@serve.zone/interfaces 28.4.0 → 29.0.0

package/changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2026-09-09 - 29.0.0
+
+### Breaking Changes
+
+- add authenticated runtime sessions and explicit runtime config null policies (runtime)
+  - Add runtime session data contracts and TypedRequest interfaces for pallet registration, assignment application, observation reporting, registry credential access, and Cloudly client session registration.
+  - Allow cpuMillis: null to explicitly request no CPU quota.
+  - Allow runAsUser and runAsGroup to be null together to delegate identity resolution to the pinned image OCI user policy, while rejecting partial null identities.
+  - Export the new runtime session contracts and document the v29 runtime contract changes.
+
+## 2026-09-09 - 28.5.0
+
+### Features
+
+- add runtime config v1 contract (data/runtimeconfig)
+  - Introduce runtime config v1 interfaces for execution intent, target ports, readiness, log policy, and immutable image metadata.
+  - Add exact-schema snapshot validation, canonical digest computation, digest validation, and assignment binding helpers.
+  - Export the runtime config data module and add tests for digest vectors, schema bounds, assignment binding, and detached async snapshots.
+
 ## 2026-09-09 - 28.4.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '28.4.0',
+    version: '29.0.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -24,6 +24,8 @@ export * from './nodecredential.js';
 export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
+export * from './runtimeconfig.js';
+export * from './runtimesession.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';

package/dist_ts/data/index.js

@@ -24,6 +24,8 @@ export * from './nodecredential.js';
 export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
+export * from './runtimeconfig.js';
+export * from './runtimesession.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';
@@ -38,4 +40,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/data/runtimeconfig.d.ts

@@ -0,0 +1,132 @@
+import type { IImmutableContainerInvocationPlatformEvidenceV1, IImmutableContainerInvocationV1, TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAssignmentV1, IRuntimeAuthorityReferenceV1 } from './runtimeassignment.js';
+/** A container target only; declaration does not publish a host or gateway port. */
+export interface IRuntimeConfigTargetPortV1 {
+    name: string;
+    port: number;
+    /** Inclusive; equal to port for a single port. */
+    portEnd: number;
+    protocol: 'tcp' | 'udp';
+}
+export interface IRuntimeConfigReadinessTimingV1 {
+    /** Measured from the evidenced container start; no probes before this delay. */
+    initialDelayMs: number;
+    /** Failures during this startup grace cannot mark the workload unhealthy. */
+    startupGraceMs: number;
+    /** Probe start-to-start interval; probes must never overlap. */
+    intervalMs: number;
+    /** Per-probe deadline, including connection, TLS and HTTP response headers. */
+    timeoutMs: number;
+    /** Consecutive successful probes needed before ready becomes true. */
+    successThreshold: number;
+    /** Consecutive failures after startup grace needed to declare unhealthy. */
+    failureThreshold: number;
+}
+export type TRuntimeConfigReadinessV1 = IRuntimeConfigReadinessTimingV1 & ({
+    kind: 'process';
+} | {
+    kind: 'tcp';
+    targetPort: string;
+    port: number;
+} | {
+    kind: 'http';
+    targetPort: string;
+    port: number;
+    scheme: 'http' | 'https';
+    /**
+     * Host header name and HTTPS SNI/certificate hostname. Connect only to the
+     * evidenced container endpoint, never resolve this name as a probe target.
+     * HTTPS verifies system trust and this hostname; no insecure TLS mode.
+     */
+    host: string;
+    /** Canonical origin-form request target, including any nonsecret query. */
+    path: string;
+    /** Sorted unique final HTTP response status codes. */
+    expectedStatusCodes: number[];
+    /** A redirect response is evaluated as received; it cannot redirect probes. */
+    followRedirects: false;
+});
+export interface IRuntimeConfigLogPolicyV1 {
+    /** Maximum UTF-8 bytes in one captured stdout/stderr line. */
+    maximumLineBytes: number;
+    /** Maximum bytes waiting for delivery; overflow requires explicit evidence. */
+    maximumBufferedBytes: number;
+    /** Retention of archived logs; durable payloads belong to SmartBucket. */
+    retentionMs: number;
+}
+/**
+ * Controller-owned resolved nonsecret execution intent. OCI command, effective
+ * environment, working directory and identity policy must be resolved before
+ * sealing; consumers must not choose resource limits or identity policies.
+ * Secrets, network identity and storage claims remain separately assignment-bound
+ * owner references. This document contains no registry credentials or host paths.
+ */
+export interface IRuntimeConfigV1 extends IRuntimeAuthorityReferenceV1 {
+    schemaVersion: 1;
+    organizationId: string;
+    serviceId: string;
+    image: {
+        registryHost: string;
+        repository: string;
+        /** Root descriptor digest, which may be an OCI platform index. */
+        imageDigest: TSha256Digest;
+        invocation: IImmutableContainerInvocationV1;
+    };
+    /** Complete effective public environment; secret values must never be inlined. */
+    environment: Record<string, string>;
+    workingDirectory: string;
+    /** null explicitly requests no CPU quota; zero and omitted values are invalid. */
+    cpuMillis: number | null;
+    memoryBytes: number;
+    readonlyRootfs: boolean;
+    /**
+     * Both identity fields must be numbers or both must be null. The null pair
+     * explicitly selects the pinned platform image's OCI User, including primary
+     * and supplemental group resolution against its immutable root filesystem.
+     * An absent OCI User retains the image/runtime specification's root identity.
+     * The execution owner must delegate that resolution to the qualified runtime;
+     * it must not guess a GID for a UID-only or named image user.
+     */
+    runAsUser: number | null;
+    /** Numeric override paired with runAsUser, or null for the image identity policy. */
+    runAsGroup: number | null;
+    /** Sorted unique names, with no overlapping ranges for the same transport. */
+    targetPorts: IRuntimeConfigTargetPortV1[];
+    readiness: TRuntimeConfigReadinessV1;
+    /**
+     * SmartData owns log metadata and SmartBucket owns archived payloads. This
+     * policy does not authorize persistent local files. Any CRI log capture uses
+     * disposable process-local transport artifacts and must evidence bounded
+     * buffering, backpressure and lost data; it must not silently truncate logs.
+     */
+    logs: IRuntimeConfigLogPolicyV1;
+}
+export interface IRuntimeConfigAssignmentBindingV1 {
+    config: IRuntimeConfigV1;
+    assignment: IRuntimeAssignmentV1;
+    platformEvidence: IImmutableContainerInvocationPlatformEvidenceV1;
+}
+export declare const runtimeConfigV1Contract: Readonly<{
+    readonly digestDomain: "serve.zone/runtime-config-v1";
+    readonly maximumCanonicalBytes: 262144;
+    readonly maximumEnvironmentEntries: 128;
+    readonly maximumTargetPorts: 64;
+    readonly maximumReadinessDurationMs: 3600000;
+    readonly maximumLogRetentionMs: 31536000000;
+}>;
+/**
+ * Detached exact-schema snapshot for synchronous persistence assertions. Digest
+ * integrity, scope authorization, admission and runtime readiness are not implied.
+ */
+export declare const snapshotRuntimeConfigV1: (valueArg: unknown) => IRuntimeConfigV1;
+/** Domain-separated canonical JSON excludes only the config's own digest. */
+export declare const computeRuntimeConfigV1Digest: (configArg: IRuntimeConfigV1) => Promise<TSha256Digest>;
+export declare const validateRuntimeConfigV1: (valueArg: unknown) => Promise<string[]>;
+/**
+ * Bind valid content to one exact assignment and select its platform evidence.
+ * No assignment digest is embedded in the config, avoiding circular hashes.
+ * This proves content consistency only: the caller must authenticate the
+ * controller, durably admit the attempt, resolve other owner references, and
+ * verify runtime and readiness evidence before effects or route publication.
+ */
+export declare const bindRuntimeConfigV1ToAssignment: (configArg: unknown, assignmentArg: unknown) => Promise<IRuntimeConfigAssignmentBindingV1>;

package/dist_ts/data/runtimeconfig.js

@@ -0,0 +1,278 @@
+import { buildDigestPinnedImageReference, isSha256Digest, validateImmutableContainerInvocation, verifyImmutableContainerInvocationDigest, } from './immutableimage.js';
+import { snapshotRuntimeAssignmentV1, validateRuntimeAssignmentV1 } from './runtimeassignment.js';
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+export const runtimeConfigV1Contract = Object.freeze({
+    digestDomain: 'serve.zone/runtime-config-v1',
+    maximumCanonicalBytes: 262_144,
+    maximumEnvironmentEntries: 128,
+    maximumTargetPorts: 64,
+    maximumReadinessDurationMs: 3_600_000,
+    maximumLogRetentionMs: 31_536_000_000,
+});
+const fail = (messageArg) => { throw new Error(messageArg); };
+const encoder = new TextEncoder();
+const isInteger = (valueArg, minimumArg, maximumArg) => typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && !Object.is(valueArg, -0)
+    && valueArg >= minimumArg && valueArg <= maximumArg;
+const isIdentifier = (valueArg) => typeof valueArg === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(valueArg);
+const isDigest = (valueArg) => typeof valueArg === 'string' && isSha256Digest(valueArg);
+const isPortName = (valueArg) => typeof valueArg === 'string' && /^[a-z0-9][a-z0-9_.-]{0,62}$/.test(valueArg);
+const isExactRecord = (valueArg, keysArg) => {
+    if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg))
+        return false;
+    const keys = Object.keys(valueArg);
+    return keys.length === keysArg.length && keys.every((keyArg) => keysArg.includes(keyArg));
+};
+/**
+ * Bound traversal before canonicalization and copy descriptor values so input
+ * getters/toJSON never run. The canonical helper supplies scalar Unicode and
+ * safe-integer validation. Detached output is obtained before any async work.
+ */
+const snapshotBoundedJson = (valueArg) => {
+    let nodes = 0;
+    let stringBytes = 0;
+    const ancestors = new Set();
+    const accountString = (value) => {
+        if (value.length > runtimeConfigV1Contract.maximumCanonicalBytes)
+            fail('runtime config string is oversized');
+        stringBytes += encoder.encode(value).byteLength;
+        if (stringBytes > runtimeConfigV1Contract.maximumCanonicalBytes)
+            fail('runtime config is oversized');
+    };
+    const copy = (value, depth) => {
+        if (++nodes > 8192 || depth > 12)
+            fail('runtime config exceeds structural bounds');
+        if (typeof value === 'string') {
+            accountString(value);
+            return value;
+        }
+        if (value === null || typeof value === 'boolean' || typeof value === 'number')
+            return value;
+        if (!value || typeof value !== 'object')
+            fail('runtime config contains a non-JSON value');
+        if (ancestors.has(value))
+            fail('runtime config contains a cycle');
+        ancestors.add(value);
+        try {
+            const array = Array.isArray(value);
+            const prototype = Object.getPrototypeOf(value);
+            if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) {
+                fail('runtime config requires plain records and arrays');
+            }
+            const keys = Reflect.ownKeys(value);
+            if (keys.length > 257)
+                fail('runtime config object exceeds key bounds');
+            if (array) {
+                const lengthDescriptor = Object.getOwnPropertyDescriptor(value, 'length');
+                const length = lengthDescriptor?.value;
+                if (!isInteger(length, 0, 256) || keys.length !== length + 1) {
+                    fail('runtime config requires bounded dense arrays');
+                }
+                const result = [];
+                for (let index = 0; index < length; index++) {
+                    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                    if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+                        fail('runtime config array contains a missing or non-data entry');
+                    }
+                    result.push(copy(descriptor.value, depth + 1));
+                }
+                return result;
+            }
+            const result = Object.create(null);
+            for (const key of keys) {
+                if (typeof key !== 'string')
