@serve.zone/interfaces 20.0.0 → 20.2.0

package/readme.md

@@ -120,6 +120,130 @@ must reject unknown manifest fields and unsupported required feature IDs before
 provisioning. Legacy `volumes` and `platformRequirements.s3` remain deprecated
 inputs for strict resolver normalization only.
 
+`platform.storagemigration` defines the provider-neutral cutover contract for a
+named object-storage binding. Corestore atomically owns and fences the source
+binding after validating a distinct, unfenced active-object snapshot. Onebox
+only receives a held candidate, stages that exact candidate, stops the matching
+workload generation, and attests the quiesced state. The candidate cannot start
+until `destinationBindingStartAuthorized` is true. Corestore continues returning
+`consumerAction: 'startDestination'` until Onebox submits the mutation-fenced
+consumer activation request and the acknowledgement becomes durable evidence.
+Candidate-issued abort tombstones authorize only `startSource` and never retain
+the staged candidate binding.
+
+Every migration DTO and status has an exact, versioned runtime normalizer.
+Unknown fields, provider or pool identifiers, unbounded strings, unsafe
+integers, stale mutation revisions, identity drift, and lifecycle-inconsistent
+fields are rejected. Migration-created digests use strict canonical JSON and a
+bare lowercase 64-hex SHA-256 value; portable golden vectors cover the source
+snapshot, target request, prepare intent, and candidate binding. Pre-cutover
+failures may retry or abort; after the durable commit point, recovery can only
+retry or roll forward. Physical pool IDs, mount details, provider receipts, and
+publication capabilities remain private.
+
+Primary exports include:
+
+- `IObjectStorageMigrationPrepareRequest` and
+  `TObjectStorageMigrationStatus` for the immutable intent and status journal.
+- `IObjectStorageMigrationConsumerQuiesceRequest` with
+  `IStorageMigrationConsumerQuiesceEvidence` for exact candidate staging and
+  source-workload shutdown.
+- `IObjectStorageMigrationConsumerActivationRequest` with
+  `IStorageMigrationConsumerActivationEvidence` for durable destination-start
+  acknowledgement.
+- `normalizeObjectStorageMigrationStatus`,
+  `bindObjectStorageMigrationConsumerQuiesceRequest`, and
+  `bindObjectStorageMigrationConsumerActivationRequest` for strict ingress and
+  current-revision mutation fencing.
+- The `create*Sha256` helpers for source snapshots, prepare intent, target
+  requests, candidate/active bindings, and persisted staging or activation
+  evidence.
+
+The phase and consumer-action progression is exact:
+
+| Phase | `consumerAction` | Destination start authorized |
+| --- | --- | --- |
+| `preparing`, `transferring` | `wait` | No |
+| `awaitingConsumerQuiesce` | `stageCandidateAndStop` | No |
+| `finalizing`, `committing` | `wait` | No |
+| `readyToStart` | `startDestination` | Yes |
+| `cleanupPending`, `complete` | `none` | Yes; durable activation evidence is required |
+| `aborting` | `wait` | No |
+| `aborted` | `startSource` | No; only the active source binding may restart |
+
+Normalize every status before acting, and bind consumer mutations to that exact
+status revision:
+
+```typescript
+const status =
+  await platform.storagemigration.normalizeObjectStorageMigrationStatus(
+    untrustedStatusPayload,
+  );
+
+if (status.phase === 'awaitingConsumerQuiesce') {
+  const request =
+    await platform.storagemigration.bindObjectStorageMigrationConsumerQuiesceRequest(
+      untrustedQuiescePayload,
+      status,
+    );
+  await submitQuiesceAcknowledgement(request);
+}
+
+if (status.phase === 'readyToStart') {
+  if (
+    !status.destinationBindingStartAuthorized ||
+    status.consumerAction !== 'startDestination'
+  ) {
+    throw new Error('destination binding is not authorized to start');
+  }
+  await startWorkload(status.activeBinding);
+  const request =
+    await platform.storagemigration.bindObjectStorageMigrationConsumerActivationRequest(
+      untrustedActivationPayload,
+      status,
+    );
+  await submitActivationAcknowledgement(request);
+}
+
+if (status.phase === 'cleanupPending') {
+  // Cleanup is reachable only after this durable acknowledgement was accepted.
+  const durableActivation = status.consumerActivationEvidence;
+}
+
+if (status.phase === 'aborted') {
+  if (
+    status.destinationBindingStartAuthorized ||
+    status.consumerAction !== 'startSource'
+  ) {
+    throw new Error('invalid aborted migration status');
+  }
+  await startWorkload(status.activeBinding);
+}
+```
+
+Here `startWorkload`, `submitQuiesceAcknowledgement`, and
+`submitActivationAcknowledgement` are consumer-owned operations, not package
+exports. Canonical digests are produced from normalized payloads:
+
+```typescript
+const snapshotSha256 =
+  await platform.storagemigration.createUnfencedObjectStorageBindingControlSnapshotSha256(
+    snapshotDigestPayload,
+  );
+const migrationSha256 =
+  await platform.storagemigration.createObjectStorageMigrationSha256(
+    prepareRequest,
+  );
+const candidateSha256 =
+  await platform.storagemigration.createObjectStorageMigrationBindingSha256(
+    candidateBinding,
+  );
+const activationRecordSha256 =
+  await platform.storagemigration.createObjectStorageMigrationPersistedActivationSha256(
+    activationDigestPayload,
+  );
+```
+
 ## Data Contracts
 
 Use `data` when you need object shapes that are persisted, exchanged between services, or exposed through the Cloudly API.
@@ -356,6 +480,35 @@ const provisioning: requests.gateway.IReq_ProvisionGatewayClientCredential['requ
 
 `getGatewayClientContext` returns effective live policy. A `gatewayClient` role necessarily includes the credential ID, bound client ID/type, and `policyGeneration`; consumers should reject admin/operator or mismatched contexts rather than falling back to a caller-supplied owner ID. `getGatewayClientMailOverview` provides an owner-scoped domain and recent-message summary. `getGatewayClientMailDomainCount` derives ownership exclusively from the authenticating gateway credential and returns `{ count: number }` for its distinct configured mail domains. Cloudly therefore uses only `dcrouterGatewayApiToken`; the former `dcrouterOpsApiToken` setting is not part of `data.ICloudlySettings`.
 
+### CoreMail contracts
+
+`requests.coremail` is the shared contract boundary for authenticated workload
+sessions, Coreflow reconciliation, and the CoreMail-to-dcrouter gateway
+session. Only the three authentication handshakes carry reusable peer
+credentials. Subsequent transfer operations may carry a scoped, short-lived,
+one-time bearer capability, while every subsequent workload request derives
+tenant, service, binding, capabilities, allowed senders, and credential version
+from the server-owned TypedSocket peer.
+
+Large content never travels inside TypedRequest JSON. Outbound body parts and
+attachments use prepare/upload/complete operations with short-lived one-time
+HTTP transfer grants. Inbound delivery uses bounded delivery listing followed
+by prepare/fetch/complete and an explicit acknowledgement after the workload
+has processed the exact byte count and SHA-256 digest. `data.coreMailLimits`
+defines the 64 KiB control-frame boundary, bounded structured content, the
+30 MiB serialized MIME ceiling, transfer deadlines, and five-minute grant
+lifetime.
+
+Coreflow applies `data.ICoreMailDesiredState` with a config-epoch
+compare-and-set fence. It stages the digest-fenced JSON snapshot through a
+bounded one-time HTTP upload, then applies it by reconciliation ID, so a large
+binding set never bypasses the 64 KiB control-frame boundary. Desired bindings
+contain password verifiers and secret references only, never plaintext
+workload or dcrouter credentials.
+Reconciliation status carries the exact CoreMail task, rollout generation, and
+image digest so Coreflow can correlate every response with its authoritative
+current task roster.
+
 Request groups are exported by product area:
 
 - `requests.admin`
@@ -366,6 +519,7 @@ Request groups are exported by product area:
 - `requests.certificate`
 - `requests.cluster`
 - `requests.config`
+- `requests.coremail`
 - `requests.corestore`
 - `requests.deployment`
 - `requests.dns`
@@ -438,6 +592,8 @@ Available platform modules:
 - `platform.pushnotification` is the deprecated legacy device-token push contract. New browser Web Push integrations use `requests.webpush`.
 - `platform.letter` for physical letter workflows.
 - `platform.ai`, `platform.database`, `platform.objectstorage`, `platform.logging`, `platform.backup`, and `platform.sip` for infrastructure and application capabilities.
+- `platform.storage` for provider-neutral storage classes, requests, capabilities, and resolved bindings.
+- `platform.storagemigration` for fenced object-storage migration intent, status, consumer acknowledgements, canonical digests, and strict normalizers.
 - `platform.types` plus root re-exports for shared capability, provider, binding, credential, and endpoint metadata.
 
 ## Legacy Platformservice Contracts

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '20.0.0',
+  version: '20.2.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/coremail.ts

@@ -0,0 +1,277 @@
+/**
+ * Shared CoreMail contracts.
+ *
+ * Workload authority is always derived from an authenticated transport
+ * session. Application-facing request DTOs therefore carry message or
+ * delivery identifiers only and never caller-selected tenant, service, or
+ * binding authority.
+ */
+
+export type TCoreMailSha256 = `sha256:${string}`;
+
+export type TCoreMailCapability = 'outbound' | 'inbound';
+export type TCoreMailBindingState = 'active' | 'disabled';
+export type TCoreMailCredentialState = 'current' | 'retiring';
+export type TCoreMailPartKind = 'text' | 'html' | 'attachment';
+export type TCoreMailTransferMethod = 'PUT' | 'GET';
+export type TCoreMailSubmissionState =
+  | 'preparing'
+  | 'uploading'
+  | 'ready'
+  | 'accepted'
+  | 'queued'
+  | 'delivering'
+  | 'delivered'
+  | 'deferred'
+  | 'failed'
+  | 'deadLettered';
+export type TCoreMailInboundDeliveryState = 'pending' | 'fetching' | 'fetched' | 'acknowledged';
+export type TCoreMailInboundAckOutcome = 'processed' | 'discarded';
+export type TCoreMailRecipientAction = 'accept' | 'reject' | 'defer';
+export type TCoreMailReconciliationState = 'applying' | 'ready' | 'failed';
+
+export type TCoreMailErrorCode =
+  | 'AUTHENTICATION_FAILED'
+  | 'AUTHENTICATION_EXPIRED'
+  | 'AUTHORITY_REVOKED'
+  | 'CAPABILITY_DENIED'
+  | 'NOT_FOUND'
+  | 'INVALID_REQUEST'
+  | 'INVALID_MAILBOX'
+  | 'INVALID_SENDER'
+  | 'INVALID_RECIPIENT'
+  | 'INVALID_HEADER'
+  | 'PAYLOAD_LIMIT_EXCEEDED'
+  | 'IDEMPOTENCY_CONFLICT'
+  | 'STATE_CONFLICT'
+  | 'TRANSFER_GRANT_EXPIRED'
+  | 'TRANSFER_GRANT_REPLAYED'
+  | 'TRANSFER_LENGTH_MISMATCH'
+  | 'TRANSFER_DIGEST_MISMATCH'
+  | 'TRANSFER_ENCODING_UNSUPPORTED'
+  | 'OBJECT_INTEGRITY_CONFLICT'
+  | 'DELIVERY_NOT_FETCHED'
+  | 'GATEWAY_UNAVAILABLE'
+  | 'RECONCILIATION_FENCE_MISMATCH';
+
+export interface ICoreMailErrorData {
+  code: TCoreMailErrorCode;
+  retryable: boolean;
+  retryAfterMs?: number;
+}
+
+export interface ICoreMailMailbox {
+  address: string;
+  displayName?: string;
+}
+
+export interface ICoreMailEnvelope {
+  mailFrom: string;
+  rcptTo: string[];
+}
+
+export interface ICoreMailHeader {
+  name: string;
+  value: string;
+}
+
+export interface ICoreMailContentDescriptor {
+  partId: string;
+  kind: TCoreMailPartKind;
+  contentType: string;
+  filename?: string;
+  contentId?: string;
+  sha256: TCoreMailSha256;
+  lengthBytes: number;
+}
+
+export interface ICoreMailOutboundMessageDescriptor {
+  sender: ICoreMailMailbox;
+  recipients: {
+    to: ICoreMailMailbox[];
+    cc?: ICoreMailMailbox[];
+    bcc?: ICoreMailMailbox[];
+  };
+  replyTo?: ICoreMailMailbox;
+  subject: string;
+  /** Ordered headers. Transport-owned MIME headers are not accepted here. */
+  headers?: ICoreMailHeader[];
+  /** Ordered body and attachment descriptors. Bytes move through bounded HTTP transfers. */
+  parts: ICoreMailContentDescriptor[];
+}
+
+export interface ICoreMailTransferGrant {
+  grantId: string;
+  method: TCoreMailTransferMethod;
+  /** Same-origin path. Callers use the authenticated CoreMail or gateway endpoint they already hold. */
+  path: string;
+  /** One-time bearer capability. It must never be logged or persisted by a consumer. */
+  bearerToken: string;
+  sha256: TCoreMailSha256;
+  lengthBytes: number;
+  contentType: string;
+  expiresAt: number;
+}
+
+export interface ICoreMailUploadGrant extends ICoreMailTransferGrant {
+  method: 'PUT';
+}
+
+export interface ICoreMailDownloadGrant extends ICoreMailTransferGrant {
+  method: 'GET';
+}
+
+export interface ICoreMailPartStatus {
+  partId: string;
+  state: 'missing' | 'uploading' | 'complete' | 'failed';
+  sha256: TCoreMailSha256;
+  lengthBytes: number;
+}
+
+export interface ICoreMailSubmission {
+  submissionId: string;
