@serve.zone/interfaces 32.24.0 → 32.25.0

package/dist_ts/platform/objectstorageenvironment.d.ts

@@ -0,0 +1,49 @@
+import type { IPlatformBinding } from './types.js';
+import type { IPlatformObjectStorageEndpoint, TObjectStorageEndpointEnvironment, TObjectStorageEndpointEnvironmentKey } from './objectstorage.js';
+import type { TObjectStorageRetentionEnvironment, TObjectStorageRetentionEnvironmentKey } from './objectstorageretention.js';
+/**
+ * Every non-secret environment name an object-storage binding can give a workload: the nine
+ * endpoint names first, then the eleven retention names.
+ */
+export declare const objectStorageBindingEnvironmentKeys: readonly ["S3_ENDPOINT", "S3_ENDPOINT_HOST", "S3_PORT", "S3_REGION", "S3_BUCKET", "S3_USE_SSL", "AWS_ENDPOINT_URL", "AWS_REGION", "AWS_S3_FORCE_PATH_STYLE", "S3_RETENTION_MODE", "S3_RETENTION_POLICY_ID", "S3_RETENTION_DURATION_SECONDS", "S3_RETENTION_INTENT_SHA256", "S3_RETENTION_SENTINEL_KEY", "S3_RETENTION_CONFIGURED_AT", "S3_RETENTION_SENTINEL_CREATED_AT", "S3_RETENTION_SENTINEL_RETAIN_UNTIL", "S3_RETENTION_SENTINEL_PAYLOAD_SHA256", "S3_RETENTION_SENTINEL_METADATA_SHA256", "S3_RETENTION_SENTINEL_ETAG"];
+export type TObjectStorageBindingEnvironmentKey = TObjectStorageEndpointEnvironmentKey | TObjectStorageRetentionEnvironmentKey;
+/**
+ * The non-secret environment of one object-storage binding: always the endpoint names, and the
+ * retention names exactly when the binding declares compliance retention. Never a credential.
+ */
+export type TObjectStorageBindingEnvironment = TObjectStorageEndpointEnvironment | (TObjectStorageEndpointEnvironment & TObjectStorageRetentionEnvironment);
+/**
+ * The environment Cloudly composes into a workload's runtime configuration for one binding.
+ *
+ * `bindingArg` is the Cloudly binding document and `endpointArg` the
+ * `IClusterNode.data.corestoreObjectStorage` of the node the binding is placed on. Refused by
+ * name, never guessed:
+ *
+ * - a binding that is not `objectstorage` or carries no canonical `objectstorageBucketName`;
+ * - an endpoint that `validatePlatformObjectStorageEndpoint()` refuses;
+ * - a binding that declares `objectstorageRetention` without `evidence`. Its bucket's retention is
+ *   not proven yet, so the workload is not given an environment that would let it run as if its
+ *   bucket were ordinary storage; the caller waits for the evidence.
+ * - evidence that does not prove the binding's own service, binding id, bucket and intent.
+ *
+ * A binding without `objectstorageRetention` gets the endpoint names alone: it promised no
+ * retention, so there is nothing to state.
+ *
+ * The evidence's reconciliation generation and binding-request digest are read from its own
+ * authority: they are what Cloudly checked when it admitted the evidence, and the binding document
+ * does not repeat them. Everything the binding does state is checked again here.
+ */
+export declare const createObjectStorageBindingEnvironment: (bindingArg: IPlatformBinding, endpointArg: IPlatformObjectStorageEndpoint) => Promise<TObjectStorageBindingEnvironment>;
+/**
+ * Validates one binding's environment: the nine endpoint names, the eleven retention names all or
+ * none, and nothing else — so a credential alias, or any other name, is refused.
+ */
+export declare const validateObjectStorageBindingEnvironment: (environmentArg: unknown, pathArg?: string) => Promise<string[]>;
+/**
+ * A workload environment with one binding's environment added.
+ *
+ * Refuses, naming every key, when the environment already holds one of the binding's names: a
+ * service that sets `S3_ENDPOINT` itself, or a second object-storage binding on the same service,
+ * would otherwise have one value silently replace the other. The inputs are not changed.
+ */
+export declare const mergeObjectStorageBindingEnvironment: (environmentArg: Readonly<Record<string, string>>, bindingEnvironmentArg: TObjectStorageBindingEnvironment) => Record<string, string>;

