@serve.zone/interfaces 23.2.0 → 24.0.0

package/dist_ts/requests/secret.d.ts

@@ -1,5 +1,5 @@
 import type * as plugins from '../plugins.js';
-import type { IResolvedSecretManifestEntry, ISecretMetadata, ISecretSetAttachment, ISecretSetConsumerRolloutStatus, ISecretSetMetadata, ISecretVersionMetadata, ISecretVersionRetentionReference, TSecretIngressRecipient, TSecretMutationTarget, TSecretValueInput, TSecretDelivery, TSecretEnvironment } from '../data/secret.js';
+import type { IResolvedSecretManifestEntry, IActiveSecretRecipientMetadata, ISecretMetadata, ISecretSetAttachment, ISecretSetConsumerRolloutStatus, ISecretSetMetadata, ISecretVersionMetadata, ISecretVersionPurgeIntentV1, ISecretVersionRetentionReference, TSecretVersionPurgeOperationV1, TSecretMutationTarget, TSecretValueInput, TSecretDelivery, TSecretEnvironment } from '../data/secret.js';
 import type { IIdentityCredential } from '../data/user.js';
 export interface IReq_GetSecretIngressRecipient extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetSecretIngressRecipient> {
     method: 'getSecretIngressRecipient';
@@ -7,7 +7,7 @@ export interface IReq_GetSecretIngressRecipient extends plugins.typedrequestInte
         identity: IIdentityCredential;
     };
     response: {
-        recipient: TSecretIngressRecipient;
+        recipient: IActiveSecretRecipientMetadata;
     };
 }
 export interface IReq_ListSecrets extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ListSecrets> {
@@ -84,7 +84,7 @@ export interface IReq_ChangeSecretLifecycle extends plugins.typedrequestInterfac
     request: {
         identity: IIdentityCredential;
         secretId: string;
-        action: 'retire' | 'revoke' | 'delete' | 'request-purge';
+        action: 'retire' | 'revoke' | 'delete';
         expectedSecretRevision: number;
         expectedTargetSecretsRevision: number;
     };
@@ -99,10 +99,34 @@ export interface IReq_GetSecretVersionPurgePreflight extends plugins.typedreques
         identity: IIdentityCredential;
         secretId: string;
         secretVersionId: string;
+        cursor?: string;
+        limit?: number;
     };
     response: {
-        purgeAllowed: boolean;
+        schemaVersion: 1;
+        secret: ISecretMetadata;
+        version: ISecretVersionMetadata;
+        targetSecretsRevision: number;
+        eligible: boolean;
+        blockers: TSecretVersionPurgeBlocker[];
+        blockingReferenceCount: number;
         references: ISecretVersionRetentionReference[];
+        nextCursor?: string;
+        referencesTruncated: boolean;
+        operation?: TSecretVersionPurgeOperationV1;
+    };
+}
+export type TSecretVersionPurgeBlocker = 'version-active' | 'retention-reference' | 'purge-pending' | 'already-purged';
+export interface IReq_PurgeSecretVersion extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PurgeSecretVersion> {
+    method: 'purgeSecretVersion';
+    request: ISecretVersionPurgeIntentV1 & {
+        identity: IIdentityCredential;
+    };
+    response: {
+        secret: ISecretMetadata;
+        version: ISecretVersionMetadata;
+        operation: TSecretVersionPurgeOperationV1;
+        targetSecretsRevision: number;
     };
 }
 export interface IReq_ListSecretSets extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_ListSecretSets> {
@@ -200,5 +224,8 @@ export interface IReq_PreviewServiceSecretResolution extends plugins.typedreques
         collisions: ISecretResolutionPreviewCollision[];
     };
 }
-export declare const validateCreateSecretRequest: (requestArg: unknown, activeIngressRecipientArg: TSecretIngressRecipient) => Promise<string[]>;
-export declare const validateRotateSecretRequest: (requestArg: unknown, activeIngressRecipientArg: TSecretIngressRecipient) => Promise<string[]>;
+export declare const validateCreateSecretRequest: (requestArg: unknown, activeIngressRecipientArg: IActiveSecretRecipientMetadata) => Promise<string[]>;
+export declare const validateRotateSecretRequest: (requestArg: unknown, activeIngressRecipientArg: IActiveSecretRecipientMetadata) => Promise<string[]>;
+export declare const validatePurgeSecretVersionRequest: (requestArg: unknown) => string[];
+export declare const validateGetSecretVersionPurgePreflightRequest: (requestArg: unknown) => string[];
+export declare const validateSecretVersionPurgePreflightResponse: (responseArg: unknown) => Promise<string[]>;

package/dist_ts/requests/secret.js

@@ -158,4 +158,201 @@ export const validateRotateSecretRequest = async (requestArg, activeIngressRecip
     errors.push(...await secretData.validateSecretValueInputForRecipient(request.valueInput, activeIngressRecipientArg, expectedContext));
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvc2VjcmV0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sS0FBSyxVQUFVLE1BQU0sbUJBQW1CLENBQUM7QUFvUmhELE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUFDLENBQzNFLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUM5RSxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxVQUFtQixFQUNuQix5QkFBa0QsRUFDL0IsRUFBRTtJQUNyQixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2RSxNQUFNLFdBQVcsR0FBRyxJQUFJLEdBQUcsQ0FBQztRQUMxQixVQUFVO1FBQ1YsWUFBWTtRQUNaLFFBQVE7UUFDUixLQUFLO1FBQ0wsYUFBYTtRQUNiLE1BQU07UUFDTixhQUFhO1FBQ2IsTUFBTTtRQUNOLFVBQVU7UUFDVixZQUFZO1FBQ1osK0JBQStCO0tBQ2hDLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN4RCxPQUFRLE9BQU8sQ0FBQyxRQUFvQyxDQUFDLEdBQUcsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLE9BQU8sT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUMzRixNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztTQUFNLENBQUM7UUFDTixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsVUFBVSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDckYsTUFBTSxDQUFDLElBQUksQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRO1dBQ3RDLENBQUMsbUNBQW1DLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3BFLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxJQUFJLEtBQUssUUFBUTtXQUMvQixPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxLQUFLLE9BQU8sQ0FBQyxJQUFJO1dBQ3BDLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkIsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDL0IsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxXQUFXLEtBQUssU0FBUztXQUNoQyxDQUFDLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMvQixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDN0QsTUFBTSxDQUFDLElBQUksQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO1FBQzVELENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxPQUFPLEdBQWEsRUFBRSxDQUFDO1lBQzdCLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxFQUFFO2dCQUN4QyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQzt1QkFDaEIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQzt1QkFDL0UsT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7dUJBQzlCLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxHQUFHLENBQUM7dUJBQ3JCLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUc7dUJBQ3ZCLE9BQU8sTUFBTSxDQUFDLEtBQUssS0FBSyxRQUFRO3VCQUNoQyxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztvQkFDL0IsTUFBTSxDQUFDLElBQUksQ0FBQyxzQkFBc0IsUUFBUSx5Q0FBeUMsQ0FBQyxDQUFDO2dCQUN2RixDQUFDO3FCQUFNLENBQUM7b0JBQ04sT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQzNCLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztZQUNILElBQUksSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxDQUFDLElBQUksQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1lBQ3ZELENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sY0FBYyxHQUFHLFVBQVUsQ0FBQyxzQkFBc0IsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGNBQWMsQ0FBQyxDQUFDO0lBQy9CLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyw2QkFBNkIsQ0FBQztXQUMxRCxPQUFPLENBQUMsNkJBQXdDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxNQUFNLGVBQWUsR0FBRyxVQUFVLENBQUMsd0JBQXdCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3ZGLFVBQVUsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDM0QsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVE7V0FDL0IsMEJBQTBCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUM7V0FDNUMsT0FBTyxPQUFPLENBQUMsV0FBVyxLQUFLLFFBQVE7V0FDdkMsbUNBQW1DLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7V0FDN0QsY0FBYyxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQzNCLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLDZCQUE2QixDQUFDO1dBQzFELE9BQU8sQ0FBQyw2QkFBd0MsSUFBSSxDQUFDLENBQUM7SUFDNUQsTUFBTSxlQUFlLEdBQUcsZUFBZTtRQUNyQyxDQUFDLENBQUMsVUFBVSxDQUFDLGlDQUFpQyxDQUFDO1lBQzNDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBb0I7WUFDeEMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUErQjtZQUMvQyxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQWE7WUFDMUIsV0FBVyxFQUFFLE9BQU8sQ0FBQyxXQUFpQztZQUN0RCxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQTJCO1lBQzdDLDZCQUE2QixFQUFFLE9BQU8sQ0FBQyw2QkFBdUM7U0FDL0UsQ0FBQztRQUNKLENBQUMsQ0FBQyxJQUFJLFVBQVUsRUFBRSxDQUFDO0lBQ3JCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLFVBQVUsQ0FBQyxvQ0FBb0MsQ0FDbEUsT0FBTyxDQUFDLFVBQVUsRUFDbEIseUJBQXlCLEVBQ3pCLGVBQWUsQ0FDaEIsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxVQUFtQixFQUNuQix5QkFBa0QsRUFDL0IsRUFBRTtJQUNyQixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2RSxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDakUseUJBQXlCO1FBQ3pCLHdCQUF3QjtRQUN4QiwrQkFBK0I7UUFDL0IsVUFBVTtRQUNWLFlBQVk7UUFDWixVQUFVO1FBQ1YsWUFBWTtLQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN4RCxPQUFRLE9BQU8sQ0FBQyxRQUFvQyxDQUFDLEdBQUcsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxVQUFVLEVBQUUseUJBQXlCLENBQVUsRUFBRSxDQUFDO1FBQ3JFLElBQUksT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUTtlQUNqQyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFXLENBQUMsRUFBRSxDQUFDO1lBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEtBQUssb0JBQW9CLENBQUMsQ0FBQztRQUMxRCxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQztXQUNuRCxPQUFPLENBQUMsc0JBQWlDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsNkJBQTZCLENBQUM7V0FDMUQsT0FBTyxDQUFDLDZCQUF3QyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNELE1BQU0sQ0FBQyxJQUFJLENBQUMsOERBQThELENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBQ0QsTUFBTSxlQUFlLEdBQUcsVUFBVSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUN2RixPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUNwQyxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztXQUM1RCxPQUFPLE9BQU8sQ0FBQyx1QkFBdUIsS0FBSyxRQUFRO1dBQ25ELHFDQUFxQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsdUJBQXVCLENBQUM7V0FDM0UsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsc0JBQXNCLENBQUM7V0FDbkQsT0FBTyxDQUFDLHNCQUFpQyxJQUFJLENBQUM7V0FDL0MsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsNkJBQTZCLENBQUM7V0FDMUQsT0FBTyxDQUFDLDZCQUF3QyxJQUFJLENBQUMsQ0FBQztJQUM1RCxNQUFNLGVBQWUsR0FBRyxlQUFlO1FBQ3JDLENBQUMsQ0FBQyxVQUFVLENBQUMsaUNBQWlDLENBQUM7WUFDM0MsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFvQjtZQUN4QyxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQWtCO1lBQ3BDLHNCQUFzQixFQUFFLE9BQU8sQ0FBQyxzQkFBZ0M7WUFDaEUsdUJBQXVCLEVBQUUsT0FBTyxDQUFDLHVCQUFpQztZQUNsRSw2QkFBNkIsRUFBRSxPQUFPLENBQUMsNkJBQXVDO1NBQy9FLENBQUM7UUFDSixDQUFDLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQztJQUNyQixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSxVQUFVLENBQUMsb0NBQW9DLENBQ2xFLE9BQU8sQ0FBQyxVQUFVLEVBQ2xCLHlCQUF5QixFQUN6QixlQUFlLENBQ2hCLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyJ9
