@serve.zone/interfaces 23.2.0 → 24.0.0

package/dist_ts/runtime.workloadinit.d.ts

@@ -0,0 +1,129 @@
+import type { TSha256Digest, TImmutableContainerPlatform } from './data/index.js';
+export declare const workloadInitReleaseContract: Readonly<{
+    readonly packageName: "@serve.zone/workloadinit";
+    readonly sourceRepository: "https://code.foss.global/serve.zone/workloadinit.git";
+    readonly imageRegistry: "code.foss.global";
+    readonly imageRepository: "serve.zone/workloadinit";
+    readonly imageIndexMediaType: "application/vnd.oci.image.index.v1+json";
+    readonly statementType: "https://in-toto.io/Statement/v1";
+    readonly predicateType: "https://slsa.dev/provenance/v1";
+    readonly buildType: "https://serve.zone/buildtypes/workloadinit-gitzone-tsdocker/v1";
+    readonly builderId: "https://serve.zone/builders/workloadinit-manual-release/v1";
+    readonly signatureFormat: "cosign-dsse-bundle-v0.3";
+    readonly signatureAlgorithm: "ecdsa-p256-sha256";
+}>;
+export interface IWorkloadInitBuildToolVersionsV1 {
+    dockerBuildx: string;
+    gitzone: string;
+    tsdocker: string;
+    tsrust: string;
+}
+export interface IWorkloadInitReleaseIdentityV1 {
+    packageName: typeof workloadInitReleaseContract.packageName;
+    version: string;
+    sourceRepository: typeof workloadInitReleaseContract.sourceRepository;
+    sourceRevision: string;
+    sourceRef: string;
+    sourceDirty: false;
+    imageRegistry: typeof workloadInitReleaseContract.imageRegistry;
+    imageRepository: typeof workloadInitReleaseContract.imageRepository;
+    imageTag: string;
+}
+export interface IWorkloadInitReleaseAttestationStatementV1 {
+    _type: typeof workloadInitReleaseContract.statementType;
+    subject: [
+        {
+            name: string;
+            digest: {
+                sha256: string;
+            };
+        }
+    ];
+    predicateType: typeof workloadInitReleaseContract.predicateType;
+    predicate: {
+        buildDefinition: {
+            buildType: typeof workloadInitReleaseContract.buildType;
+            externalParameters: {
+                artifact: {
+                    mediaType: typeof workloadInitReleaseContract.imageIndexMediaType;
+                    platforms: ['linux/amd64', 'linux/arm64'];
+                    repository: string;
+                    tag: string;
+                };
+                source: {
+                    repository: typeof workloadInitReleaseContract.sourceRepository;
+                    tag: string;
+                    dirty: false;
+                };
+            };
+            resolvedDependencies: [
+                {
+                    uri: string;
+                    digest: {
+                        gitCommit: string;
+                    };
+                }
+            ];
+        };
+        runDetails: {
+            builder: {
+                id: typeof workloadInitReleaseContract.builderId;
+                version: IWorkloadInitBuildToolVersionsV1;
+            };
+        };
+    };
+}
+/**
+ * Cloudly-created summary of a private DSSE verification. Shape and digest
+ * validation do not independently prove the signature or its trust policy.
+ */
+export interface IWorkloadInitCloudlyVerificationSummaryV1 {
+    signatureFormat: typeof workloadInitReleaseContract.signatureFormat;
+    signatureAlgorithm: typeof workloadInitReleaseContract.signatureAlgorithm;
+    signerKeyId: TSha256Digest;
+    detachedBundleDigest: TSha256Digest;
+    statementDigest: TSha256Digest;
+    subjectImageIndexDigest: TSha256Digest;
+    builderId: typeof workloadInitReleaseContract.builderId;
+    policyGeneration: number;
+    policyDigest: TSha256Digest;
+    verifiedAt: number;
+}
+export interface IWorkloadInitApprovedArtifactV1 {
+    platform: TImmutableContainerPlatform;
+    workloadInitPlatformManifestDigest: TSha256Digest;
+    workloadInitExecutableDigest: TSha256Digest;
+}
+export interface IWorkloadInitReleaseApprovalV1 {
+    schemaVersion: 1;
+    release: IWorkloadInitReleaseIdentityV1;
+    imageIndexMediaType: typeof workloadInitReleaseContract.imageIndexMediaType;
+    workloadInitImageIndexDigest: TSha256Digest;
+    artifacts: [IWorkloadInitApprovedArtifactV1, IWorkloadInitApprovedArtifactV1];
+    verificationSummary: IWorkloadInitCloudlyVerificationSummaryV1;
+    approvedAt: number;
+    approvalDigest: TSha256Digest;
+}
+export interface IWorkloadInitApprovalAuthorityReferenceV1 {
+    authorityVersion: 1;
+    authorityGeneration: number;
+    approvalDigest: TSha256Digest;
+}
+export interface IWorkloadInitActiveApprovalAuthorityV1 extends IWorkloadInitApprovalAuthorityReferenceV1 {
+    approval: IWorkloadInitReleaseApprovalV1;
+}
+export declare const validateWorkloadInitReleaseIdentity: (releaseArg: unknown) => string[];
+export declare const createWorkloadInitReleaseAttestationStatement: (inputArg: {
+    release: IWorkloadInitReleaseIdentityV1;
+    workloadInitImageIndexDigest: TSha256Digest;
+    toolVersions: IWorkloadInitBuildToolVersionsV1;
+}) => IWorkloadInitReleaseAttestationStatementV1;
+export declare const createWorkloadInitReleaseAttestationPayload: (statementArg: IWorkloadInitReleaseAttestationStatementV1) => Uint8Array;
+export declare const computeWorkloadInitReleaseAttestationStatementDigest: (statementArg: IWorkloadInitReleaseAttestationStatementV1) => Promise<TSha256Digest>;
+export declare const validateWorkloadInitReleaseAttestationStatement: (statementArg: unknown) => string[];
+export declare const validateWorkloadInitCloudlyVerificationSummary: (summaryArg: unknown) => string[];
+export declare const createWorkloadInitReleaseApprovalDigestInput: (approvalArg: IWorkloadInitReleaseApprovalV1) => string;
+export declare const computeWorkloadInitReleaseApprovalDigest: (approvalArg: IWorkloadInitReleaseApprovalV1) => Promise<TSha256Digest>;
+export declare const validateWorkloadInitReleaseApproval: (approvalArg: unknown) => Promise<string[]>;
+export declare const validateWorkloadInitApprovalAuthorityReference: (referenceArg: unknown) => string[];
+export declare const validateWorkloadInitActiveApprovalAuthority: (authorityArg: unknown) => Promise<string[]>;

package/dist_ts/runtime.workloadinit.js

@@ -0,0 +1,405 @@
+import { isSha256Digest } from './data/immutableimage.js';
+export const workloadInitReleaseContract = Object.freeze({
+    packageName: '@serve.zone/workloadinit',
+    sourceRepository: 'https://code.foss.global/serve.zone/workloadinit.git',
+    imageRegistry: 'code.foss.global',
+    imageRepository: 'serve.zone/workloadinit',
+    imageIndexMediaType: 'application/vnd.oci.image.index.v1+json',
+    statementType: 'https://in-toto.io/Statement/v1',
+    predicateType: 'https://slsa.dev/provenance/v1',
+    buildType: 'https://serve.zone/buildtypes/workloadinit-gitzone-tsdocker/v1',
+    builderId: 'https://serve.zone/builders/workloadinit-manual-release/v1',
+    signatureFormat: 'cosign-dsse-bundle-v0.3',
+    signatureAlgorithm: 'ecdsa-p256-sha256',
+});
+const semanticVersionRegex = /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/;
+const gitRevisionRegex = /^[a-f0-9]{40}$/;
+const bareSha256Regex = /^[a-f0-9]{64}$/;
+const toolVersionRegex = /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/;
+const isRecord = (valueArg) => (Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg));
+const hasExactKeys = (valueArg, keysArg) => JSON.stringify(Object.keys(valueArg).sort()) === JSON.stringify([...keysArg].sort());
+const isPositiveSafeInteger = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg > 0);
+const computeSha256 = async (inputArg) => {
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new Uint8Array(inputArg)));
+    return `sha256:${[...digest]
+        .map((byteArg) => byteArg.toString(16).padStart(2, '0'))
+        .join('')}`;
+};
+export const validateWorkloadInitReleaseIdentity = (releaseArg) => {
+    if (!isRecord(releaseArg)
+        || !hasExactKeys(releaseArg, [
+            'packageName',
+            'version',
+            'sourceRepository',
+            'sourceRevision',
+            'sourceRef',
+            'sourceDirty',
+            'imageRegistry',
+            'imageRepository',
+            'imageTag',
+        ])) {
+        return ['WorkloadInit release identity must use its exact schema'];
+    }
+    const errors = [];
+    if (releaseArg.packageName !== workloadInitReleaseContract.packageName
+        || releaseArg.sourceRepository !== workloadInitReleaseContract.sourceRepository
+        || releaseArg.imageRegistry !== workloadInitReleaseContract.imageRegistry
+        || releaseArg.imageRepository !== workloadInitReleaseContract.imageRepository) {
+        errors.push('WorkloadInit release identity must use the canonical package and repositories');
+    }
+    if (typeof releaseArg.version !== 'string' || !semanticVersionRegex.test(releaseArg.version)) {
+        errors.push('WorkloadInit release version must be canonical stable semver');
+    }
+    else if (releaseArg.sourceRef !== `refs/tags/v${releaseArg.version}`
+        || releaseArg.imageTag !== `v${releaseArg.version}`) {
+        errors.push('WorkloadInit release source ref and image tag must match its version');
+    }
+    if (typeof releaseArg.sourceRevision !== 'string'
+        || !gitRevisionRegex.test(releaseArg.sourceRevision)
+        || releaseArg.sourceDirty !== false) {
+        errors.push('WorkloadInit release source must be an exact clean Git revision');
+    }
+    return errors;
+};
+const canonicalToolVersions = (versionsArg) => ({
+    dockerBuildx: versionsArg.dockerBuildx,
+    gitzone: versionsArg.gitzone,
+    tsdocker: versionsArg.tsdocker,
+    tsrust: versionsArg.tsrust,
+});
+export const createWorkloadInitReleaseAttestationStatement = (inputArg) => ({
+    _type: workloadInitReleaseContract.statementType,
+    subject: [{
+            name: `${inputArg.release.imageRegistry}/${inputArg.release.imageRepository}:${inputArg.release.imageTag}`,
+            digest: {
+                sha256: inputArg.workloadInitImageIndexDigest.slice('sha256:'.length),
+            },
+        }],
+    predicateType: workloadInitReleaseContract.predicateType,
+    predicate: {
+        buildDefinition: {
+            buildType: workloadInitReleaseContract.buildType,
+            externalParameters: {
+                artifact: {
+                    mediaType: workloadInitReleaseContract.imageIndexMediaType,
+                    platforms: ['linux/amd64', 'linux/arm64'],
+                    repository: `${inputArg.release.imageRegistry}/${inputArg.release.imageRepository}`,
+                    tag: inputArg.release.imageTag,
+                },
+                source: {
+                    repository: inputArg.release.sourceRepository,
+                    tag: inputArg.release.sourceRef,
+                    dirty: inputArg.release.sourceDirty,
+                },
+            },
+            resolvedDependencies: [{
+                    uri: `git+${inputArg.release.sourceRepository}@${inputArg.release.sourceRef}`,
+                    digest: {
+                        gitCommit: inputArg.release.sourceRevision,
+                    },
+                }],
+        },
+        runDetails: {
+            builder: {
+                id: workloadInitReleaseContract.builderId,
+                version: canonicalToolVersions(inputArg.toolVersions),
+            },
+        },
+    },
+});
+export const createWorkloadInitReleaseAttestationPayload = (statementArg) => new TextEncoder().encode(JSON.stringify(statementArg));
+export const computeWorkloadInitReleaseAttestationStatementDigest = async (statementArg) => computeSha256(createWorkloadInitReleaseAttestationPayload(statementArg));
+export const validateWorkloadInitReleaseAttestationStatement = (statementArg) => {
+    try {
+        if (!isRecord(statementArg)
+            || !hasExactKeys(statementArg, ['_type', 'subject', 'predicateType', 'predicate'])) {
+            return ['WorkloadInit release attestation statement must use its exact schema'];
+        }
+        const errors = [];
+        if (statementArg._type !== workloadInitReleaseContract.statementType
+            || statementArg.predicateType !== workloadInitReleaseContract.predicateType) {
+            errors.push('WorkloadInit release attestation types must be canonical');
+        }
+        if (!Array.isArray(statementArg.subject)
+            || statementArg.subject.length !== 1
+            || !isRecord(statementArg.subject[0])
+            || !hasExactKeys(statementArg.subject[0], ['name', 'digest'])
+            || !isRecord(statementArg.subject[0].digest)
+            || !hasExactKeys(statementArg.subject[0].digest, ['sha256'])
+            || typeof statementArg.subject[0].digest.sha256 !== 'string'
+            || !bareSha256Regex.test(statementArg.subject[0].digest.sha256)) {
+            errors.push('WorkloadInit release attestation must have one canonical root-index subject');
+        }
+        if (!isRecord(statementArg.predicate)
+            || !hasExactKeys(statementArg.predicate, ['buildDefinition', 'runDetails'])) {
+            return [...errors, 'WorkloadInit release attestation predicate must use its exact schema'];
+        }
+        const buildDefinition = statementArg.predicate.buildDefinition;
+        const runDetails = statementArg.predicate.runDetails;
+        if (!isRecord(buildDefinition)
+            || !hasExactKeys(buildDefinition, [
+                'buildType',
+                'externalParameters',
+                'resolvedDependencies',
+            ])
+            || buildDefinition.buildType !== workloadInitReleaseContract.buildType
+            || !isRecord(buildDefinition.externalParameters)
+            || !hasExactKeys(buildDefinition.externalParameters, ['artifact', 'source'])
+            || !Array.isArray(buildDefinition.resolvedDependencies)
+            || buildDefinition.resolvedDependencies.length !== 1
+            || !isRecord(runDetails)
+            || !hasExactKeys(runDetails, ['builder'])
+            || !isRecord(runDetails.builder)
+            || !hasExactKeys(runDetails.builder, ['id', 'version'])
+            || runDetails.builder.id !== workloadInitReleaseContract.builderId) {
+            return [...errors, 'WorkloadInit release attestation build definition must be canonical'];
+        }
+        const artifact = buildDefinition.externalParameters.artifact;
+        const source = buildDefinition.externalParameters.source;
+        const dependency = buildDefinition.resolvedDependencies[0];
+        const toolVersions = runDetails.builder.version;
+        if (!isRecord(artifact)
+            || !hasExactKeys(artifact, ['mediaType', 'platforms', 'repository', 'tag'])
+            || artifact.mediaType !== workloadInitReleaseContract.imageIndexMediaType
+            || JSON.stringify(artifact.platforms) !== JSON.stringify(['linux/amd64', 'linux/arm64'])
+            || artifact.repository !== `${workloadInitReleaseContract.imageRegistry}/${workloadInitReleaseContract.imageRepository}`
+            || typeof artifact.tag !== 'string'
+            || !/^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.test(artifact.tag)) {
+            errors.push('WorkloadInit release attestation artifact must be canonical and version-tagged');
+        }
+        if (!isRecord(source)
+            || !hasExactKeys(source, ['repository', 'tag', 'dirty'])
+            || source.repository !== workloadInitReleaseContract.sourceRepository
+            || source.dirty !== false
+            || typeof source.tag !== 'string'
+            || source.tag !== `refs/tags/${artifact && isRecord(artifact) ? artifact.tag : ''}`) {
+            errors.push('WorkloadInit release attestation source must match its clean version tag');
+        }
+        if (!isRecord(dependency)
+            || !hasExactKeys(dependency, ['uri', 'digest'])
+            || !isRecord(dependency.digest)
+            || !hasExactKeys(dependency.digest, ['gitCommit'])
+            || typeof dependency.digest.gitCommit !== 'string'
+            || !gitRevisionRegex.test(dependency.digest.gitCommit)
+            || dependency.uri !== `git+${workloadInitReleaseContract.sourceRepository}@${source && isRecord(source)
+                ? source.tag
+                : ''}`) {
+            errors.push('WorkloadInit release attestation source dependency must be canonical');
+        }
+        if (!isRecord(toolVersions)
+            || !hasExactKeys(toolVersions, ['dockerBuildx', 'gitzone', 'tsdocker', 'tsrust'])
+            || Object.values(toolVersions).some((valueArg) => (typeof valueArg !== 'string' || !toolVersionRegex.test(valueArg)))) {
+            errors.push('WorkloadInit release attestation tool versions must be canonical');
+        }
+        if (Array.isArray(statementArg.subject)
+            && isRecord(statementArg.subject[0])
+            && isRecord(artifact)
+            && statementArg.subject[0].name
+                !== `${artifact.repository}:${artifact.tag}`) {
+            errors.push('WorkloadInit release attestation subject name must match the versioned image');
+        }
+        return errors;
+    }
+    catch {
+        return ['WorkloadInit release attestation statement must be safely inspectable'];
+    }
+};
+export const validateWorkloadInitCloudlyVerificationSummary = (summaryArg) => {
+    if (!isRecord(summaryArg)
+        || !hasExactKeys(summaryArg, [
+            'signatureFormat',
+            'signatureAlgorithm',
+            'signerKeyId',
+            'detachedBundleDigest',
+            'statementDigest',
+            'subjectImageIndexDigest',
+            'builderId',
+            'policyGeneration',
+            'policyDigest',
+            'verifiedAt',
+        ])) {
+        return ['WorkloadInit Cloudly verification summary must use its exact schema'];
+    }
+    const errors = [];
+    if (summaryArg.signatureFormat !== workloadInitReleaseContract.signatureFormat
+        || summaryArg.signatureAlgorithm !== workloadInitReleaseContract.signatureAlgorithm
+        || summaryArg.builderId !== workloadInitReleaseContract.builderId) {
+        errors.push('WorkloadInit Cloudly verification summary policy identifiers must be canonical');
+    }
+    for (const field of [
+        'signerKeyId',
+        'detachedBundleDigest',
+        'statementDigest',
+        'subjectImageIndexDigest',
+        'policyDigest',
+    ]) {
+        if (typeof summaryArg[field] !== 'string' || !isSha256Digest(summaryArg[field])) {
+            errors.push(`WorkloadInit Cloudly verification summary ${field} must be canonical`);
+        }
+    }
+    if (!isPositiveSafeInteger(summaryArg.policyGeneration)
+        || !isPositiveSafeInteger(summaryArg.verifiedAt)) {
+        errors.push('WorkloadInit Cloudly verification summary generation and time must be positive');
+    }
+    return errors;
+};
+const canonicalReleaseIdentity = (releaseArg) => ({
+    packageName: releaseArg.packageName,
+    version: releaseArg.version,
+    sourceRepository: releaseArg.sourceRepository,
+    sourceRevision: releaseArg.sourceRevision,
+    sourceRef: releaseArg.sourceRef,
+    sourceDirty: releaseArg.sourceDirty,
+    imageRegistry: releaseArg.imageRegistry,
+    imageRepository: releaseArg.imageRepository,
+    imageTag: releaseArg.imageTag,
+});
+const canonicalApprovedArtifact = (artifactArg) => ({
+    platform: artifactArg.platform,
+    workloadInitPlatformManifestDigest: artifactArg.workloadInitPlatformManifestDigest,
+    workloadInitExecutableDigest: artifactArg.workloadInitExecutableDigest,
+});
+const canonicalVerificationSummary = (summaryArg) => ({
+    signatureFormat: summaryArg.signatureFormat,
+    signatureAlgorithm: summaryArg.signatureAlgorithm,
+    signerKeyId: summaryArg.signerKeyId,
+    detachedBundleDigest: summaryArg.detachedBundleDigest,
+    statementDigest: summaryArg.statementDigest,
+    subjectImageIndexDigest: summaryArg.subjectImageIndexDigest,
+    builderId: summaryArg.builderId,
+    policyGeneration: summaryArg.policyGeneration,
+    policyDigest: summaryArg.policyDigest,
+    verifiedAt: summaryArg.verifiedAt,
+});
+export const createWorkloadInitReleaseApprovalDigestInput = (approvalArg) => JSON.stringify({
+    schemaVersion: approvalArg.schemaVersion,
+    purpose: 'serve.zone/workloadinit-release-approval',
+    release: canonicalReleaseIdentity(approvalArg.release),
+    imageIndexMediaType: approvalArg.imageIndexMediaType,
+    workloadInitImageIndexDigest: approvalArg.workloadInitImageIndexDigest,
+    artifacts: approvalArg.artifacts.map(canonicalApprovedArtifact),
+    verificationSummary: canonicalVerificationSummary(approvalArg.verificationSummary),
+    approvedAt: approvalArg.approvedAt,
+});
+export const computeWorkloadInitReleaseApprovalDigest = async (approvalArg) => computeSha256(new TextEncoder().encode(createWorkloadInitReleaseApprovalDigestInput(approvalArg)));
+export const validateWorkloadInitReleaseApproval = async (approvalArg) => {
+    try {
+        if (!isRecord(approvalArg)
+            || !hasExactKeys(approvalArg, [
+                'schemaVersion',
+                'release',
+                'imageIndexMediaType',
+                'workloadInitImageIndexDigest',
+                'artifacts',
+                'verificationSummary',
+                'approvedAt',
+                'approvalDigest',
+            ])) {
+            return ['WorkloadInit release approval must use its exact schema'];
+        }
+        const errors = [
+            ...validateWorkloadInitReleaseIdentity(approvalArg.release),
+            ...validateWorkloadInitCloudlyVerificationSummary(approvalArg.verificationSummary),
+        ];
+        if (approvalArg.schemaVersion !== 1
+            || approvalArg.imageIndexMediaType !== workloadInitReleaseContract.imageIndexMediaType
+            || typeof approvalArg.workloadInitImageIndexDigest !== 'string'
+            || !isSha256Digest(approvalArg.workloadInitImageIndexDigest)
+            || !isPositiveSafeInteger(approvalArg.approvedAt)
+            || typeof approvalArg.approvalDigest !== 'string'
+            || !isSha256Digest(approvalArg.approvalDigest)) {
+            errors.push('WorkloadInit release approval authority fields must be canonical');
+        }
+        if (!Array.isArray(approvalArg.artifacts)
+            || approvalArg.artifacts.length !== 2
+            || approvalArg.artifacts.map((artifactArg) => (isRecord(artifactArg) ? artifactArg.platform : undefined)).join(',') !== 'linux/amd64,linux/arm64') {
+            errors.push('WorkloadInit release approval must contain amd64 then arm64 artifacts');
+        }
+        else {
+            const manifestDigests = new Set();
+            for (const [index, artifactArg] of approvalArg.artifacts.entries()) {
+                if (!isRecord(artifactArg)
+                    || !hasExactKeys(artifactArg, [
+                        'platform',
+                        'workloadInitPlatformManifestDigest',
+                        'workloadInitExecutableDigest',
+                    ])
+                    || typeof artifactArg.workloadInitPlatformManifestDigest !== 'string'
+                    || !isSha256Digest(artifactArg.workloadInitPlatformManifestDigest)
+                    || typeof artifactArg.workloadInitExecutableDigest !== 'string'
+                    || !isSha256Digest(artifactArg.workloadInitExecutableDigest)) {
+                    errors.push(`WorkloadInit release approval artifacts[${index}] must be canonical`);
+                }
+                else {
+                    manifestDigests.add(artifactArg.workloadInitPlatformManifestDigest);
+                }
+            }
+            if (manifestDigests.size !== approvalArg.artifacts.length) {
+                errors.push('WorkloadInit release approval platform manifest digests must be unique');
+            }
+        }
+        if (isRecord(approvalArg.verificationSummary)) {
+            if (approvalArg.verificationSummary.subjectImageIndexDigest
+                !== approvalArg.workloadInitImageIndexDigest) {
+                errors.push('WorkloadInit release approval subject must match its image index');
+            }
+            if (isPositiveSafeInteger(approvalArg.verificationSummary.verifiedAt)
+                && isPositiveSafeInteger(approvalArg.approvedAt)
+                && approvalArg.verificationSummary.verifiedAt > approvalArg.approvedAt) {
+                errors.push('WorkloadInit release approval cannot predate verification');
+            }
+        }
+        if (errors.length === 0
+            && approvalArg.approvalDigest !== await computeWorkloadInitReleaseApprovalDigest(approvalArg)) {
+            errors.push('WorkloadInit release approval digest does not match');
+        }
+        return errors;
+    }
+    catch {
+        return ['WorkloadInit release approval must be safely inspectable'];
+    }
+};
+export const validateWorkloadInitApprovalAuthorityReference = (referenceArg) => {
+    if (!isRecord(referenceArg)
+        || !hasExactKeys(referenceArg, [
+            'authorityVersion',
+            'authorityGeneration',
+            'approvalDigest',
+        ])) {
+        return ['WorkloadInit approval authority reference must use its exact schema'];
+    }
+    const errors = [];
+    if (referenceArg.authorityVersion !== 1
+        || !isPositiveSafeInteger(referenceArg.authorityGeneration)
+        || typeof referenceArg.approvalDigest !== 'string'
+        || !isSha256Digest(referenceArg.approvalDigest)) {
+        errors.push('WorkloadInit approval authority reference fields must be canonical');
+    }
+    return errors;
+};
+export const validateWorkloadInitActiveApprovalAuthority = async (authorityArg) => {
+    if (!isRecord(authorityArg)
+        || !hasExactKeys(authorityArg, [
+            'authorityVersion',
+            'authorityGeneration',
+            'approvalDigest',
+            'approval',
+        ])) {
+        return ['active WorkloadInit approval authority must use its exact schema'];
+    }
+    const reference = {
+        authorityVersion: authorityArg.authorityVersion,
+        authorityGeneration: authorityArg.authorityGeneration,
+        approvalDigest: authorityArg.approvalDigest,
+    };
+    const errors = [
+        ...validateWorkloadInitApprovalAuthorityReference(reference),
+        ...await validateWorkloadInitReleaseApproval(authorityArg.approval),
+    ];
+    if (isRecord(authorityArg.approval)
+        && authorityArg.approvalDigest !== authorityArg.approval.approvalDigest) {
+        errors.push('active WorkloadInit authority must reference its embedded approval');
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS53b3JrbG9hZGluaXQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9ydW50aW1lLndvcmtsb2FkaW5pdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFFMUQsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RCxXQUFXLEVBQUUsMEJBQTBCO0lBQ3ZDLGdCQUFnQixFQUFFLHNEQUFzRDtJQUN4RSxhQUFhLEVBQUUsa0JBQWtCO0lBQ2pDLGVBQWUsRUFBRSx5QkFBeUI7SUFDMUMsbUJBQW1CLEVBQUUseUNBQXlDO0lBQzlELGFBQWEsRUFBRSxpQ0FBaUM7SUFDaEQsYUFBYSxFQUFFLGdDQUFnQztJQUMvQyxTQUFTLEVBQUUsZ0VBQWdFO0lBQzNFLFNBQVMsRUFBRSw0REFBNEQ7SUFDdkUsZUFBZSxFQUFFLHlCQUF5QjtJQUMxQyxrQkFBa0IsRUFBRSxtQkFBbUI7Q0FDL0IsQ0FBQyxDQUFDO0FBMkdaLE1BQU0sb0JBQW9CLEdBQUcscURBQXFELENBQUM7QUFDbkYsTUFBTSxnQkFBZ0IsR0FBRyxnQkFBZ0IsQ0FBQztBQUMxQyxNQUFNLGVBQWUsR0FBRyxnQkFBZ0IsQ0FBQztBQUN6QyxNQUFNLGdCQUFnQixHQUFHLG9DQUFvQyxDQUFDO0FBRTlELE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUFDLENBQzNFLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUM5RSxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FDbkIsUUFBaUMsRUFDakMsT0FBaUIsRUFDUixFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztBQUVuRyxNQUFNLHFCQUFxQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3ZFLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUssUUFBbUIsR0FBRyxDQUFDLENBQzNELENBQUM7QUFFRixNQUFNLGFBQWEsR0FBRyxLQUFLLEVBQUUsUUFBb0IsRUFBMEIsRUFBRTtJQUMzRSxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FDakUsU0FBUyxFQUNULElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUN6QixDQUFDLENBQUM7SUFDSCxPQUFPLFVBQVUsQ0FBQyxHQUFHLE1BQU0sQ0FBQztTQUN6QixHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztTQUN2RCxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQW1CLENBQUM7QUFDakMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsQ0FDakQsVUFBbUIsRUFDVCxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFO1lBQzNCLGFBQWE7WUFDYixTQUFTO1lBQ1Qsa0JBQWtCO1lBQ2xCLGdCQUFnQjtZQUNoQixXQUFXO1lBQ1gsYUFBYTtZQUNiLGVBQWU7WUFDZixpQkFBaUI7WUFDakIsVUFBVTtTQUNYLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLHlEQUF5RCxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFVBQVUsQ0FBQyxXQUFXLEtBQUssMkJBQTJCLENBQUMsV0FBVztXQUNqRSxVQUFVLENBQUMsZ0JBQWdCLEtBQUssMkJBQTJCLENBQUMsZ0JBQWdCO1dBQzVFLFVBQVUsQ0FBQyxhQUFhLEtBQUssMkJBQTJCLENBQUMsYUFBYTtXQUN0RSxVQUFVLENBQUMsZUFBZSxLQUFLLDJCQUEyQixDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzdGLE1BQU0sQ0FBQyxJQUFJLENBQUMsOERBQThELENBQUMsQ0FBQztJQUM5RSxDQUFDO1NBQU0sSUFBSSxVQUFVLENBQUMsU0FBUyxLQUFLLGNBQWMsVUFBVSxDQUFDLE9BQU8sRUFBRTtXQUNqRSxVQUFVLENBQUMsUUFBUSxLQUFLLElBQUksVUFBVSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQyxzRUFBc0UsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLGNBQWMsS0FBSyxRQUFRO1dBQzVDLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUM7V0FDakQsVUFBVSxDQUFDLFdBQVcsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUN0QyxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0scUJBQXFCLEdBQUcsQ0FDNUIsV0FBNkMsRUFDWCxFQUFFLENBQUMsQ0FBQztJQUN0QyxZQUFZLEVBQUUsV0FBVyxDQUFDLFlBQVk7SUFDdEMsT0FBTyxFQUFFLFdBQVcsQ0FBQyxPQUFPO0lBQzVCLFFBQVEsRUFBRSxXQUFXLENBQUMsUUFBUTtJQUM5QixNQUFNLEVBQUUsV0FBVyxDQUFDLE1BQU07Q0FDM0IsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FBQyxRQUk3RCxFQUE4QyxFQUFFLENBQUMsQ0FBQztJQUNqRCxLQUFLLEVBQUUsMkJBQTJCLENBQUMsYUFBYTtJQUNoRCxPQUFPLEVBQUUsQ0FBQztZQUNSLElBQUksRUFBRSxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsYUFBYSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsZUFBZSxJQUN6RSxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQ25CLEVBQUU7WUFDRixNQUFNLEVBQUU7Z0JBQ04sTUFBTSxFQUFFLFFBQVEsQ0FBQyw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQzthQUN0RTtTQUNGLENBQUM7SUFDRixhQUFhLEVBQUUsMkJBQTJCLENBQUMsYUFBYTtJQUN4RCxTQUFTLEVBQUU7UUFDVCxlQUFlLEVBQUU7WUFDZixTQUFTLEVBQUUsMkJBQTJCLENBQUMsU0FBUztZQUNoRCxrQkFBa0IsRUFBRTtnQkFDbEIsUUFBUSxFQUFFO29CQUNSLFNBQVMsRUFBRSwyQkFBMkIsQ0FBQyxtQkFBbUI7b0JBQzFELFNBQVMsRUFBRSxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUM7b0JBQ3pDLFVBQVUsRUFBRSxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsYUFBYSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsZUFBZSxFQUFFO29CQUNuRixHQUFHLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRO2lCQUMvQjtnQkFDRCxNQUFNLEVBQUU7b0JBQ04sVUFBVSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCO29CQUM3QyxHQUFHLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxTQUFTO29CQUMvQixLQUFLLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxXQUFXO2lCQUNwQzthQUNGO1lBQ0Qsb0JBQW9CLEVBQUUsQ0FBQztvQkFDckIsR0FBRyxFQUFFLE9BQU8sUUFBUSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRTtvQkFDN0UsTUFBTSxFQUFFO3dCQUNOLFNBQVMsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLGNBQWM7cUJBQzNDO2lCQUNGLENBQUM7U0FDSDtRQUNELFVBQVUsRUFBRTtZQUNWLE9BQU8sRUFBRTtnQkFDUCxFQUFFLEVBQUUsMkJBQTJCLENBQUMsU0FBUztnQkFDekMsT0FBTyxFQUFFLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7YUFDdEQ7U0FDRjtLQUNGO0NBQ0YsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FDekQsWUFBd0QsRUFDNUMsRUFBRSxDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztBQUV4RSxNQUFNLENBQUMsTUFBTSxvREFBb0QsR0FBRyxLQUFLLEVBQ3ZFLFlBQXdELEVBQ2hDLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLDJDQUEyQyxDQUFDLFlBQVksQ0FBQyxDQUMxRCxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsQ0FDN0QsWUFBcUIsRUFDWCxFQUFFO0lBQ1osSUFBSSxDQUFDO1FBQ0gsSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7ZUFDdEIsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUUsV0FBVyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3JGLE9BQU8sQ0FBQyxzRUFBc0UsQ0FBQyxDQUFDO1FBQ2xGLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7UUFDNUIsSUFBSSxZQUFZLENBQUMsS0FBSyxLQUFLLDJCQUEyQixDQUFDLGFBQWE7ZUFDL0QsWUFBWSxDQUFDLGFBQWEsS0FBSywyQkFBMkIsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDMUUsQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUM7ZUFDbkMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztlQUNqQyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO2VBQ2xDLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7ZUFDMUQsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUM7ZUFDekMsQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQztlQUN6RCxPQUFPLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxRQUFRO2VBQ3pELENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkVBQTZFLENBQUMsQ0FBQztRQUM3RixDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDO2VBQ2hDLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSxZQUFZLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDOUUsT0FBTyxDQUFDLEdBQUcsTUFBTSxFQUFFLHNFQUFzRSxDQUFDLENBQUM7UUFDN0YsQ0FBQztRQUNELE1BQU0sZUFBZSxHQUFHLFlBQVksQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDO1FBQy9ELE1BQU0sVUFBVSxHQUFHLFlBQVksQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDO1FBQ3JELElBQUksQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDO2VBQ3pCLENBQUMsWUFBWSxDQUFDLGVBQWUsRUFBRTtnQkFDaEMsV0FBVztnQkFDWCxvQkFBb0I7Z0JBQ3BCLHNCQUFzQjthQUN2QixDQUFDO2VBQ0MsZUFBZSxDQUFDLFNBQVMsS0FBSywyQkFBMkIsQ0FBQyxTQUFTO2VBQ25FLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxrQkFBa0IsQ0FBQztlQUM3QyxDQUFDLFlBQVksQ0FBQyxlQUFlLENBQUMsa0JBQWtCLEVBQUUsQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUM7ZUFDekUsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxvQkFBb0IsQ0FBQztlQUNwRCxlQUFlLENBQUMsb0JBQW9CLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDakQsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO2VBQ3JCLENBQUMsWUFBWSxDQUFDLFVBQVUsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO2VBQ3RDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUM7ZUFDN0IsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxDQUFDLElBQUksRUFBRSxTQUFTLENBQUMsQ0FBQztlQUNwRCxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSywyQkFBMkIsQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNyRSxPQUFPLENBQUMsR0FBRyxNQUFNLEVBQUUscUVBQXFFLENBQUMsQ0FBQztRQUM1RixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsZUFBZSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQztRQUM3RCxNQUFNLE1BQU0sR0FBRyxlQUFlLENBQUMsa0JBQWtCLENBQUMsTUFBTSxDQUFDO1FBQ3pELE1BQU0sVUFBVSxHQUFHLGVBQWUsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMzRCxNQUFNLFlBQVksR0FBRyxVQUFVLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQztRQUNoRCxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztlQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxXQUFXLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxLQUFLLENBQUMsQ0FBQztlQUN4RSxRQUFRLENBQUMsU0FBUyxLQUFLLDJCQUEyQixDQUFDLG1CQUFtQjtlQUN0RSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsYUFBYSxFQUFFLGFBQWEsQ0FBQyxDQUFDO2VBQ3JGLFFBQVEsQ0FBQyxVQUFVLEtBQUssR0FBRywyQkFBMkIsQ0FBQyxhQUFhLElBQ3JFLDJCQUEyQixDQUFDLGVBQzlCLEVBQUU7ZUFDQyxPQUFPLFFBQVEsQ0FBQyxHQUFHLEtBQUssUUFBUTtlQUNoQyxDQUFDLHNEQUFzRCxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNoRixNQUFNLENBQUMsSUFBSSxDQUFDLGdGQUFnRixDQUFDLENBQUM7UUFDaEcsQ0FBQztRQUNELElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO2VBQ2hCLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxDQUFDLFlBQVksRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUM7ZUFDckQsTUFBTSxDQUFDLFVBQVUsS0FBSywyQkFBMkIsQ0FBQyxnQkFBZ0I7ZUFDbEUsTUFBTSxDQUFDLEtBQUssS0FBSyxLQUFLO2VBQ3RCLE9BQU8sTUFBTSxDQUFDLEdBQUcsS0FBSyxRQUFRO2VBQzlCLE1BQU0sQ0FBQyxHQUFHLEtBQUssYUFBYSxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDO1lBQ3RGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztRQUMxRixDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7ZUFDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDO2VBQzVDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7ZUFDNUIsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxDQUFDLFdBQVcsQ0FBQyxDQUFDO2VBQy9DLE9BQU8sVUFBVSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEtBQUssUUFBUTtlQUMvQyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQztlQUNuRCxVQUFVLENBQUMsR0FBRyxLQUFLLE9BQU8sMkJBQTJCLENBQUMsZ0JBQWdCLElBQUksTUFBTSxJQUFJLFFBQVEsQ0FBQyxNQUFNLENBQUM7Z0JBQ3JHLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRztnQkFDWixDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQztZQUNYLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7ZUFDdEIsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFLENBQUMsY0FBYyxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLENBQUM7ZUFDOUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ2hELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FDakUsQ0FBQyxFQUFFLENBQUM7WUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLGtFQUFrRSxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDO2VBQ2xDLFFBQVEsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO2VBQ2pDLFFBQVEsQ0FBQyxRQUFRLENBQUM7ZUFDbEIsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJO29CQUN6QixHQUFHLFFBQVEsQ0FBQyxVQUFvQixJQUFJLFFBQVEsQ0FBQyxHQUFhLEVBQUUsRUFBRSxDQUFDO1lBQ3JFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOEVBQThFLENBQUMsQ0FBQztRQUM5RixDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUM1RCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNwQixDQUFDLFlBQVksQ0FBQyxVQUFVLEVBQUU7WUFDM0IsaUJBQWlCO1lBQ2pCLG9CQUFvQjtZQUNwQixhQUFhO1lBQ2Isc0JBQXNCO1lBQ3RCLGlCQUFpQjtZQUNqQix5QkFBeUI7WUFDekIsV0FBVztZQUNYLGtCQUFrQjtZQUNsQixjQUFjO1lBQ2QsWUFBWTtTQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFVBQVUsQ0FBQyxlQUFlLEtBQUssMkJBQTJCLENBQUMsZUFBZTtXQUN6RSxVQUFVLENBQUMsa0JBQWtCLEtBQUssMkJBQTJCLENBQUMsa0JBQWtCO1dBQ2hGLFVBQVUsQ0FBQyxTQUFTLEtBQUssMkJBQTJCLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyxnRkFBZ0YsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJO1FBQ2xCLGFBQWE7UUFDYixzQkFBc0I7UUFDdEIsaUJBQWlCO1FBQ2pCLHlCQUF5QjtRQUN6QixjQUFjO0tBQ04sRUFBRSxDQUFDO1FBQ1gsSUFBSSxPQUFPLFVBQVUsQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNoRixNQUFNLENBQUMsSUFBSSxDQUFDLDZDQUE2QyxLQUFLLG9CQUFvQixDQUFDLENBQUM7UUFDdEYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDO1dBQ2xELENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDbkQsTUFBTSxDQUFDLElBQUksQ0FBQyxnRkFBZ0YsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLHdCQUF3QixHQUFHLENBQy9CLFVBQTBDLEVBQ1YsRUFBRSxDQUFDLENBQUM7SUFDcEMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxXQUFXO0lBQ25DLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztJQUMzQixnQkFBZ0IsRUFBRSxVQUFVLENBQUMsZ0JBQWdCO0lBQzdDLGNBQWMsRUFBRSxVQUFVLENBQUMsY0FBYztJQUN6QyxTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsV0FBVyxFQUFFLFVBQVUsQ0FBQyxXQUFXO0lBQ25DLGFBQWEsRUFBRSxVQUFVLENBQUMsYUFBYTtJQUN2QyxlQUFlLEVBQUUsVUFBVSxDQUFDLGVBQWU7SUFDM0MsUUFBUSxFQUFFLFVBQVUsQ0FBQyxRQUFRO0NBQzlCLENBQUMsQ0FBQztBQUVILE1BQU0seUJBQXlCLEdBQUcsQ0FDaEMsV0FBNEMsRUFDWCxFQUFFLENBQUMsQ0FBQztJQUNyQyxRQUFRLEVBQUUsV0FBVyxDQUFDLFFBQVE7SUFDOUIsa0NBQWtDLEVBQUUsV0FBVyxDQUFDLGtDQUFrQztJQUNsRiw0QkFBNEIsRUFBRSxXQUFXLENBQUMsNEJBQTRCO0NBQ3ZFLENBQUMsQ0FBQztBQUVILE1BQU0sNEJBQTRCLEdBQUcsQ0FDbkMsVUFBcUQsRUFDVixFQUFFLENBQUMsQ0FBQztJQUMvQyxlQUFlLEVBQUUsVUFBVSxDQUFDLGVBQWU7SUFDM0Msa0JBQWtCLEVBQUUsVUFBVSxDQUFDLGtCQUFrQjtJQUNqRCxXQUFXLEVBQUUsVUFBVSxDQUFDLFdBQVc7SUFDbkMsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtJQUNyRCxlQUFlLEVBQUUsVUFBVSxDQUFDLGVBQWU7SUFDM0MsdUJBQXVCLEVBQUUsVUFBVSxDQUFDLHVCQUF1QjtJQUMzRCxTQUFTLEVBQUUsVUFBVSxDQUFDLFNBQVM7SUFDL0IsZ0JBQWdCLEVBQUUsVUFBVSxDQUFDLGdCQUFnQjtJQUM3QyxZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7SUFDckMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVO0NBQ2xDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLENBQzFELFdBQTJDLEVBQ25DLEVBQUUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO0lBQzFCLGFBQWEsRUFBRSxXQUFXLENBQUMsYUFBYTtJQUN4QyxPQUFPLEVBQUUsMENBQTBDO0lBQ25ELE9BQU8sRUFBRSx3QkFBd0IsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDO0lBQ3RELG1CQUFtQixFQUFFLFdBQVcsQ0FBQyxtQkFBbUI7SUFDcEQsNEJBQTRCLEVBQUUsV0FBVyxDQUFDLDRCQUE0QjtJQUN0RSxTQUFTLEVBQUUsV0FBVyxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMseUJBQXlCLENBQUM7SUFDL0QsbUJBQW1CLEVBQUUsNEJBQTRCLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDO0lBQ2xGLFVBQVUsRUFBRSxXQUFXLENBQUMsVUFBVTtDQUNuQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxLQUFLLEVBQzNELFdBQTJDLEVBQ25CLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLDRDQUE0QyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQ3BGLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxLQUFLLEVBQ3RELFdBQW9CLEVBQ0QsRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztlQUNyQixDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUU7Z0JBQzVCLGVBQWU7Z0JBQ2YsU0FBUztnQkFDVCxxQkFBcUI7Z0JBQ3JCLDhCQUE4QjtnQkFDOUIsV0FBVztnQkFDWCxxQkFBcUI7Z0JBQ3JCLFlBQVk7Z0JBQ1osZ0JBQWdCO2FBQ2pCLENBQUMsRUFBRSxDQUFDO1lBQ0wsT0FBTyxDQUFDLHlEQUF5RCxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHO1lBQ2IsR0FBRyxtQ0FBbUMsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDO1lBQzNELEdBQUcsOENBQThDLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDO1NBQ25GLENBQUM7UUFDRixJQUFJLFdBQVcsQ0FBQyxhQUFhLEtBQUssQ0FBQztlQUM5QixXQUFXLENBQUMsbUJBQW1CLEtBQUssMkJBQTJCLENBQUMsbUJBQW1CO2VBQ25GLE9BQU8sV0FBVyxDQUFDLDRCQUE0QixLQUFLLFFBQVE7ZUFDNUQsQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLDRCQUE0QixDQUFDO2VBQ3pELENBQUMscUJBQXFCLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQztlQUM5QyxPQUFPLFdBQVcsQ0FBQyxjQUFjLEtBQUssUUFBUTtlQUM5QyxDQUFDLGNBQWMsQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztZQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLGtFQUFrRSxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUM7ZUFDcEMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQztlQUNsQyxXQUFXLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FDNUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQ3pELENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUsseUJBQXlCLEVBQUUsQ0FBQztZQUM3QyxNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7UUFDdkYsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLGVBQWUsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1lBQzFDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsSUFBSSxXQUFXLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7Z0JBQ25FLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO3VCQUNyQixDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUU7d0JBQzVCLFVBQVU7d0JBQ1Ysb0NBQW9DO3dCQUNwQyw4QkFBOEI7cUJBQy9CLENBQUM7dUJBQ0MsT0FBTyxXQUFXLENBQUMsa0NBQWtDLEtBQUssUUFBUTt1QkFDbEUsQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLGtDQUFrQyxDQUFDO3VCQUMvRCxPQUFPLFdBQVcsQ0FBQyw0QkFBNEIsS0FBSyxRQUFRO3VCQUM1RCxDQUFDLGNBQWMsQ0FBQyxXQUFXLENBQUMsNEJBQTRCLENBQUMsRUFBRSxDQUFDO29CQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxLQUFLLHFCQUFxQixDQUFDLENBQUM7Z0JBQ3JGLENBQUM7cUJBQU0sQ0FBQztvQkFDTixlQUFlLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO2dCQUN0RSxDQUFDO1lBQ0gsQ0FBQztZQUNELElBQUksZUFBZSxDQUFDLElBQUksS0FBSyxXQUFXLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUMxRCxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7WUFDeEYsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1lBQzlDLElBQUksV0FBVyxDQUFDLG1CQUFtQixDQUFDLHVCQUF1QjtvQkFDckQsV0FBVyxDQUFDLDRCQUE0QixFQUFFLENBQUM7Z0JBQy9DLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0VBQWtFLENBQUMsQ0FBQztZQUNsRixDQUFDO1lBQ0QsSUFBSSxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsVUFBVSxDQUFDO21CQUNoRSxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDO21CQUM3QyxXQUFXLENBQUMsbUJBQW1CLENBQUMsVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztnQkFDekUsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO1lBQzNFLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDbEIsV0FBVyxDQUFDLGNBQWMsS0FBSyxNQUFNLHdDQUF3QyxDQUM5RSxXQUF3RCxDQUN6RCxFQUFFLENBQUM7WUFDSixNQUFNLENBQUMsSUFBSSxDQUFDLHFEQUFxRCxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUN0RSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FDNUQsWUFBcUIsRUFDWCxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7V0FDdEIsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFO1lBQzdCLGtCQUFrQjtZQUNsQixxQkFBcUI7WUFDckIsZ0JBQWdCO1NBQ2pCLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFlBQVksQ0FBQyxnQkFBZ0IsS0FBSyxDQUFDO1dBQ2xDLENBQUMscUJBQXFCLENBQUMsWUFBWSxDQUFDLG1CQUFtQixDQUFDO1dBQ3hELE9BQU8sWUFBWSxDQUFDLGNBQWMsS0FBSyxRQUFRO1dBQy9DLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQ2xELE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsS0FBSyxFQUM5RCxZQUFxQixFQUNGLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7V0FDdEIsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFO1lBQzdCLGtCQUFrQjtZQUNsQixxQkFBcUI7WUFDckIsZ0JBQWdCO1lBQ2hCLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE9BQU8sQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRztRQUNoQixnQkFBZ0IsRUFBRSxZQUFZLENBQUMsZ0JBQWdCO1FBQy9DLG1CQUFtQixFQUFFLFlBQVksQ0FBQyxtQkFBbUI7UUFDckQsY0FBYyxFQUFFLFlBQVksQ0FBQyxjQUFjO0tBQzVDLENBQUM7SUFDRixNQUFNLE1BQU0sR0FBRztRQUNiLEdBQUcsOENBQThDLENBQUMsU0FBUyxDQUFDO1FBQzVELEdBQUcsTUFBTSxtQ0FBbUMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDO0tBQ3BFLENBQUM7SUFDRixJQUFJLFFBQVEsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDO1dBQzlCLFlBQVksQ0FBQyxjQUFjLEtBQUssWUFBWSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "23.2.0",
+  "version": "24.0.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {