@serve.zone/interfaces 28.5.0 → 29.0.0

package/dist_ts/data/runtimesession.js

@@ -0,0 +1,275 @@
+import { isSha256Digest } from './immutableimage.js';
+import { getRuntimeAssignmentV1Reference, snapshotRuntimeAssignmentObservationV1, snapshotRuntimeAssignmentV1, validateRuntimeAssignmentObservationV1, validateRuntimeAssignmentV1, } from './runtimeassignment.js';
+import { bindRuntimeConfigV1ToAssignment, snapshotRuntimeConfigV1 } from './runtimeconfig.js';
+import { canonicalizeStrictJson } from '../private/canonicaljson.js';
+export const runtimeSessionV1Contract = Object.freeze({
+    maximumWireCanonicalBytes: 327_680,
+    maximumCredentialBytes: 16_384,
+    maximumRegistryPasswordBytes: 8192,
+    registerTransport: 'pallet-initiated-wss-on-configured-cloudly-https-origin',
+    historicalObservationAuthority: 'durable-counter-and-ack-only',
+    error: 'Runtime session contract rejected.',
+});
+const fail = () => { throw new Error(runtimeSessionV1Contract.error); };
+function requireValue(conditionArg) {
+    if (!conditionArg)
+        fail();
+}
+const safe = (operationArg) => {
+    try {
+        return operationArg();
+    }
+    catch {
+        return fail();
+    }
+};
+const encoder = new TextEncoder();
+const canonical = (valueArg) => canonicalizeStrictJson(valueArg, fail);
+const positive = (valueArg) => {
+    requireValue(typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && valueArg > 0);
+    return valueArg;
+};
+const identifier = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(valueArg));
+    return valueArg;
+};
+const nodeId = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg));
+    return valueArg;
+};
+/** Bound decoded JSON before canonicalization; copy data descriptors, never getters. */
+const capture = (valueArg) => safe(() => {
+    let nodes = 0;
+    let stringBytes = 0;
+    const ancestors = new Set();
+    const account = (value) => {
+        requireValue(value.length <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+        stringBytes += encoder.encode(value).byteLength;
+        requireValue(stringBytes <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+    };
+    const copy = (value, depth) => {
+        requireValue(++nodes <= 10_240 && depth <= 16);
+        if (typeof value === 'string') {
+            account(value);
+            return value;
+        }
+        if (value === null || typeof value === 'boolean' || typeof value === 'number')
+            return value;
+        requireValue(value !== null && typeof value === 'object' && !ancestors.has(value));
+        ancestors.add(value);
+        try {
+            const array = Array.isArray(value);
+            const prototype = Object.getPrototypeOf(value);
+            requireValue(array ? prototype === Array.prototype : prototype === Object.prototype || prototype === null);
+            const keys = Reflect.ownKeys(value);
+            requireValue(keys.length <= 257);
+            if (array) {
+                const length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
+                requireValue(Number.isSafeInteger(length) && length >= 0 && length <= 256 && keys.length === length + 1);
+                const result = [];
+                for (let index = 0; index < length; index++) {
+                    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+                    result.push(copy(descriptor.value, depth + 1));
+                }
+                return result;
+            }
+            const result = Object.create(null);
+            for (const key of keys) {
+                requireValue(typeof key === 'string');
+                account(key);
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+                result[key] = copy(descriptor.value, depth + 1);
+            }
+            return result;
+        }
+        finally {
+            ancestors.delete(value);
+        }
+    };
+    const serialized = canonical(copy(valueArg, 0));
+    requireValue(encoder.encode(serialized).byteLength <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
+    return JSON.parse(serialized);
+});
+const record = (valueArg, keysArg) => {
+    requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
+    const keys = Object.keys(valueArg);
+    requireValue(keys.length === keysArg.length && keys.every((key) => keysArg.includes(key)));
+    return valueArg;
+};
+const reference = (valueArg) => {
+    const value = record(valueArg, ['assignmentId', 'generation', 'digest']);
+    requireValue(typeof value.digest === 'string' && isSha256Digest(value.digest));
+    return { assignmentId: identifier(value.assignmentId), generation: positive(value.generation), digest: value.digest };
+};
+const session = (valueArg) => {
+    const value = record(valueArg, ['schemaVersion', 'reporterSessionId', 'nodeId', 'credentialGeneration',
+        'sessionEpoch', 'controllerInstanceId', 'controller', 'runtimeNamespace']);
+    const controller = record(value.controller, ['kind', 'id', 'epoch']);
+    requireValue(value.schemaVersion === 1 && (controller.kind === 'cloudly' || controller.kind === 'onebox'));
+    return {
+        schemaVersion: 1, reporterSessionId: identifier(value.reporterSessionId), nodeId: nodeId(value.nodeId),
+        credentialGeneration: positive(value.credentialGeneration), sessionEpoch: positive(value.sessionEpoch),
+        controllerInstanceId: identifier(value.controllerInstanceId),
+        controller: { kind: controller.kind, id: identifier(controller.id), epoch: identifier(controller.epoch) },
+        runtimeNamespace: identifier(value.runtimeNamespace),
+    };
+};
+const sameSession = (leftArg, rightArg) => canonical(leftArg) === canonical(rightArg);
+const sameOwner = (leftArg, rightArg) => leftArg.nodeId === rightArg.nodeId && leftArg.runtimeNamespace === rightArg.runtimeNamespace
+    && canonical(leftArg.controller) === canonical(rightArg.controller);
+const matchesAssignment = (sessionArg, assignmentArg) => sessionArg.nodeId === assignmentArg.nodeId && sessionArg.runtimeNamespace === assignmentArg.runtimeNamespace
+    && canonical(sessionArg.controller) === canonical(assignmentArg.controller);
+/** Synchronous detached structural assertion only; never an authentication check. */
+export const snapshotRuntimeSessionBindingV1 = (valueArg) => safe(() => session(capture(valueArg)));
+export const snapshotRegisterPalletRuntimeSessionRequestV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['schemaVersion', 'nodeId', 'credentialGeneration', 'bearer']);
+    requireValue(value.schemaVersion === 1 && typeof value.bearer === 'string'
+        && /^palletToken[0-9a-f]{64}$/.test(value.bearer));
+    return { schemaVersion: 1, nodeId: nodeId(value.nodeId),
+        credentialGeneration: positive(value.credentialGeneration), bearer: value.bearer };
+});
+export const snapshotApplyRuntimeAssignmentRequestV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['session', 'assignment', 'config', 'predecessor']);
+    const assignment = snapshotRuntimeAssignmentV1(value.assignment);
+    const predecessor = value.predecessor === null ? null : reference(value.predecessor);
+    // Assignment revisions use assignment.previous; a replacement names a different attempt.
+    requireValue(predecessor === null || predecessor.assignmentId !== assignment.assignmentId);
+    return { session: session(value.session), assignment, config: snapshotRuntimeConfigV1(value.config), predecessor };
+});
+export const snapshotApplyRuntimeAssignmentResponseV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['status', 'assignment']);
+    requireValue(value.status === 'accepted' || value.status === 'replay' || value.status === 'historical');
+    return { status: value.status, assignment: reference(value.assignment) };
+});
+export const snapshotReportRuntimeAssignmentObservationRequestV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['session', 'observation']);
+    return { session: session(value.session), observation: snapshotRuntimeAssignmentObservationV1(value.observation) };
+});
+export const snapshotReportRuntimeAssignmentObservationResponseV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['observation', 'authorityUse']);
+    requireValue(value.authorityUse === 'current-session' || value.authorityUse === 'historical-recovery');
+    return { observation: snapshotRuntimeAssignmentObservationV1(value.observation), authorityUse: value.authorityUse };
+});
+export const snapshotGetRuntimeRegistryCredentialRequestV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['session', 'assignment']);
+    return { session: session(value.session), assignment: reference(value.assignment) };
+});
+export const snapshotGetRuntimeRegistryCredentialResponseV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['username', 'password', 'expiresAt']);
+    requireValue(typeof value.username === 'string' && value.username.length > 0
+        && encoder.encode(value.username).byteLength <= 1024 && !/[\s:\u0000-\u001f\u007f]/.test(value.username));
+    requireValue(typeof value.password === 'string' && value.password.length > 0
+        && encoder.encode(value.password).byteLength <= runtimeSessionV1Contract.maximumRegistryPasswordBytes
+        && !/[\u0000-\u001f\u007f]/.test(value.password));
+    return { username: value.username, password: value.password, expiresAt: positive(value.expiresAt) };
+});
+export const snapshotRegisterCloudlyClientSessionRequestV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['schemaVersion', 'identity']);
+    const identity = record(value.identity, ['jwt']);
+    requireValue(value.schemaVersion === 1 && typeof identity.jwt === 'string'
+        && identity.jwt.length <= runtimeSessionV1Contract.maximumCredentialBytes
+        && /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(identity.jwt));
+    return { schemaVersion: 1, identity: { jwt: identity.jwt } };
+});
+export const snapshotRegisterCloudlyClientSessionResponseV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['registered']);
+    requireValue(value.registered === true);
+    return { registered: true };
+});
+/** Bind the authenticated Cloudly registration reply to the node and credential sent. */
+export const bindRegisterPalletRuntimeSessionResponseV1 = (valueArg, requestArg) => safe(() => {
+    const response = snapshotRuntimeSessionBindingV1(valueArg);
+    const request = snapshotRegisterPalletRuntimeSessionRequestV1(requestArg);
+    requireValue(response.controller.kind === 'cloudly' && response.nodeId === request.nodeId
+        && response.credentialGeneration === request.credentialGeneration);
+    return response;
+});
+/** Reject already expired material; issuance policy and current assignment authority remain server-owned. */
+export const bindGetRuntimeRegistryCredentialResponseV1 = (valueArg, nowArg) => safe(() => {
+    const response = snapshotGetRuntimeRegistryCredentialResponseV1(valueArg);
+    requireValue(response.expiresAt > positive(nowArg));
+    return response;
+});
+/**
+ * Capture every input before awaiting digest verification. trustedSessionArg must
+ * come from the receiving live connection, never from another request field.
+ * This binds content only; durable CAS, slot admission and authority remain owners.
+ */
+export const bindApplyRuntimeAssignmentRequestV1 = async (valueArg, trustedSessionArg) => {
+    try {
+        const request = snapshotApplyRuntimeAssignmentRequestV1(valueArg);
+        const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
+        requireValue(sameSession(request.session, trustedSession) && matchesAssignment(trustedSession, request.assignment));
+        await bindRuntimeConfigV1ToAssignment(request.config, request.assignment);
+        return request;
+    }
+    catch {
+        return fail();
+    }
+};
+/** Match an admission acknowledgement to the exact sent revision, including historical replies. */
+export const bindApplyRuntimeAssignmentResponseV1 = (valueArg, requestArg) => safe(() => {
+    const response = snapshotApplyRuntimeAssignmentResponseV1(valueArg);
+    const request = snapshotApplyRuntimeAssignmentRequestV1(requestArg);
+    requireValue(canonical(response.assignment) === canonical(getRuntimeAssignmentV1Reference(request.assignment)));
+    return response;
+});
+/**
+ * trustedSessionArg is the CURRENT authenticated physical peer. reporterHistoryArg
+ * must be server-indexed immutable session history, obtained by the original
+ * observation's reporterSessionId; never accept caller-supplied history. All V1
+ * runtime sessions are Pallet-purpose sessions, so Spark history cannot qualify.
+ *
+ * This verifies content and classifies recovery, not authentication, history
+ * provenance, sequence admission or current authority. The server must transact
+ * receipt/counter acceptance under current credential and peer authority. A
+ * historical result MUST NOT restore active readiness, routes or liveness.
+ */
+export const bindReportRuntimeAssignmentObservationRequestV1 = async (valueArg, assignmentArg, trustedSessionArg, reporterHistoryArg) => {
+    try {
+        const request = snapshotReportRuntimeAssignmentObservationRequestV1(valueArg);
+        const assignment = snapshotRuntimeAssignmentV1(capture(assignmentArg));
+        const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
+        const reporterHistory = snapshotRuntimeSessionBindingV1(reporterHistoryArg);
+        requireValue(sameSession(request.session, trustedSession) && matchesAssignment(trustedSession, assignment)
+            && request.observation.reporterSessionId === reporterHistory.reporterSessionId
+            && sameOwner(trustedSession, reporterHistory));
+        const current = sameSession(reporterHistory, trustedSession);
+        requireValue(current || (reporterHistory.reporterSessionId !== trustedSession.reporterSessionId
+            && reporterHistory.sessionEpoch < trustedSession.sessionEpoch
+            && reporterHistory.credentialGeneration <= trustedSession.credentialGeneration));
+        requireValue((await validateRuntimeAssignmentObservationV1(request.observation, assignment)).length === 0);
+        return { request, authorityUse: current ? 'current-session' : 'historical-recovery' };
+    }
+    catch {
+        return fail();
+    }
+};
+/** Reject body rewriting and a historical receipt mislabeled as current authority. */
+export const bindReportRuntimeAssignmentObservationResponseV1 = (valueArg, requestArg) => safe(() => {
+    const response = snapshotReportRuntimeAssignmentObservationResponseV1(valueArg);
+    const request = snapshotReportRuntimeAssignmentObservationRequestV1(requestArg);
+    requireValue(canonical(response.observation) === canonical(request.observation)
+        && response.authorityUse === (request.observation.reporterSessionId === request.session.reporterSessionId
+            ? 'current-session' : 'historical-recovery'));
+    return response;
+});
+/** Current assignment lookup and live peer authorization remain mandatory server-owned inputs. */
+export const bindGetRuntimeRegistryCredentialRequestV1 = async (valueArg, assignmentArg, trustedSessionArg) => {
+    try {
+        const request = snapshotGetRuntimeRegistryCredentialRequestV1(valueArg);
+        const assignment = snapshotRuntimeAssignmentV1(capture(assignmentArg));
+        const trustedSession = snapshotRuntimeSessionBindingV1(trustedSessionArg);
+        requireValue(sameSession(request.session, trustedSession) && matchesAssignment(trustedSession, assignment)
+            && assignment.disposition === 'run'
+            && canonical(request.assignment) === canonical(getRuntimeAssignmentV1Reference(assignment)));
+        requireValue((await validateRuntimeAssignmentV1(assignment)).length === 0);
+        return request;
+    }
+    catch {
+        return fail();
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXNlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVzZXNzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUtyRCxPQUFPLEVBQ0wsK0JBQStCLEVBQUUsc0NBQXNDLEVBQ3ZFLDJCQUEyQixFQUFFLHNDQUFzQyxFQUFFLDJCQUEyQixHQUNqRyxNQUFNLHdCQUF3QixDQUFDO0FBRWhDLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSx1QkFBdUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzlGLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBdUZyRSxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3BELHlCQUF5QixFQUFFLE9BQU87SUFDbEMsc0JBQXNCLEVBQUUsTUFBTTtJQUM5Qiw0QkFBNEIsRUFBRSxJQUFJO0lBQ2xDLGlCQUFpQixFQUFFLHlEQUF5RDtJQUM1RSw4QkFBOEIsRUFBRSw4QkFBOEI7SUFDOUQsS0FBSyxFQUFFLG9DQUFvQztDQUNuQyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQy9FLFNBQVMsWUFBWSxDQUFDLFlBQXFCO0lBQ3pDLElBQUksQ0FBQyxZQUFZO1FBQUUsSUFBSSxFQUFFLENBQUM7QUFDNUIsQ0FBQztBQUNELE1BQU0sSUFBSSxHQUFHLENBQUksWUFBcUIsRUFBSyxFQUFFO0lBQzNDLElBQUksQ0FBQztRQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDekQsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQztBQUNsQyxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN4RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUM3QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQy9DLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUNBQXFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDbkcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDM0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN0RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRix3RkFBd0Y7QUFDeEYsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUFXLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3hELElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLElBQUksV0FBVyxHQUFHLENBQUMsQ0FBQztJQUNwQixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3BDLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYSxFQUFRLEVBQUU7UUFDdEMsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLElBQUksd0JBQXdCLENBQUMseUJBQXlCLENBQUMsQ0FBQztRQUNqRixXQUFXLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFDaEQsWUFBWSxDQUFDLFdBQVcsSUFBSSx3QkFBd0IsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2xGLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBYyxFQUFFLEtBQWEsRUFBVyxFQUFFO1FBQ3RELFlBQVksQ0FBQyxFQUFFLEtBQUssSUFBSSxNQUFNLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssQ0FBQztRQUFDLENBQUM7UUFDaEUsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDNUYsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ25GLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNuQyxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQy9DLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7WUFDM0csTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNwQyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxHQUFHLENBQUMsQ0FBQztZQUNqQyxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLEVBQUUsS0FBSyxDQUFDO2dCQUN2RSxZQUFZLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQyxJQUFJLE1BQU0sSUFBSSxHQUFHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQ3pHLE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztnQkFDN0IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO29CQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUN6RSxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO29CQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE9BQU8sTUFBTSxDQUFDO1lBQ2hCLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN2QixZQUFZLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUM7Z0JBQ3RDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDYixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUMvRCxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO2dCQUMzRSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO2dCQUFTLENBQUM7WUFBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQUMsQ0FBQztJQUN4QyxDQUFDLENBQUM7SUFDRixNQUFNLFVBQVUsR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hELFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLFVBQVUsSUFBSSx3QkFBd0IsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQzFHLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUNoQyxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUEwQixFQUEyQixFQUFFO0lBQ3hGLFlBQVksQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0YsT0FBTyxRQUFtQyxDQUFDO0FBQzdDLENBQUMsQ0FBQztBQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBaUMsRUFBRTtJQUNyRSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMvRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUN4SCxDQUFDLENBQUM7QUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQTRCLEVBQUU7SUFDOUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxtQkFBbUIsRUFBRSxRQUFRLEVBQUUsc0JBQXNCO1FBQ3BHLGNBQWMsRUFBRSxzQkFBc0IsRUFBRSxZQUFZLEVBQUUsa0JBQWtCLENBQUMsQ0FBQyxDQUFDO0lBQzdFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLFlBQVksQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLFVBQVUsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQztJQUMzRyxPQUFPO1FBQ0wsYUFBYSxFQUFFLENBQUMsRUFBRSxpQkFBaUIsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3RHLG9CQUFvQixFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsb0JBQW9CLENBQUMsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7UUFDdEcsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQztRQUM1RCxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUksRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRTtRQUN6RyxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDO0tBQ3JELENBQUM7QUFDSixDQUFDLENBQUM7QUFDRixNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQWlDLEVBQUUsUUFBa0MsRUFBVyxFQUFFLENBQ3JHLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0MsTUFBTSxTQUFTLEdBQUcsQ0FBQyxPQUFpQyxFQUFFLFFBQWtDLEVBQVcsRUFBRSxDQUNuRyxPQUFPLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLGdCQUFnQixLQUFLLFFBQVEsQ0FBQyxnQkFBZ0I7T0FDekYsU0FBUyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ3RFLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxVQUFvQyxFQUFFLGFBQW1DLEVBQVcsRUFBRSxDQUMvRyxVQUFVLENBQUMsTUFBTSxLQUFLLGFBQWEsQ0FBQyxNQUFNLElBQUksVUFBVSxDQUFDLGdCQUFnQixLQUFLLGFBQWEsQ0FBQyxnQkFBZ0I7T0FDekcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBRTlFLHFGQUFxRjtBQUNyRixNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLFFBQWlCLEVBQTRCLEVBQUUsQ0FDN0YsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXpDLE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLENBQzNELFFBQWlCLEVBQ3VCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3JELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxlQUFlLEVBQUUsUUFBUSxFQUFFLHNCQUFzQixFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDdkcsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRO1dBQ3JFLDJCQUEyQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNyRCxPQUFPLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDckQsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDdkYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxRQUFpQixFQUNpQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUMvQyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFlBQVksRUFBRSxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLFVBQVUsR0FBRywyQkFBMkIsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDakUsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNyRix5RkFBeUY7SUFDekYsWUFBWSxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksV0FBVyxDQUFDLFlBQVksS0FBSyxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDM0YsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsdUJBQXVCLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDO0FBQ3JILENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsQ0FDdEQsUUFBaUIsRUFDa0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDaEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLFVBQVUsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFlBQVksQ0FBQyxDQUFDO0lBQ3hHLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxVQUFVLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO0FBQzNFLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sbURBQW1ELEdBQUcsQ0FDakUsUUFBaUIsRUFDNkIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDM0QsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLE9BQU8sRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxXQUFXLEVBQUUsc0NBQXNDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7QUFDckgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSxvREFBb0QsR0FBRyxDQUNsRSxRQUFpQixFQUM4QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUM1RCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsYUFBYSxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDekUsWUFBWSxDQUFDLEtBQUssQ0FBQyxZQUFZLEtBQUssaUJBQWlCLElBQUksS0FBSyxDQUFDLFlBQVksS0FBSyxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3ZHLE9BQU8sRUFBRSxXQUFXLEVBQUUsc0NBQXNDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFFLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUM7QUFDdEgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDbkUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDdEYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUM1RCxRQUFpQixFQUN3QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUN0RCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQy9FLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxJQUFJLElBQUksSUFBSSxDQUFDLDBCQUEwQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RyxZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3ZFLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLFVBQVUsSUFBSSx3QkFBd0IsQ0FBQyw0QkFBNEI7V0FDbEcsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDcEQsT0FBTyxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDdEcsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsZUFBZSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDdkUsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2pELFlBQVksQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxPQUFPLFFBQVEsQ0FBQyxHQUFHLEtBQUssUUFBUTtXQUNyRSxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxzQkFBc0I7V0FDdEUsa0RBQWtELENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVFLE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLFFBQVEsRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQztBQUMvRCxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQzVELFFBQWlCLEVBQ3dCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3RELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ3hELFlBQVksQ0FBQyxLQUFLLENBQUMsVUFBVSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQ3hDLE9BQU8sRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDOUIsQ0FBQyxDQUFDLENBQUM7QUFFSCx5RkFBeUY7QUFDekYsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FDeEQsUUFBaUIsRUFBRSxVQUFtQixFQUNaLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3ZDLE1BQU0sUUFBUSxHQUFHLCtCQUErQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzNELE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFFLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTTtXQUNwRixRQUFRLENBQUMsb0JBQW9CLEtBQUssT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDckUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSCw2R0FBNkc7QUFDN0csTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FDeEQsUUFBaUIsRUFBRSxNQUFjLEVBQ1EsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDdEQsTUFBTSxRQUFRLEdBQUcsOENBQThDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUUsWUFBWSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDcEQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsS0FBSyxFQUN0RCxRQUFpQixFQUFFLGlCQUEwQixFQUNGLEVBQUU7SUFDN0MsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsdUNBQXVDLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEUsTUFBTSxjQUFjLEdBQUcsK0JBQStCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUMxRSxZQUFZLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLElBQUksaUJBQWlCLENBQUMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3BILE1BQU0sK0JBQStCLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDMUUsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUVGLG1HQUFtRztBQUNuRyxNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxDQUNsRCxRQUFpQixFQUFFLFVBQW1CLEVBQ0gsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDaEQsTUFBTSxRQUFRLEdBQUcsd0NBQXdDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEUsTUFBTSxPQUFPLEdBQUcsdUNBQXVDLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEUsWUFBWSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEgsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSDs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsS0FBSyxFQUNsRSxRQUFpQixFQUFFLGFBQXNCLEVBQUUsaUJBQTBCLEVBQUUsa0JBQTJCLEVBQ21CLEVBQUU7SUFDdkgsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsbURBQW1ELENBQUMsUUFBUSxDQUFDLENBQUM7UUFDOUUsTUFBTSxVQUFVLEdBQUcsMkJBQTJCLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7UUFDdkUsTUFBTSxjQUFjLEdBQUcsK0JBQStCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUMxRSxNQUFNLGVBQWUsR0FBRywrQkFBK0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzVFLFlBQVksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxjQUFjLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxjQUFjLEVBQUUsVUFBVSxDQUFDO2VBQ3JHLE9BQU8sQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEtBQUssZUFBZSxDQUFDLGlCQUFpQjtlQUMzRSxTQUFTLENBQUMsY0FBYyxFQUFFLGVBQWUsQ0FBQyxDQUFDLENBQUM7UUFDakQsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLGVBQWUsRUFBRSxjQUFjLENBQUMsQ0FBQztRQUM3RCxZQUFZLENBQUMsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLGlCQUFpQixLQUFLLGNBQWMsQ0FBQyxpQkFBaUI7ZUFDMUYsZUFBZSxDQUFDLFlBQVksR0FBRyxjQUFjLENBQUMsWUFBWTtlQUMxRCxlQUFlLENBQUMsb0JBQW9CLElBQUksY0FBYyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQztRQUNuRixZQUFZLENBQUMsQ0FBQyxNQUFNLHNDQUFzQyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDM0csT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMscUJBQXFCLEVBQUUsQ0FBQztJQUN4RixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUYsc0ZBQXNGO0FBQ3RGLE1BQU0sQ0FBQyxNQUFNLGdEQUFnRCxHQUFHLENBQzlELFFBQWlCLEVBQUUsVUFBbUIsRUFDUyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUM1RCxNQUFNLFFBQVEsR0FBRyxvREFBb0QsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNoRixNQUFNLE9BQU8sR0FBRyxtREFBbUQsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNoRixZQUFZLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsS0FBSyxTQUFTLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztXQUMxRSxRQUFRLENBQUMsWUFBWSxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsS0FBSyxPQUFPLENBQUMsT0FBTyxDQUFDLGlCQUFpQjtZQUN2RyxDQUFDLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLENBQUMsQ0FBQztJQUNsRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMsQ0FBQztBQUVILGtHQUFrRztBQUNsRyxNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxLQUFLLEVBQzVELFFBQWlCLEVBQUUsYUFBc0IsRUFBRSxpQkFBMEIsRUFDcEIsRUFBRTtJQUNuRCxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyw2Q0FBNkMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUN4RSxNQUFNLFVBQVUsR0FBRywyQkFBMkIsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztRQUN2RSxNQUFNLGNBQWMsR0FBRywrQkFBK0IsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzFFLFlBQVksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxjQUFjLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxjQUFjLEVBQUUsVUFBVSxDQUFDO2VBQ3JHLFVBQVUsQ0FBQyxXQUFXLEtBQUssS0FBSztlQUNoQyxTQUFTLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQywrQkFBK0IsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDL0YsWUFBWSxDQUFDLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztRQUMzRSxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDNUIsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/index.d.ts

@@ -25,6 +25,7 @@ import * as nodeRequests from './node.js';
 import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
+import * as runtimeSessionRequests from './runtimesession.js';
 import * as secretRequests from './secret.js';
 import * as serverRequests from './server.js';
 import * as serviceRequests from './service.js';
@@ -33,7 +34,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -26,6 +26,7 @@ import * as nodeRequests from './node.js';
 import * as palletRequests from './pallet.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
+import * as runtimeSessionRequests from './runtimesession.js';
 import * as secretRequests from './secret.js';
 import * as serverRequests from './server.js';
 import * as serviceRequests from './service.js';
