@serve.zone/interfaces 22.0.0 → 23.0.0

package/dist_ts/runtime.d.ts

@@ -1,41 +1,93 @@
-import type * as plugins from './plugins.js';
-import type { IIdentityCredential, IResolvedSecretManifest, TSha256Digest } from './data/index.js';
-/**
- * Runtime-only material. This module is exported only under the Node condition
- * and is intentionally unreachable from the universal/browser-facing barrel.
- */
-export interface IResolvedSecretMaterialValue {
+import * as plugins from './plugins.js';
+import type { IIdentityCredential, IResolvedSecretManifest, TSha256Digest, TSecretRecipientMetadata } from './data/index.js';
+import { validateSecretRecipientMetadata } from './data/secret.js';
+export interface ISealedResolvedSecretMaterialEntry {
     secretVersionId: string;
-    value: string;
+    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
 }
-export interface IResolvedSecretMaterial {
+/** Runtime-only material. No plaintext value is represented in this DTO. */
+export interface ISealedResolvedSecretMaterial {
     schemaVersion: 1;
-    /** Full value-free manifest so the runtime can verify its canonical digest. */
+    /** Full schema-v2 value-free manifest used for digest and rollout verification. */
     manifest: IResolvedSecretManifest;
-    /** Plaintext values keyed only by the exact version IDs pinned by the manifest. */
-    values: IResolvedSecretMaterialValue[];
+    /** Sorted exact coverage of the manifest's pinned versions. */
+    entries: ISealedResolvedSecretMaterialEntry[];
+}
+export interface ISecretMaterialRequestFence {
+    serviceId: string;
+    imageRolloutId: string;
+    imageRolloutGeneration: number;
+    requestedImageDigest: TSha256Digest;
+    secretRolloutId: string;
+    secretRolloutGeneration: number;
+    manifestId: string;
+    manifestDigest: TSha256Digest;
+    expectedRecipientKeyId: string;
+}
+/** Request fence plus trusted local scope derived from the verified cluster identity. */
+export interface ISecretMaterialExpectation extends ISecretMaterialRequestFence {
+    organizationId: string;
+    clusterId: string;
 }
 /**
- * Verifies the immutable manifest and requires exactly one material value for
- * every pinned version. Callers separately compare the verified manifest
- * reference to the request and their authenticated cluster scope.
- */
-export declare const verifyResolvedSecretMaterial: (materialArg: unknown) => Promise<boolean>;
-/**
- * Cluster and organization are derived from the verified JWT. A caller cannot
- * select either scope through request fields.
+ * Parses every envelope with SmartCrypto, verifies its bound context digest,
+ * and checks sorted exact version coverage. It never receives a private key
+ * and never decrypts material.
  */
+export declare const verifySealedResolvedSecretMaterial: (materialArg: unknown, expectedArg: ISecretMaterialExpectation) => Promise<boolean>;
+/** Organization and cluster are derived exclusively from the verified cluster JWT. */
 export interface IReq_GetResolvedSecretMaterial extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetResolvedSecretMaterial> {
     method: 'getResolvedSecretMaterial';
+    request: ISecretMaterialRequestFence & {
+        identity: IIdentityCredential;
+    };
+    response: {
+        material: ISealedResolvedSecretMaterial;
+    };
+}
+export interface ISecretRecipientEnrollmentChallengeV1 {
+    schemaVersion: 1;
+    enrollmentId: string;
+    clusterId: string;
+    recipientKeyId: string;
+    publicKey: string;
+    generation: number;
+    expiresAt: number;
+    /** Sealed random 32-byte challenge; plaintext is never persisted or returned. */
+    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
+}
+/**
+ * Cluster scope is derived from the JWT. The server persists only a one-time
+ * challenge hash plus expiry and consumes it with generation CAS; reuse,
+ * expiry, mismatch, and replay are rejected. Private keys and challenge
+ * plaintext have no persistence DTO.
+ */
+export interface IReq_BeginSecretRecipientEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_BeginSecretRecipientEnrollment> {
+    method: 'beginSecretRecipientEnrollment';
+    request: {
+        identity: IIdentityCredential;
+        proposedRecipientKeyId: string;
+        proposedPublicKey: string;
+        expectedGeneration: number;
+    };
+    response: {
+        challenge: ISecretRecipientEnrollmentChallengeV1;
+    };
+}
+export interface IReq_CompleteSecretRecipientEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_CompleteSecretRecipientEnrollment> {
+    method: 'completeSecretRecipientEnrollment';
     request: {
         identity: IIdentityCredential;
-        serviceId: string;
-        secretRolloutId: string;
-        secretRolloutGeneration: number;
-        manifestId: string;
-        manifestDigest: TSha256Digest;
+        enrollmentId: string;
+        expectedGeneration: number;
+        /** Canonical unpadded base64url response containing exactly 32 bytes. */
+        response: string;
     };
     response: {
-        material: IResolvedSecretMaterial;
+        recipient: TSecretRecipientMetadata;
     };
 }
+export declare const validateBeginSecretRecipientEnrollmentRequest: (requestArg: unknown) => string[];
+export declare const validateSecretRecipientEnrollmentChallenge: (challengeArg: unknown) => Promise<string[]>;
+export declare const validateCompleteSecretRecipientEnrollmentRequest: (requestArg: unknown) => string[];
+export { validateSecretRecipientMetadata };

package/dist_ts/runtime.js

@@ -1,33 +1,233 @@
-import { validateResolvedSecretManifest, verifyResolvedSecretManifestDigest, } from './data/secret.js';
+import * as plugins from './plugins.js';
+import { createResolvedSecretMaterialEnvelopeContext, createSecretRecipientEnrollmentChallengeContext, validateResolvedSecretManifest, validateSecretRecipientMetadata, verifySecretEnvelopeContext, verifyResolvedSecretManifestDigest, } from './data/secret.js';
 /**
- * Verifies the immutable manifest and requires exactly one material value for
- * every pinned version. Callers separately compare the verified manifest
- * reference to the request and their authenticated cluster scope.
+ * Parses every envelope with SmartCrypto, verifies its bound context digest,
+ * and checks sorted exact version coverage. It never receives a private key
+ * and never decrypts material.
  */
-export const verifyResolvedSecretMaterial = async (materialArg) => {
+export const verifySealedResolvedSecretMaterial = async (materialArg, expectedArg) => {
     if (!materialArg || typeof materialArg !== 'object' || Array.isArray(materialArg))
         return false;
     const material = materialArg;
-    if (!material.manifest || !Array.isArray(material.values))
+    if (JSON.stringify(Object.keys(material).sort()) !== JSON.stringify([
+        'entries',
+        'manifest',
+        'schemaVersion',
+    ])) {
         return false;
-    if (material.schemaVersion !== 1)
+    }
+    if (material.schemaVersion !== 1 || !material.manifest || !Array.isArray(material.entries)) {
         return false;
-    if (validateResolvedSecretManifest(material.manifest).length > 0)
+    }
+    if (validateResolvedSecretManifest(material.manifest).length > 0
+        || !await verifyResolvedSecretManifestDigest(material.manifest)) {
         return false;
-    if (!await verifyResolvedSecretManifestDigest(material.manifest))
+    }
+    if (material.manifest.organizationId !== expectedArg.organizationId
+        || material.manifest.clusterId !== expectedArg.clusterId
+        || material.manifest.serviceId !== expectedArg.serviceId
+        || material.manifest.imageRolloutId !== expectedArg.imageRolloutId
+        || material.manifest.imageRolloutGeneration !== expectedArg.imageRolloutGeneration
+        || material.manifest.requestedImageDigest !== expectedArg.requestedImageDigest
+        || material.manifest.secretRolloutId !== expectedArg.secretRolloutId
+        || material.manifest.secretRolloutGeneration !== expectedArg.secretRolloutGeneration
+        || material.manifest.id !== expectedArg.manifestId
+        || material.manifest.digest !== expectedArg.manifestDigest) {
         return false;
-    if (!material.values.every((valueArg) => (Boolean(valueArg)
-        && typeof valueArg === 'object'
-        && typeof valueArg.secretVersionId === 'string'
-        && typeof valueArg.value === 'string')))
+    }
+    if (material.entries.length > 256
+        || material.entries.length !== material.manifest.entries.length) {
         return false;
+    }
     const expectedVersionIds = material.manifest.entries
         .map((entryArg) => entryArg.secretVersionId)
         .sort();
-    const actualVersionIds = material.values
-        .map((valueArg) => valueArg.secretVersionId)
-        .sort();
-    return new Set(actualVersionIds).size === actualVersionIds.length
-        && JSON.stringify(actualVersionIds) === JSON.stringify(expectedVersionIds);
+    const actualVersionIds = material.entries.map((entryArg) => entryArg.secretVersionId);
+    if (new Set(actualVersionIds).size !== actualVersionIds.length
+        || JSON.stringify(actualVersionIds) !== JSON.stringify(expectedVersionIds)) {
+        return false;
+    }
+    const manifestEntriesByVersion = new Map(material.manifest.entries.map((entryArg) => [
+        entryArg.secretVersionId,
+        entryArg,
+    ]));
+    for (const entry of material.entries) {
+        if (!entry || typeof entry !== 'object' || typeof entry.secretVersionId !== 'string')
+            return false;
+        if (JSON.stringify(Object.keys(entry).sort()) !== JSON.stringify([
+            'envelope',
+            'secretVersionId',
+        ])) {
+            return false;
+        }
+        const manifestEntry = manifestEntriesByVersion.get(entry.secretVersionId);
+        if (!manifestEntry)
+            return false;
+        let envelope;
+        try {
+            envelope = plugins.smartcrypto.parseX25519Envelope(entry.envelope);
+        }
+        catch {
+            return false;
+        }
+        if (envelope.recipientKeyId !== expectedArg.expectedRecipientKeyId)
+            return false;
+        const context = createResolvedSecretMaterialEnvelopeContext({
+            recipientKeyId: expectedArg.expectedRecipientKeyId,
+            organizationId: material.manifest.organizationId,
+            clusterId: material.manifest.clusterId,
+            serviceId: material.manifest.serviceId,
+            imageRolloutId: material.manifest.imageRolloutId,
+            imageRolloutGeneration: material.manifest.imageRolloutGeneration,
+            requestedImageDigest: material.manifest.requestedImageDigest,
+            secretRolloutId: material.manifest.secretRolloutId,
