@serve.zone/interfaces 19.8.0 → 20.1.0

package/dist_ts/private/canonicaljson.d.ts

@@ -0,0 +1,14 @@
+export declare const strictCanonicalJsonRules: Readonly<{
+    version: 1;
+    encoding: "utf-8";
+    objectKeyOrdering: "utf-16-code-unit-ascending";
+    arrayOrdering: "preserved-dense";
+    unicodeNormalization: "preserved";
+    numberEncoding: "safe-integer-json-no-negative-zero";
+    digest: "sha256-lowercase-hex";
+}>;
+export type TCanonicalJsonFailure = (reasonArg: string) => never;
+export declare const canonicalizeStrictJson: (valueArg: unknown, failArg: TCanonicalJsonFailure, fieldNameArg?: string) => string;
+export declare const createSha256Hex: (contentsArg: Uint8Array, failArg: TCanonicalJsonFailure) => Promise<string>;
+export declare const createCanonicalJsonSha256Hex: (canonicalJsonArg: string, failArg: TCanonicalJsonFailure) => Promise<string>;
+export declare const deepFreezeValue: <T>(valueArg: T, seenArg?: WeakSet<object>) => T;

package/dist_ts/private/canonicaljson.js

@@ -0,0 +1,154 @@
+export const strictCanonicalJsonRules = Object.freeze({
+    version: 1,
+    encoding: 'utf-8',
+    objectKeyOrdering: 'utf-16-code-unit-ascending',
+    arrayOrdering: 'preserved-dense',
+    unicodeNormalization: 'preserved',
+    numberEncoding: 'safe-integer-json-no-negative-zero',
+    digest: 'sha256-lowercase-hex',
+});
+const assertUnicodeScalarString = (valueArg, fieldNameArg, failArg) => {
+    for (let index = 0; index < valueArg.length; index++) {
+        const codeUnit = valueArg.charCodeAt(index);
+        if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+            const followingCodeUnit = valueArg.charCodeAt(index + 1);
+            if (!Number.isInteger(followingCodeUnit) ||
+                followingCodeUnit < 0xdc00 ||
+                followingCodeUnit > 0xdfff) {
+                failArg(`${fieldNameArg} must not contain an unpaired UTF-16 surrogate`);
+            }
+            index++;
+            continue;
+        }
+        if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+            failArg(`${fieldNameArg} must not contain an unpaired UTF-16 surrogate`);
+        }
+    }
+};
+const readStrictRecord = (valueArg, fieldNameArg, failArg) => {
+    const prototype = Object.getPrototypeOf(valueArg);
+    if (prototype !== Object.prototype && prototype !== null) {
+        return failArg(`${fieldNameArg} must be a plain object`);
+    }
+    const record = valueArg;
+    const ownKeys = Reflect.ownKeys(record);
+    if (ownKeys.some((keyArg) => typeof keyArg !== 'string')) {
+        return failArg(`${fieldNameArg} must not contain symbol keys`);
+    }
+    for (const key of ownKeys) {
+        const descriptor = Object.getOwnPropertyDescriptor(record, key);
+        if (!descriptor ||
+            !descriptor.enumerable ||
+            !Object.hasOwn(descriptor, 'value')) {
+            return failArg(`${fieldNameArg} must contain enumerable data properties only`);
+        }
+    }
+    return record;
+};
+const readStrictArray = (valueArg, fieldNameArg, failArg) => {
+    if (Object.getPrototypeOf(valueArg) !== Array.prototype) {
+        return failArg(`${fieldNameArg} must be a dense plain array`);
+    }
+    for (let index = 0; index < valueArg.length; index++) {
+        if (!Object.hasOwn(valueArg, index)) {
+            return failArg(`${fieldNameArg} must not contain sparse entries`);
+        }
+        const descriptor = Object.getOwnPropertyDescriptor(valueArg, String(index));
+        if (!descriptor ||
+            !descriptor.enumerable ||
+            !Object.hasOwn(descriptor, 'value')) {
+            return failArg(`${fieldNameArg} must contain enumerable data entries only`);
+        }
+    }
+    for (const key of Reflect.ownKeys(valueArg)) {
+        if (key === 'length') {
+            continue;
+        }
+        if (typeof key !== 'string' ||
+            !/^(?:0|[1-9][0-9]*)$/.test(key) ||
+            Number(key) >= valueArg.length) {
+            return failArg(`${fieldNameArg} must not contain extra properties`);
+        }
+    }
+    return valueArg;
+};
+export const canonicalizeStrictJson = (valueArg, failArg, fieldNameArg = 'canonical JSON input') => {
+    const ancestors = new Set();
+    const visit = (currentValueArg, currentFieldNameArg) => {
+        if (currentValueArg === null) {
+            return 'null';
+        }
+        if (typeof currentValueArg === 'boolean') {
+            return currentValueArg ? 'true' : 'false';
+        }
+        if (typeof currentValueArg === 'string') {
+            assertUnicodeScalarString(currentValueArg, currentFieldNameArg, failArg);
+            return JSON.stringify(currentValueArg);
+        }
+        if (typeof currentValueArg === 'number') {
+            if (!Number.isSafeInteger(currentValueArg) ||
+                Object.is(currentValueArg, -0)) {
+                return failArg(`${currentFieldNameArg} must contain safe integers only`);
+            }
+            return String(currentValueArg);
+        }
+        if (!currentValueArg || typeof currentValueArg !== 'object') {
+            return failArg(`${currentFieldNameArg} contains a non-JSON value`);
+        }
+        if (ancestors.has(currentValueArg)) {
+            return failArg(`${currentFieldNameArg} contains a cycle`);
+        }
+        ancestors.add(currentValueArg);
+        try {
+            if (Array.isArray(currentValueArg)) {
+                const array = readStrictArray(currentValueArg, currentFieldNameArg, failArg);
+                return `[${array
+                    .map((entryArg, indexArg) => visit(entryArg, `${currentFieldNameArg}[${indexArg}]`))
+                    .join(',')}]`;
+            }
+            const record = readStrictRecord(currentValueArg, currentFieldNameArg, failArg);
+            const keys = Object.keys(record).sort((leftArg, rightArg) => {
+                return leftArg < rightArg ? -1 : leftArg > rightArg ? 1 : 0;
+            });
+            return `{${keys
+                .map((keyArg) => {
+                assertUnicodeScalarString(keyArg, `${currentFieldNameArg} key`, failArg);
+                return `${JSON.stringify(keyArg)}:${visit(record[keyArg], `${currentFieldNameArg}.${keyArg}`)}`;
+            })
+                .join(',')}}`;
+        }
+        finally {
+            ancestors.delete(currentValueArg);
+        }
+    };
+    return visit(valueArg, fieldNameArg);
+};
+export const createSha256Hex = async (contentsArg, failArg) => {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        return failArg('Web Crypto SHA-256 is unavailable in this runtime');
+    }
+    const digest = await subtle.digest('SHA-256', new Uint8Array(contentsArg));
+    return Array.from(new Uint8Array(digest), (byteArg) => byteArg.toString(16).padStart(2, '0')).join('');
+};
+export const createCanonicalJsonSha256Hex = async (canonicalJsonArg, failArg) => {
+    return createSha256Hex(new TextEncoder().encode(canonicalJsonArg), failArg);
+};
+export const deepFreezeValue = (valueArg, seenArg = new WeakSet()) => {
+    if (!valueArg || typeof valueArg !== 'object') {
+        return valueArg;
+    }
+    const object = valueArg;
+    if (ArrayBuffer.isView(object) || seenArg.has(object)) {
+        return valueArg;
+    }
+    seenArg.add(object);
+    for (const key of Reflect.ownKeys(object)) {
+        const descriptor = Object.getOwnPropertyDescriptor(object, key);
+        if (descriptor && Object.hasOwn(descriptor, 'value')) {
+            deepFreezeValue(descriptor.value, seenArg);
+        }
+    }
+    return Object.freeze(valueArg);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2Fub25pY2FsanNvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3ByaXZhdGUvY2Fub25pY2FsanNvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3BELE9BQU8sRUFBRSxDQUFVO0lBQ25CLFFBQVEsRUFBRSxPQUFnQjtJQUMxQixpQkFBaUIsRUFBRSw0QkFBcUM7SUFDeEQsYUFBYSxFQUFFLGlCQUEwQjtJQUN6QyxvQkFBb0IsRUFBRSxXQUFvQjtJQUMxQyxjQUFjLEVBQUUsb0NBQTZDO0lBQzdELE1BQU0sRUFBRSxzQkFBK0I7Q0FDeEMsQ0FBQyxDQUFDO0FBSUgsTUFBTSx5QkFBeUIsR0FBRyxDQUNoQyxRQUFnQixFQUNoQixZQUFvQixFQUNwQixPQUE4QixFQUN4QixFQUFFO0lBQ1IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLFFBQVEsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNyRCxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzVDLElBQUksUUFBUSxJQUFJLE1BQU0sSUFBSSxRQUFRLElBQUksTUFBTSxFQUFFLENBQUM7WUFDN0MsTUFBTSxpQkFBaUIsR0FBRyxRQUFRLENBQUMsVUFBVSxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztZQUN6RCxJQUNFLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQztnQkFDcEMsaUJBQWlCLEdBQUcsTUFBTTtnQkFDMUIsaUJBQWlCLEdBQUcsTUFBTSxFQUMxQixDQUFDO2dCQUNELE9BQU8sQ0FBQyxHQUFHLFlBQVksZ0RBQWdELENBQUMsQ0FBQztZQUMzRSxDQUFDO1lBQ0QsS0FBSyxFQUFFLENBQUM7WUFDUixTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksUUFBUSxJQUFJLE1BQU0sSUFBSSxRQUFRLElBQUksTUFBTSxFQUFFLENBQUM7WUFDN0MsT0FBTyxDQUFDLEdBQUcsWUFBWSxnREFBZ0QsQ0FBQyxDQUFDO1FBQzNFLENBQUM7SUFDSCxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxnQkFBZ0IsR0FBRyxDQUN2QixRQUFnQixFQUNoQixZQUFvQixFQUNwQixPQUE4QixFQUNMLEVBQUU7SUFDM0IsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsRCxJQUFJLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxJQUFJLFNBQVMsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUN6RCxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVkseUJBQXlCLENBQUMsQ0FBQztJQUMzRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsUUFBbUMsQ0FBQztJQUNuRCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3hDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsT0FBTyxNQUFNLEtBQUssUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN6RCxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksK0JBQStCLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsS0FBSyxNQUFNLEdBQUcsSUFBSSxPQUFtQixFQUFFLENBQUM7UUFDdEMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNoRSxJQUNFLENBQUMsVUFBVTtZQUNYLENBQUMsVUFBVSxDQUFDLFVBQVU7WUFDdEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsRUFDbkMsQ0FBQztZQUNELE9BQU8sT0FBTyxDQUNaLEdBQUcsWUFBWSwrQ0FBK0MsQ0FDL0QsQ0FBQztRQUNKLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FDdEIsUUFBbUIsRUFDbkIsWUFBb0IsRUFDcEIsT0FBOEIsRUFDbkIsRUFBRTtJQUNiLElBQUksTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDeEQsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLDhCQUE4QixDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDckQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDcEMsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLGtDQUFrQyxDQUFDLENBQUM7UUFDcEUsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDNUUsSUFDRSxDQUFDLFVBQVU7WUFDWCxDQUFDLFVBQVUsQ0FBQyxVQUFVO1lBQ3RCLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLEVBQ25DLENBQUM7WUFDRCxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksNENBQTRDLENBQUMsQ0FBQztRQUM5RSxDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzVDLElBQUksR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3JCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsSUFDRSxPQUFPLEdBQUcsS0FBSyxRQUFRO1lBQ3ZCLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQztZQUNoQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sRUFDOUIsQ0FBQztZQUNELE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSxvQ0FBb0MsQ0FBQyxDQUFDO1FBQ3RFLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FDcEMsUUFBaUIsRUFDakIsT0FBOEIsRUFDOUIsWUFBWSxHQUFHLHNCQUFzQixFQUM3QixFQUFFO0lBQ1YsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUVwQyxNQUFNLEtBQUssR0FBRyxDQUFDLGVBQXdCLEVBQUUsbUJBQTJCLEVBQVUsRUFBRTtRQUM5RSxJQUFJLGVBQWUsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUM3QixPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO1FBQ0QsSUFBSSxPQUFPLGVBQWUsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN6QyxPQUFPLGVBQWUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUM7UUFDNUMsQ0FBQztRQUNELElBQUksT0FBTyxlQUFlLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDeEMseUJBQXlCLENBQUMsZUFBZSxFQUFFLG1CQUFtQixFQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQ3pFLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUN6QyxDQUFDO1FBQ0QsSUFBSSxPQUFPLGVBQWUsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUN4QyxJQUNFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxlQUFlLENBQUM7Z0JBQ3RDLE1BQU0sQ0FBQyxFQUFFLENBQUMsZUFBZSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQzlCLENBQUM7Z0JBQ0QsT0FBTyxPQUFPLENBQUMsR0FBRyxtQkFBbUIsa0NBQWtDLENBQUMsQ0FBQztZQUMzRSxDQUFDO1lBQ0QsT0FBTyxNQUFNLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUNELElBQUksQ0FBQyxlQUFlLElBQUksT0FBTyxlQUFlLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDNUQsT0FBTyxPQUFPLENBQUMsR0FBRyxtQkFBbUIsNEJBQTRCLENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBQ0QsSUFBSSxTQUFTLENBQUMsR0FBRyxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDbkMsT0FBTyxPQUFPLENBQUMsR0FBRyxtQkFBbUIsbUJBQW1CLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBRUQsU0FBUyxDQUFDLEdBQUcsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMvQixJQUFJLENBQUM7WUFDSCxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztnQkFDbkMsTUFBTSxLQUFLLEdBQUcsZUFBZSxDQUMzQixlQUFlLEVBQ2YsbUJBQW1CLEVBQ25CLE9BQU8sQ0FDUixDQUFDO2dCQUNGLE9BQU8sSUFBSSxLQUFLO3FCQUNiLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUMxQixLQUFLLENBQUMsUUFBUSxFQUFFLEdBQUcsbUJBQW1CLElBQUksUUFBUSxHQUFHLENBQUMsQ0FDdkQ7cUJBQ0EsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUM7WUFDbEIsQ0FBQztZQUVELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUM3QixlQUFlLEVBQ2YsbUJBQW1CLEVBQ25CLE9BQU8sQ0FDUixDQUFDO1lBQ0YsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUU7Z0JBQzFELE9BQU8sT0FBTyxHQUFHLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sR0FBRyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzlELENBQUMsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxJQUFJLElBQUk7aUJBQ1osR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUU7Z0JBQ2QseUJBQXlCLENBQ3ZCLE1BQU0sRUFDTixHQUFHLG1CQUFtQixNQUFNLEVBQzVCLE9BQU8sQ0FDUixDQUFDO2dCQUNGLE9BQU8sR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssQ0FDdkMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUNkLEdBQUcsbUJBQW1CLElBQUksTUFBTSxFQUFFLENBQ25DLEVBQUUsQ0FBQztZQUNOLENBQUMsQ0FBQztpQkFDRCxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztRQUNsQixDQUFDO2dCQUFTLENBQUM7WUFDVCxTQUFTLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ3BDLENBQUM7SUFDSCxDQUFDLENBQUM7SUFFRixPQUFPLEtBQUssQ0FBQyxRQUFRLEVBQUUsWUFBWSxDQUFDLENBQUM7QUFDdkMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLEtBQUssRUFDbEMsV0FBdUIsRUFDdkIsT0FBOEIsRUFDYixFQUFFO0lBQ25CLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDO0lBQ3pDLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNaLE9BQU8sT0FBTyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMzRSxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUNwRCxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQ3RDLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBQ2IsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsS0FBSyxFQUMvQyxnQkFBd0IsRUFDeEIsT0FBOEIsRUFDYixFQUFFO0lBQ25CLE9BQU8sZUFBZSxDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsT0FBTyxDQUFDLENBQUM7QUFDOUUsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQzdCLFFBQVcsRUFDWCxVQUFVLElBQUksT0FBTyxFQUFVLEVBQzVCLEVBQUU7SUFDTCxJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzlDLE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxRQUFrQixDQUFDO0lBQ2xDLElBQUksV0FBVyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDdEQsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUNELE9BQU8sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDcEIsS0FBSyxNQUFNLEdBQUcsSUFBSSxPQUFPLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDMUMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNoRSxJQUFJLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ3JELGVBQWUsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQzdDLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2pDLENBQUMsQ0FBQyJ9

package/dist_ts/requests/index.d.ts

@@ -23,6 +23,7 @@ import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
+import * as secretRequests from './secret.js';
 import * as secretBundleRequests from './secretbundle.js';
 import * as secretGroupRequests from './secretgroup.js';
 import * as serverRequests from './server.js';
@@ -32,7 +33,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -24,6 +24,7 @@ import * as networkRequests from './network.js';
 import * as nodeRequests from './node.js';
 import * as platformRequests from './platform.js';
 import * as routingRequests from './routing.js';
+import * as secretRequests from './secret.js';
 import * as secretBundleRequests from './secretbundle.js';
 import * as secretGroupRequests from './secretgroup.js';
 import * as serverRequests from './server.js';
@@ -33,9 +34,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, platformRequests as platform, routingRequests as routing, secretRequests as secret, secretBundleRequests as secretbundle, secretGroupRequests as secretgroup, serverRequests as server, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxrQkFBa0IsTUFBTSxpQkFBaUIsQ0FBQztBQUN0RCxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssd0JBQXdCLE1BQU0sdUJBQXVCLENBQUM7QUFDbEUsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGFBQWEsTUFBTSxZQUFZLENBQUM7QUFDNUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLG9CQUFvQixNQUFNLG1CQUFtQixDQUFDO0FBQzFELE9BQU8sS0FBSyxtQkFBbUIsTUFBTSxrQkFBa0IsQ0FBQztBQUN4RCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsb0JBQW9CLElBQUksWUFBWSxFQUNwQyxtQkFBbUIsSUFBSSxXQUFXLEVBQ2xDLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsWUFBWSxJQUFJLElBQUksRUFDcEIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsZUFBZSxJQUFJLE9BQU8sR0FDM0IsQ0FBQztBQUVGLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxrQkFBa0IsTUFBTSxpQkFBaUIsQ0FBQztBQUN0RCxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssd0JBQXdCLE1BQU0sdUJBQXVCLENBQUM7QUFDbEUsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGFBQWEsTUFBTSxZQUFZLENBQUM7QUFDNUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLG9CQUFvQixNQUFNLG1CQUFtQixDQUFDO0FBQzFELE9BQU8sS0FBSyxtQkFBbUIsTUFBTSxrQkFBa0IsQ0FBQztBQUN4RCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixjQUFjLElBQUksTUFBTSxFQUN4QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsb0JBQW9CLElBQUksWUFBWSxFQUNwQyxtQkFBbUIsSUFBSSxXQUFXLEVBQ2xDLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsWUFBWSxJQUFJLElBQUksRUFDcEIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsZUFBZSxJQUFJLE9BQU8sR0FDM0IsQ0FBQztBQUVGLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUMifQ==

package/dist_ts/requests/secret.d.ts

@@ -0,0 +1,198 @@
+import type * as plugins from '../plugins.js';
+import type { IResolvedSecretManifestEntry, ISecretMetadata, ISecretSetAttachment, ISecretSetConsumerRolloutStatus, ISecretSetMetadata, ISecretVersionMetadata, ISecretVersionRetentionReference, TSecretDelivery, TSecretEnvironment } from '../data/secret.js';
+import type { IIdentityCredential } from '../data/user.js';
+export type TSecretMutationTarget = {
+    kind: 'service';
+    serviceId: string;
+} | {
+    kind: 'secret-set';
+    secretSetId: string;
+};
