact CURRENT local identity, not just a receipt.
+ * This does not assert Spark activation, current Cloudly authority or workload readiness.
+ */
+export const bindPalletNodeEnrollmentActiveV1 = async (activationArg, confirmationArg) => {
+    // Capture every caller-owned value before the asynchronous shared acknowledgement binder.
+    const { enrollment, acknowledgement } = snapshotPalletNodeEnrollmentActivationV1(activationArg);
+    const confirmation = snapshotPalletNodeEnrollmentConfirmationV1(confirmationArg);
+    requireValue(confirmation.phase === 'active');
+    const ack = await bindNodeEnrollmentAcknowledgementV1(enrollment, acknowledgement);
+    requireValue(confirmation.enrollmentId === ack.enrollmentId && confirmation.cloudlyOrigin === ack.cloudlyOrigin
+        && confirmation.nodeId === ack.nodeId && confirmation.requestDigest === ack.requestDigest);
+    return confirmation;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZWVucm9sbG1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25vZGVlbnJvbGxtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFDTCxzQkFBc0IsRUFDdEIsNEJBQTRCLEVBQzVCLGVBQWUsRUFDZixlQUFlLEdBQ2hCLE1BQU0sNkJBQTZCLENBQUM7QUF1R3JDLDRGQUE0RjtBQUM1RixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzFELFVBQVUsRUFBRSxxQ0FBcUM7SUFDakQsS0FBSyxFQUFFLHVEQUF1RDtJQUM5RCxxQkFBcUIsRUFBRSxDQUFDO0lBQ3hCLGVBQWUsRUFBRSxLQUFLO0lBQ3RCLGdCQUFnQixFQUFFLEtBQUs7Q0FDZixDQUFDLENBQUM7QUFFWixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3BELFlBQVksRUFBRSwrQkFBK0I7SUFDN0MsZUFBZSxFQUFFLG1DQUFtQztJQUNwRCxjQUFjLEVBQUUsbUJBQW1CO0lBQ25DLGlCQUFpQixFQUFFLDhCQUE4QjtDQUN6QyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDckYsU0FBUyxZQUFZLENBQUMsUUFBaUI7SUFDckMsSUFBSSxDQUFDLFFBQVE7UUFBRSxJQUFJLEVBQUUsQ0FBQztBQUN4QixDQUFDO0FBRUQsa0ZBQWtGO0FBQ2xGLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUEwQixFQUEyQixFQUFFO0lBQ3hGLFlBQVksQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELFlBQVksQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDbkUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2QyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0MsTUFBTSxRQUFRLEdBQTRCLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDOUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUN2QixZQUFZLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUMvRCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ2xFLFlBQVksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDM0UsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUM7SUFDbkMsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sSUFBSSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRTtJQUNyRCxZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM3RixZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDOUUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUMsQ0FBQztJQUM3RCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQzlELFlBQVksQ0FBQyxLQUFLLEVBQUUsVUFBVSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDakUsWUFBWSxDQUFDLE1BQU0sRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNuRSxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDckMsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxFQUFFLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDdkMsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN0RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLElBQUksR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUN6QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGdCQUFnQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzlFLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sT0FBTyxHQUFHLENBQUMsUUFBaUIsRUFBRSxVQUFVLEdBQUcsQ0FBQyxFQUFFLFlBQVksR0FBRyxLQUFLLEVBQVUsRUFBRTtJQUNsRixZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDO1dBQ3RFLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxRQUFRLElBQUksVUFBVTtXQUNsRCxDQUFDLENBQUMsWUFBWSxJQUFJLFFBQVEsR0FBRyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQzVELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzNDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsQ0FBQztJQUN0RSxJQUFJLEdBQVEsQ0FBQztJQUNiLElBQUksQ0FBQztRQUFDLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUFDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQUMsQ0FBQztJQUN6RCxZQUFZLENBQUMsR0FBRyxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxJQUFJLENBQUMsR0FBRyxDQUFDLFFBQVEsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ3JHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzdDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM1RixZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUNsRCx3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzVELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sUUFBUSxHQUFHLENBQ2YsUUFBaUIsRUFBRSxVQUFvQixFQUNzQixFQUFFO0lBQy9ELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsWUFBWSxFQUFFLFdBQVc7UUFDcEYsb0JBQW9CLEVBQUUsc0JBQXNCLENBQUMsQ0FBQyxDQUFDO0lBQ2pELFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxLQUFLLFVBQVUsQ0FBQyxDQUFDO0lBQzNDLE9BQU8sRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLGNBQWMsRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUN0RyxTQUFTLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxrQkFBa0IsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLGtCQUFrQixFQUFFLENBQUMsRUFBRSxJQUFJLENBQUM7UUFDaEcsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztBQUN6RSxDQUFDLENBQUM7QUFFRixNQUFNLGNBQWMsR0FBRyxDQUNyQixRQUEwRixFQUMxRixTQUEyRixFQUNyRixFQUFFO0lBQ1IsWUFBWSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLGNBQWM7V0FDNUQsUUFBUSxDQUFDLFVBQVUsS0FBSyxTQUFTLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0FBQ25HLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFFBQWlCLEVBQXFCLEVBQUU7SUFDL0UsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxjQUFjLEVBQUUsZUFBZSxFQUFFLFVBQVU7UUFDMUYsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDL0IsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDeEMseUVBQXlFO0lBQ3pFLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDOUUsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdEUsWUFBWSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ25ELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLEtBQUssTUFBTTtRQUM3RCxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzdELFlBQVksQ0FBQyxTQUFTLENBQUMsSUFBSSxLQUFLLE1BQU0sSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLGdCQUFnQixDQUFDLENBQUM7SUFDL0UsTUFBTSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzFELE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDNUMsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUMvQyxjQUFjLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzlCLFlBQVksQ0FBQyxNQUFNLENBQUMsa0JBQWtCLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxvQkFBb0IsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNuRixZQUFZLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNO1FBQ3BDLENBQUMsQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxvQkFBb0IsS0FBSyxDQUFDO1FBQ3BFLENBQUMsQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbEMsT0FBTyxlQUFlLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQztRQUMvRSxhQUFhLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUM7UUFDOUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxJQUFJLEtBQUssTUFBTTtZQUNsQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFO1lBQ3hELENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRTtRQUNsRyxXQUFXLEVBQUUsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQ3BDLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLEtBQUssRUFBRSxRQUEyQixFQUFtQixFQUFFO0lBQ2xHLE1BQU0sT0FBTyxHQUFHLHdCQUF3QixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25ELE9BQU8sNEJBQTRCLENBQUMsc0JBQXNCLENBQUM7UUFDekQsTUFBTSxFQUFFLHdCQUF3QixDQUFDLFlBQVksRUFBRSxPQUFPO0tBQ3ZELEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxRQUFpQixFQUE0QixFQUFFO0lBQzdGLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN4RCxNQUFNLFVBQVUsR0FBRyx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDOUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN0RCxZQUFZLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxlQUFlLENBQUMsQ0FBQztJQUMzRSxZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQy9DLFlBQVksQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNO1FBQzdFLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQywyQkFBMkIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDL0YsT0FBTyxlQUFlLENBQUMsRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDNUYsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLEtBQUssRUFDOUMsUUFBa0MsRUFBRSxlQUF1QyxFQUN6RCxFQUFFO0lBQ3BCLElBQUksQ0FBQztRQUNILE1BQU0sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLEdBQUcsK0JBQStCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDeEUsSUFBSSxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksZUFBZSxLQUFLLFFBQVEsQ0FBQztlQUM1RCxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxlQUFlLElBQUksZUFBZSxLQUFLLFdBQVcsQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ3hGLHlFQUF5RTtRQUN6RSxNQUFNLE1BQU0sR0FBRyxNQUFNLGVBQWUsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDbkYsT0FBTyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVc7WUFDM0MsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLEtBQUssQ0FBQztJQUFDLENBQUM7QUFDM0IsQ0FBQyxDQUFDO0FBRUYsTUFBTSx5QkFBeUIsR0FBRyxDQUNoQyxRQUFpQixFQUFFLFVBQW9CLEVBQzZCLEVBQUU7SUFDdEUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFNBQVMsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDdkcsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLENBQUM7SUFDM0MsT0FBTyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsY0FBYyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ3RHLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDO0FBQ2pGLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVDQUF1QyxHQUFHLENBQ3JELFFBQWlCLEVBQ2lCLEVBQUU7SUFDcEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxjQUFjLEVBQUUsZUFBZSxFQUFFLFFBQVE7UUFDeEYsZUFBZSxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDbkMsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDeEMsTUFBTSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzFELE1BQU0sS0FBSyxHQUFHLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM3RCxNQUFNLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDaEUsY0FBYyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUM5QixZQUFZLENBQUMsTUFBTSxDQUFDLFVBQVUsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN0QyxPQUFPLGVBQWUsQ0FBQyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQy9FLGFBQWEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUNwRSxhQUFhLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQzlFLENBQUMsQ0FBQztBQUVGLDRGQUE0RjtBQUM1RixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxLQUFLLEVBQ3RELGFBQWdDLEVBQUUsa0JBQW9ELEVBQzNDLEVBQUU7SUFDN0MsTUFBTSxVQUFVLEdBQUcsd0JBQXdCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDM0QsTUFBTSxHQUFHLEdBQUcsdUNBQXVDLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUN4RSxZQUFZLENBQUMsR0FBRyxDQUFDLFlBQVksS0FBSyxVQUFVLENBQUMsWUFBWSxJQUFJLEdBQUcsQ0FBQyxhQUFhLEtBQUssVUFBVSxDQUFDLGFBQWE7V0FDdEcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDM0YsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQVUsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0MsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN0QyxZQUFZLENBQUMsTUFBTSxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsT0FBTyxJQUFJLE1BQU0sQ0FBQyxjQUFjLEtBQUssUUFBUSxDQUFDLGNBQWM7ZUFDaEcsTUFBTSxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUMsVUFBVSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssUUFBUSxDQUFDLFNBQVM7ZUFDcEYsTUFBTSxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUMsa0JBQWtCLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELFlBQVksQ0FBQyxHQUFHLENBQUMsYUFBYSxLQUFLLE1BQU0sNkJBQTZCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNwRixPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQUMsUUFBaUIsRUFBMEIsRUFBRTtJQUN6RixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUMvRSxZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQztJQUNyRSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDLFlBQVksRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLE9BQU8sZUFBZSxDQUFDLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUTtRQUNuRixLQUFLLEVBQUUsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQyxFQUFFLElBQUksQ0FBQyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDckgsQ0FBQyxDQUFDO0FBRUYscUZBQXFGO0FBQ3JGLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLENBQ3ZELFFBQWlCLEVBQ21CLEVBQUU7SUFDdEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsWUFBWTtRQUN4RixlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM5QixZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQztJQUN0RSxPQUFPLGVBQWUsQ0FBQyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLFFBQVE7UUFDMUQsY0FBYyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQzFFLGFBQWEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUMzRyxDQUFDLENBQUM7QUFFRixtR0FBbUc7QUFDbkcsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsQ0FDbkQsY0FBa0QsRUFBRSxXQUFvQixFQUNuQyxFQUFFO0lBQ3ZDLE1BQU0sV0FBVyxHQUFHLHlDQUF5QyxDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBQzlFLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDL0MsWUFBWSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWM7V0FDNUQsTUFBTSxDQUFDLFVBQVUsS0FBSyxXQUFXLENBQUMsVUFBVTtXQUM1QyxNQUFNLENBQUMsa0JBQWtCLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxvQkFBb0IsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUMzRSxPQUFPLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUNqQyxDQUFDLENBQUM7QUFFRixnR0FBZ0c7QUFDaEcsTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsQ0FDdEQsUUFBaUIsRUFDa0IsRUFBRTtJQUNyQyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsWUFBWSxFQUFFLGlCQUFpQixDQUFDLENBQUMsQ0FBQztJQUNsRSxPQUFPLGVBQWUsQ0FBQyxFQUFFLFVBQVUsRUFBRSx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQzdFLGVBQWUsRUFBRSx1Q0FBdUMsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQ3ZGLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDBDQUEwQyxHQUFHLENBQ3hELFFBQWlCLEVBQ29CLEVBQUU7SUFDdkMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxTQUFTLEVBQUUsY0FBYyxFQUFFLGVBQWU7UUFDekYsZUFBZSxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3ZDLFlBQVksQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsT0FBTyxLQUFLLFFBQVE7V0FDL0QsQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLE9BQU8sSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDNUQsTUFBTSxNQUFNLEdBQUcsRUFBRSxhQUFhLEVBQUUsQ0FBVSxFQUFFLE9BQU8sRUFBRSxRQUFpQjtRQUNwRSxZQUFZLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBRSxhQUFhLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUM7UUFDbEYsYUFBYSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztJQUM3QyxPQUFPLGVBQWUsQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLE9BQU87UUFDNUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRTtRQUN4RixDQUFDLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUNoRSxDQUFDLENBQUM7QUFFRixxR0FBcUc7QUFDckcsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsS0FBSyxFQUNsRCxhQUFnQyxFQUFFLGVBQTZDLEVBQ3hDLEVBQUU7SUFDekMsTUFBTSxVQUFVLEdBQUcsd0JBQXdCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDM0QsTUFBTSxZQUFZLEdBQUcsMENBQTBDLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDakYsWUFBWSxDQUFDLFlBQVksQ0FBQyxLQUFLLEtBQUssT0FBTyxJQUFJLFlBQVksQ0FBQyxZQUFZLEtBQUssVUFBVSxDQUFDLFlBQVk7V0FDL0YsWUFBWSxDQUFDLGFBQWEsS0FBSyxVQUFVLENBQUMsYUFBYTtXQUN2RCxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMxRyxZQUFZLENBQUMsWUFBWSxDQUFDLGFBQWEsS0FBSyxNQUFNLDZCQUE2QixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDN0YsT0FBTyxZQUFZLENBQUM7QUFDdEIsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEtBQUssRUFDbkQsYUFBZ0QsRUFDaEQsZUFBOEMsRUFDTixFQUFFO0lBQzFDLDBGQUEwRjtJQUMxRixNQUFNLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxHQUFHLHdDQUF3QyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ2hHLE1BQU0sWUFBWSxHQUFHLDBDQUEwQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBQ2pGLFlBQVksQ0FBQyxZQUFZLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQzlDLE1BQU0sR0FBRyxHQUFHLE1BQU0sbUNBQW1DLENBQUMsVUFBVSxFQUFFLGVBQWUsQ0FBQyxDQUFDO0lBQ25GLFlBQVksQ0FBQyxZQUFZLENBQUMsWUFBWSxLQUFLLEdBQUcsQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDLGFBQWEsS0FBSyxHQUFHLENBQUMsYUFBYTtXQUMxRyxZQUFZLENBQUMsTUFBTSxLQUFLLEdBQUcsQ0FBQyxNQUFNLElBQUksWUFBWSxDQUFDLGFBQWEsS0FBSyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDN0YsT0FBTyxZQUFZLENBQUM7QUFDdEIsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/index.d.ts

@@ -22,6 +22,7 @@ import * as mailRequests from './mail.js';
 import * as migrationRequests from './migration.js';
 import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
+import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
 import * as secretRequests from './secret.js';
@@ -32,7 +33,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -23,6 +23,7 @@ import * as mailRequests from './mail.js';
 import * as migrationRequests from './migration.js';
 import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
+import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
 import * as secretRequests from './secret.js';
@@ -33,9 +34,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGtCQUFrQixNQUFNLGlCQUFpQixDQUFDO0FBQ3RELE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsa0JBQWtCLElBQUksVUFBVSxFQUNoQyxXQUFXLElBQUksR0FBRyxFQUNsQixjQUFjLElBQUksTUFBTSxFQUN4Qix3QkFBd0IsSUFBSSxnQkFBZ0IsRUFDNUMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsWUFBWSxJQUFJLElBQUksRUFDcEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGtCQUFrQixNQUFNLGlCQUFpQixDQUFDO0FBQ3RELE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsa0JBQWtCLElBQUksVUFBVSxFQUNoQyxXQUFXLElBQUksR0FBRyxFQUNsQixjQUFjLElBQUksTUFBTSxFQUN4Qix3QkFBd0IsSUFBSSxnQkFBZ0IsRUFDNUMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsWUFBWSxJQUFJLElBQUksRUFDcEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/requests/node.d.ts

@@ -5,6 +5,24 @@ import type { IClusterNode, IClusterNodeMetrics, INodeAction, INodeMetricsSample
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
 import type { INodeCredentialMetadataV1, INodeCredentialMutationPreconditionsV1, INodeCredentialMutationResultV1, TNodeCredentialPurpose } from '../data/nodecredential.js';
+import type { INodeEnrollmentRequestV1, INodeEnrollmentAcknowledgementV1, INodeEnrollmentStateV1 } from '../data/nodeenrollment.js';
+/** Node-self adoption preconditions, not an admin or workload RBAC grant. */
+export interface IReq_Spark_Cloudly_GetNodeEnrollmentStateV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Cloudly_GetNodeEnrollmentStateV1> {
+    method: 'getNodeEnrollmentStateV1';
+    request: {
+        nodeId: string;
+        nodeToken: string;
+    };
+    /** Reject unless Spark is currently authenticated and Pallet authority is absent. */
+    response: INodeEnrollmentStateV1;
+}
+/** One server transaction; each node-local owner durably activates independently. */
+export interface IReq_Spark_Cloudly_EnrollNodeV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Cloudly_EnrollNodeV1> {
+    method: 'enrollNodeV1';
+    request: INodeEnrollmentRequestV1;
+    /** Replays require the exact receipt AND both current credential authorities. */
+    response: INodeEnrollmentAcknowledgementV1;
+}
 /** Requires verified platform-infrastructure admin authority; returns public data only. */
 export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetNodeConfig> {
     method: 'getNodeConfig';