+                    fail('runtime config contains a symbol key');
+                accountString(key);
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                if (!descriptor || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value')) {
+                    fail('runtime config requires enumerable data properties');
+                }
+                result[key] = copy(descriptor.value, depth + 1);
+            }
+            return result;
+        }
+        finally {
+            ancestors.delete(value);
+        }
+    };
+    const canonical = canonicalizeStrictJson(copy(valueArg, 0), fail);
+    if (encoder.encode(canonical).byteLength > runtimeConfigV1Contract.maximumCanonicalBytes) {
+        fail('runtime config canonical JSON is oversized');
+    }
+    return JSON.parse(canonical);
+};
+const timingKeys = ['initialDelayMs', 'startupGraceMs', 'intervalMs', 'timeoutMs',
+    'successThreshold', 'failureThreshold'];
+const assertReadiness = (valueArg, portsArg) => {
+    if (!valueArg || typeof valueArg !== 'object')
+        fail('runtime config readiness is required');
+    const value = valueArg;
+    const keys = value.kind === 'process' ? ['kind', ...timingKeys]
+        : value.kind === 'tcp' ? ['kind', ...timingKeys, 'targetPort', 'port']
+            : value.kind === 'http' ? ['kind', ...timingKeys, 'targetPort', 'port',
+                'scheme', 'host', 'path', 'expectedStatusCodes', 'followRedirects'] : [];
+    if (keys.length === 0 || !isExactRecord(value, keys)
+        || !isInteger(value.initialDelayMs, 0, runtimeConfigV1Contract.maximumReadinessDurationMs)
+        || !isInteger(value.startupGraceMs, 0, runtimeConfigV1Contract.maximumReadinessDurationMs)
+        || !isInteger(value.intervalMs, 100, runtimeConfigV1Contract.maximumReadinessDurationMs)
+        || !isInteger(value.timeoutMs, 1, 60_000)
+        || !isInteger(value.successThreshold, 1, 100)
+        || !isInteger(value.failureThreshold, 1, 100)
+        || value.timeoutMs > value.intervalMs || value.initialDelayMs > value.startupGraceMs) {
+        fail('runtime config readiness must use explicit bounded timing and exact schema');
+    }
+    if (value.kind === 'process')
+        return;
+    const target = portsArg.find((portArg) => portArg.name === value.targetPort);
+    if (!isPortName(value.targetPort) || !target || target.protocol !== 'tcp'
+        || !isInteger(value.port, target.port, target.portEnd)) {
+        fail('runtime config readiness must select a declared TCP target and port');
+    }
+    if (value.kind === 'tcp')
+        return;
+    if ((value.scheme !== 'http' && value.scheme !== 'https') || value.followRedirects !== false
+        || typeof value.host !== 'string' || value.host.length > 253
+        || !/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/.test(value.host)
+        || typeof value.path !== 'string' || value.path.length > 4096
+        || !value.path.startsWith('/') || value.path.startsWith('//')
+        || /[^\x21-\x7e]|[\\#]/.test(value.path)
+        || /%(?![0-9A-F]{2})/.test(value.path)
+        || !Array.isArray(value.expectedStatusCodes) || value.expectedStatusCodes.length === 0
+        || value.expectedStatusCodes.length > 32) {
+        fail('runtime config HTTP readiness must use an exact bounded request policy');
+    }
+    const parsed = new URL(value.path, 'http://runtime.invalid');
+    if (`${parsed.pathname}${parsed.search}` !== value.path)
+        fail('runtime config HTTP path must be canonical');
+    let previousCode = 0;
+    for (const code of value.expectedStatusCodes) {
+        if (!isInteger(code, 200, 599) || code <= previousCode) {
+            fail('runtime config HTTP status expectations must be sorted unique final codes');
+        }
+        previousCode = code;
+    }
+};
+const assertConfig = (valueArg) => {
+    if (!isExactRecord(valueArg, ['schemaVersion', 'id', 'generation', 'organizationId', 'serviceId',
+        'image', 'environment', 'workingDirectory', 'cpuMillis', 'memoryBytes', 'readonlyRootfs',
+        'runAsUser', 'runAsGroup', 'targetPorts', 'readiness', 'logs', 'digest'])
+        || valueArg.schemaVersion !== 1 || !isIdentifier(valueArg.id)
+        || !isInteger(valueArg.generation, 1, Number.MAX_SAFE_INTEGER)
+        || !isIdentifier(valueArg.organizationId) || !isIdentifier(valueArg.serviceId)
+        || !isDigest(valueArg.digest))
+        fail('runtime config must use its exact v1 schema');
+    const image = valueArg.image;
+    if (!isExactRecord(image, ['registryHost', 'repository', 'imageDigest', 'invocation'])
+        || typeof image.registryHost !== 'string' || image.registryHost.length > 253
+        || typeof image.repository !== 'string' || image.repository.length > 255
+        || !isDigest(image.imageDigest)
+        || validateImmutableContainerInvocation(image.invocation).length !== 0) {
+        fail('runtime config image must contain exact immutable invocation evidence');
+    }
+    buildDigestPinnedImageReference(image.registryHost, image.repository, image.imageDigest);
+    const environment = valueArg.environment;
+    if (!environment || typeof environment !== 'object' || Array.isArray(environment)
+        || Object.keys(environment).length > runtimeConfigV1Contract.maximumEnvironmentEntries) {
+        fail('runtime config requires an explicit bounded nonsecret environment');
+    }
+    for (const [key, value] of Object.entries(environment)) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key) || typeof value !== 'string'
+            || value.includes('\u0000') || encoder.encode(value).byteLength > 8192) {
+            fail('runtime config environment must contain bounded string entries');
+        }
+    }
+    const directory = valueArg.workingDirectory;
+    if (typeof directory !== 'string' || !directory.startsWith('/')
+        || encoder.encode(directory).byteLength > 4096 || /[\u0000-\u001f\u007f]/.test(directory)
+        || (directory !== '/' && directory.split('/').slice(1).some((partArg) => !partArg || partArg === '.' || partArg === '..'))
+        || !(valueArg.cpuMillis === null || isInteger(valueArg.cpuMillis, 1, 1_000_000))
+        || !isInteger(valueArg.memoryBytes, 16 * 1024 * 1024, 2 ** 50)
+        || typeof valueArg.readonlyRootfs !== 'boolean'
+        || !((valueArg.runAsUser === null && valueArg.runAsGroup === null)
+            || (isInteger(valueArg.runAsUser, 0, 2 ** 31 - 1) && isInteger(valueArg.runAsGroup, 0, 2 ** 31 - 1)))) {
+        fail('runtime config requires canonical directory and explicit resource and identity policies');
+    }
+    const ports = valueArg.targetPorts;
+    if (!Array.isArray(ports) || ports.length > runtimeConfigV1Contract.maximumTargetPorts) {
+        fail('runtime config target ports must be a bounded array');
+    }
+    let previousName = '';
+    const validatedPorts = [];
+    for (const port of ports) {
+        if (!isExactRecord(port, ['name', 'port', 'portEnd', 'protocol'])
+            || !isPortName(port.name) || port.name <= previousName
+            || !isInteger(port.port, 1, 65535) || !isInteger(port.portEnd, port.port, 65535)
+            || (port.protocol !== 'tcp' && port.protocol !== 'udp')
+            || validatedPorts.some((previousArg) => previousArg.protocol === port.protocol
+                && port.port <= previousArg.portEnd && port.portEnd >= previousArg.port)) {
+            fail('runtime config target ports require sorted unique names and nonoverlapping transport ranges');
+        }
+        previousName = port.name;
+        validatedPorts.push(port);
+    }
+    assertReadiness(valueArg.readiness, validatedPorts);
+    const logs = valueArg.logs;
+    if (!isExactRecord(logs, ['maximumLineBytes', 'maximumBufferedBytes', 'retentionMs'])
+        || !isInteger(logs.maximumLineBytes, 1, 1_048_576)
+        || !isInteger(logs.maximumBufferedBytes, 1, 67_108_864)
+        || logs.maximumBufferedBytes < logs.maximumLineBytes
+        || !isInteger(logs.retentionMs, 1, runtimeConfigV1Contract.maximumLogRetentionMs)) {
+        fail('runtime config logs require explicit bounded line, buffer and retention limits');
+    }
+    return valueArg;
+};
+/**
+ * Detached exact-schema snapshot for synchronous persistence assertions. Digest
+ * integrity, scope authorization, admission and runtime readiness are not implied.
+ */
+export const snapshotRuntimeConfigV1 = (valueArg) => assertConfig(snapshotBoundedJson(valueArg));
+/** Domain-separated canonical JSON excludes only the config's own digest. */
+export const computeRuntimeConfigV1Digest = async (configArg) => {
+    const { digest: _digest, ...payload } = snapshotRuntimeConfigV1(configArg);
+    return `sha256:${await createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+        domain: runtimeConfigV1Contract.digestDomain, payload,
+    }, fail), fail)}`;
+};
+const validateSnapshot = async (configArg) => {
+    if (!await verifyImmutableContainerInvocationDigest(configArg.image.invocation)) {
+        return ['runtime config immutable invocation digest does not match'];
+    }
+    return configArg.digest === await computeRuntimeConfigV1Digest(configArg)
+        ? [] : ['runtime config digest does not match'];
+};
+export const validateRuntimeConfigV1 = async (valueArg) => {
+    try {
+        return await validateSnapshot(snapshotRuntimeConfigV1(valueArg));
+    }
+    catch {
+        return ['runtime config must use its exact canonical v1 schema'];
+    }
+};
+/**
+ * Bind valid content to one exact assignment and select its platform evidence.
+ * No assignment digest is embedded in the config, avoiding circular hashes.
+ * This proves content consistency only: the caller must authenticate the
+ * controller, durably admit the attempt, resolve other owner references, and
+ * verify runtime and readiness evidence before effects or route publication.
+ */
+export const bindRuntimeConfigV1ToAssignment = async (configArg, assignmentArg) => {
+    const config = snapshotRuntimeConfigV1(configArg);
+    const assignment = snapshotRuntimeAssignmentV1(snapshotBoundedJson(assignmentArg));
+    if ((await validateSnapshot(config)).length !== 0
+        || (await validateRuntimeAssignmentV1(assignment)).length !== 0) {
+        fail('runtime config binding requires valid config, invocation and assignment digests');
+    }
+    const reference = assignment.workload.config;
+    if (reference.id !== config.id || reference.generation !== config.generation
+        || reference.digest !== config.digest || assignment.organizationId !== config.organizationId
+        || assignment.serviceId !== config.serviceId
+        || assignment.workload.registryHost !== config.image.registryHost
+        || assignment.workload.repository !== config.image.repository
+        || assignment.workload.imageDigest !== config.image.imageDigest) {
+        fail('runtime config does not match the exact assignment reference, ownership and image');
+    }
+    const platformEvidence = config.image.invocation.evidence.find((entryArg) => entryArg.platform === assignment.workload.platform);
+    if (!platformEvidence)
+        fail('runtime config lacks exact assignment platform evidence');
+    return { config, assignment, platformEvidence };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWNvbmZpZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvcnVudGltZWNvbmZpZy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQ0wsK0JBQStCLEVBQy9CLGNBQWMsRUFDZCxvQ0FBb0MsRUFDcEMsd0NBQXdDLEdBQ3pDLE1BQU0scUJBQXFCLENBQUM7QUFFN0IsT0FBTyxFQUFFLDJCQUEyQixFQUFFLDJCQUEyQixFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDbEcsT0FBTyxFQUFFLHNCQUFzQixFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFnSG5HLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbkQsWUFBWSxFQUFFLDhCQUE4QjtJQUM1QyxxQkFBcUIsRUFBRSxPQUFPO0lBQzlCLHlCQUF5QixFQUFFLEdBQUc7SUFDOUIsa0JBQWtCLEVBQUUsRUFBRTtJQUN0QiwwQkFBMEIsRUFBRSxTQUFTO0lBQ3JDLHFCQUFxQixFQUFFLGNBQWM7Q0FDN0IsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQWtDLENBQUMsVUFBVSxFQUFFLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzdGLE1BQU0sT0FBTyxHQUFHLElBQUksV0FBVyxFQUFFLENBQUM7QUFDbEMsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFVBQWtCLEVBQUUsVUFBa0IsRUFBc0IsRUFBRSxDQUNsRyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO09BQ3ZGLFFBQVEsSUFBSSxVQUFVLElBQUksUUFBUSxJQUFJLFVBQVUsQ0FBQztBQUN0RCxNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDN0QsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUN2RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FDaEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUMzRCxNQUFNLFVBQVUsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDM0QsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLDZCQUE2QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUMvRSxNQUFNLGFBQWEsR0FBRyxDQUNwQixRQUFpQixFQUFFLE9BQTBCLEVBQ1IsRUFBRTtJQUN2QyxJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3ZGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkMsT0FBTyxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBQzVGLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBaUIsRUFBVyxFQUFFO0lBQ3pELElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLElBQUksV0FBVyxHQUFHLENBQUMsQ0FBQztJQUNwQixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3BDLE1BQU0sYUFBYSxHQUFHLENBQUMsS0FBYSxFQUFRLEVBQUU7UUFDNUMsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLHVCQUF1QixDQUFDLHFCQUFxQjtZQUFFLElBQUksQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO1FBQzdHLFdBQVcsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFVBQVUsQ0FBQztRQUNoRCxJQUFJLFdBQVcsR0FBRyx1QkFBdUIsQ0FBQyxxQkFBcUI7WUFBRSxJQUFJLENBQUMsNkJBQTZCLENBQUMsQ0FBQztJQUN2RyxDQUFDLENBQUM7SUFDRixNQUFNLElBQUksR0FBRyxDQUFDLEtBQWMsRUFBRSxLQUFhLEVBQVcsRUFBRTtRQUN0RCxJQUFJLEVBQUUsS0FBSyxHQUFHLElBQUksSUFBSSxLQUFLLEdBQUcsRUFBRTtZQUFFLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO1FBQ25GLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssQ0FBQztRQUFDLENBQUM7UUFDdEUsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDNUYsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQUUsSUFBSSxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDMUYsSUFBSSxTQUFTLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQztZQUFFLElBQUksQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ2xFLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNuQyxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQy9DLElBQUksS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxTQUFTLElBQUksU0FBUyxLQUFLLElBQUksRUFBRSxDQUFDO2dCQUNqRyxJQUFJLENBQUMsa0RBQWtELENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNwQyxJQUFJLElBQUksQ0FBQyxNQUFNLEdBQUcsR0FBRztnQkFBRSxJQUFJLENBQUMsMENBQTBDLENBQUMsQ0FBQztZQUN4RSxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDMUUsTUFBTSxNQUFNLEdBQUcsZ0JBQWdCLEVBQUUsS0FBSyxDQUFDO2dCQUN2QyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7b0JBQzdELElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO2dCQUN2RCxDQUFDO2dCQUNELE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztnQkFDN0IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO29CQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUN6RSxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUM7d0JBQ2pGLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO29CQUNwRSxDQUFDO29CQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ2pELENBQUM7Z0JBQ0QsT0FBTyxNQUFNLENBQUM7WUFDaEIsQ0FBQztZQUNELE1BQU0sTUFBTSxHQUE0QixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVELEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQ3ZCLElBQUksT0FBTyxHQUFHLEtBQUssUUFBUTtvQkFBRSxJQUFJLENBQUMsc0NBQXNDLENBQUMsQ0FBQztnQkFDMUUsYUFBYSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUNuQixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUMvRCxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsVUFBVSxDQUFDLFVBQVUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUM7b0JBQ2pGLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO2dCQUM3RCxDQUFDO2dCQUNELE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDbEQsQ0FBQztZQUNELE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUM7Z0JBQVMsQ0FBQztZQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFBQyxDQUFDO0lBQ3hDLENBQUMsQ0FBQztJQUNGLE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDbEUsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDLFVBQVUsR0FBRyx1QkFBdUIsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1FBQ3pGLElBQUksQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7QUFDL0IsQ0FBQyxDQUFDO0FBRUYsTUFBTSxVQUFVLEdBQUcsQ0FBQyxnQkFBZ0IsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsV0FBVztJQUMvRSxrQkFBa0IsRUFBRSxrQkFBa0IsQ0FBVSxDQUFDO0FBQ25ELE1BQU0sZUFBZSxHQUFHLENBQUMsUUFBaUIsRUFBRSxRQUFzQyxFQUFRLEVBQUU7SUFDMUYsSUFBSSxDQUFDLFFBQVEsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRO1FBQUUsSUFBSSxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDNUYsTUFBTSxLQUFLLEdBQUcsUUFBbUMsQ0FBQztJQUNsRCxNQUFNLElBQUksR0FBRyxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsR0FBRyxVQUFVLENBQUM7UUFDN0QsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxHQUFHLFVBQVUsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDO1lBQ3BFLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsR0FBRyxVQUFVLEVBQUUsWUFBWSxFQUFFLE1BQU07Z0JBQ3BFLFFBQVEsRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLHFCQUFxQixFQUFFLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUMvRSxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUM7V0FDL0MsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxDQUFDLEVBQUUsdUJBQXVCLENBQUMsMEJBQTBCLENBQUM7V0FDdkYsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxDQUFDLEVBQUUsdUJBQXVCLENBQUMsMEJBQTBCLENBQUM7V0FDdkYsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxHQUFHLEVBQUUsdUJBQXVCLENBQUMsMEJBQTBCLENBQUM7V0FDckYsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDLEVBQUUsTUFBTSxDQUFDO1dBQ3RDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDO1dBQzFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDO1dBQzFDLEtBQUssQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDLFVBQVUsSUFBSSxLQUFLLENBQUMsY0FBYyxHQUFHLEtBQUssQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUN2RixJQUFJLENBQUMsNEVBQTRFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLFNBQVM7UUFBRSxPQUFPO0lBQ3JDLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzdFLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssS0FBSztXQUNwRSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDekQsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxLQUFLO1FBQUUsT0FBTztJQUNqQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsSUFBSSxLQUFLLENBQUMsZUFBZSxLQUFLLEtBQUs7V0FDdkYsT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQ3pELENBQUMsdUZBQXVGLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUM7V0FDekcsT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJO1dBQzFELENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO1dBQzFELG9CQUFvQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDO1dBQ3JDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDO1dBQ25DLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQUMsSUFBSSxLQUFLLENBQUMsbUJBQW1CLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDbkYsS0FBSyxDQUFDLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUMzQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUNqRixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSx3QkFBd0IsQ0FBQyxDQUFDO0lBQzdELElBQUksR0FBRyxNQUFNLENBQUMsUUFBUSxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsS0FBSyxLQUFLLENBQUMsSUFBSTtRQUFFLElBQUksQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQzVHLElBQUksWUFBWSxHQUFHLENBQUMsQ0FBQztJQUNyQixLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQzdDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsSUFBSSxJQUFJLElBQUksWUFBWSxFQUFFLENBQUM7WUFDdkQsSUFBSSxDQUFDLDJFQUEyRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELFlBQVksR0FBRyxJQUFJLENBQUM7SUFDdEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBb0IsRUFBRTtJQUMzRCxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLFdBQVc7UUFDOUYsT0FBTyxFQUFFLGFBQWEsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGdCQUFnQjtRQUN4RixXQUFXLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1dBQ3RFLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7V0FDMUQsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixDQUFDO1dBQzNELENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQzNFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7UUFBRSxJQUFJLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUNyRixNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDO0lBQzdCLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsWUFBWSxDQUFDLENBQUM7V0FDakYsT0FBTyxLQUFLLENBQUMsWUFBWSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQ3pFLE9BQU8sS0FBSyxDQUFDLFVBQVUsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUNyRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDO1dBQzVCLG9DQUFvQyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekUsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELCtCQUErQixDQUFDLEtBQUssQ0FBQyxZQUFzQixFQUFFLEtBQUssQ0FBQyxVQUFvQixFQUN0RixLQUFLLENBQUMsV0FBNEIsQ0FBQyxDQUFDO0lBQ3RDLE1BQU0sV0FBVyxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUM7SUFDekMsSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7V0FDNUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxNQUFNLEdBQUcsdUJBQXVCLENBQUMseUJBQXlCLEVBQUUsQ0FBQztRQUN6RixJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBQ0QsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUN2RCxJQUFJLENBQUMsZ0NBQWdDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVE7ZUFDdkUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFVBQVUsR0FBRyxJQUFJLEVBQUUsQ0FBQztZQUN6RSxJQUFJLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztRQUN6RSxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQztJQUM1QyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1dBQzFELE9BQU8sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsVUFBVSxHQUFHLElBQUksSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1dBQ3RGLENBQUMsU0FBUyxLQUFLLEdBQUcsSUFBSSxTQUFTLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsT0FBTyxJQUFJLE9BQU8sS0FBSyxHQUFHLElBQUksT0FBTyxLQUFLLElBQUksQ0FBQyxDQUFDO1dBQ3ZILENBQUMsQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLElBQUksSUFBSSxTQUFTLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUM7V0FDN0UsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFdBQVcsRUFBRSxFQUFFLEdBQUcsSUFBSSxHQUFHLElBQUksRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDO1dBQzNELE9BQU8sUUFBUSxDQUFDLGNBQWMsS0FBSyxTQUFTO1dBQzVDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssSUFBSSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDO2VBQzdELENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDLElBQUksU0FBUyxDQUFDLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDMUcsSUFBSSxDQUFDLHlGQUF5RixDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUM7SUFDbkMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyx1QkFBdUIsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1FBQ3ZGLElBQUksQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLFlBQVksR0FBRyxFQUFFLENBQUM7SUFDdEIsTUFBTSxjQUFjLEdBQWlDLEVBQUUsQ0FBQztJQUN4RCxLQUFLLE1BQU0sSUFBSSxJQUFJLEtBQUssRUFBRSxDQUFDO1FBQ3pCLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUM7ZUFDNUQsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLElBQUksWUFBWTtlQUNuRCxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDO2VBQzdFLENBQUMsSUFBSSxDQUFDLFFBQVEsS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLFFBQVEsS0FBSyxLQUFLLENBQUM7ZUFDcEQsY0FBYyxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsUUFBUTttQkFDeEUsSUFBSSxDQUFDLElBQWUsSUFBSSxXQUFXLENBQUMsT0FBTyxJQUFLLElBQUksQ0FBQyxPQUFrQixJQUFJLFdBQVcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3JHLElBQUksQ0FBQyw2RkFBNkYsQ0FBQyxDQUFDO1FBQ3RHLENBQUM7UUFDRCxZQUFZLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQztRQUN6QixjQUFjLENBQUMsSUFBSSxDQUFDLElBQTZDLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBQ0QsZUFBZSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsY0FBYyxDQUFDLENBQUM7SUFDcEQsTUFBTSxJQUFJLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQztJQUMzQixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDLGtCQUFrQixFQUFFLHNCQUFzQixFQUFFLGFBQWEsQ0FBQyxDQUFDO1dBQ2hGLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDLEVBQUUsU0FBUyxDQUFDO1dBQy9DLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxDQUFDLEVBQUUsVUFBVSxDQUFDO1dBQ3BELElBQUksQ0FBQyxvQkFBb0IsR0FBRyxJQUFJLENBQUMsZ0JBQWdCO1dBQ2pELENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxFQUFFLHVCQUF1QixDQUFDLHFCQUFxQixDQUFDLEVBQUUsQ0FBQztRQUNwRixJQUFJLENBQUMsZ0ZBQWdGLENBQUMsQ0FBQztJQUN6RixDQUFDO0lBQ0QsT0FBTyxRQUF1QyxDQUFDO0FBQ2pELENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLENBQUMsUUFBaUIsRUFBb0IsRUFBRSxDQUM3RSxZQUFZLENBQUMsbUJBQW1CLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUU5Qyw2RUFBNkU7QUFDN0UsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsS0FBSyxFQUFFLFNBQTJCLEVBQTBCLEVBQUU7SUFDeEcsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRyx1QkFBdUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRSxPQUFPLFVBQVUsTUFBTSw0QkFBNEIsQ0FBQyxzQkFBc0IsQ0FBQztRQUN6RSxNQUFNLEVBQUUsdUJBQXVCLENBQUMsWUFBWSxFQUFFLE9BQU87S0FDdEQsRUFBRSxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3BCLENBQUMsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxFQUFFLFNBQTJCLEVBQXFCLEVBQUU7SUFDaEYsSUFBSSxDQUFDLE1BQU0sd0NBQXdDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE9BQU8sQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxPQUFPLFNBQVMsQ0FBQyxNQUFNLEtBQUssTUFBTSw0QkFBNEIsQ0FBQyxTQUFTLENBQUM7UUFDdkUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO0FBQ3BELENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQ3BGLElBQUksQ0FBQztRQUFDLE9BQU8sTUFBTSxnQkFBZ0IsQ0FBQyx1QkFBdUIsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQUMsQ0FBQztJQUN6RSxNQUFNLENBQUM7UUFBQyxPQUFPLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUFDLENBQUM7QUFDN0UsQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsS0FBSyxFQUNsRCxTQUFrQixFQUFFLGFBQXNCLEVBQ0UsRUFBRTtJQUM5QyxNQUFNLE1BQU0sR0FBRyx1QkFBdUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNsRCxNQUFNLFVBQVUsR0FBRywyQkFBMkIsQ0FBQyxtQkFBbUIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ25GLElBQUksQ0FBQyxNQUFNLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDNUMsQ0FBQyxNQUFNLDJCQUEyQixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xFLElBQUksQ0FBQyxpRkFBaUYsQ0FBQyxDQUFDO0lBQzFGLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztJQUM3QyxJQUFJLFNBQVMsQ0FBQyxFQUFFLEtBQUssTUFBTSxDQUFDLEVBQUUsSUFBSSxTQUFTLENBQUMsVUFBVSxLQUFLLE1BQU0sQ0FBQyxVQUFVO1dBQ3ZFLFNBQVMsQ0FBQyxNQUFNLEtBQUssTUFBTSxDQUFDLE1BQU0sSUFBSSxVQUFVLENBQUMsY0FBYyxLQUFLLE1BQU0sQ0FBQyxjQUFjO1dBQ3pGLFVBQVUsQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVM7V0FDekMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEtBQUssTUFBTSxDQUFDLEtBQUssQ0FBQyxZQUFZO1dBQzlELFVBQVUsQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFLLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVTtXQUMxRCxVQUFVLENBQUMsUUFBUSxDQUFDLFdBQVcsS0FBSyxNQUFNLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ2xFLElBQUksQ0FBQyxtRkFBbUYsQ0FBQyxDQUFDO0lBQzVGLENBQUM7SUFDRCxNQUFNLGdCQUFnQixHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQzVELENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxLQUFLLFVBQVUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUNqRSxDQUFDO0lBQ0YsSUFBSSxDQUFDLGdCQUFnQjtRQUFFLElBQUksQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0lBQ3ZGLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLGdCQUFnQixFQUFFLENBQUM7QUFDbEQsQ0FBQyxDQUFDIn0=

package/dist_ts/data/runtimesession.d.ts

@@ -0,0 +1,127 @@
+import type { IIdentityCredential } from './user.js';
+import type { IRuntimeAssignmentObservationV1, IRuntimeAssignmentReferenceV1, IRuntimeAssignmentV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+import type { IRuntimeConfigV1 } from './runtimeconfig.js';
+/**
+ * Server-issued public binding for the current authenticated physical connection.
+ * It contains no bearer, peer ID or client-selected authority. A serialized binding
+ * is not authentication: every receiver must compare it with its live peer context.
+ * Onebox local execution uses the same shape with its own authenticated IPC owner.
+ */
+export interface IRuntimeSessionBindingV1 {
+    schemaVersion: 1;
+    reporterSessionId: string;
+    nodeId: string;
+    credentialGeneration: number;
+    sessionEpoch: number;
+    controllerInstanceId: string;
+    controller: IRuntimeControllerV1;
+    runtimeNamespace: string;
+}
+/** Pallet-initiated WSS on its configured Cloudly HTTPS origin; never HTTP RPC. */
+export interface IRegisterPalletRuntimeSessionRequestV1 {
+    schemaVersion: 1;
+    nodeId: string;
+    credentialGeneration: number;
+    /** Sensitive ephemeral input; exclude the complete request from hooks and logs. */
+    bearer: string;
+}
+export interface IApplyRuntimeAssignmentRequestV1 {
+    session: IRuntimeSessionBindingV1;
+    assignment: IRuntimeAssignmentV1;
+    config: IRuntimeConfigV1;
+    /** Exact removed incumbent for a new attempt; not assignment.previous. */
+    predecessor: IRuntimeAssignmentReferenceV1 | null;
+}
+/** Durable admission acknowledgement only; it asserts neither effects nor readiness. */
+export interface IApplyRuntimeAssignmentResponseV1 {
+    status: 'accepted' | 'replay' | 'historical';
+    assignment: IRuntimeAssignmentReferenceV1;
+}
+export interface IReportRuntimeAssignmentObservationRequestV1 {
+    /** Always the CURRENT authenticated connection, including after credential rotation. */
+    session: IRuntimeSessionBindingV1;
+    /** Exact durable outbox body. Never rewrite reporterSessionId, digest or sequence. */
+    observation: IRuntimeAssignmentObservationV1;
+}
+export type TRuntimeObservationAuthorityUseV1 = 'current-session' | 'historical-recovery';
+export interface IReportRuntimeAssignmentObservationResponseV1 {
+    /** Exact request body after a durable sequence/receipt transaction. */
+    observation: IRuntimeAssignmentObservationV1;
+    /**
+     * Historical recovery can advance the durable counter and ACK only. It must not
+     * update active readiness, routing or liveness; those require a fresh report
+     * from the current session. Neither classification is proof of writer fencing.
