@serve.zone/interfaces 21.1.0 → 23.0.0

package/dist_ts/data/service.d.ts

@@ -22,36 +22,12 @@ export interface IServiceVolume {
     /** Driver-specific options forwarded to Docker's VolumeDriver.Create request. */
     options?: Record<string, string>;
 }
-/**
- * A single secret-bundle key delivered as a file instead of an environment
- * variable. Targets are intentionally restricted to Docker's secret tmpfs so
- * a deployment declaration cannot overwrite application or system files.
- */
-export interface IServiceSecretFile {
-    /** Key in the service's merged secret bundles. */
-    sourceKey: string;
-    /** Absolute file path below /run/secrets/. */
-    targetPath: string;
-    /** Numeric container user identity. */
-    uid: number;
-    /** Numeric container group identity. */
-    gid: number;
-    /** Read-only POSIX mode. Supported values are 0400 and 0440. */
-    mode: number;
-}
 export declare const serviceContainerArgLimits: {
     readonly maximumArgs: 64;
     readonly maximumArgBytes: 4096;
     readonly maximumTotalBytes: number;
 };
-export declare const serviceSecretFileLimits: {
-    readonly maximumFiles: 32;
-    readonly maximumValueBytes: number;
-    readonly maximumIdentity: 2147483647;
-};
 export declare const normalizeServiceAbsolutePath: (pathArg: string) => string | undefined;
-/** Pure, secret-value-free validation shared by Cloudly and Coreflow. */
-export declare const validateServiceSecretFiles: (secretFilesArg: unknown, volumeMountPathsArg?: string[]) => string[];
 /** Pure validation for the exact OCI/Docker argument vector after image entrypoint. */
 export declare const validateServiceContainerArgs: (containerArgsArg: unknown) => string[];
 /**
@@ -118,27 +94,12 @@ export interface IService {
         environment: {
             [key: string]: string;
         };
-        /**
-         * Legacy main SecretBundle ID. New services use secretConfiguration and
-         * the server-managed secretDeployment manifest pointer.
-         *
-         * @deprecated Compatibility-only until the versioned SecretBundle migration completes.
-         */
-        secretBundleId?: string;
-        /**
-         * Legacy additional SecretBundle IDs.
-         *
-         * @deprecated Use explicit same-organization SecretSet attachments.
-         */
-        additionalSecretBundleIds?: string[];
         /** Value-free, caller-managed SecretSet attachment configuration. */
         secretConfiguration?: IServiceSecretConfiguration;
         /** Server-managed immutable manifest authority pointer. */
         secretDeployment?: IServiceSecretDeploymentPlan;
         /** Exact OCI/Docker argument vector appended after the image entrypoint. */
         containerArgs?: string[];
-        /** Secret keys mounted as files and excluded from Env and secret.json. */
-        secretFiles?: IServiceSecretFile[];
         /**
          * Service category determines deployment behavior
          * - base: Core services that run on every node (coreflow, coretraffic, corelog)

package/dist_ts/data/service.js

@@ -3,11 +3,6 @@ export const serviceContainerArgLimits = {
     maximumArgBytes: 4096,
     maximumTotalBytes: 32 * 1024,
 };
-export const serviceSecretFileLimits = {
-    maximumFiles: 32,
-    maximumValueBytes: 500 * 1024,
-    maximumIdentity: 2_147_483_647,
-};
 export const normalizeServiceAbsolutePath = (pathArg) => {
     if (typeof pathArg !== 'string'
         || !pathArg.startsWith('/')
@@ -31,77 +26,6 @@ export const normalizeServiceAbsolutePath = (pathArg) => {
     }
     return `/${segments.join('/')}`;
 };
-const isCanonicalSecretTargetPath = (targetPathArg) => (normalizeServiceAbsolutePath(targetPathArg) === targetPathArg
-    && /^\/run\/secrets\/[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(targetPathArg)
-    && targetPathArg !== '/run/secrets/secret.json');
-const pathsOverlap = (leftArg, rightArg) => {
-    const left = normalizeServiceAbsolutePath(leftArg);
-    const right = normalizeServiceAbsolutePath(rightArg);
-    if (!left || !right)
-        return false;
-    if (left === '/' || right === '/')
-        return true;
-    return left === right || left.startsWith(`${right}/`) || right.startsWith(`${left}/`);
-};
-/** Pure, secret-value-free validation shared by Cloudly and Coreflow. */
-export const validateServiceSecretFiles = (secretFilesArg, volumeMountPathsArg = []) => {
-    if (secretFilesArg === undefined)
-        return [];
-    if (!Array.isArray(secretFilesArg))
-        return ['secretFiles must be an array'];
-    if (secretFilesArg.length > serviceSecretFileLimits.maximumFiles) {
-        return [`secretFiles must contain at most ${serviceSecretFileLimits.maximumFiles} entries`];
-    }
-    const errors = [];
-    if (volumeMountPathsArg.some((mountPathArg) => (normalizeServiceAbsolutePath(mountPathArg) !== mountPathArg))) {
-        errors.push('volume mount paths must be canonical absolute paths');
-    }
-    const sourceKeys = [];
-    const targetPaths = [];
-    for (const [index, candidate] of secretFilesArg.entries()) {
-        if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
-            errors.push(`secretFiles[${index}] must be an object`);
-            continue;
-        }
-        const mapping = candidate;
-        if (typeof mapping.sourceKey !== 'string'
-            || mapping.sourceKey.length > 253
-            || !/^[A-Z_][A-Z0-9_]*$/.test(mapping.sourceKey)) {
-            errors.push(`secretFiles[${index}].sourceKey must be a canonical environment key`);
-        }
-        else {
-            sourceKeys.push(mapping.sourceKey);
-        }
-        if (typeof mapping.targetPath !== 'string'
-            || !isCanonicalSecretTargetPath(mapping.targetPath)) {
-            errors.push(`secretFiles[${index}].targetPath must be a unique canonical file below /run/secrets and may not be secret.json`);
-        }
-        else {
-            targetPaths.push(mapping.targetPath);
-            if (volumeMountPathsArg.some((mountPathArg) => (typeof mountPathArg === 'string' && pathsOverlap(mapping.targetPath, mountPathArg)))) {
-                errors.push(`secretFiles[${index}].targetPath overlaps a declared volume mount`);
-            }
-        }
-        for (const identityField of ['uid', 'gid']) {
-            const identity = mapping[identityField];
-            if (!Number.isSafeInteger(identity)
-                || identity < 0
-                || identity > serviceSecretFileLimits.maximumIdentity) {
-                errors.push(`secretFiles[${index}].${identityField} must be a bounded numeric identity`);
-            }
-        }
-        if (mapping.mode !== 0o400 && mapping.mode !== 0o440) {
-            errors.push(`secretFiles[${index}].mode must be 0400 or 0440`);
-        }
-    }
-    if (new Set(sourceKeys).size !== sourceKeys.length) {
-        errors.push('secretFiles sourceKey values must be unique');
-    }
-    if (new Set(targetPaths).size !== targetPaths.length) {
-        errors.push('secretFiles targetPath values must be unique');
-    }
-    return errors;
-};
 /** Pure validation for the exact OCI/Docker argument vector after image entrypoint. */
 export const validateServiceContainerArgs = (containerArgsArg) => {
     if (containerArgsArg === undefined)
@@ -133,4 +57,4 @@ export const validateServiceContainerArgs = (containerArgsArg) => {
     }
     return [];