package/dist_ts/platform/objectstorageenvironment.js

@@ -0,0 +1,119 @@
+import { createObjectStorageEndpointEnvironment, objectStorageEndpointEnvironmentKeys, validateObjectStorageEndpointEnvironment, validatePlatformObjectStorageBucketName, } from './objectstorage.js';
+import { createObjectStorageRetentionEnvironment, objectStorageRetentionEnvironmentKeys, validateObjectStorageRetentionEnvironment, validateObjectStorageRetentionIntent, } from './objectstorageretention.js';
+import { isPlainRecord, readDataProperties } from '../private/dataproperties.js';
+/**
+ * Every non-secret environment name an object-storage binding can give a workload: the nine
+ * endpoint names first, then the eleven retention names.
+ */
+export const objectStorageBindingEnvironmentKeys = Object.freeze([
+    ...objectStorageEndpointEnvironmentKeys,
+    ...objectStorageRetentionEnvironmentKeys,
+]);
+/**
+ * The environment Cloudly composes into a workload's runtime configuration for one binding.
+ *
+ * `bindingArg` is the Cloudly binding document and `endpointArg` the
+ * `IClusterNode.data.corestoreObjectStorage` of the node the binding is placed on. Refused by
+ * name, never guessed:
+ *
+ * - a binding that is not `objectstorage` or carries no canonical `objectstorageBucketName`;
+ * - an endpoint that `validatePlatformObjectStorageEndpoint()` refuses;
+ * - a binding that declares `objectstorageRetention` without `evidence`. Its bucket's retention is
+ *   not proven yet, so the workload is not given an environment that would let it run as if its
+ *   bucket were ordinary storage; the caller waits for the evidence.
+ * - evidence that does not prove the binding's own service, binding id, bucket and intent.
+ *
+ * A binding without `objectstorageRetention` gets the endpoint names alone: it promised no
+ * retention, so there is nothing to state.
+ *
+ * The evidence's reconciliation generation and binding-request digest are read from its own
+ * authority: they are what Cloudly checked when it admitted the evidence, and the binding document
+ * does not repeat them. Everything the binding does state is checked again here.
+ */
+export const createObjectStorageBindingEnvironment = async (bindingArg, endpointArg) => {
+    const binding = readDataProperties(bindingArg);
+    if (binding === null || binding.capability !== 'objectstorage') {
+        throw new Error('objectstorage binding environment requires an objectstorage binding');
+    }
+    const bindingName = typeof binding.id === 'string' ? binding.id : '(unnamed)';
+    if (validatePlatformObjectStorageBucketName(binding.objectstorageBucketName).length > 0) {
+        throw new Error(`objectstorage binding ${bindingName} carries no canonical bucket name; Cloudly owns it and `
+            + 'no environment invents one');
+    }
+    const bucketName = binding.objectstorageBucketName;
+    const endpointEnvironment = createObjectStorageEndpointEnvironment(endpointArg, bucketName);
+    const retention = binding.objectstorageRetention;
+    if (retention === undefined) {
+        return endpointEnvironment;
+    }
+    const retentionBinding = readDataProperties(retention);
+    if (retentionBinding === null
+        || validateObjectStorageRetentionIntent(retentionBinding.intent).length > 0) {
+        throw new Error(`objectstorage binding ${bindingName} must declare canonical compliance-retention intent`);
+    }
+    const evidence = retentionBinding.evidence;
+    if (evidence === undefined) {
+        throw new Error(`objectstorage binding ${bindingName} declares compliance retention without verified `
+            + 'evidence; its workload environment waits for the evidence');
+    }
+    const authority = isPlainRecord(evidence) ? readDataProperties(evidence.authority) : null;
+    if (authority === null) {
+        throw new Error('objectstorage retention evidence must use its exact schema');
+    }
+    const retentionEnvironment = await createObjectStorageRetentionEnvironment(evidence, {
+        serviceId: binding.serviceId,
+        bindingId: binding.id,
+        reconciliationGeneration: authority.reconciliationGeneration,
+        bindingRequestDigest: authority.bindingRequestDigest,
+        bucketName,
+        intent: retentionBinding.intent,
+    });
+    return { ...endpointEnvironment, ...retentionEnvironment };
+};
+/**
+ * Validates one binding's environment: the nine endpoint names, the eleven retention names all or
+ * none, and nothing else — so a credential alias, or any other name, is refused.
+ */
+export const validateObjectStorageBindingEnvironment = async (environmentArg, pathArg = 'objectstorage binding environment') => {
+    const environment = readDataProperties(environmentArg);
+    if (environment === null) {
+        return [`${pathArg} must be a plain record of data properties`];
+    }
+    const allowedKeys = objectStorageBindingEnvironmentKeys;
+    const foreignKeys = Object.keys(environment).filter((keyArg) => !allowedKeys.includes(keyArg));
+    if (foreignKeys.length > 0) {
+        return [`${pathArg} must not contain ${foreignKeys.sort().join(', ')}`];
+    }
+    const endpointEnvironment = {};
+    for (const key of objectStorageEndpointEnvironmentKeys) {
+        if (Object.hasOwn(environment, key))
+            endpointEnvironment[key] = environment[key];
+    }
+    const errors = validateObjectStorageEndpointEnvironment(endpointEnvironment, pathArg);
+    const retentionKeys = objectStorageRetentionEnvironmentKeys.filter((keyArg) => (Object.hasOwn(environment, keyArg)));
+    if (retentionKeys.length > 0) {
+        const retentionEnvironment = {};
+        for (const key of retentionKeys)
+            retentionEnvironment[key] = environment[key];
+        errors.push(...await validateObjectStorageRetentionEnvironment(retentionEnvironment, pathArg));
+    }
+    return errors;
+};
+/**
+ * A workload environment with one binding's environment added.
+ *
+ * Refuses, naming every key, when the environment already holds one of the binding's names: a
+ * service that sets `S3_ENDPOINT` itself, or a second object-storage binding on the same service,
+ * would otherwise have one value silently replace the other. The inputs are not changed.
+ */
+export const mergeObjectStorageBindingEnvironment = (environmentArg, bindingEnvironmentArg) => {
+    const collisions = Object.keys(bindingEnvironmentArg)
+        .filter((keyArg) => Object.hasOwn(environmentArg, keyArg))
+        .sort();
+    if (collisions.length > 0) {
+        throw new Error(`objectstorage binding environment collides with ${collisions.join(', ')} already set on the `
+            + 'workload');
+    }
+    return { ...environmentArg, ...bindingEnvironmentArg };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2JqZWN0c3RvcmFnZWVudmlyb25tZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcGxhdGZvcm0vb2JqZWN0c3RvcmFnZWVudmlyb25tZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQU1BLE9BQU8sRUFDTCxzQ0FBc0MsRUFDdEMsb0NBQW9DLEVBQ3BDLHdDQUF3QyxFQUN4Qyx1Q0FBdUMsR0FDeEMsTUFBTSxvQkFBb0IsQ0FBQztBQU81QixPQUFPLEVBQ0wsdUNBQXVDLEVBQ3ZDLHFDQUFxQyxFQUNyQyx5Q0FBeUMsRUFDekMsb0NBQW9DLEdBQ3JDLE1BQU0sNkJBQTZCLENBQUM7QUFDckMsT0FBTyxFQUFFLGFBQWEsRUFBRSxrQkFBa0IsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRWpGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDL0QsR0FBRyxvQ0FBb0M7SUFDdkMsR0FBRyxxQ0FBcUM7Q0FDaEMsQ0FBQyxDQUFDO0FBY1o7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBb0JHO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsS0FBSyxFQUN4RCxVQUE0QixFQUM1QixXQUEyQyxFQUNBLEVBQUU7SUFDN0MsTUFBTSxPQUFPLEdBQUcsa0JBQWtCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDL0MsSUFBSSxPQUFPLEtBQUssSUFBSSxJQUFJLE9BQU8sQ0FBQyxVQUFVLEtBQUssZUFBZSxFQUFFLENBQUM7UUFDL0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3pGLENBQUM7SUFDRCxNQUFNLFdBQVcsR0FBRyxPQUFPLE9BQU8sQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7SUFDOUUsSUFBSSx1Q0FBdUMsQ0FBQyxPQUFPLENBQUMsdUJBQXVCLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEYsTUFBTSxJQUFJLEtBQUssQ0FDYix5QkFBeUIsV0FBVyx5REFBeUQ7Y0FDekYsNEJBQTRCLENBQ2pDLENBQUM7SUFDSixDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLHVCQUFpQyxDQUFDO0lBQzdELE1BQU0sbUJBQW1CLEdBQUcsc0NBQXNDLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQztJQUNqRCxJQUFJLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM1QixPQUFPLG1CQUFtQixDQUFDO0lBQzdCLENBQUM7SUFDRCxNQUFNLGdCQUFnQixHQUFHLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZELElBQUksZ0JBQWdCLEtBQUssSUFBSTtXQUN4QixvQ0FBb0MsQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDOUUsTUFBTSxJQUFJLEtBQUssQ0FDYix5QkFBeUIsV0FBVyxxREFBcUQsQ0FDMUYsQ0FBQztJQUNKLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUM7SUFDM0MsSUFBSSxRQUFRLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDM0IsTUFBTSxJQUFJLEtBQUssQ0FDYix5QkFBeUIsV0FBVyxrREFBa0Q7Y0FDbEYsMkRBQTJELENBQ2hFLENBQUM7SUFDSixDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUMxRixJQUFJLFNBQVMsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUN2QixNQUFNLElBQUksS0FBSyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELE1BQU0sb0JBQW9CLEdBQUcsTUFBTSx1Q0FBdUMsQ0FDeEUsUUFBMkMsRUFDM0M7UUFDRSxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQW1CO1FBQ3RDLFNBQVMsRUFBRSxPQUFPLENBQUMsRUFBWTtRQUMvQix3QkFBd0IsRUFBRSxTQUFTLENBQUMsd0JBQWtDO1FBQ3RFLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxvQkFBOEI7UUFDOUQsVUFBVTtRQUNWLE1BQU0sRUFBRSxnQkFBZ0IsQ0FBQyxNQUF1QztLQUNqRSxDQUNGLENBQUM7SUFDRixPQUFPLEVBQUUsR0FBRyxtQkFBbUIsRUFBRSxHQUFHLG9CQUFvQixFQUFFLENBQUM7QUFDN0QsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsS0FBSyxFQUMxRCxjQUF1QixFQUN2QixPQUFPLEdBQUcsbUNBQW1DLEVBQzFCLEVBQUU7SUFDckIsTUFBTSxXQUFXLEdBQUcsa0JBQWtCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDdkQsSUFBSSxXQUFXLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDekIsT0FBTyxDQUFDLEdBQUcsT0FBTyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxNQUFNLFdBQVcsR0FBc0IsbUNBQW1DLENBQUM7SUFDM0UsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQy9GLElBQUksV0FBVyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzQixPQUFPLENBQUMsR0FBRyxPQUFPLHFCQUFxQixXQUFXLENBQUMsSUFBSSxFQUFFLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsTUFBTSxtQkFBbUIsR0FBNEIsRUFBRSxDQUFDO0lBQ3hELEtBQUssTUFBTSxHQUFHLElBQUksb0NBQW9DLEVBQUUsQ0FBQztRQUN2RCxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQztZQUFFLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxHQUFHLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsd0NBQXdDLENBQUMsbUJBQW1CLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDdEYsTUFBTSxhQUFhLEdBQUcscUNBQXFDLENBQUMsTUFBTSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUM3RSxNQUFNLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsQ0FDbkMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxhQUFhLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzdCLE1BQU0sb0JBQW9CLEdBQTRCLEVBQUUsQ0FBQztRQUN6RCxLQUFLLE1BQU0sR0FBRyxJQUFJLGFBQWE7WUFBRSxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE1BQU0seUNBQXlDLENBQUMsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNqRyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsY0FBZ0QsRUFDaEQscUJBQXVELEVBQy9CLEVBQUU7SUFDMUIsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxxQkFBcUIsQ0FBQztTQUNsRCxNQUFNLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1NBQ3pELElBQUksRUFBRSxDQUFDO0lBQ1YsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFCLE1BQU0sSUFBSSxLQUFLLENBQ2IsbURBQW1ELFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLHNCQUFzQjtjQUMxRixVQUFVLENBQ2YsQ0FBQztJQUNKLENBQUM7SUFDRCxPQUFPLEVBQUUsR0FBRyxjQUFjLEVBQUUsR0FBRyxxQkFBcUIsRUFBRSxDQUFDO0FBQ3pELENBQUMsQ0FBQyJ9

package/dist_ts/platform/objectstorageretention.d.ts

@@ -65,3 +65,43 @@ export declare const objectStorageRetentionIntentsEqual: (leftArg: unknown, righ
 export declare const validateObjectStorageRetentionEvidence: (evidenceArg: unknown, expectedArg: IObjectStorageRetentionEvidenceExpectation) => Promise<string[]>;
 export declare const validateObjectStorageRetentionBinding: (bindingArg: unknown, expectedArg: IObjectStorageRetentionEvidenceExpectation) => Promise<string[]>;
 export declare const validatePlatformBindingObjectStorageRetention: (bindingArg: unknown, expectedArg: IObjectStorageRetentionEvidenceExpectation) => Promise<string[]>;
+/**
+ * The non-secret environment names that tell a workload which retention its bucket carries.
+ *
+ * The names are the ones the cluster relay handed workloads on the Docker path, so an application
+ * that read them keeps working unchanged. Every value is a projection of verified
+ * `IObjectStorageRetentionEvidence`; none is a credential.
+ *
+ * - `S3_RETENTION_MODE`: `intent.mode`, always `compliance`.
+ * - `S3_RETENTION_POLICY_ID`: `intent.policyId`.
+ * - `S3_RETENTION_DURATION_SECONDS`: `intent.retentionDurationSeconds` in decimal.
+ * - `S3_RETENTION_INTENT_SHA256`: `intentSha256`.
+ * - `S3_RETENTION_SENTINEL_KEY`: `receipt.sentinelKey`.
+ * - `S3_RETENTION_CONFIGURED_AT`: `receipt.configuredAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_CREATED_AT`: `receipt.sentinel.createdAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_RETAIN_UNTIL`: `receipt.sentinel.retainUntil`, Unix milliseconds in
+ *   decimal.
+ * - `S3_RETENTION_SENTINEL_PAYLOAD_SHA256`: `receipt.sentinel.payloadSha256`.
+ * - `S3_RETENTION_SENTINEL_METADATA_SHA256`: `receipt.sentinel.metadataSha256`.
+ * - `S3_RETENTION_SENTINEL_ETAG`: `receipt.sentinel.etag`.
+ */
+export declare const objectStorageRetentionEnvironmentKeys: readonly ["S3_RETENTION_MODE", "S3_RETENTION_POLICY_ID", "S3_RETENTION_DURATION_SECONDS", "S3_RETENTION_INTENT_SHA256", "S3_RETENTION_SENTINEL_KEY", "S3_RETENTION_CONFIGURED_AT", "S3_RETENTION_SENTINEL_CREATED_AT", "S3_RETENTION_SENTINEL_RETAIN_UNTIL", "S3_RETENTION_SENTINEL_PAYLOAD_SHA256", "S3_RETENTION_SENTINEL_METADATA_SHA256", "S3_RETENTION_SENTINEL_ETAG"];
+export type TObjectStorageRetentionEnvironmentKey = typeof objectStorageRetentionEnvironmentKeys[number];
+export type TObjectStorageRetentionEnvironment = {
+    [TKey in TObjectStorageRetentionEnvironmentKey]: string;
+};
+/**
+ * The retention environment of evidence that proves `expectedArg`.
+ *
+ * The evidence is validated against the expectation first, with the same validator every other
+ * consumer of retention evidence uses; the first reason it is refused is thrown. A workload is
+ * never told about a retention nobody proved.
+ */
+export declare const createObjectStorageRetentionEnvironment: (evidenceArg: IObjectStorageRetentionEvidence, expectedArg: IObjectStorageRetentionEvidenceExpectation) => Promise<TObjectStorageRetentionEnvironment>;
+/**
+ * Validates a retention environment on its own: exactly its eleven keys, canonical values, an
+ * intent digest that matches the stated intent, and sentinel timestamps that agree with the
+ * duration. It cannot prove the authority or the bucket the evidence was bound to — the
+ * environment does not carry them — so it judges the shape a workload reads, not the proof.
+ */
+export declare const validateObjectStorageRetentionEnvironment: (environmentArg: unknown, pathArg?: string) => Promise<string[]>;