+export type TSecretValueInput = {
+    mode: 'provided';
+    value: string;
+}
+/** Server-generated runtime-only value; plaintext is never returned. */
+ | {
+    mode: 'generated';
+    bytes: 32 | 48 | 64;
+};
+export interface IReq_ListSecrets extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ListSecrets> {
+    method: 'listSecrets';
+    request: {
+        identity: IIdentityCredential;
+        target: TSecretMutationTarget;
+        environment?: TSecretEnvironment;
+    };
+    response: {
+        secrets: ISecretMetadata[];
+        /** Observable CAS fence for the selected service or SecretSet. */
+        targetSecretsRevision: number;
+    };
+}
+export interface IReq_GetSecretMetadata extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretMetadata> {
+    method: 'getSecretMetadata';
+    request: {
+        identity: IIdentityCredential;
+        secretId: string;
+    };
+    response: {
+        secret: ISecretMetadata;
+        versions: ISecretVersionMetadata[];
+    };
+}
+export interface IReq_CreateSecret extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CreateSecret> {
+    method: 'createSecret';
+    request: {
+        identity: IIdentityCredential;
+        target: TSecretMutationTarget;
+        key: string;
+        environment: TSecretEnvironment;
+        name: string;
+        description?: string;
+        tags?: Array<{
+            key: string;
+            value: string;
+        }>;
+        delivery: TSecretDelivery;
+        valueInput: TSecretValueInput;
+        expectedTargetSecretsRevision: number;
+    };
+    response: {
+        secret: ISecretMetadata;
+        version: ISecretVersionMetadata;
+        /** Post-create CAS revision for the selected target. */
+        targetSecretsRevision: number;
+    };
+}
+export interface IReq_RotateSecret extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_RotateSecret> {
+    method: 'rotateSecret';
+    request: {
+        identity: IIdentityCredential;
+        secretId: string;
+        valueInput: TSecretValueInput;
+        expectedSecretRevision: number;
+        expectedActiveVersionId?: string;
+    };
+    response: {
+        secret: ISecretMetadata;
+        version: ISecretVersionMetadata;
+    };
+}
+export interface IReq_ChangeSecretLifecycle extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ChangeSecretLifecycle> {
+    method: 'changeSecretLifecycle';
+    request: {
+        identity: IIdentityCredential;
+        secretId: string;
+        action: 'retire' | 'revoke' | 'delete' | 'request-purge';
+        expectedSecretRevision: number;
+    };
+    response: {
+        secret: ISecretMetadata;
+    };
+}
+export interface IReq_GetSecretVersionPurgePreflight extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretVersionPurgePreflight> {
+    method: 'getSecretVersionPurgePreflight';
+    request: {
+        identity: IIdentityCredential;
+        secretId: string;
+        secretVersionId: string;
+    };
+    response: {
+        purgeAllowed: boolean;
+        references: ISecretVersionRetentionReference[];
+    };
+}
+export interface IReq_ListSecretSets extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ListSecretSets> {
+    method: 'listSecretSets';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+    };
+    response: {
+        secretSets: ISecretSetMetadata[];
+    };
+}
+export interface IReq_CreateSecretSet extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CreateSecretSet> {
+    method: 'createSecretSet';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        name: string;
+        description?: string;
+    };
+    response: {
+        secretSet: ISecretSetMetadata;
+    };
+}
+export interface IReq_UpdateSecretSet extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_UpdateSecretSet> {
+    method: 'updateSecretSet';
+    request: {
+        identity: IIdentityCredential;
+        secretSetId: string;
+        name: string;
+        description?: string;
+        expectedRevision: number;
+    };
+    response: {
+        secretSet: ISecretSetMetadata;
+    };
+}
+export interface IReq_ChangeSecretSetLifecycle extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ChangeSecretSetLifecycle> {
+    method: 'changeSecretSetLifecycle';
+    request: {
+        identity: IIdentityCredential;
+        secretSetId: string;
+        action: 'retire' | 'delete';
+        expectedRevision: number;
+    };
+    response: {
+        secretSet: ISecretSetMetadata;
+    };
+}
+export interface IReq_GetSecretSetConsumerRollout extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretSetConsumerRollout> {
+    method: 'getSecretSetConsumerRollout';
+    request: {
+        identity: IIdentityCredential;
+        secretSetId: string;
+        rolloutId: string;
+        cursor?: string;
+        limit?: number;
+    };
+    response: {
+        consumers: ISecretSetConsumerRolloutStatus[];
+        nextCursor?: string;
+    };
+}
+export interface IReq_SetServiceSecretSetAttachments extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SetServiceSecretSetAttachments> {
+    method: 'setServiceSecretSetAttachments';
+    request: {
+        identity: IIdentityCredential;
+        serviceId: string;
+        attachments: ISecretSetAttachment[];
+        expectedSecretConfigurationRevision: number;
+    };
+    response: {
+        attachments: ISecretSetAttachment[];
+        /** Post-update attachment CAS revision. */
+        secretConfigurationRevision: number;
+    };
+}
+export interface ISecretResolutionPreviewCollision {
+    environment: TSecretEnvironment;
+    key: string;
+    sourceSecretIds: string[];
+    reason: 'duplicate-secret-set-key' | 'duplicate-service-key' | 'invalid-alias';
+}
+export interface IReq_PreviewServiceSecretResolution extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PreviewServiceSecretResolution> {
+    method: 'previewServiceSecretResolution';
+    request: {
+        identity: IIdentityCredential;
+        serviceId: string;
+        attachments?: ISecretSetAttachment[];
+    };
+    response: {
+        entries: IResolvedSecretManifestEntry[];
+        collisions: ISecretResolutionPreviewCollision[];
+    };
+}

package/dist_ts/requests/secret.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvc2VjcmV0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist_ts/runtime.d.ts

@@ -0,0 +1,41 @@
+import type * as plugins from './plugins.js';
+import type { IIdentityCredential, IResolvedSecretManifest, TSha256Digest } from './data/index.js';
+/**
+ * Runtime-only material. This module is exported only under the Node condition
+ * and is intentionally unreachable from the universal/browser-facing barrel.
+ */
+export interface IResolvedSecretMaterialValue {
+    secretVersionId: string;
+    value: string;
+}
+export interface IResolvedSecretMaterial {
+    schemaVersion: 1;
+    /** Full value-free manifest so the runtime can verify its canonical digest. */
+    manifest: IResolvedSecretManifest;
+    /** Plaintext values keyed only by the exact version IDs pinned by the manifest. */
+    values: IResolvedSecretMaterialValue[];
+}
+/**
+ * Verifies the immutable manifest and requires exactly one material value for
+ * every pinned version. Callers separately compare the verified manifest
+ * reference to the request and their authenticated cluster scope.
+ */
+export declare const verifyResolvedSecretMaterial: (materialArg: unknown) => Promise<boolean>;
+/**
+ * Cluster and organization are derived from the verified JWT. A caller cannot
+ * select either scope through request fields.
+ */
+export interface IReq_GetResolvedSecretMaterial extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetResolvedSecretMaterial> {
+    method: 'getResolvedSecretMaterial';
+    request: {
+        identity: IIdentityCredential;
+        serviceId: string;
+        secretRolloutId: string;
+        secretRolloutGeneration: number;
+        manifestId: string;
+        manifestDigest: TSha256Digest;
+    };
+    response: {
+        material: IResolvedSecretMaterial;
+    };
+}

package/dist_ts/runtime.js

@@ -0,0 +1,33 @@
+import { validateResolvedSecretManifest, verifyResolvedSecretManifestDigest, } from './data/secret.js';
+/**
+ * Verifies the immutable manifest and requires exactly one material value for
+ * every pinned version. Callers separately compare the verified manifest
+ * reference to the request and their authenticated cluster scope.
+ */
+export const verifyResolvedSecretMaterial = async (materialArg) => {
+    if (!materialArg || typeof materialArg !== 'object' || Array.isArray(materialArg))
+        return false;
+    const material = materialArg;
+    if (!material.manifest || !Array.isArray(material.values))
+        return false;
+    if (material.schemaVersion !== 1)
+        return false;
+    if (validateResolvedSecretManifest(material.manifest).length > 0)
+        return false;
+    if (!await verifyResolvedSecretManifestDigest(material.manifest))
+        return false;
+    if (!material.values.every((valueArg) => (Boolean(valueArg)
+        && typeof valueArg === 'object'
+        && typeof valueArg.secretVersionId === 'string'
+        && typeof valueArg.value === 'string')))
+        return false;
+    const expectedVersionIds = material.manifest.entries
+        .map((entryArg) => entryArg.secretVersionId)
+        .sort();
+    const actualVersionIds = material.values
+        .map((valueArg) => valueArg.secretVersionId)
+        .sort();
+    return new Set(actualVersionIds).size === actualVersionIds.length
+        && JSON.stringify(actualVersionIds) === JSON.stringify(expectedVersionIds);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBTUEsT0FBTyxFQUNMLDhCQUE4QixFQUM5QixrQ0FBa0MsR0FDbkMsTUFBTSxrQkFBa0IsQ0FBQztBQW1CMUI7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLEtBQUssRUFDL0MsV0FBb0IsRUFDRixFQUFFO0lBQ3BCLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDaEcsTUFBTSxRQUFRLEdBQUcsV0FBK0MsQ0FBQztJQUNqRSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3hFLElBQUksUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDL0MsSUFBSSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMvRSxJQUFJLENBQUMsTUFBTSxrQ0FBa0MsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDL0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUN2QyxPQUFPLENBQUMsUUFBUSxDQUFDO1dBQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtXQUM1QixPQUFPLFFBQVEsQ0FBQyxlQUFlLEtBQUssUUFBUTtXQUM1QyxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUN0QyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDakIsTUFBTSxrQkFBa0IsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU87U0FDakQsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDO1NBQzNDLElBQUksRUFBRSxDQUFDO0lBQ1YsTUFBTSxnQkFBZ0IsR0FBRyxRQUFRLENBQUMsTUFBTTtTQUNyQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7U0FDM0MsSUFBSSxFQUFFLENBQUM7SUFDVixPQUFPLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUMsSUFBSSxLQUFLLGdCQUFnQixDQUFDLE1BQU07V0FDNUQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUMvRSxDQUFDLENBQUMifQ==

package/package.json

@@ -1,10 +1,17 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "19.8.0",
+  "version": "20.1.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
-    ".": "./dist_ts/index.js"
+    ".": {
+      "types": "./dist_ts/index.d.ts",
+      "default": "./dist_ts/index.js"
+    },
+    "./runtime": {
+      "types": "./dist_ts/runtime.d.ts",
+      "node": "./dist_ts/runtime.js"
+    }
   },
   "type": "module",
   "author": "Task Venture Capital GmbH",