@serve.zone/interfaces 20.2.0 → 21.1.0

package/dist_ts/requests/status.d.ts

@@ -1,6 +1,13 @@
 import * as plugins from '../plugins.js';
 import * as serviceInterfaces from '../data/service.js';
 import * as userInterfaces from '../data/user.js';
+type TReportReconciliationRolloutIdentity = {
+    rolloutId: string;
+    rolloutGeneration: number;
+} | {
+    rolloutId?: never;
+    rolloutGeneration?: never;
+};
 /**
  * a status update dashboard
  */
@@ -24,6 +31,7 @@ export interface IRequest_Coreflow_Cloudly_ReportReconciliationStatus extends pl
         message?: string;
         errorText?: string;
         reportedAt?: number;
-    };
+    } & TReportReconciliationRolloutIdentity;
     response: {};
 }
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "20.2.0",
+  "version": "21.1.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -505,6 +505,40 @@ bounded one-time HTTP upload, then applies it by reconciliation ID, so a large
 binding set never bypasses the 64 KiB control-frame boundary. Desired bindings
 contain password verifiers and secret references only, never plaintext
 workload or dcrouter credentials.
+Use `data.normalizeCoreMailDesiredState`,
+`data.canonicalizeCoreMailDesiredState`, and
+`data.createCoreMailDesiredStateDigest` at every producer and consumer
+boundary. Use `data.verifyCoreMailDesiredStateDigest` before applying a staged
+snapshot, `data.normalizeCoreMailCredentialVerifier` before accepting verifier
+metadata, `data.normalizeCoreMailControlBootstrap` for startup authority, and
+`data.normalizeCoreMailGatewayPeerDesiredState` for dcrouter peer state. The
+normalizers reject unknown fields, noncanonical mailboxes,
+ambiguous active recipient ownership, malformed SHA-256 values, and
+credential-lifecycle inconsistencies. CoreMail credential verifiers use the
+versioned `argon2id-v1` format and the exact policy exported as
+`data.coreMailCredentialVerifierPolicy`.
+
+`data.ICoreMailControlBootstrap` is installed before ordinary reconciliation.
+It contains the CoreMail service identity and verifier metadata only. The
+matching plaintext control credential is delivered exclusively to Coreflow
+through resolved runtime secrets. `data.coreMailRuntimeKeys` publishes the
+canonical environment keys for the verifier-only bootstrap payload and the
+separate control and gateway secret values; no consumer may derive or embed
+plaintext material in desired state.
+
+`data.ICoreMailGatewayPeerDesiredState` gives dcrouter the authoritative HTTPS
+CoreMail transfer origin associated with an authenticated CoreMail service.
+The origin is control-plane state and must never be inferred from a socket,
+Host header, TypedSocket tag, or unrestricted peer input. The gateway
+authentication response repeats dcrouter's bound origin so CoreMail can reject
+configuration drift before handing over a path-only transfer grant.
+
+Control and gateway credential rotation is ordered: provision the candidate
+plaintext through resolved runtime secrets, publish and activate the matching
+`argon2id-v1` verifier, roll or reconnect every affected replica, observe
+per-task authentication and readiness, then mark the previous verifier
+`retiring` with `acceptUntil`. Remove the previous verifier and secret only
+after its acceptance window has elapsed and no session uses that version.
 Reconciliation status carries the exact CoreMail task, rollout generation, and
 image digest so Coreflow can correlate every response with its authoritative
 current task roster.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '20.2.0',
+  version: '21.1.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }