@serve.zone/interfaces 21.1.0 → 23.0.0

package/dist_ts/runtime.d.ts

@@ -1,41 +1,93 @@
-import type * as plugins from './plugins.js';
-import type { IIdentityCredential, IResolvedSecretManifest, TSha256Digest } from './data/index.js';
-/**
- * Runtime-only material. This module is exported only under the Node condition
- * and is intentionally unreachable from the universal/browser-facing barrel.
- */
-export interface IResolvedSecretMaterialValue {
+import * as plugins from './plugins.js';
+import type { IIdentityCredential, IResolvedSecretManifest, TSha256Digest, TSecretRecipientMetadata } from './data/index.js';
+import { validateSecretRecipientMetadata } from './data/secret.js';
+export interface ISealedResolvedSecretMaterialEntry {
     secretVersionId: string;
-    value: string;
+    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
 }
-export interface IResolvedSecretMaterial {
+/** Runtime-only material. No plaintext value is represented in this DTO. */
+export interface ISealedResolvedSecretMaterial {
     schemaVersion: 1;
-    /** Full value-free manifest so the runtime can verify its canonical digest. */
+    /** Full schema-v2 value-free manifest used for digest and rollout verification. */
     manifest: IResolvedSecretManifest;
-    /** Plaintext values keyed only by the exact version IDs pinned by the manifest. */
-    values: IResolvedSecretMaterialValue[];
+    /** Sorted exact coverage of the manifest's pinned versions. */
+    entries: ISealedResolvedSecretMaterialEntry[];
+}
+export interface ISecretMaterialRequestFence {
+    serviceId: string;
+    imageRolloutId: string;
+    imageRolloutGeneration: number;
+    requestedImageDigest: TSha256Digest;
+    secretRolloutId: string;
+    secretRolloutGeneration: number;
+    manifestId: string;
+    manifestDigest: TSha256Digest;
+    expectedRecipientKeyId: string;
+}
+/** Request fence plus trusted local scope derived from the verified cluster identity. */
+export interface ISecretMaterialExpectation extends ISecretMaterialRequestFence {
+    organizationId: string;
+    clusterId: string;
 }
 /**
- * Verifies the immutable manifest and requires exactly one material value for
- * every pinned version. Callers separately compare the verified manifest
- * reference to the request and their authenticated cluster scope.
- */
-export declare const verifyResolvedSecretMaterial: (materialArg: unknown) => Promise<boolean>;
-/**
- * Cluster and organization are derived from the verified JWT. A caller cannot
- * select either scope through request fields.
+ * Parses every envelope with SmartCrypto, verifies its bound context digest,
+ * and checks sorted exact version coverage. It never receives a private key
+ * and never decrypts material.
  */
+export declare const verifySealedResolvedSecretMaterial: (materialArg: unknown, expectedArg: ISecretMaterialExpectation) => Promise<boolean>;
+/** Organization and cluster are derived exclusively from the verified cluster JWT. */
 export interface IReq_GetResolvedSecretMaterial extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetResolvedSecretMaterial> {
     method: 'getResolvedSecretMaterial';
+    request: ISecretMaterialRequestFence & {
+        identity: IIdentityCredential;
+    };
+    response: {
+        material: ISealedResolvedSecretMaterial;
+    };
+}
+export interface ISecretRecipientEnrollmentChallengeV1 {
+    schemaVersion: 1;
+    enrollmentId: string;
+    clusterId: string;
+    recipientKeyId: string;
+    publicKey: string;
+    generation: number;
+    expiresAt: number;
+    /** Sealed random 32-byte challenge; plaintext is never persisted or returned. */
+    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
+}
+/**
+ * Cluster scope is derived from the JWT. The server persists only a one-time
+ * challenge hash plus expiry and consumes it with generation CAS; reuse,
+ * expiry, mismatch, and replay are rejected. Private keys and challenge
+ * plaintext have no persistence DTO.
+ */
+export interface IReq_BeginSecretRecipientEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_BeginSecretRecipientEnrollment> {
+    method: 'beginSecretRecipientEnrollment';
+    request: {
+        identity: IIdentityCredential;
+        proposedRecipientKeyId: string;
+        proposedPublicKey: string;
+        expectedGeneration: number;
+    };
+    response: {
+        challenge: ISecretRecipientEnrollmentChallengeV1;
+    };
+}
+export interface IReq_CompleteSecretRecipientEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CompleteSecretRecipientEnrollment> {
+    method: 'completeSecretRecipientEnrollment';
     request: {
         identity: IIdentityCredential;
-        serviceId: string;
-        secretRolloutId: string;
-        secretRolloutGeneration: number;
-        manifestId: string;
-        manifestDigest: TSha256Digest;
+        enrollmentId: string;
+        expectedGeneration: number;
+        /** Canonical unpadded base64url response containing exactly 32 bytes. */
+        response: string;
     };
     response: {
-        material: IResolvedSecretMaterial;
+        recipient: TSecretRecipientMetadata;
     };
 }
+export declare const validateBeginSecretRecipientEnrollmentRequest: (requestArg: unknown) => string[];
+export declare const validateSecretRecipientEnrollmentChallenge: (challengeArg: unknown) => Promise<string[]>;
+export declare const validateCompleteSecretRecipientEnrollmentRequest: (requestArg: unknown) => string[];
+export { validateSecretRecipientMetadata };

package/dist_ts/runtime.js

@@ -1,33 +1,233 @@
-import { validateResolvedSecretManifest, verifyResolvedSecretManifestDigest, } from './data/secret.js';
+import * as plugins from './plugins.js';
+import { createResolvedSecretMaterialEnvelopeContext, createSecretRecipientEnrollmentChallengeContext, validateResolvedSecretManifest, validateSecretRecipientMetadata, verifySecretEnvelopeContext, verifyResolvedSecretManifestDigest, } from './data/secret.js';
 /**
- * Verifies the immutable manifest and requires exactly one material value for
- * every pinned version. Callers separately compare the verified manifest
- * reference to the request and their authenticated cluster scope.
+ * Parses every envelope with SmartCrypto, verifies its bound context digest,
+ * and checks sorted exact version coverage. It never receives a private key
+ * and never decrypts material.
  */
-export const verifyResolvedSecretMaterial = async (materialArg) => {
+export const verifySealedResolvedSecretMaterial = async (materialArg, expectedArg) => {
     if (!materialArg || typeof materialArg !== 'object' || Array.isArray(materialArg))
         return false;
     const material = materialArg;
-    if (!material.manifest || !Array.isArray(material.values))
+    if (JSON.stringify(Object.keys(material).sort()) !== JSON.stringify([
+        'entries',
+        'manifest',
+        'schemaVersion',
+    ])) {
         return false;
-    if (material.schemaVersion !== 1)
+    }
+    if (material.schemaVersion !== 1 || !material.manifest || !Array.isArray(material.entries)) {
         return false;
-    if (validateResolvedSecretManifest(material.manifest).length > 0)
+    }
+    if (validateResolvedSecretManifest(material.manifest).length > 0
+        || !await verifyResolvedSecretManifestDigest(material.manifest)) {
         return false;
-    if (!await verifyResolvedSecretManifestDigest(material.manifest))
+    }
+    if (material.manifest.organizationId !== expectedArg.organizationId
+        || material.manifest.clusterId !== expectedArg.clusterId
+        || material.manifest.serviceId !== expectedArg.serviceId
+        || material.manifest.imageRolloutId !== expectedArg.imageRolloutId
+        || material.manifest.imageRolloutGeneration !== expectedArg.imageRolloutGeneration
+        || material.manifest.requestedImageDigest !== expectedArg.requestedImageDigest
+        || material.manifest.secretRolloutId !== expectedArg.secretRolloutId
+        || material.manifest.secretRolloutGeneration !== expectedArg.secretRolloutGeneration
+        || material.manifest.id !== expectedArg.manifestId
+        || material.manifest.digest !== expectedArg.manifestDigest) {
         return false;
-    if (!material.values.every((valueArg) => (Boolean(valueArg)
-        && typeof valueArg === 'object'
-        && typeof valueArg.secretVersionId === 'string'
-        && typeof valueArg.value === 'string')))
+    }
+    if (material.entries.length > 256
+        || material.entries.length !== material.manifest.entries.length) {
         return false;
+    }
     const expectedVersionIds = material.manifest.entries
         .map((entryArg) => entryArg.secretVersionId)
         .sort();
-    const actualVersionIds = material.values
-        .map((valueArg) => valueArg.secretVersionId)
-        .sort();
-    return new Set(actualVersionIds).size === actualVersionIds.length
-        && JSON.stringify(actualVersionIds) === JSON.stringify(expectedVersionIds);
+    const actualVersionIds = material.entries.map((entryArg) => entryArg.secretVersionId);
+    if (new Set(actualVersionIds).size !== actualVersionIds.length
+        || JSON.stringify(actualVersionIds) !== JSON.stringify(expectedVersionIds)) {
+        return false;
+    }
+    const manifestEntriesByVersion = new Map(material.manifest.entries.map((entryArg) => [
+        entryArg.secretVersionId,
+        entryArg,
+    ]));
+    for (const entry of material.entries) {
+        if (!entry || typeof entry !== 'object' || typeof entry.secretVersionId !== 'string')
+            return false;
+        if (JSON.stringify(Object.keys(entry).sort()) !== JSON.stringify([
+            'envelope',
+            'secretVersionId',
+        ])) {
+            return false;
+        }
+        const manifestEntry = manifestEntriesByVersion.get(entry.secretVersionId);
+        if (!manifestEntry)
+            return false;
+        let envelope;
+        try {
+            envelope = plugins.smartcrypto.parseX25519Envelope(entry.envelope);
+        }
+        catch {
+            return false;
+        }
+        if (envelope.recipientKeyId !== expectedArg.expectedRecipientKeyId)
+            return false;
+        const context = createResolvedSecretMaterialEnvelopeContext({
+            recipientKeyId: expectedArg.expectedRecipientKeyId,
+            organizationId: material.manifest.organizationId,
+            clusterId: material.manifest.clusterId,
+            serviceId: material.manifest.serviceId,
+            imageRolloutId: material.manifest.imageRolloutId,
+            imageRolloutGeneration: material.manifest.imageRolloutGeneration,
+            requestedImageDigest: material.manifest.requestedImageDigest,
+            secretRolloutId: material.manifest.secretRolloutId,
+            secretRolloutGeneration: material.manifest.secretRolloutGeneration,
+            manifestId: material.manifest.id,
+            manifestDigest: material.manifest.digest,
+            secretId: manifestEntry.secretId,
+            secretVersionId: manifestEntry.secretVersionId,
+        });
+        if (!await verifySecretEnvelopeContext(envelope, context))
+            return false;
+    }
+    return true;
+};
+const canonicalIdentifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const raw32ByteBase64UrlRegex = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+export const validateBeginSecretRecipientEnrollmentRequest = (requestArg) => {
+    if (!requestArg || typeof requestArg !== 'object' || Array.isArray(requestArg)) {
+        return ['enrollment request must be an object'];
+    }
+    const request = requestArg;
+    const errors = [];
+    if (JSON.stringify(Object.keys(request).sort()) !== JSON.stringify([
+        'expectedGeneration',
+        'identity',
+        'proposedPublicKey',
+        'proposedRecipientKeyId',
+    ])) {
+        errors.push('enrollment request must use its exact schema');
+    }
+    if (!request.identity || typeof request.identity !== 'object'
+        || typeof request.identity.jwt !== 'string') {
+        errors.push('enrollment identity must be a JWT credential');
+    }
+    if (typeof request.proposedRecipientKeyId !== 'string'
+        || !canonicalIdentifierRegex.test(request.proposedRecipientKeyId)) {
+        errors.push('proposed recipient key id must be canonical');
+    }
+    if (typeof request.proposedPublicKey !== 'string'
+        || !raw32ByteBase64UrlRegex.test(request.proposedPublicKey)) {
+        errors.push('proposed public key must be canonical base64url raw X25519 material');
+    }
+    if (!Number.isSafeInteger(request.expectedGeneration)
+        || request.expectedGeneration < 0) {
+        errors.push('expected generation must be a non-negative integer');
+    }
+    if ('clusterId' in request || 'organizationId' in request) {
+        errors.push('enrollment request must not select cluster or organization scope');
+    }
+    return errors;
+};
+export const validateSecretRecipientEnrollmentChallenge = async (challengeArg) => {