+export const validatePurgeSecretVersionRequest = (requestArg) => {
+    try {
+        if (!isRecord(requestArg))
+            return ['purge secret version request must be an object'];
+        const request = requestArg;
+        const intent = Object.fromEntries(Object.entries(request).filter(([keyArg]) => keyArg !== 'identity'));
+        const errors = secretData.validateSecretVersionPurgeIntent(intent);
+        if (!request.identity || typeof request.identity !== 'object' || Array.isArray(request.identity)
+            || JSON.stringify(Object.keys(request.identity).sort()) !== JSON.stringify(['jwt'])
+            || typeof request.identity.jwt !== 'string'
+            || !request.identity.jwt) {
+            errors.push('purge secret version request requires only a JWT identity');
+        }
+        return errors;
+    }
+    catch {
+        return ['purge secret version request must be safely inspectable'];
+    }
+};
+export const validateGetSecretVersionPurgePreflightRequest = (requestArg) => {
+    try {
+        if (!isRecord(requestArg)) {
+            return ['secret version purge preflight request must be an object'];
+        }
+        const expectedKeys = [
+            'identity',
+            'secretId',
+            'secretVersionId',
+            ...(requestArg.cursor === undefined ? [] : ['cursor']),
+            ...(requestArg.limit === undefined ? [] : ['limit']),
+        ];
+        const errors = [];
+        if (JSON.stringify(Object.keys(requestArg).sort())
+            !== JSON.stringify(expectedKeys.sort())) {
+            errors.push('secret version purge preflight request must use its exact schema');
+        }
+        if (!isRecord(requestArg.identity)
+            || JSON.stringify(Object.keys(requestArg.identity).sort()) !== JSON.stringify(['jwt'])
+            || typeof requestArg.identity.jwt !== 'string'
+            || !requestArg.identity.jwt) {
+            errors.push('secret version purge preflight request requires only a JWT identity');
+        }
+        for (const field of ['secretId', 'secretVersionId']) {
+            if (typeof requestArg[field] !== 'string'
+                || !/^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(requestArg[field])) {
+                errors.push(`secret version purge preflight ${field} must be canonical`);
+            }
+        }
+        if (requestArg.cursor !== undefined
+            && (typeof requestArg.cursor !== 'string' || requestArg.cursor.length === 0)) {
+            errors.push('secret version purge preflight cursor must be opaque and non-empty');
+        }
+        if (requestArg.limit !== undefined
+            && (!Number.isSafeInteger(requestArg.limit)
+                || requestArg.limit < 1
+                || requestArg.limit
+                    > secretData.secretVersionRetentionReferenceLimits.pageSizeMaximum)) {
+            errors.push('secret version purge preflight limit must be bounded');
+        }
+        return errors;
+    }
+    catch {
+        return ['secret version purge preflight request must be safely inspectable'];
+    }
+};
+export const validateSecretVersionPurgePreflightResponse = async (responseArg) => {
+    try {
+        if (!isRecord(responseArg)) {
+            return ['secret version purge preflight response must be an object'];
+        }
+        const response = responseArg;
+        const expectedKeys = [
+            'schemaVersion',
+            'secret',
+            'version',
+            'targetSecretsRevision',
+            'eligible',
+            'blockers',
+            'blockingReferenceCount',
+            'references',
+            'referencesTruncated',
+            ...(response.nextCursor === undefined ? [] : ['nextCursor']),
+            ...(response.operation === undefined ? [] : ['operation']),
+        ];
+        const errors = [];
+        if (JSON.stringify(Object.keys(response).sort())
+            !== JSON.stringify([...expectedKeys].sort())) {
+            errors.push('secret version purge preflight response must use its exact schema');
+        }
+        if (response.schemaVersion !== 1) {
+            errors.push('secret version purge preflight response schemaVersion must be 1');
+        }
+        if (secretData.validateSecretVersionMetadata(response.version).length > 0) {
+            errors.push('secret version purge preflight version must be canonical');
+        }
+        if (secretData.validateSecretMetadata(response.secret).length > 0) {
+            errors.push('secret version purge preflight secret must be canonical');
+        }
+        if (isRecord(response.secret)
+            && isRecord(response.version)
+            && response.version.secretId !== response.secret.id) {
+            errors.push('secret version purge preflight version must belong to its secret');
+        }
+        if (!Number.isSafeInteger(response.targetSecretsRevision)
+            || response.targetSecretsRevision < 0) {
+            errors.push('secret version purge preflight target revision must be non-negative');
+        }
+        const allowedBlockers = new Set([
+            'version-active',
+            'retention-reference',
+            'purge-pending',
+            'already-purged',
+        ]);
+        if (!Array.isArray(response.blockers)
+            || response.blockers.some((blockerArg) => !allowedBlockers.has(blockerArg))
+            || new Set(response.blockers).size !== response.blockers.length
+            || JSON.stringify(response.blockers) !== JSON.stringify([...response.blockers].sort())) {
+            errors.push('secret version purge preflight blockers must be uniquely sorted');
+        }
+        if (typeof response.eligible !== 'boolean'
+            || response.eligible !== (Array.isArray(response.blockers) && response.blockers.length === 0)) {
+            errors.push('secret version purge preflight eligibility must be derived from blockers');
+        }
+        if (!Number.isSafeInteger(response.blockingReferenceCount)
+            || response.blockingReferenceCount < 0) {
+            errors.push('secret version purge preflight reference count must be non-negative');
+        }
+        errors.push(...secretData.validateSecretVersionRetentionReferences(response.references));
+        if (typeof response.referencesTruncated !== 'boolean') {
+            errors.push('secret version purge preflight referencesTruncated must be boolean');
+        }
+        if (response.nextCursor !== undefined
+            && (typeof response.nextCursor !== 'string' || response.nextCursor.length === 0)) {
+            errors.push('secret version purge preflight nextCursor must be opaque and non-empty');
+        }
+        if (response.referencesTruncated !== (response.nextCursor !== undefined)) {
+            errors.push('secret version purge preflight truncation must match nextCursor presence');
+        }
+        if (Array.isArray(response.references)
+            && Number.isSafeInteger(response.blockingReferenceCount)
+            && response.blockingReferenceCount < response.references.length) {
+            errors.push('secret version purge preflight reference count cannot be smaller than its page');
+        }
+        if (Array.isArray(response.blockers)
+            && isRecord(response.version)
+            && Number.isSafeInteger(response.blockingReferenceCount)) {
+            const expectedBlockers = [];
+            if (response.version.lifecycleState === 'active')
+                expectedBlockers.push('version-active');
+            if (response.blockingReferenceCount > 0) {
+                expectedBlockers.push('retention-reference');
+            }
+            if (response.version.lifecycleState === 'purge-pending') {
+                expectedBlockers.push('purge-pending');
+            }
+            if (response.version.lifecycleState === 'purged')
+                expectedBlockers.push('already-purged');
+            expectedBlockers.sort();
+            if (JSON.stringify(response.blockers) !== JSON.stringify(expectedBlockers)) {
+                errors.push('secret version purge preflight blockers do not match current state');
+            }
+        }
+        if (response.operation !== undefined) {
+            errors.push(...await secretData.validateSecretVersionPurgeOperation(response.operation));
+            if (isRecord(response.operation)
+                && isRecord(response.operation.intent)
+                && isRecord(response.secret)
+                && isRecord(response.version)
+                && (response.operation.id !== response.version.purgeOperationId
+                    || response.operation.intent.secretId !== response.secret.id
+                    || response.operation.intent.secretVersionId !== response.version.id)) {
+                errors.push('secret version purge preflight operation does not match its version');
+            }
+            if (isRecord(response.operation) && isRecord(response.version)) {
+                if (response.version.lifecycleState === 'purge-pending'
+                    && response.operation.state === 'succeeded') {
+                    errors.push('purge-pending version cannot have a succeeded purge operation');
+                }
+                if (response.version.lifecycleState === 'purged'
+                    && (response.operation.state !== 'succeeded'
+                        || response.operation.purgedAt !== response.version.purgedAt)) {
+                    errors.push('purged version requires the matching succeeded purge operation');
+                }
+            }
+        }
+        if (isRecord(response.version)
+            && (response.version.lifecycleState === 'purge-pending'
+                || response.version.lifecycleState === 'purged')
+            && response.operation === undefined) {
+            errors.push('secret version purge preflight purging state requires its operation');
+        }
+        return errors;
+    }
+    catch {
+        return ['secret version purge preflight response must be safely inspectable'];
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VjcmV0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvc2VjcmV0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sS0FBSyxVQUFVLE1BQU0sbUJBQW1CLENBQUM7QUF3VGhELE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUFDLENBQzNFLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUM5RSxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxVQUFtQixFQUNuQix5QkFBeUQsRUFDdEMsRUFBRTtJQUNyQixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2RSxNQUFNLFdBQVcsR0FBRyxJQUFJLEdBQUcsQ0FBQztRQUMxQixVQUFVO1FBQ1YsWUFBWTtRQUNaLFFBQVE7UUFDUixLQUFLO1FBQ0wsYUFBYTtRQUNiLE1BQU07UUFDTixhQUFhO1FBQ2IsTUFBTTtRQUNOLFVBQVU7UUFDVixZQUFZO1FBQ1osK0JBQStCO0tBQ2hDLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN4RCxPQUFRLE9BQU8sQ0FBQyxRQUFvQyxDQUFDLEdBQUcsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLE9BQU8sT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUMzRixNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztTQUFNLENBQUM7UUFDTixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsVUFBVSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDckYsTUFBTSxDQUFDLElBQUksQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRO1dBQ3RDLENBQUMsbUNBQW1DLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3BFLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxJQUFJLEtBQUssUUFBUTtXQUMvQixPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxLQUFLLE9BQU8sQ0FBQyxJQUFJO1dBQ3BDLE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkIsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDL0IsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxXQUFXLEtBQUssU0FBUztXQUNoQyxDQUFDLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksT0FBTyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMvQixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDN0QsTUFBTSxDQUFDLElBQUksQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO1FBQzVELENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxPQUFPLEdBQWEsRUFBRSxDQUFDO1lBQzdCLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxFQUFFO2dCQUN4QyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQzt1QkFDaEIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQzt1QkFDL0UsT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7dUJBQzlCLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxHQUFHLENBQUM7dUJBQ3JCLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxHQUFHLEdBQUc7dUJBQ3ZCLE9BQU8sTUFBTSxDQUFDLEtBQUssS0FBSyxRQUFRO3VCQUNoQyxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztvQkFDL0IsTUFBTSxDQUFDLElBQUksQ0FBQyxzQkFBc0IsUUFBUSx5Q0FBeUMsQ0FBQyxDQUFDO2dCQUN2RixDQUFDO3FCQUFNLENBQUM7b0JBQ04sT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQzNCLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztZQUNILElBQUksSUFBSSxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxDQUFDLElBQUksQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1lBQ3ZELENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sY0FBYyxHQUFHLFVBQVUsQ0FBQyxzQkFBc0IsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGNBQWMsQ0FBQyxDQUFDO0lBQy9CLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyw2QkFBNkIsQ0FBQztXQUMxRCxPQUFPLENBQUMsNkJBQXdDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxNQUFNLGVBQWUsR0FBRyxVQUFVLENBQUMsd0JBQXdCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3ZGLFVBQVUsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDM0QsT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVE7V0FDL0IsMEJBQTBCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUM7V0FDNUMsT0FBTyxPQUFPLENBQUMsV0FBVyxLQUFLLFFBQVE7V0FDdkMsbUNBQW1DLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7V0FDN0QsY0FBYyxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQzNCLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLDZCQUE2QixDQUFDO1dBQzFELE9BQU8sQ0FBQyw2QkFBd0MsSUFBSSxDQUFDLENBQUM7SUFDNUQsTUFBTSxlQUFlLEdBQUcsZUFBZTtRQUNyQyxDQUFDLENBQUMsVUFBVSxDQUFDLGlDQUFpQyxDQUFDO1lBQzNDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBb0I7WUFDeEMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUErQjtZQUMvQyxHQUFHLEVBQUUsT0FBTyxDQUFDLEdBQWE7WUFDMUIsV0FBVyxFQUFFLE9BQU8sQ0FBQyxXQUFpQztZQUN0RCxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQTJCO1lBQzdDLDZCQUE2QixFQUFFLE9BQU8sQ0FBQyw2QkFBdUM7U0FDL0UsQ0FBQztRQUNKLENBQUMsQ0FBQyxJQUFJLFVBQVUsRUFBRSxDQUFDO0lBQ3JCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLFVBQVUsQ0FBQyxvQ0FBb0MsQ0FDbEUsT0FBTyxDQUFDLFVBQVUsRUFDbEIseUJBQXlCLEVBQ3pCLGVBQWUsQ0FDaEIsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxVQUFtQixFQUNuQix5QkFBeUQsRUFDdEMsRUFBRTtJQUNyQixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2RSxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDakUseUJBQXlCO1FBQ3pCLHdCQUF3QjtRQUN4QiwrQkFBK0I7UUFDL0IsVUFBVTtRQUNWLFlBQVk7UUFDWixVQUFVO1FBQ1YsWUFBWTtLQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN4RCxPQUFRLE9BQU8sQ0FBQyxRQUFvQyxDQUFDLEdBQUcsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxVQUFVLEVBQUUseUJBQXlCLENBQVUsRUFBRSxDQUFDO1FBQ3JFLElBQUksT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUTtlQUNqQyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFXLENBQUMsRUFBRSxDQUFDO1lBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEtBQUssb0JBQW9CLENBQUMsQ0FBQztRQUMxRCxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQztXQUNuRCxPQUFPLENBQUMsc0JBQWlDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsNkJBQTZCLENBQUM7V0FDMUQsT0FBTyxDQUFDLDZCQUF3QyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNELE1BQU0sQ0FBQyxJQUFJLENBQUMsOERBQThELENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBQ0QsTUFBTSxlQUFlLEdBQUcsVUFBVSxDQUFDLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUN2RixPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUNwQyxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztXQUM1RCxPQUFPLE9BQU8sQ0FBQyx1QkFBdUIsS0FBSyxRQUFRO1dBQ25ELHFDQUFxQyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsdUJBQXVCLENBQUM7V0FDM0UsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsc0JBQXNCLENBQUM7V0FDbkQsT0FBTyxDQUFDLHNCQUFpQyxJQUFJLENBQUM7V0FDL0MsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsNkJBQTZCLENBQUM7V0FDMUQsT0FBTyxDQUFDLDZCQUF3QyxJQUFJLENBQUMsQ0FBQztJQUM1RCxNQUFNLGVBQWUsR0FBRyxlQUFlO1FBQ3JDLENBQUMsQ0FBQyxVQUFVLENBQUMsaUNBQWlDLENBQUM7WUFDM0MsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFvQjtZQUN4QyxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQWtCO1lBQ3BDLHNCQUFzQixFQUFFLE9BQU8sQ0FBQyxzQkFBZ0M7WUFDaEUsdUJBQXVCLEVBQUUsT0FBTyxDQUFDLHVCQUFpQztZQUNsRSw2QkFBNkIsRUFBRSxPQUFPLENBQUMsNkJBQXVDO1NBQy9FLENBQUM7UUFDSixDQUFDLENBQUMsSUFBSSxVQUFVLEVBQUUsQ0FBQztJQUNyQixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSxVQUFVLENBQUMsb0NBQW9DLENBQ2xFLE9BQU8sQ0FBQyxVQUFVLEVBQ2xCLHlCQUF5QixFQUN6QixlQUFlLENBQ2hCLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQy9DLFVBQW1CLEVBQ1QsRUFBRTtJQUNaLElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1lBQUUsT0FBTyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7UUFDckYsTUFBTSxPQUFPLEdBQUcsVUFBcUMsQ0FBQztRQUN0RCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsV0FBVyxDQUMvQixNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxDQUFDLE1BQU0sS0FBSyxVQUFVLENBQUMsQ0FDcEUsQ0FBQztRQUNGLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxnQ0FBZ0MsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNuRSxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztlQUMzRixJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDO2VBQ2hGLE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVE7ZUFDckUsQ0FBRSxPQUFPLENBQUMsUUFBb0MsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUN4RCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7UUFDM0UsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMseURBQXlELENBQUMsQ0FBQztJQUNyRSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsVUFBbUIsRUFDVCxFQUFFO0lBQ1osSUFBSSxDQUFDO1FBQ0gsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQzFCLE9BQU8sQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQ3RFLENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRztZQUNuQixVQUFVO1lBQ1YsVUFBVTtZQUNWLGlCQUFpQjtZQUNqQixHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUN0RCxHQUFHLENBQUMsVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsQ0FBQztTQUNyRCxDQUFDO1FBQ0YsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUM1QyxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDMUMsTUFBTSxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO1FBQ2xGLENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7ZUFDN0IsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQztlQUNuRixPQUFPLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxLQUFLLFFBQVE7ZUFDM0MsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQzlCLE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztRQUNyRixDQUFDO1FBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLFVBQVUsRUFBRSxpQkFBaUIsQ0FBVSxFQUFFLENBQUM7WUFDN0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRO21CQUNwQyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLGtDQUFrQyxLQUFLLG9CQUFvQixDQUFDLENBQUM7WUFDM0UsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssU0FBUztlQUM5QixDQUFDLE9BQU8sVUFBVSxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMvRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELElBQUksVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTO2VBQzdCLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUM7bUJBQ3JDLFVBQVUsQ0FBQyxLQUFnQixHQUFHLENBQUM7bUJBQy9CLFVBQVUsQ0FBQyxLQUFnQjtzQkFDM0IsVUFBVSxDQUFDLHFDQUFxQyxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDMUUsTUFBTSxDQUFDLElBQUksQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1FBQ3RFLENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxDQUFDLG1FQUFtRSxDQUFDLENBQUM7SUFDL0UsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDJDQUEyQyxHQUFHLEtBQUssRUFDOUQsV0FBb0IsRUFDRCxFQUFFO0lBQ3JCLElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMzQixPQUFPLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUN2RSxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsV0FBc0MsQ0FBQztRQUN4RCxNQUFNLFlBQVksR0FBRztZQUNuQixlQUFlO1lBQ2YsUUFBUTtZQUNSLFNBQVM7WUFDVCx1QkFBdUI7WUFDdkIsVUFBVTtZQUNWLFVBQVU7WUFDVix3QkFBd0I7WUFDeEIsWUFBWTtZQUNaLHFCQUFxQjtZQUNyQixHQUFHLENBQUMsUUFBUSxDQUFDLFVBQVUsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUM1RCxHQUFHLENBQUMsUUFBUSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsQ0FBQztTQUMzRCxDQUFDO1FBQ0YsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO2dCQUMxQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsR0FBRyxZQUFZLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDL0MsTUFBTSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO1FBQ25GLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDakMsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1FBQ2pGLENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyw2QkFBNkIsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztRQUMxRSxDQUFDO1FBQ0QsSUFBSSxVQUFVLENBQUMsc0JBQXNCLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNsRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7UUFDekUsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7ZUFDeEIsUUFBUSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7ZUFDMUIsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUN0RCxNQUFNLENBQUMsSUFBSSxDQUFDLGtFQUFrRSxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQztlQUNuRCxRQUFRLENBQUMscUJBQWdDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7UUFDRCxNQUFNLGVBQWUsR0FBRyxJQUFJLEdBQUcsQ0FBNkI7WUFDMUQsZ0JBQWdCO1lBQ2hCLHFCQUFxQjtZQUNyQixlQUFlO1lBQ2YsZ0JBQWdCO1NBQ2pCLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7ZUFDaEMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FDNUQsVUFBd0MsQ0FDekMsQ0FBQztlQUNDLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNO2VBQzVELElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDekYsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1FBQ2pGLENBQUM7UUFDRCxJQUFJLE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxTQUFTO2VBQ3JDLFFBQVEsQ0FBQyxRQUFRLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2hHLE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLHNCQUFzQixDQUFDO2VBQ3BELFFBQVEsQ0FBQyxzQkFBaUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDckYsQ0FBQztRQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxVQUFVLENBQUMsd0NBQXdDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDekYsSUFBSSxPQUFPLFFBQVEsQ0FBQyxtQkFBbUIsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0RCxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxTQUFTO2VBQ2hDLENBQUMsT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ25GLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztRQUN4RixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsbUJBQW1CLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFLLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQywwRUFBMEUsQ0FBQyxDQUFDO1FBQzFGLENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztlQUNqQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxzQkFBc0IsQ0FBQztlQUNwRCxRQUFRLENBQUMsc0JBQWlDLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLGdGQUFnRixDQUFDLENBQUM7UUFDaEcsQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO2VBQy9CLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO2VBQzFCLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLHNCQUFzQixDQUFDLEVBQUUsQ0FBQztZQUMzRCxNQUFNLGdCQUFnQixHQUFpQyxFQUFFLENBQUM7WUFDMUQsSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLGNBQWMsS0FBSyxRQUFRO2dCQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1lBQzFGLElBQUssUUFBUSxDQUFDLHNCQUFpQyxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUNwRCxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMscUJBQXFCLENBQUMsQ0FBQztZQUMvQyxDQUFDO1lBQ0QsSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLGNBQWMsS0FBSyxlQUFlLEVBQUUsQ0FBQztnQkFDeEQsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1lBQ3pDLENBQUM7WUFDRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsY0FBYyxLQUFLLFFBQVE7Z0JBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDMUYsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDeEIsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztnQkFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxvRUFBb0UsQ0FBQyxDQUFDO1lBQ3BGLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLFVBQVUsQ0FBQyxtQ0FBbUMsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztZQUN6RixJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO21CQUMzQixRQUFRLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUM7bUJBQ25DLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO21CQUN6QixRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQzttQkFDMUIsQ0FDRCxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxRQUFRLENBQUMsT0FBTyxDQUFDLGdCQUFnQjt1QkFDeEQsUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRTt1QkFDekQsUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsZUFBZSxLQUFLLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUNyRSxFQUFFLENBQUM7Z0JBQ0osTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO1lBQ3JGLENBQUM7WUFDRCxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO2dCQUMvRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsY0FBYyxLQUFLLGVBQWU7dUJBQ2xELFFBQVEsQ0FBQyxTQUFTLENBQUMsS0FBSyxLQUFLLFdBQVcsRUFBRSxDQUFDO29CQUM5QyxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7Z0JBQy9FLENBQUM7Z0JBQ0QsSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLGNBQWMsS0FBSyxRQUFRO3VCQUMzQyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsS0FBSyxLQUFLLFdBQVc7MkJBQ3ZDLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxLQUFLLFFBQVEsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztvQkFDbEUsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO2dCQUNoRixDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO2VBQ3pCLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxjQUFjLEtBQUssZUFBZTttQkFDbEQsUUFBUSxDQUFDLE9BQU8sQ0FBQyxjQUFjLEtBQUssUUFBUSxDQUFDO2VBQy9DLFFBQVEsQ0FBQyxTQUFTLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDdEMsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDaEYsQ0FBQztBQUNILENBQUMsQ0FBQyJ9

package/dist_ts/runtime.d.ts

@@ -1,6 +1,8 @@
 import * as plugins from './plugins.js';
-import type { IActiveSecretRecipientMetadata, IClusterSecretDeploymentState, ICoreflowRuntimeCapabilities, IIdentityCredential, IResolvedSecretManifest, IResolvedSecretManifestReference, TSha256Digest, TImmutableContainerPlatform, TSecretRecipientMetadata } from './data/index.js';
+import type { IActiveSecretRecipientMetadata, IClusterRuntimeTargetSetReadyV1, IClusterRuntimeTargetV1, IClusterSecretDeploymentState, ICoreflowRuntimeCapabilities, IIdentityCredential, IResolvedSecretManifest, IResolvedSecretManifestReference, TSha256Digest, TSecretRecipientMetadata } from './data/index.js';
 import { validateSecretRecipientMetadata } from './data/secret.js';
+import type { IWorkloadInitActiveApprovalAuthorityV1, IWorkloadInitApprovalAuthorityReferenceV1 } from './runtime.workloadinit.js';
+export * from './runtime.workloadinit.js';
 export interface ISealedResolvedSecretMaterialEntry {
     secretVersionId: string;
     envelope: plugins.smartcrypto.IX25519EnvelopeV1;
@@ -91,6 +93,23 @@ export declare const validateBeginSecretRecipientEnrollmentRequest: (requestArg:
 export declare const validateSecretRecipientEnrollmentChallenge: (challengeArg: unknown) => Promise<string[]>;
 export declare const validateCompleteSecretRecipientEnrollmentRequest: (requestArg: unknown) => string[];
 export { validateSecretRecipientMetadata };
+/**
+ * Reproducible binding persisted inside a trusted Cloudly mutation receipt.
+ * This value alone does not prove that Cloudly admitted the envelope.
+ */
+export interface ISecretEnvelopeAdmissionBindingV1 {
+    schemaVersion: 1;
+    recipientKeyId: string;
+    recipientGeneration: number;
+    envelopeDigest: TSha256Digest;
+    requestContextDigest: TSha256Digest;
+}
+export declare const createSecretEnvelopeDigestInput: (envelopeArg: unknown) => string;
+export declare const computeSecretEnvelopeDigest: (envelopeArg: unknown) => Promise<TSha256Digest>;
+export declare const computeSecretRequestContextDigest: (contextArg: Uint8Array) => Promise<TSha256Digest>;
+export declare const validateSecretEnvelopeAdmissionBinding: (bindingArg: unknown) => string[];
+export declare const createSecretEnvelopeAdmissionBinding: (recipientArg: IActiveSecretRecipientMetadata, envelopeArg: unknown, requestContextArg: Uint8Array) => Promise<ISecretEnvelopeAdmissionBindingV1>;
+export declare const verifySecretEnvelopeAdmissionBinding: (bindingArg: unknown, envelopeArg: unknown, requestContextArg: Uint8Array) => Promise<boolean>;
 export type TSecretRecipientEnrollmentStateV1 = {
     schemaVersion: 1;
     generation: 0;
@@ -110,60 +129,64 @@ export interface IReq_GetSecretRecipientEnrollmentState extends plugins.typedreq
 }
 export declare const validateGetSecretRecipientEnrollmentStateRequest: (requestArg: unknown) => string[];
 export declare const validateSecretRecipientEnrollmentState: (stateArg: unknown) => string[];
-export interface ICoreflowSecretRuntimeNodeTargetV1 {
-    nodeId: string;
-    nodeName: string;
-    platform: TImmutableContainerPlatform;
-}
-export interface ICoreflowSecretRuntimeNodeEvidenceV1 extends ICoreflowSecretRuntimeNodeTargetV1 {
-    workloadInitPlatformManifestDigest: TSha256Digest;
-    workloadInitExecutableDigest: TSha256Digest;
+export interface ICoreflowSecretRuntimeNodeTargetV2 extends IClusterRuntimeTargetV1 {
 }
-export interface ICoreflowSecretRuntimeArtifactV1 {
-    platform: TImmutableContainerPlatform;
+export interface ICoreflowSecretRuntimeNodeEvidenceV2 extends ICoreflowSecretRuntimeNodeTargetV2 {
     workloadInitPlatformManifestDigest: TSha256Digest;
     workloadInitExecutableDigest: TSha256Digest;
 }
-export interface ICoreflowSecretRuntimeRegistrationExpectationV1 {
-    expectationVersion: 1;
+export interface ICoreflowSecretRuntimeRegistrationExpectationV2 {
+    expectationVersion: 2;
+    expectationDigest: TSha256Digest;
     reporterSessionId: string;
-    targets: ICoreflowSecretRuntimeNodeTargetV1[];
-    workloadInitImageIndexDigest: TSha256Digest;
-    workloadInitArtifacts: ICoreflowSecretRuntimeArtifactV1[];
+    targetAuthority: IClusterRuntimeTargetSetReadyV1;
+    workloadInitAuthority: IWorkloadInitActiveApprovalAuthorityV1;
     activeRecipient: IActiveSecretRecipientMetadata;
 }
-/** Dedicated TypedSocket tag carrying ICoreflowSecretRuntimeRegistrationV1. */
+/** Dedicated TypedSocket tag carrying ICoreflowSecretRuntimeRegistrationV2. */
 export declare const coreflowSecretRuntimeRegistrationTagId: "coreflowSecretRuntimeRegistration";
+export type TCoreflowSecretRuntimeRegistrationExpectationResponseV2 = {
+    status: 'available';
+    expectation: ICoreflowSecretRuntimeRegistrationExpectationV2;
+} | {
+    status: 'unavailable';
+    reason: 'recipient-unavailable' | 'workloadinit-unconfigured' | 'workloadinit-revoked' | 'targets-unavailable';
+};
 /** Cluster scope is derived exclusively from the verified cluster JWT. */
 export interface IReq_GetCoreflowSecretRuntimeRegistrationExpectation extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_GetCoreflowSecretRuntimeRegistrationExpectation> {
     method: 'getCoreflowSecretRuntimeRegistrationExpectation';
     request: {
         identity: IIdentityCredential;
     };
-    response: {
-        expectation: ICoreflowSecretRuntimeRegistrationExpectationV1;
-    };
+    response: TCoreflowSecretRuntimeRegistrationExpectationResponseV2;
 }
 export declare const validateGetCoreflowSecretRuntimeRegistrationExpectationRequest: (requestArg: unknown) => string[];
-export interface ICoreflowSecretRuntimeRegistrationV1 {
-    registrationVersion: 1;
+export interface ICoreflowSecretRuntimeRegistrationV2 {
+    registrationVersion: 2;
+    expectationDigest: TSha256Digest;
     reporterSessionId: string;
     registeredAt: number;
-    targets: ICoreflowSecretRuntimeNodeTargetV1[];
-    nodeSetDigest: TSha256Digest;
-    nodeEvidence: ICoreflowSecretRuntimeNodeEvidenceV1[];
+    targetGeneration: number;
+    targetSetDigest: TSha256Digest;
+    targets: ICoreflowSecretRuntimeNodeTargetV2[];
+    nodeEvidence: ICoreflowSecretRuntimeNodeEvidenceV2[];
     capabilities: ICoreflowRuntimeCapabilities;
     activeRecipient: IActiveSecretRecipientMetadata;
+    workloadInitAuthority: IWorkloadInitApprovalAuthorityReferenceV1;
     workloadInitImageIndexDigest: TSha256Digest;
-    workloadInitApprovedAt: number;
 }
-export declare const createCoreflowSecretRuntimeNodeSetDigestInput: (targetsArg: ICoreflowSecretRuntimeNodeTargetV1[]) => string;
-export declare const computeCoreflowSecretRuntimeNodeSetDigest: (targetsArg: ICoreflowSecretRuntimeNodeTargetV1[]) => Promise<TSha256Digest>;
+export declare const createCoreflowSecretRuntimeRegistrationExpectationDigestInput: (expectationArg: ICoreflowSecretRuntimeRegistrationExpectationV2) => string;
+export declare const computeCoreflowSecretRuntimeRegistrationExpectationDigest: (expectationArg: ICoreflowSecretRuntimeRegistrationExpectationV2) => Promise<TSha256Digest>;
+/**
+ * Validates only a Cloudly-created expectation. It does not establish the
+ * private DSSE trust decision or Spark manager consensus that produced it.
+ */
+export declare const validateCoreflowSecretRuntimeRegistrationExpectation: (expectationArg: unknown, trustedNowArg: number) => Promise<string[]>;
 /**
  * Consumers discard this registration on transport disconnect, tag
  * removal/replacement, reporter-session change, or any expectation change.
  */
-export declare const validateCoreflowSecretRuntimeRegistration: (registrationArg: unknown, expectationArg: unknown) => Promise<string[]>;
+export declare const validateCoreflowSecretRuntimeRegistration: (registrationArg: unknown, expectationArg: unknown, trustedNowArg: number) => Promise<string[]>;
 interface ISecretDeploymentReportBaseV1 {
     schemaVersion: 1;
     reporterSessionId: string;