+            secretRolloutGeneration: material.manifest.secretRolloutGeneration,
+            manifestId: material.manifest.id,
+            manifestDigest: material.manifest.digest,
+            secretId: manifestEntry.secretId,
+            secretVersionId: manifestEntry.secretVersionId,
+        });
+        if (!await verifySecretEnvelopeContext(envelope, context))
+            return false;
+    }
+    return true;
+};
+const canonicalIdentifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const raw32ByteBase64UrlRegex = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+export const validateBeginSecretRecipientEnrollmentRequest = (requestArg) => {
+    if (!requestArg || typeof requestArg !== 'object' || Array.isArray(requestArg)) {
+        return ['enrollment request must be an object'];
+    }
+    const request = requestArg;
+    const errors = [];
+    if (JSON.stringify(Object.keys(request).sort()) !== JSON.stringify([
+        'expectedGeneration',
+        'identity',
+        'proposedPublicKey',
+        'proposedRecipientKeyId',
+    ])) {
+        errors.push('enrollment request must use its exact schema');
+    }
+    if (!request.identity || typeof request.identity !== 'object'
+        || typeof request.identity.jwt !== 'string') {
+        errors.push('enrollment identity must be a JWT credential');
+    }
+    if (typeof request.proposedRecipientKeyId !== 'string'
+        || !canonicalIdentifierRegex.test(request.proposedRecipientKeyId)) {
+        errors.push('proposed recipient key id must be canonical');
+    }
+    if (typeof request.proposedPublicKey !== 'string'
+        || !raw32ByteBase64UrlRegex.test(request.proposedPublicKey)) {
+        errors.push('proposed public key must be canonical base64url raw X25519 material');
+    }
+    if (!Number.isSafeInteger(request.expectedGeneration)
+        || request.expectedGeneration < 0) {
+        errors.push('expected generation must be a non-negative integer');
+    }
+    if ('clusterId' in request || 'organizationId' in request) {
+        errors.push('enrollment request must not select cluster or organization scope');
+    }
+    return errors;
+};
+export const validateSecretRecipientEnrollmentChallenge = async (challengeArg) => {
+    if (!challengeArg || typeof challengeArg !== 'object' || Array.isArray(challengeArg)) {
+        return ['enrollment challenge must be an object'];
+    }
+    const challenge = challengeArg;
+    const errors = [];
+    if (JSON.stringify(Object.keys(challenge).sort()) !== JSON.stringify([
+        'clusterId',
+        'enrollmentId',
+        'envelope',
+        'expiresAt',
+        'generation',
+        'publicKey',
+        'recipientKeyId',
+        'schemaVersion',
+    ])) {
+        errors.push('enrollment challenge must use its exact schema');
+    }
+    for (const field of ['enrollmentId', 'clusterId', 'recipientKeyId']) {
+        if (typeof challenge[field] !== 'string'
+            || !canonicalIdentifierRegex.test(challenge[field])) {
+            errors.push(`enrollment challenge ${field} must be canonical`);
+        }
+    }
+    if (challenge.schemaVersion !== 1)
+        errors.push('enrollment challenge schemaVersion must be 1');
+    if (typeof challenge.publicKey !== 'string'
+        || !raw32ByteBase64UrlRegex.test(challenge.publicKey)) {
+        errors.push('enrollment challenge public key must be canonical');
+    }
+    if (!Number.isSafeInteger(challenge.generation) || challenge.generation < 1) {
+        errors.push('enrollment challenge generation must be positive');
+    }
+    if (!Number.isSafeInteger(challenge.expiresAt) || challenge.expiresAt < 1) {
+        errors.push('enrollment challenge expiry must be positive');
+    }
+    let envelope;
+    try {
+        envelope = plugins.smartcrypto.parseX25519Envelope(challenge.envelope);
+    }
+    catch {
+        errors.push('enrollment challenge envelope must be strict');
+    }
+    if (envelope) {
+        if (envelope.recipientKeyId !== challenge.recipientKeyId) {
+            errors.push('enrollment challenge recipient does not match');
+        }
+        if (!raw32ByteBase64UrlRegex.test(envelope.ciphertext)) {
+            errors.push('enrollment challenge ciphertext must contain exactly 32 bytes');
+        }
+        if (errors.length === 0) {
+            const context = createSecretRecipientEnrollmentChallengeContext({
+                enrollmentId: challenge.enrollmentId,
+                clusterId: challenge.clusterId,
+                recipientKeyId: challenge.recipientKeyId,
+                publicKey: challenge.publicKey,
+                generation: challenge.generation,
+                expiresAt: challenge.expiresAt,
+            });
+            if (!await verifySecretEnvelopeContext(envelope, context)) {
+                errors.push('enrollment challenge context does not match');
+            }
+        }
+    }
+    return errors;
+};
+export const validateCompleteSecretRecipientEnrollmentRequest = (requestArg) => {
+    if (!requestArg || typeof requestArg !== 'object' || Array.isArray(requestArg)) {
+        return ['enrollment completion must be an object'];
+    }
+    const request = requestArg;
+    const errors = [];
+    if (JSON.stringify(Object.keys(request).sort()) !== JSON.stringify([
+        'enrollmentId',
+        'expectedGeneration',
+        'identity',
+        'response',
+    ])) {
+        errors.push('enrollment completion must use its exact schema');
+    }
+    if (!request.identity || typeof request.identity !== 'object'
+        || typeof request.identity.jwt !== 'string') {
+        errors.push('enrollment identity must be a JWT credential');
+    }
+    if (typeof request.enrollmentId !== 'string'
+        || !canonicalIdentifierRegex.test(request.enrollmentId)) {
+        errors.push('enrollment id must be canonical');
+    }
+    if (!Number.isSafeInteger(request.expectedGeneration)
+        || request.expectedGeneration < 0) {
+        errors.push('expected generation must be a non-negative integer');
+    }
+    if (typeof request.response !== 'string' || !raw32ByteBase64UrlRegex.test(request.response)) {
+        errors.push('enrollment response must be canonical base64url containing exactly 32 bytes');
+    }
+    if ('clusterId' in request || 'organizationId' in request) {
+        errors.push('enrollment completion must not select cluster or organization scope');
+    }
+    return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBTUEsT0FBTyxFQUNMLDhCQUE4QixFQUM5QixrQ0FBa0MsR0FDbkMsTUFBTSxrQkFBa0IsQ0FBQztBQW1CMUI7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLEtBQUssRUFDL0MsV0FBb0IsRUFDRixFQUFFO0lBQ3BCLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDaEcsTUFBTSxRQUFRLEdBQUcsV0FBK0MsQ0FBQztJQUNqRSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3hFLElBQUksUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDL0MsSUFBSSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMvRSxJQUFJLENBQUMsTUFBTSxrQ0FBa0MsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDL0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUN2QyxPQUFPLENBQUMsUUFBUSxDQUFDO1dBQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtXQUM1QixPQUFPLFFBQVEsQ0FBQyxlQUFlLEtBQUssUUFBUTtXQUM1QyxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUN0QyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDakIsTUFBTSxrQkFBa0IsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU87U0FDakQsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDO1NBQzNDLElBQUksRUFBRSxDQUFDO0lBQ1YsTUFBTSxnQkFBZ0IsR0FBRyxRQUFRLENBQUMsTUFBTTtTQUNyQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7U0FDM0MsSUFBSSxFQUFFLENBQUM7SUFDVixPQUFPLElBQUksR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUMsSUFBSSxLQUFLLGdCQUFnQixDQUFDLE1BQU07V0FDNUQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUMvRSxDQUFDLENBQUMifQ==
+export { validateSecretRecipientMetadata };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFPeEMsT0FBTyxFQUNMLDJDQUEyQyxFQUMzQywrQ0FBK0MsRUFDL0MsOEJBQThCLEVBQzlCLCtCQUErQixFQUMvQiwyQkFBMkIsRUFDM0Isa0NBQWtDLEdBQ25DLE1BQU0sa0JBQWtCLENBQUM7QUFtQzFCOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxLQUFLLEVBQ3JELFdBQW9CLEVBQ3BCLFdBQXVDLEVBQ3JCLEVBQUU7SUFDcEIsSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUNoRyxNQUFNLFFBQVEsR0FBRyxXQUFxRCxDQUFDO0lBQ3ZFLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNsRSxTQUFTO1FBQ1QsVUFBVTtRQUNWLGVBQWU7S0FDaEIsQ0FBQyxFQUFFLENBQUM7UUFDSCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDM0YsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsSUFBSSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDM0QsQ0FBQyxNQUFNLGtDQUFrQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2xFLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWM7V0FDOUQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDckQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDckQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWM7V0FDL0QsUUFBUSxDQUFDLFFBQVEsQ0FBQyxzQkFBc0IsS0FBSyxXQUFXLENBQUMsc0JBQXNCO1dBQy9FLFFBQVEsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEtBQUssV0FBVyxDQUFDLG9CQUFvQjtXQUMzRSxRQUFRLENBQUMsUUFBUSxDQUFDLGVBQWUsS0FBSyxXQUFXLENBQUMsZUFBZTtXQUNqRSxRQUFRLENBQUMsUUFBUSxDQUFDLHVCQUF1QixLQUFLLFdBQVcsQ0FBQyx1QkFBdUI7V0FDakYsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEtBQUssV0FBVyxDQUFDLFVBQVU7V0FDL0MsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQzdELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUM1QixRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNsRSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLGtCQUFrQixHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTztTQUNqRCxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7U0FDM0MsSUFBSSxFQUFFLENBQUM7SUFDVixNQUFNLGdCQUFnQixHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDdEYsSUFBSSxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxNQUFNO1dBQ3pELElBQUksQ0FBQyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUM3RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLHdCQUF3QixHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUM7UUFDbkYsUUFBUSxDQUFDLGVBQWU7UUFDeEIsUUFBUTtLQUNULENBQUMsQ0FBQyxDQUFDO0lBQ0osS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDckMsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksT0FBTyxLQUFLLENBQUMsZUFBZSxLQUFLLFFBQVE7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNuRyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDL0QsVUFBVTtZQUNWLGlCQUFpQjtTQUNsQixDQUFDLEVBQUUsQ0FBQztZQUNILE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELE1BQU0sYUFBYSxHQUFHLHdCQUF3QixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDMUUsSUFBSSxDQUFDLGFBQWE7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNqQyxJQUFJLFFBQStDLENBQUM7UUFDcEQsSUFBSSxDQUFDO1lBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3JFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLHNCQUFzQjtZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ2pGLE1BQU0sT0FBTyxHQUFHLDJDQUEyQyxDQUFDO1lBQzFELGNBQWMsRUFBRSxXQUFXLENBQUMsc0JBQXNCO1lBQ2xELGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLGNBQWM7WUFDaEQsU0FBUyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUztZQUN0QyxTQUFTLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTO1lBQ3RDLGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLGNBQWM7WUFDaEQsc0JBQXNCLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxzQkFBc0I7WUFDaEUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0I7WUFDNUQsZUFBZSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsZUFBZTtZQUNsRCx1QkFBdUIsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLHVCQUF1QjtZQUNsRSxVQUFVLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFO1lBQ2hDLGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU07WUFDeEMsUUFBUSxFQUFFLGFBQWEsQ0FBQyxRQUFRO1lBQ2hDLGVBQWUsRUFBRSxhQUFhLENBQUMsZUFBZTtTQUMvQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7SUFDMUUsQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBc0VGLE1BQU0sd0JBQXdCLEdBQUcscUNBQXFDLENBQUM7QUFDdkUsTUFBTSx1QkFBdUIsR0FBRyx1Q0FBdUMsQ0FBQztBQUV4RSxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNqRSxvQkFBb0I7UUFDcEIsVUFBVTtRQUNWLG1CQUFtQjtRQUNuQix3QkFBd0I7S0FDekIsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3hELE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxzQkFBc0IsS0FBSyxRQUFRO1dBQ2pELENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLGlCQUFpQixLQUFLLFFBQVE7V0FDNUMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztXQUMvQyxPQUFPLENBQUMsa0JBQTZCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxJQUFJLFdBQVcsSUFBSSxPQUFPLElBQUksZ0JBQWdCLElBQUksT0FBTyxFQUFFLENBQUM7UUFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQzdELFlBQXFCLEVBQ0YsRUFBRTtJQUNyQixJQUFJLENBQUMsWUFBWSxJQUFJLE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDckYsT0FBTyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLFlBQXVDLENBQUM7SUFDMUQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNuRSxXQUFXO1FBQ1gsY0FBYztRQUNkLFVBQVU7UUFDVixXQUFXO1FBQ1gsWUFBWTtRQUNaLFdBQVc7UUFDWCxnQkFBZ0I7UUFDaEIsZUFBZTtLQUNoQixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLGNBQWMsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLENBQVUsRUFBRSxDQUFDO1FBQzdFLElBQUksT0FBTyxTQUFTLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUTtlQUNuQyxDQUFDLHdCQUF3QixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFXLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLEtBQUssb0JBQW9CLENBQUMsQ0FBQztRQUNqRSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQy9GLElBQUksT0FBTyxTQUFTLENBQUMsU0FBUyxLQUFLLFFBQVE7V0FDdEMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLElBQUssU0FBUyxDQUFDLFVBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEYsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLElBQUssU0FBUyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLFFBQTJELENBQUM7SUFDaEUsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksUUFBUSxFQUFFLENBQUM7UUFDYixJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3pELE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN2RCxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN4QixNQUFNLE9BQU8sR0FBRywrQ0FBK0MsQ0FBQztnQkFDOUQsWUFBWSxFQUFFLFNBQVMsQ0FBQyxZQUFzQjtnQkFDOUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjtnQkFDeEMsY0FBYyxFQUFFLFNBQVMsQ0FBQyxjQUF3QjtnQkFDbEQsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjtnQkFDeEMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxVQUFvQjtnQkFDMUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjthQUN6QyxDQUFDLENBQUM7WUFDSCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1lBQzdELENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGdEQUFnRCxHQUFHLENBQzlELFVBQW1CLEVBQ1QsRUFBRTtJQUNaLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMvRSxPQUFPLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBcUMsQ0FBQztJQUN0RCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ2pFLGNBQWM7UUFDZCxvQkFBb0I7UUFDcEIsVUFBVTtRQUNWLFVBQVU7S0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7V0FDeEQsT0FBUSxPQUFPLENBQUMsUUFBb0MsQ0FBQyxHQUFHLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFlBQVksS0FBSyxRQUFRO1dBQ3ZDLENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQzFELE1BQU0sQ0FBQyxJQUFJLENBQUMsaUNBQWlDLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1dBQy9DLE9BQU8sQ0FBQyxrQkFBNkIsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUM1RixNQUFNLENBQUMsSUFBSSxDQUFDLDZFQUE2RSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELElBQUksV0FBVyxJQUFJLE9BQU8sSUFBSSxnQkFBZ0IsSUFBSSxPQUFPLEVBQUUsQ0FBQztRQUMxRCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "22.0.0",
+  "version": "23.0.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -18,6 +18,7 @@
   "license": "MIT",
   "dependencies": {
     "@api.global/typedrequest-interfaces": "^4.0.0",
+    "@push.rocks/smartcrypto": "^2.2.0",
     "@push.rocks/smartlog-interfaces": "^3.0.2",
     "@tsclass/tsclass": "^9.5.1"
   },

package/readme.md

@@ -30,6 +30,43 @@ import { appstore, data, platform, platformservice, requests } from '@serve.zone
 
 This package intentionally has no service implementation logic. It is a stable vocabulary for services that need to agree on payload shape, method names, and response types.
 
+## Secrets v23 Pre-Cutover Contract
+
+Version 23 removes the old grouped/bundled secret DTOs and plaintext runtime
+material API. Secret values enter Cloudly only as strict SmartCrypto X25519
+envelopes or an explicit bounded server-generation request. Coreflow receives a
+full digest-verified schema-v2 manifest plus one sealed envelope per pinned
+SecretVersion through the Node-only runtime export.
+
+This is a contract release before consumer cutover. It does **not** claim that
+clean-v2 migration, backup verification, historical secret erasure, or storage
+cleanup has completed. Those operations remain separately gated and must be
+proven by their owning services before destructive cleanup.
+
+Breaking removals include:
+
+- The SecretGroup and SecretBundle data/request modules and request namespaces.
+- `getServiceSecretBundlesAsFlatObject` and every service/preflight field tied
+  to bundled flattening or aggregate runtime files.
+- Plaintext resolved runtime values, generic platform config/credential maps,
+  credential-bearing Cloudly settings, and serialized object-storage
+  credential references.
+- Hosted-app control-token identities and credential-bearing bootstrap actions.
+
+Primary v23 additions include:
+
+- `TSecretValueInput`, `TSecretIngressRecipient`, the
+  `requests.secret.IReq_GetSecretIngressRecipient` contract with method
+  `getSecretIngressRecipient`, and fixed-order create/rotate/App Store context
+  builders.
+- Schema-v2 `IResolvedSecretManifest` contracts, stable Docker resource naming,
+  WorkloadInit map/wrapper helpers, and `ISealedResolvedSecretMaterial` under
+  `@serve.zone/interfaces/runtime`.
+- Two-step Coreflow X25519 recipient enrollment and exact recipient lifecycle
+  validators.
+- Mandatory `IImmutableContainerInvocationV1` evidence on immutable image
+  deployment plans.
+
 ## Portable Storage Contracts
 
 App Store templates can declare logical, template-local `storageClasses` and
@@ -82,18 +119,21 @@ const storageConfig: appstore.IAppStoreVersionConfig = {
       capacity: { request: '100GiB', limit: '1TiB' },
       reclaimPolicy: 'retain',
       delivery: {
-        type: 'secretFile',
+        type: 'file',
         targetPath: '/run/secrets/backup-archive.json',
         format: 'servezone-object-storage-v1',
+        uid: 1000,
+        gid: 1000,
+        mode: 0o400,
       },
       protection: { versioning: 'required', retentionDays: 30 },
     },
   ],
   requiresFeatures: [
-    appstore.appStoreStorageFeatureIds.bindingsV1,
+    appstore.appStoreStorageFeatureIds.bindingsV2,
     appstore.appStoreStorageFeatureIds.filesystemV1,
-    appstore.appStoreStorageFeatureIds.objectStorageV1,
-    appstore.appStoreStorageFeatureIds.objectStorageSecretFileV1,
+    appstore.appStoreStorageFeatureIds.objectStorageV2,
+    appstore.appStoreStorageFeatureIds.objectStorageFileV2,
   ],
 };
 ```
@@ -104,13 +144,15 @@ express requirements and preferences only; Onebox and Cloudly map them to
 operator policy independently.
 
 An app may declare multiple `objectStorage` requests. Each request resolves to
-its own endpoint, bucket, and credential reference. Environment delivery uses
-an explicit key map and secret-file delivery uses a unique target path, so two
+its own endpoint, bucket, and value-free credential management scope. Launcher
+environment delivery uses an explicit key map and file delivery uses one
+managed JSON Secret at a unique target path, so two
 bindings cannot share credential destinations accidentally.
 
 `platform.storage` contains separate capability advertisements and resolved
 binding/status contracts. Resolved object-storage bindings expose connection
-metadata plus credential references, never credential values. Filesystem
+metadata plus a service-owned credential management scope and delivery policy,
+never credential references or values. Filesystem
 bindings expose the container mount and access mode, never a host path.
 
 Portable manifests and resolved bindings intentionally have no fields for
@@ -310,14 +352,15 @@ Common data contracts include:
 - `IDomain`, `IDnsEntry`, and traffic contracts for routing and DNS management.
 - Traffic and gateway route contracts including `ICoretrafficPortRouteConfig`, routing `portRoutes`, and `IGatewayClientRoute` client-owned route views. Gateway route intent supports optional match `domains`, `transport`, and `remoteIngress`, plus explicit route `priority` and `managedRouteKind`. Ownership can combine `hostname` with `routeRef` so a normal route and a path-specific managed route for the same hostname reconcile independently.
 - Value-free `ISecretMetadata`, `ISecretVersionMetadata`, and `ISecretSetMetadata`
-  contracts for operator views, plus exact-version `IResolvedSecretManifest`
-  contracts for cluster delivery. Manifest helpers enforce canonical shared
-  digests, globally unique environment/file delivery targets, and per-cluster
-  desired/applied/previous-accepted rollout state. `ISecretBundle` and
-  `ISecretGroup` remain legacy compatibility contracts during the versioned
-  migration.
+  contracts for operator views, plus schema-v2 exact-version
+  `IResolvedSecretManifest` contracts for cluster delivery. Manifest helpers
+  bind immutable image rollout and invocation evidence, enforce canonical
+  digests and globally unique launcher/file targets, and track per-cluster
+  desired/applied/previous-accepted rollout state. Platform-provider and system
+  owners are valid metadata owners but are rejected from workload manifests.
   `listSecrets` exposes the dedicated `targetSecretsRevision` CAS fence;
-  `createSecret` consumes and returns that fence, while
+  every create, rotate, and lifecycle mutation consumes and returns that
+  aggregate owner fence, while
   `setServiceSecretSetAttachments` returns the independent
   `secretConfigurationRevision`. Generic service writes own neither revision.
 - Mail gateway contracts for domain authorities, address bindings, WorkApp bindings, managed SMTP/API credentials, spool items, delivery journals, and inbound/outbound message payloads.
@@ -368,7 +411,7 @@ const config: appstore.IAppStoreVersionConfig = {
 };
 ```
 
-`redirectPath` is a canonical callback path on the app's HTTPS origin. Registration validation also requires that canonical app origin explicitly and rejects cross-origin, normalized, query-bearing, fragment-bearing, or duplicate callback URLs. The five environment values are environment-key names, not credentials embedded in the manifest. A host injects the generated client secret through its secret environment path and injects the other registration values only while OIDC is enabled.
+`redirectPath` is a canonical callback path on the app's HTTPS origin. Registration validation also requires that canonical app origin explicitly and rejects cross-origin, normalized, query-bearing, fragment-bearing, or duplicate callback URLs. The five environment values are environment-key names, not credentials embedded in the manifest. A host injects the generated client secret through launcher environment delivery and injects the other registration values only while OIDC is enabled.
 
 `data.IHostedAppRoleAssignment` binds a stable user subject to an immutable `appInstanceId`. That same app instance is the OIDC `client_id`, the ID-token `aud`, and the `servezone_app_instance_id` claim. Tokens include only the assigned roles for that audience; `preferred_username` is display metadata and must not be treated as identity authority.
 
