@serve.zone/interfaces 22.0.0 → 23.0.1

package/changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2026-07-30 - 23.0.1
+
+### Fixes
+
+- expose stable CoreMail contract error codes and classify oversized message
+  parts as `PAYLOAD_LIMIT_EXCEEDED` (coremail)
+
+## 2026-07-30 - 23.0.0
+
+### Breaking Changes
+
+- replace grouped/plaintext secret delivery with the sealed v23 contract (secrets)
+  - Remove SecretGroup and SecretBundle data/request exports, bundled service and preflight fields, flattening RPCs, compatibility validators, and aggregate runtime-file design.
+  - Require context-bound X25519 ingress envelopes, schema-v2 immutable manifests, request-and-scope-bound sealed runtime verification, active-recipient issuance, and two-step Coreflow recipient enrollment.
+  - Add stable Docker resource names, WorkloadInit map/wrapper contracts, immutable per-platform container invocation evidence, and required Coreflow capabilities.
+  - Split App Store public and secret inputs, remove serialized platform/settings/storage credentials, and require JWT-derived hosted-app machine identity with value-free revision-fenced bootstrap actions.
+  - Bump storage migration normalization and golden vectors to schema 2 with service-owned credential management scopes.
+  - This pre-cutover release does not complete or claim clean-v2 backup verification, historical erasure, or destructive cleanup; those remain separately gated.
+
 ## 2026-07-30 - 22.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '22.0.0',
+    version: '23.0.1',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/appstore/types.d.ts

@@ -1,4 +1,4 @@
-import type { IServiceSecretFile } from '../data/service.js';
+import { type TSecretDelivery, type TSecretGeneratedEncoding, type TSecretIngressRecipient, type TSecretValueInput } from '../data/secret.js';
 import { type IHostedAppRoleDefinition } from '../data/hostedapp.js';
 import type { IServiceDomainRoute, IServicePublicPortMapping, IServiceTargetPort } from '../data/serviceports.js';
 import type { IStorageCapacityRequest, IStorageClassRequirement, TFilesystemStorageAccessMode, TObjectStorageAccessMode, TObjectStorageDelivery, TStorageReclaimPolicy, TStorageResourceKind, TStorageSnapshotMode } from '../platform/storage.js';
@@ -18,10 +18,10 @@ export type TAppStoreSourceType = 'inline' | 'repoManifest' | 'dockerImage';
 export type TAppStoreTrackingMode = 'tag' | 'digest';
 export type TAppStoreUpgradeStrategy = 'semver' | 'branch' | 'dockerDigest';
 export declare const appStoreStorageFeatureIds: {
-    readonly bindingsV1: "storage.bindings.v1";
+    readonly bindingsV2: "storage.bindings.v2";
     readonly filesystemV1: "storage.filesystem.v1";
-    readonly objectStorageV1: "storage.object-storage.v1";
-    readonly objectStorageSecretFileV1: "storage.object-storage.secret-file.v1";
+    readonly objectStorageV2: "storage.object-storage.v2";
+    readonly objectStorageFileV2: "storage.object-storage.file.v2";
 };
 export type TAppStoreStorageFeatureId = typeof appStoreStorageFeatureIds[keyof typeof appStoreStorageFeatureIds];
 export type TAppStoreStoragePurpose = 'runtime' | 'database' | 'registry' | 'backup';
@@ -95,20 +95,28 @@ export interface IAppStoreResolvedSource {
     imageDigest?: string;
     resolvedAt: string;
 }
-export interface IAppStoreEnvVar {
+interface IAppStoreEnvironmentDeclarationBase {
     key: string;
-    value?: string;
     description: string;
     required?: boolean;
-    /** Store the submitted value in the service-owned Cloudly secret bundle, never in service environment data. */
-    secret?: boolean;
-    /** Generate a value server-side when the installer does not submit one. Generation is allowed only for secrets. */
+}
+export interface IAppStorePublicEnvironmentDeclaration extends IAppStoreEnvironmentDeclarationBase {
+    secret?: false;
+    /** Public nonsecret default. */
+    value?: string;
+    delivery?: never;
+    generate?: never;
+}
+export interface IAppStoreSecretEnvironmentDeclaration extends IAppStoreEnvironmentDeclarationBase {
+    secret: true;
+    value?: never;
+    delivery: TSecretDelivery;
     generate?: {
-        type: 'randomHex';
-        /** Number of random bytes before hexadecimal encoding. */
+        encoding: TSecretGeneratedEncoding;
         bytes: number;
     };
 }
+export type TAppStoreEnvironmentDeclaration = IAppStorePublicEnvironmentDeclaration | IAppStoreSecretEnvironmentDeclaration;
 export interface IAppStoreVolume {
     /** Stable Docker volume name. If omitted, the runtime derives one from service name and mount path. */
     name?: string;
@@ -193,13 +201,11 @@ export interface IAppStoreVersionConfig {
     port?: number;
     /** Exact OCI/Docker argument vector appended after the image entrypoint. */
     containerArgs?: string[];
-    /** Secret-bundle keys delivered only through Docker's read-only secret tmpfs. */
-    secretFiles?: IServiceSecretFile[];
     targetPorts?: IServiceTargetPort[];
     domains?: IServiceDomainRoute[];
     /** Edge/coretraffic public TCP/UDP exposure, distinct from Docker publishedPorts. */
