@serve.zone/interfaces 28.1.0 → 28.3.0

package/changelog.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 2026-09-08 - 28.3.0
+
+### Features
+
+- add human credential administration contracts (admin)
+  - Define getHumanCredential and mutateHumanCredential TypedRequest interfaces for inspecting and mutating human credential metadata.
+  - Support password rotation, password login revocation, and session revocation operations with generation checks and replay handling.
+  - Document human credential administration behavior, session invalidation semantics, and password handling expectations.
+
+### Fixes
+
+- pin @types/node and update pnpm package manager (package)
+  - Pins @types/node at 26.4.0 instead of using a caret range.
+  - Updates packageManager from pnpm 11.25.0 to 12.2.1.
+
+## 2026-09-06 - 28.2.0
+
+### Features
+
+- add Pallet node enrollment IPC contracts (pallet-enrollment)
+  - Add Pallet node enrollment preparation, activation, and confirmation data contracts with snapshot and binding helpers.
+  - Export requests.pallet typed methods for prepare, bind, and activate enrollment flows.
+  - Document Pallet IPC framing limits and validation responsibilities with test coverage for enrollment semantics.
+
 ## 2026-09-06 - 28.1.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '28.1.0',
+    version: '28.3.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/nodeenrollment.d.ts

@@ -73,6 +73,47 @@ export interface INodeEnrollmentStateV1 {
     };
     pallet: 'absent';
 }
+/** Root-authenticated, node-local IPC only. Initial Pallet authority is always absent. */
+export interface IPalletNodeEnrollmentPreparationV1 {
+    schemaVersion: 1;
+    purpose: 'pallet';
+    installationId: string;
+    mutationId: string;
+    cloudlyOrigin: string;
+    nodeId: string | null;
+}
+/** Full exact activation wire body; Cloudly authentication remains the coordinator's responsibility. */
+export interface IPalletNodeEnrollmentActivationV1 {
+    enrollment: INodeEnrollmentV1;
+    acknowledgement: INodeEnrollmentAcknowledgementV1;
+}
+interface IPalletNodeEnrollmentConfirmationBaseV1 {
+    schemaVersion: 1;
+    purpose: 'pallet';
+    enrollmentId: string;
+    cloudlyOrigin: string;
+    requestDigest: string;
+}
+/** The exact pending binding is durable now, not merely a historical receipt. */
+export interface IPalletNodeEnrollmentBoundV1 extends IPalletNodeEnrollmentConfirmationBaseV1 {
+    phase: 'bound';
+    /** Null before Cloudly assigns a fresh Jump node; exact existing node for adoption. */
+    nodeId: string | null;
+}
+/** Exact CURRENT local Pallet identity, not Spark activation or remote authorization. */
+export interface IPalletNodeEnrollmentActiveV1 extends IPalletNodeEnrollmentConfirmationBaseV1 {
+    phase: 'active';
+    nodeId: string;
+}
+export type TPalletNodeEnrollmentConfirmationV1 = IPalletNodeEnrollmentBoundV1 | IPalletNodeEnrollmentActiveV1;
+/** Wire bounds, not a listener, permission check, timeout implementation or storage API. */
+export declare const palletNodeEnrollmentV1Contract: Readonly<{
+    readonly socketPath: "/run/serve.zone/pallet/control.sock";
+    readonly frame: "u32be-length-prefixed-utf8-json-then-write-half-close";
+    readonly requestsPerConnection: 1;
+    readonly maxRequestBytes: 32768;
+    readonly maxResponseBytes: 16384;
+}>;
 export declare const nodeEnrollmentV1Contract: Readonly<{
     readonly digestDomain: "serve.zone/node-enrollment-v1";
     readonly localActivation: "independently-durable-convergence";
@@ -93,3 +134,19 @@ export declare const snapshotNodeEnrollmentAcknowledgementV1: (valueArg: unknown
 /** Content binding only. Authenticate Cloudly first; persist only the returned snapshot. */
 export declare const bindNodeEnrollmentAcknowledgementV1: (enrollmentArg: INodeEnrollmentV1, acknowledgementArg: INodeEnrollmentAcknowledgementV1) => Promise<INodeEnrollmentAcknowledgementV1>;
 export declare const snapshotNodeEnrollmentStateV1: (valueArg: unknown) => INodeEnrollmentStateV1;
+/** Decoded JSON/data records only, captured synchronously; never invokes getters. */
+export declare const snapshotPalletNodeEnrollmentPreparationV1: (valueArg: unknown) => IPalletNodeEnrollmentPreparationV1;
+/** Content binding only. Authenticate the local Pallet transport before trusting this proposal. */
+export declare const bindPalletNodeEnrollmentPreparationV1: (preparationArg: IPalletNodeEnrollmentPreparationV1, proposalArg: unknown) => INodeEnrollmentV1["credentials"][1];
+/** Capture the exact wrapper and both nested values before any asynchronous content binding. */
+export declare const snapshotPalletNodeEnrollmentActivationV1: (valueArg: unknown) => IPalletNodeEnrollmentActivationV1;
+export declare const snapshotPalletNodeEnrollmentConfirmationV1: (valueArg: unknown) => TPalletNodeEnrollmentConfirmationV1;
+/** Pure binding only. Pallet must prove its durable pending binding before issuing this response. */
+export declare const bindPalletNodeEnrollmentBoundV1: (enrollmentArg: INodeEnrollmentV1, confirmationArg: IPalletNodeEnrollmentBoundV1) => Promise<IPalletNodeEnrollmentBoundV1>;
+/**
+ * Pure binding only, NOT authentication or a database check. The root-authenticated
+ * Pallet owner must first prove its exact CURRENT local identity, not just a receipt.
+ * This does not assert Spark activation, current Cloudly authority or workload readiness.
+ */
+export declare const bindPalletNodeEnrollmentActiveV1: (activationArg: IPalletNodeEnrollmentActivationV1, confirmationArg: IPalletNodeEnrollmentActiveV1) => Promise<IPalletNodeEnrollmentActiveV1>;
+export {};