+    if (!challengeArg || typeof challengeArg !== 'object' || Array.isArray(challengeArg)) {
+        return ['enrollment challenge must be an object'];
+    }
+    const challenge = challengeArg;
+    const errors = [];
+    if (JSON.stringify(Object.keys(challenge).sort()) !== JSON.stringify([
+        'clusterId',
+        'enrollmentId',
+        'envelope',
+        'expiresAt',
+        'generation',
+        'publicKey',
+        'recipientKeyId',
+        'schemaVersion',
+    ])) {
+        errors.push('enrollment challenge must use its exact schema');
+    }
+    for (const field of ['enrollmentId', 'clusterId', 'recipientKeyId']) {
+        if (typeof challenge[field] !== 'string'
+            || !canonicalIdentifierRegex.test(challenge[field])) {
+            errors.push(`enrollment challenge ${field} must be canonical`);
+        }
+    }
+    if (challenge.schemaVersion !== 1)
+        errors.push('enrollment challenge schemaVersion must be 1');
+    if (typeof challenge.publicKey !== 'string'
+        || !raw32ByteBase64UrlRegex.test(challenge.publicKey)) {
+        errors.push('enrollment challenge public key must be canonical');
+    }
+    if (!Number.isSafeInteger(challenge.generation) || challenge.generation < 1) {
+        errors.push('enrollment challenge generation must be positive');
+    }
+    if (!Number.isSafeInteger(challenge.expiresAt) || challenge.expiresAt < 1) {
+        errors.push('enrollment challenge expiry must be positive');
+    }
+    let envelope;
+    try {
+        envelope = plugins.smartcrypto.parseX25519Envelope(challenge.envelope);
+    }
+    catch {
+        errors.push('enrollment challenge envelope must be strict');
+    }
+    if (envelope) {
+        if (envelope.recipientKeyId !== challenge.recipientKeyId) {
+            errors.push('enrollment challenge recipient does not match');
+        }
+        if (!raw32ByteBase64UrlRegex.test(envelope.ciphertext)) {
+            errors.push('enrollment challenge ciphertext must contain exactly 32 bytes');
+        }
+        if (errors.length === 0) {
+            const context = createSecretRecipientEnrollmentChallengeContext({
+                enrollmentId: challenge.enrollmentId,
+                clusterId: challenge.clusterId,
+                recipientKeyId: challenge.recipientKeyId,
+                publicKey: challenge.publicKey,
+                generation: challenge.generation,
+                expiresAt: challenge.expiresAt,
+            });
+            if (!await verifySecretEnvelopeContext(envelope, context)) {
+                errors.push('enrollment challenge context does not match');
+            }
+        }
+    }
+    return errors;
+};
+export const validateCompleteSecretRecipientEnrollmentRequest = (requestArg) => {
+    if (!requestArg || typeof requestArg !== 'object' || Array.isArray(requestArg)) {
+        return ['enrollment completion must be an object'];
+    }
+    const request = requestArg;
+    const errors = [];
+    if (JSON.stringify(Object.keys(request).sort()) !== JSON.stringify([
+        'enrollmentId',
+        'expectedGeneration',
+        'identity',
+        'response',
+    ])) {
+        errors.push('enrollment completion must use its exact schema');
+    }
+    if (!request.identity || typeof request.identity !== 'object'
+        || typeof request.identity.jwt !== 'string') {
+        errors.push('enrollment identity must be a JWT credential');
+    }
+    if (typeof request.enrollmentId !== 'string'
+        || !canonicalIdentifierRegex.test(request.enrollmentId)) {
+        errors.push('enrollment id must be canonical');
+    }
+    if (!Number.isSafeInteger(request.expectedGeneration)
+        || request.expectedGeneration < 0) {
+        errors.push('expected generation must be a non-negative integer');
+    }
+    if (typeof request.response !== 'string' || !raw32ByteBase64UrlRegex.test(request.response)) {
+        errors.push('enrollment response must be canonical base64url containing exactly 32 bytes');
+    }
+    if ('clusterId' in request || 'organizationId' in request) {
+        errors.push('enrollment completion must not select cluster or organization scope');
+    }
+    return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBTUEsT0FBTyxFQUNMLDhCQUE4QixFQUM5QixrQ0FBa0MsR0FDbkMsTUFBTSxrQkFBa0IsQ0FBQztBQW1CMUI7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLEtBQUssRUFDL0MsV0FBb0IsRUFDRixFQUFFO0lBQ3BCLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDaEcsTUFBTSxRQUFRLEdBQUcsV0FBK0MsQ0FBQztJQUNqRSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3hFLElBQUksUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDL0MsSUFBSSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMvRSxJQUFJLENBQUMsTUFBTSxrQ0FBa0MsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDL0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUN2QyxPQUFPLENBQUMsUUFBUSxDQUFDO1dBQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtXQUM1QixPQUFPLFFBQVEsQ0FBQyxlQUFlLEtBQUssUUFBUTtXQUM1QyxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUN0QyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDakIsTUFBTSxrQkFBa0IsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU87U0FDakQsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDO1NBQzNDLElBQUksRUFBRSxDQUFDO0lBQ1YsTUFBTSxnQkFBZ0IsR0FBRyxRQUFRLENBQUMsTUFBTTtTQUNyQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7U0FDM0MsSUFBSSxFQUFFLENBQUM7SUFDVixPQUFPLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUMsSUFBSSxLQUFLLGdCQUFnQixDQUFDLE1BQU07V0FDNUQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUMvRSxDQUFDLENBQUMifQ==
+export { validateSecretRecipientMetadata };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFPeEMsT0FBTyxFQUNMLDJDQUEyQyxFQUMzQywrQ0FBK0MsRUFDL0MsOEJBQThCLEVBQzlCLCtCQUErQixFQUMvQiwyQkFBMkIsRUFDM0Isa0NBQWtDLEdBQ25DLE1BQU0sa0JBQWtCLENBQUM7QUFtQzFCOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxLQUFLLEVBQ3JELFdBQW9CLEVBQ3BCLFdBQXVDLEVBQ3JCLEVBQUU7SUFDcEIsSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUNoRyxNQUFNLFFBQVEsR0FBRyxXQUFxRCxDQUFDO0lBQ3ZFLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNsRSxTQUFTO1FBQ1QsVUFBVTtRQUNWLGVBQWU7S0FDaEIsQ0FBQyxFQUFFLENBQUM7UUFDSCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDM0YsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsSUFBSSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDM0QsQ0FBQyxNQUFNLGtDQUFrQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2xFLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWM7V0FDOUQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDckQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDckQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWM7V0FDL0QsUUFBUSxDQUFDLFFBQVEsQ0FBQyxzQkFBc0IsS0FBSyxXQUFXLENBQUMsc0JBQXNCO1dBQy9FLFFBQVEsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEtBQUssV0FBVyxDQUFDLG9CQUFvQjtXQUMzRSxRQUFRLENBQUMsUUFBUSxDQUFDLGVBQWUsS0FBSyxXQUFXLENBQUMsZUFBZTtXQUNqRSxRQUFRLENBQUMsUUFBUSxDQUFDLHVCQUF1QixLQUFLLFdBQVcsQ0FBQyx1QkFBdUI7V0FDakYsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEtBQUssV0FBVyxDQUFDLFVBQVU7V0FDL0MsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQzdELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUM1QixRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNsRSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLGtCQUFrQixHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTztTQUNqRCxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7U0FDM0MsSUFBSSxFQUFFLENBQUM7SUFDVixNQUFNLGdCQUFnQixHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDdEYsSUFBSSxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxNQUFNO1dBQ3pELElBQUksQ0FBQyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUM3RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLHdCQUF3QixHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUM7UUFDbkYsUUFBUSxDQUFDLGVBQWU7UUFDeEIsUUFBUTtLQUNULENBQUMsQ0FBQyxDQUFDO0lBQ0osS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDckMsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksT0FBTyxLQUFLLENBQUMsZUFBZSxLQUFLLFFBQVE7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNuRyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDL0QsVUFBVTtZQUNWLGlCQUFpQjtTQUNsQixDQUFDLEVBQUUsQ0FBQztZQUNILE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELE1BQU0sYUFBYSxHQUFHLHdCQUF3QixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDMUUsSUFBSSxDQUFDLGFBQWE7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNqQyxJQUFJLFFBQStDLENBQUM7UUFDcEQsSUFBSSxDQUFDO1lBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3JFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLHNCQUFzQjtZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ2pGLE1BQU0sT0FBTyxHQUFHLDJDQUEyQyxDQUFDO1lBQzFELGNBQWMsRUFBRSxXQUFXLENBQUMsc0JBQXNCO1lBQ2xELGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLGNBQWM7WUFDaEQsU0FBUyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUztZQUN0QyxTQUFTLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTO1lBQ3RDLGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLGNBQWM7WUFDaEQsc0JBQXNCLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxzQkFBc0I7WUFDaEUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0I7WUFDNUQsZUFBZSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsZUFBZTtZQUNsRCx1QkFBdUIsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLHVCQUF1QjtZQUNsRSxVQUFVLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFO1lBQ2hDLGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU07WUFDeEMsUUFBUSxFQUFFLGFBQWEsQ0FBQyxRQUFRO1lBQ2hDLGVBQWUsRUFBRSxhQUFhLENBQUMsZUFBZTtTQUMvQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7SUFDMUUsQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBc0VGLE1BQU0sd0JBQXdCLEdBQUcscUNBQXFDLENBQUM7QUFDdkUsTUFBTSx1QkFBdUIsR0FBRyx1Q0FBdUMsQ0FBQztBQUV4RSxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNqRSxvQkFBb0I7UUFDcEIsVUFBVTtRQUNWLG1CQUFtQjtRQUNuQix3QkFBd0I7S0FDekIsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3hELE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxzQkFBc0IsS0FBSyxRQUFRO1dBQ2pELENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLGlCQUFpQixLQUFLLFFBQVE7V0FDNUMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztXQUMvQyxPQUFPLENBQUMsa0JBQTZCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxJQUFJLFdBQVcsSUFBSSxPQUFPLElBQUksZ0JBQWdCLElBQUksT0FBTyxFQUFFLENBQUM7UUFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQzdELFlBQXFCLEVBQ0YsRUFBRTtJQUNyQixJQUFJLENBQUMsWUFBWSxJQUFJLE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDckYsT0FBTyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLFlBQXVDLENBQUM7SUFDMUQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNuRSxXQUFXO1FBQ1gsY0FBYztRQUNkLFVBQVU7UUFDVixXQUFXO1FBQ1gsWUFBWTtRQUNaLFdBQVc7UUFDWCxnQkFBZ0I7UUFDaEIsZUFBZTtLQUNoQixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLGNBQWMsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLENBQVUsRUFBRSxDQUFDO1FBQzdFLElBQUksT0FBTyxTQUFTLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUTtlQUNuQyxDQUFDLHdCQUF3QixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFXLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLEtBQUssb0JBQW9CLENBQUMsQ0FBQztRQUNqRSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQy9GLElBQUksT0FBTyxTQUFTLENBQUMsU0FBUyxLQUFLLFFBQVE7V0FDdEMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLElBQUssU0FBUyxDQUFDLFVBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEYsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLElBQUssU0FBUyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLFFBQTJELENBQUM7SUFDaEUsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksUUFBUSxFQUFFLENBQUM7UUFDYixJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3pELE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN2RCxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN4QixNQUFNLE9BQU8sR0FBRywrQ0FBK0MsQ0FBQztnQkFDOUQsWUFBWSxFQUFFLFNBQVMsQ0FBQyxZQUFzQjtnQkFDOUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjtnQkFDeEMsY0FBYyxFQUFFLFNBQVMsQ0FBQyxjQUF3QjtnQkFDbEQsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjtnQkFDeEMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxVQUFvQjtnQkFDMUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjthQUN6QyxDQUFDLENBQUM7WUFDSCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1lBQzdELENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGdEQUFnRCxHQUFHLENBQzlELFVBQW1CLEVBQ1QsRUFBRTtJQUNaLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMvRSxPQUFPLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBcUMsQ0FBQztJQUN0RCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ2pFLGNBQWM7UUFDZCxvQkFBb0I7UUFDcEIsVUFBVTtRQUNWLFVBQVU7S0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7V0FDeEQsT0FBUSxPQUFPLENBQUMsUUFBb0MsQ0FBQyxHQUFHLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFlBQVksS0FBSyxRQUFRO1dBQ3ZDLENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQzFELE1BQU0sQ0FBQyxJQUFJLENBQUMsaUNBQWlDLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1dBQy9DLE9BQU8sQ0FBQyxrQkFBNkIsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUM1RixNQUFNLENBQUMsSUFBSSxDQUFDLDZFQUE2RSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELElBQUksV0FBVyxJQUFJLE9BQU8sSUFBSSxnQkFBZ0IsSUFBSSxPQUFPLEVBQUUsQ0FBQztRQUMxRCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "21.1.0",
+  "version": "23.0.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -18,6 +18,7 @@
   "license": "MIT",
   "dependencies": {
     "@api.global/typedrequest-interfaces": "^4.0.0",
+    "@push.rocks/smartcrypto": "^2.2.0",
     "@push.rocks/smartlog-interfaces": "^3.0.2",
     "@tsclass/tsclass": "^9.5.1"
   },