package/dist_ts/requests/pallet.d.ts

@@ -0,0 +1,23 @@
+import * as plugins from '../plugins.js';
+import type { INodeEnrollmentV1, IPalletNodeEnrollmentActivationV1, IPalletNodeEnrollmentPreparationV1, IPalletNodeEnrollmentBoundV1, IPalletNodeEnrollmentActiveV1 } from '../data/nodeenrollment.js';
+/** Root-authenticated node-local IPC only; never expose on a network router. */
+export interface IReq_Spark_Pallet_PrepareNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_PrepareNodeEnrollmentV1> {
+    method: 'preparePalletNodeEnrollmentV1';
+    request: IPalletNodeEnrollmentPreparationV1;
+    /** Return only a current pending proposal, never bearer material or a historical preparation. */
+    response: INodeEnrollmentV1['credentials'][1];
+}
+/** First enrollment only, not generic credential rotation. */
+export interface IReq_Spark_Pallet_BindNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_BindNodeEnrollmentV1> {
+    method: 'bindPalletNodeEnrollmentV1';
+    request: INodeEnrollmentV1;
+    /** Issued only after proving the exact durable pending binding. */
+    response: IPalletNodeEnrollmentBoundV1;
+}
+export interface IReq_Spark_Pallet_ActivateNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_ActivateNodeEnrollmentV1> {
+    method: 'activatePalletNodeEnrollmentV1';
+    /** The trusted Spark coordinator must authenticate Cloudly before submitting its acknowledgement. */
+    request: IPalletNodeEnrollmentActivationV1;
+    /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
+    response: IPalletNodeEnrollmentActiveV1;
+}

package/dist_ts/requests/pallet.js

@@ -0,0 +1,2 @@
+import * as plugins from '../plugins.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGFsbGV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvcGFsbGV0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "28.0.0",
+  "version": "28.2.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -74,6 +74,67 @@ and fence subsequent control effects against current durable credential/session
 authority. Node identity storage and transport integration must be qualified
 before enabling rotation or Pallet enrollment.
 
+### Independent Node Enrollment
+
+`requests.node` defines `getNodeEnrollmentStateV1` for current Spark-authenticated
+adoption preconditions and `enrollNodeV1` for atomic Spark/Pallet enrollment. These
+contracts do not implement endpoints, authentication, a database or a daemon.
+
+The enrollment proposal binds the canonical HTTPS Cloudly origin, hostname,
+enrollment identity, original bootstrap proof hash and an exact ordered pair of
+independently prepared Spark/Pallet credential hashes and CAS counters. Fresh Jump
+starts both at zero; existing-node adoption rotates current Spark and requires
+Pallet authority to be absent. `snapshotNodeEnrollmentV1` returns a detached,
+frozen snapshot; `computeNodeEnrollmentV1Digest` hashes domain-separated strict
+canonical JSON. Neither helper generates or persists credential material.
+
+Transport proof is excluded from the digest to permit exact lost-response
+recovery. Bootstrap proof must hash to the original proof hash and is allowed only
+before a receipt exists. Pending-Spark proof must hash to the prepared Spark hash
+and is allowed only for an existing exact receipt. `verifyNodeEnrollmentProofV1`
+checks this binding and mode only: Cloudly must derive receipt state itself and
+fence live bootstrap/credential authority in the same owned transaction. Current
+Jump codes are 12 random bytes encoded as 16 canonical base64url characters.
+
+`bindNodeEnrollmentAcknowledgementV1` checks the complete digest, both owners,
+exact next generations and unchanged adopted node ID, returning a detached frozen
+acknowledgement. Authenticate Cloudly before accepting it. The acknowledgement is
+immutable commit evidence, not ongoing authority or workload readiness. Server
+replay must still verify both active credential generations and hashes; reporter
+reconnect alone does not invalidate the credential. Spark and Pallet commit their
+local activation independently and converge after restart; there is no shared
+plaintext vault or cross-local-database ACID claim. Never log proof/request bodies
+or hashes, put them in URLs, or expose them through transport hooks.
+
+`requests.pallet` defines the node-local `preparePalletNodeEnrollmentV1`,
+`bindPalletNodeEnrollmentV1` and `activatePalletNodeEnrollmentV1` methods. They
+belong only on the protected root-owned Unix control socket, never a network
+router. Preparation requests initial Pallet authority (zero generation and
+session epoch) and returns only its independently retained credential hash.
+`snapshotPalletNodeEnrollmentPreparationV1` and
+`bindPalletNodeEnrollmentPreparationV1` validate that exact exchange.
+
+Local confirmations explicitly distinguish a durable pending binding from the
+exact current active Pallet identity. `bindPalletNodeEnrollmentBoundV1` verifies
+the whole enrollment digest and its pre-assignment node ID (null for fresh Jump).
+`snapshotPalletNodeEnrollmentActivationV1` captures the exact activation request,
+rejecting extra wrapper fields as well as malformed nested data.
+`bindPalletNodeEnrollmentActiveV1` takes that complete activation request and
+verifies the full Cloudly acknowledgement, including both owners and the assigned
+node ID. Both confirmation binders return detached frozen
+snapshots captured before hashing. These are pure content checks: authenticate
+the local transport separately, and have Pallet prove its current owned state
+before issuing a confirmation. A historical receipt is insufficient, and Pallet
+activation does not imply Spark activation or workload readiness.
+
+`palletNodeEnrollmentV1Contract` specifies one four-byte unsigned big-endian
+length-prefixed UTF-8 JSON frame per direction, followed by write-half-close, at
+most 32768 request bytes and 16384 response bytes excluding the prefix. Implement
+the listener with half-open response support, strict EOF/trailing-byte rejection,
+bounded time/concurrency, root-only directory/socket permissions and drained
+cleanup. The package supplies no listener, permission checks or persistent state.
+No bearer, generic rotation operation or database access is part of this IPC API.
+
 ### Node-Bound Runtime Assignments
 
 The `data` namespace exports `IRuntimeAssignmentV1`, canonical digest helpers,

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '28.0.0',
+  version: '28.2.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -21,6 +21,7 @@ export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './nodecredential.js';
+export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
 export * from './secret.js';

package/ts/data/nodeenrollment.ts

@@ -0,0 +1,399 @@
+import type { TNodeCredentialPurpose } from './nodecredential.js';
+import {
+  canonicalizeStrictJson,
+  createCanonicalJsonSha256Hex,
+  createSha256Hex,
+  deepFreezeValue,
+} from '../private/canonicaljson.js';
+
+export interface INodeEnrollmentCredentialProposalV1 {
+  purpose: TNodeCredentialPurpose;
+  installationId: string;
+  mutationId: string;
+  /** SHA-256 of the independently generated, durably prepared bearer UTF-8 bytes. */
+  tokenHash: string;
+  expectedGeneration: number;
+  expectedSessionEpoch: number;
+}
+
+/** Value-free, immutable proposal. Hashes are still sensitive transport fields. */
+export interface INodeEnrollmentV1 {
+  schemaVersion: 1;
+  /** 32 CSPRNG bytes encoded as lowercase hexadecimal; retain across every retry. */
+  enrollmentId: string;
+  cloudlyOrigin: string;
+  hostname: string;
+  bootstrap:
+    | { kind: 'jump'; proofHash: string }
+    | { kind: 'adopt-existing'; nodeId: string; proofHash: string };
+  credentials: [
+    INodeEnrollmentCredentialProposalV1 & { purpose: 'spark' },
+    INodeEnrollmentCredentialProposalV1 & { purpose: 'pallet' },
+  ];
+}
+
+export interface INodeEnrollmentRequestV1 {
+  enrollment: INodeEnrollmentV1;
+  /** Never persist on the server, log, put in URLs, or expose in transport hooks. */
+  proof: { kind: 'bootstrap' | 'pending-spark'; bearer: string };
+}
+
+export interface INodeEnrollmentCredentialAcknowledgementV1 {
+  purpose: TNodeCredentialPurpose;
+  installationId: string;
+  mutationId: string;
+  tokenHash: string;
+  generation: number;
+}
+
+/** Immutable commit evidence, not authorization or workload readiness. */
+export interface INodeEnrollmentAcknowledgementV1 {
+  schemaVersion: 1;
+  enrollmentId: string;
+  cloudlyOrigin: string;
+  nodeId: string;
+  requestDigest: string;
+  credentials: [
+    INodeEnrollmentCredentialAcknowledgementV1 & { purpose: 'spark' },
+    INodeEnrollmentCredentialAcknowledgementV1 & { purpose: 'pallet' },
+  ];
+}
+
+/** Returned only after current Spark authentication and proof that Pallet is absent. */
+export interface INodeEnrollmentStateV1 {
+  schemaVersion: 1;
+  nodeId: string;
+  spark: { generation: number; sessionEpoch: number };
+  pallet: 'absent';
+}
+
+/** Root-authenticated, node-local IPC only. Initial Pallet authority is always absent. */
+export interface IPalletNodeEnrollmentPreparationV1 {
+  schemaVersion: 1;
+  purpose: 'pallet';
+  installationId: string;
+  mutationId: string;
+  cloudlyOrigin: string;
+  nodeId: string | null;
+}
+
+/** Full exact activation wire body; Cloudly authentication remains the coordinator's responsibility. */
+export interface IPalletNodeEnrollmentActivationV1 {
+  enrollment: INodeEnrollmentV1;
+  acknowledgement: INodeEnrollmentAcknowledgementV1;
+}
+
+interface IPalletNodeEnrollmentConfirmationBaseV1 {
+  schemaVersion: 1;
+  purpose: 'pallet';
+  enrollmentId: string;
+  cloudlyOrigin: string;
+  requestDigest: string;
+}
+
+/** The exact pending binding is durable now, not merely a historical receipt. */
+export interface IPalletNodeEnrollmentBoundV1 extends IPalletNodeEnrollmentConfirmationBaseV1 {
+  phase: 'bound';
+  /** Null before Cloudly assigns a fresh Jump node; exact existing node for adoption. */
+  nodeId: string | null;
+}
+
+/** Exact CURRENT local Pallet identity, not Spark activation or remote authorization. */
+export interface IPalletNodeEnrollmentActiveV1 extends IPalletNodeEnrollmentConfirmationBaseV1 {
+  phase: 'active';
+  nodeId: string;
+}
+
+export type TPalletNodeEnrollmentConfirmationV1 =
+  | IPalletNodeEnrollmentBoundV1 | IPalletNodeEnrollmentActiveV1;
+
+/** Wire bounds, not a listener, permission check, timeout implementation or storage API. */
+export const palletNodeEnrollmentV1Contract = Object.freeze({
+  socketPath: '/run/serve.zone/pallet/control.sock',
+  frame: 'u32be-length-prefixed-utf8-json-then-write-half-close',
+  requestsPerConnection: 1,
+  maxRequestBytes: 32768,
+  maxResponseBytes: 16384,
+} as const);
+
+export const nodeEnrollmentV1Contract = Object.freeze({
+  digestDomain: 'serve.zone/node-enrollment-v1',
+  localActivation: 'independently-durable-convergence',
+  bootstrapProof: 'first-commit-only',
+  pendingSparkProof: 'committed-exact-receipt-only',
+} as const);
+
+const fail = (): never => { throw new Error('Node enrollment contract rejected.'); };
+function requireValue(valueArg: unknown): asserts valueArg {
+  if (!valueArg) fail();
+}
+
+/** Decoded JSON/data records only. No input accessor is executed or preserved. */
+const record = (valueArg: unknown, keysArg: readonly string[]): Record<string, unknown> => {
+  requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
+  const prototype = Object.getPrototypeOf(valueArg);
+  requireValue(prototype === Object.prototype || prototype === null);
+  const keys = Reflect.ownKeys(valueArg);
+  requireValue(keys.length === keysArg.length);
+  const snapshot: Record<string, unknown> = Object.create(null);
+  for (const key of keys) {
+    requireValue(typeof key === 'string' && keysArg.includes(key));
+    const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+    snapshot[key] = descriptor.value;
+  }
+  return snapshot;
+};
+
+const pair = (valueArg: unknown): [unknown, unknown] => {
+  requireValue(Array.isArray(valueArg) && Object.getPrototypeOf(valueArg) === Array.prototype);
+  requireValue(Reflect.ownKeys(valueArg).length === 3 && valueArg.length === 2);
+  const first = Object.getOwnPropertyDescriptor(valueArg, '0');
+  const second = Object.getOwnPropertyDescriptor(valueArg, '1');
+  requireValue(first?.enumerable && Object.hasOwn(first, 'value'));
+  requireValue(second?.enumerable && Object.hasOwn(second, 'value'));
+  return [first.value, second.value];
+};
+const id = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg));
+  return valueArg;
+};
+const hash = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && /^[a-f0-9]{64}$/.test(valueArg));
+  return valueArg;
+};
+const counter = (valueArg: unknown, minimumArg = 0, incrementArg = false): number => {
+  requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+    && !Object.is(valueArg, -0) && valueArg >= minimumArg
+    && (!incrementArg || valueArg < Number.MAX_SAFE_INTEGER));
+  return valueArg;
+};
+const origin = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && valueArg.length <= 2048);
+  let url: URL;
+  try { url = new URL(valueArg); } catch { return fail(); }
+  requireValue(url.protocol === 'https:' && !url.username && !url.password && url.origin === valueArg);
+  return valueArg;
+};
+const hostname = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string' && valueArg.length <= 253 && valueArg.length > 0);
+  requireValue(valueArg.split('.').every((labelArg) =>
+    /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(labelArg)));
+  return valueArg;
+};
+
+const proposal = <TPurpose extends TNodeCredentialPurpose>(
+  valueArg: unknown, purposeArg: TPurpose,
+): INodeEnrollmentCredentialProposalV1 & { purpose: TPurpose } => {
+  const value = record(valueArg, ['purpose', 'installationId', 'mutationId', 'tokenHash',
+    'expectedGeneration', 'expectedSessionEpoch']);
+  requireValue(value.purpose === purposeArg);
+  return { purpose: purposeArg, installationId: id(value.installationId), mutationId: id(value.mutationId),
+    tokenHash: hash(value.tokenHash), expectedGeneration: counter(value.expectedGeneration, 0, true),
+    expectedSessionEpoch: counter(value.expectedSessionEpoch, 0, true) };
+};
+
+const distinctOwners = (
+  sparkArg: INodeEnrollmentCredentialAcknowledgementV1 | INodeEnrollmentCredentialProposalV1,
+  palletArg: INodeEnrollmentCredentialAcknowledgementV1 | INodeEnrollmentCredentialProposalV1,
+): void => {
+  requireValue(sparkArg.installationId !== palletArg.installationId
+    && sparkArg.mutationId !== palletArg.mutationId && sparkArg.tokenHash !== palletArg.tokenHash);
+};
+
+/** Detached frozen snapshot, captured synchronously before hashing or other awaits. */
+export const snapshotNodeEnrollmentV1 = (valueArg: unknown): INodeEnrollmentV1 => {
+  const value = record(valueArg, ['schemaVersion', 'enrollmentId', 'cloudlyOrigin', 'hostname',
+    'bootstrap', 'credentials']);
+  requireValue(value.schemaVersion === 1);
+  // Read the discriminant from its data descriptor, never an input getter.
+  requireValue(value.bootstrap !== null && typeof value.bootstrap === 'object');
+  const kind = Object.getOwnPropertyDescriptor(value.bootstrap, 'kind');
+  requireValue(kind && Object.hasOwn(kind, 'value'));
+  const bootstrap = record(value.bootstrap, kind.value === 'jump'
+    ? ['kind', 'proofHash'] : ['kind', 'nodeId', 'proofHash']);
+  requireValue(bootstrap.kind === 'jump' || bootstrap.kind === 'adopt-existing');
+  const [sparkInput, palletInput] = pair(value.credentials);
+  const spark = proposal(sparkInput, 'spark');
+  const pallet = proposal(palletInput, 'pallet');
+  distinctOwners(spark, pallet);
+  requireValue(pallet.expectedGeneration === 0 && pallet.expectedSessionEpoch === 0);
+  requireValue(bootstrap.kind === 'jump'
+    ? spark.expectedGeneration === 0 && spark.expectedSessionEpoch === 0
+    : spark.expectedGeneration > 0);
+  return deepFreezeValue({ schemaVersion: 1, enrollmentId: hash(value.enrollmentId),
+    cloudlyOrigin: origin(value.cloudlyOrigin), hostname: hostname(value.hostname),
+    bootstrap: bootstrap.kind === 'jump'
+      ? { kind: 'jump', proofHash: hash(bootstrap.proofHash) }
+      : { kind: 'adopt-existing', nodeId: id(bootstrap.nodeId), proofHash: hash(bootstrap.proofHash) },
+    credentials: [spark, pallet] });
+};
+
+export const computeNodeEnrollmentV1Digest = async (valueArg: INodeEnrollmentV1): Promise<string> => {
+  const payload = snapshotNodeEnrollmentV1(valueArg);
+  return createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+    domain: nodeEnrollmentV1Contract.digestDomain, payload,
+  }, fail), fail);
+};
+
+export const snapshotNodeEnrollmentRequestV1 = (valueArg: unknown): INodeEnrollmentRequestV1 => {
+  const value = record(valueArg, ['enrollment', 'proof']);
+  const enrollment = snapshotNodeEnrollmentV1(value.enrollment);
+  const proof = record(value.proof, ['kind', 'bearer']);
+  requireValue(proof.kind === 'bootstrap' || proof.kind === 'pending-spark');
+  requireValue(typeof proof.bearer === 'string');
+  requireValue(proof.kind === 'bootstrap' && enrollment.bootstrap.kind === 'jump'
+    ? /^[A-Za-z0-9_-]{16}$/.test(proof.bearer) : /^secureToken[a-f0-9]{64}$/.test(proof.bearer));
+  return deepFreezeValue({ enrollment, proof: { kind: proof.kind, bearer: proof.bearer } });
+};
+
+/**
+ * Pure proof binding/mode check only, NOT authentication. The server must derive
+ * receiptState from its owned transaction, compare the complete stored proposal,
+ * and fence current Jump/Spark/Pallet authority before any commit or replay.
+ */
+export const verifyNodeEnrollmentProofV1 = async (
+  valueArg: INodeEnrollmentRequestV1, receiptStateArg: 'absent' | 'committed',
+): Promise<boolean> => {
+  try {
+    const { enrollment, proof } = snapshotNodeEnrollmentRequestV1(valueArg);
+    if (!(proof.kind === 'bootstrap' && receiptStateArg === 'absent')
+      && !(proof.kind === 'pending-spark' && receiptStateArg === 'committed')) return false;
+    // This helper hashes exact UTF-8 text; no JSON quoting or normalization.
+    const actual = await createSha256Hex(new TextEncoder().encode(proof.bearer), fail);
+    return actual === (proof.kind === 'bootstrap'
+      ? enrollment.bootstrap.proofHash : enrollment.credentials[0].tokenHash);
+  } catch { return false; }
+};
+
+const credentialAcknowledgement = <TPurpose extends TNodeCredentialPurpose>(
+  valueArg: unknown, purposeArg: TPurpose,
+): INodeEnrollmentCredentialAcknowledgementV1 & { purpose: TPurpose } => {
+  const value = record(valueArg, ['purpose', 'installationId', 'mutationId', 'tokenHash', 'generation']);
+  requireValue(value.purpose === purposeArg);
+  return { purpose: purposeArg, installationId: id(value.installationId), mutationId: id(value.mutationId),
+    tokenHash: hash(value.tokenHash), generation: counter(value.generation, 1) };
+};
+
+export const snapshotNodeEnrollmentAcknowledgementV1 = (
+  valueArg: unknown,
+): INodeEnrollmentAcknowledgementV1 => {
+  const value = record(valueArg, ['schemaVersion', 'enrollmentId', 'cloudlyOrigin', 'nodeId',
+    'requestDigest', 'credentials']);
+  requireValue(value.schemaVersion === 1);
+  const [sparkInput, palletInput] = pair(value.credentials);
+  const spark = credentialAcknowledgement(sparkInput, 'spark');
+  const pallet = credentialAcknowledgement(palletInput, 'pallet');
+  distinctOwners(spark, pallet);