@@ -380,6 +423,16 @@ Validate untrusted manifests, registrations, and claims with:
 - `appstore.validateAppStorePlatformOidcCapability`
 - `appstore.validateAppStoreVersionPlatformOidc`
 
+Hosted lifecycle RPCs accept only `IIdentityCredential`. After JWT
+verification, handlers validate `IHostedAppMachineClaims` and derive the exact
+app instance and service from `servezone_app_instance_id` and
+`servezone_service_id`; callers cannot submit those selectors. Bootstrap
+actions are either a canonical same-origin `setupRoute` path or a nonsecret
+`message`. Control tokens, usernames, passwords, and token URLs are not part of
+the lifecycle contract. Each server action carries a CAS revision; completion
+requires its exact ID, current revision, and `ready` status so a delayed request
+cannot complete a replacement action.
+
 ## TypedRequest Contracts
 
 Use `requests` when registering handlers with `@api.global/typedrequest` or when creating typed requests through a TypedSocket client.
@@ -619,8 +672,6 @@ Request groups are exported by product area:
 - `requests.platform`
 - `requests.routing`
 - `requests.secret`
-- `requests.secretbundle`
-- `requests.secretgroup`
 - `requests.server`
 - `requests.service`
 - `requests.settings`
@@ -630,28 +681,53 @@ Request groups are exported by product area:
 - `requests.webpush`
 
 Secret material response contracts are not exported from the universal
-browser-facing entrypoint. Node runtimes import the isolated subpath:
+browser-facing entrypoint.
+
+The root entrypoint does use `@push.rocks/smartcrypto` to parse and validate
+strict ingress envelopes. Browser consumers that import the root contract can
+therefore include SmartCrypto and its browser-compatible crypto dependencies in
+their bundle. This package never opens private keys; sealed runtime material
+contracts remain isolated to the Node-only `/runtime` subpath.
+
+Node runtimes import the isolated subpath:
 
 ```typescript
 import {
-  verifyResolvedSecretMaterial,
+  verifySealedResolvedSecretMaterial,
 } from '@serve.zone/interfaces/runtime';
 import type {
   IReq_GetResolvedSecretMaterial,
-  IResolvedSecretMaterial,
+  ISecretMaterialExpectation,
+  ISealedResolvedSecretMaterial,
 } from '@serve.zone/interfaces/runtime';
 
-async function acceptMaterial(material: IResolvedSecretMaterial) {
-  if (!await verifyResolvedSecretMaterial(material)) {
+async function acceptMaterial(
+  material: ISealedResolvedSecretMaterial,
+  expectation: ISecretMaterialExpectation,
+) {
+  if (!await verifySealedResolvedSecretMaterial(material, expectation)) {
     throw new Error('secret material does not match its immutable manifest');
   }
 }
 ```
 
-Runtime material is shaped as `{ manifest, values }`. The helper verifies the
-canonical manifest digest and exact one-to-one version-ID coverage before
-plaintext use. The runtime must separately compare the verified manifest
-reference and cluster to its request and authenticated deployment scope.
+Runtime material is shaped as `{ schemaVersion: 1, manifest, entries }`, where
+each entry contains only `secretVersionId` and a strict X25519 envelope. The
+helper verifies the canonical schema-v2 manifest digest, envelope context
+digests, active recipient key, sorted exact one-to-one version coverage, every
+request fence, and the trusted local organization/cluster expectation. It never
+decrypts. Organization and cluster are derived from the verified cluster JWT
+and cannot be selected by request fields.
+
+Launcher environment delivery uses stable `szsv-<base32-sha256>` Docker
+resource names and `/run/serve.zone/secrets/<resource>` source paths. The
+nonsecret map is written to `/run/serve.zone/workloadinit-map-v1.json` with mode
+0444. Runtime assets under `/opt/serve.zone/runtime-assets` are read-only, and
+the wrapper executes
+`workloadinit run --map /run/serve.zone/workloadinit-map-v1.json -- <argv...>`
+without a shell, symlink, or aggregate value file. Resources and maps remain
+retained while any desired, applied, or previous-accepted manifest references
+them and are deleted only after Docker confirms rollout or service removal.
 
 ## Platform Contracts
 
@@ -675,7 +751,9 @@ Available platform modules:
 - `platform.ai`, `platform.database`, `platform.objectstorage`, `platform.logging`, `platform.backup`, and `platform.sip` for infrastructure and application capabilities.
 - `platform.storage` for provider-neutral storage classes, requests, capabilities, and resolved bindings.
 - `platform.storagemigration` for fenced object-storage migration intent, status, consumer acknowledgements, canonical digests, and strict normalizers.
-- `platform.types` plus root re-exports for shared capability, provider, binding, credential, and endpoint metadata.
+- `platform.types` provider and binding metadata is value-free. Provider-specific
+  operational config stays adapter-internal, while public DTOs expose typed
+  endpoints and optional credential management scopes only.
 
 ## Legacy Platformservice Contracts
 
@@ -714,7 +792,7 @@ pnpm test
 pnpm run buildDocs
 ```
 
-The package is authored as ESM TypeScript and built with `tsbuild tsfolders --allowimplicitany`.
+The package is authored as ESM TypeScript and built with `tsbuild tsfolders`.
 
 ## License and Legal Information
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '22.0.0',
+  version: '23.0.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }