@serve.zone/interfaces 32.23.0 → 32.25.0

package/dist_ts/platform/objectstorageretention.d.ts

@@ -65,3 +65,43 @@ export declare const objectStorageRetentionIntentsEqual: (leftArg: unknown, righ
 export declare const validateObjectStorageRetentionEvidence: (evidenceArg: unknown, expectedArg: IObjectStorageRetentionEvidenceExpectation) => Promise<string[]>;
 export declare const validateObjectStorageRetentionBinding: (bindingArg: unknown, expectedArg: IObjectStorageRetentionEvidenceExpectation) => Promise<string[]>;
 export declare const validatePlatformBindingObjectStorageRetention: (bindingArg: unknown, expectedArg: IObjectStorageRetentionEvidenceExpectation) => Promise<string[]>;
+/**
+ * The non-secret environment names that tell a workload which retention its bucket carries.
+ *
+ * The names are the ones the cluster relay handed workloads on the Docker path, so an application
+ * that read them keeps working unchanged. Every value is a projection of verified
+ * `IObjectStorageRetentionEvidence`; none is a credential.
+ *
+ * - `S3_RETENTION_MODE`: `intent.mode`, always `compliance`.
+ * - `S3_RETENTION_POLICY_ID`: `intent.policyId`.
+ * - `S3_RETENTION_DURATION_SECONDS`: `intent.retentionDurationSeconds` in decimal.
+ * - `S3_RETENTION_INTENT_SHA256`: `intentSha256`.
+ * - `S3_RETENTION_SENTINEL_KEY`: `receipt.sentinelKey`.
+ * - `S3_RETENTION_CONFIGURED_AT`: `receipt.configuredAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_CREATED_AT`: `receipt.sentinel.createdAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_RETAIN_UNTIL`: `receipt.sentinel.retainUntil`, Unix milliseconds in
+ *   decimal.
+ * - `S3_RETENTION_SENTINEL_PAYLOAD_SHA256`: `receipt.sentinel.payloadSha256`.
+ * - `S3_RETENTION_SENTINEL_METADATA_SHA256`: `receipt.sentinel.metadataSha256`.
+ * - `S3_RETENTION_SENTINEL_ETAG`: `receipt.sentinel.etag`.
+ */
+export declare const objectStorageRetentionEnvironmentKeys: readonly ["S3_RETENTION_MODE", "S3_RETENTION_POLICY_ID", "S3_RETENTION_DURATION_SECONDS", "S3_RETENTION_INTENT_SHA256", "S3_RETENTION_SENTINEL_KEY", "S3_RETENTION_CONFIGURED_AT", "S3_RETENTION_SENTINEL_CREATED_AT", "S3_RETENTION_SENTINEL_RETAIN_UNTIL", "S3_RETENTION_SENTINEL_PAYLOAD_SHA256", "S3_RETENTION_SENTINEL_METADATA_SHA256", "S3_RETENTION_SENTINEL_ETAG"];
+export type TObjectStorageRetentionEnvironmentKey = typeof objectStorageRetentionEnvironmentKeys[number];
+export type TObjectStorageRetentionEnvironment = {
+    [TKey in TObjectStorageRetentionEnvironmentKey]: string;
+};
+/**
+ * The retention environment of evidence that proves `expectedArg`.
+ *
+ * The evidence is validated against the expectation first, with the same validator every other
+ * consumer of retention evidence uses; the first reason it is refused is thrown. A workload is
+ * never told about a retention nobody proved.
+ */
+export declare const createObjectStorageRetentionEnvironment: (evidenceArg: IObjectStorageRetentionEvidence, expectedArg: IObjectStorageRetentionEvidenceExpectation) => Promise<TObjectStorageRetentionEnvironment>;
+/**
+ * Validates a retention environment on its own: exactly its eleven keys, canonical values, an
+ * intent digest that matches the stated intent, and sentinel timestamps that agree with the
+ * duration. It cannot prove the authority or the bucket the evidence was bound to — the
+ * environment does not carry them — so it judges the shape a workload reads, not the proof.
+ */
+export declare const validateObjectStorageRetentionEnvironment: (environmentArg: unknown, pathArg?: string) => Promise<string[]>;