+  requireValue(pallet.generation === 1);
+  return deepFreezeValue({ schemaVersion: 1, enrollmentId: hash(value.enrollmentId),
+    cloudlyOrigin: origin(value.cloudlyOrigin), nodeId: id(value.nodeId),
+    requestDigest: hash(value.requestDigest), credentials: [spark, pallet] });
+};
+
+/** Content binding only. Authenticate Cloudly first; persist only the returned snapshot. */
+export const bindNodeEnrollmentAcknowledgementV1 = async (
+  enrollmentArg: INodeEnrollmentV1, acknowledgementArg: INodeEnrollmentAcknowledgementV1,
+): Promise<INodeEnrollmentAcknowledgementV1> => {
+  const enrollment = snapshotNodeEnrollmentV1(enrollmentArg);
+  const ack = snapshotNodeEnrollmentAcknowledgementV1(acknowledgementArg);
+  requireValue(ack.enrollmentId === enrollment.enrollmentId && ack.cloudlyOrigin === enrollment.cloudlyOrigin
+    && (enrollment.bootstrap.kind === 'jump' || ack.nodeId === enrollment.bootstrap.nodeId));
+  for (const index of [0, 1] as const) {
+    const expected = enrollment.credentials[index];
+    const actual = ack.credentials[index];
+    requireValue(actual.purpose === expected.purpose && actual.installationId === expected.installationId
+      && actual.mutationId === expected.mutationId && actual.tokenHash === expected.tokenHash
+      && actual.generation === expected.expectedGeneration + 1);
+  }
+  requireValue(ack.requestDigest === await computeNodeEnrollmentV1Digest(enrollment));
+  return ack;
+};
+
+export const snapshotNodeEnrollmentStateV1 = (valueArg: unknown): INodeEnrollmentStateV1 => {
+  const value = record(valueArg, ['schemaVersion', 'nodeId', 'spark', 'pallet']);
+  requireValue(value.schemaVersion === 1 && value.pallet === 'absent');
+  const spark = record(value.spark, ['generation', 'sessionEpoch']);
+  return deepFreezeValue({ schemaVersion: 1, nodeId: id(value.nodeId), pallet: 'absent',
+    spark: { generation: counter(spark.generation, 1, true), sessionEpoch: counter(spark.sessionEpoch, 0, true) } });
+};
+
+/** Decoded JSON/data records only, captured synchronously; never invokes getters. */
+export const snapshotPalletNodeEnrollmentPreparationV1 = (
+  valueArg: unknown,
+): IPalletNodeEnrollmentPreparationV1 => {
+  const value = record(valueArg, ['schemaVersion', 'purpose', 'installationId', 'mutationId',
+    'cloudlyOrigin', 'nodeId']);
+  requireValue(value.schemaVersion === 1 && value.purpose === 'pallet');
+  return deepFreezeValue({ schemaVersion: 1, purpose: 'pallet',
+    installationId: id(value.installationId), mutationId: id(value.mutationId),
+    cloudlyOrigin: origin(value.cloudlyOrigin), nodeId: value.nodeId === null ? null : id(value.nodeId) });
+};
+
+/** Content binding only. Authenticate the local Pallet transport before trusting this proposal. */
+export const bindPalletNodeEnrollmentPreparationV1 = (
+  preparationArg: IPalletNodeEnrollmentPreparationV1, proposalArg: unknown,
+): INodeEnrollmentV1['credentials'][1] => {
+  const preparation = snapshotPalletNodeEnrollmentPreparationV1(preparationArg);
+  const result = proposal(proposalArg, 'pallet');
+  requireValue(result.installationId === preparation.installationId
+    && result.mutationId === preparation.mutationId
+    && result.expectedGeneration === 0 && result.expectedSessionEpoch === 0);
+  return deepFreezeValue(result);
+};
+
+/** Capture the exact wrapper and both nested values before any asynchronous content binding. */
+export const snapshotPalletNodeEnrollmentActivationV1 = (
+  valueArg: unknown,
+): IPalletNodeEnrollmentActivationV1 => {
+  const value = record(valueArg, ['enrollment', 'acknowledgement']);
+  return deepFreezeValue({ enrollment: snapshotNodeEnrollmentV1(value.enrollment),
+    acknowledgement: snapshotNodeEnrollmentAcknowledgementV1(value.acknowledgement) });
+};
+
+export const snapshotPalletNodeEnrollmentConfirmationV1 = (
+  valueArg: unknown,
+): TPalletNodeEnrollmentConfirmationV1 => {
+  const value = record(valueArg, ['schemaVersion', 'purpose', 'enrollmentId', 'cloudlyOrigin',
+    'requestDigest', 'phase', 'nodeId']);
+  requireValue(value.schemaVersion === 1 && value.purpose === 'pallet'
+    && (value.phase === 'bound' || value.phase === 'active'));
+  const common = { schemaVersion: 1 as const, purpose: 'pallet' as const,
+    enrollmentId: hash(value.enrollmentId), cloudlyOrigin: origin(value.cloudlyOrigin),
+    requestDigest: hash(value.requestDigest) };
+  return deepFreezeValue(value.phase === 'bound'
+    ? { ...common, phase: 'bound', nodeId: value.nodeId === null ? null : id(value.nodeId) }
+    : { ...common, phase: 'active', nodeId: id(value.nodeId) });
+};
+
+/** Pure binding only. Pallet must prove its durable pending binding before issuing this response. */
+export const bindPalletNodeEnrollmentBoundV1 = async (
+  enrollmentArg: INodeEnrollmentV1, confirmationArg: IPalletNodeEnrollmentBoundV1,
+): Promise<IPalletNodeEnrollmentBoundV1> => {
+  const enrollment = snapshotNodeEnrollmentV1(enrollmentArg);
+  const confirmation = snapshotPalletNodeEnrollmentConfirmationV1(confirmationArg);
+  requireValue(confirmation.phase === 'bound' && confirmation.enrollmentId === enrollment.enrollmentId
+    && confirmation.cloudlyOrigin === enrollment.cloudlyOrigin
+    && confirmation.nodeId === (enrollment.bootstrap.kind === 'jump' ? null : enrollment.bootstrap.nodeId));
+  requireValue(confirmation.requestDigest === await computeNodeEnrollmentV1Digest(enrollment));
+  return confirmation;
+};
+
+/**
+ * Pure binding only, NOT authentication or a database check. The root-authenticated
+ * Pallet owner must first prove its exact CURRENT local identity, not just a receipt.
+ * This does not assert Spark activation, current Cloudly authority or workload readiness.
+ */
+export const bindPalletNodeEnrollmentActiveV1 = async (
+  activationArg: IPalletNodeEnrollmentActivationV1,
+  confirmationArg: IPalletNodeEnrollmentActiveV1,
+): Promise<IPalletNodeEnrollmentActiveV1> => {
+  // Capture every caller-owned value before the asynchronous shared acknowledgement binder.
+  const { enrollment, acknowledgement } = snapshotPalletNodeEnrollmentActivationV1(activationArg);
+  const confirmation = snapshotPalletNodeEnrollmentConfirmationV1(confirmationArg);
+  requireValue(confirmation.phase === 'active');
+  const ack = await bindNodeEnrollmentAcknowledgementV1(enrollment, acknowledgement);
+  requireValue(confirmation.enrollmentId === ack.enrollmentId && confirmation.cloudlyOrigin === ack.cloudlyOrigin
+    && confirmation.nodeId === ack.nodeId && confirmation.requestDigest === ack.requestDigest);
+  return confirmation;
+};

package/ts/requests/index.ts

@@ -24,6 +24,7 @@ import * as mailRequests from './mail.js';
 import * as migrationRequests from './migration.js';
 import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
+import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
 import * as secretRequests from './secret.js';
@@ -60,6 +61,7 @@ export {
   migrationRequests as migration,
   networkRequests as network,
   nodeRequests as node,
+  palletRequests as pallet,
   platformRequests as platform,
   routingRequests as routing,
   secretRequests as secret,

package/ts/requests/node.ts

@@ -10,6 +10,33 @@ import type {
   INodeCredentialMutationResultV1,
   TNodeCredentialPurpose,
 } from '../data/nodecredential.js';
+import type {
+  INodeEnrollmentRequestV1,
+  INodeEnrollmentAcknowledgementV1,
+  INodeEnrollmentStateV1,
+} from '../data/nodeenrollment.js';
+
+/** Node-self adoption preconditions, not an admin or workload RBAC grant. */
+export interface IReq_Spark_Cloudly_GetNodeEnrollmentStateV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Cloudly_GetNodeEnrollmentStateV1
+> {
+  method: 'getNodeEnrollmentStateV1';
+  request: { nodeId: string; nodeToken: string };
+  /** Reject unless Spark is currently authenticated and Pallet authority is absent. */
+  response: INodeEnrollmentStateV1;
+}
+
+/** One server transaction; each node-local owner durably activates independently. */
+export interface IReq_Spark_Cloudly_EnrollNodeV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Cloudly_EnrollNodeV1
+> {
+  method: 'enrollNodeV1';
+  request: INodeEnrollmentRequestV1;
+  /** Replays require the exact receipt AND both current credential authorities. */
+  response: INodeEnrollmentAcknowledgementV1;
+}
 
 /** Requires verified platform-infrastructure admin authority; returns public data only. */
 export interface IRequest_Any_Cloudly_GetNodeConfig extends plugins.typedrequestInterfaces.implementsTR<

package/ts/requests/pallet.ts

@@ -0,0 +1,38 @@
+import * as plugins from '../plugins.js';
+import type {
+  INodeEnrollmentV1, IPalletNodeEnrollmentActivationV1, IPalletNodeEnrollmentPreparationV1,
+  IPalletNodeEnrollmentBoundV1, IPalletNodeEnrollmentActiveV1,
+} from '../data/nodeenrollment.js';
+
+/** Root-authenticated node-local IPC only; never expose on a network router. */
+export interface IReq_Spark_Pallet_PrepareNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_PrepareNodeEnrollmentV1
+> {
+  method: 'preparePalletNodeEnrollmentV1';
+  request: IPalletNodeEnrollmentPreparationV1;
+  /** Return only a current pending proposal, never bearer material or a historical preparation. */
+  response: INodeEnrollmentV1['credentials'][1];
+}
+
+/** First enrollment only, not generic credential rotation. */
+export interface IReq_Spark_Pallet_BindNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_BindNodeEnrollmentV1
+> {
+  method: 'bindPalletNodeEnrollmentV1';
+  request: INodeEnrollmentV1;
+  /** Issued only after proving the exact durable pending binding. */
+  response: IPalletNodeEnrollmentBoundV1;
+}
+
+export interface IReq_Spark_Pallet_ActivateNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_ActivateNodeEnrollmentV1
+> {
+  method: 'activatePalletNodeEnrollmentV1';
+  /** The trusted Spark coordinator must authenticate Cloudly before submitting its acknowledgement. */
+  request: IPalletNodeEnrollmentActivationV1;
+  /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
+  response: IPalletNodeEnrollmentActiveV1;
+}