@serve.zone/interfaces 25.1.0 → 25.2.0

package/dist_ts/platform/objectstorageretention.js

@@ -0,0 +1,255 @@
+import { createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
+export const objectStorageRetentionLimits = Object.freeze({
+    maximumPolicyIdLength: 96,
+    maximumRetentionDurationSeconds: 100 * 366 * 24 * 60 * 60,
+});
+const policyIdPattern = /^[A-Za-z0-9._-]{1,96}$/;
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const sha256Pattern = /^[a-f0-9]{64}$/;
+const etagPattern = /^[a-f0-9]{32}$/;
+const sentinelKeyPattern = /^\.smartstorage-retention\/v1\/sentinel-[a-f0-9]{64}\.json$/;
+const isRecord = (valueArg) => (Boolean(valueArg)
+    && typeof valueArg === 'object'
+    && !Array.isArray(valueArg)
+    && (Object.getPrototypeOf(valueArg) === Object.prototype
+        || Object.getPrototypeOf(valueArg) === null));
+const hasExactKeys = (valueArg, keysArg) => {
+    const actualKeys = Object.keys(valueArg).sort();
+    const expectedKeys = [...keysArg].sort();
+    return actualKeys.length === expectedKeys.length
+        && actualKeys.every((keyArg, indexArg) => keyArg === expectedKeys[indexArg]);
+};
+const isPositiveSafeInteger = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg > 0);
+export const validateObjectStorageRetentionIntent = (intentArg, pathArg = 'objectstorage retention intent') => {
+    if (!isRecord(intentArg)
+        || !hasExactKeys(intentArg, ['mode', 'policyId', 'retentionDurationSeconds'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (intentArg.mode !== 'compliance'
+        || typeof intentArg.policyId !== 'string'
+        || !policyIdPattern.test(intentArg.policyId)) {
+        errors.push(`${pathArg} must identify a canonical compliance policy`);
+    }
+    if (!isPositiveSafeInteger(intentArg.retentionDurationSeconds)
+        || intentArg.retentionDurationSeconds
+            > objectStorageRetentionLimits.maximumRetentionDurationSeconds) {
+        errors.push(`${pathArg} duration must be a positive bounded safe integer`);
+    }
+    return errors;
+};
+export const createObjectStorageRetentionRetainUntil = (createdAtArg, retentionDurationSecondsArg) => {
+    if (!isPositiveSafeInteger(createdAtArg)
+        || !isPositiveSafeInteger(retentionDurationSecondsArg)
+        || retentionDurationSecondsArg > objectStorageRetentionLimits.maximumRetentionDurationSeconds) {
+        throw new Error('objectstorage retention arithmetic requires positive bounded safe integers');
+    }
+    const retainUntil = createdAtArg + retentionDurationSecondsArg * 1000;
+    if (!Number.isSafeInteger(retainUntil) || retainUntil <= createdAtArg) {
+        throw new Error('objectstorage retention retainUntil exceeds safe integer bounds');
+    }
+    return retainUntil;
+};
+export const createObjectStorageRetentionIntentDigestInput = (intentArg) => {
+    const errors = validateObjectStorageRetentionIntent(intentArg);
+    if (errors.length > 0)
+        throw new Error(errors[0]);
+    return JSON.stringify({
+        capability: 'objectstorage',
+        retention: {
+            mode: intentArg.mode,
+            policyId: intentArg.policyId,
+            retentionDurationSeconds: intentArg.retentionDurationSeconds,
+        },
+        version: 1,
+    });
+};
+export const computeObjectStorageRetentionIntentSha256 = async (intentArg) => createCanonicalJsonSha256Hex(createObjectStorageRetentionIntentDigestInput(intentArg), (reasonArg) => { throw new Error(reasonArg); });
+export const objectStorageRetentionIntentsEqual = (leftArg, rightArg) => validateObjectStorageRetentionIntent(leftArg).length === 0
+    && validateObjectStorageRetentionIntent(rightArg).length === 0
+    && leftArg.mode
+        === rightArg.mode
+    && leftArg.policyId
+        === rightArg.policyId
+    && leftArg.retentionDurationSeconds
+        === rightArg.retentionDurationSeconds;
+const retentionIntentFieldsEqual = (leftArg, rightArg) => isRecord(leftArg)
+    && isRecord(rightArg)
+    && leftArg.mode === 'compliance'
+    && rightArg.mode === 'compliance'
+    && typeof leftArg.policyId === 'string'
+    && leftArg.policyId === rightArg.policyId
+    && isPositiveSafeInteger(leftArg.retentionDurationSeconds)
+    && leftArg.retentionDurationSeconds === rightArg.retentionDurationSeconds;
+export const validateObjectStorageRetentionEvidence = async (evidenceArg, expectedArg) => {
+    if (!isRecord(evidenceArg)
+        || !hasExactKeys(evidenceArg, [
+            'intent',
+            'intentSha256',
+            'authority',
+            'capability',
+            'receipt',
+            'verifiedAt',
+        ])) {
+        return ['objectstorage retention evidence must use its exact schema'];
+    }
+    const errors = validateObjectStorageRetentionIntent(evidenceArg.intent);
+    const intent = evidenceArg.intent;
+    if (!retentionIntentFieldsEqual(intent, expectedArg.intent)) {
+        errors.push('objectstorage retention evidence intent must equal the expected intent');
+    }
+    if (typeof evidenceArg.intentSha256 !== 'string'
+        || !sha256Pattern.test(evidenceArg.intentSha256)
+        || errors.length === 0
+            && evidenceArg.intentSha256 !== await computeObjectStorageRetentionIntentSha256(intent)) {
+        errors.push('objectstorage retention intent digest must exactly match the intent');
+    }
+    const authority = evidenceArg.authority;
+    if (!isRecord(authority)
+        || !hasExactKeys(authority, [
+            'serviceId',
+            'bindingId',
+            'reconciliationGeneration',
+            'bindingRequestDigest',
+        ])
+        || typeof authority.serviceId !== 'string'
+        || !identifierPattern.test(authority.serviceId)
+        || authority.serviceId !== expectedArg.serviceId
+        || typeof authority.bindingId !== 'string'
+        || !identifierPattern.test(authority.bindingId)
+        || authority.bindingId !== expectedArg.bindingId
+        || !isPositiveSafeInteger(authority.reconciliationGeneration)
+        || authority.reconciliationGeneration !== expectedArg.reconciliationGeneration
+        || typeof authority.bindingRequestDigest !== 'string'
+        || !sha256Pattern.test(authority.bindingRequestDigest)
+        || authority.bindingRequestDigest !== expectedArg.bindingRequestDigest) {
+        errors.push('objectstorage retention evidence authority must match the trusted binding fence');
+    }
+    const capability = evidenceArg.capability;
+    if (!isRecord(capability)
+        || !hasExactKeys(capability, [
+            'version',
+            'supported',
+            'backend',
+            'modes',
+            'atomicCreateOnly',
+            'retainedMultipartSupported',
+        ])
+        || capability.version !== 1
+        || capability.supported !== true
+        || (capability.backend !== 'standalone' && capability.backend !== 'clustered')
+        || !Array.isArray(capability.modes)
+        || capability.modes.length !== 1
+        || capability.modes[0] !== 'compliance'
+        || capability.atomicCreateOnly !== true
+        || capability.retainedMultipartSupported !== false) {
+        errors.push('objectstorage retention capability evidence must be exact');
+    }
+    const receipt = evidenceArg.receipt;
+    if (!isRecord(receipt)
+        || !hasExactKeys(receipt, [
+            'mode',
+            'policyId',
+            'retentionDurationSeconds',
+            'bucketName',
+            'configuredAt',
+            'sentinelKey',
+            'sentinel',
+        ])) {
+        errors.push('objectstorage retention receipt must use its exact schema');
+        return errors;
+    }
+    if (!retentionIntentFieldsEqual(receipt, intent)) {
+        errors.push('objectstorage retention receipt intent must equal its evidence intent');
+    }
+    if (typeof receipt.bucketName !== 'string'
+        || receipt.bucketName.length === 0
+        || receipt.bucketName.length > 200
+        || receipt.bucketName !== expectedArg.bucketName) {
+        errors.push('objectstorage retention receipt bucket must exactly match');
+    }
+    if (!isPositiveSafeInteger(receipt.configuredAt)
+        || typeof receipt.sentinelKey !== 'string'
+        || !sentinelKeyPattern.test(receipt.sentinelKey)) {
+        errors.push('objectstorage retention receipt configuration evidence must be canonical');
+    }
+    const sentinel = receipt.sentinel;
+    if (!isRecord(sentinel)
+        || !hasExactKeys(sentinel, [
+            'version',
+            'mode',
+            'policyId',
+            'retentionDurationSeconds',
+            'createdAt',
+            'retainUntil',
+            'payloadSha256',
+            'metadataSha256',
+            'etag',
+        ])) {
+        errors.push('objectstorage retention sentinel evidence must use its exact schema');
+        return errors;
+    }
+    if (sentinel.version !== 1 || !retentionIntentFieldsEqual(sentinel, intent)) {
+        errors.push('objectstorage retention sentinel intent must equal its evidence intent');
+    }
+    if (!isPositiveSafeInteger(sentinel.createdAt)
+        || !isPositiveSafeInteger(sentinel.retainUntil)
+        || !isPositiveSafeInteger(receipt.configuredAt)
+        || sentinel.createdAt < receipt.configuredAt) {
+        errors.push('objectstorage retention timestamps must be positive and ordered');
+    }
+    else {
+        try {
+            if (sentinel.retainUntil !== createObjectStorageRetentionRetainUntil(sentinel.createdAt, intent.retentionDurationSeconds)) {
+                errors.push('objectstorage retention retainUntil must equal createdAt plus duration');
+            }
+        }
+        catch {
+            errors.push('objectstorage retention retainUntil arithmetic must be safe');
+        }
+    }
+    if (typeof sentinel.payloadSha256 !== 'string' || !sha256Pattern.test(sentinel.payloadSha256)
+        || typeof sentinel.metadataSha256 !== 'string' || !sha256Pattern.test(sentinel.metadataSha256)
+        || typeof sentinel.etag !== 'string' || !etagPattern.test(sentinel.etag)) {
+        errors.push('objectstorage retention sentinel digests and ETag must be canonical');
+    }
+    if (!isPositiveSafeInteger(evidenceArg.verifiedAt)
+        || !isPositiveSafeInteger(sentinel.createdAt)
+        || evidenceArg.verifiedAt < sentinel.createdAt) {
+        errors.push('objectstorage retention verification timestamp must follow sentinel creation');
+    }
+    return errors;
+};
+export const validateObjectStorageRetentionBinding = async (bindingArg, expectedArg) => {
+    if (!isRecord(bindingArg)
+        || !Object.hasOwn(bindingArg, 'schemaVersion')
+        || !Object.hasOwn(bindingArg, 'intent')
+        || Object.keys(bindingArg).some((keyArg) => !['schemaVersion', 'intent', 'evidence'].includes(keyArg))) {
+        return ['objectstorage retention binding must use its exact schema'];
+    }
+    const errors = bindingArg.schemaVersion === 1
+        ? validateObjectStorageRetentionIntent(bindingArg.intent)
+        : ['objectstorage retention binding schemaVersion must be 1'];
+    if (!retentionIntentFieldsEqual(bindingArg.intent, expectedArg.intent)) {
+        errors.push('objectstorage retention binding intent must equal the trusted expected intent');
+    }
+    if (bindingArg.evidence !== undefined) {
+        errors.push(...await validateObjectStorageRetentionEvidence(bindingArg.evidence, expectedArg));
+    }
+    return errors;
+};
+export const validatePlatformBindingObjectStorageRetention = async (bindingArg, expectedArg) => {
+    if (!isRecord(bindingArg)) {
+        return ['platform objectstorage retention binding must be an object'];
+    }
+    if (bindingArg.capability !== 'objectstorage'
+        || bindingArg.id !== expectedArg.bindingId
+        || bindingArg.serviceId !== expectedArg.serviceId) {
+        return ['platform objectstorage retention must match an objectstorage binding authority'];
+    }
+    if (bindingArg.objectstorageRetention === undefined) {
+        return ['platform objectstorage retention binding must contain retention intent'];
+    }
+    return validateObjectStorageRetentionBinding(bindingArg.objectstorageRetention, expectedArg);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2JqZWN0c3RvcmFnZXJldGVudGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL29iamVjdHN0b3JhZ2VyZXRlbnRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFFM0UsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN4RCxxQkFBcUIsRUFBRSxFQUFFO0lBQ3pCLCtCQUErQixFQUFFLEdBQUcsR0FBRyxHQUFHLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFO0NBQzFELENBQUMsQ0FBQztBQWdFSCxNQUFNLGVBQWUsR0FBRyx3QkFBd0IsQ0FBQztBQUNqRCxNQUFNLGlCQUFpQixHQUFHLHFDQUFxQyxDQUFDO0FBQ2hFLE1BQU0sYUFBYSxHQUFHLGdCQUFnQixDQUFDO0FBQ3ZDLE1BQU0sV0FBVyxHQUFHLGdCQUFnQixDQUFDO0FBQ3JDLE1BQU0sa0JBQWtCLEdBQUcsNkRBQTZELENBQUM7QUFFekYsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsQ0FDM0UsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUNkLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDNUIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUN4QixDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssTUFBTSxDQUFDLFNBQVM7V0FDbkQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQ25CLFFBQWlDLEVBQ2pDLE9BQTBCLEVBQ2pCLEVBQUU7SUFDWCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2hELE1BQU0sWUFBWSxHQUFHLENBQUMsR0FBRyxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN6QyxPQUFPLFVBQVUsQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLE1BQU07V0FDM0MsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLE1BQU0sS0FBSyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUNqRixDQUFDLENBQUM7QUFFRixNQUFNLHFCQUFxQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3ZFLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUssUUFBbUIsR0FBRyxDQUFDLENBQzNELENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxDQUNsRCxTQUFrQixFQUNsQixPQUFPLEdBQUcsZ0NBQWdDLEVBQ2hDLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztXQUNuQixDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUUsQ0FBQyxNQUFNLEVBQUUsVUFBVSxFQUFFLDBCQUEwQixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksU0FBUyxDQUFDLElBQUksS0FBSyxZQUFZO1dBQzlCLE9BQU8sU0FBUyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3RDLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUMvQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsU0FBUyxDQUFDLHdCQUF3QixDQUFDO1dBQ3hELFNBQVMsQ0FBQyx3QkFBbUM7Y0FDN0MsNEJBQTRCLENBQUMsK0JBQStCLEVBQUUsQ0FBQztRQUNuRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxtREFBbUQsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxZQUFvQixFQUNwQiwyQkFBbUMsRUFDM0IsRUFBRTtJQUNWLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxZQUFZLENBQUM7V0FDbkMsQ0FBQyxxQkFBcUIsQ0FBQywyQkFBMkIsQ0FBQztXQUNuRCwyQkFBMkIsR0FBRyw0QkFBNEIsQ0FBQywrQkFBK0IsRUFBRSxDQUFDO1FBQ2hHLE1BQU0sSUFBSSxLQUFLLENBQUMsNEVBQTRFLENBQUMsQ0FBQztJQUNoRyxDQUFDO0lBQ0QsTUFBTSxXQUFXLEdBQUcsWUFBWSxHQUFHLDJCQUEyQixHQUFHLElBQUksQ0FBQztJQUN0RSxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxXQUFXLElBQUksWUFBWSxFQUFFLENBQUM7UUFDdEUsTUFBTSxJQUFJLEtBQUssQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxPQUFPLFdBQVcsQ0FBQztBQUNyQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxTQUEwQyxFQUNsQyxFQUFFO0lBQ1YsTUFBTSxNQUFNLEdBQUcsb0NBQW9DLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDL0QsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2xELE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNwQixVQUFVLEVBQUUsZUFBZTtRQUMzQixTQUFTLEVBQUU7WUFDVCxJQUFJLEVBQUUsU0FBUyxDQUFDLElBQUk7WUFDcEIsUUFBUSxFQUFFLFNBQVMsQ0FBQyxRQUFRO1lBQzVCLHdCQUF3QixFQUFFLFNBQVMsQ0FBQyx3QkFBd0I7U0FDN0Q7UUFDRCxPQUFPLEVBQUUsQ0FBQztLQUNYLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLEtBQUssRUFDNUQsU0FBMEMsRUFDekIsRUFBRSxDQUFDLDRCQUE0QixDQUNoRCw2Q0FBNkMsQ0FBQyxTQUFTLENBQUMsRUFDeEQsQ0FBQyxTQUFTLEVBQUUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQy9DLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUNoRCxPQUFnQixFQUNoQixRQUFpQixFQUNSLEVBQUUsQ0FBQyxvQ0FBb0MsQ0FBQyxPQUFPLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQztPQUNuRSxvQ0FBb0MsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQztPQUMxRCxPQUEyQyxDQUFDLElBQUk7WUFDN0MsUUFBNEMsQ0FBQyxJQUFJO09BQ3BELE9BQTJDLENBQUMsUUFBUTtZQUNqRCxRQUE0QyxDQUFDLFFBQVE7T0FDeEQsT0FBMkMsQ0FBQyx3QkFBd0I7WUFDakUsUUFBNEMsQ0FBQyx3QkFBd0IsQ0FBQztBQUUvRSxNQUFNLDBCQUEwQixHQUFHLENBQ2pDLE9BQWdCLEVBQ2hCLFFBQWlCLEVBQ1IsRUFBRSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7T0FDMUIsUUFBUSxDQUFDLFFBQVEsQ0FBQztPQUNsQixPQUFPLENBQUMsSUFBSSxLQUFLLFlBQVk7T0FDN0IsUUFBUSxDQUFDLElBQUksS0FBSyxZQUFZO09BQzlCLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO09BQ3BDLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDLFFBQVE7T0FDdEMscUJBQXFCLENBQUMsT0FBTyxDQUFDLHdCQUF3QixDQUFDO09BQ3ZELE9BQU8sQ0FBQyx3QkFBd0IsS0FBSyxRQUFRLENBQUMsd0JBQXdCLENBQUM7QUFFNUUsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsS0FBSyxFQUN6RCxXQUFvQixFQUNwQixXQUF5RCxFQUN0QyxFQUFFO0lBQ3JCLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO1dBQ3JCLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRTtZQUM1QixRQUFRO1lBQ1IsY0FBYztZQUNkLFdBQVc7WUFDWCxZQUFZO1lBQ1osU0FBUztZQUNULFlBQVk7U0FDYixDQUFDLEVBQUUsQ0FBQztRQUNMLE9BQU8sQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxvQ0FBb0MsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDeEUsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLE1BQXlDLENBQUM7SUFDckUsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1RCxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksT0FBTyxXQUFXLENBQUMsWUFBWSxLQUFLLFFBQVE7V0FDM0MsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUM7V0FDN0MsTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ2pCLFdBQVcsQ0FBQyxZQUFZLEtBQUssTUFBTSx5Q0FBeUMsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVGLE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBRUQsTUFBTSxTQUFTLEdBQUcsV0FBVyxDQUFDLFNBQVMsQ0FBQztJQUN4QyxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztXQUNuQixDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUU7WUFDMUIsV0FBVztZQUNYLFdBQVc7WUFDWCwwQkFBMEI7WUFDMUIsc0JBQXNCO1NBQ3ZCLENBQUM7V0FDQyxPQUFPLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQzVDLFNBQVMsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDN0MsT0FBTyxTQUFTLENBQUMsU0FBUyxLQUFLLFFBQVE7V0FDdkMsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQztXQUM1QyxTQUFTLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQzdDLENBQUMscUJBQXFCLENBQUMsU0FBUyxDQUFDLHdCQUF3QixDQUFDO1dBQzFELFNBQVMsQ0FBQyx3QkFBd0IsS0FBSyxXQUFXLENBQUMsd0JBQXdCO1dBQzNFLE9BQU8sU0FBUyxDQUFDLG9CQUFvQixLQUFLLFFBQVE7V0FDbEQsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxvQkFBb0IsQ0FBQztXQUNuRCxTQUFTLENBQUMsb0JBQW9CLEtBQUssV0FBVyxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyxpRkFBaUYsQ0FBQyxDQUFDO0lBQ2pHLENBQUM7SUFFRCxNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsVUFBVSxDQUFDO0lBQzFDLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1dBQ3BCLENBQUMsWUFBWSxDQUFDLFVBQVUsRUFBRTtZQUMzQixTQUFTO1lBQ1QsV0FBVztZQUNYLFNBQVM7WUFDVCxPQUFPO1lBQ1Asa0JBQWtCO1lBQ2xCLDRCQUE0QjtTQUM3QixDQUFDO1dBQ0MsVUFBVSxDQUFDLE9BQU8sS0FBSyxDQUFDO1dBQ3hCLFVBQVUsQ0FBQyxTQUFTLEtBQUssSUFBSTtXQUM3QixDQUFDLFVBQVUsQ0FBQyxPQUFPLEtBQUssWUFBWSxJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssV0FBVyxDQUFDO1dBQzNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1dBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDN0IsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxZQUFZO1dBQ3BDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJO1dBQ3BDLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUM7SUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7V0FDakIsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFO1lBQ3hCLE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFlBQVk7WUFDWixjQUFjO1lBQ2QsYUFBYTtZQUNiLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUN6RSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxVQUFVLEtBQUssUUFBUTtXQUNyQyxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQy9CLE9BQU8sQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLEdBQUc7V0FDL0IsT0FBTyxDQUFDLFVBQVUsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDbkQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQztXQUMzQyxPQUFPLE9BQU8sQ0FBQyxXQUFXLEtBQUssUUFBUTtXQUN2QyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLDBFQUEwRSxDQUFDLENBQUM7SUFDMUYsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUM7SUFDbEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEIsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFO1lBQ3pCLFNBQVM7WUFDVCxNQUFNO1lBQ04sVUFBVTtZQUNWLDBCQUEwQjtZQUMxQixXQUFXO1lBQ1gsYUFBYTtZQUNiLGVBQWU7WUFDZixnQkFBZ0I7WUFDaEIsTUFBTTtTQUNQLENBQUMsRUFBRSxDQUFDO1FBQ0wsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO1FBQ25GLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssQ0FBQyxJQUFJLENBQUMsMEJBQTBCLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUUsTUFBTSxDQUFDLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztXQUN6QyxDQUFDLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDNUMsQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1dBQzNDLFFBQVEsQ0FBQyxTQUFvQixHQUFJLE9BQU8sQ0FBQyxZQUF1QixFQUFFLENBQUM7UUFDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7U0FBTSxDQUFDO1FBQ04sSUFBSSxDQUFDO1lBQ0gsSUFBSSxRQUFRLENBQUMsV0FBVyxLQUFLLHVDQUF1QyxDQUNsRSxRQUFRLENBQUMsU0FBUyxFQUNsQixNQUFNLENBQUMsd0JBQXdCLENBQ2hDLEVBQUUsQ0FBQztnQkFDRixNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7WUFDeEYsQ0FBQztRQUNILENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLENBQUMsSUFBSSxDQUFDLDZEQUE2RCxDQUFDLENBQUM7UUFDN0UsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLE9BQU8sUUFBUSxDQUFDLGFBQWEsS0FBSyxRQUFRLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUM7V0FDeEYsT0FBTyxRQUFRLENBQUMsY0FBYyxLQUFLLFFBQVEsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQztXQUMzRixPQUFPLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDO1dBQzdDLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztXQUN6QyxXQUFXLENBQUMsVUFBcUIsR0FBSSxRQUFRLENBQUMsU0FBb0IsRUFBRSxDQUFDO1FBQ3pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOEVBQThFLENBQUMsQ0FBQztJQUM5RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsS0FBSyxFQUN4RCxVQUFtQixFQUNuQixXQUF5RCxFQUN0QyxFQUFFO0lBQ3JCLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1dBQ3BCLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsZUFBZSxDQUFDO1dBQzNDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDO1dBQ3BDLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3pHLE9BQU8sQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxVQUFVLENBQUMsYUFBYSxLQUFLLENBQUM7UUFDM0MsQ0FBQyxDQUFDLG9DQUFvQyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7UUFDekQsQ0FBQyxDQUFDLENBQUMseURBQXlELENBQUMsQ0FBQztJQUNoRSxJQUFJLENBQUMsMEJBQTBCLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN2RSxNQUFNLENBQUMsSUFBSSxDQUFDLCtFQUErRSxDQUFDLENBQUM7SUFDL0YsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN0QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsTUFBTSxzQ0FBc0MsQ0FDekQsVUFBVSxDQUFDLFFBQVEsRUFDbkIsV0FBVyxDQUNaLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxLQUFLLEVBQ2hFLFVBQW1CLEVBQ25CLFdBQXlELEVBQ3RDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFCLE9BQU8sQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxVQUFVLEtBQUssZUFBZTtXQUN4QyxVQUFVLENBQUMsRUFBRSxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQ3ZDLFVBQVUsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ3BELE9BQU8sQ0FBQyxnRkFBZ0YsQ0FBQyxDQUFDO0lBQzVGLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxzQkFBc0IsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNwRCxPQUFPLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsT0FBTyxxQ0FBcUMsQ0FBQyxVQUFVLENBQUMsc0JBQXNCLEVBQUUsV0FBVyxDQUFDLENBQUM7QUFDL0YsQ0FBQyxDQUFDIn0=

package/dist_ts/platform/types.d.ts

@@ -1,4 +1,5 @@
 import type { TSecretManagementScope } from '../data/secret.js';
+import type { IObjectStorageRetentionBindingV1 } from './objectstorageretention.js';
 export type TPlatformCapability = 'email' | 'sms' | 'pushnotification' | 'letter' | 'ai' | 'database' | 'objectstorage' | 'logging' | 'backup' | 'sip';
 export type TPlatformAccessMode = 'rpc' | 'binding' | 'sidecar' | 'internal';
 export type TPlatformBindingStatus = 'requested' | 'provisioning' | 'ready' | 'degraded' | 'failed' | 'disabled';
@@ -39,6 +40,8 @@ export interface IPlatformBinding {
     endpoints?: IPlatformServiceEndpoint[];
     /** Value-free reconciliation scope for service-owned credentials. */
     credentialManagementScope?: Extract<TSecretManagementScope, `platform:${string}`>;
+    /** Capability-specific value-free immutable-retention intent and evidence. */
+    objectstorageRetention?: IObjectStorageRetentionBindingV1;
     createdAt?: number;
     updatedAt?: number;
 }

package/dist_ts/plugins.runtime.d.ts

@@ -0,0 +1,2 @@
+import * as crypto from 'node:crypto';
+export { crypto };

package/dist_ts/plugins.runtime.js

@@ -0,0 +1,4 @@
+// node native scope for the Node-only /runtime export
+import * as crypto from 'node:crypto';
+export { crypto };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5ydW50aW1lLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvcGx1Z2lucy5ydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLHNEQUFzRDtBQUN0RCxPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUV0QyxPQUFPLEVBQUUsTUFBTSxFQUFFLENBQUMifQ==

package/dist_ts/requests/config.d.ts

@@ -4,6 +4,7 @@ import * as serverInterfaces from '../data/server.js';
 import * as userInterfaces from '../data/user.js';
 import type { IService } from '../data/service.js';
 import type { IPlatformBinding, IPlatformProviderConfig } from '../platform/types.js';
+import type { ICorestoreCredentialPublicationGrantV1 } from '../runtime.corestore.js';
 export interface IRequest_Any_Cloudly_GetServerConfig extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetServerConfig> {
     method: 'getServerConfig';
     request: {
@@ -24,6 +25,7 @@ export interface IRequest_Any_Cloudly_GetClusterConfig extends plugins.typedrequ
         services: IService[];
         platformProviderConfigs?: IPlatformProviderConfig[];
         platformBindings?: IPlatformBinding[];
+        corestoreCredentialPublicationGrants?: ICorestoreCredentialPublicationGrantV1[];
     };
 }
 export interface IRequest_Cloudly_Coreflow_PushClusterConfig extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Cloudly_Coreflow_PushClusterConfig> {
@@ -33,6 +35,7 @@ export interface IRequest_Cloudly_Coreflow_PushClusterConfig extends plugins.typ
         services: IService[];
         platformProviderConfigs?: IPlatformProviderConfig[];
         platformBindings?: IPlatformBinding[];
+        corestoreCredentialPublicationGrants?: ICorestoreCredentialPublicationGrantV1[];
     };
     response: {};
 }