package/dist_ts/platform/objectstorageretention.js

@@ -249,4 +249,124 @@ export const validatePlatformBindingObjectStorageRetention = async (bindingArg,
     }
     return validateObjectStorageRetentionBinding(bindingArg.objectstorageRetention, expectedArg);
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2JqZWN0c3RvcmFnZXJldGVudGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL29iamVjdHN0b3JhZ2VyZXRlbnRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0UsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDN0UsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTVELE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDeEQscUJBQXFCLEVBQUUsRUFBRTtJQUN6QiwrQkFBK0IsRUFBRSxHQUFHLEdBQUcsR0FBRyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRTtDQUMxRCxDQUFDLENBQUM7QUFvRUgsTUFBTSxlQUFlLEdBQUcsd0JBQXdCLENBQUM7QUFDakQsTUFBTSxpQkFBaUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUNoRSxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQztBQUN2QyxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQztBQUNyQzs7OztHQUlHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBRyw2REFBNkQsQ0FBQztBQUV6RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUMzRSxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUM1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ3hCLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztXQUNuRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUMvQyxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN2RSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxDQUMzRCxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsU0FBa0IsRUFDbEIsT0FBTyxHQUFHLGdDQUFnQyxFQUNoQyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7V0FDbkIsQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssWUFBWTtXQUM5QixPQUFPLFNBQVMsQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN0QyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0MsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQztXQUN4RCxTQUFTLENBQUMsd0JBQW1DO2NBQzdDLDRCQUE0QixDQUFDLCtCQUErQixFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sbURBQW1ELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsWUFBb0IsRUFDcEIsMkJBQW1DLEVBQzNCLEVBQUU7SUFDVixJQUFJLENBQUMscUJBQXFCLENBQUMsWUFBWSxDQUFDO1dBQ25DLENBQUMscUJBQXFCLENBQUMsMkJBQTJCLENBQUM7V0FDbkQsMkJBQTJCLEdBQUcsNEJBQTRCLENBQUMsK0JBQStCLEVBQUUsQ0FBQztRQUNoRyxNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLFlBQVksR0FBRywyQkFBMkIsR0FBRyxJQUFJLENBQUM7SUFDdEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsU0FBd0MsRUFDaEMsRUFBRTtJQUNWLE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQy9ELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDcEIsVUFBVSxFQUFFLGVBQWU7UUFDM0IsU0FBUyxFQUFFO1lBQ1QsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO1lBQ3BCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUTtZQUM1Qix3QkFBd0IsRUFBRSxTQUFTLENBQUMsd0JBQXdCO1NBQzdEO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxTQUF3QyxFQUN2QixFQUFFLENBQUMsNEJBQTRCLENBQ2hELDZDQUE2QyxDQUFDLFNBQVMsQ0FBQyxFQUN4RCxDQUFDLFNBQVMsRUFBRSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELE9BQWdCLEVBQ2hCLFFBQWlCLEVBQ1IsRUFBRSxDQUFDLG9DQUFvQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQ25FLG9DQUFvQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQzFELE9BQXlDLENBQUMsSUFBSTtZQUMzQyxRQUEwQyxDQUFDLElBQUk7T0FDbEQsT0FBeUMsQ0FBQyxRQUFRO1lBQy9DLFFBQTBDLENBQUMsUUFBUTtPQUN0RCxPQUF5QyxDQUFDLHdCQUF3QjtZQUMvRCxRQUEwQyxDQUFDLHdCQUF3QixDQUFDO0FBRTdFLE1BQU0sMEJBQTBCLEdBQUcsQ0FDakMsT0FBZ0IsRUFDaEIsUUFBaUIsRUFDUixFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztPQUMxQixRQUFRLENBQUMsUUFBUSxDQUFDO09BQ2xCLE9BQU8sQ0FBQyxJQUFJLEtBQUssWUFBWTtPQUM3QixRQUFRLENBQUMsSUFBSSxLQUFLLFlBQVk7T0FDOUIsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7T0FDcEMsT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtPQUN0QyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLENBQUM7T0FDdkQsT0FBTyxDQUFDLHdCQUF3QixLQUFLLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztBQUU1RSxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQW9CLEVBQ3BCLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDckIsQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFO1lBQzVCLFFBQVE7WUFDUixjQUFjO1lBQ2QsV0FBVztZQUNYLFlBQVk7WUFDWixTQUFTO1lBQ1QsWUFBWTtTQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN4RSxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUMsTUFBdUMsQ0FBQztJQUNuRSxJQUFJLENBQUMsMEJBQTBCLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMzQyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQztXQUM3QyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDakIsV0FBVyxDQUFDLFlBQVksS0FBSyxNQUFNLHlDQUF5QyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsU0FBUyxDQUFDO0lBQ3hDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ25CLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRTtZQUMxQixXQUFXO1lBQ1gsV0FBVztZQUNYLDBCQUEwQjtZQUMxQixzQkFBc0I7U0FDdkIsQ0FBQztXQUNDLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7V0FDNUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztXQUM3QyxPQUFPLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQzVDLFNBQVMsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUM7V0FDMUQsU0FBUyxDQUFDLHdCQUF3QixLQUFLLFdBQVcsQ0FBQyx3QkFBd0I7V0FDM0UsT0FBTyxTQUFTLENBQUMsb0JBQW9CLEtBQUssUUFBUTtXQUNsRCxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDO1dBQ25ELFNBQVMsQ0FBQyxvQkFBb0IsS0FBSyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUN6RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlGQUFpRixDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVLENBQUM7SUFDMUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFO1lBQzNCLFdBQVc7WUFDWCxTQUFTO1lBQ1QsT0FBTztZQUNQLGtCQUFrQjtZQUNsQiw0QkFBNEI7U0FDN0IsQ0FBQztXQUNDLFVBQVUsQ0FBQyxTQUFTLEtBQUssSUFBSTtXQUM3QixDQUFDLFVBQVUsQ0FBQyxPQUFPLEtBQUssWUFBWSxJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssV0FBVyxDQUFDO1dBQzNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1dBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDN0IsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxZQUFZO1dBQ3BDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJO1dBQ3BDLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUM7SUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7V0FDakIsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFO1lBQ3hCLE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFlBQVk7WUFDWixjQUFjO1lBQ2QsYUFBYTtZQUNiLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUN6RSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSx1Q0FBdUMsQ0FDekMsT0FBTyxDQUFDLFVBQVUsRUFDbEIsd0NBQXdDLENBQ3pDLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1dBQzNDLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7WUFDekIsU0FBUztZQUNULE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFdBQVc7WUFDWCxhQUFhO1lBQ2IsZUFBZTtZQUNmLGdCQUFnQjtZQUNoQixNQUFNO1NBQ1AsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDbkYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztXQUM1QyxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7V0FDM0MsUUFBUSxDQUFDLFNBQW9CLEdBQUksT0FBTyxDQUFDLFlBQXVCLEVBQUUsQ0FBQztRQUN2RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDakYsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLENBQUM7WUFDSCxJQUFJLFFBQVEsQ0FBQyxXQUFXLEtBQUssdUNBQXVDLENBQ2xFLFFBQVEsQ0FBQyxTQUFTLEVBQ2xCLE1BQU0sQ0FBQyx3QkFBd0IsQ0FDaEMsRUFBRSxDQUFDO2dCQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztZQUN4RixDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsYUFBYSxLQUFLLFFBQVEsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztXQUN4RixPQUFPLFFBQVEsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDO1dBQzNGLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLFdBQVcsQ0FBQyxVQUFxQixHQUFJLFFBQVEsQ0FBQyxTQUFvQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyw4RUFBOEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxLQUFLLEVBQ3hELFVBQW1CLEVBQ25CLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUM7V0FDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsb0NBQW9DLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZFLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLHNDQUFzQyxDQUN6RCxVQUFVLENBQUMsUUFBUSxFQUNuQixXQUFXLENBQ1osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLEtBQUssRUFDaEUsVUFBbUIsRUFDbkIsV0FBdUQsRUFDcEMsRUFBRTtJQUNyQixJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksdUNBQXVDLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3pFLHVDQUF1QyxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1RixPQUFPLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLGVBQWU7V0FDeEMsVUFBVSxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsU0FBUztXQUN2QyxVQUFVLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQzlDLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLGdGQUFnRixDQUFDLENBQUM7SUFDNUYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BELE9BQU8sQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxPQUFPLHFDQUFxQyxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUMvRixDQUFDLENBQUMifQ==
+/**
+ * The non-secret environment names that tell a workload which retention its bucket carries.
+ *
+ * The names are the ones the cluster relay handed workloads on the Docker path, so an application
+ * that read them keeps working unchanged. Every value is a projection of verified
+ * `IObjectStorageRetentionEvidence`; none is a credential.
+ *
+ * - `S3_RETENTION_MODE`: `intent.mode`, always `compliance`.
+ * - `S3_RETENTION_POLICY_ID`: `intent.policyId`.
