@serve.zone/interfaces 32.1.0 → 32.2.0

package/dist_ts/private/storagecontract.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The readers a storage control body is judged by, and the one normalizer that turns a storage
+ * request into the exact value its digest is taken over.
+ *
+ * Two modules judge the same bytes in their own error vocabulary — `platform/storage.ts` for a
+ * storage request on its own and `platform/storagemigration.ts` for the migration control plane
+ * that carries one — so the rules take the failure they report through. A second copy of them
+ * would be a second answer to what a request is, and a request digest that a control plane issues
+ * and a consumer re-derives would stop being one value.
+ */
+import type { IAppStoreFilesystemStorageRequest, IAppStoreObjectStorageRequest, TAppStoreStorageRequest } from '../appstore/types.js';
+import type { TObjectStorageDelivery } from '../platform/storage.js';
+import type { TCanonicalJsonFailure } from './canonicaljson.js';
+/** Byte bounds every reader of a storage control string applies. */
+export declare const storageContractStringLimits: Readonly<{
+    maximumConfiguredStringBytes: 2048;
+    maximumEnvironmentKeyBytes: 256;
+    maximumSecretPathBytes: 2048;
+}>;
+export declare const createStorageContractReaders: (failArg: TCanonicalJsonFailure) => {
+    utf8ByteLength: (valueArg: string) => number;
+    readRecord: (valueArg: unknown, fieldNameArg: string) => Record<string, unknown>;
+    readDenseArray: (valueArg: unknown, fieldNameArg: string, minimumLengthArg: number, maximumLengthArg: number) => unknown[];
+    assertKeys: (recordArg: Record<string, unknown>, requiredKeysArg: readonly string[], optionalKeysArg: readonly string[], fieldNameArg: string) => void;
+    assertExactKeys: (recordArg: Record<string, unknown>, expectedKeysArg: readonly string[], fieldNameArg: string) => void;
+    readString: (valueArg: unknown, fieldNameArg: string, maximumBytesArg?: number) => string;
+    readIdentifier: (valueArg: unknown, fieldNameArg: string) => string;
+    readSha256: (valueArg: unknown, fieldNameArg: string) => string;
+    readSafeInteger: (valueArg: unknown, fieldNameArg: string, minimumArg: number, maximumArg?: number) => number;
+    readBoolean: (valueArg: unknown, fieldNameArg: string) => boolean;
+    readLiteral: <TLiteral extends string>(valueArg: unknown, allowedArg: readonly TLiteral[], fieldNameArg: string) => TLiteral;
+    readCapacityQuantity: (valueArg: unknown, fieldNameArg: string) => string;
+    capacityQuantityBytes: (valueArg: string) => bigint;
+    readEnvironmentKey: (valueArg: unknown, fieldNameArg: string) => string;
+    normalizeCapacityRequest: (valueArg: unknown, fieldNameArg: string) => NonNullable<TAppStoreStorageRequest["capacity"]>;
+    normalizeDelivery: (valueArg: unknown, fieldNameArg: string) => TObjectStorageDelivery;
+    normalizeObjectStorageRequest: (valueArg: unknown, fieldNameArg: string) => IAppStoreObjectStorageRequest;
+    normalizeFilesystemStorageRequest: (valueArg: unknown, fieldNameArg: string) => IAppStoreFilesystemStorageRequest;
+    normalizeStorageRequest: (valueArg: unknown, fieldNameArg: string) => TAppStoreStorageRequest;
+};

package/dist_ts/private/storagecontract.js

@@ -0,0 +1,399 @@
+import { normalizeServiceAbsolutePath } from '../data/service.js';
+/** Byte bounds every reader of a storage control string applies. */
+export const storageContractStringLimits = Object.freeze({
+    maximumConfiguredStringBytes: 2048,
+    maximumEnvironmentKeyBytes: 256,
+    maximumSecretPathBytes: 2048,
+});
+const canonicalIdPattern = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,191}$/;
+const environmentKeyPattern = /^[A-Z_][A-Z0-9_]{0,255}$/;
+const sha256Pattern = /^[a-f0-9]{64}$/;
+const capacityPattern = /^[1-9][0-9]*(?:KiB|MiB|GiB|TiB)$/;
+/**
+ * The mount a Secret file is delivered under. A filesystem request that mounts it, or anything
+ * containing it, would shadow every credential the platform writes for the same service.
+ */
+const secretDeliveryRoot = '/run/secrets';
+export const createStorageContractReaders = (failArg) => {
+    const utf8ByteLength = (valueArg) => {
+        return new TextEncoder().encode(valueArg).byteLength;
+    };
+    const readRecord = (valueArg, fieldNameArg) => {
+        if (!valueArg || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+            return failArg(`${fieldNameArg} must be a plain object`);
+        }
+        const prototype = Object.getPrototypeOf(valueArg);
+        if (prototype !== Object.prototype && prototype !== null) {
+            return failArg(`${fieldNameArg} must be a plain object`);
+        }
+        const record = valueArg;
+        const ownKeys = Reflect.ownKeys(record);
+        if (ownKeys.some((keyArg) => typeof keyArg !== 'string')) {
+            return failArg(`${fieldNameArg} must not contain symbol keys`);
+        }
+        for (const key of ownKeys) {
+            const descriptor = Object.getOwnPropertyDescriptor(record, key);
+            if (!descriptor ||
+                !descriptor.enumerable ||
+                !Object.hasOwn(descriptor, 'value') ||
+                descriptor.value === undefined) {
+                return failArg(`${fieldNameArg} must contain enumerable JSON data properties only`);
+            }
+        }
+        return record;
+    };
+    const readDenseArray = (valueArg, fieldNameArg, minimumLengthArg, maximumLengthArg) => {
+        if (!Array.isArray(valueArg) ||
+            Object.getPrototypeOf(valueArg) !== Array.prototype) {
+            return failArg(`${fieldNameArg} must be a dense plain array`);
+        }
+        if (valueArg.length < minimumLengthArg ||
+            valueArg.length > maximumLengthArg) {
+            return failArg(`${fieldNameArg} must contain between ${minimumLengthArg} and ${maximumLengthArg} entries`);
+        }
+        for (let index = 0; index < valueArg.length; index++) {
+            if (!Object.hasOwn(valueArg, index)) {
+                return failArg(`${fieldNameArg} must not contain sparse entries`);
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(valueArg, String(index));
+            if (!descriptor ||
+                !descriptor.enumerable ||
+                !Object.hasOwn(descriptor, 'value') ||
+                descriptor.value === undefined) {
+                return failArg(`${fieldNameArg} must contain enumerable JSON data entries only`);
+            }
+        }
+        for (const key of Reflect.ownKeys(valueArg)) {
+            if (key === 'length')
+                continue;
+            if (typeof key !== 'string' ||
+                !/^(?:0|[1-9][0-9]*)$/.test(key) ||
+                Number(key) >= valueArg.length) {
+                return failArg(`${fieldNameArg} must not contain extra properties`);
+            }
+        }
+        return valueArg;
+    };
+    const assertKeys = (recordArg, requiredKeysArg, optionalKeysArg, fieldNameArg) => {
+        const actualKeys = Object.keys(recordArg).sort();
+        const allowedKeys = new Set([...requiredKeysArg, ...optionalKeysArg]);
+        if (requiredKeysArg.some((keyArg) => !Object.hasOwn(recordArg, keyArg)) ||
+            actualKeys.some((keyArg) => !allowedKeys.has(keyArg))) {
+            failArg(`${fieldNameArg} does not match its exact schema`);
+        }
+    };
+    const assertExactKeys = (recordArg, expectedKeysArg, fieldNameArg) => {
+        assertKeys(recordArg, expectedKeysArg, [], fieldNameArg);
+    };
+    const readString = (valueArg, fieldNameArg, maximumBytesArg = storageContractStringLimits.maximumConfiguredStringBytes) => {
+        if (typeof valueArg !== 'string' ||
+            valueArg.length === 0 ||
+            utf8ByteLength(valueArg) > maximumBytesArg ||
+            /[\u0000-\u001f\u007f]/u.test(valueArg)) {
+            return failArg(`${fieldNameArg} must be a bounded non-empty JSON string`);
+        }
+        for (let index = 0; index < valueArg.length; index++) {
+            const codeUnit = valueArg.charCodeAt(index);
+            if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+                const following = valueArg.charCodeAt(index + 1);
+                if (following < 0xdc00 || following > 0xdfff) {
+                    return failArg(`${fieldNameArg} contains an unpaired UTF-16 surrogate`);
+                }
+                index++;
+            }
+            else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+                return failArg(`${fieldNameArg} contains an unpaired UTF-16 surrogate`);
+            }
+        }
+        return valueArg;
+    };
+    const readIdentifier = (valueArg, fieldNameArg) => {
+        if (typeof valueArg !== 'string' || !canonicalIdPattern.test(valueArg)) {
+            return failArg(`${fieldNameArg} must be a canonical identifier`);
+        }
+        return valueArg;
+    };
+    const readSha256 = (valueArg, fieldNameArg) => {
+        if (typeof valueArg !== 'string' || !sha256Pattern.test(valueArg)) {
+            return failArg(`${fieldNameArg} must be a bare lowercase 64-hex SHA-256 digest`);
+        }
+        return valueArg;
+    };
+    const readSafeInteger = (valueArg, fieldNameArg, minimumArg, maximumArg = Number.MAX_SAFE_INTEGER) => {
+        if (typeof valueArg !== 'number' ||
+            !Number.isSafeInteger(valueArg) ||
+            Object.is(valueArg, -0) ||
+            valueArg < minimumArg ||
+            valueArg > maximumArg) {
+            return failArg(`${fieldNameArg} must be a safe integer between ${minimumArg} and ${maximumArg}`);
+        }
+        return valueArg;
+    };
+    const readBoolean = (valueArg, fieldNameArg) => {
+        if (typeof valueArg !== 'boolean') {
+            return failArg(`${fieldNameArg} must be a boolean`);
+        }
+        return valueArg;
+    };
+    const readLiteral = (valueArg, allowedArg, fieldNameArg) => {
+        if (typeof valueArg !== 'string' ||
+            !allowedArg.includes(valueArg)) {
+            return failArg(`${fieldNameArg} is outside the supported values`);
+        }
+        return valueArg;
+    };
+    const readCapacityQuantity = (valueArg, fieldNameArg) => {
+        if (typeof valueArg !== 'string' || !capacityPattern.test(valueArg)) {
+            return failArg(`${fieldNameArg} must be a canonical base-2 capacity quantity`);
+        }
+        const numericPart = valueArg.replace(/(?:KiB|MiB|GiB|TiB)$/, '');
+        if (!Number.isSafeInteger(Number(numericPart))) {
+            return failArg(`${fieldNameArg} exceeds the safe integer quantity range`);
+        }
+        return valueArg;
+    };
+    const capacityQuantityBytes = (valueArg) => {
+        const units = {
+            KiB: 1024n,
+            MiB: 1024n ** 2n,
+            GiB: 1024n ** 3n,
+            TiB: 1024n ** 4n,
+        };
+        const unit = valueArg.slice(-3);
+        return BigInt(valueArg.slice(0, -3)) * units[unit];
+    };
+    const normalizeCapacityRequest = (valueArg, fieldNameArg) => {
+        const value = readRecord(valueArg, fieldNameArg);
+        assertKeys(value, ['request'], ['limit'], fieldNameArg);
+        const request = readCapacityQuantity(value.request, `${fieldNameArg}.request`);
+        const limit = Object.hasOwn(value, 'limit')
+            ? readCapacityQuantity(value.limit, `${fieldNameArg}.limit`)
+            : undefined;
+        if (limit && capacityQuantityBytes(limit) < capacityQuantityBytes(request)) {
+            return failArg(`${fieldNameArg}.limit must be at least request`);
+        }
+        return {
+            request,
+            ...(limit ? { limit } : {}),
+        };
+    };
+    const readEnvironmentKey = (valueArg, fieldNameArg) => {
+        if (typeof valueArg !== 'string' ||
+            utf8ByteLength(valueArg) >
+                storageContractStringLimits.maximumEnvironmentKeyBytes ||
+            !environmentKeyPattern.test(valueArg)) {
+            return failArg(`${fieldNameArg} must be a canonical environment key`);
+        }
+        return valueArg;
+    };
+    const normalizeDelivery = (valueArg, fieldNameArg) => {
+        const value = readRecord(valueArg, fieldNameArg);
+        if (value.type === 'launcher-environment') {
+            assertExactKeys(value, ['type', 'keys'], fieldNameArg);
+            const keys = readRecord(value.keys, `${fieldNameArg}.keys`);
+            assertKeys(keys, ['endpoint', 'bucket', 'region', 'accessKeyId', 'secretAccessKey'], ['sessionToken'], `${fieldNameArg}.keys`);
+            const normalizedKeys = {
+                endpoint: readEnvironmentKey(keys.endpoint, `${fieldNameArg}.keys.endpoint`),
+                bucket: readEnvironmentKey(keys.bucket, `${fieldNameArg}.keys.bucket`),
+                region: readEnvironmentKey(keys.region, `${fieldNameArg}.keys.region`),
+                accessKeyId: readEnvironmentKey(keys.accessKeyId, `${fieldNameArg}.keys.accessKeyId`),
+                secretAccessKey: readEnvironmentKey(keys.secretAccessKey, `${fieldNameArg}.keys.secretAccessKey`),
+                ...(Object.hasOwn(keys, 'sessionToken')
+                    ? {
+                        sessionToken: readEnvironmentKey(keys.sessionToken, `${fieldNameArg}.keys.sessionToken`),
+                    }
+                    : {}),
+            };
+            if (new Set(Object.values(normalizedKeys)).size !==
+                Object.keys(normalizedKeys).length) {
+                return failArg(`${fieldNameArg}.keys values must be distinct`);
+            }
+            return { type: 'launcher-environment', keys: normalizedKeys };
+        }
+        if (value.type === 'file') {
+            assertExactKeys(value, ['type', 'targetPath', 'format', 'uid', 'gid', 'mode'], fieldNameArg);
+            const targetPath = readString(value.targetPath, `${fieldNameArg}.targetPath`, storageContractStringLimits.maximumSecretPathBytes);
+            if (!targetPath.startsWith(`${secretDeliveryRoot}/`) ||
+                targetPath.includes('\\') ||
+                targetPath.split('/').some((segmentArg) => segmentArg === '.' || segmentArg === '..')) {
+                return failArg(`${fieldNameArg}.targetPath must be a canonical path below ${secretDeliveryRoot}`);
+            }
+            if (value.format !== 'servezone-object-storage') {
+                return failArg(`${fieldNameArg}.format is unsupported`);
+            }
+            return {
+                type: 'file',
+                targetPath,
+                format: 'servezone-object-storage',
+                uid: readSafeInteger(value.uid, `${fieldNameArg}.uid`, 0, 2_147_483_647),
+                gid: readSafeInteger(value.gid, `${fieldNameArg}.gid`, 0, 2_147_483_647),
+                mode: value.mode === 0o400 || value.mode === 0o440
+                    ? value.mode
+                    : failArg(`${fieldNameArg}.mode must be 0400 or 0440`),
+            };
+        }
+        return failArg(`${fieldNameArg}.type is unsupported`);
+    };
+    const normalizeObjectStorageProtection = (valueArg, fieldNameArg) => {
+        const value = readRecord(valueArg, fieldNameArg);
+        assertKeys(value, [], ['backup', 'versioning', 'retentionDays'], fieldNameArg);
+        if (Object.keys(value).length === 0) {
+            return failArg(`${fieldNameArg} must not be empty`);
+        }
+        return {
+            ...(Object.hasOwn(value, 'backup')
+                ? {
+                    backup: value.backup === 'required'
+                        ? 'required'
+                        : failArg(`${fieldNameArg}.backup must be required`),
+                }
+                : {}),
+            ...(Object.hasOwn(value, 'versioning')
+                ? {
+                    versioning: value.versioning === 'required'
+                        ? 'required'
+                        : failArg(`${fieldNameArg}.versioning must be required`),
+                }
+                : {}),
+            ...(Object.hasOwn(value, 'retentionDays')
+                ? {
+                    retentionDays: readSafeInteger(value.retentionDays, `${fieldNameArg}.retentionDays`, 1, 365_000),
+                }
+                : {}),
+        };
+    };
+    const normalizeFilesystemProtection = (valueArg, fieldNameArg) => {
+        const value = readRecord(valueArg, fieldNameArg);
+        assertKeys(value, [], ['backup', 'snapshots', 'consistency'], fieldNameArg);
+        if (Object.keys(value).length === 0) {
+            return failArg(`${fieldNameArg} must not be empty`);
+        }
+        return {
+            ...(Object.hasOwn(value, 'backup')
+                ? {
+                    backup: value.backup === 'required'
+                        ? 'required'
+                        : failArg(`${fieldNameArg}.backup must be required`),
+                }
+                : {}),
+            ...(Object.hasOwn(value, 'snapshots')
+                ? {
+                    snapshots: readLiteral(value.snapshots, ['portable', 'native'], `${fieldNameArg}.snapshots`),
+                }
+                : {}),
+            ...(Object.hasOwn(value, 'consistency')
+                ? {
+                    consistency: readLiteral(value.consistency, ['crashConsistent', 'applicationConsistent'], `${fieldNameArg}.consistency`),
+                }
+                : {}),
+        };
+    };
+    const readMountPath = (valueArg, fieldNameArg) => {
+        const value = readString(valueArg, fieldNameArg, storageContractStringLimits.maximumSecretPathBytes);
+        if (normalizeServiceAbsolutePath(value) !== value || value === '/') {
+            return failArg(`${fieldNameArg} must be a canonical non-root absolute path`);
+        }
+        if (value === secretDeliveryRoot ||
+            value.startsWith(`${secretDeliveryRoot}/`) ||
+            secretDeliveryRoot.startsWith(`${value}/`)) {
+            return failArg(`${fieldNameArg} must not overlap ${secretDeliveryRoot}`);
+        }
+        return value;
+    };
+    const normalizeObjectStorageRequest = (valueArg, fieldNameArg) => {
+        const value = readRecord(valueArg, fieldNameArg);
+        assertKeys(value, [
+            'id',
+            'kind',
+            'storageClass',
+            'accessMode',
+            'reclaimPolicy',
+            'delivery',
+        ], ['capacity', 'protection'], fieldNameArg);
+        if (value.kind !== 'objectStorage') {
+            return failArg(`${fieldNameArg}.kind must be objectStorage`);
+        }
+        return {
+            id: readIdentifier(value.id, `${fieldNameArg}.id`),
+            kind: 'objectStorage',
+            storageClass: readIdentifier(value.storageClass, `${fieldNameArg}.storageClass`),
+            accessMode: readLiteral(value.accessMode, ['readOnly', 'readWrite'], `${fieldNameArg}.accessMode`),
+            reclaimPolicy: readLiteral(value.reclaimPolicy, ['retain', 'delete'], `${fieldNameArg}.reclaimPolicy`),
+            delivery: normalizeDelivery(value.delivery, `${fieldNameArg}.delivery`),
+            ...(Object.hasOwn(value, 'capacity')
+                ? {
+                    capacity: normalizeCapacityRequest(value.capacity, `${fieldNameArg}.capacity`),
+                }
+                : {}),
+            ...(Object.hasOwn(value, 'protection')
+                ? {
+                    protection: normalizeObjectStorageProtection(value.protection, `${fieldNameArg}.protection`),
+                }
+                : {}),
+        };
+    };
+    const normalizeFilesystemStorageRequest = (valueArg, fieldNameArg) => {
+        const value = readRecord(valueArg, fieldNameArg);
+        assertKeys(value, [
+            'id',
+            'kind',
+            'storageClass',
+            'accessMode',
+            'reclaimPolicy',
+            'mountPath',
+        ], ['capacity', 'protection'], fieldNameArg);
+        if (value.kind !== 'filesystem') {
+            return failArg(`${fieldNameArg}.kind must be filesystem`);
+        }
+        return {
+            id: readIdentifier(value.id, `${fieldNameArg}.id`),
+            kind: 'filesystem',
+            storageClass: readIdentifier(value.storageClass, `${fieldNameArg}.storageClass`),
+            accessMode: readLiteral(value.accessMode, ['ReadWriteOnce', 'ReadOnlyMany', 'ReadWriteMany'], `${fieldNameArg}.accessMode`),
+            reclaimPolicy: readLiteral(value.reclaimPolicy, ['retain', 'delete'], `${fieldNameArg}.reclaimPolicy`),
+            mountPath: readMountPath(value.mountPath, `${fieldNameArg}.mountPath`),
+            ...(Object.hasOwn(value, 'capacity')
+                ? {
+                    capacity: normalizeCapacityRequest(value.capacity, `${fieldNameArg}.capacity`),
+                }
+                : {}),
+            ...(Object.hasOwn(value, 'protection')
+                ? {
+                    protection: normalizeFilesystemProtection(value.protection, `${fieldNameArg}.protection`),
+                }
+                : {}),
+        };
+    };
+    const normalizeStorageRequest = (valueArg, fieldNameArg) => {
+        const value = readRecord(valueArg, fieldNameArg);
+        if (value.kind === 'filesystem') {
+            return normalizeFilesystemStorageRequest(value, fieldNameArg);
+        }
+        if (value.kind === 'objectStorage') {
+            return normalizeObjectStorageRequest(value, fieldNameArg);
+        }
+        return failArg(`${fieldNameArg}.kind must be filesystem or objectStorage`);
+    };
+    return {
+        utf8ByteLength,
+        readRecord,
+        readDenseArray,
+        assertKeys,
+        assertExactKeys,
+        readString,
+        readIdentifier,
+        readSha256,
+        readSafeInteger,
+        readBoolean,
+        readLiteral,
+        readCapacityQuantity,
+        capacityQuantityBytes,
+        readEnvironmentKey,
+        normalizeCapacityRequest,
+        normalizeDelivery,
+        normalizeObjectStorageRequest,
+        normalizeFilesystemStorageRequest,
+        normalizeStorageRequest,
+    };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmFnZWNvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcHJpdmF0ZS9zdG9yYWdlY29udHJhY3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBZUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFJbEUsb0VBQW9FO0FBQ3BFLE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDdkQsNEJBQTRCLEVBQUUsSUFBSTtJQUNsQywwQkFBMEIsRUFBRSxHQUFHO0lBQy9CLHNCQUFzQixFQUFFLElBQUk7Q0FDN0IsQ0FBQyxDQUFDO0FBRUgsTUFBTSxrQkFBa0IsR0FBRyxzQ0FBc0MsQ0FBQztBQUNsRSxNQUFNLHFCQUFxQixHQUFHLDBCQUEwQixDQUFDO0FBQ3pELE1BQU0sYUFBYSxHQUFHLGdCQUFnQixDQUFDO0FBQ3ZDLE1BQU0sZUFBZSxHQUFHLGtDQUFrQyxDQUFDO0FBQzNEOzs7R0FHRztBQUNILE1BQU0sa0JBQWtCLEdBQUcsY0FBYyxDQUFDO0FBRTFDLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsT0FBOEIsRUFBRSxFQUFFO0lBQzdFLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBZ0IsRUFBVSxFQUFFO1FBQ2xELE9BQU8sSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxDQUFDO0lBQ3ZELENBQUMsQ0FBQztJQUVGLE1BQU0sVUFBVSxHQUFHLENBQ2pCLFFBQWlCLEVBQ2pCLFlBQW9CLEVBQ0ssRUFBRTtRQUMzQixJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDekUsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLHlCQUF5QixDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEQsSUFBSSxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDekQsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLHlCQUF5QixDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLFFBQW1DLENBQUM7UUFDbkQsTUFBTSxPQUFPLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN4QyxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE9BQU8sTUFBTSxLQUFLLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDekQsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLCtCQUErQixDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELEtBQUssTUFBTSxHQUFHLElBQUksT0FBbUIsRUFBRSxDQUFDO1lBQ3RDLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDaEUsSUFDRSxDQUFDLFVBQVU7Z0JBQ1gsQ0FBQyxVQUFVLENBQUMsVUFBVTtnQkFDdEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUM7Z0JBQ25DLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUM5QixDQUFDO2dCQUNELE9BQU8sT0FBTyxDQUNaLEdBQUcsWUFBWSxvREFBb0QsQ0FDcEUsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQyxDQUFDO0lBRUYsTUFBTSxjQUFjLEdBQUcsQ0FDckIsUUFBaUIsRUFDakIsWUFBb0IsRUFDcEIsZ0JBQXdCLEVBQ3hCLGdCQUF3QixFQUNiLEVBQUU7UUFDYixJQUNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7WUFDeEIsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLENBQUMsU0FBUyxFQUNuRCxDQUFDO1lBQ0QsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLDhCQUE4QixDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQ0UsUUFBUSxDQUFDLE1BQU0sR0FBRyxnQkFBZ0I7WUFDbEMsUUFBUSxDQUFDLE1BQU0sR0FBRyxnQkFBZ0IsRUFDbEMsQ0FBQztZQUNELE9BQU8sT0FBTyxDQUNaLEdBQUcsWUFBWSx5QkFBeUIsZ0JBQWdCLFFBQVEsZ0JBQWdCLFVBQVUsQ0FDM0YsQ0FBQztRQUNKLENBQUM7UUFDRCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsUUFBUSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3JELElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUNwQyxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksa0NBQWtDLENBQUMsQ0FBQztZQUNwRSxDQUFDO1lBQ0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUM1RSxJQUNFLENBQUMsVUFBVTtnQkFDWCxDQUFDLFVBQVUsQ0FBQyxVQUFVO2dCQUN0QixDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQztnQkFDbkMsVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTLEVBQzlCLENBQUM7Z0JBQ0QsT0FBTyxPQUFPLENBQ1osR0FBRyxZQUFZLGlEQUFpRCxDQUNqRSxDQUFDO1lBQ0osQ0FBQztRQUNILENBQUM7UUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM1QyxJQUFJLEdBQUcsS0FBSyxRQUFRO2dCQUFFLFNBQVM7WUFDL0IsSUFDRSxPQUFPLEdBQUcsS0FBSyxRQUFRO2dCQUN2QixDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7Z0JBQ2hDLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsTUFBTSxFQUM5QixDQUFDO2dCQUNELE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSxvQ0FBb0MsQ0FBQyxDQUFDO1lBQ3RFLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQyxDQUFDO0lBRUYsTUFBTSxVQUFVLEdBQUcsQ0FDakIsU0FBa0MsRUFDbEMsZUFBa0MsRUFDbEMsZUFBa0MsRUFDbEMsWUFBb0IsRUFDZCxFQUFFO1FBQ1IsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNqRCxNQUFNLFdBQVcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEdBQUcsZUFBZSxFQUFFLEdBQUcsZUFBZSxDQUFDLENBQUMsQ0FBQztRQUN0RSxJQUNFLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDbkUsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQ3JELENBQUM7WUFDRCxPQUFPLENBQUMsR0FBRyxZQUFZLGtDQUFrQyxDQUFDLENBQUM7UUFDN0QsQ0FBQztJQUNILENBQUMsQ0FBQztJQUVGLE1BQU0sZUFBZSxHQUFHLENBQ3RCLFNBQWtDLEVBQ2xDLGVBQWtDLEVBQ2xDLFlBQW9CLEVBQ2QsRUFBRTtRQUNSLFVBQVUsQ0FBQyxTQUFTLEVBQUUsZUFBZSxFQUFFLEVBQUUsRUFBRSxZQUFZLENBQUMsQ0FBQztJQUMzRCxDQUFDLENBQUM7SUFFRixNQUFNLFVBQVUsR0FBRyxDQUNqQixRQUFpQixFQUNqQixZQUFvQixFQUNwQixrQkFDRSwyQkFBMkIsQ0FBQyw0QkFBNEIsRUFDbEQsRUFBRTtRQUNWLElBQ0UsT0FBTyxRQUFRLEtBQUssUUFBUTtZQUM1QixRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7WUFDckIsY0FBYyxDQUFDLFFBQVEsQ0FBQyxHQUFHLGVBQWU7WUFDMUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUN2QyxDQUFDO1lBQ0QsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLDBDQUEwQyxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUNELEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxRQUFRLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDckQsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUM1QyxJQUFJLFFBQVEsSUFBSSxNQUFNLElBQUksUUFBUSxJQUFJLE1BQU0sRUFBRSxDQUFDO2dCQUM3QyxNQUFNLFNBQVMsR0FBRyxRQUFRLENBQUMsVUFBVSxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztnQkFDakQsSUFBSSxTQUFTLEdBQUcsTUFBTSxJQUFJLFNBQVMsR0FBRyxNQUFNLEVBQUUsQ0FBQztvQkFDN0MsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLHdDQUF3QyxDQUFDLENBQUM7Z0JBQzFFLENBQUM7Z0JBQ0QsS0FBSyxFQUFFLENBQUM7WUFDVixDQUFDO2lCQUFNLElBQUksUUFBUSxJQUFJLE1BQU0sSUFBSSxRQUFRLElBQUksTUFBTSxFQUFFLENBQUM7Z0JBQ3BELE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSx3Q0FBd0MsQ0FBQyxDQUFDO1lBQzFFLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQyxDQUFDO0lBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFlBQW9CLEVBQVUsRUFBRTtRQUN6RSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ3ZFLE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSxpQ0FBaUMsQ0FBQyxDQUFDO1FBQ25FLENBQUM7UUFDRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDLENBQUM7SUFFRixNQUFNLFVBQVUsR0FBRyxDQUFDLFFBQWlCLEVBQUUsWUFBb0IsRUFBVSxFQUFFO1FBQ3JFLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ2xFLE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSxpREFBaUQsQ0FBQyxDQUFDO1FBQ25GLENBQUM7UUFDRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDLENBQUM7SUFFRixNQUFNLGVBQWUsR0FBRyxDQUN0QixRQUFpQixFQUNqQixZQUFvQixFQUNwQixVQUFrQixFQUNsQixVQUFVLEdBQUcsTUFBTSxDQUFDLGdCQUFnQixFQUM1QixFQUFFO1FBQ1YsSUFDRSxPQUFPLFFBQVEsS0FBSyxRQUFRO1lBQzVCLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7WUFDL0IsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDdkIsUUFBUSxHQUFHLFVBQVU7WUFDckIsUUFBUSxHQUFHLFVBQVUsRUFDckIsQ0FBQztZQUNELE9BQU8sT0FBTyxDQUNaLEdBQUcsWUFBWSxtQ0FBbUMsVUFBVSxRQUFRLFVBQVUsRUFBRSxDQUNqRixDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUMsQ0FBQztJQUVGLE1BQU0sV0FBVyxHQUFHLENBQUMsUUFBaUIsRUFBRSxZQUFvQixFQUFXLEVBQUU7UUFDdkUsSUFBSSxPQUFPLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNsQyxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksb0JBQW9CLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQyxDQUFDO0lBRUYsTUFBTSxXQUFXLEdBQUcsQ0FDbEIsUUFBaUIsRUFDakIsVUFBK0IsRUFDL0IsWUFBb0IsRUFDVixFQUFFO1FBQ1osSUFDRSxPQUFPLFFBQVEsS0FBSyxRQUFRO1lBQzVCLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxRQUFvQixDQUFDLEVBQzFDLENBQUM7WUFDRCxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksa0NBQWtDLENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBQ0QsT0FBTyxRQUFvQixDQUFDO0lBQzlCLENBQUMsQ0FBQztJQUVGLE1BQU0sb0JBQW9CLEdBQUcsQ0FDM0IsUUFBaUIsRUFDakIsWUFBb0IsRUFDWixFQUFFO1FBQ1YsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDcEUsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLCtDQUErQyxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELE1BQU0sV0FBVyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsc0JBQXNCLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDakUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMvQyxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksMENBQTBDLENBQUMsQ0FBQztRQUM1RSxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQyxDQUFDO0lBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWdCLEVBQVUsRUFBRTtRQUN6RCxNQUFNLEtBQUssR0FBMkI7WUFDcEMsR0FBRyxFQUFFLEtBQUs7WUFDVixHQUFHLEVBQUUsS0FBSyxJQUFJLEVBQUU7WUFDaEIsR0FBRyxFQUFFLEtBQUssSUFBSSxFQUFFO1lBQ2hCLEdBQUcsRUFBRSxLQUFLLElBQUksRUFBRTtTQUNqQixDQUFDO1FBQ0YsTUFBTSxJQUFJLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2hDLE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDckQsQ0FBQyxDQUFDO0lBRUYsTUFBTSx3QkFBd0IsR0FBRyxDQUMvQixRQUFpQixFQUNqQixZQUFvQixFQUM4QixFQUFFO1FBQ3BELE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxRQUFRLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDakQsVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsT0FBTyxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDeEQsTUFBTSxPQUFPLEdBQUcsb0JBQW9CLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxHQUFHLFlBQVksVUFBVSxDQUFDLENBQUM7UUFDL0UsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDO1lBQ3pDLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLEdBQUcsWUFBWSxRQUFRLENBQUM7WUFDNUQsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUNkLElBQUksS0FBSyxJQUFJLHFCQUFxQixDQUFDLEtBQUssQ0FBQyxHQUFHLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDM0UsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLGlDQUFpQyxDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUNELE9BQU87WUFDTCxPQUFPO1lBQ1AsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzVCLENBQUM7SUFDSixDQUFDLENBQUM7SUFFRixNQUFNLGtCQUFrQixHQUFHLENBQ3pCLFFBQWlCLEVBQ2pCLFlBQW9CLEVBQ1osRUFBRTtRQUNWLElBQ0UsT0FBTyxRQUFRLEtBQUssUUFBUTtZQUM1QixjQUFjLENBQUMsUUFBUSxDQUFDO2dCQUN0QiwyQkFBMkIsQ0FBQywwQkFBMEI7WUFDeEQsQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQ3JDLENBQUM7WUFDRCxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksc0NBQXNDLENBQUMsQ0FBQztRQUN4RSxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQyxDQUFDO0lBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUN4QixRQUFpQixFQUNqQixZQUFvQixFQUNJLEVBQUU7UUFDMUIsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQztRQUNqRCxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssc0JBQXNCLEVBQUUsQ0FBQztZQUMxQyxlQUFlLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sSUFBSSxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEdBQUcsWUFBWSxPQUFPLENBQUMsQ0FBQztZQUM1RCxVQUFVLENBQ1IsSUFBSSxFQUNKLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsYUFBYSxFQUFFLGlCQUFpQixDQUFDLEVBQ2xFLENBQUMsY0FBYyxDQUFDLEVBQ2hCLEdBQUcsWUFBWSxPQUFPLENBQ3ZCLENBQUM7WUFDRixNQUFNLGNBQWMsR0FBRztnQkFDckIsUUFBUSxFQUFFLGtCQUFrQixDQUMxQixJQUFJLENBQUMsUUFBUSxFQUNiLEdBQUcsWUFBWSxnQkFBZ0IsQ0FDaEM7Z0JBQ0QsTUFBTSxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxZQUFZLGNBQWMsQ0FBQztnQkFDdEUsTUFBTSxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxZQUFZLGNBQWMsQ0FBQztnQkFDdEUsV0FBVyxFQUFFLGtCQUFrQixDQUM3QixJQUFJLENBQUMsV0FBVyxFQUNoQixHQUFHLFlBQVksbUJBQW1CLENBQ25DO2dCQUNELGVBQWUsRUFBRSxrQkFBa0IsQ0FDakMsSUFBSSxDQUFDLGVBQWUsRUFDcEIsR0FBRyxZQUFZLHVCQUF1QixDQUN2QztnQkFDRCxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsY0FBYyxDQUFDO29CQUNyQyxDQUFDLENBQUM7d0JBQ0UsWUFBWSxFQUFFLGtCQUFrQixDQUM5QixJQUFJLENBQUMsWUFBWSxFQUNqQixHQUFHLFlBQVksb0JBQW9CLENBQ3BDO3FCQUNGO29CQUNILENBQUMsQ0FBQyxFQUFFLENBQUM7YUFDUixDQUFDO1lBQ0YsSUFDRSxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsSUFBSTtnQkFDM0MsTUFBTSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQyxNQUFNLEVBQ2xDLENBQUM7Z0JBQ0QsT0FBTyxPQUFPLENBQUMsR0FBRyxZQUFZLCtCQUErQixDQUFDLENBQUM7WUFDakUsQ0FBQztZQUNELE9BQU8sRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLEtBQUssQ0FBQyxJQUFJLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDMUIsZUFBZSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxZQUFZLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUM7WUFDN0YsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUMzQixLQUFLLENBQUMsVUFBVSxFQUNoQixHQUFHLFlBQVksYUFBYSxFQUM1QiwyQkFBMkIsQ0FBQyxzQkFBc0IsQ0FDbkQsQ0FBQztZQUNGLElBQ0UsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEdBQUcsa0JBQWtCLEdBQUcsQ0FBQztnQkFDaEQsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUM7Z0JBQ3pCLFVBQVUsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FDeEMsVUFBVSxLQUFLLEdBQUcsSUFBSSxVQUFVLEtBQUssSUFBSSxDQUMxQyxFQUNELENBQUM7Z0JBQ0QsT0FBTyxPQUFPLENBQ1osR0FBRyxZQUFZLDhDQUE4QyxrQkFBa0IsRUFBRSxDQUNsRixDQUFDO1lBQ0osQ0FBQztZQUNELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSywwQkFBMEIsRUFBRSxDQUFDO2dCQUNoRCxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksd0JBQXdCLENBQUMsQ0FBQztZQUMxRCxDQUFDO1lBQ0QsT0FBTztnQkFDTCxJQUFJLEVBQUUsTUFBTTtnQkFDWixVQUFVO2dCQUNWLE1BQU0sRUFBRSwwQkFBMEI7Z0JBQ2xDLEdBQUcsRUFBRSxlQUFlLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxHQUFHLFlBQVksTUFBTSxFQUFFLENBQUMsRUFBRSxhQUFhLENBQUM7Z0JBQ3hFLEdBQUcsRUFBRSxlQUFlLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxHQUFHLFlBQVksTUFBTSxFQUFFLENBQUMsRUFBRSxhQUFhLENBQUM7Z0JBQ3hFLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLEtBQUs7b0JBQ2hELENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSTtvQkFDWixDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsWUFBWSw0QkFBNEIsQ0FBQzthQUN6RCxDQUFDO1FBQ0osQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSxzQkFBc0IsQ0FBQyxDQUFDO0lBQ3hELENBQUMsQ0FBQztJQUVGLE1BQU0sZ0NBQWdDLEdBQUcsQ0FDdkMsUUFBaUIsRUFDakIsWUFBb0IsRUFDc0MsRUFBRTtRQUM1RCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQ2pELFVBQVUsQ0FDUixLQUFLLEVBQ0wsRUFBRSxFQUNGLENBQUMsUUFBUSxFQUFFLFlBQVksRUFBRSxlQUFlLENBQUMsRUFDekMsWUFBWSxDQUNiLENBQUM7UUFDRixJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3BDLE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSxvQkFBb0IsQ0FBQyxDQUFDO1FBQ3RELENBQUM7UUFDRCxPQUFPO1lBQ0wsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQztnQkFDaEMsQ0FBQyxDQUFDO29CQUNFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxLQUFLLFVBQVU7d0JBQ2pDLENBQUMsQ0FBQyxVQUFtQjt3QkFDckIsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLFlBQVksMEJBQTBCLENBQUM7aUJBQ3ZEO2dCQUNILENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDUCxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsWUFBWSxDQUFDO2dCQUNwQyxDQUFDLENBQUM7b0JBQ0UsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVLEtBQUssVUFBVTt3QkFDekMsQ0FBQyxDQUFDLFVBQW1CO3dCQUNyQixDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsWUFBWSw4QkFBOEIsQ0FBQztpQkFDM0Q7Z0JBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNQLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxlQUFlLENBQUM7Z0JBQ3ZDLENBQUMsQ0FBQztvQkFDRSxhQUFhLEVBQUUsZUFBZSxDQUM1QixLQUFLLENBQUMsYUFBYSxFQUNuQixHQUFHLFlBQVksZ0JBQWdCLEVBQy9CLENBQUMsRUFDRCxPQUFPLENBQ1I7aUJBQ0Y7Z0JBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUNSLENBQUM7SUFDSixDQUFDLENBQUM7SUFFRixNQUFNLDZCQUE2QixHQUFHLENBQ3BDLFFBQWlCLEVBQ2pCLFlBQW9CLEVBQzBDLEVBQUU7UUFDaEUsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQztRQUNqRCxVQUFVLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRSxDQUFDLFFBQVEsRUFBRSxXQUFXLEVBQUUsYUFBYSxDQUFDLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDNUUsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNwQyxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksb0JBQW9CLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBQ0QsT0FBTztZQUNMLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxRQUFRLENBQUM7Z0JBQ2hDLENBQUMsQ0FBQztvQkFDRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sS0FBSyxVQUFVO3dCQUNqQyxDQUFDLENBQUMsVUFBbUI7d0JBQ3JCLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxZQUFZLDBCQUEwQixDQUFDO2lCQUN2RDtnQkFDSCxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ1AsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQztnQkFDbkMsQ0FBQyxDQUFDO29CQUNFLFNBQVMsRUFBRSxXQUFXLENBQ3BCLEtBQUssQ0FBQyxTQUFTLEVBQ2YsQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFVLEVBQy9CLEdBQUcsWUFBWSxZQUFZLENBQzVCO2lCQUNGO2dCQUNILENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDUCxHQUFHLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsYUFBYSxDQUFDO2dCQUNyQyxDQUFDLENBQUM7b0JBQ0UsV0FBVyxFQUFFLFdBQVcsQ0FDdEIsS0FBSyxDQUFDLFdBQVcsRUFDakIsQ0FBQyxpQkFBaUIsRUFBRSx1QkFBdUIsQ0FBVSxFQUNyRCxHQUFHLFlBQVksY0FBYyxDQUM5QjtpQkFDRjtnQkFDSCxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQ1IsQ0FBQztJQUNKLENBQUMsQ0FBQztJQUVGLE1BQU0sYUFBYSxHQUFHLENBQUMsUUFBaUIsRUFBRSxZQUFvQixFQUFVLEVBQUU7UUFDeEUsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUN0QixRQUFRLEVBQ1IsWUFBWSxFQUNaLDJCQUEyQixDQUFDLHNCQUFzQixDQUNuRCxDQUFDO1FBQ0YsSUFBSSw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsS0FBSyxLQUFLLElBQUksS0FBSyxLQUFLLEdBQUcsRUFBRSxDQUFDO1lBQ25FLE9BQU8sT0FBTyxDQUNaLEdBQUcsWUFBWSw2Q0FBNkMsQ0FDN0QsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUNFLEtBQUssS0FBSyxrQkFBa0I7WUFDNUIsS0FBSyxDQUFDLFVBQVUsQ0FBQyxHQUFHLGtCQUFrQixHQUFHLENBQUM7WUFDMUMsa0JBQWtCLENBQUMsVUFBVSxDQUFDLEdBQUcsS0FBSyxHQUFHLENBQUMsRUFDMUMsQ0FBQztZQUNELE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSxxQkFBcUIsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUMsQ0FBQztJQUVGLE1BQU0sNkJBQTZCLEdBQUcsQ0FDcEMsUUFBaUIsRUFDakIsWUFBb0IsRUFDVyxFQUFFO1FBQ2pDLE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxRQUFRLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDakQsVUFBVSxDQUNSLEtBQUssRUFDTDtZQUNFLElBQUk7WUFDSixNQUFNO1lBQ04sY0FBYztZQUNkLFlBQVk7WUFDWixlQUFlO1lBQ2YsVUFBVTtTQUNYLEVBQ0QsQ0FBQyxVQUFVLEVBQUUsWUFBWSxDQUFDLEVBQzFCLFlBQVksQ0FDYixDQUFDO1FBQ0YsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGVBQWUsRUFBRSxDQUFDO1lBQ25DLE9BQU8sT0FBTyxDQUFDLEdBQUcsWUFBWSw2QkFBNkIsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxPQUFPO1lBQ0wsRUFBRSxFQUFFLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxFQUFFLEdBQUcsWUFBWSxLQUFLLENBQUM7WUFDbEQsSUFBSSxFQUFFLGVBQWU7WUFDckIsWUFBWSxFQUFFLGNBQWMsQ0FDMUIsS0FBSyxDQUFDLFlBQVksRUFDbEIsR0FBRyxZQUFZLGVBQWUsQ0FDL0I7WUFDRCxVQUFVLEVBQUUsV0FBVyxDQUNyQixLQUFLLENBQUMsVUFBVSxFQUNoQixDQUFDLFVBQVUsRUFBRSxXQUFXLENBQVUsRUFDbEMsR0FBRyxZQUFZLGFBQWEsQ0FDN0I7WUFDRCxhQUFhLEVBQUUsV0FBVyxDQUN4QixLQUFLLENBQUMsYUFBYSxFQUNuQixDQUFDLFFBQVEsRUFBRSxRQUFRLENBQVUsRUFDN0IsR0FBRyxZQUFZLGdCQUFnQixDQUNoQztZQUNELFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLEdBQUcsWUFBWSxXQUFXLENBQUM7WUFDdkUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQztnQkFDbEMsQ0FBQyxDQUFDO29CQUNFLFFBQVEsRUFBRSx3QkFBd0IsQ0FDaEMsS0FBSyxDQUFDLFFBQVEsRUFDZCxHQUFHLFlBQVksV0FBVyxDQUMzQjtpQkFDRjtnQkFDSCxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ1AsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFlBQVksQ0FBQztnQkFDcEMsQ0FBQyxDQUFDO29CQUNFLFVBQVUsRUFBRSxnQ0FBZ0MsQ0FDMUMsS0FBSyxDQUFDLFVBQVUsRUFDaEIsR0FBRyxZQUFZLGFBQWEsQ0FDN0I7aUJBQ0Y7Z0JBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUNSLENBQUM7SUFDSixDQUFDLENBQUM7SUFFRixNQUFNLGlDQUFpQyxHQUFHLENBQ3hDLFFBQWlCLEVBQ2pCLFlBQW9CLEVBQ2UsRUFBRTtRQUNyQyxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQ2pELFVBQVUsQ0FDUixLQUFLLEVBQ0w7WUFDRSxJQUFJO1lBQ0osTUFBTTtZQUNOLGNBQWM7WUFDZCxZQUFZO1lBQ1osZUFBZTtZQUNmLFdBQVc7U0FDWixFQUNELENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQyxFQUMxQixZQUFZLENBQ2IsQ0FBQztRQUNGLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZLEVBQUUsQ0FBQztZQUNoQyxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksMEJBQTBCLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsT0FBTztZQUNMLEVBQUUsRUFBRSxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxHQUFHLFlBQVksS0FBSyxDQUFDO1lBQ2xELElBQUksRUFBRSxZQUFZO1lBQ2xCLFlBQVksRUFBRSxjQUFjLENBQzFCLEtBQUssQ0FBQyxZQUFZLEVBQ2xCLEdBQUcsWUFBWSxlQUFlLENBQy9CO1lBQ0QsVUFBVSxFQUFFLFdBQVcsQ0FDckIsS0FBSyxDQUFDLFVBQVUsRUFDaEIsQ0FBQyxlQUFlLEVBQUUsY0FBYyxFQUFFLGVBQWUsQ0FBVSxFQUMzRCxHQUFHLFlBQVksYUFBYSxDQUM3QjtZQUNELGFBQWEsRUFBRSxXQUFXLENBQ3hCLEtBQUssQ0FBQyxhQUFhLEVBQ25CLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBVSxFQUM3QixHQUFHLFlBQVksZ0JBQWdCLENBQ2hDO1lBQ0QsU0FBUyxFQUFFLGFBQWEsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLEdBQUcsWUFBWSxZQUFZLENBQUM7WUFDdEUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQztnQkFDbEMsQ0FBQyxDQUFDO29CQUNFLFFBQVEsRUFBRSx3QkFBd0IsQ0FDaEMsS0FBSyxDQUFDLFFBQVEsRUFDZCxHQUFHLFlBQVksV0FBVyxDQUMzQjtpQkFDRjtnQkFDSCxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ1AsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFlBQVksQ0FBQztnQkFDcEMsQ0FBQyxDQUFDO29CQUNFLFVBQVUsRUFBRSw2QkFBNkIsQ0FDdkMsS0FBSyxDQUFDLFVBQVUsRUFDaEIsR0FBRyxZQUFZLGFBQWEsQ0FDN0I7aUJBQ0Y7Z0JBQ0gsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUNSLENBQUM7SUFDSixDQUFDLENBQUM7SUFFRixNQUFNLHVCQUF1QixHQUFHLENBQzlCLFFBQWlCLEVBQ2pCLFlBQW9CLEVBQ0ssRUFBRTtRQUMzQixNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQ2pELElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZLEVBQUUsQ0FBQztZQUNoQyxPQUFPLGlDQUFpQyxDQUFDLEtBQUssRUFBRSxZQUFZLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGVBQWUsRUFBRSxDQUFDO1lBQ25DLE9BQU8sNkJBQTZCLENBQUMsS0FBSyxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFDRCxPQUFPLE9BQU8sQ0FBQyxHQUFHLFlBQVksMkNBQTJDLENBQUMsQ0FBQztJQUM3RSxDQUFDLENBQUM7SUFFRixPQUFPO1FBQ0wsY0FBYztRQUNkLFVBQVU7UUFDVixjQUFjO1FBQ2QsVUFBVTtRQUNWLGVBQWU7UUFDZixVQUFVO1FBQ1YsY0FBYztRQUNkLFVBQVU7UUFDVixlQUFlO1FBQ2YsV0FBVztRQUNYLFdBQVc7UUFDWCxvQkFBb0I7UUFDcEIscUJBQXFCO1FBQ3JCLGtCQUFrQjtRQUNsQix3QkFBd0I7UUFDeEIsaUJBQWlCO1FBQ2pCLDZCQUE2QjtRQUM3QixpQ0FBaUM7UUFDakMsdUJBQXVCO0tBQ3hCLENBQUM7QUFDSixDQUFDLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.1.0",
+  "version": "32.2.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -1293,6 +1293,21 @@ metadata plus a service-owned credential management scope and delivery policy,
 never credential references or values. Filesystem
 bindings expose the container mount and access mode, never a host path.
 
+A binding's `requestDigest` is stated by one function, so the control plane that
+issues it and the consumer that re-derives it compute the same value:
+
+```typescript
+const requestDigest = await platform.createStorageRequestSha256(storageRequest);
+```
+
+It normalizes the request to its contract shape, canonicalizes it and returns
+bare lowercase hex over the request alone — no prefix, and nothing wrapped
+around the request. A body that is not a storage request is refused with
+`platform.StorageContractError` instead of hashed, and
+`platform.canonicalizeStorageRequest` returns the exact bytes the digest is
+taken over. `platform.storageRequestCanonicalDigestGoldenVectors` states both
+for a filesystem request and for both object-storage deliveries.
+
 Portable manifests and resolved bindings intentionally have no fields for
 Synology, NFS, Kerberos, Corestore, Kubernetes, Docker drivers, servers,
 exports, mount options, provider credential values, or local fallback paths. Runtimes

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.1.0',
+  version: '32.2.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/platform/storage.golden.ts

@@ -0,0 +1,97 @@
+import type {
+  IAppStoreFilesystemStorageRequest,
+  IAppStoreObjectStorageRequest,
+} from '../appstore/types.js';
+import { deepFreezeValue } from '../private/canonicaljson.js';
+
+export interface IStorageRequestCanonicalDigestGoldenVector<TInput> {
+  input: TInput;
+  canonicalJson: string;
+  sha256: string;
+}
+
+const filesystemRequest: IAppStoreFilesystemStorageRequest = {
+  id: 'app-state',
+  kind: 'filesystem',
+  storageClass: 'databaseFast',
+  accessMode: 'ReadWriteOnce',
+  reclaimPolicy: 'delete',
+  mountPath: '/var/lib/app',
+  capacity: {
+    request: '20GiB',
+    limit: '40GiB',
+  },
+  protection: {
+    backup: 'required',
+    snapshots: 'portable',
+    consistency: 'applicationConsistent',
+  },
+};
+
+const objectStorageLauncherEnvironmentRequest: IAppStoreObjectStorageRequest = {
+  id: 'object-data',
+  kind: 'objectStorage',
+  storageClass: 'backupCapacity',
+  accessMode: 'readWrite',
+  reclaimPolicy: 'retain',
+  delivery: {
+    type: 'launcher-environment',
+    keys: {
+      endpoint: 'APP_S3_ENDPOINT',
+      bucket: 'APP_S3_BUCKET',
+      region: 'APP_S3_REGION',
+      accessKeyId: 'APP_S3_ACCESS_KEY',
+      secretAccessKey: 'APP_S3_SECRET_KEY',
+    },
+  },
+  capacity: {
+    request: '500GiB',
+  },
+  protection: {
+    backup: 'required',
+    versioning: 'required',
+    retentionDays: 30,
+  },
+};
+
+const objectStorageFileRequest: IAppStoreObjectStorageRequest = {
+  id: 'object-archive',
+  kind: 'objectStorage',
+  storageClass: 'archiveCapacity',
+  accessMode: 'readOnly',
+  reclaimPolicy: 'delete',
+  delivery: {
+    type: 'file',
+    targetPath: '/run/secrets/object-archive.json',
+    format: 'servezone-object-storage',
+    uid: 10_000,
+    gid: 10_000,
+    mode: 0o400,
+  },
+};
+
+/**
+ * The storage request digest, written down for both kinds and both deliveries.
+ *
+ * A control plane and its consumer compare this value, so it is stated here as bytes rather than
+ * as whatever the current normalizer happens to produce: a member that starts or stops
+ * participating, an optional member that starts being carried when it is absent, or a delivery
+ * mode written as anything but its number would move these digests and be caught here.
+ */
+export const storageRequestCanonicalDigestGoldenVectors = deepFreezeValue({
+  filesystem: {
+    input: filesystemRequest,
+    canonicalJson: '{"accessMode":"ReadWriteOnce","capacity":{"limit":"40GiB","request":"20GiB"},"id":"app-state","kind":"filesystem","mountPath":"/var/lib/app","protection":{"backup":"required","consistency":"applicationConsistent","snapshots":"portable"},"reclaimPolicy":"delete","storageClass":"databaseFast"}',
+    sha256: '0f8dc2e480ade7110be1f1d95f666cc56d5b90110d1c4a1b8b8383e2eeda6fae',
+  },
+  objectStorageLauncherEnvironment: {
+    input: objectStorageLauncherEnvironmentRequest,
+    canonicalJson: '{"accessMode":"readWrite","capacity":{"request":"500GiB"},"delivery":{"keys":{"accessKeyId":"APP_S3_ACCESS_KEY","bucket":"APP_S3_BUCKET","endpoint":"APP_S3_ENDPOINT","region":"APP_S3_REGION","secretAccessKey":"APP_S3_SECRET_KEY"},"type":"launcher-environment"},"id":"object-data","kind":"objectStorage","protection":{"backup":"required","retentionDays":30,"versioning":"required"},"reclaimPolicy":"retain","storageClass":"backupCapacity"}',
+    sha256: '88bd943800bea75b576612b966484e66ddbf7ec9529a7f29dd1eadc9a36e2b79',
+  },
+  objectStorageFile: {
+    input: objectStorageFileRequest,
+    canonicalJson: '{"accessMode":"readOnly","delivery":{"format":"servezone-object-storage","gid":10000,"mode":256,"targetPath":"/run/secrets/object-archive.json","type":"file","uid":10000},"id":"object-archive","kind":"objectStorage","reclaimPolicy":"delete","storageClass":"archiveCapacity"}',
+    sha256: '13186abbfe733b3917363e0694d367f2d6aa87a4064445532d7c857ee274f795',
+  },
+});