package/dist_ts/platform/objectstorageretention.js

@@ -249,4 +249,124 @@ export const validatePlatformBindingObjectStorageRetention = async (bindingArg,
     }
     return validateObjectStorageRetentionBinding(bindingArg.objectstorageRetention, expectedArg);
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2JqZWN0c3RvcmFnZXJldGVudGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL29iamVjdHN0b3JhZ2VyZXRlbnRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0UsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDN0UsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTVELE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDeEQscUJBQXFCLEVBQUUsRUFBRTtJQUN6QiwrQkFBK0IsRUFBRSxHQUFHLEdBQUcsR0FBRyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRTtDQUMxRCxDQUFDLENBQUM7QUFvRUgsTUFBTSxlQUFlLEdBQUcsd0JBQXdCLENBQUM7QUFDakQsTUFBTSxpQkFBaUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUNoRSxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQztBQUN2QyxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQztBQUNyQzs7OztHQUlHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBRyw2REFBNkQsQ0FBQztBQUV6RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUMzRSxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUM1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ3hCLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztXQUNuRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUMvQyxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN2RSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxDQUMzRCxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsU0FBa0IsRUFDbEIsT0FBTyxHQUFHLGdDQUFnQyxFQUNoQyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7V0FDbkIsQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssWUFBWTtXQUM5QixPQUFPLFNBQVMsQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN0QyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0MsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQztXQUN4RCxTQUFTLENBQUMsd0JBQW1DO2NBQzdDLDRCQUE0QixDQUFDLCtCQUErQixFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sbURBQW1ELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsWUFBb0IsRUFDcEIsMkJBQW1DLEVBQzNCLEVBQUU7SUFDVixJQUFJLENBQUMscUJBQXFCLENBQUMsWUFBWSxDQUFDO1dBQ25DLENBQUMscUJBQXFCLENBQUMsMkJBQTJCLENBQUM7V0FDbkQsMkJBQTJCLEdBQUcsNEJBQTRCLENBQUMsK0JBQStCLEVBQUUsQ0FBQztRQUNoRyxNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLFlBQVksR0FBRywyQkFBMkIsR0FBRyxJQUFJLENBQUM7SUFDdEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsU0FBd0MsRUFDaEMsRUFBRTtJQUNWLE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQy9ELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDcEIsVUFBVSxFQUFFLGVBQWU7UUFDM0IsU0FBUyxFQUFFO1lBQ1QsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO1lBQ3BCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUTtZQUM1Qix3QkFBd0IsRUFBRSxTQUFTLENBQUMsd0JBQXdCO1NBQzdEO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxTQUF3QyxFQUN2QixFQUFFLENBQUMsNEJBQTRCLENBQ2hELDZDQUE2QyxDQUFDLFNBQVMsQ0FBQyxFQUN4RCxDQUFDLFNBQVMsRUFBRSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELE9BQWdCLEVBQ2hCLFFBQWlCLEVBQ1IsRUFBRSxDQUFDLG9DQUFvQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQ25FLG9DQUFvQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQzFELE9BQXlDLENBQUMsSUFBSTtZQUMzQyxRQUEwQyxDQUFDLElBQUk7T0FDbEQsT0FBeUMsQ0FBQyxRQUFRO1lBQy9DLFFBQTBDLENBQUMsUUFBUTtPQUN0RCxPQUF5QyxDQUFDLHdCQUF3QjtZQUMvRCxRQUEwQyxDQUFDLHdCQUF3QixDQUFDO0FBRTdFLE1BQU0sMEJBQTBCLEdBQUcsQ0FDakMsT0FBZ0IsRUFDaEIsUUFBaUIsRUFDUixFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztPQUMxQixRQUFRLENBQUMsUUFBUSxDQUFDO09BQ2xCLE9BQU8sQ0FBQyxJQUFJLEtBQUssWUFBWTtPQUM3QixRQUFRLENBQUMsSUFBSSxLQUFLLFlBQVk7T0FDOUIsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7T0FDcEMsT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtPQUN0QyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLENBQUM7T0FDdkQsT0FBTyxDQUFDLHdCQUF3QixLQUFLLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztBQUU1RSxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQW9CLEVBQ3BCLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDckIsQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFO1lBQzVCLFFBQVE7WUFDUixjQUFjO1lBQ2QsV0FBVztZQUNYLFlBQVk7WUFDWixTQUFTO1lBQ1QsWUFBWTtTQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN4RSxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUMsTUFBdUMsQ0FBQztJQUNuRSxJQUFJLENBQUMsMEJBQTBCLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMzQyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQztXQUM3QyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDakIsV0FBVyxDQUFDLFlBQVksS0FBSyxNQUFNLHlDQUF5QyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsU0FBUyxDQUFDO0lBQ3hDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ25CLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRTtZQUMxQixXQUFXO1lBQ1gsV0FBVztZQUNYLDBCQUEwQjtZQUMxQixzQkFBc0I7U0FDdkIsQ0FBQztXQUNDLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7V0FDNUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztXQUM3QyxPQUFPLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQzVDLFNBQVMsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUM7V0FDMUQsU0FBUyxDQUFDLHdCQUF3QixLQUFLLFdBQVcsQ0FBQyx3QkFBd0I7V0FDM0UsT0FBTyxTQUFTLENBQUMsb0JBQW9CLEtBQUssUUFBUTtXQUNsRCxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDO1dBQ25ELFNBQVMsQ0FBQyxvQkFBb0IsS0FBSyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUN6RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlGQUFpRixDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVLENBQUM7SUFDMUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFO1lBQzNCLFdBQVc7WUFDWCxTQUFTO1lBQ1QsT0FBTztZQUNQLGtCQUFrQjtZQUNsQiw0QkFBNEI7U0FDN0IsQ0FBQztXQUNDLFVBQVUsQ0FBQyxTQUFTLEtBQUssSUFBSTtXQUM3QixDQUFDLFVBQVUsQ0FBQyxPQUFPLEtBQUssWUFBWSxJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssV0FBVyxDQUFDO1dBQzNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1dBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDN0IsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxZQUFZO1dBQ3BDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJO1dBQ3BDLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUM7SUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7V0FDakIsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFO1lBQ3hCLE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFlBQVk7WUFDWixjQUFjO1lBQ2QsYUFBYTtZQUNiLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUN6RSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSx1Q0FBdUMsQ0FDekMsT0FBTyxDQUFDLFVBQVUsRUFDbEIsd0NBQXdDLENBQ3pDLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1dBQzNDLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7WUFDekIsU0FBUztZQUNULE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFdBQVc7WUFDWCxhQUFhO1lBQ2IsZUFBZTtZQUNmLGdCQUFnQjtZQUNoQixNQUFNO1NBQ1AsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDbkYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztXQUM1QyxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7V0FDM0MsUUFBUSxDQUFDLFNBQW9CLEdBQUksT0FBTyxDQUFDLFlBQXVCLEVBQUUsQ0FBQztRQUN2RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDakYsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLENBQUM7WUFDSCxJQUFJLFFBQVEsQ0FBQyxXQUFXLEtBQUssdUNBQXVDLENBQ2xFLFFBQVEsQ0FBQyxTQUFTLEVBQ2xCLE1BQU0sQ0FBQyx3QkFBd0IsQ0FDaEMsRUFBRSxDQUFDO2dCQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztZQUN4RixDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsYUFBYSxLQUFLLFFBQVEsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztXQUN4RixPQUFPLFFBQVEsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDO1dBQzNGLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLFdBQVcsQ0FBQyxVQUFxQixHQUFJLFFBQVEsQ0FBQyxTQUFvQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyw4RUFBOEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxLQUFLLEVBQ3hELFVBQW1CLEVBQ25CLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUM7V0FDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsb0NBQW9DLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZFLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLHNDQUFzQyxDQUN6RCxVQUFVLENBQUMsUUFBUSxFQUNuQixXQUFXLENBQ1osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLEtBQUssRUFDaEUsVUFBbUIsRUFDbkIsV0FBdUQsRUFDcEMsRUFBRTtJQUNyQixJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksdUNBQXVDLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3pFLHVDQUF1QyxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1RixPQUFPLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLGVBQWU7V0FDeEMsVUFBVSxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsU0FBUztXQUN2QyxVQUFVLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQzlDLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLGdGQUFnRixDQUFDLENBQUM7SUFDNUYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BELE9BQU8sQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxPQUFPLHFDQUFxQyxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUMvRixDQUFDLENBQUMifQ==
+/**
+ * The non-secret environment names that tell a workload which retention its bucket carries.
+ *
+ * The names are the ones the cluster relay handed workloads on the Docker path, so an application
+ * that read them keeps working unchanged. Every value is a projection of verified
+ * `IObjectStorageRetentionEvidence`; none is a credential.
+ *
+ * - `S3_RETENTION_MODE`: `intent.mode`, always `compliance`.
+ * - `S3_RETENTION_POLICY_ID`: `intent.policyId`.
+ * - `S3_RETENTION_DURATION_SECONDS`: `intent.retentionDurationSeconds` in decimal.
+ * - `S3_RETENTION_INTENT_SHA256`: `intentSha256`.
+ * - `S3_RETENTION_SENTINEL_KEY`: `receipt.sentinelKey`.
+ * - `S3_RETENTION_CONFIGURED_AT`: `receipt.configuredAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_CREATED_AT`: `receipt.sentinel.createdAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_RETAIN_UNTIL`: `receipt.sentinel.retainUntil`, Unix milliseconds in
+ *   decimal.
+ * - `S3_RETENTION_SENTINEL_PAYLOAD_SHA256`: `receipt.sentinel.payloadSha256`.
+ * - `S3_RETENTION_SENTINEL_METADATA_SHA256`: `receipt.sentinel.metadataSha256`.
+ * - `S3_RETENTION_SENTINEL_ETAG`: `receipt.sentinel.etag`.
+ */
+export const objectStorageRetentionEnvironmentKeys = Object.freeze([
+    'S3_RETENTION_MODE',
+    'S3_RETENTION_POLICY_ID',
+    'S3_RETENTION_DURATION_SECONDS',
+    'S3_RETENTION_INTENT_SHA256',
+    'S3_RETENTION_SENTINEL_KEY',
+    'S3_RETENTION_CONFIGURED_AT',
+    'S3_RETENTION_SENTINEL_CREATED_AT',
+    'S3_RETENTION_SENTINEL_RETAIN_UNTIL',
+    'S3_RETENTION_SENTINEL_PAYLOAD_SHA256',
+    'S3_RETENTION_SENTINEL_METADATA_SHA256',
+    'S3_RETENTION_SENTINEL_ETAG',
+]);
+/**
+ * The retention environment of evidence that proves `expectedArg`.
+ *
+ * The evidence is validated against the expectation first, with the same validator every other
+ * consumer of retention evidence uses; the first reason it is refused is thrown. A workload is
+ * never told about a retention nobody proved.
+ */
+export const createObjectStorageRetentionEnvironment = async (evidenceArg, expectedArg) => {
+    const errors = await validateObjectStorageRetentionEvidence(evidenceArg, expectedArg);
+    if (errors.length > 0)
+        throw new Error(errors[0]);
+    return {
+        S3_RETENTION_MODE: evidenceArg.intent.mode,
+        S3_RETENTION_POLICY_ID: evidenceArg.intent.policyId,
+        S3_RETENTION_DURATION_SECONDS: String(evidenceArg.intent.retentionDurationSeconds),
+        S3_RETENTION_INTENT_SHA256: evidenceArg.intentSha256,
+        S3_RETENTION_SENTINEL_KEY: evidenceArg.receipt.sentinelKey,
+        S3_RETENTION_CONFIGURED_AT: String(evidenceArg.receipt.configuredAt),
+        S3_RETENTION_SENTINEL_CREATED_AT: String(evidenceArg.receipt.sentinel.createdAt),
+        S3_RETENTION_SENTINEL_RETAIN_UNTIL: String(evidenceArg.receipt.sentinel.retainUntil),
+        S3_RETENTION_SENTINEL_PAYLOAD_SHA256: evidenceArg.receipt.sentinel.payloadSha256,
+        S3_RETENTION_SENTINEL_METADATA_SHA256: evidenceArg.receipt.sentinel.metadataSha256,
+        S3_RETENTION_SENTINEL_ETAG: evidenceArg.receipt.sentinel.etag,
+    };
+};
+const canonicalDecimalPattern = /^[1-9][0-9]*$/;
+const readCanonicalPositiveInteger = (valueArg) => (typeof valueArg === 'string'
+    && canonicalDecimalPattern.test(valueArg)
+    && Number.isSafeInteger(Number(valueArg))
+    ? Number(valueArg)
+    : undefined);
+/**
+ * Validates a retention environment on its own: exactly its eleven keys, canonical values, an
+ * intent digest that matches the stated intent, and sentinel timestamps that agree with the
+ * duration. It cannot prove the authority or the bucket the evidence was bound to — the
+ * environment does not carry them — so it judges the shape a workload reads, not the proof.
+ */
+export const validateObjectStorageRetentionEnvironment = async (environmentArg, pathArg = 'objectstorage retention environment') => {
+    if (!isRecord(environmentArg)
+        || !hasExactKeys(environmentArg, objectStorageRetentionEnvironmentKeys)
+        || objectStorageRetentionEnvironmentKeys.some((keyArg) => (typeof environmentArg[keyArg] !== 'string'))) {
+        return [`${pathArg} must contain exactly its string keys`];
+    }
+    const environment = environmentArg;
+    const errors = [];
+    const duration = readCanonicalPositiveInteger(environment.S3_RETENTION_DURATION_SECONDS);
+    const intent = {
+        mode: environment.S3_RETENTION_MODE,
+        policyId: environment.S3_RETENTION_POLICY_ID,
+        retentionDurationSeconds: duration,
+    };
+    const intentErrors = validateObjectStorageRetentionIntent(intent, `${pathArg} intent`);
+    errors.push(...intentErrors);
+    if (!sha256Pattern.test(environment.S3_RETENTION_INTENT_SHA256)
+        || intentErrors.length === 0
+            && environment.S3_RETENTION_INTENT_SHA256 !== await computeObjectStorageRetentionIntentSha256(intent)) {
+        errors.push(`${pathArg} S3_RETENTION_INTENT_SHA256 must be the digest of the stated intent`);
+    }
+    if (!sentinelKeyPattern.test(environment.S3_RETENTION_SENTINEL_KEY)) {
+        errors.push(`${pathArg} S3_RETENTION_SENTINEL_KEY must be canonical`);
+    }
+    const configuredAt = readCanonicalPositiveInteger(environment.S3_RETENTION_CONFIGURED_AT);
+    const createdAt = readCanonicalPositiveInteger(environment.S3_RETENTION_SENTINEL_CREATED_AT);
+    const retainUntil = readCanonicalPositiveInteger(environment.S3_RETENTION_SENTINEL_RETAIN_UNTIL);
+    if (configuredAt === undefined
+        || createdAt === undefined
+        || retainUntil === undefined
+        || createdAt < configuredAt) {
+        errors.push(`${pathArg} timestamps must be canonical positive decimals in order`);
+    }
+    else if (intentErrors.length === 0) {
+        try {
+            if (retainUntil !== createObjectStorageRetentionRetainUntil(createdAt, duration)) {
+                errors.push(`${pathArg} S3_RETENTION_SENTINEL_RETAIN_UNTIL must equal createdAt plus duration`);
+            }
+        }
+        catch {
+            errors.push(`${pathArg} S3_RETENTION_SENTINEL_RETAIN_UNTIL arithmetic must be safe`);
+        }
+    }
+    if (!sha256Pattern.test(environment.S3_RETENTION_SENTINEL_PAYLOAD_SHA256)
+        || !sha256Pattern.test(environment.S3_RETENTION_SENTINEL_METADATA_SHA256)
+        || !etagPattern.test(environment.S3_RETENTION_SENTINEL_ETAG)) {
+        errors.push(`${pathArg} sentinel digests and ETag must be canonical`);
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2JqZWN0c3RvcmFnZXJldGVudGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL29iamVjdHN0b3JhZ2VyZXRlbnRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0UsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDN0UsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTVELE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDeEQscUJBQXFCLEVBQUUsRUFBRTtJQUN6QiwrQkFBK0IsRUFBRSxHQUFHLEdBQUcsR0FBRyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRTtDQUMxRCxDQUFDLENBQUM7QUFvRUgsTUFBTSxlQUFlLEdBQUcsd0JBQXdCLENBQUM7QUFDakQsTUFBTSxpQkFBaUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUNoRSxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQztBQUN2QyxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQztBQUNyQzs7OztHQUlHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBRyw2REFBNkQsQ0FBQztBQUV6RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUMzRSxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUM1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ3hCLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztXQUNuRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUMvQyxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN2RSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxDQUMzRCxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsU0FBa0IsRUFDbEIsT0FBTyxHQUFHLGdDQUFnQyxFQUNoQyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7V0FDbkIsQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssWUFBWTtXQUM5QixPQUFPLFNBQVMsQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN0QyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0MsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQztXQUN4RCxTQUFTLENBQUMsd0JBQW1DO2NBQzdDLDRCQUE0QixDQUFDLCtCQUErQixFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sbURBQW1ELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsWUFBb0IsRUFDcEIsMkJBQW1DLEVBQzNCLEVBQUU7SUFDVixJQUFJLENBQUMscUJBQXFCLENBQUMsWUFBWSxDQUFDO1dBQ25DLENBQUMscUJBQXFCLENBQUMsMkJBQTJCLENBQUM7V0FDbkQsMkJBQTJCLEdBQUcsNEJBQTRCLENBQUMsK0JBQStCLEVBQUUsQ0FBQztRQUNoRyxNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLFlBQVksR0FBRywyQkFBMkIsR0FBRyxJQUFJLENBQUM7SUFDdEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsU0FBd0MsRUFDaEMsRUFBRTtJQUNWLE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQy9ELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDcEIsVUFBVSxFQUFFLGVBQWU7UUFDM0IsU0FBUyxFQUFFO1lBQ1QsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO1lBQ3BCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUTtZQUM1Qix3QkFBd0IsRUFBRSxTQUFTLENBQUMsd0JBQXdCO1NBQzdEO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxTQUF3QyxFQUN2QixFQUFFLENBQUMsNEJBQTRCLENBQ2hELDZDQUE2QyxDQUFDLFNBQVMsQ0FBQyxFQUN4RCxDQUFDLFNBQVMsRUFBRSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELE9BQWdCLEVBQ2hCLFFBQWlCLEVBQ1IsRUFBRSxDQUFDLG9DQUFvQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQ25FLG9DQUFvQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQzFELE9BQXlDLENBQUMsSUFBSTtZQUMzQyxRQUEwQyxDQUFDLElBQUk7T0FDbEQsT0FBeUMsQ0FBQyxRQUFRO1lBQy9DLFFBQTBDLENBQUMsUUFBUTtPQUN0RCxPQUF5QyxDQUFDLHdCQUF3QjtZQUMvRCxRQUEwQyxDQUFDLHdCQUF3QixDQUFDO0FBRTdFLE1BQU0sMEJBQTBCLEdBQUcsQ0FDakMsT0FBZ0IsRUFDaEIsUUFBaUIsRUFDUixFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztPQUMxQixRQUFRLENBQUMsUUFBUSxDQUFDO09BQ2xCLE9BQU8sQ0FBQyxJQUFJLEtBQUssWUFBWTtPQUM3QixRQUFRLENBQUMsSUFBSSxLQUFLLFlBQVk7T0FDOUIsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7T0FDcEMsT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtPQUN0QyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLENBQUM7T0FDdkQsT0FBTyxDQUFDLHdCQUF3QixLQUFLLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztBQUU1RSxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQW9CLEVBQ3BCLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDckIsQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFO1lBQzVCLFFBQVE7WUFDUixjQUFjO1lBQ2QsV0FBVztZQUNYLFlBQVk7WUFDWixTQUFTO1lBQ1QsWUFBWTtTQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN4RSxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUMsTUFBdUMsQ0FBQztJQUNuRSxJQUFJLENBQUMsMEJBQTBCLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMzQyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQztXQUM3QyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDakIsV0FBVyxDQUFDLFlBQVksS0FBSyxNQUFNLHlDQUF5QyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsU0FBUyxDQUFDO0lBQ3hDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ25CLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRTtZQUMxQixXQUFXO1lBQ1gsV0FBVztZQUNYLDBCQUEwQjtZQUMxQixzQkFBc0I7U0FDdkIsQ0FBQztXQUNDLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7V0FDNUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztXQUM3QyxPQUFPLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQzVDLFNBQVMsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUM7V0FDMUQsU0FBUyxDQUFDLHdCQUF3QixLQUFLLFdBQVcsQ0FBQyx3QkFBd0I7V0FDM0UsT0FBTyxTQUFTLENBQUMsb0JBQW9CLEtBQUssUUFBUTtXQUNsRCxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDO1dBQ25ELFNBQVMsQ0FBQyxvQkFBb0IsS0FBSyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUN6RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlGQUFpRixDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVLENBQUM7SUFDMUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFO1lBQzNCLFdBQVc7WUFDWCxTQUFTO1lBQ1QsT0FBTztZQUNQLGtCQUFrQjtZQUNsQiw0QkFBNEI7U0FDN0IsQ0FBQztXQUNDLFVBQVUsQ0FBQyxTQUFTLEtBQUssSUFBSTtXQUM3QixDQUFDLFVBQVUsQ0FBQyxPQUFPLEtBQUssWUFBWSxJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssV0FBVyxDQUFDO1dBQzNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1dBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDN0IsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxZQUFZO1dBQ3BDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJO1dBQ3BDLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUM7SUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7V0FDakIsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFO1lBQ3hCLE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFlBQVk7WUFDWixjQUFjO1lBQ2QsYUFBYTtZQUNiLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUN6RSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSx1Q0FBdUMsQ0FDekMsT0FBTyxDQUFDLFVBQVUsRUFDbEIsd0NBQXdDLENBQ3pDLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1dBQzNDLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7WUFDekIsU0FBUztZQUNULE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFdBQVc7WUFDWCxhQUFhO1lBQ2IsZUFBZTtZQUNmLGdCQUFnQjtZQUNoQixNQUFNO1NBQ1AsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDbkYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztXQUM1QyxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7V0FDM0MsUUFBUSxDQUFDLFNBQW9CLEdBQUksT0FBTyxDQUFDLFlBQXVCLEVBQUUsQ0FBQztRQUN2RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDakYsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLENBQUM7WUFDSCxJQUFJLFFBQVEsQ0FBQyxXQUFXLEtBQUssdUNBQXVDLENBQ2xFLFFBQVEsQ0FBQyxTQUFTLEVBQ2xCLE1BQU0sQ0FBQyx3QkFBd0IsQ0FDaEMsRUFBRSxDQUFDO2dCQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztZQUN4RixDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsYUFBYSxLQUFLLFFBQVEsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztXQUN4RixPQUFPLFFBQVEsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDO1dBQzNGLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLFdBQVcsQ0FBQyxVQUFxQixHQUFJLFFBQVEsQ0FBQyxTQUFvQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyw4RUFBOEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxLQUFLLEVBQ3hELFVBQW1CLEVBQ25CLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUM7V0FDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsb0NBQW9DLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZFLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLHNDQUFzQyxDQUN6RCxVQUFVLENBQUMsUUFBUSxFQUNuQixXQUFXLENBQ1osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLEtBQUssRUFDaEUsVUFBbUIsRUFDbkIsV0FBdUQsRUFDcEMsRUFBRTtJQUNyQixJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksdUNBQXVDLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3pFLHVDQUF1QyxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1RixPQUFPLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLGVBQWU7V0FDeEMsVUFBVSxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsU0FBUztXQUN2QyxVQUFVLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQzlDLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLGdGQUFnRixDQUFDLENBQUM7SUFDNUYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BELE9BQU8sQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxPQUFPLHFDQUFxQyxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUMvRixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW1CRztBQUNILE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDakUsbUJBQW1CO0lBQ25CLHdCQUF3QjtJQUN4QiwrQkFBK0I7SUFDL0IsNEJBQTRCO0lBQzVCLDJCQUEyQjtJQUMzQiw0QkFBNEI7SUFDNUIsa0NBQWtDO0lBQ2xDLG9DQUFvQztJQUNwQyxzQ0FBc0M7SUFDdEMsdUNBQXVDO0lBQ3ZDLDRCQUE0QjtDQUNwQixDQUFDLENBQUM7QUFTWjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxLQUFLLEVBQzFELFdBQTRDLEVBQzVDLFdBQXVELEVBQ1YsRUFBRTtJQUMvQyxNQUFNLE1BQU0sR0FBRyxNQUFNLHNDQUFzQyxDQUFDLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUN0RixJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbEQsT0FBTztRQUNMLGlCQUFpQixFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsSUFBSTtRQUMxQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLFFBQVE7UUFDbkQsNkJBQTZCLEVBQUUsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsd0JBQXdCLENBQUM7UUFDbEYsMEJBQTBCLEVBQUUsV0FBVyxDQUFDLFlBQVk7UUFDcEQseUJBQXlCLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxXQUFXO1FBQzFELDBCQUEwQixFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQztRQUNwRSxnQ0FBZ0MsRUFBRSxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1FBQ2hGLGtDQUFrQyxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7UUFDcEYsb0NBQW9DLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsYUFBYTtRQUNoRixxQ0FBcUMsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxjQUFjO1FBQ2xGLDBCQUEwQixFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUk7S0FDOUQsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLE1BQU0sdUJBQXVCLEdBQUcsZUFBZSxDQUFDO0FBRWhELE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDOUUsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUN6Qix1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO09BQ3RDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDO0lBQ2xCLENBQUMsQ0FBQyxTQUFTLENBQ2QsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxjQUF1QixFQUN2QixPQUFPLEdBQUcscUNBQXFDLEVBQzVCLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUM7V0FDeEIsQ0FBQyxZQUFZLENBQUMsY0FBYyxFQUFFLHFDQUFxQyxDQUFDO1dBQ3BFLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FDeEQsT0FBTyxjQUFjLENBQUMsTUFBTSxDQUFDLEtBQUssUUFBUSxDQUMzQyxDQUFDLEVBQUUsQ0FBQztRQUNMLE9BQU8sQ0FBQyxHQUFHLE9BQU8sdUNBQXVDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsTUFBTSxXQUFXLEdBQUcsY0FBb0QsQ0FBQztJQUN6RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxRQUFRLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLDZCQUE2QixDQUFDLENBQUM7SUFDekYsTUFBTSxNQUFNLEdBQUc7UUFDYixJQUFJLEVBQUUsV0FBVyxDQUFDLGlCQUFpQjtRQUNuQyxRQUFRLEVBQUUsV0FBVyxDQUFDLHNCQUFzQjtRQUM1Qyx3QkFBd0IsRUFBRSxRQUFRO0tBQ25DLENBQUM7SUFDRixNQUFNLFlBQVksR0FBRyxvQ0FBb0MsQ0FBQyxNQUFNLEVBQUUsR0FBRyxPQUFPLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxZQUFZLENBQUMsQ0FBQztJQUM3QixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsMEJBQTBCLENBQUM7V0FDMUQsWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ3ZCLFdBQVcsQ0FBQywwQkFBMEIsS0FBSyxNQUFNLHlDQUF5QyxDQUMzRixNQUF1QyxDQUN4QyxFQUFFLENBQUM7UUFDTixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxxRUFBcUUsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyx5QkFBeUIsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLDBCQUEwQixDQUFDLENBQUM7SUFDMUYsTUFBTSxTQUFTLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDN0YsTUFBTSxXQUFXLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDakcsSUFBSSxZQUFZLEtBQUssU0FBUztXQUN6QixTQUFTLEtBQUssU0FBUztXQUN2QixXQUFXLEtBQUssU0FBUztXQUN6QixTQUFTLEdBQUcsWUFBWSxFQUFFLENBQUM7UUFDOUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMERBQTBELENBQUMsQ0FBQztJQUNwRixDQUFDO1NBQU0sSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3JDLElBQUksQ0FBQztZQUNILElBQUksV0FBVyxLQUFLLHVDQUF1QyxDQUFDLFNBQVMsRUFBRSxRQUFrQixDQUFDLEVBQUUsQ0FBQztnQkFDM0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sd0VBQXdFLENBQUMsQ0FBQztZQUNsRyxDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDZEQUE2RCxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsb0NBQW9DLENBQUM7V0FDcEUsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxxQ0FBcUMsQ0FBQztXQUN0RSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLDBCQUEwQixDQUFDLEVBQUUsQ0FBQztRQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/requests/node.d.ts

@@ -4,6 +4,7 @@ import type { ICluster } from '../data/cluster.js';
 import type { IClusterNode, INodeAction, INodeMetricsSample, TNodeActionName } from '../data/clusternode.js';
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
+import type { IPlatformObjectStorageEndpoint } from '../platform/objectstorage.js';
 import type { INodeCredentialMetadata, INodeCredentialMutationPreconditions, INodeCredentialMutationResult, TNodeCredentialPurpose } from '../data/nodecredential.js';
 import type { INodeRuntimeRetirement } from '../data/noderetirement.js';
 import type { INodeRuntimeBindingRead, INodeRuntimeBindingRequest } from '../data/noderuntimebinding.js';
@@ -217,6 +218,34 @@ export interface IReq_Any_Cloudly_SetClusterNodeCorestoreEndpoint extends plugin
         node: IClusterNode;
     };
 }
+/**
+ * An administrator states where a workload on one node reaches the node's Corestore object
+ * storage, and the region it signs for: `IClusterNode.data.corestoreObjectStorage`.
+ *
+ * A request of its own, separate from `setClusterNodeCorestoreEndpoint`, because the two are
+ * separate facts with separate readers — the relay dials the control endpoint, a workload dials
+ * this one — and setting one never touches the other. A caller that states only the control
+ * endpoint leaves this one as it stands.
+ *
+ * Cloudly validates it with `validatePlatformObjectStorageEndpoint` before it writes and takes the
+ * node's own real-write fence inside the writing transaction, as for the control endpoint.
+ * `objectStorage: null` clears it, which is the same fact as never having set one: no
+ * object-storage environment can be composed for a binding on this node. The endpoint says where,
+ * never with what — no credential travels in this request or in the node document.
+ */
+export interface IReq_Any_Cloudly_SetClusterNodeCorestoreObjectStorageEndpoint extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_SetClusterNodeCorestoreObjectStorageEndpoint> {
+    method: 'setClusterNodeCorestoreObjectStorageEndpoint';
+    request: {
+        identity: IIdentity;
+        nodeId: string;
+        /** The node's object-storage endpoint and region, or `null` to state that it has none. */
+        objectStorage: IPlatformObjectStorageEndpoint | null;
+    };
+    response: {
+        /** The node as it now stands, so a caller needs no second read to see what it set. */
+        node: IClusterNode;
+    };
+}
 export interface IReq_Any_Cloudly_CreateNodeAction extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_CreateNodeAction> {
     method: 'createNodeAction';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.24.0",
+  "version": "32.25.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -3486,6 +3486,78 @@ Coreflow, all exported from `data` and `platform`:
 While a binding of a service reports `legacy-adoption-pending`, the service's runtime status waits as
 `legacy-adoption-pending` instead of `bindings-pending`.
 
+### Object-Storage Binding Environment
+
+An object-storage binding gives its workload two things. The access key and the secret reach it
+only as Secrets: the six aliases `createCorestoreCredentialSecretValues()` expands
+(`S3_ACCESS_KEY`, `S3_ACCESS_KEY_ID`, `S3_SECRET_KEY`, `S3_SECRET_ACCESS_KEY`,
+`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), published through the sealed Secret set. Where the
+bucket is, and which retention it carries, is non-secret and reaches it through the runtime
+configuration: Cloudly composes it into `IRuntimeConfig.environment`, the complete public
+environment, so no further runtime spec or assignment field carries it. The names are the ones
+Corestore and the cluster relay handed workloads before, so an application that read them keeps
+working unchanged.
+
+| Name | Value |
+| --- | --- |
+| `S3_ENDPOINT`, `AWS_ENDPOINT_URL` | The endpoint origin, for example `http://192.0.2.15:9000`. |
+| `S3_ENDPOINT_HOST` | The origin's host; an IPv6 literal keeps its brackets. |
+| `S3_PORT` | The origin's port, `80` or `443` when the origin states none. |
+| `S3_USE_SSL` | `true` for `https:`, `false` for `http:`. |
+| `S3_REGION`, `AWS_REGION` | The signing region. |
+| `S3_BUCKET` | `IPlatformBinding.objectstorageBucketName`. |
+| `AWS_S3_FORCE_PATH_STYLE` | Always `true`: a node-local origin has no wildcard DNS. |
+| `S3_RETENTION_MODE` | `intent.mode`, always `compliance`. |
+| `S3_RETENTION_POLICY_ID` | `intent.policyId`. |
+| `S3_RETENTION_DURATION_SECONDS` | `intent.retentionDurationSeconds`. |
+| `S3_RETENTION_INTENT_SHA256` | `intentSha256`. |
+| `S3_RETENTION_SENTINEL_KEY` | `receipt.sentinelKey`. |
+| `S3_RETENTION_CONFIGURED_AT` | `receipt.configuredAt`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_CREATED_AT` | `receipt.sentinel.createdAt`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_RETAIN_UNTIL` | `receipt.sentinel.retainUntil`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_PAYLOAD_SHA256` | `receipt.sentinel.payloadSha256`. |
+| `S3_RETENTION_SENTINEL_METADATA_SHA256` | `receipt.sentinel.metadataSha256`. |
+| `S3_RETENTION_SENTINEL_ETAG` | `receipt.sentinel.etag`. |
+
+Every number is a canonical decimal. `objectStorageEndpointEnvironmentKeys`,
+`objectStorageRetentionEnvironmentKeys` and `objectStorageBindingEnvironmentKeys` publish the
+lists in this order, with the matching `T…EnvironmentKey` and `T…Environment` types.
+
+**Where the endpoint comes from.** Corestore is node-local, so the endpoint is a fact about the
+node that holds the bucket: `IClusterNode.data.corestoreObjectStorage` is an optional
+`IPlatformObjectStorageEndpoint { endpoint, region }`, checked by
+`validatePlatformObjectStorageEndpoint()` (a canonical `http:` or `https:` origin and a lowercase
+region). It sits beside `corestore`, not inside it: the relay dials the control endpoint and a
+workload dials this one, and `IClusterNodeCorestore` keeps its exact schema, so a relay that
+validates it goes on accepting every node document. An administrator sets it with
+`setClusterNodeCorestoreObjectStorageEndpoint { identity; nodeId; objectStorage }`, answered by
+Cloudly with the node as it now stands; `objectStorage: null` clears it. The request is separate
+from `setClusterNodeCorestoreEndpoint`, so setting the control endpoint never touches it. A node
+without it cannot give a workload an object-storage environment; nothing derives a port, a scheme
+or a region.
+
+**Composing.** `createObjectStorageBindingEnvironment(binding, endpoint)` returns the nine endpoint
+names for a binding that declares no retention, and all twenty when it declares retention with
+evidence. It refuses by name, and never guesses, when the binding is not `objectstorage`, carries
+no canonical bucket, or declares retention without `evidence`: a bucket whose immutability is not
+proven yet must not be handed to its workload as if it were ordinary storage, so the workload
+waits for the evidence. The evidence is validated with `validateObjectStorageRetentionEvidence()`
+against the binding's own service, binding id, bucket and intent, and the reconciliation
+generation and request digest it states. The split helpers are
+`createObjectStorageEndpointEnvironment(endpoint, bucketName)` and
+`createObjectStorageRetentionEnvironment(evidence, expectation)`.
+`mergeObjectStorageBindingEnvironment(environment, bindingEnvironment)` adds one binding's names
+to a workload environment and refuses, naming every key, a name that is already set — by the
+service itself or by a second object-storage binding — instead of letting one value replace
+another.
+
+**Validating.** `validateObjectStorageBindingEnvironment()` accepts exactly the endpoint names and
+all or none of the retention names, each value the one its endpoint and evidence derive, and
+refuses any other name — so a credential alias in the public environment is refused by name.
+`validateObjectStorageEndpointEnvironment()` and `validateObjectStorageRetentionEnvironment()`
+judge each half on its own. The environment does not carry the evidence's authority, so
+validating it checks what a workload reads, not the proof behind it.
+
 ### Launcher Environment Delivery
 