+ * - `S3_RETENTION_DURATION_SECONDS`: `intent.retentionDurationSeconds` in decimal.
+ * - `S3_RETENTION_INTENT_SHA256`: `intentSha256`.
+ * - `S3_RETENTION_SENTINEL_KEY`: `receipt.sentinelKey`.
+ * - `S3_RETENTION_CONFIGURED_AT`: `receipt.configuredAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_CREATED_AT`: `receipt.sentinel.createdAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_RETAIN_UNTIL`: `receipt.sentinel.retainUntil`, Unix milliseconds in
+ *   decimal.
+ * - `S3_RETENTION_SENTINEL_PAYLOAD_SHA256`: `receipt.sentinel.payloadSha256`.
+ * - `S3_RETENTION_SENTINEL_METADATA_SHA256`: `receipt.sentinel.metadataSha256`.
+ * - `S3_RETENTION_SENTINEL_ETAG`: `receipt.sentinel.etag`.
+ */
+export const objectStorageRetentionEnvironmentKeys = Object.freeze([
+    'S3_RETENTION_MODE',
+    'S3_RETENTION_POLICY_ID',
+    'S3_RETENTION_DURATION_SECONDS',
+    'S3_RETENTION_INTENT_SHA256',
+    'S3_RETENTION_SENTINEL_KEY',
+    'S3_RETENTION_CONFIGURED_AT',
+    'S3_RETENTION_SENTINEL_CREATED_AT',
+    'S3_RETENTION_SENTINEL_RETAIN_UNTIL',
+    'S3_RETENTION_SENTINEL_PAYLOAD_SHA256',
+    'S3_RETENTION_SENTINEL_METADATA_SHA256',
+    'S3_RETENTION_SENTINEL_ETAG',
+]);
+/**
+ * The retention environment of evidence that proves `expectedArg`.
+ *
+ * The evidence is validated against the expectation first, with the same validator every other
+ * consumer of retention evidence uses; the first reason it is refused is thrown. A workload is
+ * never told about a retention nobody proved.
+ */
+export const createObjectStorageRetentionEnvironment = async (evidenceArg, expectedArg) => {
+    const errors = await validateObjectStorageRetentionEvidence(evidenceArg, expectedArg);
+    if (errors.length > 0)
+        throw new Error(errors[0]);
+    return {
+        S3_RETENTION_MODE: evidenceArg.intent.mode,
+        S3_RETENTION_POLICY_ID: evidenceArg.intent.policyId,
+        S3_RETENTION_DURATION_SECONDS: String(evidenceArg.intent.retentionDurationSeconds),
+        S3_RETENTION_INTENT_SHA256: evidenceArg.intentSha256,
+        S3_RETENTION_SENTINEL_KEY: evidenceArg.receipt.sentinelKey,
+        S3_RETENTION_CONFIGURED_AT: String(evidenceArg.receipt.configuredAt),
+        S3_RETENTION_SENTINEL_CREATED_AT: String(evidenceArg.receipt.sentinel.createdAt),
+        S3_RETENTION_SENTINEL_RETAIN_UNTIL: String(evidenceArg.receipt.sentinel.retainUntil),
+        S3_RETENTION_SENTINEL_PAYLOAD_SHA256: evidenceArg.receipt.sentinel.payloadSha256,
+        S3_RETENTION_SENTINEL_METADATA_SHA256: evidenceArg.receipt.sentinel.metadataSha256,
+        S3_RETENTION_SENTINEL_ETAG: evidenceArg.receipt.sentinel.etag,
+    };
+};
+const canonicalDecimalPattern = /^[1-9][0-9]*$/;
+const readCanonicalPositiveInteger = (valueArg) => (typeof valueArg === 'string'
+    && canonicalDecimalPattern.test(valueArg)
+    && Number.isSafeInteger(Number(valueArg))
+    ? Number(valueArg)
+    : undefined);
+/**
+ * Validates a retention environment on its own: exactly its eleven keys, canonical values, an
+ * intent digest that matches the stated intent, and sentinel timestamps that agree with the
+ * duration. It cannot prove the authority or the bucket the evidence was bound to — the
+ * environment does not carry them — so it judges the shape a workload reads, not the proof.
+ */
+export const validateObjectStorageRetentionEnvironment = async (environmentArg, pathArg = 'objectstorage retention environment') => {
+    if (!isRecord(environmentArg)
+        || !hasExactKeys(environmentArg, objectStorageRetentionEnvironmentKeys)
+        || objectStorageRetentionEnvironmentKeys.some((keyArg) => (typeof environmentArg[keyArg] !== 'string'))) {
+        return [`${pathArg} must contain exactly its string keys`];
+    }
+    const environment = environmentArg;
+    const errors = [];
+    const duration = readCanonicalPositiveInteger(environment.S3_RETENTION_DURATION_SECONDS);
+    const intent = {
+        mode: environment.S3_RETENTION_MODE,
+        policyId: environment.S3_RETENTION_POLICY_ID,
+        retentionDurationSeconds: duration,
+    };
+    const intentErrors = validateObjectStorageRetentionIntent(intent, `${pathArg} intent`);
+    errors.push(...intentErrors);
+    if (!sha256Pattern.test(environment.S3_RETENTION_INTENT_SHA256)
+        || intentErrors.length === 0
+            && environment.S3_RETENTION_INTENT_SHA256 !== await computeObjectStorageRetentionIntentSha256(intent)) {
+        errors.push(`${pathArg} S3_RETENTION_INTENT_SHA256 must be the digest of the stated intent`);
+    }
+    if (!sentinelKeyPattern.test(environment.S3_RETENTION_SENTINEL_KEY)) {
+        errors.push(`${pathArg} S3_RETENTION_SENTINEL_KEY must be canonical`);
+    }
+    const configuredAt = readCanonicalPositiveInteger(environment.S3_RETENTION_CONFIGURED_AT);
+    const createdAt = readCanonicalPositiveInteger(environment.S3_RETENTION_SENTINEL_CREATED_AT);
+    const retainUntil = readCanonicalPositiveInteger(environment.S3_RETENTION_SENTINEL_RETAIN_UNTIL);
+    if (configuredAt === undefined
+        || createdAt === undefined
+        || retainUntil === undefined
+        || createdAt < configuredAt) {
+        errors.push(`${pathArg} timestamps must be canonical positive decimals in order`);
+    }
+    else if (intentErrors.length === 0) {
+        try {
+            if (retainUntil !== createObjectStorageRetentionRetainUntil(createdAt, duration)) {
+                errors.push(`${pathArg} S3_RETENTION_SENTINEL_RETAIN_UNTIL must equal createdAt plus duration`);
+            }
+        }
+        catch {
+            errors.push(`${pathArg} S3_RETENTION_SENTINEL_RETAIN_UNTIL arithmetic must be safe`);
+        }
+    }
+    if (!sha256Pattern.test(environment.S3_RETENTION_SENTINEL_PAYLOAD_SHA256)
+        || !sha256Pattern.test(environment.S3_RETENTION_SENTINEL_METADATA_SHA256)
+        || !etagPattern.test(environment.S3_RETENTION_SENTINEL_ETAG)) {
+        errors.push(`${pathArg} sentinel digests and ETag must be canonical`);
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2JqZWN0c3RvcmFnZXJldGVudGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL29iamVjdHN0b3JhZ2VyZXRlbnRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0UsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDN0UsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTVELE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDeEQscUJBQXFCLEVBQUUsRUFBRTtJQUN6QiwrQkFBK0IsRUFBRSxHQUFHLEdBQUcsR0FBRyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRTtDQUMxRCxDQUFDLENBQUM7QUFvRUgsTUFBTSxlQUFlLEdBQUcsd0JBQXdCLENBQUM7QUFDakQsTUFBTSxpQkFBaUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUNoRSxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQztBQUN2QyxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQztBQUNyQzs7OztHQUlHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBRyw2REFBNkQsQ0FBQztBQUV6RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUMzRSxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUM1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ3hCLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztXQUNuRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUMvQyxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN2RSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxDQUMzRCxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsU0FBa0IsRUFDbEIsT0FBTyxHQUFHLGdDQUFnQyxFQUNoQyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7V0FDbkIsQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssWUFBWTtXQUM5QixPQUFPLFNBQVMsQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN0QyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0MsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQztXQUN4RCxTQUFTLENBQUMsd0JBQW1DO2NBQzdDLDRCQUE0QixDQUFDLCtCQUErQixFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sbURBQW1ELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsWUFBb0IsRUFDcEIsMkJBQW1DLEVBQzNCLEVBQUU7SUFDVixJQUFJLENBQUMscUJBQXFCLENBQUMsWUFBWSxDQUFDO1dBQ25DLENBQUMscUJBQXFCLENBQUMsMkJBQTJCLENBQUM7V0FDbkQsMkJBQTJCLEdBQUcsNEJBQTRCLENBQUMsK0JBQStCLEVBQUUsQ0FBQztRQUNoRyxNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLFlBQVksR0FBRywyQkFBMkIsR0FBRyxJQUFJLENBQUM7SUFDdEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsU0FBd0MsRUFDaEMsRUFBRTtJQUNWLE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQy9ELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDcEIsVUFBVSxFQUFFLGVBQWU7UUFDM0IsU0FBUyxFQUFFO1lBQ1QsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO1lBQ3BCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUTtZQUM1Qix3QkFBd0IsRUFBRSxTQUFTLENBQUMsd0JBQXdCO1NBQzdEO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxTQUF3QyxFQUN2QixFQUFFLENBQUMsNEJBQTRCLENBQ2hELDZDQUE2QyxDQUFDLFNBQVMsQ0FBQyxFQUN4RCxDQUFDLFNBQVMsRUFBRSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELE9BQWdCLEVBQ2hCLFFBQWlCLEVBQ1IsRUFBRSxDQUFDLG9DQUFvQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQ25FLG9DQUFvQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQzFELE9BQXlDLENBQUMsSUFBSTtZQUMzQyxRQUEwQyxDQUFDLElBQUk7T0FDbEQsT0FBeUMsQ0FBQyxRQUFRO1lBQy9DLFFBQTBDLENBQUMsUUFBUTtPQUN0RCxPQUF5QyxDQUFDLHdCQUF3QjtZQUMvRCxRQUEwQyxDQUFDLHdCQUF3QixDQUFDO0FBRTdFLE1BQU0sMEJBQTBCLEdBQUcsQ0FDakMsT0FBZ0IsRUFDaEIsUUFBaUIsRUFDUixFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztPQUMxQixRQUFRLENBQUMsUUFBUSxDQUFDO09BQ2xCLE9BQU8sQ0FBQyxJQUFJLEtBQUssWUFBWTtPQUM3QixRQUFRLENBQUMsSUFBSSxLQUFLLFlBQVk7T0FDOUIsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7T0FDcEMsT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtPQUN0QyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLENBQUM7T0FDdkQsT0FBTyxDQUFDLHdCQUF3QixLQUFLLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztBQUU1RSxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQW9CLEVBQ3BCLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDckIsQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFO1lBQzVCLFFBQVE7WUFDUixjQUFjO1lBQ2QsV0FBVztZQUNYLFlBQVk7WUFDWixTQUFTO1lBQ1QsWUFBWTtTQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN4RSxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUMsTUFBdUMsQ0FBQztJQUNuRSxJQUFJLENBQUMsMEJBQTBCLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMzQyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQztXQUM3QyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDakIsV0FBVyxDQUFDLFlBQVksS0FBSyxNQUFNLHlDQUF5QyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsU0FBUyxDQUFDO0lBQ3hDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ25CLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRTtZQUMxQixXQUFXO1lBQ1gsV0FBVztZQUNYLDBCQUEwQjtZQUMxQixzQkFBc0I7U0FDdkIsQ0FBQztXQUNDLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7V0FDNUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztXQUM3QyxPQUFPLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQzVDLFNBQVMsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUM7V0FDMUQsU0FBUyxDQUFDLHdCQUF3QixLQUFLLFdBQVcsQ0FBQyx3QkFBd0I7V0FDM0UsT0FBTyxTQUFTLENBQUMsb0JBQW9CLEtBQUssUUFBUTtXQUNsRCxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDO1dBQ25ELFNBQVMsQ0FBQyxvQkFBb0IsS0FBSyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUN6RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlGQUFpRixDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVLENBQUM7SUFDMUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFO1lBQzNCLFdBQVc7WUFDWCxTQUFTO1lBQ1QsT0FBTztZQUNQLGtCQUFrQjtZQUNsQiw0QkFBNEI7U0FDN0IsQ0FBQztXQUNDLFVBQVUsQ0FBQyxTQUFTLEtBQUssSUFBSTtXQUM3QixDQUFDLFVBQVUsQ0FBQyxPQUFPLEtBQUssWUFBWSxJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssV0FBVyxDQUFDO1dBQzNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1dBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDN0IsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxZQUFZO1dBQ3BDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJO1dBQ3BDLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUM7SUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7V0FDakIsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFO1lBQ3hCLE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFlBQVk7WUFDWixjQUFjO1lBQ2QsYUFBYTtZQUNiLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUN6RSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSx1Q0FBdUMsQ0FDekMsT0FBTyxDQUFDLFVBQVUsRUFDbEIsd0NBQXdDLENBQ3pDLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1dBQzNDLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7WUFDekIsU0FBUztZQUNULE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFdBQVc7WUFDWCxhQUFhO1lBQ2IsZUFBZTtZQUNmLGdCQUFnQjtZQUNoQixNQUFNO1NBQ1AsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDbkYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztXQUM1QyxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7V0FDM0MsUUFBUSxDQUFDLFNBQW9CLEdBQUksT0FBTyxDQUFDLFlBQXVCLEVBQUUsQ0FBQztRQUN2RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDakYsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLENBQUM7WUFDSCxJQUFJLFFBQVEsQ0FBQyxXQUFXLEtBQUssdUNBQXVDLENBQ2xFLFFBQVEsQ0FBQyxTQUFTLEVBQ2xCLE1BQU0sQ0FBQyx3QkFBd0IsQ0FDaEMsRUFBRSxDQUFDO2dCQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztZQUN4RixDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsYUFBYSxLQUFLLFFBQVEsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztXQUN4RixPQUFPLFFBQVEsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDO1dBQzNGLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLFdBQVcsQ0FBQyxVQUFxQixHQUFJLFFBQVEsQ0FBQyxTQUFvQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyw4RUFBOEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxLQUFLLEVBQ3hELFVBQW1CLEVBQ25CLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUM7V0FDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsb0NBQW9DLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZFLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLHNDQUFzQyxDQUN6RCxVQUFVLENBQUMsUUFBUSxFQUNuQixXQUFXLENBQ1osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLEtBQUssRUFDaEUsVUFBbUIsRUFDbkIsV0FBdUQsRUFDcEMsRUFBRTtJQUNyQixJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksdUNBQXVDLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3pFLHVDQUF1QyxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1RixPQUFPLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLGVBQWU7V0FDeEMsVUFBVSxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsU0FBUztXQUN2QyxVQUFVLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQzlDLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLGdGQUFnRixDQUFDLENBQUM7SUFDNUYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BELE9BQU8sQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxPQUFPLHFDQUFxQyxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUMvRixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW1CRztBQUNILE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDakUsbUJBQW1CO0lBQ25CLHdCQUF3QjtJQUN4QiwrQkFBK0I7SUFDL0IsNEJBQTRCO0lBQzVCLDJCQUEyQjtJQUMzQiw0QkFBNEI7SUFDNUIsa0NBQWtDO0lBQ2xDLG9DQUFvQztJQUNwQyxzQ0FBc0M7SUFDdEMsdUNBQXVDO0lBQ3ZDLDRCQUE0QjtDQUNwQixDQUFDLENBQUM7QUFTWjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxLQUFLLEVBQzFELFdBQTRDLEVBQzVDLFdBQXVELEVBQ1YsRUFBRTtJQUMvQyxNQUFNLE1BQU0sR0FBRyxNQUFNLHNDQUFzQyxDQUFDLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUN0RixJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbEQsT0FBTztRQUNMLGlCQUFpQixFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsSUFBSTtRQUMxQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLFFBQVE7UUFDbkQsNkJBQTZCLEVBQUUsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsd0JBQXdCLENBQUM7UUFDbEYsMEJBQTBCLEVBQUUsV0FBVyxDQUFDLFlBQVk7UUFDcEQseUJBQXlCLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxXQUFXO1FBQzFELDBCQUEwQixFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQztRQUNwRSxnQ0FBZ0MsRUFBRSxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1FBQ2hGLGtDQUFrQyxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7UUFDcEYsb0NBQW9DLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsYUFBYTtRQUNoRixxQ0FBcUMsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxjQUFjO1FBQ2xGLDBCQUEwQixFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUk7S0FDOUQsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLE1BQU0sdUJBQXVCLEdBQUcsZUFBZSxDQUFDO0FBRWhELE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDOUUsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUN6Qix1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO09BQ3RDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDO0lBQ2xCLENBQUMsQ0FBQyxTQUFTLENBQ2QsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxjQUF1QixFQUN2QixPQUFPLEdBQUcscUNBQXFDLEVBQzVCLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUM7V0FDeEIsQ0FBQyxZQUFZLENBQUMsY0FBYyxFQUFFLHFDQUFxQyxDQUFDO1dBQ3BFLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FDeEQsT0FBTyxjQUFjLENBQUMsTUFBTSxDQUFDLEtBQUssUUFBUSxDQUMzQyxDQUFDLEVBQUUsQ0FBQztRQUNMLE9BQU8sQ0FBQyxHQUFHLE9BQU8sdUNBQXVDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsTUFBTSxXQUFXLEdBQUcsY0FBb0QsQ0FBQztJQUN6RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxRQUFRLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLDZCQUE2QixDQUFDLENBQUM7SUFDekYsTUFBTSxNQUFNLEdBQUc7UUFDYixJQUFJLEVBQUUsV0FBVyxDQUFDLGlCQUFpQjtRQUNuQyxRQUFRLEVBQUUsV0FBVyxDQUFDLHNCQUFzQjtRQUM1Qyx3QkFBd0IsRUFBRSxRQUFRO0tBQ25DLENBQUM7SUFDRixNQUFNLFlBQVksR0FBRyxvQ0FBb0MsQ0FBQyxNQUFNLEVBQUUsR0FBRyxPQUFPLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxZQUFZLENBQUMsQ0FBQztJQUM3QixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsMEJBQTBCLENBQUM7V0FDMUQsWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ3ZCLFdBQVcsQ0FBQywwQkFBMEIsS0FBSyxNQUFNLHlDQUF5QyxDQUMzRixNQUF1QyxDQUN4QyxFQUFFLENBQUM7UUFDTixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxxRUFBcUUsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyx5QkFBeUIsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLDBCQUEwQixDQUFDLENBQUM7SUFDMUYsTUFBTSxTQUFTLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDN0YsTUFBTSxXQUFXLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDakcsSUFBSSxZQUFZLEtBQUssU0FBUztXQUN6QixTQUFTLEtBQUssU0FBUztXQUN2QixXQUFXLEtBQUssU0FBUztXQUN6QixTQUFTLEdBQUcsWUFBWSxFQUFFLENBQUM7UUFDOUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMERBQTBELENBQUMsQ0FBQztJQUNwRixDQUFDO1NBQU0sSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3JDLElBQUksQ0FBQztZQUNILElBQUksV0FBVyxLQUFLLHVDQUF1QyxDQUFDLFNBQVMsRUFBRSxRQUFrQixDQUFDLEVBQUUsQ0FBQztnQkFDM0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sd0VBQXdFLENBQUMsQ0FBQztZQUNsRyxDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDZEQUE2RCxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsb0NBQW9DLENBQUM7V0FDcEUsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxxQ0FBcUMsQ0FBQztXQUN0RSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLDBCQUEwQixDQUFDLEVBQUUsQ0FBQztRQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/requests/node.d.ts

@@ -4,6 +4,7 @@ import type { ICluster } from '../data/cluster.js';
 import type { IClusterNode, INodeAction, INodeMetricsSample, TNodeActionName } from '../data/clusternode.js';
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
+import type { IPlatformObjectStorageEndpoint } from '../platform/objectstorage.js';
 import type { INodeCredentialMetadata, INodeCredentialMutationPreconditions, INodeCredentialMutationResult, TNodeCredentialPurpose } from '../data/nodecredential.js';
 import type { INodeRuntimeRetirement } from '../data/noderetirement.js';
 import type { INodeRuntimeBindingRead, INodeRuntimeBindingRequest } from '../data/noderuntimebinding.js';
@@ -217,6 +218,34 @@ export interface IReq_Any_Cloudly_SetClusterNodeCorestoreEndpoint extends plugin
         node: IClusterNode;
     };
 }
+/**
+ * An administrator states where a workload on one node reaches the node's Corestore object
+ * storage, and the region it signs for: `IClusterNode.data.corestoreObjectStorage`.
+ *
+ * A request of its own, separate from `setClusterNodeCorestoreEndpoint`, because the two are
+ * separate facts with separate readers — the relay dials the control endpoint, a workload dials
+ * this one — and setting one never touches the other. A caller that states only the control
+ * endpoint leaves this one as it stands.
+ *
+ * Cloudly validates it with `validatePlatformObjectStorageEndpoint` before it writes and takes the
+ * node's own real-write fence inside the writing transaction, as for the control endpoint.
+ * `objectStorage: null` clears it, which is the same fact as never having set one: no
+ * object-storage environment can be composed for a binding on this node. The endpoint says where,
+ * never with what — no credential travels in this request or in the node document.
+ */
+export interface IReq_Any_Cloudly_SetClusterNodeCorestoreObjectStorageEndpoint extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_SetClusterNodeCorestoreObjectStorageEndpoint> {
+    method: 'setClusterNodeCorestoreObjectStorageEndpoint';
+    request: {
+        identity: IIdentity;
+        nodeId: string;
+        /** The node's object-storage endpoint and region, or `null` to state that it has none. */
+        objectStorage: IPlatformObjectStorageEndpoint | null;
+    };
+    response: {
+        /** The node as it now stands, so a caller needs no second read to see what it set. */
+        node: IClusterNode;
+    };
+}
 export interface IReq_Any_Cloudly_CreateNodeAction extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_CreateNodeAction> {
     method: 'createNodeAction';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.23.0",
+  "version": "32.25.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -1984,25 +1984,64 @@ native fence.
 
 ### Runtime local storage claims
 
-`data.IRuntimeLocalStorageClaim` is a controller's authority for one retained, node-local volume of
-one service. Cloudly and Onebox issue it alike (`controller.kind` is `cloudly` or `onebox`). It names
-the claim revision (`id`, `generation`, `previous`), the organization, cluster, node, runtime
-namespace, service and the service's own `volumeId`, and it states:
-
-- `source`: `{ kind: 'directory' }`, a node-local directory the node derives from the claim's
-  identity under a root only the node knows. Network filesystems join this union later as further
-  kinds, with their credentials delivered as secrets and never inside a claim;
+`data.IRuntimeLocalStorageClaim` is a controller's authority for one retained volume of one service,
+mounted on one node. Cloudly and Onebox issue it alike (`controller.kind` is `cloudly` or `onebox`).
+It names the claim revision (`id`, `generation`, `previous`), the organization, cluster, node,
+runtime namespace, service and the service's own `volumeId`, and it states:
+
+- `source` (`TRuntimeLocalStorageSource`), one of:
+  - `{ kind: 'directory' }` (`TRuntimeLocalStorageDirectorySource`), a node-local directory the node
+    derives from the claim's identity under a root only the node knows;
+  - `{ kind: 'nfs', server, export, subPath, version }` (`TRuntimeLocalStorageNfsSource`), the
+    directory `subPath` below the NFS export `server:export`;
+  - `{ kind: 'smb', server, share, subPath, version, credential }` (`TRuntimeLocalStorageSmbSource`),
+    the directory `subPath` below the SMB share `//server/share`. `credential` is an
+    `IRuntimeAuthorityReference { id, generation, digest }` naming the credential the node
+    authenticates with; the claim never carries a user name, password or domain, and the node
+    resolves the material through the controller's secret delivery. NFS authenticates the node's
+    host, so an `nfs` source names no credential;
 - `initialization`: `empty` creates an empty root with `initialOwnership { uid, gid, mode }`, which
   an `empty` claim must state, so a workload without `runAs` never meets a root-owned directory by
   accident; `import` waits for the volume's bytes to be imported and states `initialOwnership: null`,
   because an imported tree keeps its own ownership. `mode` holds directory permission bits only
-  (`runtimeLocalStorageClaimContract.directoryModeBits`, `0o3777`; setuid is refused);
+  (`runtimeLocalStorageClaimContract.directoryModeBits`, `0o3777`; setuid is refused). SMB carries no
+  POSIX ownership, so the node presents an SMB volume with `initialOwnership`, and an `smb` claim is
+  always `empty`;
 - `mount { mountPath, readOnly }`, judged by the storage request's own mount path rule: canonical,
   absolute, not `/`, and never overlapping `/run/secrets`;
 - `accessMode: 'ReadWriteOnce'`, `reclaimPolicy: 'retain'`, and `lifecycle`: `bound` keeps the
   volume, `purge` orders its bytes deleted and always follows a bound generation of the same claim.
 
-The claim carries no host path, device, mount option or credential.
+A network source names the remote directory and nothing about how to mount it, so the node derives
+every mount parameter from these fields alone and a claim cannot smuggle an option in:
+
+| Field | Rule |
+| --- | --- |
+| `server` | a lowercase fully qualified hostname of two or more labels whose last label is not numeric (a single label would resolve through each node's own search domains), or a canonical IP literal (a dotted quad without leading zeros, or RFC 5952 IPv6 without brackets or zone). No scheme, user info or port: the node connects to the protocol's standard port |
+| `export` | `/`, or `/` and canonical segments without a trailing slash |
+| `subPath` | `.` for the export or share itself, or canonical relative segments |
+| `share` | one segment of at most 80 characters, without `+`, `;`, `[` or `]` |
+| `version` | `nfs`: `3`, `4.0`, `4.1` or `4.2`; `smb`: `3.0`, `3.02` or `3.1.1` |
+
+A segment is printable ASCII without a space, at most 255 characters, never `.` or `..`, and holds
+none of `"`, `*`, `,`, `/`, `:`, `<`, `=`, `>`, `?`, `\` or `|`: a comma or `=` would read as a mount
+option, and the rest have meaning in a mount source or an SMB name. `export` and `subPath` are at
+most 1024 characters. ASCII keeps one spelling per segment, but one remote directory can still be
+named several ways: a hostname and an address of the same server, a different `export`/`subPath`
+split, or a nested `subPath`. The contract cannot detect these aliases, so the controller must refuse
+overlapping bound claims itself. The versions are the kernel's own `vers=` spellings, and each pins one protocol version: a
+bare NFS `4` or SMB `3` negotiates one, which a claim that must mean the same mount on every node
+cannot allow. NFS version 2 and the SMB 1 and 2 dialects are refused; SMB 3 is the first dialect
+that encrypts. The bounds and version lists
+are `runtimeLocalStorageClaimContract.nfsVersions`, `smbVersions`, `maximumServerLength`,
+`maximumPathLength`, `maximumSegmentLength` and `maximumShareLength`.
+
+`ReadWriteOnce` holds on the node that mounts the claim. A network directory is reachable from more
+than one node, so the controller issues at most one bound claim per remote directory; a node cannot
+see another node's mounts. A `purge` of a network claim deletes everything below `subPath`, the
+whole export or share for `.`.
+
+The claim carries no host path, device, mount option or credential value.
 `snapshotRuntimeLocalStorageClaim` makes a detached exact-schema snapshot,
 `computeRuntimeLocalStorageClaimDigest` hashes it under `serve.zone/runtime-local-storage-claim`,
 `validateRuntimeLocalStorageClaim` verifies the stated digest, and
@@ -3394,9 +3433,13 @@ Coreflow, all exported from `data` and `platform`:
    `{ state: 'authorized', bindingId }`. The blocker names what would stop the offline adoption,
    `null` when nothing would: `not-adoptable` (an allocation-managed database, another provider, a
    resource name that is not its database or bucket name, or a bucket name that is not a canonical S3
-   name), `ordinary-credentials-rotated` or `owned-by-binding`. An adoptable bucket must have a
-   canonical S3 name, because a binding request carries only such a name. A consumed adoption removes
-   the legacy entry, so it never appears.
+   name), `ordinary-credentials-rotated`, `owned-by-binding` or `fence-lineage-conflict` (the
+   bucket's object-storage fence lineage cannot move to the adopting binding: the bucket has more than
+   one lineage, or its lineage does not validate, belongs to another authority or has an unfinished
+   mutation).
+   Only a bucket has a fence lineage, so a database never names `fence-lineage-conflict`. An
+   adoptable bucket must have a canonical S3 name, because a binding request carries only such a
+   name. A consumed adoption removes the legacy entry, so it never appears.
 2. **Relay.** `getClusterCorestoreLegacyResources { nodeId }` asks the relay for one node's
    inventory, answered as `TClusterCorestoreLegacyResourceInventory`: `reachable: true` with the
    services, or `reachable: false` with `errorCode` `CORESTORE_ENDPOINT_UNKNOWN` or
@@ -3443,6 +3486,78 @@ Coreflow, all exported from `data` and `platform`:
 While a binding of a service reports `legacy-adoption-pending`, the service's runtime status waits as
 `legacy-adoption-pending` instead of `bindings-pending`.
 
+### Object-Storage Binding Environment
+
+An object-storage binding gives its workload two things. The access key and the secret reach it
+only as Secrets: the six aliases `createCorestoreCredentialSecretValues()` expands
+(`S3_ACCESS_KEY`, `S3_ACCESS_KEY_ID`, `S3_SECRET_KEY`, `S3_SECRET_ACCESS_KEY`,
+`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), published through the sealed Secret set. Where the
+bucket is, and which retention it carries, is non-secret and reaches it through the runtime
+configuration: Cloudly composes it into `IRuntimeConfig.environment`, the complete public
+environment, so no further runtime spec or assignment field carries it. The names are the ones
+Corestore and the cluster relay handed workloads before, so an application that read them keeps
+working unchanged.
+
+| Name | Value |
+| --- | --- |
+| `S3_ENDPOINT`, `AWS_ENDPOINT_URL` | The endpoint origin, for example `http://192.0.2.15:9000`. |
+| `S3_ENDPOINT_HOST` | The origin's host; an IPv6 literal keeps its brackets. |
+| `S3_PORT` | The origin's port, `80` or `443` when the origin states none. |
+| `S3_USE_SSL` | `true` for `https:`, `false` for `http:`. |
+| `S3_REGION`, `AWS_REGION` | The signing region. |
+| `S3_BUCKET` | `IPlatformBinding.objectstorageBucketName`. |
+| `AWS_S3_FORCE_PATH_STYLE` | Always `true`: a node-local origin has no wildcard DNS. |
+| `S3_RETENTION_MODE` | `intent.mode`, always `compliance`. |
+| `S3_RETENTION_POLICY_ID` | `intent.policyId`. |
+| `S3_RETENTION_DURATION_SECONDS` | `intent.retentionDurationSeconds`. |
+| `S3_RETENTION_INTENT_SHA256` | `intentSha256`. |
+| `S3_RETENTION_SENTINEL_KEY` | `receipt.sentinelKey`. |
+| `S3_RETENTION_CONFIGURED_AT` | `receipt.configuredAt`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_CREATED_AT` | `receipt.sentinel.createdAt`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_RETAIN_UNTIL` | `receipt.sentinel.retainUntil`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_PAYLOAD_SHA256` | `receipt.sentinel.payloadSha256`. |
+| `S3_RETENTION_SENTINEL_METADATA_SHA256` | `receipt.sentinel.metadataSha256`. |
+| `S3_RETENTION_SENTINEL_ETAG` | `receipt.sentinel.etag`. |
+
+Every number is a canonical decimal. `objectStorageEndpointEnvironmentKeys`,
+`objectStorageRetentionEnvironmentKeys` and `objectStorageBindingEnvironmentKeys` publish the
+lists in this order, with the matching `T…EnvironmentKey` and `T…Environment` types.
+
+**Where the endpoint comes from.** Corestore is node-local, so the endpoint is a fact about the
+node that holds the bucket: `IClusterNode.data.corestoreObjectStorage` is an optional
+`IPlatformObjectStorageEndpoint { endpoint, region }`, checked by
+`validatePlatformObjectStorageEndpoint()` (a canonical `http:` or `https:` origin and a lowercase
+region). It sits beside `corestore`, not inside it: the relay dials the control endpoint and a
+workload dials this one, and `IClusterNodeCorestore` keeps its exact schema, so a relay that
+validates it goes on accepting every node document. An administrator sets it with
+`setClusterNodeCorestoreObjectStorageEndpoint { identity; nodeId; objectStorage }`, answered by
+Cloudly with the node as it now stands; `objectStorage: null` clears it. The request is separate
+from `setClusterNodeCorestoreEndpoint`, so setting the control endpoint never touches it. A node
+without it cannot give a workload an object-storage environment; nothing derives a port, a scheme
+or a region.
+
+**Composing.** `createObjectStorageBindingEnvironment(binding, endpoint)` returns the nine endpoint
+names for a binding that declares no retention, and all twenty when it declares retention with
+evidence. It refuses by name, and never guesses, when the binding is not `objectstorage`, carries
+no canonical bucket, or declares retention without `evidence`: a bucket whose immutability is not
+proven yet must not be handed to its workload as if it were ordinary storage, so the workload
+waits for the evidence. The evidence is validated with `validateObjectStorageRetentionEvidence()`
+against the binding's own service, binding id, bucket and intent, and the reconciliation
+generation and request digest it states. The split helpers are
+`createObjectStorageEndpointEnvironment(endpoint, bucketName)` and
+`createObjectStorageRetentionEnvironment(evidence, expectation)`.
+`mergeObjectStorageBindingEnvironment(environment, bindingEnvironment)` adds one binding's names
+to a workload environment and refuses, naming every key, a name that is already set — by the
+service itself or by a second object-storage binding — instead of letting one value replace
+another.
+
+**Validating.** `validateObjectStorageBindingEnvironment()` accepts exactly the endpoint names and
+all or none of the retention names, each value the one its endpoint and evidence derive, and
+refuses any other name — so a credential alias in the public environment is refused by name.
+`validateObjectStorageEndpointEnvironment()` and `validateObjectStorageRetentionEnvironment()`
+judge each half on its own. The environment does not carry the evidence's authority, so
+validating it checks what a workload reads, not the proof behind it.
+
 ### Launcher Environment Delivery
 
 Launcher environment delivery uses stable `szsv-<base32-sha256>` Docker
@@ -3484,6 +3599,8 @@ Available platform modules:
 - `platform.objectstorageretention` for value-free immutable-retention intent,
   capability and sentinel evidence, authority binding, digest helpers, and
   strict validators.
+- `platform.objectstorageenvironment` for the non-secret workload environment of an
+  object-storage binding; see Object-Storage Binding Environment.
 - `platform.storagemigration` for fenced object-storage migration intent, status, consumer acknowledgements, canonical digests, and strict normalizers.
 - `platform.types` provider and binding metadata is value-free. Provider-specific
   operational config stays adapter-internal, while public DTOs expose typed

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.23.0',
+  version: '32.25.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusternode.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import { isSha256Digest, type TSha256Digest, type TImmutableContainerPlatform } from './immutableimage.js';
 import type { ISparkNodeReportRecord } from './sparknodereport.js';
+import type { IPlatformObjectStorageEndpoint } from '../platform/objectstorage.js';
 import {
   fleetCutoverContract,
   snapshotFleetCutoverPreparedVolumeHandoffAggregate,
@@ -1773,6 +1774,21 @@ export interface IClusterNode {
      * while Docker Swarm resolved it is exactly what stops resolving.
      */
     corestore?: IClusterNodeCorestore;
+
+    /**
+     * Where a workload on this node reaches the node's Corestore object storage, and the region
+     * it signs for.
+     *
+     * Cloudly owns it, sets it with `setClusterNodeCorestoreObjectStorageEndpoint`, and composes
+     * it into the environment of every object-storage binding placed on this node with
+     * `createObjectStorageBindingEnvironment()`. It is a sibling of `corestore`, not a member:
+     * the control API and the S3 API listen on different ports and have different readers — the
+     * relay dials `corestore`, a workload dials this — and `corestore` keeps its exact schema.
+     * Absent means no object-storage environment can be composed for this node, and a binding's
+     * workload waits rather than being handed a guessed port, scheme or region. Value-free like
+     * `corestore`: it says where, never with what.
+     */
+    corestoreObjectStorage?: IPlatformObjectStorageEndpoint;
   };
 }
 
@@ -1789,7 +1805,7 @@ export interface IClusterNode {
 export interface IClusterNodeCorestore {
   /**
    * The canonical origin of the control API, for example
-   * `http://10.20.0.15:3000`.
+   * `http://192.0.2.15:3000`.
    *
    * `http:` is admitted because Corestore terminates no TLS today — it binds a
    * plain control port and advertises no transport-encryption guarantee — and

package/ts/data/corestorelegacyadoption.ts

@@ -42,12 +42,17 @@ export type TCorestoreLegacyCapability = 'database' | 'objectstorage';
  * - `ordinary-credentials-rotated`: its credentials were rotated, so the delivered ones are no
  *   longer the generation a binding adopts;
  * - `owned-by-binding`: a credential binding or a named storage binding already owns the service
- *   capability, the resource or the bucket.
+ *   capability, the resource or the bucket;
+ * - `fence-lineage-conflict`: the bucket's object-storage fence lineage cannot move to the adopting
+ *   binding, because the bucket has more than one lineage, or its lineage does not validate,
+ *   belongs to another authority or has an unfinished mutation. Only a bucket has a fence lineage,
+ *   so a database never names it.
  */
 export type TCorestoreLegacyResourceBlocker =
   | 'not-adoptable'
   | 'ordinary-credentials-rotated'
-  | 'owned-by-binding';
+  | 'owned-by-binding'
+  | 'fence-lineage-conflict';
 
 /**
  * `unadopted` names what would stop the offline adoption, or `null` when nothing would;
@@ -155,7 +160,7 @@ const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
 const printableNamePattern = /^[\x21-\x7e]+$/;
 const bareSha256Pattern = /^[a-f0-9]{64}$/;
 const blockers: readonly TCorestoreLegacyResourceBlocker[] = [
-  'not-adoptable', 'ordinary-credentials-rotated', 'owned-by-binding',
+  'not-adoptable', 'ordinary-credentials-rotated', 'owned-by-binding', 'fence-lineage-conflict',
 ];
 
 const isIdentifier = (valueArg: unknown): valueArg is string => (
@@ -172,13 +177,18 @@ const isCapability = (valueArg: unknown): valueArg is TCorestoreLegacyCapability
   valueArg === 'database' || valueArg === 'objectstorage'
 );
 
-const validateAdoption = (valueArg: unknown, pathArg: string): string[] => {
+const validateAdoption = (
+  valueArg: unknown, capabilityArg: TCorestoreLegacyCapability, pathArg: string,
+): string[] => {
   if (!isPlainRecord(valueArg)) return [`${pathArg} must use its exact schema`];
   if (valueArg.state === 'unadopted') {
     if (!hasExactKeys(valueArg, ['state', 'blocker'])) return [`${pathArg} must use its exact schema`];
-    return valueArg.blocker === null || (blockers as readonly unknown[]).includes(valueArg.blocker)
-      ? []
-      : [`${pathArg} blocker must be null or a named blocker`];
+    if (valueArg.blocker !== null && !(blockers as readonly unknown[]).includes(valueArg.blocker)) {
+      return [`${pathArg} blocker must be null or a named blocker`];
+    }
+    return valueArg.blocker === 'fence-lineage-conflict' && capabilityArg !== 'objectstorage'
+      ? [`${pathArg} blocker fence-lineage-conflict must name a bucket`]
+      : [];
   }
   if (valueArg.state === 'authorized') {
     if (!hasExactKeys(valueArg, ['state', 'bindingId'])) return [`${pathArg} must use its exact schema`];
@@ -198,7 +208,7 @@ const validateResource = (valueArg: unknown, pathArg: string): string[] => {
     if (!hasExactKeys(valueArg, ['capability', 'databaseName', 'adoption'])) {
       return [`${pathArg} must use its exact schema`];
     }
-    const errors = validateAdoption(valueArg.adoption, `${pathArg} adoption`);
+    const errors = validateAdoption(valueArg.adoption, 'database', `${pathArg} adoption`);
     if (!isLegacyName(valueArg.databaseName)) errors.push(`${pathArg} databaseName must be a bounded printable name`);
     return errors;
   }
@@ -206,7 +216,7 @@ const validateResource = (valueArg: unknown, pathArg: string): string[] => {
     if (!hasExactKeys(valueArg, ['capability', 'bucketName', 'retention', 'adoption'])) {
       return [`${pathArg} must use its exact schema`];
     }
-    const errors = validateAdoption(valueArg.adoption, `${pathArg} adoption`);
+    const errors = validateAdoption(valueArg.adoption, 'objectstorage', `${pathArg} adoption`);
     if (!isLegacyName(valueArg.bucketName)) {
       errors.push(`${pathArg} bucketName must be a bounded printable name`);
     } else if (errors.length === 0 && isAdoptable(valueArg.adoption)) {