@serve.zone/pallet-bundle 35.3.0

package/dist_ts_bundle/inventory.js

@@ -0,0 +1,78 @@
+import * as plugins from './plugins.js';
+/**
+ * What a Pallet control bundle is made of, stated once.
+ *
+ * Pallet's own build (`scripts/build-control.mjs`) writes its control record with these paths and
+ * keys, and its packaging (`scripts/control-package.mjs`) runs this package's verifier over every
+ * build before sealing it, so a bundle that disagrees with this description is never released. The
+ * files of each component (clock, DNS, VPN, containerd, notices and sources) are not listed here:
+ * the bundle states them itself in its control record and in the manifests of those components,
+ * and the verifier checks every file against them.
+ */
+/** The tspack bundle name, the package that builds it and the Gitea repository that releases it. */
+export const palletControlBundleName = 'pallet-control';
+export const palletControlPackageName = '@serve.zone/pallet';
+export const palletControlRepository = 'serve.zone/pallet';
+/** The platforms a release carries, as tspack bundle ids. */
+export const palletControlTargets = ['linux-amd64', 'linux-arm64'];
+export const isPalletControlTarget = (valueArg) => palletControlTargets.some((target) => target === valueArg);
+/** The tsrust target every native executable of a bundle was built for. */
+export const palletNativeTarget = (targetArg) => `${targetArg.replace('-', '_')}_musl`;
+/** The fixed host paths a control build compiles in; its control record repeats them. */
+export const palletControlPaths = Object.freeze({
+    /** The node's store, created only by explicit provisioning. */
+    dataRoot: '/var/lib/serve.zone/pallet',
+    /** The Cloudly enrollment control socket (`enrollment-serve`, `enrollment-provision`). */
+    socketPath: plugins.interfaces.data.palletNodeEnrollmentContract.socketPath,
+    /** The local controller socket a node bound to a controller on its own host serves. */
+    localControllerSocketPath: plugins.interfaces.data.nodeRuntimeLocalControllerContract.socketPath,
+    /** The CRI socket of Pallet's own containerd, never the host's shared one. */
+    runtimeSocketPath: '/run/pallet/containerd/containerd.sock',
+    /** The uid every Pallet process and every installed file belongs to. */
+    expectedUid: 0,
+});
+/** Every key of a bundle's `control-build.json`, and nothing else. */
+export const palletControlRecordKeys = Object.freeze([
+    'packageName', 'version', 'sourceCommit', 'sourceDirty', 'target', 'compiler', 'lockSha256', 'dataRoot',
+    'socketPath', 'runtimeSocketPath', 'expectedUid', 'clockManifestSha256', 'dnsManifestSha256',
+    'vpnInventorySha256', 'containerdManifestSha256', 'files',
+]);
+export const palletControlRecordName = 'control-build.json';
+/** The executables `pallet-control` starts by name, each verified against the digest it compiles in. */
+export const palletControlRoles = Object.freeze({
+    control: { path: 'pallet-control' },
+    store: { path: 'pallet-smartdb', provenance: { path: 'pallet-smartdb.tsrust-build.json',
+            projectName: '@lossless.org/nosqldb', binary: 'rustdb' } },
+    runtime: { path: 'pallet-runtime', provenance: { path: 'pallet-runtime.tsrust-build.json',
+            projectName: palletControlPackageName, binary: 'pallet' } },
+    guard: { path: 'pallet-guard', provenance: { path: 'pallet-guard.tsrust-build.json',
+            projectName: '@push.rocks/smartnftables', binary: 'smartnftables' } },
+    dns: { path: 'pallet-dns', provenance: { path: 'pallet-dns.tsrust-build.json',
+            projectName: '@push.rocks/smartdns', binary: 'rustdns' } },
+    vpn: { path: 'pallet-vpn', provenance: { path: 'pallet-vpn.tsrust-build.json',
+            projectName: '@push.rocks/smartvpn', binary: 'smartvpn_daemon' } },
+});
+/**
+ * The components whose files a manifest inside the bundle lists, and the control record key that
+ * pins that manifest's digest. `listing` components state every file below `directory` by path,
+ * size, SHA-256 and mode; the others are pinned by digest only and their files are declared in the
+ * control record.
+ */
+export const palletControlComponents = Object.freeze({
+    clock: { manifest: 'pallet-clock/manifest.json', recordKey: 'clockManifestSha256', directory: 'pallet-clock/' },
+    containerd: { manifest: 'pallet-containerd/manifest.json', recordKey: 'containerdManifestSha256',
+        directory: 'pallet-containerd/' },
+    dns: { manifest: 'notices/coredns/manifest.json', recordKey: 'dnsManifestSha256', directory: null },
+    vpn: { manifest: 'notices/smartvpn/notices/inventory.json', recordKey: 'vpnInventorySha256', directory: null },
+});
+/** Notice trees in the `tsrust.native-notices` format: a manifest naming every file below it. */
+export const palletControlNoticeTrees = Object.freeze(['native-notices/', 'notices/smartnftables/']);
+/**
+ * Notice and corresponding-source inventories: a manifest whose `files` list every file below both
+ * prefixes by path, size and SHA-256.
+ */
+export const palletControlSourceInventories = Object.freeze([
+    { manifest: 'notices/clock/manifest.json', prefixes: ['notices/clock/', 'sources/clock/'] },
+    { manifest: 'notices/containerd/manifest.json', prefixes: ['notices/containerd/', 'sources/containerd/'] },
+]);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW52ZW50b3J5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfYnVuZGxlL2ludmVudG9yeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4Qzs7Ozs7Ozs7O0dBU0c7QUFFSCxvR0FBb0c7QUFDcEcsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsZ0JBQWdCLENBQUM7QUFDeEQsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsb0JBQW9CLENBQUM7QUFDN0QsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsbUJBQW1CLENBQUM7QUFFM0QsNkRBQTZEO0FBQzdELE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsYUFBYSxFQUFFLGFBQWEsQ0FBVSxDQUFDO0FBRzVFLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLENBQUMsUUFBaUIsRUFBb0MsRUFBRSxDQUMzRixvQkFBb0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQztBQUU3RCwyRUFBMkU7QUFDM0UsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxTQUErQixFQUFVLEVBQUUsQ0FBQyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxPQUFPLENBQUM7QUFFckgseUZBQXlGO0FBQ3pGLE1BQU0sQ0FBQyxNQUFNLGtCQUFrQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDOUMsK0RBQStEO0lBQy9ELFFBQVEsRUFBRSw0QkFBNEI7SUFDdEMsMEZBQTBGO0lBQzFGLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxVQUFVO0lBQzNFLHVGQUF1RjtJQUN2Rix5QkFBeUIsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxrQ0FBa0MsQ0FBQyxVQUFVO0lBQ2hHLDhFQUE4RTtJQUM5RSxpQkFBaUIsRUFBRSx3Q0FBd0M7SUFDM0Qsd0VBQXdFO0lBQ3hFLFdBQVcsRUFBRSxDQUFDO0NBQ2YsQ0FBQyxDQUFDO0FBRUgsc0VBQXNFO0FBQ3RFLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbkQsYUFBYSxFQUFFLFNBQVMsRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLFVBQVU7SUFDdkcsWUFBWSxFQUFFLG1CQUFtQixFQUFFLGFBQWEsRUFBRSxxQkFBcUIsRUFBRSxtQkFBbUI7SUFDNUYsb0JBQW9CLEVBQUUsMEJBQTBCLEVBQUUsT0FBTztDQUNqRCxDQUFDLENBQUM7QUFFWixNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxvQkFBb0IsQ0FBQztBQWU1RCx3R0FBd0c7QUFDeEcsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQXdFLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbkgsT0FBTyxFQUFFLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFO0lBQ25DLEtBQUssRUFBRSxFQUFFLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsa0NBQWtDO1lBQ3JGLFdBQVcsRUFBRSx1QkFBdUIsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLEVBQUU7SUFDNUQsT0FBTyxFQUFFLEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxrQ0FBa0M7WUFDdkYsV0FBVyxFQUFFLHdCQUF3QixFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsRUFBRTtJQUM3RCxLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsY0FBYyxFQUFFLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxnQ0FBZ0M7WUFDakYsV0FBVyxFQUFFLDJCQUEyQixFQUFFLE1BQU0sRUFBRSxlQUFlLEVBQUUsRUFBRTtJQUN2RSxHQUFHLEVBQUUsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSw4QkFBOEI7WUFDM0UsV0FBVyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsRUFBRTtJQUM1RCxHQUFHLEVBQUUsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSw4QkFBOEI7WUFDM0UsV0FBVyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sRUFBRSxpQkFBaUIsRUFBRSxFQUFFO0NBQ3JFLENBQUMsQ0FBQztBQUVIOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNuRCxLQUFLLEVBQUUsRUFBRSxRQUFRLEVBQUUsNEJBQTRCLEVBQUUsU0FBUyxFQUFFLHFCQUFxQixFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUU7SUFDL0csVUFBVSxFQUFFLEVBQUUsUUFBUSxFQUFFLGlDQUFpQyxFQUFFLFNBQVMsRUFBRSwwQkFBMEI7UUFDOUYsU0FBUyxFQUFFLG9CQUFvQixFQUFFO0lBQ25DLEdBQUcsRUFBRSxFQUFFLFFBQVEsRUFBRSwrQkFBK0IsRUFBRSxTQUFTLEVBQUUsbUJBQW1CLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRTtJQUNuRyxHQUFHLEVBQUUsRUFBRSxRQUFRLEVBQUUseUNBQXlDLEVBQUUsU0FBUyxFQUFFLG9CQUFvQixFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUU7Q0FDdEcsQ0FBQyxDQUFDO0FBRVosaUdBQWlHO0FBQ2pHLE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxpQkFBaUIsRUFBRSx3QkFBd0IsQ0FBVSxDQUFDLENBQUM7QUFFOUc7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUMxRCxFQUFFLFFBQVEsRUFBRSw2QkFBNkIsRUFBRSxRQUFRLEVBQUUsQ0FBQyxnQkFBZ0IsRUFBRSxnQkFBZ0IsQ0FBQyxFQUFFO0lBQzNGLEVBQUUsUUFBUSxFQUFFLGtDQUFrQyxFQUFFLFFBQVEsRUFBRSxDQUFDLHFCQUFxQixFQUFFLHFCQUFxQixDQUFDLEVBQUU7Q0FDbEcsQ0FBQyxDQUFDIn0=

package/dist_ts_bundle/paths.d.ts

@@ -0,0 +1,12 @@
+/** An absolute, normalized path without a trailing slash; `/` itself is refused. */
+export declare function canonicalPath(valueArg: unknown): string;
+/** No symlink ancestor, foreign owner or group/other writer can replace the protected leaf. */
+export declare function checkAncestors(pathArg: string, uidArg: number): Promise<void>;
+/**
+ * Proves the executable at a protected path carries the digest trusted metadata states. The file is
+ * read through one descriptor opened without following links, and its identity must not change
+ * while it is read.
+ */
+export declare function verifyExecutable(pathArg: string, digestArg: string, uidArg: number, signalArg?: AbortSignal): Promise<void>;
+/** A directory that is canonical (its real path is itself) and a directory. */
+export declare function requireCanonicalDirectory(pathArg: string): Promise<void>;

package/dist_ts_bundle/paths.js

@@ -0,0 +1,76 @@
+import * as plugins from './plugins.js';
+import { PalletBundleError } from './errors.js';
+/** An absolute, normalized path without a trailing slash; `/` itself is refused. */
+export function canonicalPath(valueArg) {
+    if (typeof valueArg !== 'string' || valueArg.length > 4096 || valueArg.includes('\0') ||
+        !plugins.path.isAbsolute(valueArg) || valueArg === '/' || plugins.path.normalize(valueArg) !== valueArg ||
+        valueArg.endsWith('/')) {
+        throw new PalletBundleError('invalid_options');
+    }
+    return valueArg;
+}
+const unsafe = () => { throw new PalletBundleError('unsafe_path'); };
+/** No symlink ancestor, foreign owner or group/other writer can replace the protected leaf. */
+export async function checkAncestors(pathArg, uidArg) {
+    let current = plugins.path.dirname(pathArg);
+    for (;;) {
+        const info = await plugins.fs.lstat(current);
+        const rootSticky = info.uid === 0 && (info.mode & 0o1000) !== 0;
+        if (!info.isDirectory() || info.isSymbolicLink() || (info.uid !== uidArg && info.uid !== 0) ||
+            ((info.mode & 0o022) !== 0 && !rootSticky))
+            unsafe();
+        if (current === '/')
+            return;
+        current = plugins.path.dirname(current);
+    }
+}
+const checkExecutable = (infoArg, uidArg) => {
+    if (!infoArg.isFile() || infoArg.isSymbolicLink() || infoArg.uid !== uidArg || infoArg.nlink !== 1 ||
+        (infoArg.mode & 0o6022) !== 0 || (infoArg.mode & 0o100) === 0)
+        unsafe();
+};
+/**
+ * Proves the executable at a protected path carries the digest trusted metadata states. The file is
+ * read through one descriptor opened without following links, and its identity must not change
+ * while it is read.
+ */
+export async function verifyExecutable(pathArg, digestArg, uidArg, signalArg) {
+    signalArg?.throwIfAborted();
+    await checkAncestors(pathArg, uidArg);
+    checkExecutable(await plugins.fs.lstat(pathArg), uidArg);
+    const file = await plugins.fs.open(pathArg, plugins.fsConstants.O_RDONLY | plugins.fsConstants.O_NOFOLLOW);
+    try {
+        const before = await file.stat();
+        checkExecutable(before, uidArg);
+        if (before.size < 1 || before.size > 1024 ** 3)
+            unsafe();
+        const hash = plugins.crypto.createHash('sha256');
+        const buffer = Buffer.alloc(1024 * 1024);
+        let position = 0;
+        while (position < before.size) {
+            signalArg?.throwIfAborted();
+            const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, before.size - position), position);
+            if (bytesRead === 0)
+                unsafe();
+            hash.update(buffer.subarray(0, bytesRead));
+            position += bytesRead;
+        }
+        const after = await file.stat();
+        if (after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs ||
+            after.ino !== before.ino || after.dev !== before.dev)
+            unsafe();
+        if (hash.digest('hex') !== digestArg)
+            throw new PalletBundleError('artifact_mismatch');
+    }
+    finally {
+        await file.close();
+    }
+}
+/** A directory that is canonical (its real path is itself) and a directory. */
+export async function requireCanonicalDirectory(pathArg) {
+    canonicalPath(pathArg);
+    const info = await plugins.fs.lstat(pathArg).catch(() => unsafe());
+    if (!info.isDirectory() || await plugins.fs.realpath(pathArg) !== pathArg)
+        unsafe();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGF0aHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19idW5kbGUvcGF0aHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBRWhELG9GQUFvRjtBQUNwRixNQUFNLFVBQVUsYUFBYSxDQUFDLFFBQWlCO0lBQzdDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsSUFBSSxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO1FBQ25GLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxLQUFLLEdBQUcsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsS0FBSyxRQUFRO1FBQ3ZHLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN6QixNQUFNLElBQUksaUJBQWlCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQztBQUVELE1BQU0sTUFBTSxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUU1RSwrRkFBK0Y7QUFDL0YsTUFBTSxDQUFDLEtBQUssVUFBVSxjQUFjLENBQUMsT0FBZSxFQUFFLE1BQWM7SUFDbEUsSUFBSSxPQUFPLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDNUMsU0FBUyxDQUFDO1FBQ1IsTUFBTSxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM3QyxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2hFLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLElBQUksSUFBSSxDQUFDLGNBQWMsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDLENBQUM7WUFDekYsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO1lBQUUsTUFBTSxFQUFFLENBQUM7UUFDdkQsSUFBSSxPQUFPLEtBQUssR0FBRztZQUFFLE9BQU87UUFDNUIsT0FBTyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQzFDLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxlQUFlLEdBQUcsQ0FBQyxPQUFtRyxFQUMxSCxNQUFjLEVBQVEsRUFBRTtJQUN4QixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxJQUFJLE9BQU8sQ0FBQyxjQUFjLEVBQUUsSUFBSSxPQUFPLENBQUMsR0FBRyxLQUFLLE1BQU0sSUFBSSxPQUFPLENBQUMsS0FBSyxLQUFLLENBQUM7UUFDaEcsQ0FBQyxPQUFPLENBQUMsSUFBSSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQztRQUFFLE1BQU0sRUFBRSxDQUFDO0FBQzVFLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLGdCQUFnQixDQUFDLE9BQWUsRUFBRSxTQUFpQixFQUFFLE1BQWMsRUFDdkYsU0FBdUI7SUFDdkIsU0FBUyxFQUFFLGNBQWMsRUFBRSxDQUFDO0lBQzVCLE1BQU0sY0FBYyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0QyxlQUFlLENBQUMsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN6RCxNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzNHLElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2pDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDaEMsSUFBSSxNQUFNLENBQUMsSUFBSSxHQUFHLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxHQUFHLElBQUksSUFBSSxDQUFDO1lBQUUsTUFBTSxFQUFFLENBQUM7UUFDekQsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDakQsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDLENBQUM7UUFDekMsSUFBSSxRQUFRLEdBQUcsQ0FBQyxDQUFDO1FBQ2pCLE9BQU8sUUFBUSxHQUFHLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUM5QixTQUFTLEVBQUUsY0FBYyxFQUFFLENBQUM7WUFDNUIsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsSUFBSSxHQUFHLFFBQVEsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1lBQzVHLElBQUksU0FBUyxLQUFLLENBQUM7Z0JBQUUsTUFBTSxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQzNDLFFBQVEsSUFBSSxTQUFTLENBQUM7UUFDeEIsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hDLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsSUFBSSxJQUFJLEtBQUssQ0FBQyxPQUFPLEtBQUssTUFBTSxDQUFDLE9BQU8sSUFBSSxLQUFLLENBQUMsT0FBTyxLQUFLLE1BQU0sQ0FBQyxPQUFPO1lBQ3BHLEtBQUssQ0FBQyxHQUFHLEtBQUssTUFBTSxDQUFDLEdBQUcsSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLE1BQU0sQ0FBQyxHQUFHO1lBQUUsTUFBTSxFQUFFLENBQUM7UUFDakUsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLFNBQVM7WUFBRSxNQUFNLElBQUksaUJBQWlCLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUN6RixDQUFDO1lBQVMsQ0FBQztRQUNULE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3JCLENBQUM7QUFDSCxDQUFDO0FBRUQsK0VBQStFO0FBQy9FLE1BQU0sQ0FBQyxLQUFLLFVBQVUseUJBQXlCLENBQUMsT0FBZTtJQUM3RCxhQUFhLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdkIsTUFBTSxJQUFJLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUNuRSxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxJQUFJLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssT0FBTztRQUFFLE1BQU0sRUFBRSxDQUFDO0FBQ3RGLENBQUMifQ==

package/dist_ts_bundle/plugins.d.ts

@@ -0,0 +1,14 @@
+import * as childProcess from 'node:child_process';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import * as nodeUtil from 'node:util';
+import * as os from 'node:os';
+import * as path from 'node:path';
+export { childProcess, crypto, fs, fsConstants, nodeUtil, os, path };
+import * as tspack from '@git.zone/tspack';
+export { tspack };
+import * as smartdaemon from '@push.rocks/smartdaemon';
+export { smartdaemon };
+import * as interfaces from '@serve.zone/interfaces';
+export { interfaces };

package/dist_ts_bundle/plugins.js

@@ -0,0 +1,19 @@
+// node native scope
+import * as childProcess from 'node:child_process';
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs/promises';
+import { constants as fsConstants } from 'node:fs';
+import * as nodeUtil from 'node:util';
+import * as os from 'node:os';
+import * as path from 'node:path';
+export { childProcess, crypto, fs, fsConstants, nodeUtil, os, path };
+// @git.zone scope
+import * as tspack from '@git.zone/tspack';
+export { tspack };
+// @push.rocks scope
+import * as smartdaemon from '@push.rocks/smartdaemon';
+export { smartdaemon };
+// @serve.zone scope
+import * as interfaces from '@serve.zone/interfaces';
+export { interfaces };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2J1bmRsZS9wbHVnaW5zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssWUFBWSxNQUFNLG9CQUFvQixDQUFDO0FBQ25ELE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFDdkMsT0FBTyxFQUFFLFNBQVMsSUFBSSxXQUFXLEVBQUUsTUFBTSxTQUFTLENBQUM7QUFDbkQsT0FBTyxLQUFLLFFBQVEsTUFBTSxXQUFXLENBQUM7QUFDdEMsT0FBTyxLQUFLLEVBQUUsTUFBTSxTQUFTLENBQUM7QUFDOUIsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFFbEMsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxDQUFDO0FBRXJFLGtCQUFrQjtBQUNsQixPQUFPLEtBQUssTUFBTSxNQUFNLGtCQUFrQixDQUFDO0FBRTNDLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUVsQixvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUV2RCxPQUFPLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFFdkIsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFFckQsT0FBTyxFQUFFLFVBQVUsRUFBRSxDQUFDIn0=

package/dist_ts_bundle/protocol.d.ts

@@ -0,0 +1,48 @@
+/**
+ * The process protocol of `pallet-control`: its modes, the protocol each mode reports on standard
+ * output and the reasons a `failed` line names. `pallet-control` itself reports with these names
+ * (`ts/control/process-cli.ts`), and the supervisors in this package read them. This module has no
+ * dependencies, so the compiled control can import it.
+ */
+/** Every line of the protocol starts with this prefix, followed by one JSON object. */
+export declare const palletControlLinePrefix = "PALLET_CONTROL ";
+export declare const palletControlProtocols: Readonly<{
+    readonly enrollment: "pallet.enrollment.process";
+    readonly node: "pallet.node.process";
+    readonly guard: "pallet.guard.process";
+    readonly acquisition: "pallet.network.acquisition";
+    readonly containerd: "pallet.containerd.process";
+    readonly storageImport: "pallet.storage.import";
+    readonly storeProvision: "pallet.store.provision";
+}>;
+/**
+ * Modes a supervisor holds for its lifetime through a stdin pipe: the child stops when that pipe
+ * closes. `runtime-serve` is the node process as a supervised child.
+ */
+export declare const palletControlLifetimeModes: Readonly<{
+    readonly 'enrollment-serve': "pallet.enrollment.process";
+    readonly 'enrollment-provision': "pallet.enrollment.process";
+    readonly 'runtime-serve': "pallet.node.process";
+}>;
+export type TPalletControlLifetimeMode = keyof typeof palletControlLifetimeModes;
+/** Oneshot modes: null stdin is valid, and `ready` followed by `stopped` is their success. */
+export declare const palletControlOneshotModes: Readonly<{
+    readonly 'guard-recover': "pallet.guard.process";
+    readonly 'guard-commission': "pallet.guard.process";
+    readonly 'network-acquire': "pallet.network.acquisition";
+    readonly 'network-acquire-local': "pallet.network.acquisition";
+    readonly 'store-provision': "pallet.store.provision";
+}>;
+export type TPalletControlOneshotMode = keyof typeof palletControlOneshotModes;
+/**
+ * Service unit main processes. Their stdin is null and a signal stops them; the service manager,
+ * not a supervisor in this package, runs them.
+ */
+export declare const palletControlUnitModes: Readonly<{
+    readonly 'containerd-serve': "pallet.containerd.process";
+    readonly 'runtime-unit': "pallet.node.process";
+}>;
+export type TPalletControlUnitMode = keyof typeof palletControlUnitModes;
+/** The reasons a `failed` line names. */
+export declare const palletControlFailureReasons: readonly ["invalid_arguments", "invalid_ca_store", "invalid_stdin", "owner_failed", "unsupported_kernel"];
+export type TPalletControlFailureReason = typeof palletControlFailureReasons[number];

package/dist_ts_bundle/protocol.js

@@ -0,0 +1,47 @@
+/**
+ * The process protocol of `pallet-control`: its modes, the protocol each mode reports on standard
+ * output and the reasons a `failed` line names. `pallet-control` itself reports with these names
+ * (`ts/control/process-cli.ts`), and the supervisors in this package read them. This module has no
+ * dependencies, so the compiled control can import it.
+ */
+/** Every line of the protocol starts with this prefix, followed by one JSON object. */
+export const palletControlLinePrefix = 'PALLET_CONTROL ';
+export const palletControlProtocols = Object.freeze({
+    enrollment: 'pallet.enrollment.process',
+    node: 'pallet.node.process',
+    guard: 'pallet.guard.process',
+    acquisition: 'pallet.network.acquisition',
+    containerd: 'pallet.containerd.process',
+    storageImport: 'pallet.storage.import',
+    storeProvision: 'pallet.store.provision',
+});
+/**
+ * Modes a supervisor holds for its lifetime through a stdin pipe: the child stops when that pipe
+ * closes. `runtime-serve` is the node process as a supervised child.
+ */
+export const palletControlLifetimeModes = Object.freeze({
+    'enrollment-serve': palletControlProtocols.enrollment,
+    'enrollment-provision': palletControlProtocols.enrollment,
+    'runtime-serve': palletControlProtocols.node,
+});
+/** Oneshot modes: null stdin is valid, and `ready` followed by `stopped` is their success. */
+export const palletControlOneshotModes = Object.freeze({
+    'guard-recover': palletControlProtocols.guard,
+    'guard-commission': palletControlProtocols.guard,
+    'network-acquire': palletControlProtocols.acquisition,
+    'network-acquire-local': palletControlProtocols.acquisition,
+    'store-provision': palletControlProtocols.storeProvision,
+});
+/**
+ * Service unit main processes. Their stdin is null and a signal stops them; the service manager,
+ * not a supervisor in this package, runs them.
+ */
+export const palletControlUnitModes = Object.freeze({
+    'containerd-serve': palletControlProtocols.containerd,
+    'runtime-unit': palletControlProtocols.node,
+});
+/** The reasons a `failed` line names. */
+export const palletControlFailureReasons = Object.freeze([
+    'invalid_arguments', 'invalid_ca_store', 'invalid_stdin', 'owner_failed', 'unsupported_kernel',
+]);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdG9jb2wuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19idW5kbGUvcHJvdG9jb2wudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7O0dBS0c7QUFFSCx1RkFBdUY7QUFDdkYsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsaUJBQWlCLENBQUM7QUFFekQsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNsRCxVQUFVLEVBQUUsMkJBQTJCO0lBQ3ZDLElBQUksRUFBRSxxQkFBcUI7SUFDM0IsS0FBSyxFQUFFLHNCQUFzQjtJQUM3QixXQUFXLEVBQUUsNEJBQTRCO0lBQ3pDLFVBQVUsRUFBRSwyQkFBMkI7SUFDdkMsYUFBYSxFQUFFLHVCQUF1QjtJQUN0QyxjQUFjLEVBQUUsd0JBQXdCO0NBQ2hDLENBQUMsQ0FBQztBQUVaOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDdEQsa0JBQWtCLEVBQUUsc0JBQXNCLENBQUMsVUFBVTtJQUNyRCxzQkFBc0IsRUFBRSxzQkFBc0IsQ0FBQyxVQUFVO0lBQ3pELGVBQWUsRUFBRSxzQkFBc0IsQ0FBQyxJQUFJO0NBQ3BDLENBQUMsQ0FBQztBQUdaLDhGQUE4RjtBQUM5RixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3JELGVBQWUsRUFBRSxzQkFBc0IsQ0FBQyxLQUFLO0lBQzdDLGtCQUFrQixFQUFFLHNCQUFzQixDQUFDLEtBQUs7SUFDaEQsaUJBQWlCLEVBQUUsc0JBQXNCLENBQUMsV0FBVztJQUNyRCx1QkFBdUIsRUFBRSxzQkFBc0IsQ0FBQyxXQUFXO0lBQzNELGlCQUFpQixFQUFFLHNCQUFzQixDQUFDLGNBQWM7Q0FDaEQsQ0FBQyxDQUFDO0FBR1o7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNsRCxrQkFBa0IsRUFBRSxzQkFBc0IsQ0FBQyxVQUFVO0lBQ3JELGNBQWMsRUFBRSxzQkFBc0IsQ0FBQyxJQUFJO0NBQ25DLENBQUMsQ0FBQztBQUdaLHlDQUF5QztBQUN6QyxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3ZELG1CQUFtQixFQUFFLGtCQUFrQixFQUFFLGVBQWUsRUFBRSxjQUFjLEVBQUUsb0JBQW9CO0NBQ3RGLENBQUMsQ0FBQyJ9

package/dist_ts_bundle/units.d.ts

@@ -0,0 +1,67 @@
+import * as plugins from './plugins.js';
+/**
+ * The service units an installer writes for Pallet, to the "Service unit contract" in Pallet's readme.
+ * Pallet never writes a unit file itself: Spark on fleet nodes and Onebox on its own host install
+ * these definitions under their own unit names and install roots.
+ */
+/** The one network provider the guard's supported host profile orders itself before. */
+export declare const palletGuardNetworkProviderName = "systemd-networkd.service";
+/** How long a stop of the node may take: a five-minute native operation, then the database joins. */
+export declare const palletNodeStopTimeoutSeconds = 360;
+export interface IPalletGuardUnitOptions {
+    unitName: string;
+    /**
+     * The boot command's executable. It runs `guard-recover`: `pallet-control` itself, or an
+     * installer's own executable that verifies the installed bundle before it starts that mode.
+     */
+    executable: string;
+    workingDirectory: string;
+}
+export interface IPalletContainerdUnitOptions {
+    unitName: string;
+    /** `<bundle>/pallet-control` of the selected installation. */
+    controlExecutable: string;
+    workingDirectory: string;
+    guardUnitName: string;
+    /** The node unit, the only CRI client, which this unit starts before. */
+    nodeUnitName: string;
+}
+export interface IPalletNodeUnitOptions {
+    unitName: string;
+    /** `<bundle>/pallet-control` of the selected installation. */
+    controlExecutable: string;
+    workingDirectory: string;
+    guardUnitName: string;
+    containerdUnitName: string;
+}
+/**
+ * The retained allocation-pool guard's boot unit: a oneshot that recovers the commissioned guard
+ * before networkd, required by `network-pre.target` and by networkd itself. The installer installs it
+ * only after the first `guard-commission`, and never replaces an installed one with other bytes.
+ */
+export declare const createPalletGuardServiceDefinition: (optionsArg: IPalletGuardUnitOptions) => plugins.smartdaemon.SystemdServiceDefinition;
+/**
+ * Pallet's containerd unit: `pallet-control containerd-serve` as the root main process with null stdin,
+ * ready on the `READY=1` its native owner (a child of the main process) sends. Stopping the unit
+ * signals only `containerd-serve`, which stops containerd itself; every shim and workload keeps
+ * running and is reattached by the next containerd. containerd's exit fails the process and the
+ * service manager restarts it — Pallet never restarts containerd inside the process.
+ */
+export declare const createPalletContainerdServiceDefinition: (optionsArg: IPalletContainerdUnitOptions) => plugins.smartdaemon.SystemdServiceDefinition;
+/**
+ * The node unit: `pallet-control runtime-unit` as the root main process with null stdin. It runs the
+ * same node lifetime as `runtime-serve`, but standard input is not its parent's lifetime: SIGTERM or
+ * SIGINT stops it. `KillMode=mixed` signals only the main process, which joins every owner and child
+ * it started, and the service manager removes whatever remains of the unit's cgroup when the stop
+ * timeout ends, before any successor starts. A failed lifetime is restarted by the service manager,
+ * never inside the process.
+ */
+export declare const createPalletNodeServiceDefinition: (optionsArg: IPalletNodeUnitOptions) => plugins.smartdaemon.SystemdServiceDefinition;
+/**
+ * Whether the service manager's own reading of the containerd unit, drop-ins included, is the
+ * contract. Admission and activation read the loaded unit rather than the file, so a drop-in that
+ * weakens the contract is refused whatever file produced it.
+ */
+export declare const palletContainerdServiceSettingsMatch: (settingsArg: plugins.smartdaemon.ISystemdServiceSettings, unitNameArg: string) => boolean;
+/** The same reading of the node unit: no restart inside a stop, and a stop long enough to join. */
+export declare const palletNodeServiceSettingsMatch: (settingsArg: plugins.smartdaemon.ISystemdServiceSettings, unitNameArg: string) => boolean;