package/dist_ts/data/nodeenrollment.js

@@ -1,4 +1,12 @@
 import { canonicalizeStrictJson, createCanonicalJsonSha256Hex, createSha256Hex, deepFreezeValue, } from '../private/canonicaljson.js';
+/** Wire bounds, not a listener, permission check, timeout implementation or storage API. */
+export const palletNodeEnrollmentV1Contract = Object.freeze({
+    socketPath: '/run/serve.zone/pallet/control.sock',
+    frame: 'u32be-length-prefixed-utf8-json-then-write-half-close',
+    requestsPerConnection: 1,
+    maxRequestBytes: 32768,
+    maxResponseBytes: 16384,
+});
 export const nodeEnrollmentV1Contract = Object.freeze({
     digestDomain: 'serve.zone/node-enrollment-v1',
     localActivation: 'independently-durable-convergence',
@@ -183,4 +191,65 @@ export const snapshotNodeEnrollmentStateV1 = (valueArg) => {
     return deepFreezeValue({ schemaVersion: 1, nodeId: id(value.nodeId), pallet: 'absent',
         spark: { generation: counter(spark.generation, 1, true), sessionEpoch: counter(spark.sessionEpoch, 0, true) } });
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZWVucm9sbG1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25vZGVlbnJvbGxtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFDTCxzQkFBc0IsRUFDdEIsNEJBQTRCLEVBQzVCLGVBQWUsRUFDZixlQUFlLEdBQ2hCLE1BQU0sNkJBQTZCLENBQUM7QUErRHJDLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDcEQsWUFBWSxFQUFFLCtCQUErQjtJQUM3QyxlQUFlLEVBQUUsbUNBQW1DO0lBQ3BELGNBQWMsRUFBRSxtQkFBbUI7SUFDbkMsaUJBQWlCLEVBQUUsOEJBQThCO0NBQ3pDLENBQUMsQ0FBQztBQUVaLE1BQU0sSUFBSSxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNyRixTQUFTLFlBQVksQ0FBQyxRQUFpQjtJQUNyQyxJQUFJLENBQUMsUUFBUTtRQUFFLElBQUksRUFBRSxDQUFDO0FBQ3hCLENBQUM7QUFFRCxrRkFBa0Y7QUFDbEYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQTBCLEVBQTJCLEVBQUU7SUFDeEYsWUFBWSxDQUFDLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEQsWUFBWSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxJQUFJLFNBQVMsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUNuRSxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZDLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUM3QyxNQUFNLFFBQVEsR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUM5RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ3ZCLFlBQVksQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQy9ELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDbEUsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUMzRSxRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQztJQUNuQyxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxJQUFJLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFO0lBQ3JELFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzdGLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztJQUM5RSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQzdELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDOUQsWUFBWSxDQUFDLEtBQUssRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNqRSxZQUFZLENBQUMsTUFBTSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ25FLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNyQyxDQUFDLENBQUM7QUFDRixNQUFNLEVBQUUsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUN2QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHdCQUF3QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ3pDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDOUUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFVBQVUsR0FBRyxDQUFDLEVBQUUsWUFBWSxHQUFHLEtBQUssRUFBVSxFQUFFO0lBQ2xGLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDdEUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLFFBQVEsSUFBSSxVQUFVO1dBQ2xELENBQUMsQ0FBQyxZQUFZLElBQUksUUFBUSxHQUFHLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDNUQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDM0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxDQUFDO0lBQ3RFLElBQUksR0FBUSxDQUFDO0lBQ2IsSUFBSSxDQUFDO1FBQUMsR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQ3pELFlBQVksQ0FBQyxHQUFHLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEdBQUcsQ0FBQyxRQUFRLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDckcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDN0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLEdBQUcsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVGLFlBQVksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQ2xELHdDQUF3QyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxRQUFRLEdBQUcsQ0FDZixRQUFpQixFQUFFLFVBQW9CLEVBQ3NCLEVBQUU7SUFDL0QsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFNBQVMsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsV0FBVztRQUNwRixvQkFBb0IsRUFBRSxzQkFBc0IsQ0FBQyxDQUFDLENBQUM7SUFDakQsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLENBQUM7SUFDM0MsT0FBTyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsY0FBYyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ3RHLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEVBQUUsQ0FBQyxFQUFFLElBQUksQ0FBQztRQUNoRyxvQkFBb0IsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLG9CQUFvQixFQUFFLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3pFLENBQUMsQ0FBQztBQUVGLE1BQU0sY0FBYyxHQUFHLENBQ3JCLFFBQTBGLEVBQzFGLFNBQTJGLEVBQ3JGLEVBQUU7SUFDUixZQUFZLENBQUMsUUFBUSxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsY0FBYztXQUM1RCxRQUFRLENBQUMsVUFBVSxLQUFLLFNBQVMsQ0FBQyxVQUFVLElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDbkcsQ0FBQyxDQUFDO0FBRUYsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsUUFBaUIsRUFBcUIsRUFBRTtJQUMvRSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsZUFBZSxFQUFFLGNBQWMsRUFBRSxlQUFlLEVBQUUsVUFBVTtRQUMxRixXQUFXLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUMvQixZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN4Qyx5RUFBeUU7SUFDekUsWUFBWSxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsQ0FBQztJQUM5RSxNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0RSxZQUFZLENBQUMsSUFBSSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDbkQsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLEtBQUssS0FBSyxNQUFNO1FBQzdELENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDN0QsWUFBWSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssTUFBTSxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssZ0JBQWdCLENBQUMsQ0FBQztJQUMvRSxNQUFNLENBQUMsVUFBVSxFQUFFLFdBQVcsQ0FBQyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDMUQsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM1QyxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQy9DLGNBQWMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDOUIsWUFBWSxDQUFDLE1BQU0sQ0FBQyxrQkFBa0IsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLG9CQUFvQixLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ25GLFlBQVksQ0FBQyxTQUFTLENBQUMsSUFBSSxLQUFLLE1BQU07UUFDcEMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLG9CQUFvQixLQUFLLENBQUM7UUFDcEUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNsQyxPQUFPLGVBQWUsQ0FBQyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQy9FLGFBQWEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQztRQUM5RSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNO1lBQ2xDLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEVBQUU7WUFDeEQsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFO1FBQ2xHLFdBQVcsRUFBRSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDcEMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsS0FBSyxFQUFFLFFBQTJCLEVBQW1CLEVBQUU7SUFDbEcsTUFBTSxPQUFPLEdBQUcsd0JBQXdCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkQsT0FBTyw0QkFBNEIsQ0FBQyxzQkFBc0IsQ0FBQztRQUN6RCxNQUFNLEVBQUUsd0JBQXdCLENBQUMsWUFBWSxFQUFFLE9BQU87S0FDdkQsRUFBRSxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLFFBQWlCLEVBQTRCLEVBQUU7SUFDN0YsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3hELE1BQU0sVUFBVSxHQUFHLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUM5RCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3RELFlBQVksQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGVBQWUsQ0FBQyxDQUFDO0lBQzNFLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDL0MsWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssV0FBVyxJQUFJLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxLQUFLLE1BQU07UUFDN0UsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLDJCQUEyQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMvRixPQUFPLGVBQWUsQ0FBQyxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztBQUM1RixDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxRQUFrQyxFQUFFLGVBQXVDLEVBQ3pELEVBQUU7SUFDcEIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsR0FBRywrQkFBK0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN4RSxJQUFJLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsSUFBSSxlQUFlLEtBQUssUUFBUSxDQUFDO2VBQzVELENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLGVBQWUsSUFBSSxlQUFlLEtBQUssV0FBVyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDeEYseUVBQXlFO1FBQ3pFLE1BQU0sTUFBTSxHQUFHLE1BQU0sZUFBZSxDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNuRixPQUFPLE1BQU0sS0FBSyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssV0FBVztZQUMzQyxDQUFDLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sS0FBSyxDQUFDO0lBQUMsQ0FBQztBQUMzQixDQUFDLENBQUM7QUFFRixNQUFNLHlCQUF5QixHQUFHLENBQ2hDLFFBQWlCLEVBQUUsVUFBb0IsRUFDNkIsRUFBRTtJQUN0RSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsU0FBUyxFQUFFLGdCQUFnQixFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUN2RyxZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sS0FBSyxVQUFVLENBQUMsQ0FBQztJQUMzQyxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxjQUFjLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsRUFBRSxVQUFVLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDdEcsU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsVUFBVSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQyxFQUFFLENBQUM7QUFDakYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsUUFBaUIsRUFDaUIsRUFBRTtJQUNwQyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsZUFBZSxFQUFFLGNBQWMsRUFBRSxlQUFlLEVBQUUsUUFBUTtRQUN4RixlQUFlLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUNuQyxZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN4QyxNQUFNLENBQUMsVUFBVSxFQUFFLFdBQVcsQ0FBQyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDMUQsTUFBTSxLQUFLLEdBQUcseUJBQXlCLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQzdELE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNoRSxjQUFjLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzlCLFlBQVksQ0FBQyxNQUFNLENBQUMsVUFBVSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3RDLE9BQU8sZUFBZSxDQUFDLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxZQUFZLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7UUFDL0UsYUFBYSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQUUsTUFBTSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3BFLGFBQWEsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7QUFDOUUsQ0FBQyxDQUFDO0FBRUYsNEZBQTRGO0FBQzVGLE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLEtBQUssRUFDdEQsYUFBZ0MsRUFBRSxrQkFBb0QsRUFDM0MsRUFBRTtJQUM3QyxNQUFNLFVBQVUsR0FBRyx3QkFBd0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMzRCxNQUFNLEdBQUcsR0FBRyx1Q0FBdUMsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ3hFLFlBQVksQ0FBQyxHQUFHLENBQUMsWUFBWSxLQUFLLFVBQVUsQ0FBQyxZQUFZLElBQUksR0FBRyxDQUFDLGFBQWEsS0FBSyxVQUFVLENBQUMsYUFBYTtXQUN0RyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxLQUFLLE1BQU0sSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMzRixLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBVSxFQUFFLENBQUM7UUFDcEMsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQyxNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3RDLFlBQVksQ0FBQyxNQUFNLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxPQUFPLElBQUksTUFBTSxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsY0FBYztlQUNoRyxNQUFNLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUztlQUNwRixNQUFNLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxrQkFBa0IsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsWUFBWSxDQUFDLEdBQUcsQ0FBQyxhQUFhLEtBQUssTUFBTSw2QkFBNkIsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLE9BQU8sR0FBRyxDQUFDO0FBQ2IsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FBQyxRQUFpQixFQUEwQixFQUFFO0lBQ3pGLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQy9FLFlBQVksQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ3JFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUMsWUFBWSxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDbEUsT0FBTyxlQUFlLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRO1FBQ25GLEtBQUssRUFBRSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztBQUNySCxDQUFDLENBQUMifQ==
+/** Decoded JSON/data records only, captured synchronously; never invokes getters. */
+export const snapshotPalletNodeEnrollmentPreparationV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'purpose', 'installationId', 'mutationId',
+        'cloudlyOrigin', 'nodeId']);
+    requireValue(value.schemaVersion === 1 && value.purpose === 'pallet');
+    return deepFreezeValue({ schemaVersion: 1, purpose: 'pallet',
+        installationId: id(value.installationId), mutationId: id(value.mutationId),
+        cloudlyOrigin: origin(value.cloudlyOrigin), nodeId: value.nodeId === null ? null : id(value.nodeId) });
+};
+/** Content binding only. Authenticate the local Pallet transport before trusting this proposal. */
+export const bindPalletNodeEnrollmentPreparationV1 = (preparationArg, proposalArg) => {
+    const preparation = snapshotPalletNodeEnrollmentPreparationV1(preparationArg);
+    const result = proposal(proposalArg, 'pallet');
+    requireValue(result.installationId === preparation.installationId
+        && result.mutationId === preparation.mutationId
+        && result.expectedGeneration === 0 && result.expectedSessionEpoch === 0);
+    return deepFreezeValue(result);
+};
+/** Capture the exact wrapper and both nested values before any asynchronous content binding. */
+export const snapshotPalletNodeEnrollmentActivationV1 = (valueArg) => {
+    const value = record(valueArg, ['enrollment', 'acknowledgement']);
+    return deepFreezeValue({ enrollment: snapshotNodeEnrollmentV1(value.enrollment),
+        acknowledgement: snapshotNodeEnrollmentAcknowledgementV1(value.acknowledgement) });
+};
+export const snapshotPalletNodeEnrollmentConfirmationV1 = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'purpose', 'enrollmentId', 'cloudlyOrigin',
+        'requestDigest', 'phase', 'nodeId']);
+    requireValue(value.schemaVersion === 1 && value.purpose === 'pallet'
+        && (value.phase === 'bound' || value.phase === 'active'));
+    const common = { schemaVersion: 1, purpose: 'pallet',
+        enrollmentId: hash(value.enrollmentId), cloudlyOrigin: origin(value.cloudlyOrigin),
+        requestDigest: hash(value.requestDigest) };
+    return deepFreezeValue(value.phase === 'bound'
+        ? { ...common, phase: 'bound', nodeId: value.nodeId === null ? null : id(value.nodeId) }
+        : { ...common, phase: 'active', nodeId: id(value.nodeId) });
+};
+/** Pure binding only. Pallet must prove its durable pending binding before issuing this response. */
+export const bindPalletNodeEnrollmentBoundV1 = async (enrollmentArg, confirmationArg) => {
+    const enrollment = snapshotNodeEnrollmentV1(enrollmentArg);
+    const confirmation = snapshotPalletNodeEnrollmentConfirmationV1(confirmationArg);
+    requireValue(confirmation.phase === 'bound' && confirmation.enrollmentId === enrollment.enrollmentId
+        && confirmation.cloudlyOrigin === enrollment.cloudlyOrigin
+        && confirmation.nodeId === (enrollment.bootstrap.kind === 'jump' ? null : enrollment.bootstrap.nodeId));
+    requireValue(confirmation.requestDigest === await computeNodeEnrollmentV1Digest(enrollment));
+    return confirmation;
+};
+/**
+ * Pure binding only, NOT authentication or a database check. The root-authenticated
+ * Pallet owner must first prove its exact CURRENT local identity, not just a receipt.
+ * This does not assert Spark activation, current Cloudly authority or workload readiness.
+ */
+export const bindPalletNodeEnrollmentActiveV1 = async (activationArg, confirmationArg) => {
+    // Capture every caller-owned value before the asynchronous shared acknowledgement binder.
+    const { enrollment, acknowledgement } = snapshotPalletNodeEnrollmentActivationV1(activationArg);
+    const confirmation = snapshotPalletNodeEnrollmentConfirmationV1(confirmationArg);
+    requireValue(confirmation.phase === 'active');
+    const ack = await bindNodeEnrollmentAcknowledgementV1(enrollment, acknowledgement);
+    requireValue(confirmation.enrollmentId === ack.enrollmentId && confirmation.cloudlyOrigin === ack.cloudlyOrigin
+        && confirmation.nodeId === ack.nodeId && confirmation.requestDigest === ack.requestDigest);
+    return confirmation;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZWVucm9sbG1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25vZGVlbnJvbGxtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFDTCxzQkFBc0IsRUFDdEIsNEJBQTRCLEVBQzVCLGVBQWUsRUFDZixlQUFlLEdBQ2hCLE1BQU0sNkJBQTZCLENBQUM7QUF1R3JDLDRGQUE0RjtBQUM1RixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzFELFVBQVUsRUFBRSxxQ0FBcUM7SUFDakQsS0FBSyxFQUFFLHVEQUF1RDtJQUM5RCxxQkFBcUIsRUFBRSxDQUFDO0lBQ3hCLGVBQWUsRUFBRSxLQUFLO0lBQ3RCLGdCQUFnQixFQUFFLEtBQUs7Q0FDZixDQUFDLENBQUM7QUFFWixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3BELFlBQVksRUFBRSwrQkFBK0I7SUFDN0MsZUFBZSxFQUFFLG1DQUFtQztJQUNwRCxjQUFjLEVBQUUsbUJBQW1CO0lBQ25DLGlCQUFpQixFQUFFLDhCQUE4QjtDQUN6QyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLG9DQUFvQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDckYsU0FBUyxZQUFZLENBQUMsUUFBaUI7SUFDckMsSUFBSSxDQUFDLFFBQVE7UUFBRSxJQUFJLEVBQUUsQ0FBQztBQUN4QixDQUFDO0FBRUQsa0ZBQWtGO0FBQ2xGLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUEwQixFQUEyQixFQUFFO0lBQ3hGLFlBQVksQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELFlBQVksQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDbkUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2QyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDN0MsTUFBTSxRQUFRLEdBQTRCLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDOUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUN2QixZQUFZLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUMvRCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ2xFLFlBQVksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDM0UsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUM7SUFDbkMsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sSUFBSSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRTtJQUNyRCxZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM3RixZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDOUUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUMsQ0FBQztJQUM3RCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQzlELFlBQVksQ0FBQyxLQUFLLEVBQUUsVUFBVSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDakUsWUFBWSxDQUFDLE1BQU0sRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNuRSxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDckMsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxFQUFFLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDdkMsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN0RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLElBQUksR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUN6QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGdCQUFnQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzlFLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sT0FBTyxHQUFHLENBQUMsUUFBaUIsRUFBRSxVQUFVLEdBQUcsQ0FBQyxFQUFFLFlBQVksR0FBRyxLQUFLLEVBQVUsRUFBRTtJQUNsRixZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDO1dBQ3RFLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxRQUFRLElBQUksVUFBVTtXQUNsRCxDQUFDLENBQUMsWUFBWSxJQUFJLFFBQVEsR0FBRyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQzVELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzNDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsQ0FBQztJQUN0RSxJQUFJLEdBQVEsQ0FBQztJQUNiLElBQUksQ0FBQztRQUFDLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUFDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQUMsQ0FBQztJQUN6RCxZQUFZLENBQUMsR0FBRyxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxHQUFHLENBQUMsUUFBUSxJQUFJLENBQUMsR0FBRyxDQUFDLFFBQVEsSUFBSSxHQUFHLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ3JHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzdDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sSUFBSSxHQUFHLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM1RixZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUNsRCx3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzVELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sUUFBUSxHQUFHLENBQ2YsUUFBaUIsRUFBRSxVQUFvQixFQUNzQixFQUFFO0lBQy9ELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsWUFBWSxFQUFFLFdBQVc7UUFDcEYsb0JBQW9CLEVBQUUsc0JBQXNCLENBQUMsQ0FBQyxDQUFDO0lBQ2pELFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxLQUFLLFVBQVUsQ0FBQyxDQUFDO0lBQzNDLE9BQU8sRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLGNBQWMsRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUN0RyxTQUFTLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxrQkFBa0IsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLGtCQUFrQixFQUFFLENBQUMsRUFBRSxJQUFJLENBQUM7UUFDaEcsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztBQUN6RSxDQUFDLENBQUM7QUFFRixNQUFNLGNBQWMsR0FBRyxDQUNyQixRQUEwRixFQUMxRixTQUEyRixFQUNyRixFQUFFO0lBQ1IsWUFBWSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLGNBQWM7V0FDNUQsUUFBUSxDQUFDLFVBQVUsS0FBSyxTQUFTLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0FBQ25HLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFFBQWlCLEVBQXFCLEVBQUU7SUFDL0UsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxjQUFjLEVBQUUsZUFBZSxFQUFFLFVBQVU7UUFDMUYsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDL0IsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDeEMseUVBQXlFO0lBQ3pFLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDOUUsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdEUsWUFBWSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ25ELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLEtBQUssTUFBTTtRQUM3RCxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzdELFlBQVksQ0FBQyxTQUFTLENBQUMsSUFBSSxLQUFLLE1BQU0sSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLGdCQUFnQixDQUFDLENBQUM7SUFDL0UsTUFBTSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzFELE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDNUMsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUMvQyxjQUFjLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzlCLFlBQVksQ0FBQyxNQUFNLENBQUMsa0JBQWtCLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxvQkFBb0IsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNuRixZQUFZLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNO1FBQ3BDLENBQUMsQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxvQkFBb0IsS0FBSyxDQUFDO1FBQ3BFLENBQUMsQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbEMsT0FBTyxlQUFlLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQztRQUMvRSxhQUFhLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsRUFBRSxRQUFRLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUM7UUFDOUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxJQUFJLEtBQUssTUFBTTtZQUNsQyxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFO1lBQ3hELENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRTtRQUNsRyxXQUFXLEVBQUUsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQ3BDLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLEtBQUssRUFBRSxRQUEyQixFQUFtQixFQUFFO0lBQ2xHLE1BQU0sT0FBTyxHQUFHLHdCQUF3QixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25ELE9BQU8sNEJBQTRCLENBQUMsc0JBQXNCLENBQUM7UUFDekQsTUFBTSxFQUFFLHdCQUF3QixDQUFDLFlBQVksRUFBRSxPQUFPO0tBQ3ZELEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxRQUFpQixFQUE0QixFQUFFO0lBQzdGLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN4RCxNQUFNLFVBQVUsR0FBRyx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDOUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN0RCxZQUFZLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxlQUFlLENBQUMsQ0FBQztJQUMzRSxZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQy9DLFlBQVksQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNO1FBQzdFLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQywyQkFBMkIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDL0YsT0FBTyxlQUFlLENBQUMsRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLEVBQUUsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDNUYsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLEtBQUssRUFDOUMsUUFBa0MsRUFBRSxlQUF1QyxFQUN6RCxFQUFFO0lBQ3BCLElBQUksQ0FBQztRQUNILE1BQU0sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFLEdBQUcsK0JBQStCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDeEUsSUFBSSxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksZUFBZSxLQUFLLFFBQVEsQ0FBQztlQUM1RCxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxlQUFlLElBQUksZUFBZSxLQUFLLFdBQVcsQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ3hGLHlFQUF5RTtRQUN6RSxNQUFNLE1BQU0sR0FBRyxNQUFNLGVBQWUsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDbkYsT0FBTyxNQUFNLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVc7WUFDM0MsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLEtBQUssQ0FBQztJQUFDLENBQUM7QUFDM0IsQ0FBQyxDQUFDO0FBRUYsTUFBTSx5QkFBeUIsR0FBRyxDQUNoQyxRQUFpQixFQUFFLFVBQW9CLEVBQzZCLEVBQUU7SUFDdEUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLFNBQVMsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDdkcsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDLENBQUM7SUFDM0MsT0FBTyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsY0FBYyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ3RHLFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDO0FBQ2pGLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVDQUF1QyxHQUFHLENBQ3JELFFBQWlCLEVBQ2lCLEVBQUU7SUFDcEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxjQUFjLEVBQUUsZUFBZSxFQUFFLFFBQVE7UUFDeEYsZUFBZSxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDbkMsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDeEMsTUFBTSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzFELE1BQU0sS0FBSyxHQUFHLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM3RCxNQUFNLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDaEUsY0FBYyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUM5QixZQUFZLENBQUMsTUFBTSxDQUFDLFVBQVUsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN0QyxPQUFPLGVBQWUsQ0FBQyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQy9FLGFBQWEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUNwRSxhQUFhLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQzlFLENBQUMsQ0FBQztBQUVGLDRGQUE0RjtBQUM1RixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxLQUFLLEVBQ3RELGFBQWdDLEVBQUUsa0JBQW9ELEVBQzNDLEVBQUU7SUFDN0MsTUFBTSxVQUFVLEdBQUcsd0JBQXdCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDM0QsTUFBTSxHQUFHLEdBQUcsdUNBQXVDLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUN4RSxZQUFZLENBQUMsR0FBRyxDQUFDLFlBQVksS0FBSyxVQUFVLENBQUMsWUFBWSxJQUFJLEdBQUcsQ0FBQyxhQUFhLEtBQUssVUFBVSxDQUFDLGFBQWE7V0FDdEcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDM0YsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQVUsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDL0MsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN0QyxZQUFZLENBQUMsTUFBTSxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsT0FBTyxJQUFJLE1BQU0sQ0FBQyxjQUFjLEtBQUssUUFBUSxDQUFDLGNBQWM7ZUFDaEcsTUFBTSxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUMsVUFBVSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssUUFBUSxDQUFDLFNBQVM7ZUFDcEYsTUFBTSxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUMsa0JBQWtCLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELFlBQVksQ0FBQyxHQUFHLENBQUMsYUFBYSxLQUFLLE1BQU0sNkJBQTZCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNwRixPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQUMsUUFBaUIsRUFBMEIsRUFBRTtJQUN6RixNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUMvRSxZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQztJQUNyRSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDLFlBQVksRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLE9BQU8sZUFBZSxDQUFDLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUTtRQUNuRixLQUFLLEVBQUUsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQyxFQUFFLElBQUksQ0FBQyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDckgsQ0FBQyxDQUFDO0FBRUYscUZBQXFGO0FBQ3JGLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLENBQ3ZELFFBQWlCLEVBQ21CLEVBQUU7SUFDdEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsWUFBWTtRQUN4RixlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM5QixZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQztJQUN0RSxPQUFPLGVBQWUsQ0FBQyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLFFBQVE7UUFDMUQsY0FBYyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQzFFLGFBQWEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUMzRyxDQUFDLENBQUM7QUFFRixtR0FBbUc7QUFDbkcsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsQ0FDbkQsY0FBa0QsRUFBRSxXQUFvQixFQUNuQyxFQUFFO0lBQ3ZDLE1BQU0sV0FBVyxHQUFHLHlDQUF5QyxDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBQzlFLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDL0MsWUFBWSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWM7V0FDNUQsTUFBTSxDQUFDLFVBQVUsS0FBSyxXQUFXLENBQUMsVUFBVTtXQUM1QyxNQUFNLENBQUMsa0JBQWtCLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxvQkFBb0IsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUMzRSxPQUFPLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUNqQyxDQUFDLENBQUM7QUFFRixnR0FBZ0c7QUFDaEcsTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsQ0FDdEQsUUFBaUIsRUFDa0IsRUFBRTtJQUNyQyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsWUFBWSxFQUFFLGlCQUFpQixDQUFDLENBQUMsQ0FBQztJQUNsRSxPQUFPLGVBQWUsQ0FBQyxFQUFFLFVBQVUsRUFBRSx3QkFBd0IsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQzdFLGVBQWUsRUFBRSx1Q0FBdUMsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQ3ZGLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDBDQUEwQyxHQUFHLENBQ3hELFFBQWlCLEVBQ29CLEVBQUU7SUFDdkMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxTQUFTLEVBQUUsY0FBYyxFQUFFLGVBQWU7UUFDekYsZUFBZSxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3ZDLFlBQVksQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsT0FBTyxLQUFLLFFBQVE7V0FDL0QsQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLE9BQU8sSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDNUQsTUFBTSxNQUFNLEdBQUcsRUFBRSxhQUFhLEVBQUUsQ0FBVSxFQUFFLE9BQU8sRUFBRSxRQUFpQjtRQUNwRSxZQUFZLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBRSxhQUFhLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUM7UUFDbEYsYUFBYSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztJQUM3QyxPQUFPLGVBQWUsQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLE9BQU87UUFDNUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxNQUFNLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRTtRQUN4RixDQUFDLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUNoRSxDQUFDLENBQUM7QUFFRixxR0FBcUc7QUFDckcsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsS0FBSyxFQUNsRCxhQUFnQyxFQUFFLGVBQTZDLEVBQ3hDLEVBQUU7SUFDekMsTUFBTSxVQUFVLEdBQUcsd0JBQXdCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDM0QsTUFBTSxZQUFZLEdBQUcsMENBQTBDLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDakYsWUFBWSxDQUFDLFlBQVksQ0FBQyxLQUFLLEtBQUssT0FBTyxJQUFJLFlBQVksQ0FBQyxZQUFZLEtBQUssVUFBVSxDQUFDLFlBQVk7V0FDL0YsWUFBWSxDQUFDLGFBQWEsS0FBSyxVQUFVLENBQUMsYUFBYTtXQUN2RCxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMxRyxZQUFZLENBQUMsWUFBWSxDQUFDLGFBQWEsS0FBSyxNQUFNLDZCQUE2QixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDN0YsT0FBTyxZQUFZLENBQUM7QUFDdEIsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEtBQUssRUFDbkQsYUFBZ0QsRUFDaEQsZUFBOEMsRUFDTixFQUFFO0lBQzFDLDBGQUEwRjtJQUMxRixNQUFNLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxHQUFHLHdDQUF3QyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ2hHLE1BQU0sWUFBWSxHQUFHLDBDQUEwQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBQ2pGLFlBQVksQ0FBQyxZQUFZLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQzlDLE1BQU0sR0FBRyxHQUFHLE1BQU0sbUNBQW1DLENBQUMsVUFBVSxFQUFFLGVBQWUsQ0FBQyxDQUFDO0lBQ25GLFlBQVksQ0FBQyxZQUFZLENBQUMsWUFBWSxLQUFLLEdBQUcsQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDLGFBQWEsS0FBSyxHQUFHLENBQUMsYUFBYTtXQUMxRyxZQUFZLENBQUMsTUFBTSxLQUFLLEdBQUcsQ0FBQyxNQUFNLElBQUksWUFBWSxDQUFDLGFBQWEsS0FBSyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDN0YsT0FBTyxZQUFZLENBQUM7QUFDdEIsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/admin.d.ts