+  idempotencyKey: string;
+  submissionDigest: TCoreMailSha256;
+  state: TCoreMailSubmissionState;
+  parts: ICoreMailPartStatus[];
+  transportMessageId?: string;
+  attempts: number;
+  nextAttemptAt?: number;
+  acceptedAt?: number;
+  deliveredAt?: number;
+  createdAt: number;
+  updatedAt: number;
+}
+
+export interface ICoreMailInboundDelivery {
+  deliveryId: string;
+  transportDeliveryId: string;
+  state: TCoreMailInboundDeliveryState;
+  envelope: ICoreMailEnvelope;
+  rawMime: {
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+    contentType: 'message/rfc822';
+  };
+  messageId?: string;
+  subject?: string;
+  receivedAt: number;
+  updatedAt: number;
+}
+
+export interface ICoreMailBindingCredentialVerifier {
+  credentialId: string;
+  version: number;
+  state: TCoreMailCredentialState;
+  /** Password-verifier string only. Plaintext credential material is never part of desired state. */
+  verificationHash: string;
+  acceptUntil?: number;
+}
+
+export interface ICoreMailBindingDesiredState {
+  schemaVersion: 1;
+  bindingId: string;
+  serviceId: string;
+  tenantId: string;
+  revision: number;
+  state: TCoreMailBindingState;
+  capabilities: TCoreMailCapability[];
+  credentials: ICoreMailBindingCredentialVerifier[];
+  allowedSenders: string[];
+  inboundRecipients: string[];
+  defaultSender?: string;
+  limits?: {
+    messagesPerMinute?: number;
+    messagesPerDay?: number;
+    maxPendingInbound?: number;
+  };
+}
+
+export interface ICoreMailGatewayDesiredState {
+  endpointUrl: string;
+  credentialId: string;
+  credentialVersion: number;
+  /** Key in CoreMail's resolved runtime secret material, never a plaintext value. */
+  credentialSecretKey: string;
+}
+
+export interface ICoreMailDesiredState {
+  schemaVersion: 1;
+  configEpoch: number;
+  bindings: ICoreMailBindingDesiredState[];
+  gateway: ICoreMailGatewayDesiredState;
+}
+
+export interface ICoreMailReplicaIdentity {
+  taskId: string;
+  serviceId: string;
+  rolloutId: string;
+  rolloutGeneration: number;
+  imageDigest: TCoreMailSha256;
+}
+
+export interface ICoreMailBindingReconciliationStatus {
+  bindingId: string;
+  revision: number;
+  state: TCoreMailBindingState;
+  activeSessionsByCredentialVersion: Array<{
+    version: number;
+    count: number;
+  }>;
+}
+
+export interface ICoreMailReconciliationStatus {
+  replica: ICoreMailReplicaIdentity;
+  state: TCoreMailReconciliationState;
+  appliedConfigEpoch: number;
+  appliedDesiredStateDigest: TCoreMailSha256;
+  bindings: ICoreMailBindingReconciliationStatus[];
+  updatedAt: number;
+  errorCode?: TCoreMailErrorCode;
+}
+
+export interface ICoreMailRecipientResolution {
+  recipient: string;
+  action: TCoreMailRecipientAction;
+  /** Opaque, short-lived handle returned only for accepted recipients. */
+  routingHandle?: string;
+  smtpCode?: number;
+  message?: string;
+}
+
+export interface ICoreMailGatewayMessageDescriptor {
+  envelope: ICoreMailEnvelope;
+  rawMime: {
+    sha256: TCoreMailSha256;
+    lengthBytes: number;
+    contentType: 'message/rfc822';
+  };
+}
+
+export interface ICoreMailGatewayOutboundStatus {
+  transportMessageId: string;
+  state: Extract<
+    TCoreMailSubmissionState,
+    'accepted' | 'queued' | 'delivering' | 'delivered' | 'deferred' | 'failed' | 'deadLettered'
+  >;
+  attempts: number;
+  nextAttemptAt?: number;
+  smtpCode?: number;
+  updatedAt: number;
+}
+
+export const coreMailLimits = Object.freeze({
+  controlMessageBytes: 64 * 1024,
+  desiredStateBytes: 8 * 1024 * 1024,
+  textPartBytes: 1 * 1024 * 1024,
+  htmlPartBytes: 2 * 1024 * 1024,
+  attachmentCount: 16,
+  attachmentBytes: 10 * 1024 * 1024,
+  aggregateAttachmentBytes: 17 * 1024 * 1024,
+  mimeFramingBytes: 512 * 1024,
+  serializedMimeBytes: 30 * 1024 * 1024,
+  transferGrantTtlMs: 5 * 60 * 1000,
+  transferHeaderTimeoutMs: 10 * 1000,
+  transferIdleTimeoutMs: 15 * 1000,
+  transferOverallTimeoutMs: 2 * 60 * 1000,
+} as const);