package/dist_ts_bundle/units.js

@@ -0,0 +1,128 @@
+import * as plugins from './plugins.js';
+import { PalletBundleError } from './errors.js';
+/**
+ * The service units an installer writes for Pallet, to the "Service unit contract" in Pallet's readme.
+ * Pallet never writes a unit file itself: Spark on fleet nodes and Onebox on its own host install
+ * these definitions under their own unit names and install roots.
+ */
+/** The one network provider the guard's supported host profile orders itself before. */
+export const palletGuardNetworkProviderName = 'systemd-networkd.service';
+/** How long a stop of the node may take: a five-minute native operation, then the database joins. */
+export const palletNodeStopTimeoutSeconds = 360;
+const definition = (optionsArg) => {
+    try {
+        return new plugins.smartdaemon.SystemdServiceDefinition(optionsArg);
+    }
+    catch (error) {
+        throw new PalletBundleError('invalid_options', { cause: error });
+    }
+};
+/**
+ * The retained allocation-pool guard's boot unit: a oneshot that recovers the commissioned guard
+ * before networkd, required by `network-pre.target` and by networkd itself. The installer installs it
+ * only after the first `guard-commission`, and never replaces an installed one with other bytes.
+ */
+export const createPalletGuardServiceDefinition = (optionsArg) => definition({
+    unitName: optionsArg.unitName,
+    description: 'serve.zone retained allocation-pool guard',
+    executable: optionsArg.executable,
+    args: ['guard-recover'],
+    workingDirectory: optionsArg.workingDirectory,
+    user: 'root',
+    group: 'root',
+    restart: 'no',
+    killMode: 'mixed',
+    timeoutStopSeconds: 360,
+    startup: { type: 'oneshot', remainAfterExit: true, timeoutStartSeconds: 600 },
+    dependencies: {
+        defaultDependencies: false,
+        after: [],
+        before: ['network-pre.target', palletGuardNetworkProviderName, 'shutdown.target'],
+        requires: [],
+        wants: ['network-pre.target'],
+        conflicts: ['shutdown.target'],
+    },
+    install: { wantedBy: [], requiredBy: ['network-pre.target', palletGuardNetworkProviderName] },
+});
+/**
+ * Pallet's containerd unit: `pallet-control containerd-serve` as the root main process with null stdin,
+ * ready on the `READY=1` its native owner (a child of the main process) sends. Stopping the unit
+ * signals only `containerd-serve`, which stops containerd itself; every shim and workload keeps
+ * running and is reattached by the next containerd. containerd's exit fails the process and the
+ * service manager restarts it — Pallet never restarts containerd inside the process.
+ */
+export const createPalletContainerdServiceDefinition = (optionsArg) => definition({
+    unitName: optionsArg.unitName,
+    description: 'serve.zone Pallet containerd',
+    executable: optionsArg.controlExecutable,
+    args: ['containerd-serve'],
+    workingDirectory: optionsArg.workingDirectory,
+    user: 'root',
+    group: 'root',
+    restart: 'always',
+    restartSeconds: 2,
+    killMode: 'process',
+    // Pallet's 30 s containerd grace plus the owner's joins; the contract's floor is 45 s.
+    timeoutStopSeconds: 60,
+    // containerd-serve waits up to 60 s for CRI readiness, then imports the pause image.
+    startup: { type: 'notify', notifyAccess: 'all', timeoutStartSeconds: 120 },
+    delegate: true,
+    limitNoFile: 'infinity',
+    tasksMax: 'infinity',
+    oomScoreAdjust: -999,
+    dependencies: {
+        defaultDependencies: true,
+        after: [optionsArg.guardUnitName],
+        before: [optionsArg.nodeUnitName],
+        requires: [optionsArg.guardUnitName],
+        wants: [],
+        conflicts: [],
+    },
+});
+/**
+ * The node unit: `pallet-control runtime-unit` as the root main process with null stdin. It runs the
+ * same node lifetime as `runtime-serve`, but standard input is not its parent's lifetime: SIGTERM or
+ * SIGINT stops it. `KillMode=mixed` signals only the main process, which joins every owner and child
+ * it started, and the service manager removes whatever remains of the unit's cgroup when the stop
+ * timeout ends, before any successor starts. A failed lifetime is restarted by the service manager,
+ * never inside the process.
+ */
+export const createPalletNodeServiceDefinition = (optionsArg) => definition({
+    unitName: optionsArg.unitName,
+    description: 'serve.zone Pallet node',
+    executable: optionsArg.controlExecutable,
+    args: ['runtime-unit'],
+    workingDirectory: optionsArg.workingDirectory,
+    user: 'root',
+    group: 'root',
+    restart: 'on-failure',
+    restartSeconds: 5,
+    killMode: 'mixed',
+    timeoutStopSeconds: palletNodeStopTimeoutSeconds,
+    dependencies: {
+        defaultDependencies: true,
+        after: [optionsArg.guardUnitName, optionsArg.containerdUnitName],
+        before: [],
+        requires: [optionsArg.guardUnitName],
+        wants: [optionsArg.containerdUnitName],
+        conflicts: [],
+    },
+});
+/**
+ * Whether the service manager's own reading of the containerd unit, drop-ins included, is the
+ * contract. Admission and activation read the loaded unit rather than the file, so a drop-in that
+ * weakens the contract is refused whatever file produced it.
+ */
+export const palletContainerdServiceSettingsMatch = (settingsArg, unitNameArg) => settingsArg.unitName === unitNameArg && settingsArg.type === 'notify' && settingsArg.notifyAccess === 'all' &&
+    settingsArg.restart === 'always' && typeof settingsArg.restartMicroseconds === 'number' &&
+    settingsArg.restartMicroseconds > 0 && settingsArg.restartMicroseconds <= 10_000_000 && settingsArg.killMode === 'process' &&
+    settingsArg.delegate && typeof settingsArg.timeoutStopMicroseconds === 'number' &&
+    settingsArg.timeoutStopMicroseconds >= 45_000_000 && settingsArg.limitNoFile === 'infinity' &&
+    settingsArg.limitNoFileSoft === 'infinity' && settingsArg.tasksMax === 'infinity' && settingsArg.oomScoreAdjust === -999;
+/** The same reading of the node unit: no restart inside a stop, and a stop long enough to join. */
+export const palletNodeServiceSettingsMatch = (settingsArg, unitNameArg) => settingsArg.unitName === unitNameArg && settingsArg.type === 'exec' && settingsArg.killMode === 'mixed' &&
+    settingsArg.restart === 'on-failure' &&
+    typeof settingsArg.timeoutStopMicroseconds === 'number' &&
+    settingsArg.timeoutStopMicroseconds >= palletNodeStopTimeoutSeconds * 1_000_000 && !settingsArg.delegate &&
+    Object.keys(settingsArg.environment).length === 0;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidW5pdHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90c19idW5kbGUvdW5pdHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBRWhEOzs7O0dBSUc7QUFFSCx3RkFBd0Y7QUFDeEYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsMEJBQTBCLENBQUM7QUFFekUscUdBQXFHO0FBQ3JHLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLEdBQUcsQ0FBQztBQStCaEQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxVQUFnRSxFQUFFLEVBQUU7SUFDdEYsSUFBSSxDQUFDO1FBQUMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxXQUFXLENBQUMsd0JBQXdCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFBQyxDQUFDO0lBQzVFLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFBQyxNQUFNLElBQUksaUJBQWlCLENBQUMsaUJBQWlCLEVBQUUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUFDLENBQUM7QUFDckYsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQUMsVUFBbUMsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDO0lBQ3BHLFFBQVEsRUFBRSxVQUFVLENBQUMsUUFBUTtJQUM3QixXQUFXLEVBQUUsMkNBQTJDO0lBQ3hELFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtJQUNqQyxJQUFJLEVBQUUsQ0FBQyxlQUFlLENBQUM7SUFDdkIsZ0JBQWdCLEVBQUUsVUFBVSxDQUFDLGdCQUFnQjtJQUM3QyxJQUFJLEVBQUUsTUFBTTtJQUNaLEtBQUssRUFBRSxNQUFNO0lBQ2IsT0FBTyxFQUFFLElBQUk7SUFDYixRQUFRLEVBQUUsT0FBTztJQUNqQixrQkFBa0IsRUFBRSxHQUFHO0lBQ3ZCLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsZUFBZSxFQUFFLElBQUksRUFBRSxtQkFBbUIsRUFBRSxHQUFHLEVBQUU7SUFDN0UsWUFBWSxFQUFFO1FBQ1osbUJBQW1CLEVBQUUsS0FBSztRQUMxQixLQUFLLEVBQUUsRUFBRTtRQUNULE1BQU0sRUFBRSxDQUFDLG9CQUFvQixFQUFFLDhCQUE4QixFQUFFLGlCQUFpQixDQUFDO1FBQ2pGLFFBQVEsRUFBRSxFQUFFO1FBQ1osS0FBSyxFQUFFLENBQUMsb0JBQW9CLENBQUM7UUFDN0IsU0FBUyxFQUFFLENBQUMsaUJBQWlCLENBQUM7S0FDL0I7SUFDRCxPQUFPLEVBQUUsRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxDQUFDLG9CQUFvQixFQUFFLDhCQUE4QixDQUFDLEVBQUU7Q0FDOUYsQ0FBQyxDQUFDO0FBRUg7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FBQyxVQUF3QyxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUM7SUFDOUcsUUFBUSxFQUFFLFVBQVUsQ0FBQyxRQUFRO0lBQzdCLFdBQVcsRUFBRSw4QkFBOEI7SUFDM0MsVUFBVSxFQUFFLFVBQVUsQ0FBQyxpQkFBaUI7SUFDeEMsSUFBSSxFQUFFLENBQUMsa0JBQWtCLENBQUM7SUFDMUIsZ0JBQWdCLEVBQUUsVUFBVSxDQUFDLGdCQUFnQjtJQUM3QyxJQUFJLEVBQUUsTUFBTTtJQUNaLEtBQUssRUFBRSxNQUFNO0lBQ2IsT0FBTyxFQUFFLFFBQVE7SUFDakIsY0FBYyxFQUFFLENBQUM7SUFDakIsUUFBUSxFQUFFLFNBQVM7SUFDbkIsdUZBQXVGO0lBQ3ZGLGtCQUFrQixFQUFFLEVBQUU7SUFDdEIscUZBQXFGO0lBQ3JGLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxHQUFHLEVBQUU7SUFDMUUsUUFBUSxFQUFFLElBQUk7SUFDZCxXQUFXLEVBQUUsVUFBVTtJQUN2QixRQUFRLEVBQUUsVUFBVTtJQUNwQixjQUFjLEVBQUUsQ0FBQyxHQUFHO0lBQ3BCLFlBQVksRUFBRTtRQUNaLG1CQUFtQixFQUFFLElBQUk7UUFDekIsS0FBSyxFQUFFLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQztRQUNqQyxNQUFNLEVBQUUsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1FBQ2pDLFFBQVEsRUFBRSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUM7UUFDcEMsS0FBSyxFQUFFLEVBQUU7UUFDVCxTQUFTLEVBQUUsRUFBRTtLQUNkO0NBQ0YsQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsVUFBa0MsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDO0lBQ2xHLFFBQVEsRUFBRSxVQUFVLENBQUMsUUFBUTtJQUM3QixXQUFXLEVBQUUsd0JBQXdCO0lBQ3JDLFVBQVUsRUFBRSxVQUFVLENBQUMsaUJBQWlCO0lBQ3hDLElBQUksRUFBRSxDQUFDLGNBQWMsQ0FBQztJQUN0QixnQkFBZ0IsRUFBRSxVQUFVLENBQUMsZ0JBQWdCO0lBQzdDLElBQUksRUFBRSxNQUFNO0lBQ1osS0FBSyxFQUFFLE1BQU07SUFDYixPQUFPLEVBQUUsWUFBWTtJQUNyQixjQUFjLEVBQUUsQ0FBQztJQUNqQixRQUFRLEVBQUUsT0FBTztJQUNqQixrQkFBa0IsRUFBRSw0QkFBNEI7SUFDaEQsWUFBWSxFQUFFO1FBQ1osbUJBQW1CLEVBQUUsSUFBSTtRQUN6QixLQUFLLEVBQUUsQ0FBQyxVQUFVLENBQUMsYUFBYSxFQUFFLFVBQVUsQ0FBQyxrQkFBa0IsQ0FBQztRQUNoRSxNQUFNLEVBQUUsRUFBRTtRQUNWLFFBQVEsRUFBRSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUM7UUFDcEMsS0FBSyxFQUFFLENBQUMsVUFBVSxDQUFDLGtCQUFrQixDQUFDO1FBQ3RDLFNBQVMsRUFBRSxFQUFFO0tBQ2Q7Q0FDRixDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FBQyxXQUF3RCxFQUMzRyxXQUFtQixFQUFXLEVBQUUsQ0FDaEMsV0FBVyxDQUFDLFFBQVEsS0FBSyxXQUFXLElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksV0FBVyxDQUFDLFlBQVksS0FBSyxLQUFLO0lBQzNHLFdBQVcsQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLE9BQU8sV0FBVyxDQUFDLG1CQUFtQixLQUFLLFFBQVE7SUFDdkYsV0FBVyxDQUFDLG1CQUFtQixHQUFHLENBQUMsSUFBSSxXQUFXLENBQUMsbUJBQW1CLElBQUksVUFBVSxJQUFJLFdBQVcsQ0FBQyxRQUFRLEtBQUssU0FBUztJQUMxSCxXQUFXLENBQUMsUUFBUSxJQUFJLE9BQU8sV0FBVyxDQUFDLHVCQUF1QixLQUFLLFFBQVE7SUFDL0UsV0FBVyxDQUFDLHVCQUF1QixJQUFJLFVBQVUsSUFBSSxXQUFXLENBQUMsV0FBVyxLQUFLLFVBQVU7SUFDM0YsV0FBVyxDQUFDLGVBQWUsS0FBSyxVQUFVLElBQUksV0FBVyxDQUFDLFFBQVEsS0FBSyxVQUFVLElBQUksV0FBVyxDQUFDLGNBQWMsS0FBSyxDQUFDLEdBQUcsQ0FBQztBQUUzSCxtR0FBbUc7QUFDbkcsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FBQyxXQUF3RCxFQUNyRyxXQUFtQixFQUFXLEVBQUUsQ0FDaEMsV0FBVyxDQUFDLFFBQVEsS0FBSyxXQUFXLElBQUksV0FBVyxDQUFDLElBQUksS0FBSyxNQUFNLElBQUksV0FBVyxDQUFDLFFBQVEsS0FBSyxPQUFPO0lBQ3ZHLFdBQVcsQ0FBQyxPQUFPLEtBQUssWUFBWTtJQUNwQyxPQUFPLFdBQVcsQ0FBQyx1QkFBdUIsS0FBSyxRQUFRO0lBQ3ZELFdBQVcsQ0FBQyx1QkFBdUIsSUFBSSw0QkFBNEIsR0FBRyxTQUFTLElBQUksQ0FBQyxXQUFXLENBQUMsUUFBUTtJQUN4RyxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDIn0=

package/dist_ts_bundle/verify.d.ts

@@ -0,0 +1,75 @@
+import * as plugins from './plugins.js';
+import { type TPalletControlRole, type TPalletControlTarget } from './inventory.js';
+/** The trusted identity of one Pallet release, as a consumer pins it. */
+export interface IPalletBundlePin {
+    readonly version: string;
+    readonly sourceCommit: string;
+    /** SHA-256 of the release's `tspack-manifest.json`, which pins every file of every bundle. */
+    readonly manifestSha256: string;
+}
+/** A bundle's files as its sealed tspack manifest records them. */
+export type TPalletSealedFiles = Readonly<Record<string, plugins.tspack.ITsPackFileRecord>>;
+export interface IPalletControlExecutable {
+    /** Absolute path inside the verified bundle directory. */
+    readonly path: string;
+    readonly sha256: string;
+}
+/** Who built a native executable, from its tsrust provenance. */
+export interface IPalletControlProvenance {
+    readonly projectName: string;
+    readonly projectVersion: string;
+    readonly gitCommit: string;
+}
+export interface IPalletControlBundle {
+    readonly directory: string;
+    readonly target: TPalletControlTarget;
+    readonly version: string;
+    readonly sourceCommit: string;
+    readonly sourceDirty: boolean;
+    /** The Deno the control executable was compiled with. */
+    readonly denoVersion: string;
+    readonly lockSha256: string;
+    readonly executables: Readonly<Record<TPalletControlRole, IPalletControlExecutable>>;
+    readonly provenance: Readonly<Record<Exclude<TPalletControlRole, 'control'>, IPalletControlProvenance>>;
+    readonly clockManifestSha256: string;
+    readonly dnsManifestSha256: string;
+    readonly vpnInventorySha256: string;
+    /** The digest `containerd-serve` compiles in; it pins containerd, its shim, runc and the pause image. */
+    readonly containerdManifestSha256: string;
+    readonly containerdVersion: string;
+    readonly runcVersion: string;
+    readonly files: TPalletSealedFiles;
+}
+/** A released bundle: every file verified against the pinned release manifest. */
+export interface IPalletVerifiedControlBundle extends IPalletControlBundle {
+    readonly manifestSha256: string;
+}
+/** What a build is expected to be; the consumer's pin, or the packaging step's own source identity. */
+export interface IPalletControlBuildExpectation {
+    readonly version: string;
+    readonly sourceCommit: string;
+    readonly sourceDirty: boolean;
+    readonly target: TPalletControlTarget;
+}
+export declare const validPalletBundlePin: (valueArg: unknown) => valueArg is IPalletBundlePin;
+/** Refuses a malformed pin, and a pin of another Pallet version than this package states. */
+export declare function requirePalletBundlePin(pinArg: unknown): Promise<IPalletBundlePin>;
+/**
+ * Checks a control build directory against the sealed records of its files: the control record,
+ * every executable's role and provenance, the component manifests and the notice and source
+ * inventories. Pallet's packaging runs this over every build before sealing it, with the build's
+ * own source identity; consumers use {@link verifyPalletControlBundle}, which also binds the pin.
+ */
+export declare function inspectPalletControlBuild(directoryArg: string, filesArg: TPalletSealedFiles, expectedArg: IPalletControlBuildExpectation): Promise<IPalletControlBundle>;
+/**
+ * Verifies an extracted release bundle of the pinned version: `filesArg` are the records of the
+ * sealed release manifest whose digest the pin states (tspack's `extractBundle` result), and the
+ * pin must name this package's own Pallet version.
+ */
+export declare function verifyPalletControlBundle(directoryArg: string, filesArg: TPalletSealedFiles, pinArg: IPalletBundlePin, targetArg: TPalletControlTarget): Promise<IPalletVerifiedControlBundle>;
+/**
+ * Extracts and verifies the pinned bundle from a download directory that holds the release's
+ * `tspack-manifest.json`, `SHA256SUMS.txt` and the target's archive. The bundle is extracted into a
+ * fresh private directory below `stagingParentArg`, which the caller owns from then on.
+ */
+export declare function extractPalletControlBundle(downloadDirectoryArg: string, targetArg: TPalletControlTarget, stagingParentArg: string, pinArg: IPalletBundlePin, signalArg?: AbortSignal): Promise<IPalletVerifiedControlBundle>;