@@ -1,5 +1,49 @@
 import * as plugins from '../plugins.js';
 import type { IIdentity, IIdentityCredential, IServiceDeploymentGrant } from '../data/user.js';
+/** Backend-owned human credential metadata; never includes a password verifier. */
+export interface IHumanCredentialMetadata {
+    userId: string;
+    generation: number;
+    passwordEnabled: boolean;
+    updatedAt: number;
+}
+export interface IReq_Admin_GetHumanCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_GetHumanCredential> {
+    method: 'getHumanCredential';
+    request: {
+        identity: IIdentityCredential;
+        userId: string;
+    };
+    response: {
+        credential: IHumanCredentialMetadata;
+    };
+}
+/**
+ * Requires a recently authenticated human administrator. Each operation invalidates
+ * previously issued human UI/API and registry sessions. Revoking a password retains
+ * the user's upstream OIDC binding, so a new trusted OIDC login remains possible.
+ */
+export interface IReq_Admin_MutateHumanCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_MutateHumanCredential> {
+    method: 'mutateHumanCredential';
+    request: {
+        identity: IIdentityCredential;
+        userId: string;
+        mutationId: string;
+        expectedGeneration: number;
+        operation: {
+            kind: 'rotatePassword';
+            password: string;
+        } | {
+            kind: 'revokePassword';
+        } | {
+            kind: 'revokeSessions';
+        };
+    };
+    response: {
+        /** Historical on replay; read getHumanCredential for current state. */
+        credential: IHumanCredentialMetadata;
+        replayed: boolean;
+    };
+}
 export interface IReq_Admin_LoginWithUsernameAndPassword extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_LoginWithUsernameAndPassword> {
     method: 'adminLoginWithUsernameAndPassword';
     request: {

package/dist_ts/requests/index.d.ts

@@ -22,6 +22,7 @@ import * as mailRequests from './mail.js';
 import * as migrationRequests from './migration.js';
 import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
+import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
 import * as secretRequests from './secret.js';
@@ -32,7 +33,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -23,6 +23,7 @@ import * as mailRequests from './mail.js';
 import * as migrationRequests from './migration.js';
 import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
+import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
 import * as secretRequests from './secret.js';
@@ -33,9 +34,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGtCQUFrQixNQUFNLGlCQUFpQixDQUFDO0FBQ3RELE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsa0JBQWtCLElBQUksVUFBVSxFQUNoQyxXQUFXLElBQUksR0FBRyxFQUNsQixjQUFjLElBQUksTUFBTSxFQUN4Qix3QkFBd0IsSUFBSSxnQkFBZ0IsRUFDNUMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsWUFBWSxJQUFJLElBQUksRUFDcEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGtCQUFrQixNQUFNLGlCQUFpQixDQUFDO0FBQ3RELE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsa0JBQWtCLElBQUksVUFBVSxFQUNoQyxXQUFXLElBQUksR0FBRyxFQUNsQixjQUFjLElBQUksTUFBTSxFQUN4Qix3QkFBd0IsSUFBSSxnQkFBZ0IsRUFDNUMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsWUFBWSxJQUFJLElBQUksRUFDcEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/requests/pallet.d.ts

@@ -0,0 +1,23 @@
+import * as plugins from '../plugins.js';
+import type { INodeEnrollmentV1, IPalletNodeEnrollmentActivationV1, IPalletNodeEnrollmentPreparationV1, IPalletNodeEnrollmentBoundV1, IPalletNodeEnrollmentActiveV1 } from '../data/nodeenrollment.js';
+/** Root-authenticated node-local IPC only; never expose on a network router. */
+export interface IReq_Spark_Pallet_PrepareNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_PrepareNodeEnrollmentV1> {
+    method: 'preparePalletNodeEnrollmentV1';
+    request: IPalletNodeEnrollmentPreparationV1;
+    /** Return only a current pending proposal, never bearer material or a historical preparation. */
+    response: INodeEnrollmentV1['credentials'][1];
+}
+/** First enrollment only, not generic credential rotation. */
+export interface IReq_Spark_Pallet_BindNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_BindNodeEnrollmentV1> {
+    method: 'bindPalletNodeEnrollmentV1';
+    request: INodeEnrollmentV1;
+    /** Issued only after proving the exact durable pending binding. */
+    response: IPalletNodeEnrollmentBoundV1;
+}
+export interface IReq_Spark_Pallet_ActivateNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Spark_Pallet_ActivateNodeEnrollmentV1> {
+    method: 'activatePalletNodeEnrollmentV1';
+    /** The trusted Spark coordinator must authenticate Cloudly before submitting its acknowledgement. */
+    request: IPalletNodeEnrollmentActivationV1;
+    /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
+    response: IPalletNodeEnrollmentActiveV1;
+}

package/dist_ts/requests/pallet.js

@@ -0,0 +1,2 @@
+import * as plugins from '../plugins.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGFsbGV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvcGFsbGV0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "28.1.0",
+  "version": "28.3.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -31,7 +31,7 @@
     "@git.zone/tsdoc": "^2.2.0",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "^4.0.0",
-    "@types/node": "^26.4.1"
+    "@types/node": "26.4.0"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -47,6 +47,21 @@ validator; unlike `@serve.zone/interfaces/runtime`, it does not load the general
 runtime graph, `plugins.js`, SmartCrypto, TypedRequest, Corestore, or settlement
 runtime modules.
 
+### Human Credential Administration
+
+`requests.admin.getHumanCredential` and `mutateHumanCredential` describe human
+credential inspection and mutation for recently authenticated administrators.
+Operations rotate a password, revoke password login, or revoke existing sessions.
+Each successful mutation advances the generation and invalidates older human
+UI/API and OCI registry sessions. Upstream OIDC identity bindings remain intact.
+
+Send the expected generation and a stable mutation ID. After a lost response,
+authenticate again and repeat the same request. A replay returns the original
+metadata without applying the operation again; inspect current metadata separately.
+Requests containing passwords must never be logged. Responses contain no passwords
+or verifiers. Cloudly owns validation, atomic persistence, and session enforcement;
+these shared contracts alone do not implement an endpoint.
+
 ### Node Credential Administration
 
 `requests.node` defines `getNodeCredential`, `rotateNodeCredential` and
@@ -106,6 +121,35 @@ local activation independently and converge after restart; there is no shared
 plaintext vault or cross-local-database ACID claim. Never log proof/request bodies
 or hashes, put them in URLs, or expose them through transport hooks.
 
+`requests.pallet` defines the node-local `preparePalletNodeEnrollmentV1`,
+`bindPalletNodeEnrollmentV1` and `activatePalletNodeEnrollmentV1` methods. They
+belong only on the protected root-owned Unix control socket, never a network
+router. Preparation requests initial Pallet authority (zero generation and
+session epoch) and returns only its independently retained credential hash.
+`snapshotPalletNodeEnrollmentPreparationV1` and
+`bindPalletNodeEnrollmentPreparationV1` validate that exact exchange.
+
+Local confirmations explicitly distinguish a durable pending binding from the
+exact current active Pallet identity. `bindPalletNodeEnrollmentBoundV1` verifies
+the whole enrollment digest and its pre-assignment node ID (null for fresh Jump).
+`snapshotPalletNodeEnrollmentActivationV1` captures the exact activation request,
+rejecting extra wrapper fields as well as malformed nested data.
+`bindPalletNodeEnrollmentActiveV1` takes that complete activation request and
+verifies the full Cloudly acknowledgement, including both owners and the assigned
+node ID. Both confirmation binders return detached frozen
+snapshots captured before hashing. These are pure content checks: authenticate
+the local transport separately, and have Pallet prove its current owned state
+before issuing a confirmation. A historical receipt is insufficient, and Pallet
+activation does not imply Spark activation or workload readiness.
+
+`palletNodeEnrollmentV1Contract` specifies one four-byte unsigned big-endian
+length-prefixed UTF-8 JSON frame per direction, followed by write-half-close, at
+most 32768 request bytes and 16384 response bytes excluding the prefix. Implement
+the listener with half-open response support, strict EOF/trailing-byte rejection,
+bounded time/concurrency, root-only directory/socket permissions and drained
+cleanup. The package supplies no listener, permission checks or persistent state.
+No bearer, generic rotation operation or database access is part of this IPC API.
+
 ### Node-Bound Runtime Assignments
 
 The `data` namespace exports `IRuntimeAssignmentV1`, canonical digest helpers,

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '28.1.0',
+  version: '28.3.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/nodeenrollment.ts

@@ -67,6 +67,55 @@ export interface INodeEnrollmentStateV1 {
   pallet: 'absent';
 }
 
+/** Root-authenticated, node-local IPC only. Initial Pallet authority is always absent. */
+export interface IPalletNodeEnrollmentPreparationV1 {
+  schemaVersion: 1;
+  purpose: 'pallet';
+  installationId: string;
+  mutationId: string;
+  cloudlyOrigin: string;
+  nodeId: string | null;
+}
+
+/** Full exact activation wire body; Cloudly authentication remains the coordinator's responsibility. */
+export interface IPalletNodeEnrollmentActivationV1 {
+  enrollment: INodeEnrollmentV1;
+  acknowledgement: INodeEnrollmentAcknowledgementV1;
+}
+
+interface IPalletNodeEnrollmentConfirmationBaseV1 {
+  schemaVersion: 1;
+  purpose: 'pallet';
+  enrollmentId: string;
+  cloudlyOrigin: string;
+  requestDigest: string;
+}
+
+/** The exact pending binding is durable now, not merely a historical receipt. */
+export interface IPalletNodeEnrollmentBoundV1 extends IPalletNodeEnrollmentConfirmationBaseV1 {
+  phase: 'bound';
+  /** Null before Cloudly assigns a fresh Jump node; exact existing node for adoption. */
+  nodeId: string | null;
+}
+
+/** Exact CURRENT local Pallet identity, not Spark activation or remote authorization. */
+export interface IPalletNodeEnrollmentActiveV1 extends IPalletNodeEnrollmentConfirmationBaseV1 {
+  phase: 'active';
+  nodeId: string;
+}
+
+export type TPalletNodeEnrollmentConfirmationV1 =
+  | IPalletNodeEnrollmentBoundV1 | IPalletNodeEnrollmentActiveV1;
+
+/** Wire bounds, not a listener, permission check, timeout implementation or storage API. */
+export const palletNodeEnrollmentV1Contract = Object.freeze({
+  socketPath: '/run/serve.zone/pallet/control.sock',
+  frame: 'u32be-length-prefixed-utf8-json-then-write-half-close',
+  requestsPerConnection: 1,
+  maxRequestBytes: 32768,
+  maxResponseBytes: 16384,
+} as const);
+
 export const nodeEnrollmentV1Contract = Object.freeze({
   digestDomain: 'serve.zone/node-enrollment-v1',
   localActivation: 'independently-durable-convergence',
@@ -268,3 +317,83 @@ export const snapshotNodeEnrollmentStateV1 = (valueArg: unknown): INodeEnrollmen
   return deepFreezeValue({ schemaVersion: 1, nodeId: id(value.nodeId), pallet: 'absent',
     spark: { generation: counter(spark.generation, 1, true), sessionEpoch: counter(spark.sessionEpoch, 0, true) } });
 };
+
+/** Decoded JSON/data records only, captured synchronously; never invokes getters. */
+export const snapshotPalletNodeEnrollmentPreparationV1 = (
+  valueArg: unknown,
+): IPalletNodeEnrollmentPreparationV1 => {
+  const value = record(valueArg, ['schemaVersion', 'purpose', 'installationId', 'mutationId',
+    'cloudlyOrigin', 'nodeId']);
+  requireValue(value.schemaVersion === 1 && value.purpose === 'pallet');
+  return deepFreezeValue({ schemaVersion: 1, purpose: 'pallet',
+    installationId: id(value.installationId), mutationId: id(value.mutationId),
+    cloudlyOrigin: origin(value.cloudlyOrigin), nodeId: value.nodeId === null ? null : id(value.nodeId) });
+};
+
+/** Content binding only. Authenticate the local Pallet transport before trusting this proposal. */
+export const bindPalletNodeEnrollmentPreparationV1 = (
+  preparationArg: IPalletNodeEnrollmentPreparationV1, proposalArg: unknown,
+): INodeEnrollmentV1['credentials'][1] => {
+  const preparation = snapshotPalletNodeEnrollmentPreparationV1(preparationArg);
+  const result = proposal(proposalArg, 'pallet');
+  requireValue(result.installationId === preparation.installationId
+    && result.mutationId === preparation.mutationId
+    && result.expectedGeneration === 0 && result.expectedSessionEpoch === 0);
+  return deepFreezeValue(result);
+};
+
+/** Capture the exact wrapper and both nested values before any asynchronous content binding. */
+export const snapshotPalletNodeEnrollmentActivationV1 = (
+  valueArg: unknown,
+): IPalletNodeEnrollmentActivationV1 => {
+  const value = record(valueArg, ['enrollment', 'acknowledgement']);
+  return deepFreezeValue({ enrollment: snapshotNodeEnrollmentV1(value.enrollment),
+    acknowledgement: snapshotNodeEnrollmentAcknowledgementV1(value.acknowledgement) });
+};
+
+export const snapshotPalletNodeEnrollmentConfirmationV1 = (
+  valueArg: unknown,
+): TPalletNodeEnrollmentConfirmationV1 => {
+  const value = record(valueArg, ['schemaVersion', 'purpose', 'enrollmentId', 'cloudlyOrigin',
+    'requestDigest', 'phase', 'nodeId']);
+  requireValue(value.schemaVersion === 1 && value.purpose === 'pallet'
+    && (value.phase === 'bound' || value.phase === 'active'));
+  const common = { schemaVersion: 1 as const, purpose: 'pallet' as const,
+    enrollmentId: hash(value.enrollmentId), cloudlyOrigin: origin(value.cloudlyOrigin),
+    requestDigest: hash(value.requestDigest) };
+  return deepFreezeValue(value.phase === 'bound'
+    ? { ...common, phase: 'bound', nodeId: value.nodeId === null ? null : id(value.nodeId) }
+    : { ...common, phase: 'active', nodeId: id(value.nodeId) });
+};
+
+/** Pure binding only. Pallet must prove its durable pending binding before issuing this response. */
+export const bindPalletNodeEnrollmentBoundV1 = async (
+  enrollmentArg: INodeEnrollmentV1, confirmationArg: IPalletNodeEnrollmentBoundV1,
+): Promise<IPalletNodeEnrollmentBoundV1> => {
+  const enrollment = snapshotNodeEnrollmentV1(enrollmentArg);
+  const confirmation = snapshotPalletNodeEnrollmentConfirmationV1(confirmationArg);
+  requireValue(confirmation.phase === 'bound' && confirmation.enrollmentId === enrollment.enrollmentId
+    && confirmation.cloudlyOrigin === enrollment.cloudlyOrigin
+    && confirmation.nodeId === (enrollment.bootstrap.kind === 'jump' ? null : enrollment.bootstrap.nodeId));
+  requireValue(confirmation.requestDigest === await computeNodeEnrollmentV1Digest(enrollment));
+  return confirmation;
+};
+
+/**
+ * Pure binding only, NOT authentication or a database check. The root-authenticated
+ * Pallet owner must first prove its exact CURRENT local identity, not just a receipt.
+ * This does not assert Spark activation, current Cloudly authority or workload readiness.
+ */
+export const bindPalletNodeEnrollmentActiveV1 = async (
+  activationArg: IPalletNodeEnrollmentActivationV1,
+  confirmationArg: IPalletNodeEnrollmentActiveV1,
+): Promise<IPalletNodeEnrollmentActiveV1> => {
+  // Capture every caller-owned value before the asynchronous shared acknowledgement binder.
+  const { enrollment, acknowledgement } = snapshotPalletNodeEnrollmentActivationV1(activationArg);
+  const confirmation = snapshotPalletNodeEnrollmentConfirmationV1(confirmationArg);
+  requireValue(confirmation.phase === 'active');
+  const ack = await bindNodeEnrollmentAcknowledgementV1(enrollment, acknowledgement);
+  requireValue(confirmation.enrollmentId === ack.enrollmentId && confirmation.cloudlyOrigin === ack.cloudlyOrigin
+    && confirmation.nodeId === ack.nodeId && confirmation.requestDigest === ack.requestDigest);
+  return confirmation;
+};

