@serve.zone/interfaces 32.24.0 → 32.26.0

package/dist_ts/platform/objectstorageretention.js

@@ -249,4 +249,124 @@ export const validatePlatformBindingObjectStorageRetention = async (bindingArg,
     }
     return validateObjectStorageRetentionBinding(bindingArg.objectstorageRetention, expectedArg);
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2JqZWN0c3RvcmFnZXJldGVudGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL29iamVjdHN0b3JhZ2VyZXRlbnRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0UsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDN0UsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTVELE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDeEQscUJBQXFCLEVBQUUsRUFBRTtJQUN6QiwrQkFBK0IsRUFBRSxHQUFHLEdBQUcsR0FBRyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRTtDQUMxRCxDQUFDLENBQUM7QUFvRUgsTUFBTSxlQUFlLEdBQUcsd0JBQXdCLENBQUM7QUFDakQsTUFBTSxpQkFBaUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUNoRSxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQztBQUN2QyxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQztBQUNyQzs7OztHQUlHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBRyw2REFBNkQsQ0FBQztBQUV6RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUMzRSxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUM1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ3hCLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztXQUNuRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUMvQyxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN2RSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxDQUMzRCxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsU0FBa0IsRUFDbEIsT0FBTyxHQUFHLGdDQUFnQyxFQUNoQyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7V0FDbkIsQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssWUFBWTtXQUM5QixPQUFPLFNBQVMsQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN0QyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0MsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQztXQUN4RCxTQUFTLENBQUMsd0JBQW1DO2NBQzdDLDRCQUE0QixDQUFDLCtCQUErQixFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sbURBQW1ELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsWUFBb0IsRUFDcEIsMkJBQW1DLEVBQzNCLEVBQUU7SUFDVixJQUFJLENBQUMscUJBQXFCLENBQUMsWUFBWSxDQUFDO1dBQ25DLENBQUMscUJBQXFCLENBQUMsMkJBQTJCLENBQUM7V0FDbkQsMkJBQTJCLEdBQUcsNEJBQTRCLENBQUMsK0JBQStCLEVBQUUsQ0FBQztRQUNoRyxNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLFlBQVksR0FBRywyQkFBMkIsR0FBRyxJQUFJLENBQUM7SUFDdEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsU0FBd0MsRUFDaEMsRUFBRTtJQUNWLE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQy9ELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDcEIsVUFBVSxFQUFFLGVBQWU7UUFDM0IsU0FBUyxFQUFFO1lBQ1QsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO1lBQ3BCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUTtZQUM1Qix3QkFBd0IsRUFBRSxTQUFTLENBQUMsd0JBQXdCO1NBQzdEO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxTQUF3QyxFQUN2QixFQUFFLENBQUMsNEJBQTRCLENBQ2hELDZDQUE2QyxDQUFDLFNBQVMsQ0FBQyxFQUN4RCxDQUFDLFNBQVMsRUFBRSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELE9BQWdCLEVBQ2hCLFFBQWlCLEVBQ1IsRUFBRSxDQUFDLG9DQUFvQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQ25FLG9DQUFvQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQzFELE9BQXlDLENBQUMsSUFBSTtZQUMzQyxRQUEwQyxDQUFDLElBQUk7T0FDbEQsT0FBeUMsQ0FBQyxRQUFRO1lBQy9DLFFBQTBDLENBQUMsUUFBUTtPQUN0RCxPQUF5QyxDQUFDLHdCQUF3QjtZQUMvRCxRQUEwQyxDQUFDLHdCQUF3QixDQUFDO0FBRTdFLE1BQU0sMEJBQTBCLEdBQUcsQ0FDakMsT0FBZ0IsRUFDaEIsUUFBaUIsRUFDUixFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztPQUMxQixRQUFRLENBQUMsUUFBUSxDQUFDO09BQ2xCLE9BQU8sQ0FBQyxJQUFJLEtBQUssWUFBWTtPQUM3QixRQUFRLENBQUMsSUFBSSxLQUFLLFlBQVk7T0FDOUIsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7T0FDcEMsT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtPQUN0QyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLENBQUM7T0FDdkQsT0FBTyxDQUFDLHdCQUF3QixLQUFLLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztBQUU1RSxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQW9CLEVBQ3BCLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDckIsQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFO1lBQzVCLFFBQVE7WUFDUixjQUFjO1lBQ2QsV0FBVztZQUNYLFlBQVk7WUFDWixTQUFTO1lBQ1QsWUFBWTtTQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN4RSxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUMsTUFBdUMsQ0FBQztJQUNuRSxJQUFJLENBQUMsMEJBQTBCLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMzQyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQztXQUM3QyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDakIsV0FBVyxDQUFDLFlBQVksS0FBSyxNQUFNLHlDQUF5QyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsU0FBUyxDQUFDO0lBQ3hDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ25CLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRTtZQUMxQixXQUFXO1lBQ1gsV0FBVztZQUNYLDBCQUEwQjtZQUMxQixzQkFBc0I7U0FDdkIsQ0FBQztXQUNDLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7V0FDNUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztXQUM3QyxPQUFPLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQzVDLFNBQVMsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUM7V0FDMUQsU0FBUyxDQUFDLHdCQUF3QixLQUFLLFdBQVcsQ0FBQyx3QkFBd0I7V0FDM0UsT0FBTyxTQUFTLENBQUMsb0JBQW9CLEtBQUssUUFBUTtXQUNsRCxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDO1dBQ25ELFNBQVMsQ0FBQyxvQkFBb0IsS0FBSyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUN6RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlGQUFpRixDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVLENBQUM7SUFDMUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFO1lBQzNCLFdBQVc7WUFDWCxTQUFTO1lBQ1QsT0FBTztZQUNQLGtCQUFrQjtZQUNsQiw0QkFBNEI7U0FDN0IsQ0FBQztXQUNDLFVBQVUsQ0FBQyxTQUFTLEtBQUssSUFBSTtXQUM3QixDQUFDLFVBQVUsQ0FBQyxPQUFPLEtBQUssWUFBWSxJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssV0FBVyxDQUFDO1dBQzNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1dBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDN0IsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxZQUFZO1dBQ3BDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJO1dBQ3BDLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUM7SUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7V0FDakIsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFO1lBQ3hCLE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFlBQVk7WUFDWixjQUFjO1lBQ2QsYUFBYTtZQUNiLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUN6RSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSx1Q0FBdUMsQ0FDekMsT0FBTyxDQUFDLFVBQVUsRUFDbEIsd0NBQXdDLENBQ3pDLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1dBQzNDLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7WUFDekIsU0FBUztZQUNULE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFdBQVc7WUFDWCxhQUFhO1lBQ2IsZUFBZTtZQUNmLGdCQUFnQjtZQUNoQixNQUFNO1NBQ1AsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDbkYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztXQUM1QyxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7V0FDM0MsUUFBUSxDQUFDLFNBQW9CLEdBQUksT0FBTyxDQUFDLFlBQXVCLEVBQUUsQ0FBQztRQUN2RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDakYsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLENBQUM7WUFDSCxJQUFJLFFBQVEsQ0FBQyxXQUFXLEtBQUssdUNBQXVDLENBQ2xFLFFBQVEsQ0FBQyxTQUFTLEVBQ2xCLE1BQU0sQ0FBQyx3QkFBd0IsQ0FDaEMsRUFBRSxDQUFDO2dCQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztZQUN4RixDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsYUFBYSxLQUFLLFFBQVEsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztXQUN4RixPQUFPLFFBQVEsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDO1dBQzNGLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLFdBQVcsQ0FBQyxVQUFxQixHQUFJLFFBQVEsQ0FBQyxTQUFvQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyw4RUFBOEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxLQUFLLEVBQ3hELFVBQW1CLEVBQ25CLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUM7V0FDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsb0NBQW9DLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZFLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLHNDQUFzQyxDQUN6RCxVQUFVLENBQUMsUUFBUSxFQUNuQixXQUFXLENBQ1osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLEtBQUssRUFDaEUsVUFBbUIsRUFDbkIsV0FBdUQsRUFDcEMsRUFBRTtJQUNyQixJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksdUNBQXVDLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3pFLHVDQUF1QyxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1RixPQUFPLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLGVBQWU7V0FDeEMsVUFBVSxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsU0FBUztXQUN2QyxVQUFVLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQzlDLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLGdGQUFnRixDQUFDLENBQUM7SUFDNUYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BELE9BQU8sQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxPQUFPLHFDQUFxQyxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUMvRixDQUFDLENBQUMifQ==
+/**
+ * The non-secret environment names that tell a workload which retention its bucket carries.
+ *
+ * The names are the ones the cluster relay handed workloads on the Docker path, so an application
+ * that read them keeps working unchanged. Every value is a projection of verified
+ * `IObjectStorageRetentionEvidence`; none is a credential.
+ *
+ * - `S3_RETENTION_MODE`: `intent.mode`, always `compliance`.
+ * - `S3_RETENTION_POLICY_ID`: `intent.policyId`.
+ * - `S3_RETENTION_DURATION_SECONDS`: `intent.retentionDurationSeconds` in decimal.
+ * - `S3_RETENTION_INTENT_SHA256`: `intentSha256`.
+ * - `S3_RETENTION_SENTINEL_KEY`: `receipt.sentinelKey`.
+ * - `S3_RETENTION_CONFIGURED_AT`: `receipt.configuredAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_CREATED_AT`: `receipt.sentinel.createdAt`, Unix milliseconds in decimal.
+ * - `S3_RETENTION_SENTINEL_RETAIN_UNTIL`: `receipt.sentinel.retainUntil`, Unix milliseconds in
+ *   decimal.
+ * - `S3_RETENTION_SENTINEL_PAYLOAD_SHA256`: `receipt.sentinel.payloadSha256`.
+ * - `S3_RETENTION_SENTINEL_METADATA_SHA256`: `receipt.sentinel.metadataSha256`.
+ * - `S3_RETENTION_SENTINEL_ETAG`: `receipt.sentinel.etag`.
+ */
+export const objectStorageRetentionEnvironmentKeys = Object.freeze([
+    'S3_RETENTION_MODE',
+    'S3_RETENTION_POLICY_ID',
+    'S3_RETENTION_DURATION_SECONDS',
+    'S3_RETENTION_INTENT_SHA256',
+    'S3_RETENTION_SENTINEL_KEY',
+    'S3_RETENTION_CONFIGURED_AT',
+    'S3_RETENTION_SENTINEL_CREATED_AT',
+    'S3_RETENTION_SENTINEL_RETAIN_UNTIL',
+    'S3_RETENTION_SENTINEL_PAYLOAD_SHA256',
+    'S3_RETENTION_SENTINEL_METADATA_SHA256',
+    'S3_RETENTION_SENTINEL_ETAG',
+]);
+/**
+ * The retention environment of evidence that proves `expectedArg`.
+ *
+ * The evidence is validated against the expectation first, with the same validator every other
+ * consumer of retention evidence uses; the first reason it is refused is thrown. A workload is
+ * never told about a retention nobody proved.
+ */
+export const createObjectStorageRetentionEnvironment = async (evidenceArg, expectedArg) => {
+    const errors = await validateObjectStorageRetentionEvidence(evidenceArg, expectedArg);
+    if (errors.length > 0)
+        throw new Error(errors[0]);
+    return {
+        S3_RETENTION_MODE: evidenceArg.intent.mode,
+        S3_RETENTION_POLICY_ID: evidenceArg.intent.policyId,
+        S3_RETENTION_DURATION_SECONDS: String(evidenceArg.intent.retentionDurationSeconds),
+        S3_RETENTION_INTENT_SHA256: evidenceArg.intentSha256,
+        S3_RETENTION_SENTINEL_KEY: evidenceArg.receipt.sentinelKey,
+        S3_RETENTION_CONFIGURED_AT: String(evidenceArg.receipt.configuredAt),
+        S3_RETENTION_SENTINEL_CREATED_AT: String(evidenceArg.receipt.sentinel.createdAt),
+        S3_RETENTION_SENTINEL_RETAIN_UNTIL: String(evidenceArg.receipt.sentinel.retainUntil),
+        S3_RETENTION_SENTINEL_PAYLOAD_SHA256: evidenceArg.receipt.sentinel.payloadSha256,
+        S3_RETENTION_SENTINEL_METADATA_SHA256: evidenceArg.receipt.sentinel.metadataSha256,
+        S3_RETENTION_SENTINEL_ETAG: evidenceArg.receipt.sentinel.etag,
+    };
+};
+const canonicalDecimalPattern = /^[1-9][0-9]*$/;
+const readCanonicalPositiveInteger = (valueArg) => (typeof valueArg === 'string'
+    && canonicalDecimalPattern.test(valueArg)
+    && Number.isSafeInteger(Number(valueArg))
+    ? Number(valueArg)
+    : undefined);
+/**
+ * Validates a retention environment on its own: exactly its eleven keys, canonical values, an
+ * intent digest that matches the stated intent, and sentinel timestamps that agree with the
+ * duration. It cannot prove the authority or the bucket the evidence was bound to — the
+ * environment does not carry them — so it judges the shape a workload reads, not the proof.
+ */
+export const validateObjectStorageRetentionEnvironment = async (environmentArg, pathArg = 'objectstorage retention environment') => {
+    if (!isRecord(environmentArg)
+        || !hasExactKeys(environmentArg, objectStorageRetentionEnvironmentKeys)
+        || objectStorageRetentionEnvironmentKeys.some((keyArg) => (typeof environmentArg[keyArg] !== 'string'))) {
+        return [`${pathArg} must contain exactly its string keys`];
+    }
+    const environment = environmentArg;
+    const errors = [];
+    const duration = readCanonicalPositiveInteger(environment.S3_RETENTION_DURATION_SECONDS);
+    const intent = {
+        mode: environment.S3_RETENTION_MODE,
+        policyId: environment.S3_RETENTION_POLICY_ID,
+        retentionDurationSeconds: duration,
+    };
+    const intentErrors = validateObjectStorageRetentionIntent(intent, `${pathArg} intent`);
+    errors.push(...intentErrors);
+    if (!sha256Pattern.test(environment.S3_RETENTION_INTENT_SHA256)
+        || intentErrors.length === 0
+            && environment.S3_RETENTION_INTENT_SHA256 !== await computeObjectStorageRetentionIntentSha256(intent)) {
+        errors.push(`${pathArg} S3_RETENTION_INTENT_SHA256 must be the digest of the stated intent`);
+    }
+    if (!sentinelKeyPattern.test(environment.S3_RETENTION_SENTINEL_KEY)) {
+        errors.push(`${pathArg} S3_RETENTION_SENTINEL_KEY must be canonical`);
+    }
+    const configuredAt = readCanonicalPositiveInteger(environment.S3_RETENTION_CONFIGURED_AT);
+    const createdAt = readCanonicalPositiveInteger(environment.S3_RETENTION_SENTINEL_CREATED_AT);
+    const retainUntil = readCanonicalPositiveInteger(environment.S3_RETENTION_SENTINEL_RETAIN_UNTIL);
+    if (configuredAt === undefined
+        || createdAt === undefined
+        || retainUntil === undefined
+        || createdAt < configuredAt) {
+        errors.push(`${pathArg} timestamps must be canonical positive decimals in order`);
+    }
+    else if (intentErrors.length === 0) {
+        try {
+            if (retainUntil !== createObjectStorageRetentionRetainUntil(createdAt, duration)) {
+                errors.push(`${pathArg} S3_RETENTION_SENTINEL_RETAIN_UNTIL must equal createdAt plus duration`);
+            }
+        }
+        catch {
+            errors.push(`${pathArg} S3_RETENTION_SENTINEL_RETAIN_UNTIL arithmetic must be safe`);
+        }
+    }
+    if (!sha256Pattern.test(environment.S3_RETENTION_SENTINEL_PAYLOAD_SHA256)
+        || !sha256Pattern.test(environment.S3_RETENTION_SENTINEL_METADATA_SHA256)
+        || !etagPattern.test(environment.S3_RETENTION_SENTINEL_ETAG)) {
+        errors.push(`${pathArg} sentinel digests and ETag must be canonical`);
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib2JqZWN0c3RvcmFnZXJldGVudGlvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsYXRmb3JtL29iamVjdHN0b3JhZ2VyZXRlbnRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDM0UsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDN0UsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTVELE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDeEQscUJBQXFCLEVBQUUsRUFBRTtJQUN6QiwrQkFBK0IsRUFBRSxHQUFHLEdBQUcsR0FBRyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRTtDQUMxRCxDQUFDLENBQUM7QUFvRUgsTUFBTSxlQUFlLEdBQUcsd0JBQXdCLENBQUM7QUFDakQsTUFBTSxpQkFBaUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUNoRSxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQztBQUN2QyxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQztBQUNyQzs7OztHQUlHO0FBQ0gsTUFBTSxrQkFBa0IsR0FBRyw2REFBNkQsQ0FBQztBQUV6RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUMzRSxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUM1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ3hCLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztXQUNuRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUMvQyxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN2RSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxDQUMzRCxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsU0FBa0IsRUFDbEIsT0FBTyxHQUFHLGdDQUFnQyxFQUNoQyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7V0FDbkIsQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssWUFBWTtXQUM5QixPQUFPLFNBQVMsQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN0QyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDL0MsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFNBQVMsQ0FBQyx3QkFBd0IsQ0FBQztXQUN4RCxTQUFTLENBQUMsd0JBQW1DO2NBQzdDLDRCQUE0QixDQUFDLCtCQUErQixFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sbURBQW1ELENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FDckQsWUFBb0IsRUFDcEIsMkJBQW1DLEVBQzNCLEVBQUU7SUFDVixJQUFJLENBQUMscUJBQXFCLENBQUMsWUFBWSxDQUFDO1dBQ25DLENBQUMscUJBQXFCLENBQUMsMkJBQTJCLENBQUM7V0FDbkQsMkJBQTJCLEdBQUcsNEJBQTRCLENBQUMsK0JBQStCLEVBQUUsQ0FBQztRQUNoRyxNQUFNLElBQUksS0FBSyxDQUFDLDRFQUE0RSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLFlBQVksR0FBRywyQkFBMkIsR0FBRyxJQUFJLENBQUM7SUFDdEUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsT0FBTyxXQUFXLENBQUM7QUFDckIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsU0FBd0MsRUFDaEMsRUFBRTtJQUNWLE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQy9ELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDcEIsVUFBVSxFQUFFLGVBQWU7UUFDM0IsU0FBUyxFQUFFO1lBQ1QsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO1lBQ3BCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUTtZQUM1Qix3QkFBd0IsRUFBRSxTQUFTLENBQUMsd0JBQXdCO1NBQzdEO0tBQ0YsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxTQUF3QyxFQUN2QixFQUFFLENBQUMsNEJBQTRCLENBQ2hELDZDQUE2QyxDQUFDLFNBQVMsQ0FBQyxFQUN4RCxDQUFDLFNBQVMsRUFBRSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELE9BQWdCLEVBQ2hCLFFBQWlCLEVBQ1IsRUFBRSxDQUFDLG9DQUFvQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQ25FLG9DQUFvQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQzFELE9BQXlDLENBQUMsSUFBSTtZQUMzQyxRQUEwQyxDQUFDLElBQUk7T0FDbEQsT0FBeUMsQ0FBQyxRQUFRO1lBQy9DLFFBQTBDLENBQUMsUUFBUTtPQUN0RCxPQUF5QyxDQUFDLHdCQUF3QjtZQUMvRCxRQUEwQyxDQUFDLHdCQUF3QixDQUFDO0FBRTdFLE1BQU0sMEJBQTBCLEdBQUcsQ0FDakMsT0FBZ0IsRUFDaEIsUUFBaUIsRUFDUixFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztPQUMxQixRQUFRLENBQUMsUUFBUSxDQUFDO09BQ2xCLE9BQU8sQ0FBQyxJQUFJLEtBQUssWUFBWTtPQUM3QixRQUFRLENBQUMsSUFBSSxLQUFLLFlBQVk7T0FDOUIsT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7T0FDcEMsT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtPQUN0QyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsd0JBQXdCLENBQUM7T0FDdkQsT0FBTyxDQUFDLHdCQUF3QixLQUFLLFFBQVEsQ0FBQyx3QkFBd0IsQ0FBQztBQUU1RSxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQW9CLEVBQ3BCLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDckIsQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFO1lBQzVCLFFBQVE7WUFDUixjQUFjO1lBQ2QsV0FBVztZQUNYLFlBQVk7WUFDWixTQUFTO1lBQ1QsWUFBWTtTQUNiLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLG9DQUFvQyxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUN4RSxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUMsTUFBdUMsQ0FBQztJQUNuRSxJQUFJLENBQUMsMEJBQTBCLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsSUFBSSxPQUFPLFdBQVcsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMzQyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQztXQUM3QyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDakIsV0FBVyxDQUFDLFlBQVksS0FBSyxNQUFNLHlDQUF5QyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsU0FBUyxDQUFDO0lBQ3hDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ25CLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRTtZQUMxQixXQUFXO1lBQ1gsV0FBVztZQUNYLDBCQUEwQjtZQUMxQixzQkFBc0I7U0FDdkIsQ0FBQztXQUNDLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7V0FDNUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztXQUM3QyxPQUFPLFNBQVMsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQzVDLFNBQVMsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsd0JBQXdCLENBQUM7V0FDMUQsU0FBUyxDQUFDLHdCQUF3QixLQUFLLFdBQVcsQ0FBQyx3QkFBd0I7V0FDM0UsT0FBTyxTQUFTLENBQUMsb0JBQW9CLEtBQUssUUFBUTtXQUNsRCxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLG9CQUFvQixDQUFDO1dBQ25ELFNBQVMsQ0FBQyxvQkFBb0IsS0FBSyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUN6RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlGQUFpRixDQUFDLENBQUM7SUFDakcsQ0FBQztJQUVELE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVLENBQUM7SUFDMUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFO1lBQzNCLFdBQVc7WUFDWCxTQUFTO1lBQ1QsT0FBTztZQUNQLGtCQUFrQjtZQUNsQiw0QkFBNEI7U0FDN0IsQ0FBQztXQUNDLFVBQVUsQ0FBQyxTQUFTLEtBQUssSUFBSTtXQUM3QixDQUFDLFVBQVUsQ0FBQyxPQUFPLEtBQUssWUFBWSxJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssV0FBVyxDQUFDO1dBQzNFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1dBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDN0IsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxZQUFZO1dBQ3BDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJO1dBQ3BDLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUM7SUFDcEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7V0FDakIsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFO1lBQ3hCLE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFlBQVk7WUFDWixjQUFjO1lBQ2QsYUFBYTtZQUNiLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUN6RSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSx1Q0FBdUMsQ0FDekMsT0FBTyxDQUFDLFVBQVUsRUFDbEIsd0NBQXdDLENBQ3pDLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDO1dBQzNDLE9BQU8sT0FBTyxDQUFDLFdBQVcsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBRUQsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQztJQUNsQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7WUFDekIsU0FBUztZQUNULE1BQU07WUFDTixVQUFVO1lBQ1YsMEJBQTBCO1lBQzFCLFdBQVc7WUFDWCxhQUFhO1lBQ2IsZUFBZTtZQUNmLGdCQUFnQjtZQUNoQixNQUFNO1NBQ1AsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDbkYsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxDQUFDLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztXQUM1QyxDQUFDLHFCQUFxQixDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7V0FDM0MsUUFBUSxDQUFDLFNBQW9CLEdBQUksT0FBTyxDQUFDLFlBQXVCLEVBQUUsQ0FBQztRQUN2RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDakYsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLENBQUM7WUFDSCxJQUFJLFFBQVEsQ0FBQyxXQUFXLEtBQUssdUNBQXVDLENBQ2xFLFFBQVEsQ0FBQyxTQUFTLEVBQ2xCLE1BQU0sQ0FBQyx3QkFBd0IsQ0FDaEMsRUFBRSxDQUFDO2dCQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztZQUN4RixDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsYUFBYSxLQUFLLFFBQVEsSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztXQUN4RixPQUFPLFFBQVEsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDO1dBQzNGLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMscUVBQXFFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7V0FDN0MsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1dBQ3pDLFdBQVcsQ0FBQyxVQUFxQixHQUFJLFFBQVEsQ0FBQyxTQUFvQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyw4RUFBOEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxLQUFLLEVBQ3hELFVBQW1CLEVBQ25CLFdBQXVELEVBQ3BDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUM7V0FDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsb0NBQW9DLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3ZFLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxNQUFNLHNDQUFzQyxDQUN6RCxVQUFVLENBQUMsUUFBUSxFQUNuQixXQUFXLENBQ1osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLEtBQUssRUFDaEUsVUFBbUIsRUFDbkIsV0FBdUQsRUFDcEMsRUFBRTtJQUNyQixJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksdUNBQXVDLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3pFLHVDQUF1QyxDQUFDLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM1RixPQUFPLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLGVBQWU7V0FDeEMsVUFBVSxDQUFDLEVBQUUsS0FBSyxXQUFXLENBQUMsU0FBUztXQUN2QyxVQUFVLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQzlDLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDbkUsT0FBTyxDQUFDLGdGQUFnRixDQUFDLENBQUM7SUFDNUYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BELE9BQU8sQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxPQUFPLHFDQUFxQyxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsQ0FBQztBQUMvRixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW1CRztBQUNILE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDakUsbUJBQW1CO0lBQ25CLHdCQUF3QjtJQUN4QiwrQkFBK0I7SUFDL0IsNEJBQTRCO0lBQzVCLDJCQUEyQjtJQUMzQiw0QkFBNEI7SUFDNUIsa0NBQWtDO0lBQ2xDLG9DQUFvQztJQUNwQyxzQ0FBc0M7SUFDdEMsdUNBQXVDO0lBQ3ZDLDRCQUE0QjtDQUNwQixDQUFDLENBQUM7QUFTWjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxLQUFLLEVBQzFELFdBQTRDLEVBQzVDLFdBQXVELEVBQ1YsRUFBRTtJQUMvQyxNQUFNLE1BQU0sR0FBRyxNQUFNLHNDQUFzQyxDQUFDLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQztJQUN0RixJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbEQsT0FBTztRQUNMLGlCQUFpQixFQUFFLFdBQVcsQ0FBQyxNQUFNLENBQUMsSUFBSTtRQUMxQyxzQkFBc0IsRUFBRSxXQUFXLENBQUMsTUFBTSxDQUFDLFFBQVE7UUFDbkQsNkJBQTZCLEVBQUUsTUFBTSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsd0JBQXdCLENBQUM7UUFDbEYsMEJBQTBCLEVBQUUsV0FBVyxDQUFDLFlBQVk7UUFDcEQseUJBQXlCLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxXQUFXO1FBQzFELDBCQUEwQixFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQztRQUNwRSxnQ0FBZ0MsRUFBRSxNQUFNLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1FBQ2hGLGtDQUFrQyxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7UUFDcEYsb0NBQW9DLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsYUFBYTtRQUNoRixxQ0FBcUMsRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxjQUFjO1FBQ2xGLDBCQUEwQixFQUFFLFdBQVcsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUk7S0FDOUQsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLE1BQU0sdUJBQXVCLEdBQUcsZUFBZSxDQUFDO0FBRWhELE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDOUUsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUN6Qix1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO09BQ3RDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDO0lBQ2xCLENBQUMsQ0FBQyxTQUFTLENBQ2QsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxjQUF1QixFQUN2QixPQUFPLEdBQUcscUNBQXFDLEVBQzVCLEVBQUU7SUFDckIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUM7V0FDeEIsQ0FBQyxZQUFZLENBQUMsY0FBYyxFQUFFLHFDQUFxQyxDQUFDO1dBQ3BFLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FDeEQsT0FBTyxjQUFjLENBQUMsTUFBTSxDQUFDLEtBQUssUUFBUSxDQUMzQyxDQUFDLEVBQUUsQ0FBQztRQUNMLE9BQU8sQ0FBQyxHQUFHLE9BQU8sdUNBQXVDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsTUFBTSxXQUFXLEdBQUcsY0FBb0QsQ0FBQztJQUN6RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxRQUFRLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLDZCQUE2QixDQUFDLENBQUM7SUFDekYsTUFBTSxNQUFNLEdBQUc7UUFDYixJQUFJLEVBQUUsV0FBVyxDQUFDLGlCQUFpQjtRQUNuQyxRQUFRLEVBQUUsV0FBVyxDQUFDLHNCQUFzQjtRQUM1Qyx3QkFBd0IsRUFBRSxRQUFRO0tBQ25DLENBQUM7SUFDRixNQUFNLFlBQVksR0FBRyxvQ0FBb0MsQ0FBQyxNQUFNLEVBQUUsR0FBRyxPQUFPLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxZQUFZLENBQUMsQ0FBQztJQUM3QixJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsMEJBQTBCLENBQUM7V0FDMUQsWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ3ZCLFdBQVcsQ0FBQywwQkFBMEIsS0FBSyxNQUFNLHlDQUF5QyxDQUMzRixNQUF1QyxDQUN4QyxFQUFFLENBQUM7UUFDTixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxxRUFBcUUsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyx5QkFBeUIsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLDBCQUEwQixDQUFDLENBQUM7SUFDMUYsTUFBTSxTQUFTLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDN0YsTUFBTSxXQUFXLEdBQUcsNEJBQTRCLENBQUMsV0FBVyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDakcsSUFBSSxZQUFZLEtBQUssU0FBUztXQUN6QixTQUFTLEtBQUssU0FBUztXQUN2QixXQUFXLEtBQUssU0FBUztXQUN6QixTQUFTLEdBQUcsWUFBWSxFQUFFLENBQUM7UUFDOUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMERBQTBELENBQUMsQ0FBQztJQUNwRixDQUFDO1NBQU0sSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3JDLElBQUksQ0FBQztZQUNILElBQUksV0FBVyxLQUFLLHVDQUF1QyxDQUFDLFNBQVMsRUFBRSxRQUFrQixDQUFDLEVBQUUsQ0FBQztnQkFDM0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sd0VBQXdFLENBQUMsQ0FBQztZQUNsRyxDQUFDO1FBQ0gsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDZEQUE2RCxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsb0NBQW9DLENBQUM7V0FDcEUsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxxQ0FBcUMsQ0FBQztXQUN0RSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLDBCQUEwQixDQUFDLEVBQUUsQ0FBQztRQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/requests/node.d.ts

@@ -4,6 +4,7 @@ import type { ICluster } from '../data/cluster.js';
 import type { IClusterNode, INodeAction, INodeMetricsSample, TNodeActionName } from '../data/clusternode.js';
 import type { IDeployment } from '../data/deployment.js';
 import type { IIdentity } from '../data/user.js';
+import type { IPlatformObjectStorageEndpoint } from '../platform/objectstorage.js';
 import type { INodeCredentialMetadata, INodeCredentialMutationPreconditions, INodeCredentialMutationResult, TNodeCredentialPurpose } from '../data/nodecredential.js';
 import type { INodeRuntimeRetirement } from '../data/noderetirement.js';
 import type { INodeRuntimeBindingRead, INodeRuntimeBindingRequest } from '../data/noderuntimebinding.js';
@@ -217,6 +218,34 @@ export interface IReq_Any_Cloudly_SetClusterNodeCorestoreEndpoint extends plugin
         node: IClusterNode;
     };
 }
+/**
+ * An administrator states where a workload on one node reaches the node's Corestore object
+ * storage, and the region it signs for: `IClusterNode.data.corestoreObjectStorage`.
+ *
+ * A request of its own, separate from `setClusterNodeCorestoreEndpoint`, because the two are
+ * separate facts with separate readers — the relay dials the control endpoint, a workload dials
+ * this one — and setting one never touches the other. A caller that states only the control
+ * endpoint leaves this one as it stands.
+ *
+ * Cloudly validates it with `validatePlatformObjectStorageEndpoint` before it writes and takes the
+ * node's own real-write fence inside the writing transaction, as for the control endpoint.
+ * `objectStorage: null` clears it, which is the same fact as never having set one: no
+ * object-storage environment can be composed for a binding on this node. The endpoint says where,
+ * never with what — no credential travels in this request or in the node document.
+ */
+export interface IReq_Any_Cloudly_SetClusterNodeCorestoreObjectStorageEndpoint extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_SetClusterNodeCorestoreObjectStorageEndpoint> {
+    method: 'setClusterNodeCorestoreObjectStorageEndpoint';
+    request: {
+        identity: IIdentity;
+        nodeId: string;
+        /** The node's object-storage endpoint and region, or `null` to state that it has none. */
+        objectStorage: IPlatformObjectStorageEndpoint | null;
+    };
+    response: {
+        /** The node as it now stands, so a caller needs no second read to see what it set. */
+        node: IClusterNode;
+    };
+}
 export interface IReq_Any_Cloudly_CreateNodeAction extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_CreateNodeAction> {
     method: 'createNodeAction';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.24.0",
+  "version": "32.26.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -30,7 +30,7 @@
     "@git.zone/tsbuild": "^5.0.0",
     "@git.zone/tsdoc": "^2.2.2",
     "@git.zone/tsrun": "^3.0.0",
-    "@git.zone/tstest": "6.2.0",
+    "@git.zone/tstest": "6.2.1",
     "@types/node": "26.6.1"
   },
   "files": [

package/readme.md

@@ -1419,21 +1419,25 @@ on one spec revision, and each reason belongs to exactly one state. `converged`
 carry `reason: null`. `waiting` carries a `TServiceRuntimeWaitingReason`: `node-network-pending`,
 `conflict`, `failure-backoff`, `storage-import-pending` (an `import` local storage claim whose bytes
 have not arrived on its node), `bindings-pending` (the secret manifest does not cover every enabled
-binding of the service yet) or `legacy-adoption-pending` (a Corestore binding of the service waits for
-the offline adoption of its legacy resource, see
-[Corestore Legacy Resource Adoption](#corestore-legacy-resource-adoption)). `refused` carries a
-`TServiceRuntimeRefusal`:
+binding of the service yet, or an object-storage binding is placed on no node),
+`legacy-adoption-pending` (a Corestore binding of the service waits for the offline adoption of its
+legacy resource, see [Corestore Legacy Resource Adoption](#corestore-legacy-resource-adoption)) or
+`objectstorage-retention-pending` (an object-storage binding declares compliance retention whose
+evidence has not arrived). `refused` carries a `TServiceRuntimeRefusal`:
 `cluster-runtime-missing`, `organization-missing`, `image-plan-missing`, `platform-unsupported`,
 `secrets-unsupported`, `volumes-unsupported`, `port-protocol-unsupported`, `ports-too-many`,
 `readiness-target-undeclared`, `environment-too-large`, `no-eligible-node`, `replica-limit`,
 `node-authority-unsupported`, `network-policy-missing`, `network-policy-mismatch`,
 `network-workload-pool-missing`, `network-workload-pool-exhausted`, `volume-driver-unsupported`,
 `volume-options-unsupported`, `volume-shared-unsupported`, `volume-placement-unsupported`,
-`volume-initialization-unknown` or `volume-ownership-unknown`. The first four volume refusals name
-what a local storage claim cannot express: a volume driver other than a node-local directory, driver
-or mount options, one volume mounted by more than one replica or service, and a placement that does
-not pin each volume to one node. The last two name what Cloudly will not guess, see
-[Service Volume Initialization](#service-volume-initialization). `ports-too-many` is a service declaring more target ports than the
+`volume-initialization-unknown`, `volume-ownership-unknown`, `objectstorage-endpoint-missing`,
+`objectstorage-binding-invalid` or `objectstorage-environment-conflict`. The first four volume
+refusals name what a local storage claim cannot express: a volume driver other than a node-local
+directory, driver or mount options, one volume mounted by more than one replica or service, and a
+placement that does not pin each volume to one node. The other two name what Cloudly will not guess,
+see [Service Volume Initialization](#service-volume-initialization). The three object-storage
+refusals name why a binding's environment cannot be composed, see
+[Object-Storage Binding Environment](#object-storage-binding-environment). `ports-too-many` is a service declaring more target ports than the
 `runtimeConfigContract.maximumTargetPorts` (64) a config carries, where `port-protocol-unsupported`
 is about one port's protocol; `node-authority-unsupported` is a node whose session resolved fewer
 workload authorities than the spec needs, refused at the admit step rather than handed to a node
@@ -3486,6 +3490,100 @@ Coreflow, all exported from `data` and `platform`:
 While a binding of a service reports `legacy-adoption-pending`, the service's runtime status waits as
 `legacy-adoption-pending` instead of `bindings-pending`.
 
