@serve.zone/interfaces 23.2.0 → 24.1.0

package/dist_ts/data/clusternode.js

@@ -1,2 +1,421 @@
 import * as plugins from '../plugins.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3Rlcm5vZGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJub2RlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDIn0=
+const runtimeIdentifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const runtimeDigestRegex = /^sha256:[a-f0-9]{64}$/;
+const runtimePlatforms = new Set([
+    'linux/amd64',
+    'linux/arm64',
+]);
+const maximumSwarmNodes = 1024;
+const isRuntimeRecord = (valueArg) => (Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg));
+const hasExactRuntimeKeys = (valueArg, keysArg) => JSON.stringify(Object.keys(valueArg).sort()) === JSON.stringify([...keysArg].sort());
+const isRuntimeIdentifier = (valueArg) => (typeof valueArg === 'string' && runtimeIdentifierRegex.test(valueArg));
+const isPositiveSafeInteger = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg > 0);
+const computeSha256 = async (inputArg) => {
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(inputArg)));
+    return `sha256:${[...digest]
+        .map((byteArg) => byteArg.toString(16).padStart(2, '0'))
+        .join('')}`;
+};
+const canonicalSwarmNode = (nodeArg) => ({
+    swarmNodeId: nodeArg.swarmNodeId,
+    nodeName: nodeArg.nodeName,
+    platform: nodeArg.platform,
+    role: nodeArg.role,
+    availability: nodeArg.availability,
+    state: nodeArg.state,
+    managerStatus: nodeArg.managerStatus
+        ? {
+            leader: nodeArg.managerStatus.leader,
+            reachability: nodeArg.managerStatus.reachability,
+        }
+        : null,
+});
+export const createSwarmManagerSnapshotDigestInput = (swarmClusterIdArg, snapshotArg) => JSON.stringify({
+    schemaVersion: 1,
+    purpose: 'serve.zone/swarm-manager-snapshot',
+    swarmClusterId: swarmClusterIdArg,
+    snapshotVersion: snapshotArg.snapshotVersion,
+    nodeCount: snapshotArg.nodeCount,
+    managerCount: snapshotArg.managerCount,
+    nodes: snapshotArg.nodes.map(canonicalSwarmNode),
+});
+export const computeSwarmManagerSnapshotDigest = async (swarmClusterIdArg, snapshotArg) => computeSha256(createSwarmManagerSnapshotDigestInput(swarmClusterIdArg, snapshotArg));
+const validateSwarmManagerSnapshot = async (swarmClusterIdArg, localSwarmNodeIdArg, snapshotArg) => {
+    if (!isRuntimeRecord(snapshotArg)
+        || !hasExactRuntimeKeys(snapshotArg, [
+            'snapshotVersion',
+            'snapshotDigest',
+            'nodeCount',
+            'managerCount',
+            'nodes',
+        ])) {
+        return ['Spark Swarm manager snapshot must use its exact schema'];
+    }
+    const errors = [];
+    if (snapshotArg.snapshotVersion !== 1) {
+        errors.push('Spark Swarm manager snapshotVersion must be 1');
+    }
+    if (typeof snapshotArg.snapshotDigest !== 'string'
+        || !runtimeDigestRegex.test(snapshotArg.snapshotDigest)) {
+        errors.push('Spark Swarm manager snapshot digest must be canonical');
+    }
+    if (!Array.isArray(snapshotArg.nodes)
+        || snapshotArg.nodes.length === 0
+        || snapshotArg.nodes.length > maximumSwarmNodes) {
+        errors.push('Spark Swarm manager snapshot nodes must be a non-empty bounded array');
+        return errors;
+    }
+    if (snapshotArg.nodeCount !== snapshotArg.nodes.length
+        || !isPositiveSafeInteger(snapshotArg.nodeCount)) {
+        errors.push('Spark Swarm manager snapshot nodeCount must match nodes');
+    }
+    const nodeIds = new Set();
+    const nodeNames = new Set();
+    let managerCount = 0;
+    let leaderCount = 0;
+    let previousSortKey;
+    for (const [index, nodeArg] of snapshotArg.nodes.entries()) {
+        if (!isRuntimeRecord(nodeArg)) {
+            errors.push(`Spark Swarm manager snapshot nodes[${index}] must be an object`);
+            continue;
+        }
+        const isManager = nodeArg.role === 'manager';
+        const expectedKeys = [
+            'swarmNodeId',
+            'nodeName',
+            'platform',
+            'role',
+            'availability',
+            'state',
+            ...(isManager ? ['managerStatus'] : []),
+        ];
+        if (!hasExactRuntimeKeys(nodeArg, expectedKeys)) {
+            errors.push(`Spark Swarm manager snapshot nodes[${index}] must use its exact role schema`);
+        }
+        if (!isRuntimeIdentifier(nodeArg.swarmNodeId) || !isRuntimeIdentifier(nodeArg.nodeName)) {
+            errors.push(`Spark Swarm manager snapshot nodes[${index}] identity must be canonical`);
+        }
+        if (!runtimePlatforms.has(nodeArg.platform)) {
+            errors.push(`Spark Swarm manager snapshot nodes[${index}] platform must be supported`);
+        }
+        if (!['manager', 'worker'].includes(nodeArg.role)
+            || !['active', 'pause', 'drain'].includes(nodeArg.availability)
+            || !['unknown', 'down', 'ready', 'disconnected'].includes(nodeArg.state)) {
+            errors.push(`Spark Swarm manager snapshot nodes[${index}] scheduler state must be canonical`);
+        }
+        if (isManager) {
+            managerCount++;
+            if (!isRuntimeRecord(nodeArg.managerStatus)
+                || !hasExactRuntimeKeys(nodeArg.managerStatus, ['leader', 'reachability'])
+                || typeof nodeArg.managerStatus.leader !== 'boolean'
+                || !['unknown', 'unreachable', 'reachable']
+                    .includes(nodeArg.managerStatus.reachability)) {
+                errors.push(`Spark Swarm manager snapshot nodes[${index}] managerStatus must be canonical`);
+            }
+            else if (nodeArg.managerStatus.leader) {
+                leaderCount++;
+            }
+        }
+        if (isRuntimeIdentifier(nodeArg.swarmNodeId)) {
+            if (nodeIds.has(nodeArg.swarmNodeId)) {
+                errors.push('Spark Swarm manager snapshot node IDs must be unique');
+            }
+            nodeIds.add(nodeArg.swarmNodeId);
+        }
+        if (isRuntimeIdentifier(nodeArg.nodeName)) {
+            if (nodeNames.has(nodeArg.nodeName)) {
+                errors.push('Spark Swarm manager snapshot node names must be unique');
+            }
+            nodeNames.add(nodeArg.nodeName);
+        }
+        if (isRuntimeIdentifier(nodeArg.swarmNodeId) && isRuntimeIdentifier(nodeArg.nodeName)) {
+            const sortKey = `${nodeArg.swarmNodeId}\0${nodeArg.nodeName}\0${nodeArg.platform}`;
+            if (previousSortKey !== undefined && sortKey <= previousSortKey) {
+                errors.push('Spark Swarm manager snapshot nodes must be uniquely sorted');
+            }
+            previousSortKey = sortKey;
+        }
+    }
+    if (snapshotArg.managerCount !== managerCount || !isPositiveSafeInteger(snapshotArg.managerCount)) {
+        errors.push('Spark Swarm manager snapshot managerCount must match nodes');
+    }
+    if (leaderCount > 1)
+        errors.push('Spark Swarm manager snapshot may contain at most one leader');
+    const sourceNode = snapshotArg.nodes.find((nodeArg) => (isRuntimeRecord(nodeArg) && nodeArg.swarmNodeId === localSwarmNodeIdArg));
+    if (!isRuntimeRecord(sourceNode)
+        || sourceNode.role !== 'manager'
+        || sourceNode.availability !== 'active'
+        || sourceNode.state !== 'ready'
+        || !isRuntimeRecord(sourceNode.managerStatus)
+        || sourceNode.managerStatus.reachability !== 'reachable') {
+        errors.push('Spark Swarm manager snapshot source must be an active reachable manager');
+    }
+    if (errors.length === 0
+        && snapshotArg.snapshotDigest !== await computeSwarmManagerSnapshotDigest(swarmClusterIdArg, snapshotArg)) {
+        errors.push('Spark Swarm manager snapshot digest does not match');
+    }
+    return errors;
+};
+export const validateSparkSwarmObservation = async (observationArg) => {
+    try {
+        if (!isRuntimeRecord(observationArg))
+            return ['Spark Swarm observation must be an object'];
+        const observation = observationArg;
+        const commonKeys = [
+            'schemaVersion',
+            'reporterSessionId',
+            'observationSequence',
+            'observedAt',
+            'state',
+        ];
+        const expectedKeys = observation.state === 'unknown'
+            ? [...commonKeys, 'reason']
+            : observation.state === 'not-member'
+                ? commonKeys
+                : observation.state === 'member'
+                    ? [
+                        ...commonKeys,
+                        'swarmClusterId',
+                        'localSwarmNodeId',
+                        'controlAvailable',
+                        ...(observation.managerSnapshot === undefined ? [] : ['managerSnapshot']),
+                    ]
+                    : [];
+        if (expectedKeys.length === 0 || !hasExactRuntimeKeys(observation, expectedKeys)) {
+            return ['Spark Swarm observation must use its exact state schema'];
+        }
+        const errors = [];
+        if (observation.schemaVersion !== 1)
+            errors.push('Spark Swarm observation schemaVersion must be 1');
+        if (!isRuntimeIdentifier(observation.reporterSessionId)
+            || !isPositiveSafeInteger(observation.observationSequence)
+            || !isPositiveSafeInteger(observation.observedAt)) {
+            errors.push('Spark Swarm observation identity, sequence, and timestamp must be canonical');
+        }
+        if (observation.state === 'unknown'
+            && !['docker-unavailable', 'query-failed', 'not-initialized']
+                .includes(observation.reason)) {
+            errors.push('Spark Swarm observation unknown reason must be canonical');
+        }
+        if (observation.state === 'member') {
+            if (!isRuntimeIdentifier(observation.swarmClusterId)
+                || !isRuntimeIdentifier(observation.localSwarmNodeId)
+                || typeof observation.controlAvailable !== 'boolean') {
+                errors.push('Spark Swarm member observation must have canonical local authority');
+            }
+            if (observation.managerSnapshot !== undefined) {
+                if (observation.controlAvailable !== true) {
+                    errors.push('Spark Swarm manager snapshot requires controlAvailable');
+                }
+                else if (isRuntimeIdentifier(observation.swarmClusterId)
+                    && isRuntimeIdentifier(observation.localSwarmNodeId)) {
+                    errors.push(...await validateSwarmManagerSnapshot(observation.swarmClusterId, observation.localSwarmNodeId, observation.managerSnapshot));
+                }
+            }
+        }
+        return errors;
+    }
+    catch {
+        return ['Spark Swarm observation must be safely inspectable'];
+    }
+};
+export const validateSparkSwarmObservationV2 = async (observationArg) => {
+    try {
+        if (!isRuntimeRecord(observationArg))
+            return ['Spark Swarm observation v2 must be an object'];
+        const observation = observationArg;
+        const commonKeys = [
+            'schemaVersion',
+            'reporterSessionId',
+            'observationSequence',
+            'observedAt',
+            'state',
+        ];
+        const expectedKeys = observation.state === 'unknown'
+            ? [...commonKeys, 'reason']
+            : observation.state === 'not-member'
+                ? commonKeys
+                : observation.state === 'member' && observation.controlAvailable === false
+                    ? [...commonKeys, 'localSwarmNodeId', 'controlAvailable']
+                    : observation.state === 'member' && observation.controlAvailable === true
+                        ? [
+                            ...commonKeys,
+                            'swarmClusterId',
+                            'localSwarmNodeId',
+                            'controlAvailable',
+                            ...(observation.managerSnapshot === undefined ? [] : ['managerSnapshot']),
+                        ]
+                        : [];
+        if (expectedKeys.length === 0 || !hasExactRuntimeKeys(observation, expectedKeys)) {
+            return ['Spark Swarm observation v2 must use its exact state schema'];
+        }
+        const errors = [];
+        if (observation.schemaVersion !== 2) {
+            errors.push('Spark Swarm observation v2 schemaVersion must be 2');
+        }
+        if (!isRuntimeIdentifier(observation.reporterSessionId)
+            || !isPositiveSafeInteger(observation.observationSequence)
+            || !isPositiveSafeInteger(observation.observedAt)) {
+            errors.push('Spark Swarm observation v2 identity, sequence, and timestamp must be canonical');
+        }
+        if (observation.state === 'unknown'
+            && !['docker-unavailable', 'query-failed', 'not-initialized']
+                .includes(observation.reason)) {
+            errors.push('Spark Swarm observation v2 unknown reason must be canonical');
+        }
+        if (observation.state === 'member') {
+            if (!isRuntimeIdentifier(observation.localSwarmNodeId)
+                || typeof observation.controlAvailable !== 'boolean') {
+                errors.push('Spark Swarm member observation v2 must have canonical local authority');
+            }
+            if (observation.controlAvailable === true) {
+                if (!isRuntimeIdentifier(observation.swarmClusterId)) {
+                    errors.push('Spark Swarm manager observation v2 must have canonical cluster authority');
+                }
+                else if (observation.managerSnapshot !== undefined
+                    && isRuntimeIdentifier(observation.localSwarmNodeId)) {
+                    errors.push(...await validateSwarmManagerSnapshot(observation.swarmClusterId, observation.localSwarmNodeId, observation.managerSnapshot));
+                }
+            }
+        }
+        return errors;
+    }
+    catch {
+        return ['Spark Swarm observation v2 must be safely inspectable'];
+    }
+};
+const canonicalRuntimeTarget = (targetArg) => ({
+    cloudlyNodeId: targetArg.cloudlyNodeId,
+    swarmClusterId: targetArg.swarmClusterId,
+    swarmNodeId: targetArg.swarmNodeId,
+    nodeName: targetArg.nodeName,
+    platform: targetArg.platform,
+});
+export const createClusterRuntimeTargetSetDigestInput = (targetSetArg) => JSON.stringify({
+    schemaVersion: targetSetArg.schemaVersion,
+    purpose: 'serve.zone/cluster-runtime-target-set',
+    cloudlyClusterId: targetSetArg.cloudlyClusterId,
+    swarmClusterId: targetSetArg.swarmClusterId,
+    generation: targetSetArg.generation,
+    targets: targetSetArg.targets.map(canonicalRuntimeTarget),
+});
+export const computeClusterRuntimeTargetSetDigest = async (targetSetArg) => computeSha256(createClusterRuntimeTargetSetDigestInput(targetSetArg));
+export const validateClusterRuntimeTargetSet = async (targetSetArg) => {
+    try {
+        if (!isRuntimeRecord(targetSetArg))
+            return ['cluster runtime target set must be an object'];
+        if (targetSetArg.state === 'unavailable') {
+            if (!hasExactRuntimeKeys(targetSetArg, [
+                'schemaVersion',
+                'state',
+                'cloudlyClusterId',
+                'generation',
+                'changedAt',
+                'reason',
+            ])) {
+                return ['unavailable cluster runtime target set must use its exact schema'];
+            }
+            const errors = [];
+            if (targetSetArg.schemaVersion !== 1
+                || !isRuntimeIdentifier(targetSetArg.cloudlyClusterId)
+                || !Number.isSafeInteger(targetSetArg.generation)
+                || targetSetArg.generation < 0
+                || !isPositiveSafeInteger(targetSetArg.changedAt)
+                || ![
+                    'never-observed',
+                    'stale',
+                    'no-manager-consensus',
+                    'identity-conflict',
+                    'no-schedulable-targets',
+                ].includes(targetSetArg.reason)) {
+                errors.push('unavailable cluster runtime target set fields must be canonical');
+            }
+            if (targetSetArg.reason === 'never-observed' && targetSetArg.generation !== 0) {
+                errors.push('never-observed target state must use generation zero');
+            }
+            return errors;
+        }
+        if (targetSetArg.state !== 'ready'
+            || !hasExactRuntimeKeys(targetSetArg, [
+                'schemaVersion',
+                'state',
+                'cloudlyClusterId',
+                'swarmClusterId',
+                'generation',
+                'targetSetDigest',
+                'acceptedAt',
+                'freshUntil',
+                'targets',
+            ])) {
+            return ['ready cluster runtime target set must use its exact schema'];
+        }
+        const errors = [];
+        if (targetSetArg.schemaVersion !== 1
+            || !isRuntimeIdentifier(targetSetArg.cloudlyClusterId)
+            || !isRuntimeIdentifier(targetSetArg.swarmClusterId)
+            || !isPositiveSafeInteger(targetSetArg.generation)
+            || !isPositiveSafeInteger(targetSetArg.acceptedAt)
+            || !isPositiveSafeInteger(targetSetArg.freshUntil)
+            || targetSetArg.freshUntil <= targetSetArg.acceptedAt
+            || typeof targetSetArg.targetSetDigest !== 'string'
+            || !runtimeDigestRegex.test(targetSetArg.targetSetDigest)) {
+            errors.push('ready cluster runtime target set authority fields must be canonical');
+        }
+        if (!Array.isArray(targetSetArg.targets)
+            || targetSetArg.targets.length === 0
+            || targetSetArg.targets.length > maximumSwarmNodes) {
+            errors.push('ready cluster runtime target set targets must be a non-empty bounded array');
+            return errors;
+        }
+        const cloudlyNodeIds = new Set();
+        const swarmNodeScopes = new Set();
+        const nodeNames = new Set();
+        let previousSortKey;
+        for (const [index, targetArg] of targetSetArg.targets.entries()) {
+            if (!isRuntimeRecord(targetArg)
+                || !hasExactRuntimeKeys(targetArg, [
+                    'cloudlyNodeId',
+                    'swarmClusterId',
+                    'swarmNodeId',
+                    'nodeName',
+                    'platform',
+                ])
+                || !isRuntimeIdentifier(targetArg.cloudlyNodeId)
+                || !isRuntimeIdentifier(targetArg.swarmClusterId)
+                || !isRuntimeIdentifier(targetArg.swarmNodeId)
+                || !isRuntimeIdentifier(targetArg.nodeName)
+                || targetArg.swarmClusterId !== targetSetArg.swarmClusterId
+                || !runtimePlatforms.has(targetArg.platform)) {
+                errors.push(`cluster runtime target set targets[${index}] must be canonical`);
+                continue;
+            }
+            const sortKey = `${targetArg.cloudlyNodeId}\0${targetArg.swarmClusterId}\0${targetArg.swarmNodeId}\0${targetArg.nodeName}\0${targetArg.platform}`;
+            if (previousSortKey !== undefined && sortKey <= previousSortKey) {
+                errors.push('cluster runtime target set targets must be uniquely sorted');
+            }
+            previousSortKey = sortKey;
+            const swarmScope = `${targetArg.swarmClusterId}\0${targetArg.swarmNodeId}`;
+            if (cloudlyNodeIds.has(targetArg.cloudlyNodeId)
+                || swarmNodeScopes.has(swarmScope)
+                || nodeNames.has(targetArg.nodeName)) {
+                errors.push('cluster runtime target identities must be unique');
+            }
+            cloudlyNodeIds.add(targetArg.cloudlyNodeId);
+            swarmNodeScopes.add(swarmScope);
+            nodeNames.add(targetArg.nodeName);
+        }
+        if (errors.length === 0
+            && targetSetArg.targetSetDigest !== await computeClusterRuntimeTargetSetDigest(targetSetArg)) {
+            errors.push('cluster runtime target set digest does not match');
+        }
+        return errors;
+    }
+    catch {
+        return ['cluster runtime target set must be safely inspectable'];
+    }
+};
+export const isClusterRuntimeTargetSetFresh = (targetSetArg, nowArg) => (targetSetArg.state === 'ready'
+    && Number.isSafeInteger(nowArg)
+    && nowArg >= targetSetArg.acceptedAt
+    && nowArg < targetSetArg.freshUntil);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3Rlcm5vZGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJub2RlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBME56QyxNQUFNLHNCQUFzQixHQUFHLHFDQUFxQyxDQUFDO0FBQ3JFLE1BQU0sa0JBQWtCLEdBQUcsdUJBQXVCLENBQUM7QUFDbkQsTUFBTSxnQkFBZ0IsR0FBRyxJQUFJLEdBQUcsQ0FBOEI7SUFDNUQsYUFBYTtJQUNiLGFBQWE7Q0FDZCxDQUFDLENBQUM7QUFDSCxNQUFNLGlCQUFpQixHQUFHLElBQUksQ0FBQztBQUUvQixNQUFNLGVBQWUsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUNsRixPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FDOUUsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FDMUIsUUFBaUMsRUFDakMsT0FBaUIsRUFDUixFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztBQUVuRyxNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3JFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3RFLENBQUM7QUFFRixNQUFNLHFCQUFxQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3ZFLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUssUUFBbUIsR0FBRyxDQUFDLENBQzNELENBQUM7QUFFRixNQUFNLGFBQWEsR0FBRyxLQUFLLEVBQUUsUUFBZ0IsRUFBMEIsRUFBRTtJQUN2RSxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FDakUsU0FBUyxFQUNULElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUNuQyxDQUFDLENBQUM7SUFDSCxPQUFPLFVBQVUsQ0FBQyxHQUFHLE1BQU0sQ0FBQztTQUN6QixHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztTQUN2RCxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQW1CLENBQUM7QUFDakMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxrQkFBa0IsR0FBRyxDQUN6QixPQUFvQyxFQUNYLEVBQUUsQ0FBQyxDQUFDO0lBQzdCLFdBQVcsRUFBRSxPQUFPLENBQUMsV0FBVztJQUNoQyxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7SUFDMUIsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO0lBQzFCLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtJQUNsQixZQUFZLEVBQUUsT0FBTyxDQUFDLFlBQVk7SUFDbEMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFLO0lBQ3BCLGFBQWEsRUFBRSxPQUFPLENBQUMsYUFBYTtRQUNsQyxDQUFDLENBQUM7WUFDRSxNQUFNLEVBQUUsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNO1lBQ3BDLFlBQVksRUFBRSxPQUFPLENBQUMsYUFBYSxDQUFDLFlBQVk7U0FDakQ7UUFDSCxDQUFDLENBQUMsSUFBSTtDQUNULENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQ25ELGlCQUF5QixFQUN6QixXQUFvQyxFQUM1QixFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUMxQixhQUFhLEVBQUUsQ0FBQztJQUNoQixPQUFPLEVBQUUsbUNBQW1DO0lBQzVDLGNBQWMsRUFBRSxpQkFBaUI7SUFDakMsZUFBZSxFQUFFLFdBQVcsQ0FBQyxlQUFlO0lBQzVDLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztJQUNoQyxZQUFZLEVBQUUsV0FBVyxDQUFDLFlBQVk7SUFDdEMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLGtCQUFrQixDQUFDO0NBQ2pELENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLEtBQUssRUFDcEQsaUJBQXlCLEVBQ3pCLFdBQW9DLEVBQ1osRUFBRSxDQUFDLGFBQWEsQ0FDeEMscUNBQXFDLENBQUMsaUJBQWlCLEVBQUUsV0FBVyxDQUFDLENBQ3RFLENBQUM7QUFFRixNQUFNLDRCQUE0QixHQUFHLEtBQUssRUFDeEMsaUJBQXlCLEVBQ3pCLG1CQUEyQixFQUMzQixXQUFvQixFQUNELEVBQUU7SUFDckIsSUFBSSxDQUFDLGVBQWUsQ0FBQyxXQUFXLENBQUM7V0FDNUIsQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLEVBQUU7WUFDbkMsaUJBQWlCO1lBQ2pCLGdCQUFnQjtZQUNoQixXQUFXO1lBQ1gsY0FBYztZQUNkLE9BQU87U0FDUixDQUFDLEVBQUUsQ0FBQztRQUNMLE9BQU8sQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxXQUFXLENBQUMsZUFBZSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxjQUFjLEtBQUssUUFBUTtXQUM3QyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUMxRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxLQUFLLENBQUM7V0FDaEMsV0FBVyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUM5QixXQUFXLENBQUMsS0FBSyxDQUFDLE1BQU0sR0FBRyxpQkFBaUIsRUFBRSxDQUFDO1FBQ2xELE1BQU0sQ0FBQyxJQUFJLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUNwRixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxLQUFLLENBQUMsTUFBTTtXQUNqRCxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNsQyxNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3BDLElBQUksWUFBWSxHQUFHLENBQUMsQ0FBQztJQUNyQixJQUFJLFdBQVcsR0FBRyxDQUFDLENBQUM7SUFDcEIsSUFBSSxlQUFtQyxDQUFDO0lBQ3hDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsSUFBSSxXQUFXLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDM0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzlCLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0NBQXNDLEtBQUsscUJBQXFCLENBQUMsQ0FBQztZQUM5RSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDO1FBQzdDLE1BQU0sWUFBWSxHQUFHO1lBQ25CLGFBQWE7WUFDYixVQUFVO1lBQ1YsVUFBVTtZQUNWLE1BQU07WUFDTixjQUFjO1lBQ2QsT0FBTztZQUNQLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUN4QyxDQUFDO1FBQ0YsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ2hELE1BQU0sQ0FBQyxJQUFJLENBQUMsc0NBQXNDLEtBQUssa0NBQWtDLENBQUMsQ0FBQztRQUM3RixDQUFDO1FBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ3hGLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0NBQXNDLEtBQUssOEJBQThCLENBQUMsQ0FBQztRQUN6RixDQUFDO1FBQ0QsSUFBSSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsUUFBdUMsQ0FBQyxFQUFFLENBQUM7WUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxzQ0FBc0MsS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFDRCxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFjLENBQUM7ZUFDdEQsQ0FBQyxDQUFDLFFBQVEsRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxZQUFzQixDQUFDO2VBQ3RFLENBQUMsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxjQUFjLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQWUsQ0FBQyxFQUFFLENBQUM7WUFDckYsTUFBTSxDQUFDLElBQUksQ0FBQyxzQ0FBc0MsS0FBSyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ2hHLENBQUM7UUFDRCxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQ2QsWUFBWSxFQUFFLENBQUM7WUFDZixJQUFJLENBQUMsZUFBZSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUM7bUJBQ3RDLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxDQUFDLFFBQVEsRUFBRSxjQUFjLENBQUMsQ0FBQzttQkFDdkUsT0FBTyxPQUFPLENBQUMsYUFBYSxDQUFDLE1BQU0sS0FBSyxTQUFTO21CQUNqRCxDQUFDLENBQUMsU0FBUyxFQUFFLGFBQWEsRUFBRSxXQUFXLENBQUM7cUJBQ3hDLFFBQVEsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLFlBQXNCLENBQUMsRUFBRSxDQUFDO2dCQUM1RCxNQUFNLENBQUMsSUFBSSxDQUFDLHNDQUFzQyxLQUFLLG1DQUFtQyxDQUFDLENBQUM7WUFDOUYsQ0FBQztpQkFBTSxJQUFJLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ3hDLFdBQVcsRUFBRSxDQUFDO1lBQ2hCLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxtQkFBbUIsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUM3QyxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3JDLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0RBQXNELENBQUMsQ0FBQztZQUN0RSxDQUFDO1lBQ0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDbkMsQ0FBQztRQUNELElBQUksbUJBQW1CLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDMUMsSUFBSSxTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO2dCQUNwQyxNQUFNLENBQUMsSUFBSSxDQUFDLHdEQUF3RCxDQUFDLENBQUM7WUFDeEUsQ0FBQztZQUNELFNBQVMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2xDLENBQUM7UUFDRCxJQUFJLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsSUFBSSxtQkFBbUIsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUN0RixNQUFNLE9BQU8sR0FBRyxHQUFHLE9BQU8sQ0FBQyxXQUFXLEtBQUssT0FBTyxDQUFDLFFBQVEsS0FBSyxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDbkYsSUFBSSxlQUFlLEtBQUssU0FBUyxJQUFJLE9BQU8sSUFBSSxlQUFlLEVBQUUsQ0FBQztnQkFDaEUsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO1lBQzVFLENBQUM7WUFDRCxlQUFlLEdBQUcsT0FBTyxDQUFDO1FBQzVCLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsWUFBWSxLQUFLLFlBQVksSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQ2xHLE1BQU0sQ0FBQyxJQUFJLENBQUMsNERBQTRELENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBQ0QsSUFBSSxXQUFXLEdBQUcsQ0FBQztRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztJQUNoRyxNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FDckQsZUFBZSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sQ0FBQyxXQUFXLEtBQUssbUJBQW1CLENBQ3hFLENBQUMsQ0FBQztJQUNILElBQUksQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO1dBQzNCLFVBQVUsQ0FBQyxJQUFJLEtBQUssU0FBUztXQUM3QixVQUFVLENBQUMsWUFBWSxLQUFLLFFBQVE7V0FDcEMsVUFBVSxDQUFDLEtBQUssS0FBSyxPQUFPO1dBQzVCLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUM7V0FDMUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxZQUFZLEtBQUssV0FBVyxFQUFFLENBQUM7UUFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyx5RUFBeUUsQ0FBQyxDQUFDO0lBQ3pGLENBQUM7SUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNsQixXQUFXLENBQUMsY0FBYyxLQUFLLE1BQU0saUNBQWlDLENBQ3ZFLGlCQUFpQixFQUNqQixXQUFpRCxDQUNsRCxFQUFFLENBQUM7UUFDSixNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLEtBQUssRUFDaEQsY0FBdUIsRUFDSixFQUFFO0lBQ3JCLElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxlQUFlLENBQUMsY0FBYyxDQUFDO1lBQUUsT0FBTyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7UUFDM0YsTUFBTSxXQUFXLEdBQUcsY0FBeUMsQ0FBQztRQUM5RCxNQUFNLFVBQVUsR0FBRztZQUNqQixlQUFlO1lBQ2YsbUJBQW1CO1lBQ25CLHFCQUFxQjtZQUNyQixZQUFZO1lBQ1osT0FBTztTQUNSLENBQUM7UUFDRixNQUFNLFlBQVksR0FBRyxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVM7WUFDbEQsQ0FBQyxDQUFDLENBQUMsR0FBRyxVQUFVLEVBQUUsUUFBUSxDQUFDO1lBQzNCLENBQUMsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLLFlBQVk7Z0JBQ2xDLENBQUMsQ0FBQyxVQUFVO2dCQUNaLENBQUMsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLLFFBQVE7b0JBQzlCLENBQUMsQ0FBQzt3QkFDRSxHQUFHLFVBQVU7d0JBQ2IsZ0JBQWdCO3dCQUNoQixrQkFBa0I7d0JBQ2xCLGtCQUFrQjt3QkFDbEIsR0FBRyxDQUFDLFdBQVcsQ0FBQyxlQUFlLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsaUJBQWlCLENBQUMsQ0FBQztxQkFDMUU7b0JBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNYLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLEVBQUUsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUNqRixPQUFPLENBQUMseURBQXlELENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBQzVCLElBQUksV0FBVyxDQUFDLGFBQWEsS0FBSyxDQUFDO1lBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO1FBQ3BHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsaUJBQWlCLENBQUM7ZUFDbEQsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUM7ZUFDdkQsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUNwRCxNQUFNLENBQUMsSUFBSSxDQUFDLDZFQUE2RSxDQUFDLENBQUM7UUFDN0YsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLEtBQUssS0FBSyxTQUFTO2VBQzlCLENBQUMsQ0FBQyxvQkFBb0IsRUFBRSxjQUFjLEVBQUUsaUJBQWlCLENBQUM7aUJBQzFELFFBQVEsQ0FBQyxXQUFXLENBQUMsTUFBZ0IsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLFdBQVcsQ0FBQyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDbkMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUM7bUJBQy9DLENBQUMsbUJBQW1CLENBQUMsV0FBVyxDQUFDLGdCQUFnQixDQUFDO21CQUNsRCxPQUFPLFdBQVcsQ0FBQyxnQkFBZ0IsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDdkQsTUFBTSxDQUFDLElBQUksQ0FBQyxvRUFBb0UsQ0FBQyxDQUFDO1lBQ3BGLENBQUM7WUFDRCxJQUFJLFdBQVcsQ0FBQyxlQUFlLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzlDLElBQUksV0FBVyxDQUFDLGdCQUFnQixLQUFLLElBQUksRUFBRSxDQUFDO29CQUMxQyxNQUFNLENBQUMsSUFBSSxDQUFDLHdEQUF3RCxDQUFDLENBQUM7Z0JBQ3hFLENBQUM7cUJBQU0sSUFBSSxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDO3VCQUNyRCxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO29CQUN2RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSw0QkFBNEIsQ0FDL0MsV0FBVyxDQUFDLGNBQWMsRUFDMUIsV0FBVyxDQUFDLGdCQUFnQixFQUM1QixXQUFXLENBQUMsZUFBZSxDQUM1QixDQUFDLENBQUM7Z0JBQ0wsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxLQUFLLEVBQ2xELGNBQXVCLEVBQ0osRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxJQUFJLENBQUMsZUFBZSxDQUFDLGNBQWMsQ0FBQztZQUFFLE9BQU8sQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQzlGLE1BQU0sV0FBVyxHQUFHLGNBQXlDLENBQUM7UUFDOUQsTUFBTSxVQUFVLEdBQUc7WUFDakIsZUFBZTtZQUNmLG1CQUFtQjtZQUNuQixxQkFBcUI7WUFDckIsWUFBWTtZQUNaLE9BQU87U0FDUixDQUFDO1FBQ0YsTUFBTSxZQUFZLEdBQUcsV0FBVyxDQUFDLEtBQUssS0FBSyxTQUFTO1lBQ2xELENBQUMsQ0FBQyxDQUFDLEdBQUcsVUFBVSxFQUFFLFFBQVEsQ0FBQztZQUMzQixDQUFDLENBQUMsV0FBVyxDQUFDLEtBQUssS0FBSyxZQUFZO2dCQUNsQyxDQUFDLENBQUMsVUFBVTtnQkFDWixDQUFDLENBQUMsV0FBVyxDQUFDLEtBQUssS0FBSyxRQUFRLElBQUksV0FBVyxDQUFDLGdCQUFnQixLQUFLLEtBQUs7b0JBQ3hFLENBQUMsQ0FBQyxDQUFDLEdBQUcsVUFBVSxFQUFFLGtCQUFrQixFQUFFLGtCQUFrQixDQUFDO29CQUN6RCxDQUFDLENBQUMsV0FBVyxDQUFDLEtBQUssS0FBSyxRQUFRLElBQUksV0FBVyxDQUFDLGdCQUFnQixLQUFLLElBQUk7d0JBQ3ZFLENBQUMsQ0FBQzs0QkFDRSxHQUFHLFVBQVU7NEJBQ2IsZ0JBQWdCOzRCQUNoQixrQkFBa0I7NEJBQ2xCLGtCQUFrQjs0QkFDbEIsR0FBRyxDQUFDLFdBQVcsQ0FBQyxlQUFlLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsaUJBQWlCLENBQUMsQ0FBQzt5QkFDMUU7d0JBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNiLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLEVBQUUsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUNqRixPQUFPLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUN4RSxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBQzVCLElBQUksV0FBVyxDQUFDLGFBQWEsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNwQyxNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7UUFDcEUsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsaUJBQWlCLENBQUM7ZUFDbEQsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUM7ZUFDdkQsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUNwRCxNQUFNLENBQUMsSUFBSSxDQUFDLGdGQUFnRixDQUFDLENBQUM7UUFDaEcsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLEtBQUssS0FBSyxTQUFTO2VBQzlCLENBQUMsQ0FBQyxvQkFBb0IsRUFBRSxjQUFjLEVBQUUsaUJBQWlCLENBQUM7aUJBQzFELFFBQVEsQ0FBQyxXQUFXLENBQUMsTUFBZ0IsQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO1FBQzdFLENBQUM7UUFDRCxJQUFJLFdBQVcsQ0FBQyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDbkMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFdBQVcsQ0FBQyxnQkFBZ0IsQ0FBQzttQkFDakQsT0FBTyxXQUFXLENBQUMsZ0JBQWdCLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3ZELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztZQUN2RixDQUFDO1lBQ0QsSUFBSSxXQUFXLENBQUMsZ0JBQWdCLEtBQUssSUFBSSxFQUFFLENBQUM7Z0JBQzFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztvQkFDckQsTUFBTSxDQUFDLElBQUksQ0FBQywwRUFBMEUsQ0FBQyxDQUFDO2dCQUMxRixDQUFDO3FCQUFNLElBQUksV0FBVyxDQUFDLGVBQWUsS0FBSyxTQUFTO3VCQUMvQyxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO29CQUN2RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSw0QkFBNEIsQ0FDL0MsV0FBVyxDQUFDLGNBQWMsRUFDMUIsV0FBVyxDQUFDLGdCQUFnQixFQUM1QixXQUFXLENBQUMsZUFBZSxDQUM1QixDQUFDLENBQUM7Z0JBQ0wsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLHNCQUFzQixHQUFHLENBQzdCLFNBQWtDLEVBQ1QsRUFBRSxDQUFDLENBQUM7SUFDN0IsYUFBYSxFQUFFLFNBQVMsQ0FBQyxhQUFhO0lBQ3RDLGNBQWMsRUFBRSxTQUFTLENBQUMsY0FBYztJQUN4QyxXQUFXLEVBQUUsU0FBUyxDQUFDLFdBQVc7SUFDbEMsUUFBUSxFQUFFLFNBQVMsQ0FBQyxRQUFRO0lBQzVCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUTtDQUM3QixDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxDQUN0RCxZQUE2QyxFQUNyQyxFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUMxQixhQUFhLEVBQUUsWUFBWSxDQUFDLGFBQWE7SUFDekMsT0FBTyxFQUFFLHVDQUF1QztJQUNoRCxnQkFBZ0IsRUFBRSxZQUFZLENBQUMsZ0JBQWdCO0lBQy9DLGNBQWMsRUFBRSxZQUFZLENBQUMsY0FBYztJQUMzQyxVQUFVLEVBQUUsWUFBWSxDQUFDLFVBQVU7SUFDbkMsT0FBTyxFQUFFLFlBQVksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLHNCQUFzQixDQUFDO0NBQzFELENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLEtBQUssRUFDdkQsWUFBNkMsRUFDckIsRUFBRSxDQUFDLGFBQWEsQ0FBQyx3Q0FBd0MsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO0FBRW5HLE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLEtBQUssRUFDbEQsWUFBcUIsRUFDRixFQUFFO0lBQ3JCLElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxlQUFlLENBQUMsWUFBWSxDQUFDO1lBQUUsT0FBTyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDNUYsSUFBSSxZQUFZLENBQUMsS0FBSyxLQUFLLGFBQWEsRUFBRSxDQUFDO1lBQ3pDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxZQUFZLEVBQUU7Z0JBQ3JDLGVBQWU7Z0JBQ2YsT0FBTztnQkFDUCxrQkFBa0I7Z0JBQ2xCLFlBQVk7Z0JBQ1osV0FBVztnQkFDWCxRQUFRO2FBQ1QsQ0FBQyxFQUFFLENBQUM7Z0JBQ0gsT0FBTyxDQUFDLGtFQUFrRSxDQUFDLENBQUM7WUFDOUUsQ0FBQztZQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztZQUM1QixJQUFJLFlBQVksQ0FBQyxhQUFhLEtBQUssQ0FBQzttQkFDL0IsQ0FBQyxtQkFBbUIsQ0FBQyxZQUFZLENBQUMsZ0JBQWdCLENBQUM7bUJBQ25ELENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDO21CQUM3QyxZQUFZLENBQUMsVUFBcUIsR0FBRyxDQUFDO21CQUN2QyxDQUFDLHFCQUFxQixDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUM7bUJBQzlDLENBQUM7b0JBQ0YsZ0JBQWdCO29CQUNoQixPQUFPO29CQUNQLHNCQUFzQjtvQkFDdEIsbUJBQW1CO29CQUNuQix3QkFBd0I7aUJBQ3pCLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxNQUFnQixDQUFDLEVBQUUsQ0FBQztnQkFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1lBQ2pGLENBQUM7WUFDRCxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssZ0JBQWdCLElBQUksWUFBWSxDQUFDLFVBQVUsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1lBQ3RFLENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO1FBQ0QsSUFBSSxZQUFZLENBQUMsS0FBSyxLQUFLLE9BQU87ZUFDN0IsQ0FBQyxtQkFBbUIsQ0FBQyxZQUFZLEVBQUU7Z0JBQ3BDLGVBQWU7Z0JBQ2YsT0FBTztnQkFDUCxrQkFBa0I7Z0JBQ2xCLGdCQUFnQjtnQkFDaEIsWUFBWTtnQkFDWixpQkFBaUI7Z0JBQ2pCLFlBQVk7Z0JBQ1osWUFBWTtnQkFDWixTQUFTO2FBQ1YsQ0FBQyxFQUFFLENBQUM7WUFDTCxPQUFPLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUN4RSxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBQzVCLElBQUksWUFBWSxDQUFDLGFBQWEsS0FBSyxDQUFDO2VBQy9CLENBQUMsbUJBQW1CLENBQUMsWUFBWSxDQUFDLGdCQUFnQixDQUFDO2VBQ25ELENBQUMsbUJBQW1CLENBQUMsWUFBWSxDQUFDLGNBQWMsQ0FBQztlQUNqRCxDQUFDLHFCQUFxQixDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUM7ZUFDL0MsQ0FBQyxxQkFBcUIsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDO2VBQy9DLENBQUMscUJBQXFCLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQztlQUM5QyxZQUFZLENBQUMsVUFBcUIsSUFBSyxZQUFZLENBQUMsVUFBcUI7ZUFDMUUsT0FBTyxZQUFZLENBQUMsZUFBZSxLQUFLLFFBQVE7ZUFDaEQsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDNUQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDO2VBQ25DLFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDakMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsaUJBQWlCLEVBQUUsQ0FBQztZQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDRFQUE0RSxDQUFDLENBQUM7WUFDMUYsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQztRQUNELE1BQU0sY0FBYyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7UUFDekMsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUMxQyxNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ3BDLElBQUksZUFBbUMsQ0FBQztRQUN4QyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLElBQUksWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQ2hFLElBQUksQ0FBQyxlQUFlLENBQUMsU0FBUyxDQUFDO21CQUMxQixDQUFDLG1CQUFtQixDQUFDLFNBQVMsRUFBRTtvQkFDakMsZUFBZTtvQkFDZixnQkFBZ0I7b0JBQ2hCLGFBQWE7b0JBQ2IsVUFBVTtvQkFDVixVQUFVO2lCQUNYLENBQUM7bUJBQ0MsQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDO21CQUM3QyxDQUFDLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUM7bUJBQzlDLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQzttQkFDM0MsQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDO21CQUN4QyxTQUFTLENBQUMsY0FBYyxLQUFLLFlBQVksQ0FBQyxjQUFjO21CQUN4RCxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsUUFBdUMsQ0FBQyxFQUFFLENBQUM7Z0JBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0NBQXNDLEtBQUsscUJBQXFCLENBQUMsQ0FBQztnQkFDOUUsU0FBUztZQUNYLENBQUM7WUFDRCxNQUFNLE9BQU8sR0FBRyxHQUFHLFNBQVMsQ0FBQyxhQUFhLEtBQUssU0FBUyxDQUFDLGNBQWMsS0FDckUsU0FBUyxDQUFDLFdBQ1osS0FBSyxTQUFTLENBQUMsUUFBUSxLQUFLLFNBQVMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNqRCxJQUFJLGVBQWUsS0FBSyxTQUFTLElBQUksT0FBTyxJQUFJLGVBQWUsRUFBRSxDQUFDO2dCQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLDREQUE0RCxDQUFDLENBQUM7WUFDNUUsQ0FBQztZQUNELGVBQWUsR0FBRyxPQUFPLENBQUM7WUFDMUIsTUFBTSxVQUFVLEdBQUcsR0FBRyxTQUFTLENBQUMsY0FBYyxLQUFLLFNBQVMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUMzRSxJQUFJLGNBQWMsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQzttQkFDMUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUM7bUJBQy9CLFNBQVMsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0RBQWtELENBQUMsQ0FBQztZQUNsRSxDQUFDO1lBQ0QsY0FBYyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDNUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUNoQyxTQUFTLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNwQyxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDbEIsWUFBWSxDQUFDLGVBQWUsS0FBSyxNQUFNLG9DQUFvQyxDQUM1RSxZQUEwRCxDQUMzRCxFQUFFLENBQUM7WUFDSixNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUNuRSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FDNUMsWUFBd0MsRUFDeEMsTUFBYyxFQUNtQyxFQUFFLENBQUMsQ0FDcEQsWUFBWSxDQUFDLEtBQUssS0FBSyxPQUFPO09BQzNCLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDO09BQzVCLE1BQU0sSUFBSSxZQUFZLENBQUMsVUFBVTtPQUNqQyxNQUFNLEdBQUcsWUFBWSxDQUFDLFVBQVUsQ0FDcEMsQ0FBQyJ9

package/dist_ts/data/secret.d.ts

@@ -2,7 +2,7 @@ import * as plugins from '../plugins.js';
 import type { TSha256Digest } from './immutableimage.js';
 export type TSecretEnvironment = string;
 export type TSecretLifecycleState = 'active' | 'retired' | 'revoked' | 'deleted';
-export type TSecretVersionLifecycleState = 'active' | 'retired' | 'revoked' | 'purged';
+export type TSecretVersionLifecycleState = 'active' | 'retired' | 'revoked' | 'purge-pending' | 'purged';
 /** Retired versions remain usable only through an already-accepted manifest. */
 export declare const isSecretVersionMaterialIssuable: (lifecycleStateArg: TSecretVersionLifecycleState, referencedByAcceptedManifestArg: boolean) => boolean;
 export type TSecretManagementSource = 'operator' | 'appstore' | 'mail' | 'oidc' | 'webpush' | 'platform' | 'system';
@@ -36,6 +36,9 @@ export interface ISecretVersionRetentionReference {
     resourceId: string;
     expiresAt?: number;
 }
+export declare const secretVersionRetentionReferenceLimits: Readonly<{
+    pageSizeMaximum: 256;
+}>;
 /** Browser-safe logical secret metadata. It never contains value material. */
 export interface ISecretMetadata {
     id: string;
@@ -65,14 +68,53 @@ export interface ISecretMetadata {
 export interface ISecretVersionMetadata {
     id: string;
     secretId: string;
+    revision: number;
     lifecycleState: TSecretVersionLifecycleState;
     createdAt: number;
     createdBy: string;
     source: TSecretManagementSource;
     retiredAt?: number;
     revokedAt?: number;
+    purgeOperationId?: string;
     purgedAt?: number;
 }
+/** Irreversibly erases every platform-managed copy after all references are gone. */
+export interface ISecretVersionPurgeIntentV1 {
+    schemaVersion: 1;
+    mutationId: string;
+    secretId: string;
+    secretVersionId: string;
+    expectedSecretRevision: number;
+    expectedSecretVersionRevision: number;
+    expectedTargetSecretsRevision: number;
+}
+export interface ISecretVersionPurgeFailureV1 {
+    code: string;
+    retryable: boolean;
+    failedAt: number;
+}
+interface ISecretVersionPurgeOperationBaseV1 {
+    schemaVersion: 1;
+    id: string;
+    revision: number;
+    intent: ISecretVersionPurgeIntentV1;
+    intentDigest: TSha256Digest;
+    createdAt: number;
+    updatedAt: number;
+}
+export type TSecretVersionPurgeOperationV1 = (ISecretVersionPurgeOperationBaseV1 & {
+    state: 'pending' | 'erasing';
+    failure?: never;
+    purgedAt?: never;
+}) | (ISecretVersionPurgeOperationBaseV1 & {
+    state: 'failed';
+    failure: ISecretVersionPurgeFailureV1;
+    purgedAt?: never;
+}) | (ISecretVersionPurgeOperationBaseV1 & {
+    state: 'succeeded';
+    failure?: never;
+    purgedAt: number;
+});
 export interface ISecretSetMetadata {
     id: string;
     organizationId: string;
@@ -219,9 +261,17 @@ export interface IServiceSecretDeploymentPlan {
 export declare const resolvedSecretManifestReferencesEqual: (leftArg: IResolvedSecretManifestReference | undefined, rightArg: IResolvedSecretManifestReference | undefined) => boolean;
 export declare const isResolvedSecretManifestReferenceAccepted: (stateArg: IClusterSecretDeploymentState, referenceArg: IResolvedSecretManifestReference, nowArg: number) => boolean;
 export declare const validateSecretMutationId: (mutationIdArg: unknown) => string[];
+export declare const validateSecretVersionRetentionReferences: (referencesArg: unknown) => string[];
+export declare const validateSecretVersionMetadata: (versionArg: unknown) => string[];
+export declare const validateSecretVersionPurgeIntent: (intentArg: unknown) => string[];
+export declare const createSecretVersionPurgeIntentDigestInput: (intentArg: ISecretVersionPurgeIntentV1) => string;
+export declare const computeSecretVersionPurgeIntentDigest: (intentArg: ISecretVersionPurgeIntentV1) => Promise<TSha256Digest>;
+export declare const verifySecretVersionPurgeIntentDigest: (intentArg: ISecretVersionPurgeIntentV1, digestArg: unknown) => Promise<boolean>;
+export declare const validateSecretVersionPurgeOperation: (operationArg: unknown) => Promise<string[]>;
 export declare const validateSecretOwner: (ownerArg: unknown) => string[];
 export declare const validateSecretManagementScope: (sourceArg: TSecretManagementSource, scopeArg: unknown) => string[];
 export declare const validateSecretDelivery: (deliveryArg: unknown) => string[];
+export declare const validateSecretMetadata: (secretArg: unknown) => string[];
 export declare const validateSecretValueInput: (valueInputArg: unknown) => string[];
 /** Checks the SmartCrypto context digest without opening or decrypting the envelope. */
 export declare const verifySecretEnvelopeContext: (envelopeArg: unknown, contextArg: unknown) => Promise<boolean>;
@@ -316,7 +366,6 @@ export interface IRevokedSecretRecipientMetadata extends ISecretRecipientMetadat
     revokedAt: number;
 }
 export type TSecretRecipientMetadata = IActiveSecretRecipientMetadata | IRetiringSecretRecipientMetadata | IRevokedSecretRecipientMetadata;
-export type TSecretIngressRecipient = TSecretRecipientMetadata;
 export declare const secretRecipientLimits: Readonly<{
     maximumRecipients: 64;
 }>;
@@ -325,8 +374,6 @@ export declare const validateSecretRecipientSet: (recipientsArg: unknown) => str
 /** New envelopes target only active recipients. */
 export declare const canIssueNewSecretEnvelope: (recipientArg: TSecretRecipientMetadata) => boolean;
 export declare const validateSecretValueInputForRecipient: (valueInputArg: unknown, recipientArg: TSecretRecipientMetadata, expectedContextArg: Uint8Array) => Promise<string[]>;
-/** Retiring recipients open only already-issued envelopes before their deadline. */
-export declare const canOpenIssuedSecretEnvelope: (recipientArg: TSecretRecipientMetadata, issuedAtArg: number, nowArg: number) => boolean;
 export declare const createSecretCreateEnvelopeContext: (contextArg: {
     mutationId: string;
     target: TSecretMutationTarget;