     publicPortMappings?: IServicePublicPortMapping[];
-    envVars?: IAppStoreEnvVar[];
+    envVars?: TAppStoreEnvironmentDeclaration[];
     /**
      * @deprecated Legacy volume syntax. New templates use storageClasses and
      * storageRequests. Resolver normalization must reject legacy physical driver
@@ -269,16 +275,24 @@ export interface IServezoneAppStoreManifest {
     };
 }
 export interface IAppStoreInstallRequest {
+    mutationId: string;
     appId: string;
-    version?: string;
+    version: string;
+    serviceId: string;
     serviceName: string;
     domain?: string;
     /** Legacy install-time override for the web target port. */
     port?: number;
     publishedPorts?: IAppStorePublishedPort[];
     publicPortMappings?: IServicePublicPortMapping[];
-    envVars?: Record<string, string>;
+    publicEnvironment: Record<string, string>;
+    secretInputs: Array<{
+        key: string;
+        valueInput: TSecretValueInput;
+    }>;
 }
+export declare const validateAppStoreEnvironmentDeclarations: (declarationsArg: unknown) => string[];
+export declare const validateAppStoreInstallRequest: (requestArg: unknown, configArg: IAppStoreVersionConfig, activeIngressRecipientArg: TSecretIngressRecipient) => Promise<string[]>;
 export interface IUpgradeableAppStoreService {
     serviceId?: string;
     serviceName: string;
@@ -287,3 +301,4 @@ export interface IUpgradeableAppStoreService {
     latestVersion: string;
     hasMigration: boolean;
 }
+export {};

package/dist_ts/appstore/types.js

@@ -1,9 +1,10 @@
+import { createAppStoreInstallSecretEnvelopeContext, validateSecretDelivery, validateSecretValueInput, validateSecretValueInputForRecipient, } from '../data/secret.js';
 import { validateHostedAppRoleDefinitions, } from '../data/hostedapp.js';
 export const appStoreStorageFeatureIds = {
-    bindingsV1: 'storage.bindings.v1',
+    bindingsV2: 'storage.bindings.v2',
     filesystemV1: 'storage.filesystem.v1',
-    objectStorageV1: 'storage.object-storage.v1',
-    objectStorageSecretFileV1: 'storage.object-storage.secret-file.v1',
+    objectStorageV2: 'storage.object-storage.v2',
+    objectStorageFileV2: 'storage.object-storage.file.v2',
 };
 const appStoreEnvKeyRegex = /^[A-Z_][A-Z0-9_]*$/;
 export const validateAppStorePlatformOidcCapability = (capabilityArg) => {
@@ -52,7 +53,10 @@ export const validateAppStoreVersionPlatformOidc = (configArg) => {
         return ['appstore config must be an object'];
     }
     const config = configArg;
-    const errors = validateAppStorePlatformOidcCapability(config.platformOidc);
+    const errors = [
+        ...validateAppStorePlatformOidcCapability(config.platformOidc),
+        ...validateAppStoreEnvironmentDeclarations(config.envVars),
+    ];
     if (!config.platformOidc || typeof config.platformOidc !== 'object'
         || Array.isArray(config.platformOidc))
         return errors;
@@ -67,16 +71,209 @@ export const validateAppStoreVersionPlatformOidc = (configArg) => {
             ? envArg.key
             : undefined)).filter((valueArg) => typeof valueArg === 'string')
         : [];
-    const secretFileKeys = Array.isArray(config.secretFiles)
-        ? config.secretFiles.map((fileArg) => (fileArg && typeof fileArg === 'object' && !Array.isArray(fileArg)
-            ? fileArg.sourceKey
-            : undefined)).filter((valueArg) => typeof valueArg === 'string')
-        : [];
-    for (const key of [...ordinaryEnvKeys, ...secretFileKeys]) {
+    for (const key of ordinaryEnvKeys) {
         if (oidcKeys.has(key)) {
             errors.push(`platformOidc environment key '${key}' collides with app runtime input`);
         }
     }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9hcHBzdG9yZS90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQ0wsZ0NBQWdDLEdBRWpDLE1BQU0sc0JBQXNCLENBQUM7QUFpQzlCLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHO0lBQ3ZDLFVBQVUsRUFBRSxxQkFBcUI7SUFDakMsWUFBWSxFQUFFLHVCQUF1QjtJQUNyQyxlQUFlLEVBQUUsMkJBQTJCO0lBQzVDLHlCQUF5QixFQUFFLHVDQUF1QztDQUMxRCxDQUFDO0FBK0pYLE1BQU0sbUJBQW1CLEdBQUcsb0JBQW9CLENBQUM7QUFFakQsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsYUFBc0IsRUFDWixFQUFFO0lBQ1osSUFBSSxhQUFhLEtBQUssU0FBUztRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQzNDLElBQUksQ0FBQyxhQUFhLElBQUksT0FBTyxhQUFhLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUM1QyxDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsYUFBd0MsQ0FBQztJQUM1RCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLFVBQVUsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMxQyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztXQUN4QyxVQUFVLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUM7V0FDeEMsVUFBVSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1dBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztXQUNwQyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsWUFBWSxFQUFFLHFCQUFxQixDQUFDLENBQUMsUUFBUSxLQUFLLFVBQVUsQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUNsRyxNQUFNLENBQUMsSUFBSSxDQUFDLDBGQUEwRixDQUFDLENBQUM7SUFDMUcsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxnQ0FBZ0MsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1NBQzlELEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUVsRCxNQUFNLFdBQVcsR0FBRyxVQUFVLENBQUMsb0JBQW9CLENBQUM7SUFDcEQsSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sQ0FBQyxJQUFJLENBQUMscURBQXFELENBQUMsQ0FBQztJQUNyRSxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sSUFBSSxHQUFHLENBQUMsV0FBVyxFQUFFLFVBQVUsRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLFVBQVUsQ0FBVSxDQUFDO1FBQzNGLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFFLFdBQXVDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUN0RixJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxFQUFFO1lBQ2hDLElBQUksT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUTttQkFDbkMsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBVyxDQUFDLEVBQUUsQ0FBQztnQkFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyxxQ0FBcUMsTUFBTSxrQ0FBa0MsQ0FBQyxDQUFDO1lBQzdGLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUMzQyxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDOUQsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxxQkFBcUI7V0FDOUQsVUFBVSxDQUFDLDBCQUEwQixLQUFLLG9CQUFvQixFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxDQUNqRCxTQUFrQixFQUNSLEVBQUU7SUFDWixJQUFJLENBQUMsU0FBUyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDNUUsT0FBTyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFNBQW9DLENBQUM7SUFDcEQsTUFBTSxNQUFNLEdBQUcsc0NBQXNDLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQzNFLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxJQUFJLE9BQU8sTUFBTSxDQUFDLFlBQVksS0FBSyxRQUFRO1dBQzlELEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQztRQUFFLE9BQU8sTUFBTSxDQUFDO0lBQ3ZELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxZQUF1QyxDQUFDO0lBQ2xFLElBQUksQ0FBQyxVQUFVLENBQUMsb0JBQW9CLElBQUksT0FBTyxVQUFVLENBQUMsb0JBQW9CLEtBQUssUUFBUTtXQUN0RixLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQztRQUFFLE9BQU8sTUFBTSxDQUFDO0lBQ25FLE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLG9CQUFvQixDQUFDO1NBQ3BFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBc0IsRUFBRSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDM0UsTUFBTSxlQUFlLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQ25ELENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FDN0IsTUFBTSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1lBQzVELENBQUMsQ0FBRSxNQUFrQyxDQUFDLEdBQUc7WUFDekMsQ0FBQyxDQUFDLFNBQVMsQ0FDZCxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFzQixFQUFFLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxDQUFDO1FBQzNFLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDUCxNQUFNLGNBQWMsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDdEQsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUNsQyxPQUFPLElBQUksT0FBTyxPQUFPLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUM7WUFDL0QsQ0FBQyxDQUFFLE9BQW1DLENBQUMsU0FBUztZQUNoRCxDQUFDLENBQUMsU0FBUyxDQUNkLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQXNCLEVBQUUsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLENBQUM7UUFDM0UsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxHQUFHLGVBQWUsRUFBRSxHQUFHLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDMUQsSUFBSSxRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdEIsTUFBTSxDQUFDLElBQUksQ0FBQyxpQ0FBaUMsR0FBRyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDIn0=
+const appStoreMutationIdRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+export const validateAppStoreEnvironmentDeclarations = (declarationsArg) => {
+    if (declarationsArg === undefined)
+        return [];
+    if (!Array.isArray(declarationsArg) || declarationsArg.length > 256) {
+        return ['envVars must be a bounded array'];
+    }
+    const errors = [];
+    const keys = [];
+    declarationsArg.forEach((declarationArg, indexArg) => {
+        if (!declarationArg || typeof declarationArg !== 'object' || Array.isArray(declarationArg)) {
+            errors.push(`envVars[${indexArg}] must be an object`);
+            return;
+        }
+        const declaration = declarationArg;
+        const allowedKeys = declaration.secret === true
+            ? new Set(['key', 'description', 'required', 'secret', 'delivery', 'generate'])
+            : new Set(['key', 'description', 'required', 'secret', 'value']);
+        if (Object.keys(declaration).some((keyArg) => !allowedKeys.has(keyArg))) {
+            errors.push(`envVars[${indexArg}] contains fields outside its exact channel schema`);
+        }
+        if (typeof declaration.key !== 'string' || !appStoreEnvKeyRegex.test(declaration.key)) {
+            errors.push(`envVars[${indexArg}].key must be canonical`);
+        }
+        else {
+            keys.push(declaration.key);
+        }
+        if (typeof declaration.description !== 'string' || declaration.description.length > 1000) {
+            errors.push(`envVars[${indexArg}].description must be bounded`);
+        }
+        if (declaration.required !== undefined && typeof declaration.required !== 'boolean') {
+            errors.push(`envVars[${indexArg}].required must be boolean`);
