@serve.zone/pallet-bundle 35.3.0

package/dist_ts_bundle/verify.js

@@ -0,0 +1,263 @@
+import * as plugins from './plugins.js';
+import { PalletBundleError, requireBundle } from './errors.js';
+import { canonicalPath, requireCanonicalDirectory } from './paths.js';
+import { palletBundleVersion } from './version.js';
+import { isPalletControlTarget, palletControlBundleName, palletControlComponents, palletControlNoticeTrees, palletControlPackageName, palletControlPaths, palletControlRecordKeys, palletControlRecordName, palletControlRoles, palletControlSourceInventories, palletNativeTarget, } from './inventory.js';
+const hash = /^[a-f0-9]{64}$/;
+const commit = /^[a-f0-9]{40}$/;
+const semver = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+const executableMode = 0o755;
+const fileMode = 0o644;
+const maximumMetadataBytes = 2 * 1024 * 1024;
+const record = (valueArg) => typeof valueArg === 'object' && valueArg !== null && !Array.isArray(valueArg) &&
+    Object.getPrototypeOf(valueArg) === Object.prototype;
+const sameKeys = (valueArg, keysArg) => {
+    const keys = Object.keys(valueArg);
+    return keys.length === keysArg.length && keysArg.every((key) => Object.hasOwn(valueArg, key));
+};
+const list = (valueArg) => Array.isArray(valueArg);
+const safeName = (nameArg) => typeof nameArg === 'string' && nameArg.length <= 1024 && /^[A-Za-z0-9][A-Za-z0-9._+@/-]*$/.test(nameArg) &&
+    !nameArg.split('/').some((part) => ['', '.', '..'].includes(part));
+const invalid = () => { throw new PalletBundleError('invalid_release'); };
+export const validPalletBundlePin = (valueArg) => record(valueArg) && sameKeys(valueArg, ['version', 'sourceCommit', 'manifestSha256']) &&
+    typeof valueArg.version === 'string' && semver.test(valueArg.version) &&
+    typeof valueArg.sourceCommit === 'string' && commit.test(valueArg.sourceCommit) &&
+    typeof valueArg.manifestSha256 === 'string' && hash.test(valueArg.manifestSha256);
+/** Refuses a malformed pin, and a pin of another Pallet version than this package states. */
+export async function requirePalletBundlePin(pinArg) {
+    requireBundle(validPalletBundlePin(pinArg), 'invalid_options');
+    if (pinArg.version !== await palletBundleVersion())
+        throw new PalletBundleError('version_mismatch');
+    return Object.freeze({ version: pinArg.version, sourceCommit: pinArg.sourceCommit, manifestSha256: pinArg.manifestSha256 });
+}
+/** Reads one sealed file back and proves its bytes are the sealed record's. */
+async function readSealed(directoryArg, filesArg, nameArg) {
+    const sealed = filesArg[nameArg];
+    requireBundle(sealed && safeName(nameArg) && sealed.mode === fileMode && sealed.size <= maximumMetadataBytes, 'invalid_release');
+    const filename = plugins.path.join(directoryArg, nameArg);
+    const file = await plugins.fs.open(filename, plugins.fsConstants.O_RDONLY | plugins.fsConstants.O_NOFOLLOW)
+        .catch(() => { throw new PalletBundleError('invalid_release'); });
+    try {
+        const info = await file.stat();
+        requireBundle(info.isFile() && info.size === sealed.size, 'invalid_release');
+        const bytes = Buffer.alloc(info.size);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const { bytesRead } = await file.read(bytes, offset, bytes.length - offset, offset);
+            requireBundle(bytesRead > 0, 'invalid_release');
+            offset += bytesRead;
+        }
+        requireBundle(plugins.crypto.createHash('sha256').update(bytes).digest('hex') === sealed.sha256, 'artifact_mismatch');
+        return bytes;
+    }
+    finally {
+        await file.close();
+    }
+}
+async function readJson(directoryArg, filesArg, nameArg) {
+    const bytes = await readSealed(directoryArg, filesArg, nameArg);
+    try {
+        return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        return invalid();
+    }
+}
+/** The files below the prefixes, as the sealed manifest names them. */
+const below = (filesArg, prefixesArg) => Object.keys(filesArg).filter((name) => prefixesArg.some((prefix) => name.startsWith(prefix))).sort();
+const sameSet = (leftArg, rightArg) => leftArg.length === rightArg.length && [...leftArg].sort().every((name, index) => name === [...rightArg].sort()[index]);
+/** The control record: its identity, its fixed paths, and each declared file's sealed record. */
+function checkRecord(recordArg, filesArg, expectedArg) {
+    requireBundle(record(recordArg) && sameKeys(recordArg, palletControlRecordKeys), 'invalid_release');
+    const control = recordArg;
+    const compiler = control.compiler;
+    requireBundle(control.packageName === palletControlPackageName && control.version === expectedArg.version &&
+        control.sourceCommit === expectedArg.sourceCommit && control.sourceDirty === expectedArg.sourceDirty &&
+        control.target === expectedArg.target && control.expectedUid === palletControlPaths.expectedUid &&
+        control.dataRoot === palletControlPaths.dataRoot && control.socketPath === palletControlPaths.socketPath &&
+        control.runtimeSocketPath === palletControlPaths.runtimeSocketPath &&
+        typeof control.lockSha256 === 'string' && hash.test(control.lockSha256) &&
+        record(compiler) && Object.values(compiler).every((value) => typeof value === 'string') &&
+        typeof compiler.deno === 'string' && semver.test(compiler.deno), 'invalid_release');
+    const componentDigest = (componentArg) => {
+        const component = palletControlComponents[componentArg];
+        const digest = control[component.recordKey];
+        requireBundle(typeof digest === 'string' && hash.test(digest) && filesArg[component.manifest]?.sha256 === digest &&
+            filesArg[component.manifest].mode === fileMode, 'invalid_release');
+        return digest;
+    };
+    const facts = {
+        denoVersion: compiler.deno, lockSha256: control.lockSha256,
+        clockManifestSha256: componentDigest('clock'), containerdManifestSha256: componentDigest('containerd'),
+        dnsManifestSha256: componentDigest('dns'), vpnInventorySha256: componentDigest('vpn'),
+    };
+    const declared = control.files;
+    requireBundle(record(declared) && Object.keys(declared).length > 0, 'invalid_release');
+    for (const [name, described] of Object.entries(declared)) {
+        const sealed = filesArg[name];
+        requireBundle(safeName(name) && record(described) && sameKeys(described, ['sha256', 'size']) && sealed &&
+            described.sha256 === sealed.sha256 && described.size === sealed.size, 'invalid_release');
+    }
+    // Every executable the bundle carries is one the control record declares.
+    for (const [name, sealed] of Object.entries(filesArg)) {
+        requireBundle(safeName(name) && (sealed.mode === fileMode || (sealed.mode === executableMode && Object.hasOwn(declared, name))), 'invalid_release');
+    }
+    for (const role of Object.values(palletControlRoles)) {
+        requireBundle(Object.hasOwn(declared, role.path) && filesArg[role.path]?.mode === executableMode &&
+            filesArg[role.path].size > 0, 'invalid_release');
+        if (role.provenance) {
+            requireBundle(Object.hasOwn(declared, role.provenance.path) && filesArg[role.provenance.path]?.mode === fileMode, 'invalid_release');
+        }
+    }
+    return facts;
+}
+/** A listing component: its manifest names exactly the files below its directory. */
+async function checkListing(directoryArg, filesArg, manifestArg, prefixArg) {
+    const manifest = await readJson(directoryArg, filesArg, manifestArg);
+    requireBundle(record(manifest) && list(manifest.files) && manifest.files.length > 0, 'invalid_release');
+    const listed = [];
+    for (const entry of manifest.files) {
+        requireBundle(record(entry) && safeName(entry.path) && typeof entry.sha256 === 'string' && hash.test(entry.sha256) &&
+            Number.isSafeInteger(entry.size) && (entry.mode === executableMode || entry.mode === fileMode), 'invalid_release');
+        const name = `${prefixArg}${entry.path}`;
+        const sealed = filesArg[name];
+        requireBundle(name !== manifestArg && sealed && sealed.sha256 === entry.sha256 && sealed.size === entry.size &&
+            sealed.mode === entry.mode, 'invalid_release');
+        listed.push(name);
+    }
+    requireBundle(new Set(listed).size === listed.length && sameSet(below(filesArg, [prefixArg]), [manifestArg, ...listed]), 'invalid_release');
+    return manifest;
+}
+/** A `tsrust.native-notices` tree: its manifest names every file below the prefix by digest. */
+async function checkNoticeTree(directoryArg, filesArg, prefixArg) {
+    const manifestName = `${prefixArg}manifest.json`;
+    const manifest = await readJson(directoryArg, filesArg, manifestName);
+    requireBundle(record(manifest) && manifest.format === 'tsrust.native-notices' && record(manifest.files), 'invalid_release');
+    const named = Object.entries(manifest.files);
+    requireBundle(named.length > 0 && named.length <= 1024 && !Object.hasOwn(manifest.files, 'manifest.json'), 'invalid_release');
+    for (const [name, digest] of named) {
+        const sealed = filesArg[`${prefixArg}${name}`];
+        requireBundle(safeName(name) && typeof digest === 'string' && hash.test(digest) && sealed?.sha256 === digest &&
+            sealed.mode === fileMode, 'invalid_release');
+    }
+    requireBundle(sameSet(below(filesArg, [prefixArg]), [manifestName, ...named.map(([name]) => `${prefixArg}${name}`)]), 'invalid_release');
+}
+/** A notice and corresponding-source inventory: its manifest lists every file below its prefixes. */
+async function checkSourceInventory(directoryArg, filesArg, manifestArg, prefixesArg) {
+    const manifest = await readJson(directoryArg, filesArg, manifestArg);
+    requireBundle(record(manifest) && list(manifest.files) && manifest.files.length > 0, 'invalid_release');
+    const listed = [];
+    for (const entry of manifest.files) {
+        requireBundle(record(entry), 'invalid_release');
+        const path = entry.path;
+        requireBundle(safeName(path) && path !== manifestArg && prefixesArg.some((prefix) => path.startsWith(prefix)) &&
+            typeof entry.sha256 === 'string' && hash.test(entry.sha256) && Number.isSafeInteger(entry.size) &&
+            filesArg[path]?.sha256 === entry.sha256 && filesArg[path].size === entry.size &&
+            filesArg[path].mode === fileMode, 'invalid_release');
+        listed.push(path);
+    }
+    requireBundle(new Set(listed).size === listed.length && sameSet(below(filesArg, prefixesArg), [manifestArg, ...listed]), 'invalid_release');
+}
+/** One native executable's tsrust provenance, bound to the sealed executable and this bundle's target. */
+async function checkProvenance(directoryArg, filesArg, roleArg, expectedArg) {
+    const role = palletControlRoles[roleArg];
+    const description = role.provenance;
+    const provenance = await readJson(directoryArg, filesArg, description.path);
+    requireBundle(record(provenance), 'invalid_release');
+    const build = provenance.buildInfo;
+    requireBundle(record(build), 'invalid_release');
+    const own = roleArg === 'runtime';
+    requireBundle(provenance.format === 'tsrust.build-provenance.v2' && provenance.binarySha256 === filesArg[role.path].sha256 &&
+        build.projectName === description.projectName && build.binary === description.binary &&
+        build.target === palletNativeTarget(expectedArg.target) &&
+        typeof build.projectVersion === 'string' && semver.test(build.projectVersion) &&
+        typeof build.gitCommit === 'string' && commit.test(build.gitCommit) &&
+        build.gitDirty === (own ? expectedArg.sourceDirty : false) &&
+        (!own || (build.projectVersion === expectedArg.version && build.gitCommit === expectedArg.sourceCommit)), 'invalid_release');
+    return Object.freeze({ projectName: description.projectName, projectVersion: build.projectVersion, gitCommit: build.gitCommit });
+}
+/**
+ * Checks a control build directory against the sealed records of its files: the control record,
+ * every executable's role and provenance, the component manifests and the notice and source
+ * inventories. Pallet's packaging runs this over every build before sealing it, with the build's
+ * own source identity; consumers use {@link verifyPalletControlBundle}, which also binds the pin.