+     */
+    authorityUse: TRuntimeObservationAuthorityUseV1;
+}
+export interface IGetRuntimeRegistryCredentialRequestV1 {
+    session: IRuntimeSessionBindingV1;
+    /** The server must authorize this exact CURRENT assignment, including its node. */
+    assignment: IRuntimeAssignmentReferenceV1;
+}
+/** Sensitive ephemeral material; never persist, hash, log or include in diagnostics. */
+export interface IGetRuntimeRegistryCredentialResponseV1 {
+    username: string;
+    password: string;
+    expiresAt: number;
+}
+/** Cloudly human/machine JWT registration on a physical TypedSocket; reject HTTP. */
+export interface IRegisterCloudlyClientSessionRequestV1 {
+    schemaVersion: 1;
+    /** Authenticate the current JWT server-side; do not accept client identity claims. */
+    identity: IIdentityCredential;
+}
+export interface IRegisterCloudlyClientSessionResponseV1 {
+    /** Server-owned identity tagging completed; never trust a client-authored tag. */
+    registered: true;
+}
+export declare const runtimeSessionV1Contract: Readonly<{
+    readonly maximumWireCanonicalBytes: 327680;
+    readonly maximumCredentialBytes: 16384;
+    readonly maximumRegistryPasswordBytes: 8192;
+    readonly registerTransport: "pallet-initiated-wss-on-configured-cloudly-https-origin";
+    readonly historicalObservationAuthority: "durable-counter-and-ack-only";
+    readonly error: "Runtime session contract rejected.";
+}>;
+/** Synchronous detached structural assertion only; never an authentication check. */
+export declare const snapshotRuntimeSessionBindingV1: (valueArg: unknown) => IRuntimeSessionBindingV1;
+export declare const snapshotRegisterPalletRuntimeSessionRequestV1: (valueArg: unknown) => IRegisterPalletRuntimeSessionRequestV1;
+export declare const snapshotApplyRuntimeAssignmentRequestV1: (valueArg: unknown) => IApplyRuntimeAssignmentRequestV1;
+export declare const snapshotApplyRuntimeAssignmentResponseV1: (valueArg: unknown) => IApplyRuntimeAssignmentResponseV1;
+export declare const snapshotReportRuntimeAssignmentObservationRequestV1: (valueArg: unknown) => IReportRuntimeAssignmentObservationRequestV1;
+export declare const snapshotReportRuntimeAssignmentObservationResponseV1: (valueArg: unknown) => IReportRuntimeAssignmentObservationResponseV1;
+export declare const snapshotGetRuntimeRegistryCredentialRequestV1: (valueArg: unknown) => IGetRuntimeRegistryCredentialRequestV1;
+export declare const snapshotGetRuntimeRegistryCredentialResponseV1: (valueArg: unknown) => IGetRuntimeRegistryCredentialResponseV1;
+export declare const snapshotRegisterCloudlyClientSessionRequestV1: (valueArg: unknown) => IRegisterCloudlyClientSessionRequestV1;
+export declare const snapshotRegisterCloudlyClientSessionResponseV1: (valueArg: unknown) => IRegisterCloudlyClientSessionResponseV1;
+/** Bind the authenticated Cloudly registration reply to the node and credential sent. */
+export declare const bindRegisterPalletRuntimeSessionResponseV1: (valueArg: unknown, requestArg: unknown) => IRuntimeSessionBindingV1;
+/** Reject already expired material; issuance policy and current assignment authority remain server-owned. */
+export declare const bindGetRuntimeRegistryCredentialResponseV1: (valueArg: unknown, nowArg: number) => IGetRuntimeRegistryCredentialResponseV1;
+/**
+ * Capture every input before awaiting digest verification. trustedSessionArg must
+ * come from the receiving live connection, never from another request field.
+ * This binds content only; durable CAS, slot admission and authority remain owners.
+ */
+export declare const bindApplyRuntimeAssignmentRequestV1: (valueArg: unknown, trustedSessionArg: unknown) => Promise<IApplyRuntimeAssignmentRequestV1>;
+/** Match an admission acknowledgement to the exact sent revision, including historical replies. */
+export declare const bindApplyRuntimeAssignmentResponseV1: (valueArg: unknown, requestArg: unknown) => IApplyRuntimeAssignmentResponseV1;
+/**
+ * trustedSessionArg is the CURRENT authenticated physical peer. reporterHistoryArg
+ * must be server-indexed immutable session history, obtained by the original
+ * observation's reporterSessionId; never accept caller-supplied history. All V1
+ * runtime sessions are Pallet-purpose sessions, so Spark history cannot qualify.
+ *
+ * This verifies content and classifies recovery, not authentication, history
+ * provenance, sequence admission or current authority. The server must transact
+ * receipt/counter acceptance under current credential and peer authority. A
+ * historical result MUST NOT restore active readiness, routes or liveness.
+ */
+export declare const bindReportRuntimeAssignmentObservationRequestV1: (valueArg: unknown, assignmentArg: unknown, trustedSessionArg: unknown, reporterHistoryArg: unknown) => Promise<{
+    request: IReportRuntimeAssignmentObservationRequestV1;
+    authorityUse: TRuntimeObservationAuthorityUseV1;
+}>;
+/** Reject body rewriting and a historical receipt mislabeled as current authority. */
+export declare const bindReportRuntimeAssignmentObservationResponseV1: (valueArg: unknown, requestArg: unknown) => IReportRuntimeAssignmentObservationResponseV1;
+/** Current assignment lookup and live peer authorization remain mandatory server-owned inputs. */
+export declare const bindGetRuntimeRegistryCredentialRequestV1: (valueArg: unknown, assignmentArg: unknown, trustedSessionArg: unknown) => Promise<IGetRuntimeRegistryCredentialRequestV1>;