package/ts/requests/admin.ts

@@ -1,6 +1,50 @@
 import * as plugins from '../plugins.js';
 import type { IIdentity, IIdentityCredential, IServiceDeploymentGrant } from '../data/user.js';
 
+/** Backend-owned human credential metadata; never includes a password verifier. */
+export interface IHumanCredentialMetadata {
+  userId: string;
+  generation: number;
+  passwordEnabled: boolean;
+  updatedAt: number;
+}
+
+export interface IReq_Admin_GetHumanCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Admin_GetHumanCredential
+> {
+  method: 'getHumanCredential';
+  request: { identity: IIdentityCredential; userId: string };
+  response: { credential: IHumanCredentialMetadata };
+}
+
+/**
+ * Requires a recently authenticated human administrator. Each operation invalidates
+ * previously issued human UI/API and registry sessions. Revoking a password retains
+ * the user's upstream OIDC binding, so a new trusted OIDC login remains possible.
+ */
+export interface IReq_Admin_MutateHumanCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Admin_MutateHumanCredential
+> {
+  method: 'mutateHumanCredential';
+  request: {
+    identity: IIdentityCredential;
+    userId: string;
+    mutationId: string;
+    expectedGeneration: number;
+    operation:
+      | { kind: 'rotatePassword'; password: string }
+      | { kind: 'revokePassword' }
+      | { kind: 'revokeSessions' };
+  };
+  response: {
+    /** Historical on replay; read getHumanCredential for current state. */
+    credential: IHumanCredentialMetadata;
+    replayed: boolean;
+  };
+}
+
 export interface IReq_Admin_LoginWithUsernameAndPassword extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
   IReq_Admin_LoginWithUsernameAndPassword

package/ts/requests/index.ts

@@ -24,6 +24,7 @@ import * as mailRequests from './mail.js';
 import * as migrationRequests from './migration.js';
 import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
+import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
 import * as secretRequests from './secret.js';
@@ -60,6 +61,7 @@ export {
   migrationRequests as migration,
   networkRequests as network,
   nodeRequests as node,
+  palletRequests as pallet,
   platformRequests as platform,
   routingRequests as routing,
   secretRequests as secret,

package/ts/requests/pallet.ts

@@ -0,0 +1,38 @@
+import * as plugins from '../plugins.js';
+import type {
+  INodeEnrollmentV1, IPalletNodeEnrollmentActivationV1, IPalletNodeEnrollmentPreparationV1,
+  IPalletNodeEnrollmentBoundV1, IPalletNodeEnrollmentActiveV1,
+} from '../data/nodeenrollment.js';
+
+/** Root-authenticated node-local IPC only; never expose on a network router. */
+export interface IReq_Spark_Pallet_PrepareNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_PrepareNodeEnrollmentV1
+> {
+  method: 'preparePalletNodeEnrollmentV1';
+  request: IPalletNodeEnrollmentPreparationV1;
+  /** Return only a current pending proposal, never bearer material or a historical preparation. */
+  response: INodeEnrollmentV1['credentials'][1];
+}
+
+/** First enrollment only, not generic credential rotation. */
+export interface IReq_Spark_Pallet_BindNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_BindNodeEnrollmentV1
+> {
+  method: 'bindPalletNodeEnrollmentV1';
+  request: INodeEnrollmentV1;
+  /** Issued only after proving the exact durable pending binding. */
+  response: IPalletNodeEnrollmentBoundV1;
+}
+
+export interface IReq_Spark_Pallet_ActivateNodeEnrollmentV1 extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Spark_Pallet_ActivateNodeEnrollmentV1
+> {
+  method: 'activatePalletNodeEnrollmentV1';
+  /** The trusted Spark coordinator must authenticate Cloudly before submitting its acknowledgement. */
+  request: IPalletNodeEnrollmentActivationV1;
+  /** Prove the exact current local identity after activation; a historical receipt is insufficient. */
+  response: IPalletNodeEnrollmentActiveV1;
+}