package/ts/data/index.ts

@@ -1,6 +1,7 @@
 export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './config.js';
+export * from './coremail.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
 export * from './deploymentoperation.js';

package/ts/data/isolatedrestore.ts

@@ -3,6 +3,13 @@ import type {
   IBackupArchiveObject,
   TIsolatedRestoreResourceMapping,
 } from './backup.js';
+import {
+  canonicalizeStrictJson,
+  createCanonicalJsonSha256Hex,
+  createSha256Hex,
+  deepFreezeValue,
+  strictCanonicalJsonRules,
+} from '../private/canonicaljson.js';
 
 /** Operations carried by a short-lived, single-operation restore grant. */
 export const isolatedRestoreGrantOperations = Object.freeze([
@@ -307,15 +314,7 @@ export class IsolatedRestoreContractError extends Error {
 }
 
 /** Cross-runtime rules for restore authority digests. */
-export const isolatedRestoreCanonicalJsonRules = Object.freeze({
-  version: 1 as const,
-  encoding: 'utf-8' as const,
-  objectKeyOrdering: 'utf-16-code-unit-ascending' as const,
-  arrayOrdering: 'preserved-dense' as const,
-  unicodeNormalization: 'preserved' as const,
-  numberEncoding: 'safe-integer-json-no-negative-zero' as const,
-  digest: 'sha256-lowercase-hex' as const,
-});
+export const isolatedRestoreCanonicalJsonRules = strictCanonicalJsonRules;
 
 const canonicalIdentifierPattern = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,255}$/;
 const canonicalScopedIdPattern = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,191}$/;
@@ -360,23 +359,7 @@ export const assertIsolatedRestoreControlIngressByteLength = (
   return byteLengthArg;
 };
 
-const deepFreeze = <T>(valueArg: T, seenArg = new WeakSet<object>()): T => {
-  if (!valueArg || typeof valueArg !== 'object') {
-    return valueArg;
-  }
-  const object = valueArg as object;
-  if (ArrayBuffer.isView(object) || seenArg.has(object)) {
-    return valueArg;
-  }
-  seenArg.add(object);
-  for (const key of Reflect.ownKeys(object)) {
-    const descriptor = Object.getOwnPropertyDescriptor(object, key);
-    if (descriptor && Object.hasOwn(descriptor, 'value')) {
-      deepFreeze(descriptor.value, seenArg);
-    }
-  }
-  return Object.freeze(valueArg);
-};
+const deepFreeze = deepFreezeValue;
 
 const verifiedIsolatedRestoreGrantCompacts = new WeakMap<object, string>();
 const verifiedIsolatedRestoreWriteBindings = new WeakSet<object>();
@@ -1419,64 +1402,7 @@ export const normalizeIsolatedRestoreControlStatusRequest = (
 };
 
 const canonicalizeJson = (valueArg: unknown): string => {
-  const ancestors = new Set<object>();
-
-  const visit = (currentValueArg: unknown, fieldNameArg: string): string => {
-    if (currentValueArg === null) {
-      return 'null';
-    }
-    if (typeof currentValueArg === 'boolean') {
-      return currentValueArg ? 'true' : 'false';
-    }
-    if (typeof currentValueArg === 'string') {
-      assertUnicodeScalarString(currentValueArg, fieldNameArg);
-      return JSON.stringify(currentValueArg);
-    }
-    if (typeof currentValueArg === 'number') {
-      if (
-        !Number.isSafeInteger(currentValueArg) ||
-        Object.is(currentValueArg, -0)
-      ) {
-        return fail(`${fieldNameArg} must contain safe integers only`);
-      }
-      return String(currentValueArg);
-    }
-    if (typeof currentValueArg !== 'object') {
-      return fail(`${fieldNameArg} contains a non-JSON value`);
-    }
-    if (ancestors.has(currentValueArg)) {
-      return fail(`${fieldNameArg} contains a cycle`);
-    }
-
-    ancestors.add(currentValueArg);
-    try {
-      if (Array.isArray(currentValueArg)) {
-        return `[${currentValueArg
-          .map((entryArg, indexArg) =>
-            visit(entryArg, `${fieldNameArg}[${indexArg}]`),
-          )
-          .join(',')}]`;
-      }
-
-      const record = readRecord(currentValueArg, fieldNameArg);
-      const keys = Object.keys(record).sort((leftArg, rightArg) => {
-        return leftArg < rightArg ? -1 : leftArg > rightArg ? 1 : 0;
-      });
-      return `{${keys
-        .map((keyArg) => {
-          assertUnicodeScalarString(keyArg, `${fieldNameArg} key`);
-          return `${JSON.stringify(keyArg)}:${visit(
-            record[keyArg],
-            `${fieldNameArg}.${keyArg}`,
-          )}`;
-        })
-        .join(',')}}`;
-    } finally {
-      ancestors.delete(currentValueArg);
-    }
-  };
-
-  return visit(valueArg, 'canonical JSON input');
+  return canonicalizeStrictJson(valueArg, fail);
 };
 
 export const canonicalizeIsolatedRestoreResourceMappings = (
@@ -1618,20 +1544,13 @@ export const canonicalizeIsolatedRestoreAuthorityProjection = (
 };
 
 const createSha256 = async (contentsArg: Uint8Array): Promise<string> => {
-  const subtle = globalThis.crypto?.subtle;
-  if (!subtle) {
-    return fail('Web Crypto SHA-256 is unavailable in this runtime');
-  }
-  const digest = await subtle.digest('SHA-256', new Uint8Array(contentsArg));
-  return Array.from(new Uint8Array(digest), (byteArg) =>
-    byteArg.toString(16).padStart(2, '0'),
-  ).join('');
+  return createSha256Hex(contentsArg, fail);
 };
 
 const createCanonicalJsonSha256 = async (
   canonicalJsonArg: string,
 ): Promise<string> => {
-  return createSha256(new TextEncoder().encode(canonicalJsonArg));
+  return createCanonicalJsonSha256Hex(canonicalJsonArg, fail);
 };
 
 export const createIsolatedRestoreBytesSha256 = async (

package/ts/platform/index.ts

@@ -9,6 +9,7 @@ import * as pushnotification from './pushnotification.js';
 import * as sip from './sip.js';
 import * as sms from './sms.js';
 import * as storage from './storage.js';
+import * as storagemigration from './storagemigration.js';
 import * as types from './types.js';
 
 export {
@@ -23,8 +24,10 @@ export {
   sip,
   sms,
   storage,
+  storagemigration,
   types,
 };
 
 export * from './storage.js';
+export * from './storagemigration.js';
 export * from './types.js';