 Launcher environment delivery uses stable `szsv-<base32-sha256>` Docker
@@ -3527,6 +3599,8 @@ Available platform modules:
 - `platform.objectstorageretention` for value-free immutable-retention intent,
   capability and sentinel evidence, authority binding, digest helpers, and
   strict validators.
+- `platform.objectstorageenvironment` for the non-secret workload environment of an
+  object-storage binding; see Object-Storage Binding Environment.
 - `platform.storagemigration` for fenced object-storage migration intent, status, consumer acknowledgements, canonical digests, and strict normalizers.
 - `platform.types` provider and binding metadata is value-free. Provider-specific
   operational config stays adapter-internal, while public DTOs expose typed

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.24.0',
+  version: '32.25.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusternode.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import { isSha256Digest, type TSha256Digest, type TImmutableContainerPlatform } from './immutableimage.js';
 import type { ISparkNodeReportRecord } from './sparknodereport.js';
+import type { IPlatformObjectStorageEndpoint } from '../platform/objectstorage.js';
 import {
   fleetCutoverContract,
   snapshotFleetCutoverPreparedVolumeHandoffAggregate,
@@ -1773,6 +1774,21 @@ export interface IClusterNode {
      * while Docker Swarm resolved it is exactly what stops resolving.
      */
     corestore?: IClusterNodeCorestore;
+
+    /**
+     * Where a workload on this node reaches the node's Corestore object storage, and the region
+     * it signs for.
+     *
+     * Cloudly owns it, sets it with `setClusterNodeCorestoreObjectStorageEndpoint`, and composes
+     * it into the environment of every object-storage binding placed on this node with
+     * `createObjectStorageBindingEnvironment()`. It is a sibling of `corestore`, not a member:
+     * the control API and the S3 API listen on different ports and have different readers — the
+     * relay dials `corestore`, a workload dials this — and `corestore` keeps its exact schema.
+     * Absent means no object-storage environment can be composed for this node, and a binding's
+     * workload waits rather than being handed a guessed port, scheme or region. Value-free like
+     * `corestore`: it says where, never with what.
+     */
+    corestoreObjectStorage?: IPlatformObjectStorageEndpoint;
   };
 }
 
@@ -1789,7 +1805,7 @@ export interface IClusterNode {
 export interface IClusterNodeCorestore {
   /**
    * The canonical origin of the control API, for example
-   * `http://10.20.0.15:3000`.
+   * `http://192.0.2.15:3000`.
    *
    * `http:` is admitted because Corestore terminates no TLS today — it binds a
    * plain control port and advertises no transport-encryption guarantee — and

package/ts/platform/index.ts

@@ -5,6 +5,7 @@ import * as email from './email.js';
 import * as letter from './letter.js';
 import * as logging from './logging.js';
 import * as objectstorage from './objectstorage.js';
+import * as objectstorageenvironment from './objectstorageenvironment.js';
 import * as objectstorageretention from './objectstorageretention.js';
 import * as pushnotification from './pushnotification.js';
 import * as sip from './sip.js';
@@ -21,6 +22,7 @@ export {
   letter,
   logging,
   objectstorage,
+  objectstorageenvironment,
   objectstorageretention,
   pushnotification,
   sip,
@@ -32,6 +34,7 @@ export {
 
 export * from './storage.js';
 export * from './objectstorage.js';
+export * from './objectstorageenvironment.js';
 export * from './objectstorageretention.js';
 export * from './storagemigration.js';
 export * from './types.js';