+        }
+        if (declaration.secret === true) {
+            if ('value' in declaration)
+                errors.push(`envVars[${indexArg}] secret declaration forbids value`);
+            if (!('delivery' in declaration)) {
+                errors.push(`envVars[${indexArg}] secret declaration requires delivery`);
+            }
+            else {
+                errors.push(...validateSecretDelivery(declaration.delivery)
+                    .map((errorArg) => `envVars[${indexArg}].${errorArg}`));
+            }
+            if (declaration.generate !== undefined) {
+                errors.push(...validateSecretValueInput({
+                    mode: 'generated',
+                    ...declaration.generate,
+                }).map((errorArg) => `envVars[${indexArg}].generate ${errorArg}`));
+            }
+        }
+        else {
+            if (declaration.secret !== undefined && declaration.secret !== false) {
+                errors.push(`envVars[${indexArg}].secret must be true or false`);
+            }
+            if ('delivery' in declaration)
+                errors.push(`envVars[${indexArg}] public declaration forbids delivery`);
+            if ('generate' in declaration)
+                errors.push(`envVars[${indexArg}] public declaration forbids generate`);
+            if (declaration.value !== undefined && typeof declaration.value !== 'string') {
+                errors.push(`envVars[${indexArg}].value must be a public string default`);
+            }
+        }
+    });
+    if (new Set(keys).size !== keys.length)
+        errors.push('envVars keys must be unique');
+    return errors;
+};
+export const validateAppStoreInstallRequest = async (requestArg, configArg, activeIngressRecipientArg) => {
+    if (!requestArg || typeof requestArg !== 'object' || Array.isArray(requestArg)) {
+        return ['install request must be an object'];
+    }
+    const request = requestArg;
+    const rawDeclarations = configArg && typeof configArg === 'object'
+        ? configArg.envVars
+        : undefined;
+    const errors = validateAppStoreEnvironmentDeclarations(rawDeclarations);
+    const allowedRequestKeys = new Set([
+        'mutationId',
+        'appId',
+        'version',
+        'serviceId',
+        'serviceName',
+        'domain',
+        'port',
+        'publishedPorts',
+        'publicPortMappings',
+        'publicEnvironment',
+        'secretInputs',
+    ]);
+    if (Object.keys(request).some((keyArg) => !allowedRequestKeys.has(keyArg))) {
+        errors.push('install request contains fields outside its schema');
+    }
+    if (typeof request.mutationId !== 'string'
+        || !appStoreMutationIdRegex.test(request.mutationId)) {
+        errors.push('install mutationId must be canonical');
+    }
+    for (const field of ['appId', 'version', 'serviceId', 'serviceName']) {
+        if (typeof request[field] !== 'string' || !request[field].trim()) {
+            errors.push(`install ${field} must be non-empty`);
+        }
+    }
+    const publicEnvironment = request.publicEnvironment;
+    if (!publicEnvironment || typeof publicEnvironment !== 'object'
+        || Array.isArray(publicEnvironment)
+        || Object.entries(publicEnvironment).some(([keyArg, valueArg]) => (!appStoreEnvKeyRegex.test(keyArg) || typeof valueArg !== 'string'))) {
+        errors.push('install publicEnvironment must be a canonical string map');
+    }
+    const secretInputs = Array.isArray(request.secretInputs) ? request.secretInputs : [];
+    if (!Array.isArray(request.secretInputs) || secretInputs.length > 256) {
+        errors.push('install secretInputs must be a bounded array');
+    }
+    const inputKeys = [];
+    const inputsByKey = new Map();
+    const declarations = Array.isArray(rawDeclarations) && rawDeclarations.length <= 256
+        ? rawDeclarations.filter((entryArg) => (validateAppStoreEnvironmentDeclarations([entryArg]).length === 0))
+        : [];
+    const publicDeclarations = new Map(declarations
+        .filter((entryArg) => entryArg.secret !== true)
+        .map((entryArg) => [entryArg.key, entryArg]));
+    const secretDeclarations = new Map(declarations
+        .filter((entryArg) => entryArg.secret === true)
+        .map((entryArg) => [entryArg.key, entryArg]));
+    for (const [indexArg, inputArg] of secretInputs.entries()) {
+        if (!inputArg || typeof inputArg !== 'object' || Array.isArray(inputArg)) {
+            errors.push(`install secretInputs[${indexArg}] must be an object`);
+            continue;
+        }
+        const input = inputArg;
+        if (JSON.stringify(Object.keys(input).sort()) !== JSON.stringify(['key', 'valueInput'])) {
+            errors.push(`install secretInputs[${indexArg}] must use its exact schema`);
+        }
+        if (typeof input.key !== 'string' || !appStoreEnvKeyRegex.test(input.key)) {
+            errors.push(`install secretInputs[${indexArg}].key must be canonical`);
+            continue;
+        }
+        inputKeys.push(input.key);
+        inputsByKey.set(input.key, input);
