@serve.zone/interfaces 19.7.0 → 20.0.0

package/dist_ts/requests/index.d.ts

@@ -23,6 +23,7 @@ import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
+import * as secretRequests from './secret.js';
 import * as secretBundleRequests from './secretbundle.js';
 import * as secretGroupRequests from './secretgroup.js';
 import * as serverRequests from './server.js';
@@ -32,7 +33,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -24,6 +24,7 @@ import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
+import * as secretRequests from './secret.js';
 import * as secretBundleRequests from './secretbundle.js';
 import * as secretGroupRequests from './secretgroup.js';
 import * as serverRequests from './server.js';
@@ -33,9 +34,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxrQkFBa0IsTUFBTSxpQkFBaUIsQ0FBQztBQUN0RCxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssd0JBQXdCLE1BQU0sdUJBQXVCLENBQUM7QUFDbEUsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGFBQWEsTUFBTSxZQUFZLENBQUM7QUFDNUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLG9CQUFvQixNQUFNLG1CQUFtQixDQUFDO0FBQzFELE9BQU8sS0FBSyxtQkFBbUIsTUFBTSxrQkFBa0IsQ0FBQztBQUN4RCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsb0JBQW9CLElBQUksWUFBWSxFQUNwQyxtQkFBbUIsSUFBSSxXQUFXLEVBQ2xDLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsWUFBWSxJQUFJLElBQUksRUFDcEIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsZUFBZSxJQUFJLE9BQU8sR0FDM0IsQ0FBQztBQUVGLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxrQkFBa0IsTUFBTSxpQkFBaUIsQ0FBQztBQUN0RCxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssd0JBQXdCLE1BQU0sdUJBQXVCLENBQUM7QUFDbEUsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGFBQWEsTUFBTSxZQUFZLENBQUM7QUFDNUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLG9CQUFvQixNQUFNLG1CQUFtQixDQUFDO0FBQzFELE9BQU8sS0FBSyxtQkFBbUIsTUFBTSxrQkFBa0IsQ0FBQztBQUN4RCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsb0JBQW9CLElBQUksWUFBWSxFQUNwQyxtQkFBbUIsSUFBSSxXQUFXLEVBQ2xDLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsWUFBWSxJQUFJLElBQUksRUFDcEIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsZUFBZSxJQUFJLE9BQU8sR0FDM0IsQ0FBQztBQUVGLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUMifQ==

package/dist_ts/requests/secret.d.ts

@@ -0,0 +1,198 @@
+import type * as plugins from '../plugins.js';
+import type { IResolvedSecretManifestEntry, ISecretMetadata, ISecretSetAttachment, ISecretSetConsumerRolloutStatus, ISecretSetMetadata, ISecretVersionMetadata, ISecretVersionRetentionReference, TSecretDelivery, TSecretEnvironment } from '../data/secret.js';
+import type { IIdentityCredential } from '../data/user.js';
+export type TSecretMutationTarget = {
+    kind: 'service';
+    serviceId: string;
+} | {
+    kind: 'secret-set';
+    secretSetId: string;
+};
+export type TSecretValueInput = {
+    mode: 'provided';
+    value: string;
+}
+/** Server-generated runtime-only value; plaintext is never returned. */
+ | {
+    mode: 'generated';
+    bytes: 32 | 48 | 64;
+};
+export interface IReq_ListSecrets extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ListSecrets> {
+    method: 'listSecrets';
+    request: {
+        identity: IIdentityCredential;
+        target: TSecretMutationTarget;
+        environment?: TSecretEnvironment;
+    };
+    response: {
+        secrets: ISecretMetadata[];
+        /** Observable CAS fence for the selected service or SecretSet. */
+        targetSecretsRevision: number;
+    };
+}
+export interface IReq_GetSecretMetadata extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretMetadata> {
+    method: 'getSecretMetadata';
+    request: {
+        identity: IIdentityCredential;
+        secretId: string;
+    };
+    response: {
+        secret: ISecretMetadata;
+        versions: ISecretVersionMetadata[];
+    };
+}
+export interface IReq_CreateSecret extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CreateSecret> {
+    method: 'createSecret';
+    request: {
+        identity: IIdentityCredential;
+        target: TSecretMutationTarget;
+        key: string;
+        environment: TSecretEnvironment;
+        name: string;
+        description?: string;
+        tags?: Array<{
+            key: string;
+            value: string;
+        }>;
+        delivery: TSecretDelivery;
+        valueInput: TSecretValueInput;
+        expectedTargetSecretsRevision: number;
+    };
+    response: {
+        secret: ISecretMetadata;
+        version: ISecretVersionMetadata;
+        /** Post-create CAS revision for the selected target. */
+        targetSecretsRevision: number;
+    };
+}
+export interface IReq_RotateSecret extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_RotateSecret> {
+    method: 'rotateSecret';
+    request: {
+        identity: IIdentityCredential;
+        secretId: string;
+        valueInput: TSecretValueInput;
+        expectedSecretRevision: number;
+        expectedActiveVersionId?: string;
+    };
+    response: {
+        secret: ISecretMetadata;
+        version: ISecretVersionMetadata;
+    };
+}
+export interface IReq_ChangeSecretLifecycle extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ChangeSecretLifecycle> {
+    method: 'changeSecretLifecycle';
+    request: {
+        identity: IIdentityCredential;
+        secretId: string;
+        action: 'retire' | 'revoke' | 'delete' | 'request-purge';
+        expectedSecretRevision: number;
+    };
+    response: {
+        secret: ISecretMetadata;
+    };
+}
+export interface IReq_GetSecretVersionPurgePreflight extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretVersionPurgePreflight> {
+    method: 'getSecretVersionPurgePreflight';
+    request: {
+        identity: IIdentityCredential;
+        secretId: string;
+        secretVersionId: string;
+    };
+    response: {
+        purgeAllowed: boolean;
+        references: ISecretVersionRetentionReference[];
+    };
+}
+export interface IReq_ListSecretSets extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ListSecretSets> {
+    method: 'listSecretSets';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+    };
+    response: {
+        secretSets: ISecretSetMetadata[];
+    };
+}
+export interface IReq_CreateSecretSet extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CreateSecretSet> {
+    method: 'createSecretSet';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        name: string;
+        description?: string;
+    };
+    response: {
+        secretSet: ISecretSetMetadata;
+    };
+}
+export interface IReq_UpdateSecretSet extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_UpdateSecretSet> {
+    method: 'updateSecretSet';
+    request: {
+        identity: IIdentityCredential;
+        secretSetId: string;
+        name: string;
+        description?: string;
+        expectedRevision: number;
+    };
+    response: {
+        secretSet: ISecretSetMetadata;
+    };
+}
+export interface IReq_ChangeSecretSetLifecycle extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ChangeSecretSetLifecycle> {
+    method: 'changeSecretSetLifecycle';
+    request: {
+        identity: IIdentityCredential;
+        secretSetId: string;
+        action: 'retire' | 'delete';
+        expectedRevision: number;
+    };
+    response: {
+        secretSet: ISecretSetMetadata;
+    };
+}
+export interface IReq_GetSecretSetConsumerRollout extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretSetConsumerRollout> {
+    method: 'getSecretSetConsumerRollout';
+    request: {
+        identity: IIdentityCredential;
+        secretSetId: string;
+        rolloutId: string;
+        cursor?: string;
+        limit?: number;
+    };
+    response: {
+        consumers: ISecretSetConsumerRolloutStatus[];
+        nextCursor?: string;
+    };
+}
+export interface IReq_SetServiceSecretSetAttachments extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SetServiceSecretSetAttachments> {
+    method: 'setServiceSecretSetAttachments';
+    request: {
+        identity: IIdentityCredential;
+        serviceId: string;
+        attachments: ISecretSetAttachment[];
+        expectedSecretConfigurationRevision: number;
+    };
+    response: {
+        attachments: ISecretSetAttachment[];
+        /** Post-update attachment CAS revision. */
+        secretConfigurationRevision: number;
+    };
+}
+export interface ISecretResolutionPreviewCollision {
+    environment: TSecretEnvironment;
+    key: string;
+    sourceSecretIds: string[];
+    reason: 'duplicate-secret-set-key' | 'duplicate-service-key' | 'invalid-alias';
+}
+export interface IReq_PreviewServiceSecretResolution extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PreviewServiceSecretResolution> {
+    method: 'previewServiceSecretResolution';
+    request: {
+        identity: IIdentityCredential;
+        serviceId: string;
+        attachments?: ISecretSetAttachment[];
+    };
+    response: {
+        entries: IResolvedSecretManifestEntry[];
+        collisions: ISecretResolutionPreviewCollision[];
+    };
+}

package/dist_ts/requests/secret.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvc2VjcmV0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist_ts/runtime.d.ts

@@ -0,0 +1,41 @@
+import type * as plugins from './plugins.js';
+import type { IIdentityCredential, IResolvedSecretManifest, TSha256Digest } from './data/index.js';
+/**
+ * Runtime-only material. This module is exported only under the Node condition
+ * and is intentionally unreachable from the universal/browser-facing barrel.
+ */
+export interface IResolvedSecretMaterialValue {
+    secretVersionId: string;
+    value: string;
+}
+export interface IResolvedSecretMaterial {
+    schemaVersion: 1;
+    /** Full value-free manifest so the runtime can verify its canonical digest. */
+    manifest: IResolvedSecretManifest;
+    /** Plaintext values keyed only by the exact version IDs pinned by the manifest. */
+    values: IResolvedSecretMaterialValue[];
+}
+/**
+ * Verifies the immutable manifest and requires exactly one material value for
+ * every pinned version. Callers separately compare the verified manifest
+ * reference to the request and their authenticated cluster scope.
+ */
+export declare const verifyResolvedSecretMaterial: (materialArg: unknown) => Promise<boolean>;
+/**
+ * Cluster and organization are derived from the verified JWT. A caller cannot
+ * select either scope through request fields.
+ */
+export interface IReq_GetResolvedSecretMaterial extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetResolvedSecretMaterial> {
+    method: 'getResolvedSecretMaterial';
+    request: {
+        identity: IIdentityCredential;
+        serviceId: string;
+        secretRolloutId: string;
+        secretRolloutGeneration: number;
+        manifestId: string;
+        manifestDigest: TSha256Digest;
+    };
+    response: {
+        material: IResolvedSecretMaterial;
+    };
+}

package/dist_ts/runtime.js

@@ -0,0 +1,33 @@
+import { validateResolvedSecretManifest, verifyResolvedSecretManifestDigest, } from './data/secret.js';
+/**
+ * Verifies the immutable manifest and requires exactly one material value for
+ * every pinned version. Callers separately compare the verified manifest
+ * reference to the request and their authenticated cluster scope.
+ */
+export const verifyResolvedSecretMaterial = async (materialArg) => {
+    if (!materialArg || typeof materialArg !== 'object' || Array.isArray(materialArg))
+        return false;
+    const material = materialArg;
+    if (!material.manifest || !Array.isArray(material.values))
+        return false;
+    if (material.schemaVersion !== 1)
+        return false;
+    if (validateResolvedSecretManifest(material.manifest).length > 0)
+        return false;
+    if (!await verifyResolvedSecretManifestDigest(material.manifest))
+        return false;
+    if (!material.values.every((valueArg) => (Boolean(valueArg)
+        && typeof valueArg === 'object'
+        && typeof valueArg.secretVersionId === 'string'
+        && typeof valueArg.value === 'string')))
+        return false;
+    const expectedVersionIds = material.manifest.entries
+        .map((entryArg) => entryArg.secretVersionId)
+        .sort();
+    const actualVersionIds = material.values
+        .map((valueArg) => valueArg.secretVersionId)
+        .sort();
+    return new Set(actualVersionIds).size === actualVersionIds.length
+        && JSON.stringify(actualVersionIds) === JSON.stringify(expectedVersionIds);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBTUEsT0FBTyxFQUNMLDhCQUE4QixFQUM5QixrQ0FBa0MsR0FDbkMsTUFBTSxrQkFBa0IsQ0FBQztBQW1CMUI7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLEtBQUssRUFDL0MsV0FBb0IsRUFDRixFQUFFO0lBQ3BCLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDaEcsTUFBTSxRQUFRLEdBQUcsV0FBK0MsQ0FBQztJQUNqRSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3hFLElBQUksUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDL0MsSUFBSSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMvRSxJQUFJLENBQUMsTUFBTSxrQ0FBa0MsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDL0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUN2QyxPQUFPLENBQUMsUUFBUSxDQUFDO1dBQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtXQUM1QixPQUFPLFFBQVEsQ0FBQyxlQUFlLEtBQUssUUFBUTtXQUM1QyxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUN0QyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDakIsTUFBTSxrQkFBa0IsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU87U0FDakQsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDO1NBQzNDLElBQUksRUFBRSxDQUFDO0lBQ1YsTUFBTSxnQkFBZ0IsR0FBRyxRQUFRLENBQUMsTUFBTTtTQUNyQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7U0FDM0MsSUFBSSxFQUFFLENBQUM7SUFDVixPQUFPLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUMsSUFBSSxLQUFLLGdCQUFnQixDQUFDLE1BQU07V0FDNUQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUMvRSxDQUFDLENBQUMifQ==

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "19.7.0",
+  "version": "20.0.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
-    ".": "./dist_ts/index.js"
+    ".": {
+      "types": "./dist_ts/index.d.ts",
+      "default": "./dist_ts/index.js"
+    },
+    "./runtime": {
+      "types": "./dist_ts/runtime.d.ts",
+      "node": "./dist_ts/runtime.js"
+    }
   },
   "type": "module",
   "author": "Task Venture Capital GmbH",

package/readme.md

@@ -137,7 +137,6 @@ const service: data.IService = {
     environment: {
       NODE_ENV: 'production',
     },
-    secretBundleId: 'secretbundle-api',
     serviceCategory: 'workload',
     deploymentStrategy: 'limited-replicas',
     scaleFactor: 2,
@@ -186,7 +185,17 @@ Common data contracts include:
 - Service port contracts including `IServiceTargetPort`, `IServiceDomainRoute`, and `IServicePublicPortMapping` for canonical backend targets, domain target references, and edge/Coretraffic TCP/UDP public exposure.
 - `IDomain`, `IDnsEntry`, and traffic contracts for routing and DNS management.
 - Traffic and gateway route contracts including `ICoretrafficPortRouteConfig`, routing `portRoutes`, and `IGatewayClientRoute` client-owned route views. Gateway route intent supports optional match `domains`, `transport`, and `remoteIngress`, plus explicit route `priority` and `managedRouteKind`. Ownership can combine `hostname` with `routeRef` so a normal route and a path-specific managed route for the same hostname reconcile independently.
-- `ISecretBundle` and `ISecretGroup` for secret ownership and shared secret groups.
+- Value-free `ISecretMetadata`, `ISecretVersionMetadata`, and `ISecretSetMetadata`
+  contracts for operator views, plus exact-version `IResolvedSecretManifest`
+  contracts for cluster delivery. Manifest helpers enforce canonical shared
+  digests, globally unique environment/file delivery targets, and per-cluster
+  desired/applied/previous-accepted rollout state. `ISecretBundle` and
+  `ISecretGroup` remain legacy compatibility contracts during the versioned
+  migration.
+  `listSecrets` exposes the dedicated `targetSecretsRevision` CAS fence;
+  `createSecret` consumes and returns that fence, while
+  `setServiceSecretSetAttachments` returns the independent
+  `secretConfigurationRevision`. Generic service writes own neither revision.
 - Mail gateway contracts for domain authorities, address bindings, WorkApp bindings, managed SMTP/API credentials, spool items, delivery journals, and inbound/outbound message payloads.
 - Service-level mail configuration through `IService.data.mail`, including per-address inbound `smtpForward` settings and outbound credential metadata. Cloudly settings include dcrouter gateway, SMTP submission, and inbound forward-target keys for reconciling those bindings.
 - Web Push contracts for environment-specific service bindings, public credential state, public VAPID key rotation metadata, privacy-minimal notification signals, and redacted delivery state. Subscription endpoints, browser key material, provider ciphertext, VAPID private keys, and credential secrets are intentionally absent from public binding and status DTOs.
@@ -345,7 +354,7 @@ const provisioning: requests.gateway.IReq_ProvisionGatewayClientCredential['requ
 };
 ```
 
-`getGatewayClientContext` returns effective live policy. A `gatewayClient` role necessarily includes the credential ID, bound client ID/type, and `policyGeneration`; consumers should reject admin/operator or mismatched contexts rather than falling back to a caller-supplied owner ID. `getGatewayClientMailOverview` provides an owner-scoped domain and recent-message summary. Cloudly therefore uses only `dcrouterGatewayApiToken`; the former `dcrouterOpsApiToken` setting is not part of `data.ICloudlySettings`.
+`getGatewayClientContext` returns effective live policy. A `gatewayClient` role necessarily includes the credential ID, bound client ID/type, and `policyGeneration`; consumers should reject admin/operator or mismatched contexts rather than falling back to a caller-supplied owner ID. `getGatewayClientMailOverview` provides an owner-scoped domain and recent-message summary. `getGatewayClientMailDomainCount` derives ownership exclusively from the authenticating gateway credential and returns `{ count: number }` for its distinct configured mail domains. Cloudly therefore uses only `dcrouterGatewayApiToken`; the former `dcrouterOpsApiToken` setting is not part of `data.ICloudlySettings`.
 
 Request groups are exported by product area:
 
@@ -374,6 +383,7 @@ Request groups are exported by product area:
 - `requests.node`
 - `requests.platform`
 - `requests.routing`
+- `requests.secret`
 - `requests.secretbundle`
 - `requests.secretgroup`
 - `requests.server`
@@ -384,6 +394,30 @@ Request groups are exported by product area:
 - `requests.version`
 - `requests.webpush`
 
+Secret material response contracts are not exported from the universal
+browser-facing entrypoint. Node runtimes import the isolated subpath:
+
+```typescript
+import {
+  verifyResolvedSecretMaterial,
+} from '@serve.zone/interfaces/runtime';
+import type {
+  IReq_GetResolvedSecretMaterial,
+  IResolvedSecretMaterial,
+} from '@serve.zone/interfaces/runtime';
+
+async function acceptMaterial(material: IResolvedSecretMaterial) {
+  if (!await verifyResolvedSecretMaterial(material)) {
+    throw new Error('secret material does not match its immutable manifest');
+  }
+}
+```
+
+Runtime material is shaped as `{ manifest, values }`. The helper verifies the
+canonical manifest digest and exact one-to-one version-ID coverage before
+plaintext use. The runtime must separately compare the verified manifest
+reference and cluster to its request and authenticated deployment scope.
+
 ## Platform Contracts
 
 Use `platform` for current platform-service capabilities and application-facing platform RPCs.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '19.7.0',
+  version: '20.0.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/immutableimage.ts

@@ -66,6 +66,8 @@ export interface ICoreflowRuntimeCapabilities {
   immutableImageDeploymentVersion: 1;
   /** Coreflow can answer the versioned, node-scoped Corestore inventory probe. */
   corestoreInventoryVersion?: 1;
+  /** Coreflow can consume exact, cluster-scoped resolved secret manifests. */
+  secretManifestVersion?: 1;
 }
 
 /**

package/ts/data/index.ts

@@ -19,6 +19,7 @@ export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';
 export * from './registry.js';
+export * from './secret.js';
 export * from './secretbundle.js';
 export * from './secretgroup.js';
 export * from './baremetal.js';