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFzREEsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUc7SUFDdkMsV0FBVyxFQUFFLEVBQUU7SUFDZixlQUFlLEVBQUUsSUFBSTtJQUNyQixpQkFBaUIsRUFBRSxFQUFFLEdBQUcsSUFBSTtDQUNwQixDQUFDO0FBRVgsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUc7SUFDckMsWUFBWSxFQUFFLEVBQUU7SUFDaEIsaUJBQWlCLEVBQUUsR0FBRyxHQUFHLElBQUk7SUFDN0IsZUFBZSxFQUFFLGFBQWE7Q0FDdEIsQ0FBQztBQUVYLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsT0FBZSxFQUFzQixFQUFFO0lBQ2xGLElBQUksT0FBTyxPQUFPLEtBQUssUUFBUTtXQUMxQixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDO1dBQ3hCLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO1dBQ3RCLE9BQU8sQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDMUIsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFhLEVBQUUsQ0FBQztJQUM5QixLQUFLLE1BQU0sT0FBTyxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN6QyxJQUFJLENBQUMsT0FBTyxJQUFJLE9BQU8sS0FBSyxHQUFHO1lBQUUsU0FBUztRQUMxQyxJQUFJLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNyQixJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztnQkFBRSxPQUFPLFNBQVMsQ0FBQztZQUM1QyxRQUFRLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDZixTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDO1lBQUUsT0FBTyxTQUFTLENBQUM7UUFDekQsUUFBUSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN6QixDQUFDO0lBQ0QsT0FBTyxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztBQUNsQyxDQUFDLENBQUM7QUFFRixNQUFNLDJCQUEyQixHQUFHLENBQUMsYUFBcUIsRUFBVyxFQUFFLENBQUMsQ0FDdEUsNEJBQTRCLENBQUMsYUFBYSxDQUFDLEtBQUssYUFBYTtPQUMxRCxvREFBb0QsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDO09BQ3hFLGFBQWEsS0FBSywwQkFBMEIsQ0FDaEQsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsT0FBZSxFQUFFLFFBQWdCLEVBQVcsRUFBRTtJQUNsRSxNQUFNLElBQUksR0FBRyw0QkFBNEIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNuRCxNQUFNLEtBQUssR0FBRyw0QkFBNEIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNyRCxJQUFJLENBQUMsSUFBSSxJQUFJLENBQUMsS0FBSztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ2xDLElBQUksSUFBSSxLQUFLLEdBQUcsSUFBSSxLQUFLLEtBQUssR0FBRztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQy9DLE9BQU8sSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsS0FBSyxHQUFHLENBQUMsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQztBQUN4RixDQUFDLENBQUM7QUFFRix5RUFBeUU7QUFDekUsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FDeEMsY0FBdUIsRUFDdkIsc0JBQWdDLEVBQUUsRUFDeEIsRUFBRTtJQUNaLElBQUksY0FBYyxLQUFLLFNBQVM7UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUM1QyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUM7UUFBRSxPQUFPLENBQUMsOEJBQThCLENBQUMsQ0FBQztJQUM1RSxJQUFJLGNBQWMsQ0FBQyxNQUFNLEdBQUcsdUJBQXVCLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDakUsT0FBTyxDQUFDLG9DQUFvQyx1QkFBdUIsQ0FBQyxZQUFZLFVBQVUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLENBQzdDLDRCQUE0QixDQUFDLFlBQVksQ0FBQyxLQUFLLFlBQVksQ0FDNUQsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFhLEVBQUUsQ0FBQztJQUNoQyxNQUFNLFdBQVcsR0FBYSxFQUFFLENBQUM7SUFDakMsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxJQUFJLGNBQWMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQzFELElBQUksQ0FBQyxTQUFTLElBQUksT0FBTyxTQUFTLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsS0FBSyxxQkFBcUIsQ0FBQyxDQUFDO1lBQ3ZELFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsU0FBd0MsQ0FBQztRQUN6RCxJQUFJLE9BQU8sT0FBTyxDQUFDLFNBQVMsS0FBSyxRQUFRO2VBQ3BDLE9BQU8sQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLEdBQUc7ZUFDOUIsQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDbkQsTUFBTSxDQUFDLElBQUksQ0FBQyxlQUFlLEtBQUssaURBQWlELENBQUMsQ0FBQztRQUNyRixDQUFDO2FBQU0sQ0FBQztZQUNOLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3JDLENBQUM7UUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFVBQVUsS0FBSyxRQUFRO2VBQ3JDLENBQUMsMkJBQTJCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDdEQsTUFBTSxDQUFDLElBQUksQ0FDVCxlQUFlLEtBQUssNEZBQTRGLENBQ2pILENBQUM7UUFDSixDQUFDO2FBQU0sQ0FBQztZQUNOLFdBQVcsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ3JDLElBQUksbUJBQW1CLENBQUMsSUFBSSxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyxDQUM3QyxPQUFPLFlBQVksS0FBSyxRQUFRLElBQUksWUFBWSxDQUFDLE9BQU8sQ0FBQyxVQUFvQixFQUFFLFlBQVksQ0FBQyxDQUM3RixDQUFDLEVBQUUsQ0FBQztnQkFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsS0FBSywrQ0FBK0MsQ0FBQyxDQUFDO1lBQ25GLENBQUM7UUFDSCxDQUFDO1FBQ0QsS0FBSyxNQUFNLGFBQWEsSUFBSSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQVUsRUFBRSxDQUFDO1lBQ3BELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUN4QyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7bUJBQzdCLFFBQW1CLEdBQUcsQ0FBQzttQkFDdkIsUUFBbUIsR0FBRyx1QkFBdUIsQ0FBQyxlQUFlLEVBQUUsQ0FBQztnQkFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyxlQUFlLEtBQUssS0FBSyxhQUFhLHFDQUFxQyxDQUFDLENBQUM7WUFDM0YsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssS0FBSyxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssS0FBSyxFQUFFLENBQUM7WUFDckQsTUFBTSxDQUFDLElBQUksQ0FBQyxlQUFlLEtBQUssNkJBQTZCLENBQUMsQ0FBQztRQUNqRSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLDZDQUE2QyxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxLQUFLLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLGdCQUF5QixFQUFZLEVBQUU7SUFDbEYsSUFBSSxnQkFBZ0IsS0FBSyxTQUFTO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDOUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUM7UUFBRSxPQUFPLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUNoRixJQUFJLGdCQUFnQixDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNsQyxPQUFPLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcseUJBQXlCLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDcEUsT0FBTyxDQUFDLHNDQUFzQyx5QkFBeUIsQ0FBQyxXQUFXLFVBQVUsQ0FBQyxDQUFDO0lBQ2pHLENBQUM7SUFDRCxJQUFJLFVBQVUsR0FBRyxDQUFDLENBQUM7SUFDbkIsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxJQUFJLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDM0QsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMxRCxPQUFPLENBQUMsaUJBQWlCLEtBQUssOEJBQThCLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUMzQyxPQUFPLENBQUMsaUJBQWlCLEtBQUssdUNBQXVDLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQ0QsTUFBTSxhQUFhLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxDQUFDO1FBQ3BFLElBQUksYUFBYSxHQUFHLHlCQUF5QixDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzlELE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyxvQ0FBb0MsQ0FBQyxDQUFDO1FBQ3RFLENBQUM7UUFDRCxVQUFVLElBQUksYUFBYSxDQUFDO0lBQzlCLENBQUM7SUFDRCxJQUFJLFVBQVUsR0FBRyx5QkFBeUIsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQzdELE9BQU8sQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFvQ0EsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUc7SUFDdkMsV0FBVyxFQUFFLEVBQUU7SUFDZixlQUFlLEVBQUUsSUFBSTtJQUNyQixpQkFBaUIsRUFBRSxFQUFFLEdBQUcsSUFBSTtDQUNwQixDQUFDO0FBRVgsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxPQUFlLEVBQXNCLEVBQUU7SUFDbEYsSUFBSSxPQUFPLE9BQU8sS0FBSyxRQUFRO1dBQzFCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7V0FDeEIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7V0FDdEIsT0FBTyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUMxQixPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQWEsRUFBRSxDQUFDO0lBQzlCLEtBQUssTUFBTSxPQUFPLElBQUksT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxLQUFLLEdBQUc7WUFBRSxTQUFTO1FBQzFDLElBQUksT0FBTyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3JCLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO2dCQUFFLE9BQU8sU0FBUyxDQUFDO1lBQzVDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNmLFNBQVM7UUFDWCxDQUFDO1FBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7WUFBRSxPQUFPLFNBQVMsQ0FBQztRQUN6RCxRQUFRLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3pCLENBQUM7SUFDRCxPQUFPLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO0FBQ2xDLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLGdCQUF5QixFQUFZLEVBQUU7SUFDbEYsSUFBSSxnQkFBZ0IsS0FBSyxTQUFTO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDOUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUM7UUFBRSxPQUFPLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUNoRixJQUFJLGdCQUFnQixDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNsQyxPQUFPLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcseUJBQXlCLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDcEUsT0FBTyxDQUFDLHNDQUFzQyx5QkFBeUIsQ0FBQyxXQUFXLFVBQVUsQ0FBQyxDQUFDO0lBQ2pHLENBQUM7SUFDRCxJQUFJLFVBQVUsR0FBRyxDQUFDLENBQUM7SUFDbkIsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxJQUFJLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDM0QsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMxRCxPQUFPLENBQUMsaUJBQWlCLEtBQUssOEJBQThCLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUMzQyxPQUFPLENBQUMsaUJBQWlCLEtBQUssdUNBQXVDLENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQ0QsTUFBTSxhQUFhLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxDQUFDO1FBQ3BFLElBQUksYUFBYSxHQUFHLHlCQUF5QixDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzlELE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyxvQ0FBb0MsQ0FBQyxDQUFDO1FBQ3RFLENBQUM7UUFDRCxVQUFVLElBQUksYUFBYSxDQUFDO0lBQzlCLENBQUM7SUFDRCxJQUFJLFVBQVUsR0FBRyx5QkFBeUIsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQzdELE9BQU8sQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUMsQ0FBQyJ9

package/dist_ts/data/settings.d.ts

@@ -1,52 +1,71 @@
-/**
- * Interface for Cloudly settings stored in EasyStore
- * These are runtime-configurable settings that can be modified via the UI
- */
+export interface ICloudlyS3BackupTargetDescriptor {
+    type: 's3';
+    endpoint: string;
+    bucket: string;
+    region?: string;
+    port?: number;
+    useSsl?: boolean;
+}
+export interface ICloudlyNfsBackupTargetDescriptor {
+    type: 'nfs';
+    path: string;
+}
+export interface ICloudlySmbBackupTargetDescriptor {
+    type: 'smb';
+    host: string;
+    share: string;
+    domain?: string;
+    port?: number;
+}
+export type TCloudlyBackupTargetDescriptor = ICloudlyS3BackupTargetDescriptor | ICloudlyNfsBackupTargetDescriptor | ICloudlySmbBackupTargetDescriptor;
+/** Public runtime-configurable settings. No serialized credential belongs here. */
 export interface ICloudlySettings {
-    hetznerToken?: string;
-    cloudflareToken?: string;
-    deploymentArchiveRetentionDays?: string;
-    backupExternalTargetType?: string;
-    backupExternalTargetConfig?: string;
-    backupNodeCacheKeepDays?: string;
+    deploymentArchiveRetentionDays?: number;
+    backupExternalTarget?: TCloudlyBackupTargetDescriptor;
+    backupNodeCacheKeepDays?: number;
     dcrouterGatewayUrl?: string;
-    dcrouterGatewayApiToken?: string;
     dcrouterGatewayClientId?: string;
     dcrouterTargetHost?: string;
-    dcrouterTargetPort?: string;
-    dcrouterTargetHostsByNode?: string;
+    dcrouterTargetPort?: number;
+    dcrouterTargetHostsByNode?: Record<string, string>;
     dcrouterMailSubmissionHost?: string;
-    dcrouterMailSubmissionPort?: string;
+    dcrouterMailSubmissionPort?: number;
     dcrouterMailSubmissionTlsMode?: 'plain' | 'starttls' | 'implicitTls';
     dcrouterMailForwardTargetHost?: string;
-    dcrouterMailForwardTargetHostsByNode?: string;
-    baseosJoinToken?: string;
+    dcrouterMailForwardTargetHostsByNode?: Record<string, string>;
     corebuildWorkerUrl?: string;
-    corebuildWorkerToken?: string;
-    corebuildWorkersJson?: string;
-    awsAccessKey?: string;
-    awsSecretKey?: string;
-    awsRegion?: string;
-    digitalOceanToken?: string;
-    azureClientId?: string;
-    azureClientSecret?: string;
-    azureTenantId?: string;
-    azureSubscriptionId?: string;
-    googleCloudKeyJson?: string;
-    googleCloudProjectId?: string;
-    vultrApiKey?: string;
-    linodeToken?: string;
-    ovhApplicationKey?: string;
-    ovhApplicationSecret?: string;
-    ovhConsumerKey?: string;
-    scalewayAccessKey?: string;
-    scalewaySecretKey?: string;
-    scalewayOrganizationId?: string;
+    corebuildWorkerUrls?: string[];
 }
-/**
- * Interface for masked settings (used in API responses)
- * Shows only last 4 characters of sensitive tokens
- */
-export type ICloudlySettingsMasked = {
-    [K in keyof ICloudlySettings]: string | undefined;
-};
+export declare const cloudlySystemSecretOwner: Readonly<{
+    readonly kind: "system";
+    readonly systemId: "cloudly-settings";
+}>;
+export declare const cloudlySystemSecretManagementScope: "system:cloudly-settings";
+/** Stable keys for values removed from serialized Cloudly settings. */
+export declare const cloudlySystemSecretKeys: Readonly<{
+    readonly hetznerToken: "HETZNER_TOKEN";
+    readonly cloudflareToken: "CLOUDFLARE_TOKEN";
+    readonly backupExternalTargetCredentials: "BACKUP_EXTERNAL_TARGET_CREDENTIALS";
+    readonly dcrouterGatewayApiToken: "DCROUTER_GATEWAY_API_TOKEN";
+    readonly baseosJoinToken: "BASEOS_JOIN_TOKEN";
+    readonly corebuildWorkerToken: "COREBUILD_WORKER_TOKEN";
+    readonly corebuildWorkers: "COREBUILD_WORKERS";
+    readonly awsAccessKey: "AWS_ACCESS_KEY";
+    readonly awsSecretKey: "AWS_SECRET_KEY";
+    readonly awsRegion: "AWS_REGION";
+    readonly digitalOceanToken: "DIGITALOCEAN_TOKEN";
+    readonly azureClientId: "AZURE_CLIENT_ID";
+    readonly azureClientSecret: "AZURE_CLIENT_SECRET";
+    readonly azureTenantId: "AZURE_TENANT_ID";
+    readonly azureSubscriptionId: "AZURE_SUBSCRIPTION_ID";
+    readonly googleCloudKey: "GOOGLE_CLOUD_KEY";
+    readonly googleCloudProjectId: "GOOGLE_CLOUD_PROJECT_ID";
+    readonly vultrApiKey: "VULTR_API_KEY";
+    readonly linodeToken: "LINODE_TOKEN";
+    readonly ovhApplicationKey: "OVH_APPLICATION_KEY";
+    readonly ovhApplicationSecret: "OVH_APPLICATION_SECRET";
+    readonly ovhConsumerKey: "OVH_CONSUMER_KEY";
+    readonly scalewayAccessKey: "SCALEWAY_ACCESS_KEY";
+    readonly scalewaySecretKey: "SCALEWAY_SECRET_KEY";
+    readonly scalewayOrganizationId: "SCALEWAY_ORGANIZATION_ID";
+}>;

package/dist_ts/data/settings.js

@@ -1,2 +1,34 @@
-import * as plugins from '../plugins.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2V0dGluZ3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NldHRpbmdzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDIn0=
+export const cloudlySystemSecretOwner = Object.freeze({
+    kind: 'system',
+    systemId: 'cloudly-settings',
+});
+export const cloudlySystemSecretManagementScope = 'system:cloudly-settings';
+/** Stable keys for values removed from serialized Cloudly settings. */
+export const cloudlySystemSecretKeys = Object.freeze({
+    hetznerToken: 'HETZNER_TOKEN',
+    cloudflareToken: 'CLOUDFLARE_TOKEN',
+    backupExternalTargetCredentials: 'BACKUP_EXTERNAL_TARGET_CREDENTIALS',
+    dcrouterGatewayApiToken: 'DCROUTER_GATEWAY_API_TOKEN',
+    baseosJoinToken: 'BASEOS_JOIN_TOKEN',
+    corebuildWorkerToken: 'COREBUILD_WORKER_TOKEN',
+    corebuildWorkers: 'COREBUILD_WORKERS',
+    awsAccessKey: 'AWS_ACCESS_KEY',
+    awsSecretKey: 'AWS_SECRET_KEY',
+    awsRegion: 'AWS_REGION',
+    digitalOceanToken: 'DIGITALOCEAN_TOKEN',
+    azureClientId: 'AZURE_CLIENT_ID',
+    azureClientSecret: 'AZURE_CLIENT_SECRET',
+    azureTenantId: 'AZURE_TENANT_ID',
+    azureSubscriptionId: 'AZURE_SUBSCRIPTION_ID',
+    googleCloudKey: 'GOOGLE_CLOUD_KEY',
+    googleCloudProjectId: 'GOOGLE_CLOUD_PROJECT_ID',
+    vultrApiKey: 'VULTR_API_KEY',
+    linodeToken: 'LINODE_TOKEN',
+    ovhApplicationKey: 'OVH_APPLICATION_KEY',
+    ovhApplicationSecret: 'OVH_APPLICATION_SECRET',
+    ovhConsumerKey: 'OVH_CONSUMER_KEY',
+    scalewayAccessKey: 'SCALEWAY_ACCESS_KEY',
+    scalewaySecretKey: 'SCALEWAY_SECRET_KEY',
+    scalewayOrganizationId: 'SCALEWAY_ORGANIZATION_ID',
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2V0dGluZ3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NldHRpbmdzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQWdEQSxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3BELElBQUksRUFBRSxRQUFRO0lBQ2QsUUFBUSxFQUFFLGtCQUFrQjtDQUNTLENBQUMsQ0FBQztBQUV6QyxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FDN0MseUJBQW1FLENBQUM7QUFFdEUsdUVBQXVFO0FBQ3ZFLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbkQsWUFBWSxFQUFFLGVBQWU7SUFDN0IsZUFBZSxFQUFFLGtCQUFrQjtJQUNuQywrQkFBK0IsRUFBRSxvQ0FBb0M7SUFDckUsdUJBQXVCLEVBQUUsNEJBQTRCO0lBQ3JELGVBQWUsRUFBRSxtQkFBbUI7SUFDcEMsb0JBQW9CLEVBQUUsd0JBQXdCO0lBQzlDLGdCQUFnQixFQUFFLG1CQUFtQjtJQUNyQyxZQUFZLEVBQUUsZ0JBQWdCO0lBQzlCLFlBQVksRUFBRSxnQkFBZ0I7SUFDOUIsU0FBUyxFQUFFLFlBQVk7SUFDdkIsaUJBQWlCLEVBQUUsb0JBQW9CO0lBQ3ZDLGFBQWEsRUFBRSxpQkFBaUI7SUFDaEMsaUJBQWlCLEVBQUUscUJBQXFCO0lBQ3hDLGFBQWEsRUFBRSxpQkFBaUI7SUFDaEMsbUJBQW1CLEVBQUUsdUJBQXVCO0lBQzVDLGNBQWMsRUFBRSxrQkFBa0I7SUFDbEMsb0JBQW9CLEVBQUUseUJBQXlCO0lBQy9DLFdBQVcsRUFBRSxlQUFlO0lBQzVCLFdBQVcsRUFBRSxjQUFjO0lBQzNCLGlCQUFpQixFQUFFLHFCQUFxQjtJQUN4QyxvQkFBb0IsRUFBRSx3QkFBd0I7SUFDOUMsY0FBYyxFQUFFLGtCQUFrQjtJQUNsQyxpQkFBaUIsRUFBRSxxQkFBcUI7SUFDeEMsaUJBQWlCLEVBQUUscUJBQXFCO0lBQ3hDLHNCQUFzQixFQUFFLDBCQUEwQjtDQUMxQyxDQUFDLENBQUMifQ==

package/dist_ts/platform/storage.d.ts

@@ -1,3 +1,4 @@
+import type { TSecretManagementScope } from '../data/secret.js';
 /**
  * Backend-neutral storage vocabulary shared by App Store manifests, control
  * planes, and fulfillment adapters. Physical providers and runtime attachment
@@ -84,12 +85,12 @@ export type TStorageClassCapabilities = IFilesystemStorageClassCapabilities | IO
  * addresses, mount options, principals, and credential values are private.
  */
 export interface IStorageCapabilityAdvertisement {
-    schemaVersion: 1;
+    schemaVersion: 2;
     featureIds: string[];
     classes: TStorageClassCapabilities[];
 }
-export interface IObjectStorageEnvironmentDelivery {
-    type: 'environment';
+export interface IObjectStorageLauncherEnvironmentDelivery {
+    type: 'launcher-environment';
     /**
      * Explicit target keys prevent two named bindings from silently overwriting
      * each other. Every required field must have a distinct environment key.
@@ -103,8 +104,8 @@ export interface IObjectStorageEnvironmentDelivery {
         sessionToken?: string;
     };
 }
-export interface IObjectStorageSecretFileDelivery {
-    type: 'secretFile';
+export interface IObjectStorageFileDelivery {
+    type: 'file';
     /** Canonical absolute path below /run/secrets/. */
     targetPath: string;
     /**
@@ -112,8 +113,11 @@ export interface IObjectStorageSecretFileDelivery {
      * secretAccessKey, and optional sessionToken fields.
      */
     format: 'servezone-object-storage-v1';
+    uid: number;
+    gid: number;
+    mode: 0o400 | 0o440;
 }
-export type TObjectStorageDelivery = IObjectStorageEnvironmentDelivery | IObjectStorageSecretFileDelivery;
+export type TObjectStorageDelivery = IObjectStorageLauncherEnvironmentDelivery | IObjectStorageFileDelivery;
 export type TResolvedStorageBindingStatus = 'requested' | 'provisioning' | 'ready' | 'degraded' | 'failed' | 'releasing' | 'retained' | 'released';
 export type TStorageBindingFailureCode = 'unsupportedCapability' | 'policyUnavailable' | 'provisionFailed' | 'attachmentFailed' | 'quotaExceeded' | 'credentialsUnavailable' | 'backendUnavailable' | 'migrationRequired';
 export interface IStorageBindingFailure {
@@ -133,7 +137,7 @@ export interface IResolvedStorageCapacity {
     limit?: TStorageCapacityQuantity;
 }
 export interface IResolvedStorageBindingBase {
-    schemaVersion: 1;
+    schemaVersion: 2;
     /** Stable binding/allocation identity. */
     id: string;
     serviceId: string;
@@ -162,12 +166,6 @@ export interface IResolvedFilesystemStorageBinding extends IResolvedStorageBindi
     mountPath: string;
     accessMode: TFilesystemStorageAccessMode;
 }
-export interface IStorageObjectCredentialsRef {
-    secretBundleId: string;
-    accessKeyIdKey: string;
-    secretAccessKeyKey: string;
-    sessionTokenKey?: string;
-}
 export interface IResolvedObjectStorageConnection {
     endpoint: string;
     bucket: string;
@@ -177,7 +175,8 @@ export interface IResolvedObjectStorageBinding extends IResolvedStorageBindingBa
     kind: 'objectStorage';
     accessMode: TObjectStorageAccessMode;
     connection: IResolvedObjectStorageConnection;
-    credentials: IStorageObjectCredentialsRef;
+    /** Value-free service-owned Secret reconciliation scope. */
+    credentialManagementScope: Extract<TSecretManagementScope, `platform:${string}`>;
     delivery: TObjectStorageDelivery;
     versioning: boolean;
     retentionDays?: number;

package/dist_ts/platform/storage.js

@@ -5,4 +5,4 @@
 export const storageKindPlatformCapabilityIds = {
     objectStorage: 'objectstorage',
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmFnZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL3N0b3JhZ2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBTUE7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUc7SUFDOUMsYUFBYSxFQUFFLGVBQWU7Q0FDdEIsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmFnZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL3N0b3JhZ2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBUUE7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUc7SUFDOUMsYUFBYSxFQUFFLGVBQWU7Q0FDdEIsQ0FBQyJ9

package/dist_ts/platform/storagemigration.d.ts

@@ -1,7 +1,7 @@
 import type { IAppStoreObjectStorageRequest, IAppStoreStorageClass } from '../appstore/types.js';
-import type { IResolvedObjectStorageBinding, IResolvedStoragePolicyRef, IStorageObjectCredentialsRef } from './storage.js';
+import type { IResolvedObjectStorageBinding, IResolvedStoragePolicyRef } from './storage.js';
 export declare const storageMigrationContractLimits: Readonly<{
-    version: 1;
+    version: 2;
     maximumControlJsonBytes: number;
     maximumConfiguredStringBytes: 2048;
     maximumIssueMessageBytes: 4096;
@@ -32,7 +32,7 @@ export interface IStorageBindingMigrationOwner {
     migrationDigest: string;
 }
 export interface IUnfencedObjectStorageBindingControlSnapshot {
-    schemaVersion: 1;
+    schemaVersion: 2;
     binding: TActiveObjectStorageBinding;
     recordRevision: number;
     snapshotDigest: string;
@@ -40,7 +40,7 @@ export interface IUnfencedObjectStorageBindingControlSnapshot {
     activeMigration?: never;
 }
 export interface IFencedObjectStorageBindingControlSnapshot {
-    schemaVersion: 1;
+    schemaVersion: 2;
     binding: TActiveObjectStorageBinding;
     recordRevision: number;
     snapshotDigest: string;
@@ -55,10 +55,10 @@ export interface IObjectStorageMigrationTarget {
         kind: 'objectStorage';
     };
     request: IAppStoreObjectStorageRequest;
-    credentials: IStorageObjectCredentialsRef;
+    credentialManagementScope: IResolvedObjectStorageBinding['credentialManagementScope'];
 }
 export interface IObjectStorageMigrationPrepareRequest {
-    schemaVersion: 1;
+    schemaVersion: 2;
     migrationId: string;
     sourceControlSnapshot: IUnfencedObjectStorageBindingControlSnapshot;
     workloadGeneration: number;
@@ -92,7 +92,7 @@ export interface IStorageMigrationPostCutoverIssue extends IStorageMigrationIssu
     allowedRecoveryActions: TStorageMigrationPostCutoverRecoveryAction[];
 }
 export interface IStorageMigrationMutationFence {
-    schemaVersion: 1;
+    schemaVersion: 2;
     migrationId: string;
     migrationDigest: string;
     expectedMigrationRevision: number;
@@ -136,7 +136,7 @@ export interface IObjectStorageMigrationResumeRequest extends IStorageMigrationM
 export interface IObjectStorageMigrationCleanupRequest extends IStorageMigrationMutationFence {
 }
 export interface IStorageMigrationStatusBase {
-    schemaVersion: 1;
+    schemaVersion: 2;
     migrationId: string;
     migrationDigest: string;
     migrationRevision: number;

package/dist_ts/platform/storagemigration.golden.d.ts

@@ -5,7 +5,7 @@ export interface IStorageMigrationCanonicalDigestGoldenVector<TInput> {
     sha256: string;
 }
 export declare const storageMigrationCanonicalDigestGoldenVectors: {
-    version: 1;
+    version: 2;
     targetRequest: {
         input: {
             readonly id: "object-data";
@@ -18,7 +18,7 @@ export declare const storageMigrationCanonicalDigestGoldenVectors: {
             readonly reclaimPolicy: "retain";
             readonly accessMode: "readWrite";
             readonly delivery: {
-                readonly type: "environment";
+                readonly type: "launcher-environment";
                 readonly keys: {
                     readonly endpoint: "APP_S3_ENDPOINT";
                     readonly bucket: "APP_S3_BUCKET";