+        const declaration = secretDeclarations.get(input.key);
+        const canBuildContext = declaration
+            && typeof request.mutationId === 'string'
+            && appStoreMutationIdRegex.test(request.mutationId)
+            && typeof request.appId === 'string'
+            && Boolean(request.appId.trim())
+            && typeof request.version === 'string'
+            && Boolean(request.version.trim())
+            && typeof request.serviceId === 'string'
+            && Boolean(request.serviceId.trim());
+        const expectedContext = canBuildContext
+            ? createAppStoreInstallSecretEnvelopeContext({
+                mutationId: request.mutationId,
+                appId: request.appId,
+                appVersion: request.version,
+                serviceId: request.serviceId,
+                key: input.key,
+                delivery: declaration.delivery,
+                generation: declaration.generate,
+            })
+            : new Uint8Array();
+        errors.push(...(await validateSecretValueInputForRecipient(input.valueInput, activeIngressRecipientArg, expectedContext))
+            .map((errorArg) => `install secretInputs[${indexArg}].${errorArg}`));
+    }
+    if (new Set(inputKeys).size !== inputKeys.length) {
+        errors.push('install secretInputs keys must be unique');
+    }
+    for (const key of Object.keys((publicEnvironment || {}))) {
+        if (!publicDeclarations.has(key))
+            errors.push(`install public key '${key}' is not declared public`);
+        if (inputsByKey.has(key))
+            errors.push(`install key '${key}' appears in both channels`);
+    }
+    for (const [key, input] of inputsByKey) {
+        const declaration = secretDeclarations.get(key);
+        if (!declaration) {
+            errors.push(`install secret key '${key}' is not declared secret`);
+            continue;
+        }
+        const valueInput = input.valueInput;
+        if (valueInput?.mode === 'generated'
+            && (!declaration.generate
+                || declaration.generate.encoding !== valueInput.encoding
+                || declaration.generate.bytes !== valueInput.bytes)) {
+            errors.push(`install secret key '${key}' generation does not match its declaration`);
+        }
+    }
+    for (const declaration of publicDeclarations.values()) {
+        if (declaration.required
+            && declaration.value === undefined
+            && !Object.hasOwn((publicEnvironment || {}), declaration.key)) {
+            errors.push(`install required public key '${declaration.key}' is missing`);
+        }
+    }
+    for (const declaration of secretDeclarations.values()) {
+        if (declaration.required && !declaration.generate && !inputsByKey.has(declaration.key)) {
+            errors.push(`install required secret key '${declaration.key}' is missing`);
+        }
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9hcHBzdG9yZS90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsMENBQTBDLEVBQzFDLHNCQUFzQixFQUN0Qix3QkFBd0IsRUFDeEIsb0NBQW9DLEdBS3JDLE1BQU0sbUJBQW1CLENBQUM7QUFDM0IsT0FBTyxFQUNMLGdDQUFnQyxHQUVqQyxNQUFNLHNCQUFzQixDQUFDO0FBaUM5QixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRztJQUN2QyxVQUFVLEVBQUUscUJBQXFCO0lBQ2pDLFlBQVksRUFBRSx1QkFBdUI7SUFDckMsZUFBZSxFQUFFLDJCQUEyQjtJQUM1QyxtQkFBbUIsRUFBRSxnQ0FBZ0M7Q0FDN0MsQ0FBQztBQThLWCxNQUFNLG1CQUFtQixHQUFHLG9CQUFvQixDQUFDO0FBRWpELE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQ3BELGFBQXNCLEVBQ1osRUFBRTtJQUNaLElBQUksYUFBYSxLQUFLLFNBQVM7UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUMzQyxJQUFJLENBQUMsYUFBYSxJQUFJLE9BQU8sYUFBYSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7UUFDeEYsT0FBTyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFHLGFBQXdDLENBQUM7SUFDNUQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksT0FBTyxVQUFVLENBQUMsWUFBWSxLQUFLLFFBQVE7V0FDMUMsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7V0FDeEMsVUFBVSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO1dBQ3hDLFVBQVUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztXQUN4QyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUM7V0FDcEMsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLFlBQVksRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLFFBQVEsS0FBSyxVQUFVLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDbEcsTUFBTSxDQUFDLElBQUksQ0FBQywwRkFBMEYsQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZ0NBQWdDLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztTQUM5RCxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLGdCQUFnQixRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFFbEQsTUFBTSxXQUFXLEdBQUcsVUFBVSxDQUFDLG9CQUFvQixDQUFDO0lBQ3BELElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNsRixNQUFNLENBQUMsSUFBSSxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDckUsQ0FBQztTQUFNLENBQUM7UUFDTixNQUFNLElBQUksR0FBRyxDQUFDLFdBQVcsRUFBRSxVQUFVLEVBQUUsY0FBYyxFQUFFLGFBQWEsRUFBRSxVQUFVLENBQVUsQ0FBQztRQUMzRixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBRSxXQUF1QyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDdEYsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsRUFBRTtZQUNoQyxJQUFJLE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLFFBQVE7bUJBQ25DLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQVcsQ0FBQyxFQUFFLENBQUM7Z0JBQzNELE1BQU0sQ0FBQyxJQUFJLENBQUMscUNBQXFDLE1BQU0sa0NBQWtDLENBQUMsQ0FBQztZQUM3RixDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDM0MsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQzlELENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsMEJBQTBCLEtBQUsscUJBQXFCO1dBQzlELFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxvQkFBb0IsRUFBRSxDQUFDO1FBQ3BFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0RBQXdELENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsQ0FDakQsU0FBa0IsRUFDUixFQUFFO0lBQ1osSUFBSSxDQUFDLFNBQVMsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzVFLE9BQU8sQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxTQUFvQyxDQUFDO0lBQ3BELE1BQU0sTUFBTSxHQUFHO1FBQ2IsR0FBRyxzQ0FBc0MsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDO1FBQzlELEdBQUcsdUNBQXVDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztLQUMzRCxDQUFDO0lBQ0YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxZQUFZLElBQUksT0FBTyxNQUFNLENBQUMsWUFBWSxLQUFLLFFBQVE7V0FDOUQsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDdkQsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLFlBQXVDLENBQUM7SUFDbEUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxvQkFBb0IsSUFBSSxPQUFPLFVBQVUsQ0FBQyxvQkFBb0IsS0FBSyxRQUFRO1dBQ3RGLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLG9CQUFvQixDQUFDO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDbkUsTUFBTSxRQUFRLEdBQUcsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsb0JBQW9CLENBQUM7U0FDcEUsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFzQixFQUFFLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQztJQUMzRSxNQUFNLGVBQWUsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDbkQsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUM3QixNQUFNLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7WUFDNUQsQ0FBQyxDQUFFLE1BQWtDLENBQUMsR0FBRztZQUN6QyxDQUFDLENBQUMsU0FBUyxDQUNkLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQXNCLEVBQUUsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLENBQUM7UUFDM0UsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLEtBQUssTUFBTSxHQUFHLElBQUksZUFBZSxFQUFFLENBQUM7UUFDbEMsSUFBSSxRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdEIsTUFBTSxDQUFDLElBQUksQ0FBQyxpQ0FBaUMsR0FBRyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBNElGLE1BQU0sdUJBQXVCLEdBQUcscUNBQXFDLENBQUM7QUFFdEUsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsZUFBd0IsRUFDZCxFQUFFO0lBQ1osSUFBSSxlQUFlLEtBQUssU0FBUztRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQzdDLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxJQUFJLGVBQWUsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDcEUsT0FBTyxDQUFDLGlDQUFpQyxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixNQUFNLElBQUksR0FBYSxFQUFFLENBQUM7SUFDMUIsZUFBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDLGNBQWMsRUFBRSxRQUFRLEVBQUUsRUFBRTtRQUNuRCxJQUFJLENBQUMsY0FBYyxJQUFJLE9BQU8sY0FBYyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7WUFDM0YsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLFFBQVEscUJBQXFCLENBQUMsQ0FBQztZQUN0RCxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sV0FBVyxHQUFHLGNBQXlDLENBQUM7UUFDOUQsTUFBTSxXQUFXLEdBQUcsV0FBVyxDQUFDLE1BQU0sS0FBSyxJQUFJO1lBQzdDLENBQUMsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxhQUFhLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7WUFDL0UsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLGFBQWEsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDbkUsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN4RSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSxvREFBb0QsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7UUFDRCxJQUFJLE9BQU8sV0FBVyxDQUFDLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLFFBQVEseUJBQXlCLENBQUMsQ0FBQztRQUM1RCxDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzdCLENBQUM7UUFDRCxJQUFJLE9BQU8sV0FBVyxDQUFDLFdBQVcsS0FBSyxRQUFRLElBQUksV0FBVyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsSUFBSSxFQUFFLENBQUM7WUFDekYsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLFFBQVEsK0JBQStCLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsUUFBUSxLQUFLLFNBQVMsSUFBSSxPQUFPLFdBQVcsQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDcEYsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLFFBQVEsNEJBQTRCLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ2hDLElBQUksT0FBTyxJQUFJLFdBQVc7Z0JBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLFFBQVEsb0NBQW9DLENBQUMsQ0FBQztZQUNqRyxJQUFJLENBQUMsQ0FBQyxVQUFVLElBQUksV0FBVyxDQUFDLEVBQUUsQ0FBQztnQkFDakMsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLFFBQVEsd0NBQXdDLENBQUMsQ0FBQztZQUMzRSxDQUFDO2lCQUFNLENBQUM7Z0JBQ04sTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNCQUFzQixDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUM7cUJBQ3hELEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsV0FBVyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQzVELENBQUM7WUFDRCxJQUFJLFdBQVcsQ0FBQyxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx3QkFBd0IsQ0FBQztvQkFDdEMsSUFBSSxFQUFFLFdBQVc7b0JBQ2pCLEdBQUksV0FBVyxDQUFDLFFBQW9DO2lCQUNyRCxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxXQUFXLFFBQVEsY0FBYyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDckUsQ0FBQztRQUNILENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLEtBQUssRUFBRSxDQUFDO2dCQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSxnQ0FBZ0MsQ0FBQyxDQUFDO1lBQ25FLENBQUM7WUFDRCxJQUFJLFVBQVUsSUFBSSxXQUFXO2dCQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLHVDQUF1QyxDQUFDLENBQUM7WUFDdkcsSUFBSSxVQUFVLElBQUksV0FBVztnQkFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSx1Q0FBdUMsQ0FBQyxDQUFDO1lBQ3ZHLElBQUksV0FBVyxDQUFDLEtBQUssS0FBSyxTQUFTLElBQUksT0FBTyxXQUFXLENBQUMsS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUM3RSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSx5Q0FBeUMsQ0FBQyxDQUFDO1lBQzVFLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDSCxJQUFJLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsTUFBTTtRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkJBQTZCLENBQUMsQ0FBQztJQUNuRixPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxLQUFLLEVBQ2pELFVBQW1CLEVBQ25CLFNBQWlDLEVBQ2pDLHlCQUFrRCxFQUMvQixFQUFFO0lBQ3JCLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMvRSxPQUFPLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBcUMsQ0FBQztJQUN0RCxNQUFNLGVBQWUsR0FBRyxTQUFTLElBQUksT0FBTyxTQUFTLEtBQUssUUFBUTtRQUNoRSxDQUFDLENBQUMsU0FBUyxDQUFDLE9BQU87UUFDbkIsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNkLE1BQU0sTUFBTSxHQUFHLHVDQUF1QyxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxHQUFHLENBQUM7UUFDakMsWUFBWTtRQUNaLE9BQU87UUFDUCxTQUFTO1FBQ1QsV0FBVztRQUNYLGFBQWE7UUFDYixRQUFRO1FBQ1IsTUFBTTtRQUNOLGdCQUFnQjtRQUNoQixvQkFBb0I7UUFDcEIsbUJBQW1CO1FBQ25CLGNBQWM7S0FDZixDQUFDLENBQUM7SUFDSCxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFVBQVUsS0FBSyxRQUFRO1dBQ3JDLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ3ZELE1BQU0sQ0FBQyxJQUFJLENBQUMsc0NBQXNDLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLE9BQU8sRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLGFBQWEsQ0FBVSxFQUFFLENBQUM7UUFDOUUsSUFBSSxPQUFPLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRLElBQUksQ0FBRSxPQUFPLENBQUMsS0FBSyxDQUFZLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUM3RSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsS0FBSyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ3BELENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxpQkFBaUIsR0FBRyxPQUFPLENBQUMsaUJBQWlCLENBQUM7SUFDcEQsSUFBSSxDQUFDLGlCQUFpQixJQUFJLE9BQU8saUJBQWlCLEtBQUssUUFBUTtXQUMxRCxLQUFLLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDO1dBQ2hDLE1BQU0sQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FDaEUsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxDQUNsRSxDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNyRixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLElBQUksWUFBWSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUN0RSxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFhLEVBQUUsQ0FBQztJQUMvQixNQUFNLFdBQVcsR0FBRyxJQUFJLEdBQUcsRUFBbUMsQ0FBQztJQUMvRCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxJQUFJLGVBQWUsQ0FBQyxNQUFNLElBQUksR0FBRztRQUNsRixDQUFDLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBK0MsRUFBRSxDQUFDLENBQ2hGLHVDQUF1QyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUNqRSxDQUFDO1FBQ0osQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxHQUFHLENBQUMsWUFBWTtTQUM1QyxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQXFELEVBQUUsQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQztTQUNqRyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEQsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLEdBQUcsQ0FBQyxZQUFZO1NBQzVDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBcUQsRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDO1NBQ2pHLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNoRCxLQUFLLE1BQU0sQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLElBQUksWUFBWSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDMUQsSUFBSSxDQUFDLFFBQVEsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ3pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLFFBQVEscUJBQXFCLENBQUMsQ0FBQztZQUNuRSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLFFBQW1DLENBQUM7UUFDbEQsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsS0FBSyxFQUFFLFlBQVksQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN4RixNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixRQUFRLDZCQUE2QixDQUFDLENBQUM7UUFDN0UsQ0FBQztRQUNELElBQUksT0FBTyxLQUFLLENBQUMsR0FBRyxLQUFLLFFBQVEsSUFBSSxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixRQUFRLHlCQUF5QixDQUFDLENBQUM7WUFDdkUsU0FBUztRQUNYLENBQUM7UUFDRCxTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUMxQixXQUFXLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDbEMsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN0RCxNQUFNLGVBQWUsR0FBRyxXQUFXO2VBQzlCLE9BQU8sT0FBTyxDQUFDLFVBQVUsS0FBSyxRQUFRO2VBQ3RDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO2VBQ2hELE9BQU8sT0FBTyxDQUFDLEtBQUssS0FBSyxRQUFRO2VBQ2pDLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO2VBQzdCLE9BQU8sT0FBTyxDQUFDLE9BQU8sS0FBSyxRQUFRO2VBQ25DLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO2VBQy9CLE9BQU8sT0FBTyxDQUFDLFNBQVMsS0FBSyxRQUFRO2VBQ3JDLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDdkMsTUFBTSxlQUFlLEdBQUcsZUFBZTtZQUNyQyxDQUFDLENBQUMsMENBQTBDLENBQUM7Z0JBQ3pDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBb0I7Z0JBQ3hDLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBZTtnQkFDOUIsVUFBVSxFQUFFLE9BQU8sQ0FBQyxPQUFpQjtnQkFDckMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFtQjtnQkFDdEMsR0FBRyxFQUFFLEtBQUssQ0FBQyxHQUFHO2dCQUNkLFFBQVEsRUFBRSxXQUFXLENBQUMsUUFBUTtnQkFDOUIsVUFBVSxFQUFFLFdBQVcsQ0FBQyxRQUFRO2FBQ2pDLENBQUM7WUFDSixDQUFDLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQztRQUNyQixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxNQUFNLG9DQUFvQyxDQUN4RCxLQUFLLENBQUMsVUFBVSxFQUNoQix5QkFBeUIsRUFDekIsZUFBZSxDQUNoQixDQUFDO2FBQ0MsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyx3QkFBd0IsUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsS0FBSyxNQUFNLEdBQUcsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsaUJBQWlCLElBQUksRUFBRSxDQUE0QixDQUFDLEVBQUUsQ0FBQztRQUNwRixJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQztZQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUJBQXVCLEdBQUcsMEJBQTBCLENBQUMsQ0FBQztRQUNwRyxJQUFJLFdBQVcsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDO1lBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3pGLENBQUM7SUFDRCxLQUFLLE1BQU0sQ0FBQyxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksV0FBVyxFQUFFLENBQUM7UUFDdkMsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2hELElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNqQixNQUFNLENBQUMsSUFBSSxDQUFDLHVCQUF1QixHQUFHLDBCQUEwQixDQUFDLENBQUM7WUFDbEUsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBK0IsQ0FBQztRQUN6RCxJQUFJLFVBQVUsRUFBRSxJQUFJLEtBQUssV0FBVztlQUMvQixDQUFDLENBQUMsV0FBVyxDQUFDLFFBQVE7bUJBQ3BCLFdBQVcsQ0FBQyxRQUFRLENBQUMsUUFBUSxLQUFLLFVBQVUsQ0FBQyxRQUFRO21CQUNyRCxXQUFXLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN4RCxNQUFNLENBQUMsSUFBSSxDQUFDLHVCQUF1QixHQUFHLDZDQUE2QyxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxLQUFLLE1BQU0sV0FBVyxJQUFJLGtCQUFrQixDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7UUFDdEQsSUFBSSxXQUFXLENBQUMsUUFBUTtlQUNuQixXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVM7ZUFDL0IsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsaUJBQWlCLElBQUksRUFBRSxDQUFXLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDMUUsTUFBTSxDQUFDLElBQUksQ0FBQyxnQ0FBZ0MsV0FBVyxDQUFDLEdBQUcsY0FBYyxDQUFDLENBQUM7UUFDN0UsQ0FBQztJQUNILENBQUM7SUFDRCxLQUFLLE1BQU0sV0FBVyxJQUFJLGtCQUFrQixDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUM7UUFDdEQsSUFBSSxXQUFXLENBQUMsUUFBUSxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDdkYsTUFBTSxDQUFDLElBQUksQ0FBQyxnQ0FBZ0MsV0FBVyxDQUFDLEdBQUcsY0FBYyxDQUFDLENBQUM7UUFDN0UsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/data/coremail.runtime.d.ts

@@ -1,4 +1,4 @@
-import { type ICoreMailBindingCredentialVerifier, type ICoreMailControlBootstrap, type ICoreMailDesiredState, type ICoreMailDownloadGrant, type ICoreMailEnvelope, type ICoreMailErrorData, type ICoreMailGatewayOutboundStatus, type ICoreMailGatewayPeerDesiredState, type ICoreMailInboundDelivery, type ICoreMailInboundDeliveryPage, type ICoreMailOutboundMessageDescriptor, type ICoreMailRuntimeKeyReference, type ICoreMailReconciliationStatus, type ICoreMailReplicaIdentity, type ICoreMailSubmission, type ICoreMailTransferGrant, type ICoreMailUploadGrant, type TCoreMailCapability, type TCoreMailBindingState, type TCoreMailSha256, type TCoreMailWorkloadOperation } from './coremail.js';
+import { type ICoreMailBindingCredentialVerifier, type ICoreMailControlBootstrap, type ICoreMailDesiredState, type ICoreMailDownloadGrant, type ICoreMailEnvelope, type ICoreMailErrorData, type ICoreMailGatewayOutboundStatus, type ICoreMailGatewayPeerDesiredState, type ICoreMailInboundDelivery, type ICoreMailInboundDeliveryPage, type ICoreMailOutboundMessageDescriptor, type ICoreMailRuntimeKeyReference, type ICoreMailReconciliationStatus, type ICoreMailReplicaIdentity, type ICoreMailSubmission, type ICoreMailTransferGrant, type ICoreMailUploadGrant, type TCoreMailCapability, type TCoreMailBindingState, type TCoreMailErrorCode, type TCoreMailSha256, type TCoreMailWorkloadOperation } from './coremail.js';
 export declare const coreMailCanonicalJsonRules: Readonly<{
     version: 1;
     encoding: "utf-8";
@@ -30,7 +30,8 @@ export declare const coreMailContractLimits: Readonly<{
     readonly maximumBearerTokenBytes: 1024;
 }>;
 export declare class CoreMailContractError extends Error {
-    constructor(reasonArg: string);
+    readonly code: TCoreMailErrorCode;
+    constructor(reasonArg: string, codeArg?: TCoreMailErrorCode);
 }
 export declare const normalizeCoreMailSha256: (valueArg: unknown, pathArg?: string) => TCoreMailSha256;
 export declare const normalizeCoreMailCredentialVerifier: (valueArg: unknown, pathArg?: string) => ICoreMailBindingCredentialVerifier;