+ */
+export async function inspectPalletControlBuild(directoryArg, filesArg, expectedArg) {
+    const directory = canonicalPath(directoryArg);
+    requireBundle(isPalletControlTarget(expectedArg.target) && semver.test(expectedArg.version) &&
+        commit.test(expectedArg.sourceCommit) && typeof expectedArg.sourceDirty === 'boolean' && record(filesArg), 'invalid_options');
+    await requireCanonicalDirectory(directory);
+    const control = checkRecord(await readJson(directory, filesArg, palletControlRecordName), filesArg, expectedArg);
+    await checkListing(directory, filesArg, palletControlComponents.clock.manifest, palletControlComponents.clock.directory);
+    const containerd = await checkListing(directory, filesArg, palletControlComponents.containerd.manifest, palletControlComponents.containerd.directory);
+    requireBundle(typeof containerd.containerdVersion === 'string' && typeof containerd.runcVersion === 'string', 'invalid_release');
+    for (const tree of palletControlNoticeTrees)
+        await checkNoticeTree(directory, filesArg, tree);
+    for (const inventory of palletControlSourceInventories) {
+        await checkSourceInventory(directory, filesArg, inventory.manifest, inventory.prefixes);
+    }
+    const provenance = {
+        store: await checkProvenance(directory, filesArg, 'store', expectedArg),
+        runtime: await checkProvenance(directory, filesArg, 'runtime', expectedArg),
+        guard: await checkProvenance(directory, filesArg, 'guard', expectedArg),
+        dns: await checkProvenance(directory, filesArg, 'dns', expectedArg),
+        vpn: await checkProvenance(directory, filesArg, 'vpn', expectedArg),
+    };
+    const executable = (roleArg) => Object.freeze({
+        path: plugins.path.join(directory, palletControlRoles[roleArg].path), sha256: filesArg[palletControlRoles[roleArg].path].sha256,
+    });
+    return Object.freeze({
+        directory, target: expectedArg.target, version: expectedArg.version, sourceCommit: expectedArg.sourceCommit,
+        sourceDirty: expectedArg.sourceDirty, denoVersion: control.denoVersion, lockSha256: control.lockSha256,
+        executables: Object.freeze({ control: executable('control'), store: executable('store'), runtime: executable('runtime'),
+            guard: executable('guard'), dns: executable('dns'), vpn: executable('vpn') }),
+        provenance: Object.freeze(provenance),
+        clockManifestSha256: control.clockManifestSha256, dnsManifestSha256: control.dnsManifestSha256,
+        vpnInventorySha256: control.vpnInventorySha256, containerdManifestSha256: control.containerdManifestSha256,
+        containerdVersion: containerd.containerdVersion, runcVersion: containerd.runcVersion,
+        files: Object.freeze({ ...filesArg }),
+    });
+}
+/**
+ * Verifies an extracted release bundle of the pinned version: `filesArg` are the records of the
+ * sealed release manifest whose digest the pin states (tspack's `extractBundle` result), and the
+ * pin must name this package's own Pallet version.
+ */
+export async function verifyPalletControlBundle(directoryArg, filesArg, pinArg, targetArg) {
+    const pin = await requirePalletBundlePin(pinArg);
+    requireBundle(isPalletControlTarget(targetArg), 'invalid_options');
+    const bundle = await inspectPalletControlBuild(directoryArg, filesArg, { version: pin.version, sourceCommit: pin.sourceCommit, sourceDirty: false, target: targetArg });
+    return Object.freeze({ ...bundle, manifestSha256: pin.manifestSha256 });
+}
+/**
+ * Extracts and verifies the pinned bundle from a download directory that holds the release's
+ * `tspack-manifest.json`, `SHA256SUMS.txt` and the target's archive. The bundle is extracted into a
+ * fresh private directory below `stagingParentArg`, which the caller owns from then on.
+ */
+export async function extractPalletControlBundle(downloadDirectoryArg, targetArg, stagingParentArg, pinArg, signalArg) {
+    const pin = await requirePalletBundlePin(pinArg);
+    requireBundle(isPalletControlTarget(targetArg), 'invalid_options');
+    await requireCanonicalDirectory(canonicalPath(stagingParentArg));
+    let extracted;
+    try {
+        extracted = await new plugins.tspack.TsPack().extractBundle(downloadDirectoryArg, targetArg, stagingParentArg, {
+            expectedManifestSha256: pin.manifestSha256, expectedSourceCommit: pin.sourceCommit, requireRelease: true,
+            ...(signalArg ? { signal: signalArg } : {}),
+        });
+    }
+    catch (error) {
+        if (signalArg?.aborted)
+            throw new PalletBundleError('aborted', { cause: error });
+        throw new PalletBundleError('invalid_release', { cause: error });
+    }
+    try {
+        requireBundle(extracted.manifest.packageName === palletControlPackageName &&
+            extracted.manifest.name === palletControlBundleName && extracted.manifest.version === pin.version, 'invalid_release');
+        return await verifyPalletControlBundle(extracted.directory, extracted.artifact.files, pin, targetArg);
+    }
+    catch (error) {
+        await plugins.fs.rm(extracted.directory, { recursive: true, force: true });
+        throw error;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyaWZ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHNfYnVuZGxlL3ZlcmlmeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsYUFBYSxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBQy9ELE9BQU8sRUFBRSxhQUFhLEVBQUUseUJBQXlCLEVBQUUsTUFBTSxZQUFZLENBQUM7QUFDdEUsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBQ25ELE9BQU8sRUFDTCxxQkFBcUIsRUFBRSx1QkFBdUIsRUFBRSx1QkFBdUIsRUFBRSx3QkFBd0IsRUFBRSx3QkFBd0IsRUFDM0gsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQUUsOEJBQThCLEVBQ3hILGtCQUFrQixHQUNuQixNQUFNLGdCQUFnQixDQUFDO0FBNER4QixNQUFNLElBQUksR0FBRyxnQkFBZ0IsQ0FBQztBQUM5QixNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsQ0FBQztBQUNoQyxNQUFNLE1BQU0sR0FBRyw0Q0FBNEMsQ0FBQztBQUM1RCxNQUFNLGNBQWMsR0FBRyxLQUFLLENBQUM7QUFDN0IsTUFBTSxRQUFRLEdBQUcsS0FBSyxDQUFDO0FBQ3ZCLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxHQUFHLElBQUksR0FBRyxJQUFJLENBQUM7QUFHN0MsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUF1QixFQUFFLENBQ3hELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7SUFDN0UsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUyxDQUFDO0FBQ3ZELE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUEwQixFQUFXLEVBQUU7SUFDMUUsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuQyxPQUFPLElBQUksQ0FBQyxNQUFNLEtBQUssT0FBTyxDQUFDLE1BQU0sSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBQ2hHLENBQUMsQ0FBQztBQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsUUFBaUIsRUFBa0MsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDNUYsTUFBTSxRQUFRLEdBQUcsQ0FBQyxPQUFnQixFQUFxQixFQUFFLENBQ3ZELE9BQU8sT0FBTyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsTUFBTSxJQUFJLElBQUksSUFBSSxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDO0lBQ3hHLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztBQUNyRSxNQUFNLE9BQU8sR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksaUJBQWlCLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVqRixNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLFFBQWlCLEVBQWdDLEVBQUUsQ0FDdEYsTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxTQUFTLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixDQUFDLENBQUM7SUFDckYsT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7SUFDckUsT0FBTyxRQUFRLENBQUMsWUFBWSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7SUFDL0UsT0FBTyxRQUFRLENBQUMsY0FBYyxLQUFLLFFBQVEsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsQ0FBQztBQUVwRiw2RkFBNkY7QUFDN0YsTUFBTSxDQUFDLEtBQUssVUFBVSxzQkFBc0IsQ0FBQyxNQUFlO0lBQzFELGFBQWEsQ0FBQyxvQkFBb0IsQ0FBQyxNQUFNLENBQUMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQy9ELElBQUksTUFBTSxDQUFDLE9BQU8sS0FBSyxNQUFNLG1CQUFtQixFQUFFO1FBQUUsTUFBTSxJQUFJLGlCQUFpQixDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDcEcsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sQ0FBQyxZQUFZLEVBQUUsY0FBYyxFQUFFLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQyxDQUFDO0FBQzlILENBQUM7QUFFRCwrRUFBK0U7QUFDL0UsS0FBSyxVQUFVLFVBQVUsQ0FBQyxZQUFvQixFQUFFLFFBQTRCLEVBQUUsT0FBZTtJQUMzRixNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDakMsYUFBYSxDQUFDLE1BQU0sSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLElBQUksSUFBSSxvQkFBb0IsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2pJLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQztJQUMxRCxNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQztTQUN4RyxLQUFLLENBQUMsR0FBRyxFQUFFLEdBQUcsTUFBTSxJQUFJLGlCQUFpQixDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwRSxJQUFJLENBQUM7UUFDSCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUMvQixhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssTUFBTSxDQUFDLElBQUksRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBQzdFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3RDLElBQUksTUFBTSxHQUFHLENBQUMsQ0FBQztRQUNmLE9BQU8sTUFBTSxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUM3QixNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sR0FBRyxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDcEYsYUFBYSxDQUFDLFNBQVMsR0FBRyxDQUFDLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztZQUNoRCxNQUFNLElBQUksU0FBUyxDQUFDO1FBQ3RCLENBQUM7UUFDRCxhQUFhLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLENBQUM7UUFDdEgsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO1lBQVMsQ0FBQztRQUNULE1BQU0sSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3JCLENBQUM7QUFDSCxDQUFDO0FBRUQsS0FBSyxVQUFVLFFBQVEsQ0FBQyxZQUFvQixFQUFFLFFBQTRCLEVBQUUsT0FBZTtJQUN6RixNQUFNLEtBQUssR0FBRyxNQUFNLFVBQVUsQ0FBQyxZQUFZLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ2hFLElBQUksQ0FBQztRQUFDLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUFDLENBQUM7SUFDbkYsTUFBTSxDQUFDO1FBQUMsT0FBTyxPQUFPLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDN0IsQ0FBQztBQUVELHVFQUF1RTtBQUN2RSxNQUFNLEtBQUssR0FBRyxDQUFDLFFBQTRCLEVBQUUsV0FBOEIsRUFBWSxFQUFFLENBQ3ZGLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztBQUN2RyxNQUFNLE9BQU8sR0FBRyxDQUFDLE9BQTBCLEVBQUUsUUFBMkIsRUFBVyxFQUFFLENBQ25GLE9BQU8sQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLE1BQU0sSUFBSSxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsSUFBSSxLQUFLLENBQUMsR0FBRyxRQUFRLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBTXpILGlHQUFpRztBQUNqRyxTQUFTLFdBQVcsQ0FBQyxTQUFrQixFQUFFLFFBQTRCLEVBQ25FLFdBQTJDO0lBQzNDLGFBQWEsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLElBQUksUUFBUSxDQUFDLFNBQVMsRUFBRSx1QkFBdUIsQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDcEcsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDO0lBQzFCLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUM7SUFDbEMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxXQUFXLEtBQUssd0JBQXdCLElBQUksT0FBTyxDQUFDLE9BQU8sS0FBSyxXQUFXLENBQUMsT0FBTztRQUN2RyxPQUFPLENBQUMsWUFBWSxLQUFLLFdBQVcsQ0FBQyxZQUFZLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxXQUFXLENBQUMsV0FBVztRQUNwRyxPQUFPLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxrQkFBa0IsQ0FBQyxXQUFXO1FBQy9GLE9BQU8sQ0FBQyxRQUFRLEtBQUssa0JBQWtCLENBQUMsUUFBUSxJQUFJLE9BQU8sQ0FBQyxVQUFVLEtBQUssa0JBQWtCLENBQUMsVUFBVTtRQUN4RyxPQUFPLENBQUMsaUJBQWlCLEtBQUssa0JBQWtCLENBQUMsaUJBQWlCO1FBQ2xFLE9BQU8sT0FBTyxDQUFDLFVBQVUsS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO1FBQ3ZFLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDO1FBQ3ZGLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUN0RixNQUFNLGVBQWUsR0FBRyxDQUFDLFlBQWtELEVBQVUsRUFBRTtRQUNyRixNQUFNLFNBQVMsR0FBRyx1QkFBdUIsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN4RCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzVDLGFBQWEsQ0FBQyxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxRQUFRLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLE1BQU0sS0FBSyxNQUFNO1lBQzlHLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3JFLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUMsQ0FBQztJQUNGLE1BQU0sS0FBSyxHQUE4QjtRQUN2QyxXQUFXLEVBQUUsUUFBUSxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7UUFDMUQsbUJBQW1CLEVBQUUsZUFBZSxDQUFDLE9BQU8sQ0FBQyxFQUFFLHdCQUF3QixFQUFFLGVBQWUsQ0FBQyxZQUFZLENBQUM7UUFDdEcsaUJBQWlCLEVBQUUsZUFBZSxDQUFDLEtBQUssQ0FBQyxFQUFFLGtCQUFrQixFQUFFLGVBQWUsQ0FBQyxLQUFLLENBQUM7S0FDdEYsQ0FBQztJQUNGLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUM7SUFDL0IsYUFBYSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUN2RixLQUFLLE1BQU0sQ0FBQyxJQUFJLEVBQUUsU0FBUyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ3pELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM5QixhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUMsSUFBSSxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxDQUFDLElBQUksTUFBTTtZQUNwRyxTQUFTLENBQUMsTUFBTSxLQUFLLE1BQU0sQ0FBQyxNQUFNLElBQUksU0FBUyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELDBFQUEwRTtJQUMxRSxLQUFLLE1BQU0sQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ3RELGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssY0FBYyxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsRUFDN0gsaUJBQWlCLENBQUMsQ0FBQztJQUN2QixDQUFDO0lBQ0QsS0FBSyxNQUFNLElBQUksSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUNyRCxhQUFhLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxLQUFLLGNBQWM7WUFDOUYsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDbkQsSUFBSSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDcEIsYUFBYSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxLQUFLLFFBQVEsRUFDOUcsaUJBQWlCLENBQUMsQ0FBQztRQUN2QixDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQztBQUVELHFGQUFxRjtBQUNyRixLQUFLLFVBQVUsWUFBWSxDQUFDLFlBQW9CLEVBQUUsUUFBNEIsRUFBRSxXQUFtQixFQUNqRyxTQUFpQjtJQUNqQixNQUFNLFFBQVEsR0FBRyxNQUFNLFFBQVEsQ0FBQyxZQUFZLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQ3JFLGFBQWEsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUN4RyxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDbkMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1lBQ2hILE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxjQUFjLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3JILE1BQU0sSUFBSSxHQUFHLEdBQUcsU0FBUyxHQUFHLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN6QyxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDOUIsYUFBYSxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksTUFBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxJQUFJO1lBQzFHLE1BQU0sQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDLElBQUksRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDcEIsQ0FBQztJQUNELGFBQWEsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEtBQUssTUFBTSxDQUFDLE1BQU0sSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxXQUFXLEVBQUUsR0FBRyxNQUFNLENBQUMsQ0FBQyxFQUNySCxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3JCLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUM7QUFFRCxnR0FBZ0c7QUFDaEcsS0FBSyxVQUFVLGVBQWUsQ0FBQyxZQUFvQixFQUFFLFFBQTRCLEVBQUUsU0FBaUI7SUFDbEcsTUFBTSxZQUFZLEdBQUcsR0FBRyxTQUFTLGVBQWUsQ0FBQztJQUNqRCxNQUFNLFFBQVEsR0FBRyxNQUFNLFFBQVEsQ0FBQyxZQUFZLEVBQUUsUUFBUSxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQ3RFLGFBQWEsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyx1QkFBdUIsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDNUgsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDN0MsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLGVBQWUsQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDOUgsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLEtBQUssRUFBRSxDQUFDO1FBQ25DLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxHQUFHLFNBQVMsR0FBRyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxFQUFFLE1BQU0sS0FBSyxNQUFNO1lBQzFHLE1BQU0sQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDakQsQ0FBQztJQUNELGFBQWEsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxZQUFZLEVBQUUsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUMsR0FBRyxTQUFTLEdBQUcsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQ2xILGlCQUFpQixDQUFDLENBQUM7QUFDdkIsQ0FBQztBQUVELHFHQUFxRztBQUNyRyxLQUFLLFVBQVUsb0JBQW9CLENBQUMsWUFBb0IsRUFBRSxRQUE0QixFQUFFLFdBQW1CLEVBQ3pHLFdBQThCO0lBQzlCLE1BQU0sUUFBUSxHQUFHLE1BQU0sUUFBUSxDQUFDLFlBQVksRUFBRSxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDckUsYUFBYSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3hHLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixLQUFLLE1BQU0sS0FBSyxJQUFJLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNuQyxhQUFhLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDaEQsTUFBTSxJQUFJLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQztRQUN4QixhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLElBQUksS0FBSyxXQUFXLElBQUksV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUMzRyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQztZQUMvRixRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsTUFBTSxLQUFLLEtBQUssQ0FBQyxNQUFNLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsSUFBSTtZQUM3RSxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3ZELE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDcEIsQ0FBQztJQUNELGFBQWEsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLEtBQUssTUFBTSxDQUFDLE1BQU0sSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDLFdBQVcsRUFBRSxHQUFHLE1BQU0sQ0FBQyxDQUFDLEVBQ3JILGlCQUFpQixDQUFDLENBQUM7QUFDdkIsQ0FBQztBQUVELDBHQUEwRztBQUMxRyxLQUFLLFVBQVUsZUFBZSxDQUFDLFlBQW9CLEVBQUUsUUFBNEIsRUFBRSxPQUErQyxFQUNoSSxXQUEyQztJQUMzQyxNQUFNLElBQUksR0FBRyxrQkFBa0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN6QyxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsVUFBVyxDQUFDO0lBQ3JDLE1BQU0sVUFBVSxHQUFHLE1BQU0sUUFBUSxDQUFDLFlBQVksRUFBRSxRQUFRLEVBQUUsV0FBVyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzVFLGFBQWEsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUNyRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDO0lBQ25DLGFBQWEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUNoRCxNQUFNLEdBQUcsR0FBRyxPQUFPLEtBQUssU0FBUyxDQUFDO0lBQ2xDLGFBQWEsQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLDRCQUE0QixJQUFJLFVBQVUsQ0FBQyxZQUFZLEtBQUssUUFBUSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNO1FBQ3hILEtBQUssQ0FBQyxXQUFXLEtBQUssV0FBVyxDQUFDLFdBQVcsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxNQUFNO1FBQ3BGLEtBQUssQ0FBQyxNQUFNLEtBQUssa0JBQWtCLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQztRQUN2RCxPQUFPLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQztRQUM3RSxPQUFPLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUNuRSxLQUFLLENBQUMsUUFBUSxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUM7UUFDMUQsQ0FBQyxDQUFDLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDL0gsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsV0FBVyxFQUFFLFdBQVcsQ0FBQyxXQUFXLEVBQUUsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjLEVBQUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQyxDQUFDO0FBQ25JLENBQUM7QUFFRDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUseUJBQXlCLENBQUMsWUFBb0IsRUFBRSxRQUE0QixFQUNoRyxXQUEyQztJQUMzQyxNQUFNLFNBQVMsR0FBRyxhQUFhLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDOUMsYUFBYSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUM7UUFDekYsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsWUFBWSxDQUFDLElBQUksT0FBTyxXQUFXLENBQUMsV0FBVyxLQUFLLFNBQVMsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUNoSSxNQUFNLHlCQUF5QixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzNDLE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxNQUFNLFFBQVEsQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLHVCQUF1QixDQUFDLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQ2pILE1BQU0sWUFBWSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsdUJBQXVCLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDekgsTUFBTSxVQUFVLEdBQUcsTUFBTSxZQUFZLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSx1QkFBdUIsQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUNwRyx1QkFBdUIsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEQsYUFBYSxDQUFDLE9BQU8sVUFBVSxDQUFDLGlCQUFpQixLQUFLLFFBQVEsSUFBSSxPQUFPLFVBQVUsQ0FBQyxXQUFXLEtBQUssUUFBUSxFQUFFLGlCQUFpQixDQUFDLENBQUM7SUFDakksS0FBSyxNQUFNLElBQUksSUFBSSx3QkFBd0I7UUFBRSxNQUFNLGVBQWUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQzlGLEtBQUssTUFBTSxTQUFTLElBQUksOEJBQThCLEVBQUUsQ0FBQztRQUN2RCxNQUFNLG9CQUFvQixDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsU0FBUyxDQUFDLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUYsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFHO1FBQ2pCLEtBQUssRUFBRSxNQUFNLGVBQWUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUM7UUFDdkUsT0FBTyxFQUFFLE1BQU0sZUFBZSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLFdBQVcsQ0FBQztRQUMzRSxLQUFLLEVBQUUsTUFBTSxlQUFlLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDO1FBQ3ZFLEdBQUcsRUFBRSxNQUFNLGVBQWUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxXQUFXLENBQUM7UUFDbkUsR0FBRyxFQUFFLE1BQU0sZUFBZSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLFdBQVcsQ0FBQztLQUNwRSxDQUFDO0lBQ0YsTUFBTSxVQUFVLEdBQUcsQ0FBQyxPQUEyQixFQUE0QixFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztRQUMxRixJQUFJLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTTtLQUNoSSxDQUFDLENBQUM7SUFDSCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDbkIsU0FBUyxFQUFFLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTSxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsT0FBTyxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsWUFBWTtRQUMzRyxXQUFXLEVBQUUsV0FBVyxDQUFDLFdBQVcsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7UUFDdEcsV0FBVyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxPQUFPLEVBQUUsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxTQUFTLENBQUM7WUFDckgsS0FBSyxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxHQUFHLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxFQUFFLEdBQUcsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUMvRSxVQUFVLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7UUFDckMsbUJBQW1CLEVBQUUsT0FBTyxDQUFDLG1CQUFtQixFQUFFLGlCQUFpQixFQUFFLE9BQU8sQ0FBQyxpQkFBaUI7UUFDOUYsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLGtCQUFrQixFQUFFLHdCQUF3QixFQUFFLE9BQU8sQ0FBQyx3QkFBd0I7UUFDMUcsaUJBQWlCLEVBQUUsVUFBVSxDQUFDLGlCQUFpQixFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUMsV0FBVztRQUNwRixLQUFLLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEdBQUcsUUFBUSxFQUFFLENBQUM7S0FDdEMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQztBQUVEOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsS0FBSyxVQUFVLHlCQUF5QixDQUFDLFlBQW9CLEVBQUUsUUFBNEIsRUFBRSxNQUF3QixFQUMxSCxTQUErQjtJQUMvQixNQUFNLEdBQUcsR0FBRyxNQUFNLHNCQUFzQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ2pELGFBQWEsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ25FLE1BQU0sTUFBTSxHQUFHLE1BQU0seUJBQXlCLENBQUMsWUFBWSxFQUFFLFFBQVEsRUFDbkUsRUFBRSxPQUFPLEVBQUUsR0FBRyxDQUFDLE9BQU8sRUFBRSxZQUFZLEVBQUUsR0FBRyxDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEdBQUcsTUFBTSxFQUFFLGNBQWMsRUFBRSxHQUFHLENBQUMsY0FBYyxFQUFFLENBQUMsQ0FBQztBQUMxRSxDQUFDO0FBRUQ7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxLQUFLLFVBQVUsMEJBQTBCLENBQUMsb0JBQTRCLEVBQUUsU0FBK0IsRUFDNUcsZ0JBQXdCLEVBQUUsTUFBd0IsRUFBRSxTQUF1QjtJQUMzRSxNQUFNLEdBQUcsR0FBRyxNQUFNLHNCQUFzQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ2pELGFBQWEsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ25FLE1BQU0seUJBQXlCLENBQUMsYUFBYSxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQztJQUNqRSxJQUFJLFNBQThDLENBQUM7SUFDbkQsSUFBSSxDQUFDO1FBQ0gsU0FBUyxHQUFHLE1BQU0sSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUU7WUFDN0csc0JBQXNCLEVBQUUsR0FBRyxDQUFDLGNBQWMsRUFBRSxvQkFBb0IsRUFBRSxHQUFHLENBQUMsWUFBWSxFQUFFLGNBQWMsRUFBRSxJQUFJO1lBQ3hHLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDNUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLFNBQVMsRUFBRSxPQUFPO1lBQUUsTUFBTSxJQUFJLGlCQUFpQixDQUFDLFNBQVMsRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ2pGLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxpQkFBaUIsRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxhQUFhLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxXQUFXLEtBQUssd0JBQXdCO1lBQ3ZFLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLHVCQUF1QixJQUFJLFNBQVMsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLEdBQUcsQ0FBQyxPQUFPLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztRQUN4SCxPQUFPLE1BQU0seUJBQXlCLENBQUMsU0FBUyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDeEcsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzNFLE1BQU0sS0FBSyxDQUFDO0lBQ2QsQ0FBQztBQUNILENBQUMifQ==

package/dist_ts_bundle/version.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The Pallet version this package describes. The package is released from Pallet's repository with
+ * Pallet's own version, so this is the one bundle version whose inventory and contracts it states.
+ * It is read from the package manifest beside the compiled module, which is Pallet's root manifest
+ * in the repository and the published package's own manifest in `node_modules`.
+ */
+export declare const palletBundleVersion: () => Promise<string>;

package/dist_ts_bundle/version.js

@@ -0,0 +1,17 @@
+import * as plugins from './plugins.js';
+let ownVersion;
+/**
+ * The Pallet version this package describes. The package is released from Pallet's repository with
+ * Pallet's own version, so this is the one bundle version whose inventory and contracts it states.
+ * It is read from the package manifest beside the compiled module, which is Pallet's root manifest
+ * in the repository and the published package's own manifest in `node_modules`.
+ */
+export const palletBundleVersion = () => ownVersion ??= (async () => {
+    const manifest = JSON.parse(await plugins.fs.readFile(new URL('../package.json', import.meta.url), 'utf8'));
+    const version = typeof manifest === 'object' && manifest !== null && 'version' in manifest ? manifest.version : undefined;
+    if (typeof version !== 'string' || !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version)) {
+        throw new Error('The Pallet bundle package manifest carries no release version.');
+    }
+    return version;
+})();
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmVyc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzX2J1bmRsZS92ZXJzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBRXhDLElBQUksVUFBdUMsQ0FBQztBQUU1Qzs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLEdBQW9CLEVBQUUsQ0FBQyxVQUFVLEtBQUssQ0FBQyxLQUFLLElBQUksRUFBRTtJQUNuRixNQUFNLFFBQVEsR0FBWSxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsSUFBSSxHQUFHLENBQUMsaUJBQWlCLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3JILE1BQU0sT0FBTyxHQUFHLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLEtBQUssSUFBSSxJQUFJLFNBQVMsSUFBSSxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUMxSCxJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLDRDQUE0QyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQy9GLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDLEVBQUUsQ0FBQyJ9

package/license.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Task Venture Capital GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,35 @@
+{
+  "author": "Task Venture Capital GmbH",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://code.foss.global/serve.zone/pallet.git"
+  },
+  "homepage": "https://code.foss.global/serve.zone/pallet",
+  "bugs": {
+    "url": "https://community.foss.global/"
+  },
+  "name": "@serve.zone/pallet-bundle",
+  "version": "35.3.0",
+  "type": "module",
+  "description": "Install surface of Pallet's sealed control bundle: pinned release download and verification, the service units Pallet's contract states, and supervisors for the pallet-control process protocol.",
+  "main": "./dist_ts_bundle/index.js",
+  "types": "./dist_ts_bundle/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist_ts_bundle/index.d.ts",
+      "import": "./dist_ts_bundle/index.js"
+    }
+  },
+  "dependencies": {
+    "@git.zone/tspack": "1.4.1",
+    "@push.rocks/smartdaemon": "2.14.0",
+    "@serve.zone/interfaces": "32.32.0"
+  },
+  "files": [
+    "ts_bundle",
+    "dist_ts_bundle",
+    "readme.md",
+    "license.md"
+  ]
+}

package/readme.md

@@ -0,0 +1,176 @@
+# @serve.zone/pallet-bundle
+
+The install surface of Pallet's sealed control bundle, released from Pallet's repository with
+Pallet's own version. An installer — Spark on fleet nodes, Onebox on its own host — uses it to
+
+- download a pinned Pallet release and verify it with tspack,
+- verify the extracted bundle: its control record, every executable's role and build provenance, the
+  component manifests and the notice and source inventories,
+- write the service units Pallet's "Service unit contract" states, and read them back from the
+  service manager,
+- run and supervise `pallet-control` modes over its `PALLET_CONTROL` process protocol.
+
+Pallet is the source of truth for all of it. Pallet's own packaging runs this package's verifier over
+every bundle it seals, so a release never disagrees with the version of this package that carries
+the same version number.
+
+## Issue Reporting and Security
+
+For reporting bugs, issues, or security vulnerabilities, please visit
+[community.foss.global/](https://community.foss.global/). This is the central community hub for all
+issue reporting. Developers who sign and comply with our contribution agreement and go through
+identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull
+Requests directly.
+
+## Install
+
+```sh
+pnpm install @serve.zone/pallet-bundle
+```
+
+The package runs under Node.js and Deno; it uses `node:` APIs and the global `fetch` only.
+
+It reads its own version at runtime from the `package.json` beside its compiled modules
+(`version.ts`, resolved relative to `import.meta.url`). Consume it as an npm dependency and do not
+bundle it into another file: a bundler that inlines the modules loses that manifest, and
+`palletBundleVersion` and every call that takes a pin (the release client and the verifiers) then fail. `deno compile`
+keeps it: a compiled binary embeds each npm package it
+uses with its `package.json`, whether the dependency comes from a `node_modules` directory
+installed by pnpm or from Deno's own `nodeModulesDir: "auto"` install.
+
+## Pins
+
+A release is selected only by its pin, the values a consumer compiles in:
+
+```typescript
+import type { IPalletBundlePin } from '@serve.zone/pallet-bundle';
+
+const pin: IPalletBundlePin = {
+  version: '35.3.0',
+  sourceCommit: '<the 40-hex commit of the v35.3.0 tag>',
+  manifestSha256: '<SHA-256 of that release\'s tspack-manifest.json>',
+};
+```
+
+Every entry point refuses a pin whose `version` differs from this package's own version
+(`version_mismatch`): the inventory and contracts it states belong to that one Pallet version.
+Upgrade the package and the pin together.
+
+## Download, extract and verify
+
+```typescript
+import { PalletReleaseClient, extractPalletControlBundle } from '@serve.zone/pallet-bundle';
+
+const client = new PalletReleaseClient();
+const bundle = await client.run(pin, 'linux-amd64', '/opt/onebox/pallet', (download) =>
+  extractPalletControlBundle(download, 'linux-amd64', '/opt/onebox/pallet', pin, signal), signal);
+// bundle.directory is a fresh private directory below /opt/onebox/pallet; the caller owns it.
+console.log(bundle.executables.control.path, bundle.executables.control.sha256);
+console.log(bundle.containerdManifestSha256, bundle.provenance.store.projectVersion);
+```
+
+`PalletReleaseClient.run` resolves the release `v<version>` of `serve.zone/pallet` on
+`https://code.foss.global`, requires its tag to name the pinned commit, verifies the release metadata
+against the pinned manifest digest (tspack `verifyMetadata`), downloads the manifest, the checksums
+and the target's archive into a private directory below the given parent, verifies the archive
+(tspack `verifyBundle`) and hands the directory to the callback. It removes the download directory
+when the callback settles. A release that exists without all of its assets answers
+`release_pending` with the missing asset names.
+
+`extractPalletControlBundle` extracts the target's archive with tspack `extractBundle`, then runs
+`verifyPalletControlBundle` over it and removes the extraction again if that fails. For a bundle
+that is already extracted, call `verifyPalletControlBundle(directory, sealedFiles, pin, target)`
+with the file records of the pinned manifest.
+
+The verifier checks, against the sealed records of the bundle's files:
+
+- `control-build.json`: exactly its keys, Pallet's package name, the pinned version and commit, a
+  clean source, the target and the fixed host paths; every file it declares carries the sealed
+  digest and size, and every executable in the bundle is one it declares;
+- the executables `pallet-control` starts by name (`pallet-control`, `pallet-smartdb`,
+  `pallet-runtime`, `pallet-guard`, `pallet-dns`, `pallet-vpn`) and their tsrust provenance: the
+  sealed digest, the owning project and binary, the target, a clean build, and for `pallet-runtime`
+  the pinned version and commit;
+- the clock and containerd manifests, which list every file below their directories with digest,
+  size and mode, and the digests the control record pins for them and for the DNS and VPN notices;
+- the notice trees (`native-notices/`, `notices/smartnftables/`) and the clock and containerd notice
+  and corresponding-source inventories: each manifest names exactly the files below it.
+
+Refusals are `PalletBundleError` values with a fixed `code`; see `TPalletBundleErrorCode`.
+
+## Service units
+
+```typescript
+import { SystemdUnit, SystemdUnitFile } from '@push.rocks/smartdaemon';
+import {
+  createPalletGuardServiceDefinition, createPalletContainerdServiceDefinition,
+  createPalletNodeServiceDefinition, palletContainerdServiceSettingsMatch,
+} from '@serve.zone/pallet-bundle';
+
+const control = '/opt/onebox/pallet/current/pallet-control';
+const guard = createPalletGuardServiceDefinition({ unitName: 'onebox-pallet-guard.service',
+  executable: control, workingDirectory: '/opt/onebox/pallet' });
+const containerd = createPalletContainerdServiceDefinition({ unitName: 'onebox-pallet-containerd.service',
+  controlExecutable: control, workingDirectory: '/opt/onebox/pallet',
+  guardUnitName: guard.unitName, nodeUnitName: 'onebox-pallet-node.service' });
+const node = createPalletNodeServiceDefinition({ unitName: 'onebox-pallet-node.service',
+  controlExecutable: control, workingDirectory: '/opt/onebox/pallet',
+  guardUnitName: guard.unitName, containerdUnitName: containerd.unitName });
+```
+
+The definitions are `SystemdServiceDefinition` values of `@push.rocks/smartdaemon`; install them
+with its `SystemdUnitFile`. The unit names and the install root are the installer's.
+
+- The guard unit is a oneshot that runs `guard-recover` before `network-pre.target` and
+  `systemd-networkd.service`, which both require it. Install it only after the first
+  `guard-commission`. Its executable is `pallet-control` or an installer's own executable that
+  verifies the installation before it starts that mode.
+- The containerd unit runs `containerd-serve` to the contract in Pallet's readme ("Pallet's own
+  containerd"). `palletContainerdServiceSettingsMatch` reads the loaded unit's settings, drop-ins
+  included, back against that contract.
+- The node unit runs `runtime-unit`, the node lifetime as a unit's main process: null stdin, stopped
+  by SIGTERM, `KillMode=mixed`, restarted on failure by the service manager, after the guard and
+  containerd units. `palletNodeServiceSettingsMatch` reads it back.
+
+## Process supervisors
+
+```typescript
+import { PalletControlOneshot, PalletControlLifetime } from '@serve.zone/pallet-bundle';
+
+// A null-stdin oneshot: guard-recover, guard-commission, network-acquire, network-acquire-local, store-provision.
+await new PalletControlOneshot({ binaryPath: control, binarySha256: bundle.executables.control.sha256 })
+  .run('store-provision', signal);
+
+// A supervised lifetime held by a stdin pipe: enrollment-serve, enrollment-provision, runtime-serve.
+const lifetime = new PalletControlLifetime({ binaryPath: control, binarySha256, mode: 'enrollment-serve' });
+await lifetime.run(signal, async (running) => { /* talk to the enrollment socket */ });
+```
+
+Both verify the executable's digest before every start, start it with a clean environment and `/`
+as its working directory, read the `PALLET_CONTROL` lines of the mode's protocol and forward its
+standard error line by line, bounded (`PalletControlStderr`). They never restart a child. A oneshot
+succeeds only on `ready`, `stopped`, drained pipes and exit status 0. A lifetime runs the operation
+while the child is `ready`; closing its stdin is the graceful stop, and a missed shutdown deadline
+signals SIGTERM and then SIGKILL, which fails the lifetime as `shutdown_failed`. Refusals are
+`PalletControlProcessError` values; `unsupported_kernel` carries the operator's remedy.
+
+## License and Legal Information
+
+This repository contains open-source code licensed under the MIT License. A copy of the license is included in this package as `license.md`.
+
+**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
+
+### Trademarks
+
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.
+
+Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.
+
+### Company Information
+
+Task Venture Capital GmbH<br>
+Registered at District Court Bremen HRB 35230 HB, Germany
+
+For any legal inquiries or further information, please contact us via email at hello@task.vc.
+
+By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.