@@ -34,9 +35,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGtCQUFrQixNQUFNLGlCQUFpQixDQUFDO0FBQ3RELE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsa0JBQWtCLElBQUksVUFBVSxFQUNoQyxXQUFXLElBQUksR0FBRyxFQUNsQixjQUFjLElBQUksTUFBTSxFQUN4Qix3QkFBd0IsSUFBSSxnQkFBZ0IsRUFDNUMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsWUFBWSxJQUFJLElBQUksRUFDcEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGtCQUFrQixNQUFNLGlCQUFpQixDQUFDO0FBQ3RELE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyx3QkFBd0IsTUFBTSx1QkFBdUIsQ0FBQztBQUNsRSxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssc0JBQXNCLE1BQU0scUJBQXFCLENBQUM7QUFDOUQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUVoRCxPQUFPLEVBQ0wsYUFBYSxJQUFJLEtBQUssRUFDdEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLG1CQUFtQixJQUFJLFdBQVcsRUFDbEMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsc0JBQXNCLElBQUksY0FBYyxFQUN4QyxjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/requests/runtimesession.d.ts

@@ -0,0 +1,32 @@
+import * as plugins from '../plugins.js';
+import type * as data from '../data/runtimesession.js';
+/** WSS-only Pallet bootstrap. Derive physical peer/process/idempotency server-side. */
+export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1> {
+    method: 'registerPalletRuntimeSessionV1';
+    request: data.IRegisterPalletRuntimeSessionRequestV1;
+    response: data.IRuntimeSessionBindingV1;
+}
+/** Controller push over the already authenticated Pallet-initiated connection. */
+export interface IReq_Controller_Pallet_ApplyRuntimeAssignmentV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeAssignmentV1> {
+    method: 'applyRuntimeAssignmentV1';
+    request: data.IApplyRuntimeAssignmentRequestV1;
+    response: data.IApplyRuntimeAssignmentResponseV1;
+}
+/** Current-peer report, including exact historical outbox recovery after reconnect. */
+export interface IReq_Pallet_Controller_ReportRuntimeAssignmentObservationV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportRuntimeAssignmentObservationV1> {
+    method: 'reportRuntimeAssignmentObservationV1';
+    request: data.IReportRuntimeAssignmentObservationRequestV1;
+    response: data.IReportRuntimeAssignmentObservationResponseV1;
+}
+/** Current-peer, exact current assignment authorization; response is secret material. */
+export interface IReq_Pallet_Controller_GetRuntimeRegistryCredentialV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeRegistryCredentialV1> {
+    method: 'getRuntimeRegistryCredentialV1';
+    request: data.IGetRuntimeRegistryCredentialRequestV1;
+    response: data.IGetRuntimeRegistryCredentialResponseV1;
+}
+/** WSS-only JWT authentication; server-owned identity tag, never client-authored claims. */
+export interface IReq_Any_Cloudly_RegisterCloudlyClientSessionV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_RegisterCloudlyClientSessionV1> {
+    method: 'registerCloudlyClientSessionV1';
+    request: data.IRegisterCloudlyClientSessionRequestV1;
+    response: data.IRegisterCloudlyClientSessionResponseV1;
+}

package/dist_ts/requests/runtimesession.js

@@ -0,0 +1,2 @@
+import * as plugins from '../plugins.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXNlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9ydW50aW1lc2Vzc2lvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "28.5.0",
+  "version": "29.0.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -184,6 +184,49 @@ the receiving service. Readiness requires matching running image evidence and
 can describe drift (such as a removed runtime while intent remains `run`), and
 does not authorize storage relocation or prove fencing.
 
+### Resolved Runtime Configuration
+
+`data.IRuntimeConfigV1` seals the public environment, working directory, resource
+and identity policies, target ports, readiness timing and log limits together with
+the immutable image invocation. `computeRuntimeConfigV1Digest` hashes that exact
+content; `bindRuntimeConfigV1ToAssignment` checks the config reference, service,
+organization, image and selected platform against one assignment. Secret material,
+registry credentials and host paths remain outside the configuration.
+
+Both CPU and identity policies are required. `cpuMillis: null` explicitly means
+no CPU quota; a positive number sets a quota. `runAsUser` and `runAsGroup` must
+either both be numeric overrides or both be `null`. The null pair selects the
+pinned platform image's OCI user and group resolution against its immutable root
+filesystem. A consumer must not guess a group for a UID-only or named image user.
+Version 29 widens these numeric TypeScript fields to include those explicit null
+policies; consumers must handle them before accepting configurations from v29.
+Existing numeric configurations retain their exact meaning and digest.
+
+### Authenticated Runtime Sessions
+
+`requests.runtimesession` defines `registerPalletRuntimeSessionV1`,
+`applyRuntimeAssignmentV1`, `reportRuntimeAssignmentObservationV1`, and
+`getRuntimeRegistryCredentialV1`. Pallet initiates WSS through its configured
+Cloudly HTTPS origin. The receiver derives the physical peer, process instance
+and registration idempotency; callers cannot supply those authorities. A serialized
+`IRuntimeSessionBindingV1` provides content to compare with authenticated peer
+state and does not itself authenticate a connection. Registry credentials are
+ephemeral, bounded and authorized against an exact current `run` assignment.
+
+After reconnect or credential rotation, the current authenticated session may
+submit an unchanged historical observation from its durable outbox. Server-indexed
+history must prove the same node, runtime namespace and durable controller, an
+older session epoch and an eligible credential generation. A
+`historical-recovery` receipt can advance the durable counter and acknowledge the
+exact body; it cannot restore active readiness, routes or liveness. Those require
+a fresh observation from the current session. The contract helpers validate and
+classify content; authentication and atomic receipt persistence remain server-owned.
+
+`registerCloudlyClientSessionV1` separately authenticates a current human or
+machine JWT on a physical TypedSocket so the server can own its identity tag.
+Both registration methods reject HTTP transport. Sensitive requests and registry
+responses must be excluded from hooks, logs, diagnostics and durable journals.
+
 ### Offline SmartDB Settlement And Packaging
 
 The Node-only `@serve.zone/interfaces/runtime` export includes isolated V1

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '28.5.0',
+  version: '29.0.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -25,6 +25,7 @@ export * from './nodeenrollment.js';
 export * from './registry.js';
 export * from './runtimeassignment.js';
 export * from './runtimeconfig.js';
+export * from './runtimesession.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';

package/ts/data/runtimeconfig.ts

@@ -71,8 +71,8 @@ export interface IRuntimeConfigLogPolicyV1 {
 
 /**
  * Controller-owned resolved nonsecret execution intent. OCI command, effective
- * environment, working directory and identity must be resolved before sealing;
- * consumers must not append inherited image defaults or choose runtime defaults.
+ * environment, working directory and identity policy must be resolved before
+ * sealing; consumers must not choose resource limits or identity policies.
  * Secrets, network identity and storage claims remain separately assignment-bound
  * owner references. This document contains no registry credentials or host paths.
  */
@@ -90,11 +90,21 @@ export interface IRuntimeConfigV1 extends IRuntimeAuthorityReferenceV1 {
   /** Complete effective public environment; secret values must never be inlined. */
   environment: Record<string, string>;
   workingDirectory: string;
-  cpuMillis: number;
+  /** null explicitly requests no CPU quota; zero and omitted values are invalid. */
+  cpuMillis: number | null;
   memoryBytes: number;
   readonlyRootfs: boolean;
-  runAsUser: number;
-  runAsGroup: number;
+  /**
+   * Both identity fields must be numbers or both must be null. The null pair
+   * explicitly selects the pinned platform image's OCI User, including primary
+   * and supplemental group resolution against its immutable root filesystem.
+   * An absent OCI User retains the image/runtime specification's root identity.
+   * The execution owner must delegate that resolution to the qualified runtime;
+   * it must not guess a GID for a UID-only or named image user.
+   */
+  runAsUser: number | null;
+  /** Numeric override paired with runAsUser, or null for the image identity policy. */
+  runAsGroup: number | null;
   /** Sorted unique names, with no overlapping ranges for the same transport. */
   targetPorts: IRuntimeConfigTargetPortV1[];
   readiness: TRuntimeConfigReadinessV1;
@@ -287,12 +297,12 @@ const assertConfig = (valueArg: unknown): IRuntimeConfigV1 => {
   if (typeof directory !== 'string' || !directory.startsWith('/')
     || encoder.encode(directory).byteLength > 4096 || /[\u0000-\u001f\u007f]/.test(directory)
     || (directory !== '/' && directory.split('/').slice(1).some((partArg) => !partArg || partArg === '.' || partArg === '..'))
-    || !isInteger(valueArg.cpuMillis, 1, 1_000_000)
+    || !(valueArg.cpuMillis === null || isInteger(valueArg.cpuMillis, 1, 1_000_000))
     || !isInteger(valueArg.memoryBytes, 16 * 1024 * 1024, 2 ** 50)
     || typeof valueArg.readonlyRootfs !== 'boolean'
-    || !isInteger(valueArg.runAsUser, 0, 2 ** 31 - 1)
-    || !isInteger(valueArg.runAsGroup, 0, 2 ** 31 - 1)) {
-    fail('runtime config requires canonical directory, explicit resources and numeric identity');
+    || !((valueArg.runAsUser === null && valueArg.runAsGroup === null)
+      || (isInteger(valueArg.runAsUser, 0, 2 ** 31 - 1) && isInteger(valueArg.runAsGroup, 0, 2 ** 31 - 1)))) {
+    fail('runtime config requires canonical directory and explicit resource and identity policies');
   }
   const ports = valueArg.targetPorts;
   if (!Array.isArray(ports) || ports.length > runtimeConfigV1Contract.maximumTargetPorts) {