@serve.zone/interfaces 23.0.4 → 23.2.0

package/readme.md

@@ -67,6 +67,53 @@ Primary v23 additions include:
 - Mandatory `IImmutableContainerInvocationV1` evidence on immutable image
   deployment plans.
 
+### Secrets v23.1 Runtime Registration And Reporting
+
+The Node-only `@serve.zone/interfaces/runtime` export adds the live contract
+that Cloudly must validate before publishing secret-bearing desired state to a
+Coreflow connection:
+
+- `getSecretRecipientEnrollmentState` returns either an exact generation-zero
+  empty state or the complete valid recipient set for the cluster derived from
+  the verified JWT.
+- `getCoreflowSecretRuntimeRegistrationExpectation` returns the authoritative
+  live reporter session, target-node set, active recipient, and approved
+  WorkloadInit artifacts for the cluster derived from the verified JWT.
+- `coreflowSecretRuntimeRegistrationTagId` is the sole dedicated TypedSocket
+  tag identifier. Its payload is exactly
+  `ICoreflowSecretRuntimeRegistrationV1`; cluster scope comes from the verified
+  connection identity rather than the tag.
+- `ICoreflowSecretRuntimeRegistrationV1` binds a reporter session to the exact
+  authoritative schedulable target-node set, required secret capabilities,
+  active recipient, approved WorkloadInit OCI index, and exact per-platform
+  manifest and installed-executable digests.
+- `validateCoreflowSecretRuntimeRegistration` compares the registration with a
+  trusted expectation built by Cloudly, including the live reporter session.
+  Missing, extra, duplicate, reordered, or mismatched node evidence fails
+  closed. Consumers must discard the registration on transport disconnect, tag
+  removal or replacement, or any live session, placement, artifact, or
+  recipient expectation change before publishing more secret-bearing state.
+- `reportSecretDeploymentState` reports only `applying`, `applied`, `drifted`,
+  or `failed` for the manifest and plan revision selected by Cloudly. The
+  validator receives the trusted cluster ID after JWT verification and the
+  trusted live reporter session. Wire-provided manifest scope is checked
+  against, and never replaces, that trusted authority.
+
+The package validates report shape, digest, trusted cluster, and trusted live
+session; it does not persist replay state or mutate deployment plans. Deployment
+report consumers must persist an atomic receipt keyed by the verified cluster,
+reporter session, service, and positive sequence. The report digest uses
+fixed-order JSON and excludes only the JWT identity and `reportDigest`. The
+consumer accepts the exact next sequence once, returns the prior response for a
+same-digest replay, rejects a different-digest replay, and ensures a plan
+revision CAS failure consumes neither the sequence nor a receipt. Timestamps
+are informational and never replace live session, placement, artifact,
+recipient, sequence, or plan-revision fences.
+
+`createWorkloadInitEnvironmentMap` now rejects manifests without any
+`launcher-environment` delivery. Consumers must bypass WorkloadInit for
+file-only manifests.
+
 ## Portable Storage Contracts
 
 App Store templates can declare logical, template-local `storageClasses` and

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '23.0.4',
+  version: '23.2.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/immutableimage.ts

@@ -71,6 +71,8 @@ export interface ICoreflowRuntimeCapabilities {
   sealedSecretMaterialVersion: 1;
   secretRecipientEnrollmentVersion: 1;
   workloadInitEnvironmentVersion: 1;
+  /** Coreflow can submit replay-safe schema-v1 secret deployment reports. */
+  secretDeploymentReportVersion?: 1;
 }
 
 export type TImmutableContainerPlatform = 'linux/amd64' | 'linux/arm64';

package/ts/data/secret.ts

@@ -922,7 +922,7 @@ export const validateResolvedSecretManifest = (
   return errors;
 };
 
-const validateResolvedSecretManifestReference = (
+const validateResolvedSecretManifestReferenceAtPath = (
   referenceArg: unknown,
   expectedClusterIdArg: string,
   pathArg: string,
@@ -958,6 +958,25 @@ const validateResolvedSecretManifestReference = (
   return [];
 };
 
+/** Strict public validator for a cluster-scoped resolved manifest reference. */
+export const validateResolvedSecretManifestReference = (
+  referenceArg: unknown,
+  expectedClusterIdArg: string,
+): string[] => {
+  try {
+    if (!isSecretIdentifier(expectedClusterIdArg)) {
+      return ['expected cluster id must be canonical'];
+    }
+    return validateResolvedSecretManifestReferenceAtPath(
+      referenceArg,
+      expectedClusterIdArg,
+      'resolved secret manifest reference',
+    );
+  } catch {
+    return ['resolved secret manifest reference must be safely inspectable'];
+  }
+};
+
 export const validateServiceSecretDeploymentPlan = (
   planArg: unknown,
   expectedTargetClusterIdsArg?: string[],
@@ -992,7 +1011,7 @@ export const validateServiceSecretDeploymentPlan = (
     expectedClusterIdArg: string,
     pathArg: string,
   ): void => {
-    const referenceErrors = validateResolvedSecretManifestReference(
+    const referenceErrors = validateResolvedSecretManifestReferenceAtPath(
       referenceArg,
       expectedClusterIdArg,
       pathArg,
@@ -1183,6 +1202,9 @@ export const createWorkloadInitEnvironmentMap = async (
         source: createLauncherSecretSourcePath(resource),
       };
     }));
+  if (entries.length === 0) {
+    throw new Error('workload init map requires at least one launcher-environment delivery');
+  }
   entries.sort((leftArg, rightArg) => (
     leftArg.variableName < rightArg.variableName
       ? -1