@serve.zone/interfaces 30.0.0 → 30.2.0

package/dist_ts/data/runtimeterminalreceipt.js

@@ -0,0 +1,281 @@
+import { isSha256Digest } from './immutableimage.js';
+import { evaluateRuntimeAssignmentV1, getRuntimeAssignmentV1Reference, snapshotRuntimeAssignmentV1 } from './runtimeassignment.js';
+import { bindRuntimeReporterSessionV1, snapshotRuntimeSessionBindingV1 } from './runtimesession.js';
+import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+export const runtimeAssignmentTerminalReceiptV1Contract = Object.freeze({
+    digestDomain: 'serve.zone/runtime-assignment-terminal-receipt-v1',
+    maximumReceiptCanonicalBytes: 16_384,
+    maximumHistoryCanonicalBytes: 98_304,
+    maximumReceipts: 2,
+    maximumAssignmentRevisions: 3,
+    error: 'Runtime terminal receipt contract rejected.',
+});
+const fail = () => { throw new Error(runtimeAssignmentTerminalReceiptV1Contract.error); };
+function requireValue(conditionArg) { if (!conditionArg)
+    fail(); }
+const safe = (operationArg) => { try {
+    return operationArg();
+}
+catch {
+    return fail();
+} };
+const canonical = (valueArg) => canonicalizeStrictJson(valueArg, fail);
+const encoder = new TextEncoder();
+const identifier = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(valueArg));
+    return valueArg;
+};
+const digest = (valueArg) => {
+    requireValue(typeof valueArg === 'string' && isSha256Digest(valueArg));
+    return valueArg;
+};
+/** Bounded inert copy before hashing or calling any nested validator. */
+const capture = (valueArg, maximumBytesArg = runtimeAssignmentTerminalReceiptV1Contract.maximumHistoryCanonicalBytes) => safe(() => {
+    let nodes = 0;
+    let bytes = 0;
+    const ancestors = new Set();
+    const account = (value) => {
+        requireValue(value.length <= maximumBytesArg);
+        bytes += encoder.encode(value).byteLength;
+        requireValue(bytes <= maximumBytesArg);
+    };
+    const copy = (value, depth) => {
+        requireValue(++nodes <= 4096 && depth <= 12);
+        if (typeof value === 'string') {
+            account(value);
+            return value;
+        }
+        if (value === null || typeof value === 'boolean' || typeof value === 'number')
+            return value;
+        requireValue(value !== null && typeof value === 'object' && !ancestors.has(value));
+        const array = Array.isArray(value);
+        const prototype = Object.getPrototypeOf(value);
+        requireValue(array ? prototype === Array.prototype : prototype === Object.prototype || prototype === null);
+        ancestors.add(value);
+        try {
+            const keys = Reflect.ownKeys(value);
+            requireValue(keys.length <= 65);
+            if (array) {
+                const length = Object.getOwnPropertyDescriptor(value, 'length')?.value;
+                requireValue(Number.isSafeInteger(length) && length >= 0 && length <= 64 && keys.length === length + 1);
+                const result = [];
+                for (let index = 0; index < length; index++) {
+                    const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                    requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+                    result.push(copy(descriptor.value, depth + 1));
+                }
+                return result;
+            }
+            const result = Object.create(null);
+            for (const key of keys) {
+                requireValue(typeof key === 'string');
+                account(key);
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                requireValue(descriptor?.enumerable && Object.hasOwn(descriptor, 'value'));
+                result[key] = copy(descriptor.value, depth + 1);
+            }
+            return result;
+        }
+        finally {
+            ancestors.delete(value);
+        }
+    };
+    const serialized = canonical(copy(valueArg, 0));
+    requireValue(encoder.encode(serialized).byteLength <= maximumBytesArg);
+    return JSON.parse(serialized);
+});
+const record = (valueArg, keysArg) => {
+    requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
+    const keys = Object.keys(valueArg);
+    requireValue(keys.length === keysArg.length && keys.every((key) => keysArg.includes(key)));
+    return valueArg;
+};
+const reference = (valueArg) => {
+    const value = record(valueArg, ['assignmentId', 'generation', 'digest']);
+    requireValue(typeof value.generation === 'number' && Number.isSafeInteger(value.generation)
+        && value.generation >= 1 && value.generation <= 3);
+    return { assignmentId: identifier(value.assignmentId), generation: value.generation, digest: digest(value.digest) };
+};
+const evidence = (valueArg) => {
+    const value = record(valueArg, ['phase', 'sandboxId', 'containerId', 'imageConfigDigest', 'ipAddresses', 'exitCode']);
+    requireValue(value.phase === 'absent' || value.phase === 'stopped');
+    for (const field of ['sandboxId', 'containerId'])
+        requireValue(value[field] === null
+            || (typeof value[field] === 'string' && /^[a-f0-9]{64}$/.test(value[field])));
+    requireValue(value.imageConfigDigest === null || (typeof value.imageConfigDigest === 'string'
+        && isSha256Digest(value.imageConfigDigest)));
+    requireValue(Array.isArray(value.ipAddresses) && value.ipAddresses.length === 0);
+    requireValue(value.exitCode === null || (typeof value.exitCode === 'number' && Number.isSafeInteger(value.exitCode)
+        && value.exitCode >= -2_147_483_648 && value.exitCode <= 2_147_483_647));
+    requireValue(value.phase === 'absent'
+        ? value.sandboxId === null && value.containerId === null && value.imageConfigDigest === null && value.exitCode === null
+        : value.sandboxId !== null);
+    requireValue(value.containerId !== null || (value.imageConfigDigest === null && value.exitCode === null));
+    return value;
+};
+/** Detached exact-schema assertion only; digest, journal provenance and authority remain unverified. */
+export const snapshotRuntimeAssignmentTerminalReceiptV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg, runtimeAssignmentTerminalReceiptV1Contract.maximumReceiptCanonicalBytes), ['schemaVersion', 'assignment', 'runAssignment', 'reporterSessionId', 'sequence', 'operation', 'previousReceiptDigest', 'digest']);
+    const assignment = reference(value.assignment);
+    const runAssignment = reference(value.runAssignment);
+    const operation = record(value.operation, ['id', 'action', 'bootId', 'status', 'evidence']);
+    const terminalEvidence = evidence(operation.evidence);
+    requireValue(value.schemaVersion === 1 && (value.sequence === 1 || value.sequence === 2)
+        && operation.status === 'completed' && assignment.generation === value.sequence + 1
+        && runAssignment.generation === 1 && runAssignment.assignmentId === assignment.assignmentId);
+    requireValue(typeof operation.bootId === 'string'
+        && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(operation.bootId));
+    requireValue(value.sequence === 1 ? operation.action === 'stop' && value.previousReceiptDigest === null
+        : operation.action === 'remove' && terminalEvidence.phase === 'absent' && value.previousReceiptDigest !== null);
+    return { schemaVersion: 1, assignment, runAssignment, reporterSessionId: identifier(value.reporterSessionId),
+        sequence: value.sequence, operation: { id: identifier(operation.id), action: operation.action,
+            bootId: operation.bootId, status: 'completed', evidence: terminalEvidence },
+        previousReceiptDigest: value.previousReceiptDigest === null ? null : digest(value.previousReceiptDigest), digest: digest(value.digest) };
+});
+/** Bounded exact receipt history for synchronous persistence assertions; hashes remain unchecked. */
+export const snapshotRuntimeAssignmentTerminalReceiptHistoryV1 = (valueArg) => safe(() => {
+    const values = capture(valueArg);
+    requireValue(Array.isArray(values) && values.length <= runtimeAssignmentTerminalReceiptV1Contract.maximumReceipts);
+    const receipts = values.map(snapshotRuntimeAssignmentTerminalReceiptV1);
+    for (const [index, receipt] of receipts.entries()) {
+        requireValue(receipt.sequence === index + 1);
+        if (index > 0)
+            requireValue(receipt.previousReceiptDigest === receipts[0].digest
+                && canonical(receipt.runAssignment) === canonical(receipts[0].runAssignment)
+                && receipt.operation.id !== receipts[0].operation.id);
+    }
+    return receipts;
+});
+const assignments = (valueArg) => {
+    const values = capture(valueArg);
+    requireValue(Array.isArray(values) && values.length >= 2
+        && values.length <= runtimeAssignmentTerminalReceiptV1Contract.maximumAssignmentRevisions);
+    return values.map(snapshotRuntimeAssignmentV1);
+};
+const checkAssignmentHistory = async (historyArg) => {
+    const run = historyArg[0];
+    const scope = { controller: run.controller, organizationId: run.organizationId,
+        nodeId: run.nodeId, runtimeNamespace: run.runtimeNamespace };
+    for (const [index, assignment] of historyArg.entries()) {
+        requireValue(assignment.generation === index + 1
+            && assignment.disposition === ['run', 'stop-preserve', 'remove-runtime-preserve-storage'][index]);
+        requireValue((await evaluateRuntimeAssignmentV1(assignment, index === 0 ? null : historyArg[index - 1], scope)).status === 'accept');
+    }
+};
+const computeSnapshotDigest = async (receiptArg) => {
+    const { digest: _digest, ...payload } = receiptArg;
+    return `sha256:${await createCanonicalJsonSha256Hex(canonical({
+        domain: runtimeAssignmentTerminalReceiptV1Contract.digestDomain, payload,
+    }), fail)}`;
+};
+/** Domain-separated exact body digest; captures before asynchronous hashing. */
+export const computeRuntimeAssignmentTerminalReceiptV1Digest = async (valueArg) => {
+    try {
+        return await computeSnapshotDigest(snapshotRuntimeAssignmentTerminalReceiptV1(valueArg));
+    }
+    catch {
+        return fail();
+    }
+};
+const checkReceipt = async (receiptArg, historyArg, previousArg) => {
+    requireValue(historyArg.length > receiptArg.sequence
+        && canonical(receiptArg.runAssignment) === canonical(getRuntimeAssignmentV1Reference(historyArg[0]))
+        && canonical(receiptArg.assignment) === canonical(getRuntimeAssignmentV1Reference(historyArg[receiptArg.sequence]))
+        && receiptArg.digest === await computeSnapshotDigest(receiptArg));
+    if (receiptArg.sequence === 1)
+        requireValue(previousArg === null);
+    else {
+        requireValue(previousArg !== null && previousArg.sequence === 1);
+        await checkReceipt(previousArg, historyArg, null);
+        requireValue(receiptArg.previousReceiptDigest === previousArg.digest && receiptArg.operation.id !== previousArg.operation.id);
+    }
+};
+/** Full immutable run/stop/remove chain and exact prior stop receipt are mandatory for removal. */
+export const validateRuntimeAssignmentTerminalReceiptV1 = async (valueArg, assignmentHistoryArg, previousReceiptArg) => {
+    try {
+        const receipt = snapshotRuntimeAssignmentTerminalReceiptV1(valueArg);
+        const history = assignments(assignmentHistoryArg);
+        const previous = previousReceiptArg === null ? null : snapshotRuntimeAssignmentTerminalReceiptV1(previousReceiptArg);
+        await checkAssignmentHistory(history);
+        await checkReceipt(receipt, history, previous);
+        return [];
+    }
+    catch {
+        return [runtimeAssignmentTerminalReceiptV1Contract.error];
+    }
+};
+/**
+ * Pure bounded CAS decision. Persist under the owning transaction and current
+ * credential/peer fence. New acceptance also requires the exact global incumbent;
+ * only a previously persisted exact body can replay after the incumbent changes.
+ * The helper cannot prove either condition. Retain both bodies after removal.
+ */
+export const evaluateRuntimeAssignmentTerminalReceiptV1 = async (valueArg, acceptedHistoryArg, assignmentHistoryArg) => {
+    try {
+        const receipt = snapshotRuntimeAssignmentTerminalReceiptV1(valueArg);
+        const accepted = snapshotRuntimeAssignmentTerminalReceiptHistoryV1(acceptedHistoryArg);
+        const history = assignments(assignmentHistoryArg);
+        await checkAssignmentHistory(history);
+        for (const existing of accepted)
+            await checkReceipt(existing, history, existing.sequence === 1 ? null : accepted[0]);
+        if (receipt.digest !== await computeSnapshotDigest(receipt)
+            || history.length <= receipt.sequence
+            || canonical(receipt.runAssignment) !== canonical(getRuntimeAssignmentV1Reference(history[0]))
+            || canonical(receipt.assignment) !== canonical(getRuntimeAssignmentV1Reference(history[receipt.sequence]))) {
+            return { status: 'reject', reason: 'invalid' };
+        }
+        const existing = accepted[receipt.sequence - 1];
+        if (existing)
+            return canonical(existing) === canonical(receipt)
+                ? { status: 'replay', receipt: existing } : { status: 'reject', reason: 'conflict' };
+        if (receipt.sequence !== accepted.length + 1)
+            return { status: 'reject', reason: 'sequence-gap' };
+        if (receipt.sequence === 2 && (receipt.previousReceiptDigest !== accepted[0].digest
+            || receipt.operation.id === accepted[0].operation.id))
+            return { status: 'reject', reason: 'predecessor-mismatch' };
+        return { status: 'accept', receipt };
+    }
+    catch {
+        return { status: 'reject', reason: 'invalid' };
+    }
+};
+export const snapshotReportRuntimeAssignmentTerminalReceiptRequestV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['session', 'receipt']);
+    return { session: snapshotRuntimeSessionBindingV1(value.session), receipt: snapshotRuntimeAssignmentTerminalReceiptV1(value.receipt) };
+});
+export const snapshotReportRuntimeAssignmentTerminalReceiptResponseV1 = (valueArg) => safe(() => {
+    const value = record(capture(valueArg), ['receipt', 'authorityUse']);
+    requireValue(value.authorityUse === 'current-session' || value.authorityUse === 'historical-recovery');
+    return { receipt: snapshotRuntimeAssignmentTerminalReceiptV1(value.receipt), authorityUse: value.authorityUse };
+});
+/**
+ * CURRENT physical session and immutable server-indexed reporter history are
+ * trusted owner inputs, never wire claims. The previous stop receipt must also
+ * come from the durable owner. This binds content; it does not authenticate,
+ * prove the local operation join, advance CAS, or admit a replacement.
+ */
+export const bindReportRuntimeAssignmentTerminalReceiptRequestV1 = async (valueArg, assignmentHistoryArg, previousReceiptArg, trustedSessionArg, reporterHistoryArg) => {
+    try {
+        const request = snapshotReportRuntimeAssignmentTerminalReceiptRequestV1(valueArg);
+        const history = assignments(assignmentHistoryArg);
+        const previous = previousReceiptArg === null ? null : snapshotRuntimeAssignmentTerminalReceiptV1(previousReceiptArg);
+        requireValue(history.length > request.receipt.sequence);
+        const binding = bindRuntimeReporterSessionV1(request.session, request.receipt.reporterSessionId, history[request.receipt.sequence], trustedSessionArg, reporterHistoryArg);
+        await checkAssignmentHistory(history);
+        await checkReceipt(request.receipt, history, previous);
+        return { request, authorityUse: binding.authorityUse };
+    }
+    catch {
+        return fail();
+    }
+};
+/** Exact ACK of the immutable outbox body; no rewritten session, operation or chain. */
+export const bindReportRuntimeAssignmentTerminalReceiptResponseV1 = (valueArg, requestArg) => safe(() => {
+    const response = snapshotReportRuntimeAssignmentTerminalReceiptResponseV1(valueArg);
+    const request = snapshotReportRuntimeAssignmentTerminalReceiptRequestV1(requestArg);
+    requireValue(canonical(response.receipt) === canonical(request.receipt)
+        && response.authorityUse === (request.receipt.reporterSessionId === request.session.reporterSessionId
+            ? 'current-session' : 'historical-recovery'));
+    return response;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXRlcm1pbmFscmVjZWlwdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvcnVudGltZXRlcm1pbmFscmVjZWlwdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFFckQsT0FBTyxFQUFFLDJCQUEyQixFQUFFLCtCQUErQixFQUNuRSwyQkFBMkIsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRTlELE9BQU8sRUFBRSw0QkFBNEIsRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ3BHLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSw0QkFBNEIsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBNERuRyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3RFLFlBQVksRUFBRSxtREFBbUQ7SUFDakUsNEJBQTRCLEVBQUUsTUFBTTtJQUNwQyw0QkFBNEIsRUFBRSxNQUFNO0lBQ3BDLGVBQWUsRUFBRSxDQUFDO0lBQ2xCLDBCQUEwQixFQUFFLENBQUM7SUFDN0IsS0FBSyxFQUFFLDZDQUE2QztDQUM1QyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQ2pHLFNBQVMsWUFBWSxDQUFDLFlBQXFCLElBQTBCLElBQUksQ0FBQyxZQUFZO0lBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQ2pHLE1BQU0sSUFBSSxHQUFHLENBQUksWUFBcUIsRUFBSyxFQUFFLEdBQUcsSUFBSSxDQUFDO0lBQUMsT0FBTyxZQUFZLEVBQUUsQ0FBQztBQUFDLENBQUM7QUFBQyxNQUFNLENBQUM7SUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0FBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUMxRyxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN4RixNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDO0FBQ2xDLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQy9DLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUNBQXFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDbkcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFpQixFQUFFO0lBQ2xELFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDdkUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYseUVBQXlFO0FBQ3pFLE1BQU0sT0FBTyxHQUFHLENBQUMsUUFBaUIsRUFBRSxrQkFBMEIsMENBQTBDLENBQUMsNEJBQTRCLEVBQVcsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDM0osSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNwQyxNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWEsRUFBUSxFQUFFO1FBQ3RDLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxJQUFJLGVBQWUsQ0FBQyxDQUFDO1FBQzlDLEtBQUssSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFVBQVUsQ0FBQztRQUMxQyxZQUFZLENBQUMsS0FBSyxJQUFJLGVBQWUsQ0FBQyxDQUFDO0lBQ3pDLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBYyxFQUFFLEtBQWEsRUFBVyxFQUFFO1FBQ3RELFlBQVksQ0FBQyxFQUFFLEtBQUssSUFBSSxJQUFJLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzdDLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssQ0FBQztRQUFDLENBQUM7UUFDaEUsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDNUYsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ25GLE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbkMsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQyxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxTQUFTLElBQUksU0FBUyxLQUFLLElBQUksQ0FBQyxDQUFDO1FBQzNHLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNwQyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNoQyxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLEVBQUUsS0FBSyxDQUFDO2dCQUN2RSxZQUFZLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQyxJQUFJLE1BQU0sSUFBSSxFQUFFLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQ3hHLE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztnQkFDN0IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO29CQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUN6RSxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO29CQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE9BQU8sTUFBTSxDQUFDO1lBQ2hCLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN2QixZQUFZLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUM7Z0JBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUNwRCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUMvRCxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO2dCQUMzRSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO2dCQUFTLENBQUM7WUFBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQUMsQ0FBQztJQUN4QyxDQUFDLENBQUM7SUFDRixNQUFNLFVBQVUsR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hELFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLFVBQVUsSUFBSSxlQUFlLENBQUMsQ0FBQztJQUN2RSxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7QUFDaEMsQ0FBQyxDQUFDLENBQUM7QUFDSCxNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBaUIsRUFBMkIsRUFBRTtJQUMvRSxZQUFZLENBQUMsUUFBUSxLQUFLLElBQUksSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDNUYsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuQyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzNGLE9BQU8sUUFBbUMsQ0FBQztBQUM3QyxDQUFDLENBQUM7QUFDRixNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQWlDLEVBQUU7SUFDckUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGNBQWMsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN6RSxZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7V0FDdEYsS0FBSyxDQUFDLFVBQVUsSUFBSSxDQUFDLElBQUksS0FBSyxDQUFDLFVBQVUsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUNyRCxPQUFPLEVBQUUsWUFBWSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQUUsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUN0SCxDQUFDLENBQUM7QUFDRixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXdDLEVBQUU7SUFDM0UsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLE9BQU8sRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLG1CQUFtQixFQUFFLGFBQWEsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3RILFlBQVksQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3BFLEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxXQUFXLEVBQUUsYUFBYSxDQUFDO1FBQUUsWUFBWSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxJQUFJO2VBQy9FLENBQUMsT0FBTyxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUSxJQUFJLGdCQUFnQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEYsWUFBWSxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsS0FBSyxJQUFJLElBQUksQ0FBQyxPQUFPLEtBQUssQ0FBQyxpQkFBaUIsS0FBSyxRQUFRO1dBQ3hGLGNBQWMsQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0MsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxXQUFXLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2pGLFlBQVksQ0FBQyxLQUFLLENBQUMsUUFBUSxLQUFLLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDO1dBQzlHLEtBQUssQ0FBQyxRQUFRLElBQUksQ0FBQyxhQUFhLElBQUksS0FBSyxDQUFDLFFBQVEsSUFBSSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQzNFLFlBQVksQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLFFBQVE7UUFDbkMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssSUFBSSxJQUFJLEtBQUssQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLEtBQUssQ0FBQyxpQkFBaUIsS0FBSyxJQUFJLElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxJQUFJO1FBQ3ZILENBQUMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQzlCLFlBQVksQ0FBQyxLQUFLLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsS0FBSyxJQUFJLElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQzFHLE9BQU8sS0FBd0QsQ0FBQztBQUNsRSxDQUFDLENBQUM7QUFFRix3R0FBd0c7QUFDeEcsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUM5SCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSwwQ0FBMEMsQ0FBQyw0QkFBNEIsQ0FBQyxFQUM3RyxDQUFDLGVBQWUsRUFBRSxZQUFZLEVBQUUsZUFBZSxFQUFFLG1CQUFtQixFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsdUJBQXVCLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNySSxNQUFNLFVBQVUsR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQy9DLE1BQU0sYUFBYSxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDckQsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxJQUFJLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLGdCQUFnQixHQUFHLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDdEQsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLFFBQVEsS0FBSyxDQUFDLENBQUM7V0FDbkYsU0FBUyxDQUFDLE1BQU0sS0FBSyxXQUFXLElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxLQUFLLENBQUMsUUFBUSxHQUFHLENBQUM7V0FDaEYsYUFBYSxDQUFDLFVBQVUsS0FBSyxDQUFDLElBQUksYUFBYSxDQUFDLFlBQVksS0FBSyxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDL0YsWUFBWSxDQUFDLE9BQU8sU0FBUyxDQUFDLE1BQU0sS0FBSyxRQUFRO1dBQzVDLGdFQUFnRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUM5RixZQUFZLENBQUMsS0FBSyxDQUFDLFFBQVEsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxNQUFNLEtBQUssTUFBTSxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsS0FBSyxJQUFJO1FBQ3JHLENBQUMsQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxnQkFBZ0IsQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxxQkFBcUIsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUNsSCxPQUFPLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxVQUFVLEVBQUUsYUFBYSxFQUFFLGlCQUFpQixFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUM7UUFDMUcsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUEyQjtZQUNoSCxNQUFNLEVBQUUsU0FBUyxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsV0FBVyxFQUFFLFFBQVEsRUFBRSxnQkFBZ0IsRUFBRTtRQUM3RSxxQkFBcUIsRUFBRSxLQUFLLENBQUMscUJBQXFCLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMscUJBQXFCLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0FBQzdJLENBQUMsQ0FBQyxDQUFDO0FBRUgscUdBQXFHO0FBQ3JHLE1BQU0sQ0FBQyxNQUFNLGlEQUFpRCxHQUFHLENBQUMsUUFBaUIsRUFBeUMsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDdkksTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2pDLFlBQVksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sQ0FBQyxNQUFNLElBQUksMENBQTBDLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDbkgsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQ3hFLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNsRCxZQUFZLENBQUMsT0FBTyxDQUFDLFFBQVEsS0FBSyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDN0MsSUFBSSxLQUFLLEdBQUcsQ0FBQztZQUFFLFlBQVksQ0FBQyxPQUFPLENBQUMscUJBQXFCLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU07bUJBQzNFLFNBQVMsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLEtBQUssU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUM7bUJBQ3pFLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDMUQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxXQUFXLEdBQUcsQ0FBQyxRQUFpQixFQUEwQixFQUFFO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNqQyxZQUFZLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLENBQUMsTUFBTSxJQUFJLENBQUM7V0FDbkQsTUFBTSxDQUFDLE1BQU0sSUFBSSwwQ0FBMEMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sTUFBTSxDQUFDLEdBQUcsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO0FBQ2pELENBQUMsQ0FBQztBQUNGLE1BQU0sc0JBQXNCLEdBQUcsS0FBSyxFQUFFLFVBQWtDLEVBQWlCLEVBQUU7SUFDekYsTUFBTSxHQUFHLEdBQUcsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzFCLE1BQU0sS0FBSyxHQUFHLEVBQUUsVUFBVSxFQUFFLEdBQUcsQ0FBQyxVQUFVLEVBQUUsY0FBYyxFQUFFLEdBQUcsQ0FBQyxjQUFjO1FBQzVFLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTSxFQUFFLGdCQUFnQixFQUFFLEdBQUcsQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO0lBQy9ELEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxVQUFVLENBQUMsSUFBSSxVQUFVLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUN2RCxZQUFZLENBQUMsVUFBVSxDQUFDLFVBQVUsS0FBSyxLQUFLLEdBQUcsQ0FBQztlQUMzQyxVQUFVLENBQUMsV0FBVyxLQUFLLENBQUMsS0FBSyxFQUFFLGVBQWUsRUFBRSxpQ0FBaUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDcEcsWUFBWSxDQUFDLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxVQUFVLEVBQUUsS0FBSyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsS0FBSyxHQUFHLENBQUMsQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZJLENBQUM7QUFDSCxDQUFDLENBQUM7QUFDRixNQUFNLHFCQUFxQixHQUFHLEtBQUssRUFBRSxVQUErQyxFQUEwQixFQUFFO0lBQzlHLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsVUFBVSxDQUFDO0lBQ25ELE9BQU8sVUFBVSxNQUFNLDRCQUE0QixDQUFDLFNBQVMsQ0FBQztRQUM1RCxNQUFNLEVBQUUsMENBQTBDLENBQUMsWUFBWSxFQUFFLE9BQU87S0FDekUsQ0FBQyxFQUFFLElBQUksQ0FBQyxFQUFFLENBQUM7QUFDZCxDQUFDLENBQUM7QUFDRixnRkFBZ0Y7QUFDaEYsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsS0FBSyxFQUNsRSxRQUE2QyxFQUNyQixFQUFFO0lBQzFCLElBQUksQ0FBQztRQUFDLE9BQU8sTUFBTSxxQkFBcUIsQ0FBQywwQ0FBMEMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQzVILENBQUMsQ0FBQztBQUNGLE1BQU0sWUFBWSxHQUFHLEtBQUssRUFDeEIsVUFBK0MsRUFBRSxVQUFrQyxFQUNuRixXQUF1RCxFQUN4QyxFQUFFO0lBQ2pCLFlBQVksQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLFVBQVUsQ0FBQyxRQUFRO1dBQy9DLFNBQVMsQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1dBQ2pHLFNBQVMsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztXQUNoSCxVQUFVLENBQUMsTUFBTSxLQUFLLE1BQU0scUJBQXFCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNwRSxJQUFJLFVBQVUsQ0FBQyxRQUFRLEtBQUssQ0FBQztRQUFFLFlBQVksQ0FBQyxXQUFXLEtBQUssSUFBSSxDQUFDLENBQUM7U0FDN0QsQ0FBQztRQUNKLFlBQVksQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLFdBQVcsQ0FBQyxRQUFRLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDakUsTUFBTSxZQUFZLENBQUMsV0FBVyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUNsRCxZQUFZLENBQUMsVUFBVSxDQUFDLHFCQUFxQixLQUFLLFdBQVcsQ0FBQyxNQUFNLElBQUksVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssV0FBVyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNoSSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsbUdBQW1HO0FBQ25HLE1BQU0sQ0FBQyxNQUFNLDBDQUEwQyxHQUFHLEtBQUssRUFDN0QsUUFBaUIsRUFBRSxvQkFBNkIsRUFBRSxrQkFBMkIsRUFDMUQsRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRywwQ0FBMEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNyRSxNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsb0JBQW9CLENBQUMsQ0FBQztRQUNsRCxNQUFNLFFBQVEsR0FBRyxrQkFBa0IsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsMENBQTBDLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNySCxNQUFNLHNCQUFzQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3RDLE1BQU0sWUFBWSxDQUFDLE9BQU8sRUFBRSxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDL0MsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxDQUFDLDBDQUEwQyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQUMsQ0FBQztBQUN4RSxDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLDBDQUEwQyxHQUFHLEtBQUssRUFDN0QsUUFBaUIsRUFBRSxrQkFBMkIsRUFBRSxvQkFBNkIsRUFDdkIsRUFBRTtJQUN4RCxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRywwQ0FBMEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNyRSxNQUFNLFFBQVEsR0FBRyxpREFBaUQsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3ZGLE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ2xELE1BQU0sc0JBQXNCLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEMsS0FBSyxNQUFNLFFBQVEsSUFBSSxRQUFRO1lBQUUsTUFBTSxZQUFZLENBQUMsUUFBUSxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsUUFBUSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNySCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssTUFBTSxxQkFBcUIsQ0FBQyxPQUFPLENBQUM7ZUFDdEQsT0FBTyxDQUFDLE1BQU0sSUFBSSxPQUFPLENBQUMsUUFBUTtlQUNsQyxTQUFTLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxLQUFLLFNBQVMsQ0FBQywrQkFBK0IsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztlQUMzRixTQUFTLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQywrQkFBK0IsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzdHLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUNqRCxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDaEQsSUFBSSxRQUFRO1lBQUUsT0FBTyxTQUFTLENBQUMsUUFBUSxDQUFDLEtBQUssU0FBUyxDQUFDLE9BQU8sQ0FBQztnQkFDN0QsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDdkYsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxjQUFjLEVBQUUsQ0FBQztRQUNsRyxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLHFCQUFxQixLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNO2VBQzlFLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLHNCQUFzQixFQUFFLENBQUM7UUFDckgsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLENBQUM7SUFDdkMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDN0QsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdURBQXVELEdBQUcsQ0FDckUsUUFBaUIsRUFDaUMsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDL0QsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLE9BQU8sRUFBRSxPQUFPLEVBQUUsK0JBQStCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLE9BQU8sRUFBRSwwQ0FBMEMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztBQUN6SSxDQUFDLENBQUMsQ0FBQztBQUNILE1BQU0sQ0FBQyxNQUFNLHdEQUF3RCxHQUFHLENBQ3RFLFFBQWlCLEVBQ2tDLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ2hFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUNyRSxZQUFZLENBQUMsS0FBSyxDQUFDLFlBQVksS0FBSyxpQkFBaUIsSUFBSSxLQUFLLENBQUMsWUFBWSxLQUFLLHFCQUFxQixDQUFDLENBQUM7SUFDdkcsT0FBTyxFQUFFLE9BQU8sRUFBRSwwQ0FBMEMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsWUFBWSxFQUFFLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQztBQUNsSCxDQUFDLENBQUMsQ0FBQztBQUVIOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbURBQW1ELEdBQUcsS0FBSyxFQUN0RSxRQUFpQixFQUFFLG9CQUE2QixFQUFFLGtCQUEyQixFQUM3RSxpQkFBMEIsRUFBRSxrQkFBMkIsRUFDa0UsRUFBRTtJQUMzSCxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyx1REFBdUQsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNsRixNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsb0JBQW9CLENBQUMsQ0FBQztRQUNsRCxNQUFNLFFBQVEsR0FBRyxrQkFBa0IsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsMENBQTBDLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNySCxZQUFZLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3hELE1BQU0sT0FBTyxHQUFHLDRCQUE0QixDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsRUFDN0YsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsaUJBQWlCLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztRQUM1RSxNQUFNLHNCQUFzQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3RDLE1BQU0sWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3ZELE9BQU8sRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQztJQUN6RCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sQ0FBQyxNQUFNLG9EQUFvRCxHQUFHLENBQ2xFLFFBQWlCLEVBQUUsVUFBbUIsRUFDYSxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNoRSxNQUFNLFFBQVEsR0FBRyx3REFBd0QsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNwRixNQUFNLE9BQU8sR0FBRyx1REFBdUQsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNwRixZQUFZLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsS0FBSyxTQUFTLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQztXQUNsRSxRQUFRLENBQUMsWUFBWSxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyxPQUFPLENBQUMsT0FBTyxDQUFDLGlCQUFpQjtZQUNuRyxDQUFDLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLENBQUMsQ0FBQztJQUNsRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMsQ0FBQyJ9

package/dist_ts/data/servicecredential.d.ts

@@ -0,0 +1,57 @@
+/** Workload permissions are independent of human membership and deployment grants. */
+export type TServiceMachineCapabilityV1 = 'platform:session';
+/** Exact existing-service authority. Never infer this grant from an API role. */
+export interface IServiceMachineGrantV1 {
+    organizationId: string;
+    serviceId: string;
+    capabilities: TServiceMachineCapabilityV1[];
+}
+/** Public metadata only. The bearer is delivered through the owning service's SecretSet. */
+export interface IServiceMachineCredentialMetadataV1 {
+    schemaVersion: 1;
+    credentialId: string;
+    userId: string;
+    grant: IServiceMachineGrantV1;
+    generation: number;
+    state: 'active' | 'revoked';
+    expiresAt: number;
+    createdAt: number;
+    updatedAt: number;
+    /** Exact immutable encrypted delivery version; null after revocation. */
+    delivery: {
+        secretId: string;
+        secretVersionId: string;
+    } | null;
+}
+interface IServiceMachineCredentialMutationBaseV1 {
+    schemaVersion: 1;
+    organizationId: string;
+    serviceId: string;
+    /** Retain the complete request and this ID across retries. */
+    mutationId: string;
+}
+/** Creation is absent-only; rotation and revocation require the exact current generation. */
+export type TServiceMachineCredentialMutationV1 = IServiceMachineCredentialMutationBaseV1 & ({
+    operation: 'ensure';
+    expectedGeneration: null;
+    capabilities: TServiceMachineCapabilityV1[];
+    expiresAt: number;
+} | {
+    operation: 'rotate';
+    expectedGeneration: number;
+    capabilities: TServiceMachineCapabilityV1[];
+    expiresAt: number;
+} | {
+    operation: 'revoke';
+    expectedGeneration: number;
+});
+export interface IServiceMachineCredentialMutationResultV1 {
+    /** Historical on replay; replay never restores revoked or superseded authority. */
+    credential: IServiceMachineCredentialMetadataV1;
+    replayed: boolean;
+}
+/** Structural copy only; the backend must fence live service ownership and credential authority. */
+export declare const snapshotServiceMachineGrantV1: (value: unknown) => IServiceMachineGrantV1;
+export declare const snapshotServiceMachineCredentialMutationV1: (value: unknown) => TServiceMachineCredentialMutationV1;
+export declare const snapshotServiceMachineCredentialMetadataV1: (value: unknown) => IServiceMachineCredentialMetadataV1;
+export {};

package/dist_ts/data/servicecredential.js

@@ -0,0 +1,81 @@
+const fail = () => { throw new Error('Service credential contract rejected.'); };
+function requireValue(value) { if (!value)
+    fail(); }
+const object = (value, keys) => {
+    requireValue(value !== null && typeof value === 'object' && !Array.isArray(value));
+    requireValue(Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+    const actual = Reflect.ownKeys(value);
+    requireValue(actual.length === keys.length && keys.every((key) => actual.includes(key)));
+    const copy = Object.create(null);
+    for (const key of keys) {
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        requireValue(descriptor && Object.hasOwn(descriptor, 'value') && descriptor.enumerable);
+        copy[key] = descriptor.value;
+    }
+    return copy;
+};
+const identifier = (value) => {
+    requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+    return value;
+};
+const counter = (value) => {
+    requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0 && value < Number.MAX_SAFE_INTEGER);
+    return value;
+};
+const capabilities = (value) => {
+    requireValue(Array.isArray(value) && Object.getPrototypeOf(value) === Array.prototype);
+    const keys = Reflect.ownKeys(value);
+    requireValue(keys.length === 2 && keys.includes('length') && keys.includes('0'));
+    const entry = Object.getOwnPropertyDescriptor(value, '0');
+    requireValue(entry && Object.hasOwn(entry, 'value') && entry.enumerable && entry.value === 'platform:session');
+    return ['platform:session'];
+};
+const safe = (operation) => { try {
+    return operation();
+}
+catch {
+    return fail();
+} };
+/** Structural copy only; the backend must fence live service ownership and credential authority. */
+export const snapshotServiceMachineGrantV1 = (value) => safe(() => {
+    const grant = object(value, ['organizationId', 'serviceId', 'capabilities']);
+    return { organizationId: identifier(grant.organizationId), serviceId: identifier(grant.serviceId),
+        capabilities: capabilities(grant.capabilities) };
+});
+export const snapshotServiceMachineCredentialMutationV1 = (value) => safe(() => {
+    requireValue(value !== null && typeof value === 'object');
+    const operation = Object.getOwnPropertyDescriptor(value, 'operation')?.value;
+    requireValue(operation === 'ensure' || operation === 'rotate' || operation === 'revoke');
+    const request = object(value, ['schemaVersion', 'organizationId', 'serviceId', 'mutationId', 'operation',
+        'expectedGeneration', ...(operation === 'revoke' ? [] : ['capabilities', 'expiresAt'])]);
+    requireValue(request.schemaVersion === 1);
+    const base = { schemaVersion: 1, organizationId: identifier(request.organizationId),
+        serviceId: identifier(request.serviceId), mutationId: identifier(request.mutationId) };
+    if (operation === 'revoke')
+        return { ...base, operation, expectedGeneration: counter(request.expectedGeneration) };
+    const material = { capabilities: capabilities(request.capabilities), expiresAt: counter(request.expiresAt) };
+    if (operation === 'ensure') {
+        requireValue(request.expectedGeneration === null);
+        return { ...base, ...material, operation, expectedGeneration: null };
+    }
+    return { ...base, ...material, operation, expectedGeneration: counter(request.expectedGeneration) };
+});
+export const snapshotServiceMachineCredentialMetadataV1 = (value) => safe(() => {
+    const metadata = object(value, ['schemaVersion', 'credentialId', 'userId', 'grant', 'generation', 'state',
+        'expiresAt', 'createdAt', 'updatedAt', 'delivery']);
+    requireValue(metadata.schemaVersion === 1 && (metadata.state === 'active' || metadata.state === 'revoked'));
+    const createdAt = counter(metadata.createdAt);
+    const updatedAt = counter(metadata.updatedAt);
+    requireValue(updatedAt >= createdAt);
+    let delivery = null;
+    if (metadata.state === 'active') {