+### Object-Storage Binding Environment
+
+An object-storage binding gives its workload two things. The access key and the secret reach it
+only as Secrets: the six aliases `createCorestoreCredentialSecretValues()` expands
+(`S3_ACCESS_KEY`, `S3_ACCESS_KEY_ID`, `S3_SECRET_KEY`, `S3_SECRET_ACCESS_KEY`,
+`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), published through the sealed Secret set. Where the
+bucket is, and which retention it carries, is non-secret and reaches it through the runtime
+configuration: Cloudly composes it into `IRuntimeConfig.environment`, the complete public
+environment, so no further runtime spec or assignment field carries it. The names are the ones
+Corestore and the cluster relay handed workloads before, so an application that read them keeps
+working unchanged.
+
+| Name | Value |
+| --- | --- |
+| `S3_ENDPOINT`, `AWS_ENDPOINT_URL` | The endpoint origin, for example `http://192.0.2.15:9000`. |
+| `S3_ENDPOINT_HOST` | The origin's host; an IPv6 literal keeps its brackets. |
+| `S3_PORT` | The origin's port, `80` or `443` when the origin states none. |
+| `S3_USE_SSL` | `true` for `https:`, `false` for `http:`. |
+| `S3_REGION`, `AWS_REGION` | The signing region. |
+| `S3_BUCKET` | `IPlatformBinding.objectstorageBucketName`. |
+| `AWS_S3_FORCE_PATH_STYLE` | Always `true`: a node-local origin has no wildcard DNS. |
+| `S3_RETENTION_MODE` | `intent.mode`, always `compliance`. |
+| `S3_RETENTION_POLICY_ID` | `intent.policyId`. |
+| `S3_RETENTION_DURATION_SECONDS` | `intent.retentionDurationSeconds`. |
+| `S3_RETENTION_INTENT_SHA256` | `intentSha256`. |
+| `S3_RETENTION_SENTINEL_KEY` | `receipt.sentinelKey`. |
+| `S3_RETENTION_CONFIGURED_AT` | `receipt.configuredAt`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_CREATED_AT` | `receipt.sentinel.createdAt`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_RETAIN_UNTIL` | `receipt.sentinel.retainUntil`, Unix milliseconds. |
+| `S3_RETENTION_SENTINEL_PAYLOAD_SHA256` | `receipt.sentinel.payloadSha256`. |
+| `S3_RETENTION_SENTINEL_METADATA_SHA256` | `receipt.sentinel.metadataSha256`. |
+| `S3_RETENTION_SENTINEL_ETAG` | `receipt.sentinel.etag`. |
+
+Every number is a canonical decimal. `objectStorageEndpointEnvironmentKeys`,
+`objectStorageRetentionEnvironmentKeys` and `objectStorageBindingEnvironmentKeys` publish the
+lists in this order, with the matching `T…EnvironmentKey` and `T…Environment` types.
+
+**Where the endpoint comes from.** Corestore is node-local, so the endpoint is a fact about the
+node that holds the bucket: `IClusterNode.data.corestoreObjectStorage` is an optional
+`IPlatformObjectStorageEndpoint { endpoint, region }`, checked by
+`validatePlatformObjectStorageEndpoint()` (a canonical `http:` or `https:` origin and a lowercase
+region). It sits beside `corestore`, not inside it: the relay dials the control endpoint and a
+workload dials this one, and `IClusterNodeCorestore` keeps its exact schema, so a relay that
+validates it goes on accepting every node document. An administrator sets it with
+`setClusterNodeCorestoreObjectStorageEndpoint { identity; nodeId; objectStorage }`, answered by
+Cloudly with the node as it now stands; `objectStorage: null` clears it. The request is separate
+from `setClusterNodeCorestoreEndpoint`, so setting the control endpoint never touches it. A node
+without it cannot give a workload an object-storage environment; nothing derives a port, a scheme
+or a region.
+
+**Composing.** `createObjectStorageBindingEnvironment(binding, endpoint)` returns the nine endpoint
+names for a binding that declares no retention, and all twenty when it declares retention with
+evidence. It refuses by name, and never guesses, when the binding is not `objectstorage`, carries
+no canonical bucket, or declares retention without `evidence`: a bucket whose immutability is not
+proven yet must not be handed to its workload as if it were ordinary storage, so the workload
+waits for the evidence. The evidence is validated with `validateObjectStorageRetentionEvidence()`
+against the binding's own service, binding id, bucket and intent, and the reconciliation
+generation and request digest it states. The split helpers are
+`createObjectStorageEndpointEnvironment(endpoint, bucketName)` and
+`createObjectStorageRetentionEnvironment(evidence, expectation)`.
+`mergeObjectStorageBindingEnvironment(environment, bindingEnvironment)` adds one binding's names
+to a workload environment and refuses, naming every key, a name that is already set — by the
+service itself or by a second object-storage binding — instead of letting one value replace
+another.
+
+**Reporting.** `composeObjectStorageServiceEnvironment(serviceEnvironment, sources)` composes a
+whole service and answers in the service runtime vocabulary, so a producer never classifies the
+errors above. Each `IObjectStorageBindingEnvironmentSource { binding, endpoint }` is an enabled
+object-storage binding and the `corestoreObjectStorage` of the node it is placed on, `null` when
+that node states none; a binding placed on no node is not a source, and its service waits as
+`bindings-pending`. The answer is a `TObjectStorageServiceEnvironmentComposition`:
+
+| `status` | `reason` | When |
+| --- | --- | --- |
+| `composed` | — | `environment` is the service's own with every binding's names added. |
+| `waiting` | `objectstorage-retention-pending` | A binding declares compliance retention whose evidence has not arrived. |
+| `refused` | `objectstorage-endpoint-missing` | The binding's node states no valid `corestoreObjectStorage`. |
+| `refused` | `objectstorage-binding-invalid` | `createObjectStorageBindingEnvironment()` refuses the binding: not `objectstorage`, no canonical bucket, no canonical retention intent, or evidence that does not prove this binding. |
+| `refused` | `objectstorage-environment-conflict` | The service's own environment or another binding already sets one of the binding's names. |
+
+`waiting` and `refused` carry the `bindingId` and the contract's `message`. Bindings are taken in
+id order, so the verdict does not depend on the order of the sources, and a refusal outranks a
+wait: a binding waiting for its evidence already claims all twenty names, so a collision with it
+is refused now rather than once the evidence arrives. The reasons are
+`TObjectStorageEnvironmentWaitingReason` and `TObjectStorageEnvironmentRefusal`, members of
+`TServiceRuntimeWaitingReason` and `TServiceRuntimeRefusal`.
+
+**Validating.** `validateObjectStorageBindingEnvironment()` accepts exactly the endpoint names and
+all or none of the retention names, each value the one its endpoint and evidence derive, and
+refuses any other name — so a credential alias in the public environment is refused by name.
+`validateObjectStorageEndpointEnvironment()` and `validateObjectStorageRetentionEnvironment()`
+judge each half on its own. The environment does not carry the evidence's authority, so
+validating it checks what a workload reads, not the proof behind it.
+
 ### Launcher Environment Delivery
 
 Launcher environment delivery uses stable `szsv-<base32-sha256>` Docker
@@ -3527,6 +3625,8 @@ Available platform modules:
 - `platform.objectstorageretention` for value-free immutable-retention intent,
   capability and sentinel evidence, authority binding, digest helpers, and
   strict validators.
+- `platform.objectstorageenvironment` for the non-secret workload environment of an
+  object-storage binding; see Object-Storage Binding Environment.
 - `platform.storagemigration` for fenced object-storage migration intent, status, consumer acknowledgements, canonical digests, and strict normalizers.
 - `platform.types` provider and binding metadata is value-free. Provider-specific
   operational config stays adapter-internal, while public DTOs expose typed

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.24.0',
+  version: '32.26.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusternode.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import { isSha256Digest, type TSha256Digest, type TImmutableContainerPlatform } from './immutableimage.js';
 import type { ISparkNodeReportRecord } from './sparknodereport.js';
+import type { IPlatformObjectStorageEndpoint } from '../platform/objectstorage.js';
 import {
   fleetCutoverContract,
   snapshotFleetCutoverPreparedVolumeHandoffAggregate,
@@ -1773,6 +1774,21 @@ export interface IClusterNode {
      * while Docker Swarm resolved it is exactly what stops resolving.
      */
     corestore?: IClusterNodeCorestore;
+
+    /**
+     * Where a workload on this node reaches the node's Corestore object storage, and the region
+     * it signs for.
+     *
+     * Cloudly owns it, sets it with `setClusterNodeCorestoreObjectStorageEndpoint`, and composes
+     * it into the environment of every object-storage binding placed on this node with
+     * `createObjectStorageBindingEnvironment()`. It is a sibling of `corestore`, not a member:
+     * the control API and the S3 API listen on different ports and have different readers — the
+     * relay dials `corestore`, a workload dials this — and `corestore` keeps its exact schema.
+     * Absent means no object-storage environment can be composed for this node, and a binding's
+     * workload waits rather than being handed a guessed port, scheme or region. Value-free like
+     * `corestore`: it says where, never with what.
+     */
+    corestoreObjectStorage?: IPlatformObjectStorageEndpoint;
   };
 }
 
@@ -1789,7 +1805,7 @@ export interface IClusterNode {
 export interface IClusterNodeCorestore {
   /**
    * The canonical origin of the control API, for example
-   * `http://10.20.0.15:3000`.
+   * `http://192.0.2.15:3000`.
    *
    * `http:` is admitted because Corestore terminates no TLS today — it binds a
    * plain control port and advertises no transport-encryption guarantee — and

package/ts/data/serviceruntime.ts

@@ -78,7 +78,7 @@ export const serviceRuntimeContract = Object.freeze({
 
 const serviceRuntimeWaitingReasons = [
   'node-network-pending', 'conflict', 'failure-backoff', 'storage-import-pending', 'bindings-pending',
-  'legacy-adoption-pending',
+  'legacy-adoption-pending', 'objectstorage-retention-pending',
 ] as const;
 const serviceRuntimeRefusals = [
   'cluster-runtime-missing', 'organization-missing', 'image-plan-missing', 'platform-unsupported',
@@ -88,6 +88,7 @@ const serviceRuntimeRefusals = [
   'network-workload-pool-missing', 'network-workload-pool-exhausted',
   'volume-driver-unsupported', 'volume-options-unsupported', 'volume-shared-unsupported',
   'volume-placement-unsupported', 'volume-initialization-unknown', 'volume-ownership-unknown',
+  'objectstorage-endpoint-missing', 'objectstorage-binding-invalid', 'objectstorage-environment-conflict',
 ] as const;
 
 /**
@@ -95,9 +96,12 @@ const serviceRuntimeRefusals = [
  * `node-network-pending` waits for a node's network readiness, `conflict` for a sweep over inputs
  * that changed while it ran, `failure-backoff` for a failed replica's backoff to elapse,
  * `storage-import-pending` for an `import` local storage claim whose bytes have not arrived on its
- * node, `bindings-pending` for the secret manifest to cover every enabled binding of the service, and
- * `legacy-adoption-pending` for a Corestore binding whose legacy resource waits for the offline
- * adoption Corestore requires (the binding's `statusReason` of the same name).
+ * node, `bindings-pending` for the secret manifest to cover every enabled binding of the service (and
+ * for an object-storage binding placed on no node), `legacy-adoption-pending` for a Corestore binding
+ * whose legacy resource waits for the offline adoption Corestore requires (the binding's
+ * `statusReason` of the same name), and `objectstorage-retention-pending` for an object-storage
+ * binding that declares compliance retention whose evidence has not arrived: its workload is not
+ * handed the bucket as if it were ordinary storage.
  */
 export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[number];
 
@@ -118,6 +122,12 @@ export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[n
  * `volume-initialization-unknown` is a volume without an initialization and
  * `volume-ownership-unknown` a `run-as` ownership under `runAs: null`
  * (`deriveServiceVolumeClaimInitialization`); neither is defaulted.
+ *
+ * The object-storage refusals name why a binding's environment cannot be composed
+ * (`composeObjectStorageServiceEnvironment`): `objectstorage-endpoint-missing` a binding whose node
+ * states no valid `corestoreObjectStorage`, `objectstorage-binding-invalid` a binding
+ * `createObjectStorageBindingEnvironment` refuses, and `objectstorage-environment-conflict` a name
+ * the service's own environment or another binding already sets.
  */
 export type TServiceRuntimeRefusal = typeof serviceRuntimeRefusals[number];
 

package/ts/platform/index.ts

@@ -5,6 +5,7 @@ import * as email from './email.js';
 import * as letter from './letter.js';
 import * as logging from './logging.js';
 import * as objectstorage from './objectstorage.js';
+import * as objectstorageenvironment from './objectstorageenvironment.js';
 import * as objectstorageretention from './objectstorageretention.js';
 import * as pushnotification from './pushnotification.js';
 import * as sip from './sip.js';
@@ -21,6 +22,7 @@ export {
   letter,
   logging,
   objectstorage,
+  objectstorageenvironment,
   objectstorageretention,
   pushnotification,
   sip,
@@ -32,6 +34,7 @@ export {
 
 export * from './storage.js';
 export * from './objectstorage.js';
+export * from './objectstorageenvironment.js';
 export * from './objectstorageretention.js';
 export * from './storagemigration.js';
 export * from './types.js';