@serve.zone/interfaces 23.2.0 → 24.0.0

package/dist_ts/data/secret.d.ts

@@ -2,7 +2,7 @@ import * as plugins from '../plugins.js';
 import type { TSha256Digest } from './immutableimage.js';
 export type TSecretEnvironment = string;
 export type TSecretLifecycleState = 'active' | 'retired' | 'revoked' | 'deleted';
-export type TSecretVersionLifecycleState = 'active' | 'retired' | 'revoked' | 'purged';
+export type TSecretVersionLifecycleState = 'active' | 'retired' | 'revoked' | 'purge-pending' | 'purged';
 /** Retired versions remain usable only through an already-accepted manifest. */
 export declare const isSecretVersionMaterialIssuable: (lifecycleStateArg: TSecretVersionLifecycleState, referencedByAcceptedManifestArg: boolean) => boolean;
 export type TSecretManagementSource = 'operator' | 'appstore' | 'mail' | 'oidc' | 'webpush' | 'platform' | 'system';
@@ -36,6 +36,9 @@ export interface ISecretVersionRetentionReference {
     resourceId: string;
     expiresAt?: number;
 }
+export declare const secretVersionRetentionReferenceLimits: Readonly<{
+    pageSizeMaximum: 256;
+}>;
 /** Browser-safe logical secret metadata. It never contains value material. */
 export interface ISecretMetadata {
     id: string;
@@ -65,14 +68,53 @@ export interface ISecretMetadata {
 export interface ISecretVersionMetadata {
     id: string;
     secretId: string;
+    revision: number;
     lifecycleState: TSecretVersionLifecycleState;
     createdAt: number;
     createdBy: string;
     source: TSecretManagementSource;
     retiredAt?: number;
     revokedAt?: number;
+    purgeOperationId?: string;
     purgedAt?: number;
 }
+/** Irreversibly erases every platform-managed copy after all references are gone. */
+export interface ISecretVersionPurgeIntentV1 {
+    schemaVersion: 1;
+    mutationId: string;
+    secretId: string;
+    secretVersionId: string;
+    expectedSecretRevision: number;
+    expectedSecretVersionRevision: number;
+    expectedTargetSecretsRevision: number;
+}
+export interface ISecretVersionPurgeFailureV1 {
+    code: string;
+    retryable: boolean;
+    failedAt: number;
+}
+interface ISecretVersionPurgeOperationBaseV1 {
+    schemaVersion: 1;
+    id: string;
+    revision: number;
+    intent: ISecretVersionPurgeIntentV1;
+    intentDigest: TSha256Digest;
+    createdAt: number;
+    updatedAt: number;
+}
+export type TSecretVersionPurgeOperationV1 = (ISecretVersionPurgeOperationBaseV1 & {
+    state: 'pending' | 'erasing';
+    failure?: never;
+    purgedAt?: never;
+}) | (ISecretVersionPurgeOperationBaseV1 & {
+    state: 'failed';
+    failure: ISecretVersionPurgeFailureV1;
+    purgedAt?: never;
+}) | (ISecretVersionPurgeOperationBaseV1 & {
+    state: 'succeeded';
+    failure?: never;
+    purgedAt: number;
+});
 export interface ISecretSetMetadata {
     id: string;
     organizationId: string;
@@ -219,9 +261,17 @@ export interface IServiceSecretDeploymentPlan {
 export declare const resolvedSecretManifestReferencesEqual: (leftArg: IResolvedSecretManifestReference | undefined, rightArg: IResolvedSecretManifestReference | undefined) => boolean;
 export declare const isResolvedSecretManifestReferenceAccepted: (stateArg: IClusterSecretDeploymentState, referenceArg: IResolvedSecretManifestReference, nowArg: number) => boolean;
 export declare const validateSecretMutationId: (mutationIdArg: unknown) => string[];
+export declare const validateSecretVersionRetentionReferences: (referencesArg: unknown) => string[];
+export declare const validateSecretVersionMetadata: (versionArg: unknown) => string[];
+export declare const validateSecretVersionPurgeIntent: (intentArg: unknown) => string[];
+export declare const createSecretVersionPurgeIntentDigestInput: (intentArg: ISecretVersionPurgeIntentV1) => string;
+export declare const computeSecretVersionPurgeIntentDigest: (intentArg: ISecretVersionPurgeIntentV1) => Promise<TSha256Digest>;
+export declare const verifySecretVersionPurgeIntentDigest: (intentArg: ISecretVersionPurgeIntentV1, digestArg: unknown) => Promise<boolean>;
+export declare const validateSecretVersionPurgeOperation: (operationArg: unknown) => Promise<string[]>;
 export declare const validateSecretOwner: (ownerArg: unknown) => string[];
 export declare const validateSecretManagementScope: (sourceArg: TSecretManagementSource, scopeArg: unknown) => string[];
 export declare const validateSecretDelivery: (deliveryArg: unknown) => string[];
+export declare const validateSecretMetadata: (secretArg: unknown) => string[];
 export declare const validateSecretValueInput: (valueInputArg: unknown) => string[];
 /** Checks the SmartCrypto context digest without opening or decrypting the envelope. */
 export declare const verifySecretEnvelopeContext: (envelopeArg: unknown, contextArg: unknown) => Promise<boolean>;
@@ -316,7 +366,6 @@ export interface IRevokedSecretRecipientMetadata extends ISecretRecipientMetadat
     revokedAt: number;
 }
 export type TSecretRecipientMetadata = IActiveSecretRecipientMetadata | IRetiringSecretRecipientMetadata | IRevokedSecretRecipientMetadata;
-export type TSecretIngressRecipient = TSecretRecipientMetadata;
 export declare const secretRecipientLimits: Readonly<{
     maximumRecipients: 64;
 }>;
@@ -325,8 +374,6 @@ export declare const validateSecretRecipientSet: (recipientsArg: unknown) => str
 /** New envelopes target only active recipients. */
 export declare const canIssueNewSecretEnvelope: (recipientArg: TSecretRecipientMetadata) => boolean;
 export declare const validateSecretValueInputForRecipient: (valueInputArg: unknown, recipientArg: TSecretRecipientMetadata, expectedContextArg: Uint8Array) => Promise<string[]>;
-/** Retiring recipients open only already-issued envelopes before their deadline. */
-export declare const canOpenIssuedSecretEnvelope: (recipientArg: TSecretRecipientMetadata, issuedAtArg: number, nowArg: number) => boolean;
 export declare const createSecretCreateEnvelopeContext: (contextArg: {
     mutationId: string;
     target: TSecretMutationTarget;