+        const version = object(metadata.delivery, ['secretId', 'secretVersionId']);
+        delivery = { secretId: identifier(version.secretId), secretVersionId: identifier(version.secretVersionId) };
+    }
+    else
+        requireValue(metadata.delivery === null);
+    return { schemaVersion: 1, credentialId: identifier(metadata.credentialId), userId: identifier(metadata.userId),
+        grant: snapshotServiceMachineGrantV1(metadata.grant), generation: counter(metadata.generation),
+        state: metadata.state, expiresAt: counter(metadata.expiresAt), createdAt, updatedAt, delivery };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZWNyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXdEQSxNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDeEYsU0FBUyxZQUFZLENBQUMsS0FBYyxJQUFtQixJQUFJLENBQUMsS0FBSztJQUFFLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztBQUM1RSxNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBRSxJQUFjLEVBQTJCLEVBQUU7SUFDekUsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ25GLFlBQVksQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUN6RyxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3RDLFlBQVksQ0FBQyxNQUFNLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDekYsTUFBTSxJQUFJLEdBQTRCLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDMUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUN2QixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQy9ELFlBQVksQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLElBQUksVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3hGLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDO0lBQy9CLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQztBQUNGLE1BQU0sVUFBVSxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDNUMsWUFBWSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUM3RixPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQztBQUNGLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDekMsWUFBWSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssR0FBRyxDQUFDLElBQUksS0FBSyxHQUFHLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3ZILE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxZQUFZLEdBQUcsQ0FBQyxLQUFjLEVBQWlDLEVBQUU7SUFDckUsWUFBWSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDdkYsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNwQyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDakYsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsQ0FBQztJQUMxRCxZQUFZLENBQUMsS0FBSyxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxJQUFJLEtBQUssQ0FBQyxVQUFVLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyxrQkFBa0IsQ0FBQyxDQUFDO0lBQy9HLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0FBQzlCLENBQUMsQ0FBQztBQUNGLE1BQU0sSUFBSSxHQUFHLENBQUksU0FBa0IsRUFBSyxFQUFFLEdBQUcsSUFBSSxDQUFDO0lBQUMsT0FBTyxTQUFTLEVBQUUsQ0FBQztBQUFDLENBQUM7QUFBQyxNQUFNLENBQUM7SUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0FBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVwRyxvR0FBb0c7QUFDcEcsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ2pHLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUM3RSxPQUFPLEVBQUUsY0FBYyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQy9GLFlBQVksRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7QUFDckQsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUFDLEtBQWMsRUFBdUMsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDM0gsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDMUQsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsRUFBRSxLQUFLLENBQUM7SUFDN0UsWUFBWSxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksU0FBUyxLQUFLLFFBQVEsSUFBSSxTQUFTLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDekYsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLGVBQWUsRUFBRSxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLFdBQVc7UUFDdEcsb0JBQW9CLEVBQUUsR0FBRyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxjQUFjLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0YsWUFBWSxDQUFDLE9BQU8sQ0FBQyxhQUFhLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUMsTUFBTSxJQUFJLEdBQUcsRUFBRSxhQUFhLEVBQUUsQ0FBVSxFQUFFLGNBQWMsRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQztRQUMxRixTQUFTLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO0lBQ3pGLElBQUksU0FBUyxLQUFLLFFBQVE7UUFBRSxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsU0FBUyxFQUFFLGtCQUFrQixFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUMsRUFBRSxDQUFDO0lBQ25ILE1BQU0sUUFBUSxHQUFHLEVBQUUsWUFBWSxFQUFFLFlBQVksQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM3RyxJQUFJLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMzQixZQUFZLENBQUMsT0FBTyxDQUFDLGtCQUFrQixLQUFLLElBQUksQ0FBQyxDQUFDO1FBQ2xELE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxHQUFHLFFBQVEsRUFBRSxTQUFTLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDdkUsQ0FBQztJQUNELE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxHQUFHLFFBQVEsRUFBRSxTQUFTLEVBQUUsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLENBQUM7QUFDdEcsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUFDLEtBQWMsRUFBdUMsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDM0gsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLGVBQWUsRUFBRSxjQUFjLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTztRQUN2RyxXQUFXLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3RELFlBQVksQ0FBQyxRQUFRLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQztJQUM1RyxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzlDLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUMsWUFBWSxDQUFDLFNBQVMsSUFBSSxTQUFTLENBQUMsQ0FBQztJQUNyQyxJQUFJLFFBQVEsR0FBb0QsSUFBSSxDQUFDO0lBQ3JFLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNoQyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxDQUFDLFVBQVUsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7UUFDM0UsUUFBUSxHQUFHLEVBQUUsUUFBUSxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsZUFBZSxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztJQUM5RyxDQUFDOztRQUFNLFlBQVksQ0FBQyxRQUFRLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQ2hELE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLFlBQVksRUFBRSxVQUFVLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUM3RyxLQUFLLEVBQUUsNkJBQTZCLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztRQUM5RixLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQ3BHLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/admin.d.ts

@@ -1,5 +1,30 @@
 import * as plugins from '../plugins.js';
 import type { IIdentity, IIdentityCredential, IServiceDeploymentGrant } from '../data/user.js';
+import type { IServiceMachineCredentialMetadataV1, IServiceMachineCredentialMutationResultV1, TServiceMachineCredentialMutationV1 } from '../data/servicecredential.js';
+export interface IReq_Admin_GetServiceMachineCredentialV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_GetServiceMachineCredentialV1> {
+    method: 'getServiceMachineCredentialV1';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        credential: IServiceMachineCredentialMetadataV1 | null;
+    };
+}
+/**
+ * The backend authorizes the exact service and mutates hashed credential authority,
+ * encrypted SecretSet delivery and the replay receipt in one fenced transaction.
+ * No bearer is returned. Existing legacy deployment/cluster credentials are separate.
+ */
+export interface IReq_Admin_MutateServiceMachineCredentialV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_MutateServiceMachineCredentialV1> {
+    method: 'mutateServiceMachineCredentialV1';
+    request: {
+        identity: IIdentityCredential;
+        mutation: TServiceMachineCredentialMutationV1;
+    };
+    response: IServiceMachineCredentialMutationResultV1;
+}
 /** Backend-owned human credential metadata; never includes a password verifier. */
 export interface IHumanCredentialMetadata {
     userId: string;

package/dist_ts/requests/runtimesession.d.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../plugins.js';
 import type * as data from '../data/runtimesession.js';
+import type * as terminal from '../data/runtimeterminalreceipt.js';
 /** WSS-only Pallet bootstrap. Derive physical peer/process/idempotency server-side. */
 export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1> {
     method: 'registerPalletRuntimeSessionV1';
@@ -18,6 +19,12 @@ export interface IReq_Pallet_Controller_ReportRuntimeAssignmentObservationV1 ext
     request: data.IReportRuntimeAssignmentObservationRequestV1;
     response: data.IReportRuntimeAssignmentObservationResponseV1;
 }
+/** Exact joined terminal-operation receipt; observations and boot changes cannot substitute. */
+export interface IReq_Pallet_Controller_ReportRuntimeAssignmentTerminalReceiptV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportRuntimeAssignmentTerminalReceiptV1> {
+    method: 'reportRuntimeAssignmentTerminalReceiptV1';
+    request: terminal.IReportRuntimeAssignmentTerminalReceiptRequestV1;
+    response: terminal.IReportRuntimeAssignmentTerminalReceiptResponseV1;
+}
 /** Current-peer, exact current assignment authorization; response is secret material. */
 export interface IReq_Pallet_Controller_GetRuntimeRegistryCredentialV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeRegistryCredentialV1> {
     method: 'getRuntimeRegistryCredentialV1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "30.0.0",
+  "version": "30.2.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -174,6 +174,24 @@ bounded time/concurrency, root-only directory/socket permissions and drained
 cleanup. The package supplies no listener, permission checks or persistent state.
 No bearer, generic rotation operation or database access is part of this IPC API.
 
+### Service Machine Credentials
+
+`requests.admin.getServiceMachineCredentialV1` inspects redacted metadata;
+`mutateServiceMachineCredentialV1` creates, rotates or revokes authority for one
+exact existing service and organization. `ensure` requires absent authority and
+a null expected generation. Rotation and revocation require the exact current
+generation. Retain the mutation ID and complete input for retry; a receipt replay
+returns historical metadata without restoring authority.
+
+`IServiceMachineGrantV1` currently grants only `platform:session`. This is separate
+from deployment grants, human membership and infrastructure permissions. The
+backend must authenticate each JWT against the current active credential
+generation, expiry and exact service ownership. Structural snapshot helpers do
+not perform these checks. Credential changes, encrypted service SecretSet
+delivery and the replay receipt must commit in the same authorized transaction.
+The response contains only the immutable secret/version reference; no bearer or
+hash is returned. Revocation removes current delivery from the metadata.
+
 ### Node-Bound Runtime Assignments
 
 The `data` namespace exports `IRuntimeAssignmentV1`, canonical digest helpers,
@@ -251,6 +269,41 @@ machine JWT on a physical TypedSocket so the server can own its identity tag.
 Both registration methods reject HTTP transport. Sensitive requests and registry
 responses must be excluded from hooks, logs, diagnostics and durable journals.
 
+### Joined Runtime Terminal Receipts
+
+`data.IRuntimeAssignmentTerminalReceiptV1` and
+`requests.runtimesession.reportRuntimeAssignmentTerminalReceiptV1` carry a separate
+receipt for the exact Pallet attempt's joined terminal execution. Sequence 1 binds
+the generation 2 stop assignment; sequence 2 binds generation 3 removal and the
+exact stop receipt digest. Both retain the original generation 1 run reference.
+The full immutable assignment chain and both receipt bodies remain durable after
+removal, permitting an exact earlier stop receipt to be acknowledged again.
+
+Only a durably completed native operation can issue a terminal receipt. Native
+stop joins container and sandbox stop; native remove requires an already stopped
+sandbox and joins container and sandbox removal. The assignment owner separately
+requires the exact completed stop before admitting removal. Terminal evidence
+contains precise CRI identifiers, the kernel boot UUID, and stopped/absent state;
+this native path does not collect IP addresses. Pending, unknown and host-fenced
+journal entries never qualify. A proven boot change can permit a new joined
+terminal operation but cannot skip the stop/remove chain.
+
+The synchronous snapshot helpers validate bounded exact data only. Digest,
+assignment-chain and receipt-chain helpers do not prove native execution or
+authenticate a reporter. `bindRuntimeReporterSessionV1` and the terminal report
+binder require the current physical session and immutable server-indexed reporter
+history from their trusted owners. Reconnect recovery preserves every original
+receipt field and returns `historical-recovery`; it never restores active
+readiness, routes or liveness. The response binder rejects rewritten receipt bodies.
+
+Cloudly must transact new acceptance against the exact global incumbent, stored
+assignment chain and current peer, credential and node authority. A first receipt
+after the incumbent changes is denied; only an already persisted exact receipt
+can be acknowledged again under current authentication. These receipts settle
+only the named Pallet attempt. They do not authorize storage relocation, prove
+whole-host or Docker/Coreflow absence, grant another controller or organization
+authority, or replace independently qualified readiness and routing evidence.
+
 ### Offline SmartDB Settlement And Packaging
 
 The Node-only `@serve.zone/interfaces/runtime` export includes isolated V1

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '30.0.0',
+  version: '30.2.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -26,6 +26,7 @@ export * from './registry.js';
 export * from './runtimeassignment.js';
 export * from './runtimeconfig.js';
 export * from './runtimesession.js';
+export * from './runtimeterminalreceipt.js';
 export * from './secret.js';
 export * from './baremetal.js';
 export * from './baseos.js';
@@ -33,6 +34,7 @@ export * from './backup.js';
 export * from './clusternode.js';
 export * from './settings.js';
 export * from './service.js';
+export * from './servicecredential.js';
 export * from './serviceports.js';
 export * from './status.js';
 export * from './taskexecution.js';