@serve.zone/interfaces 32.58.0 → 32.60.0

package/changelog.md

@@ -1,5 +1,89 @@
 # Changelog
 
+## 2026-10-20 - 32.60.0
+
+### Fixes
+
+- External registry reads stop carrying the credential the server must never send. Every
+  `requests.externalRegistry` response (`getExternalRegistryById`, `getExternalRegistries`,
+  `createExternalRegistry`, `updateExternalRegistry`, `verifyExternalRegistry`) now answers
+  `data.IExternalRegistryPublic`: the registry without `data.password` and with a required
+  `passwordConfigured`. `IExternalRegistry` stays the stored shape, and its `data.password` is
+  documented as write-only.
+- `IReq_UpdateRegistry.request.registryData` is a `Partial` of the operator fields
+  (`TExternalRegistryOperatorData`, names in `TExternalRegistryOperatorField`): status, last error
+  and timestamps belong to Cloudly and can no longer be sent. A missing or empty `password` keeps
+  the stored one; `authType: 'none'` removes it.
+- `IReq_VerifyRegistry.response` carries a required `outcome` (`TExternalRegistryVerifyOutcome`:
+  `authenticated`, `anonymous`, `credentials-not-exercised`, `authentication-failed`,
+  `unreachable`, `unsupported`) and a required `registry`, so a registry that answers anonymously
+  no longer reads as verified credentials.
+
+### Features
+
+- `composeObjectStorageServiceEnvironment(serviceEnvironment, sources, secretEnvironmentNames?)`:
+  the names, without values, of the variables the workload receives as launcher-environment
+  secrets. The launcher sets a secret over a plain variable of the same name, so a secret named
+  like one of a binding's names (`objectStorageBindingEnvironmentKeys`, such as `S3_ENDPOINT`)
+  would silently replace the binding's value; it is refused as
+  `objectstorage-environment-conflict`, exactly as the same name in the service's own environment
+  is, and the message names it as a secret. Other secret names, including the binding's own
+  credentials (`corestoreObjectStorageCredentialSecretKeys`), are not conflicts. Omitted, the
+  composition treats the workload as receiving none; the input becomes required in the coordinated
+  major.
+- `IRequest_Any_Cloudly_UpdateService.request.serviceData` is a
+  `Partial<TServiceUpdateWritableData>`, matching the merge Cloudly performs: an omitted key keeps
+  its stored value, a stated key replaces it whole, and `containerArgs: null` removes the stored
+  argument vector. A client sends only the fields it changes, so an edit no longer has to restate
+  `placement` or `scaleFactor`, which a service with a runtime spec (and an immutable service)
+  refuses whenever an update states them. The full shape still type-checks, so existing callers
+  compile unchanged.
+- `deriveLauncherSecretDeliveryOwner({ runAs, imageUsers, launcherDeliveries })` (`data`): the one
+  rule for the owner of a workload's launcher-environment secret files, which WorkloadInit reads as
+  the workload's own process identity. A `runAs` pair wins; under `runAs: null` an image without a
+  user is `0:0`, a numeric `user:group` is taken as stated, `root` stands for `0`, and a numeric
+  user without a group or with a named group is `user:0` while every launcher delivery is `0o400`.
+  `imageUsers` is Cloudly's canonical image user (`parseCanonicalImageUser`), one per platform of
+  the pinned digest; group readability is computed from `launcherDeliveries`. A named user, a
+  numeric part above the identity bound, a `0o440` delivery whose group the image does not state
+  numerically (the refusal names it in `variableName`), or platforms that derive different owners
+  refuse as the new service runtime refusal `launcher-secret-ownership-unknown`
+  (`TLauncherSecretDeliveryOwner`, with a `message`); a workload without launcher deliveries is
+  `not-required`. An image running as a non-root user is no longer handed secret files it cannot
+  read. Only a structurally malformed input throws.
+- A resolved secret manifest's deliveries are their own type, `TSecretResolvedDelivery`, whose
+  launcher member `ISecretResolvedLauncherEnvironmentDelivery` requires `uid` and `gid`: the owner
+  the resolver derived, under the same keys, so the manifest's wire format and digest do not change
+  and every node keeps mounting it. `IResolvedSecretManifestEntry.delivery` is that type,
+  `validateSecretResolvedDelivery` checks it (`validateResolvedSecretManifest` uses it), and
+  `createResolvedSecretDelivery(delivery, owner)` builds it from a caller's delivery and the derived
+  owner.
+
+### Deprecations
+
+- `ISecretLauncherEnvironmentDelivery`, the launcher delivery a caller states (a Secret's
+  `defaultDelivery`, a SecretSet attachment override, a create request, an App Store declaration),
+  makes `uid` and `gid` optional and deprecated: the resolver ignores them and writes the derived
+  owner into the resolved delivery. `validateSecretDelivery` prefers neither and tolerates both
+  (bounded) until the next major, which removes them; a sealed context that states them still
+  verifies. File deliveries keep their stated owner.
+
+### Maintenance
+
+- Release tooling: pnpm 12.13.0; the other build and test tooling is current.
+
+## 2026-10-18 - 32.59.0
+
+### Features
+
+- `IDomain.data.gatewayListedAt` (optional timestamp): when the dcrouter gateway last listed the
+  domain to this Cloudly; absent while the gateway does not list it. The gateway sync owns it,
+  separately from the operator's `activationState`.
+
+### Maintenance
+
+- release tooling: pnpm 12.12.1
+
 ## 2026-10-17 - 32.58.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.58.0',
+    version: '32.60.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/domain.d.ts

@@ -86,6 +86,12 @@ export interface IDomain {
          */
         syncSource?: 'cloudflare' | 'manual' | null;
         lastSyncAt?: number;
+        /**
+         * When the dcrouter gateway last listed this domain to this Cloudly (timestamp).
+         * Absent while the gateway does not list the domain. The gateway sync owns this
+         * member; it is independent of the operator's `activationState`.
+         */
+        gatewayListedAt?: number;
         /**
          * Whether domain is managed externally
          */

package/dist_ts/data/externalregistry.d.ts

@@ -1,3 +1,7 @@
+/**
+ * An external registry as Cloudly stores it, credential included. Never answered: every external
+ * registry response carries `IExternalRegistryPublic`.
+ */
 export interface IExternalRegistry {
     id: string;
     data: {
@@ -18,7 +22,10 @@ export interface IExternalRegistry {
          */
         username?: string;
         /**
-         * Password, access token, or API key for authentication (optional for public registries)
+         * Password, access token or API key for authentication (optional for public registries).
+         *
+         * Write-only: Cloudly stores it and uses it server-side, and never answers it. Reads carry
+         * `IExternalRegistryPublic.passwordConfigured` instead.
          */
         password?: string;
         /**
@@ -90,3 +97,32 @@ export interface IExternalRegistry {
         updatedAt?: number;
     };
 }
+/**
+ * An external registry as Cloudly answers it: the stored registry without its credential, and
+ * whether one is stored.
+ */
+export interface IExternalRegistryPublic {
+    id: string;
+    data: Omit<IExternalRegistry['data'], 'password'>;
+    /** Whether a password, access token or API key is stored for the registry. */
+    passwordConfigured: boolean;
+}
+/** The registry fields an operator writes; Cloudly owns status, errors and timestamps. */
+export type TExternalRegistryOperatorField = 'type' | 'name' | 'url' | 'username' | 'password' | 'description' | 'isDefault' | 'authType' | 'insecure' | 'namespace' | 'proxy' | 'config';
+export type TExternalRegistryOperatorData = Pick<IExternalRegistry['data'], TExternalRegistryOperatorField>;
+/**
+ * What a registry verification proved.
+ *
+ * - `authenticated`: the registry admitted the stored credentials (Basic, or a token its Bearer
+ *   realm issued for them).
+ * - `anonymous`: the registry answers without authentication and none is configured.
+ * - `credentials-not-exercised`: credentials are configured, but the registry answers without
+ *   authentication, so they were never checked.
+ * - `authentication-failed`: the registry, or its token realm, refused the credentials, or it
+ *   requires authentication and none is configured.
+ * - `unreachable`: no usable answer (connection, TLS, timeout or an unexpected HTTP status).
+ * - `unsupported`: the registry or its configuration cannot be verified (an npm registry, OAuth2,
+ *   an unknown or missing authentication challenge, a redirect, or credentials over plain HTTP
+ *   without `insecure`).
+ */
+export type TExternalRegistryVerifyOutcome = 'authenticated' | 'anonymous' | 'credentials-not-exercised' | 'authentication-failed' | 'unreachable' | 'unsupported';

package/dist_ts/data/index.d.ts

@@ -81,6 +81,7 @@ export * from './servicecredential.js';
 export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
+export * from './launchersecretowner.js';
 export * from './servicevolumeinitialization.js';
 export * from './status.js';
 export * from './taskexecution.js';

package/dist_ts/data/index.js

@@ -77,6 +77,7 @@ export * from './servicecredential.js';
 export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
+export * from './launchersecretowner.js';
 export * from './servicevolumeinitialization.js';
 export * from './status.js';
 export * from './taskexecution.js';
@@ -84,4 +85,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBR3ZDLE9BQU8sRUFBRSwwQkFBMEIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRzlELE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBRXBGLE9BQU8sRUFBRSwwQ0FBMEMsRUFBRSwwQ0FBMEMsRUFBRSxNQUFNLGtDQUFrQyxDQUFDO0FBQzFJLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywrQkFBK0IsQ0FBQztBQUM5QyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBR3ZDLE9BQU8sRUFBRSwwQkFBMEIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRzlELE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBRXBGLE9BQU8sRUFBRSwwQ0FBMEMsRUFBRSwwQ0FBMEMsRUFBRSxNQUFNLGtDQUFrQyxDQUFDO0FBQzFJLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywrQkFBK0IsQ0FBQztBQUM5QyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxrQ0FBa0MsQ0FBQztBQUNqRCxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/data/launchersecretowner.d.ts

@@ -0,0 +1,60 @@
+import type { ISecretLauncherEnvironmentDelivery } from './secret.js';
+import type { IServiceRuntimeProfile, TServiceRuntimeRefusal } from './serviceruntime.js';
+/** What the owner of a workload's launcher-environment secret files derives from. */
+export interface ILauncherSecretDeliveryOwnerInput {
+    /** The runtime spec's `profile.runAs`; null runs the image's own OCI user. */
+    runAs: IServiceRuntimeProfile['runAs'];
+    /**
+     * The unresolved OCI `config.User` of the pinned digest's image config in Cloudly's canonical
+     * form (what its registry manager's `parseCanonicalImageUser` answers, never the raw registry
+     * value): `user` or `user:group`, each part a numeric identity or a name, and null for an image
+     * that states none or an empty `User`. One entry for a single-platform manifest, one per
+     * platform of a multi-platform index; never empty.
+     */
+    imageUsers: (string | null)[];
+    /**
+     * Every launcher-environment delivery the workload receives, as its caller states it. A `0o440`
+     * delivery grants the derived group, so that group has to be one the image states numerically.
+     */
+    launcherDeliveries: Pick<ISecretLauncherEnvironmentDelivery, 'variableName' | 'mode'>[];
+}
+/**
+ * The numeric owner of a workload's launcher-environment secret files, or why it derives none.
+ *
+ * `not-required` is a workload without launcher-environment deliveries: no file needs an owner, so
+ * nothing about the image refuses it.
+ *
+ * `launcher-secret-ownership-unknown` is a runtime spec that runs the image's own user
+ * (`runAs: null`) while that user's numeric owner is not known: a named user other than `root`, a
+ * numeric part above the runtime identity bound, a group-readable (`0o440`) delivery whose group
+ * the image does not state numerically, or platforms of a multi-platform index that derive
+ * different owners. `variableName` names the group-readable delivery that caused it (the first by
+ * name), null for the others; `message` states the cause.
+ */
+export type TLauncherSecretDeliveryOwner = {
+    status: 'derived';
+    uid: number;
+    gid: number;
+} | {
+    status: 'not-required';
+} | {
+    status: 'refused';
+    reason: Extract<TServiceRuntimeRefusal, 'launcher-secret-ownership-unknown'>;
+    variableName: string | null;
+    message: string;
+};
+/**
+ * The owner Cloudly gives every launcher-environment secret file of a workload, which WorkloadInit
+ * reads as the workload's own process identity before it starts the image.
+ *
+ * Without launcher deliveries it is `not-required`. A `runAs` pair wins over the image. Under
+ * `runAs: null` an image without a user runs as root (`0:0`, the runtime config's own default), a
+ * numeric `user:group` is taken as stated and `root` stands for `0` in either part. A numeric user
+ * without a group, or with a named group, is `user:0` while every delivery is owner-readable
+ * (`0o400`), which grants the group nothing; a `0o440` delivery would grant it, so it refuses and
+ * names that delivery. A named user, or a numeric part above the runtime identity bound, refuses.
+ * Every platform of a multi-platform index must derive
+ * the same owner, or it refuses: a workload gets one delivery, never one per platform. Nothing is
+ * guessed. A structurally malformed input throws, whatever it would answer.
+ */
+export declare const deriveLauncherSecretDeliveryOwner: (inputArg: ILauncherSecretDeliveryOwnerInput) => TLauncherSecretDeliveryOwner;

package/dist_ts/data/launchersecretowner.js

@@ -0,0 +1,94 @@
+import { hasExactKeys, isPlainRecord } from '../private/dataproperties.js';
+import { isRuntimeIdentityNumber, runtimePolicyLimits } from '../private/runtimepolicy.js';
+const imageUserPartPattern = /^[^:\u0000-\u001f\u007f]+$/;
+const imageUserPart = (partArg) => {
+    if (partArg === 'root')
+        return 0;
+    if (!/^[0-9]+$/.test(partArg))
+        return 'named';
+    const identity = Number(partArg);
+    return isRuntimeIdentityNumber(identity) ? identity : 'unbounded';
+};
+/** One platform's user and group; an absent group is `undefined`. A malformed image user throws. */
+const imageUserParts = (imageUserArg) => {
+    if (imageUserArg === null)
+        return { user: 0, group: 0 };
+    const parts = typeof imageUserArg === 'string' ? imageUserArg.split(':') : [];
+    if (parts.length === 0 || parts.length > 2 || !parts.every((partArg) => imageUserPartPattern.test(partArg))) {
+        throw new Error('image user must be null, user or user:group');
+    }
+    return { user: imageUserPart(parts[0]), group: parts[1] === undefined ? undefined : imageUserPart(parts[1]) };
+};
+/** The names of the group-readable (`0o440`) deliveries, sorted; a malformed delivery throws. */
+const groupReadableVariableNames = (deliveriesArg) => {
+    if (!Array.isArray(deliveriesArg))
+        throw new Error('launcherDeliveries must list the launcher deliveries');
+    const names = [];
+    for (const delivery of deliveriesArg) {
+        if (!isPlainRecord(delivery) || typeof delivery.variableName !== 'string' || delivery.variableName === ''
+            || (delivery.mode !== 0o400 && delivery.mode !== 0o440)) {
+            throw new Error('a launcher delivery must state its variableName and a 0400 or 0440 mode');
+        }
+        if (delivery.mode === 0o440)
+            names.push(delivery.variableName);
+    }
+    return names.sort();
+};
+const refusal = (variableNameArg, messageArg) => ({
+    status: 'refused', reason: 'launcher-secret-ownership-unknown', variableName: variableNameArg, message: messageArg,
+});
+/**
+ * The owner Cloudly gives every launcher-environment secret file of a workload, which WorkloadInit
+ * reads as the workload's own process identity before it starts the image.
+ *
+ * Without launcher deliveries it is `not-required`. A `runAs` pair wins over the image. Under
+ * `runAs: null` an image without a user runs as root (`0:0`, the runtime config's own default), a
+ * numeric `user:group` is taken as stated and `root` stands for `0` in either part. A numeric user
+ * without a group, or with a named group, is `user:0` while every delivery is owner-readable
+ * (`0o400`), which grants the group nothing; a `0o440` delivery would grant it, so it refuses and
+ * names that delivery. A named user, or a numeric part above the runtime identity bound, refuses.
+ * Every platform of a multi-platform index must derive
+ * the same owner, or it refuses: a workload gets one delivery, never one per platform. Nothing is
+ * guessed. A structurally malformed input throws, whatever it would answer.
+ */
+export const deriveLauncherSecretDeliveryOwner = (inputArg) => {
+    const { runAs, imageUsers, launcherDeliveries } = inputArg;
+    if (runAs !== null && !(isPlainRecord(runAs) && hasExactKeys(runAs, ['user', 'group'])
+        && isRuntimeIdentityNumber(runAs.user) && isRuntimeIdentityNumber(runAs.group))) {
+        throw new Error('runAs must be null or an exact user and group');
+    }
+    if (!Array.isArray(imageUsers) || imageUsers.length === 0) {
+        throw new Error('imageUsers must name the user of every platform');
+    }
+    const platforms = imageUsers.map(imageUserParts);
+    const groupReadable = groupReadableVariableNames(launcherDeliveries);
+    if (launcherDeliveries.length === 0)
+        return { status: 'not-required' };
+    if (runAs !== null)
+        return { status: 'derived', uid: runAs.user, gid: runAs.group };
+    const userOf = (predicateArg) => (imageUsers.find((_imageUserArg, indexArg) => predicateArg(platforms[indexArg])));
+    const unbounded = userOf((platformArg) => platformArg.user === 'unbounded' || platformArg.group === 'unbounded');
+    if (unbounded !== undefined) {
+        return refusal(null, `image user '${unbounded}' states an identity above `
+            + `${runtimePolicyLimits.maximumIdentityNumber}`);
+    }
+    const namedUser = userOf((platformArg) => platformArg.user === 'named');
+    if (namedUser !== undefined) {
+        return refusal(null, `image user '${namedUser}' names a user only the image's root filesystem resolves`);
+    }
+    const ungrouped = userOf((platformArg) => typeof platformArg.group !== 'number');
+    if (ungrouped !== undefined && groupReadable.length > 0) {
+        return refusal(groupReadable[0], `launcher-environment secret ${groupReadable.join(', ')} is group-readable `
+            + `(0440), but image user '${ungrouped}' states no numeric group`);
+    }
+    // Every part is now a bounded number, or a group that an owner-readable file does not grant.
+    const [first, ...rest] = platforms.map((platformArg) => ({
+        uid: platformArg.user, gid: typeof platformArg.group === 'number' ? platformArg.group : 0,
+    }));
+    if (rest.some((ownerArg) => ownerArg.uid !== first.uid || ownerArg.gid !== first.gid)) {
+        const users = imageUsers.map((userArg) => userArg === null ? 'none' : `'${userArg}'`).join(', ');
+        return refusal(null, `the platforms' image users ${users} derive different owners`);
+    }
+    return { status: 'derived', uid: first.uid, gid: first.gid };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGF1bmNoZXJzZWNyZXRvd25lci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvbGF1bmNoZXJzZWNyZXRvd25lci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzNFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxtQkFBbUIsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBNEMzRixNQUFNLG9CQUFvQixHQUFHLDRCQUE0QixDQUFDO0FBUTFELE1BQU0sYUFBYSxHQUFHLENBQUMsT0FBZSxFQUFrQixFQUFFO0lBQ3hELElBQUksT0FBTyxLQUFLLE1BQU07UUFBRSxPQUFPLENBQUMsQ0FBQztJQUNqQyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7UUFBRSxPQUFPLE9BQU8sQ0FBQztJQUM5QyxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDakMsT0FBTyx1QkFBdUIsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7QUFDcEUsQ0FBQyxDQUFDO0FBRUYsb0dBQW9HO0FBQ3BHLE1BQU0sY0FBYyxHQUFHLENBQUMsWUFBcUIsRUFBK0QsRUFBRTtJQUM1RyxJQUFJLFlBQVksS0FBSyxJQUFJO1FBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxDQUFDO0lBQ3hELE1BQU0sS0FBSyxHQUFHLE9BQU8sWUFBWSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzlFLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzVHLE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsT0FBTyxFQUFFLElBQUksRUFBRSxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7QUFDaEgsQ0FBQyxDQUFDO0FBRUYsaUdBQWlHO0FBQ2pHLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxhQUFzQixFQUFZLEVBQUU7SUFDdEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0lBQzNHLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUMzQixLQUFLLE1BQU0sUUFBUSxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxRQUFRLENBQUMsWUFBWSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsWUFBWSxLQUFLLEVBQUU7ZUFDcEcsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDMUQsTUFBTSxJQUFJLEtBQUssQ0FBQyx5RUFBeUUsQ0FBQyxDQUFDO1FBQzdGLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssS0FBSztZQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztBQUN0QixDQUFDLENBQUM7QUFFRixNQUFNLE9BQU8sR0FBRyxDQUFDLGVBQThCLEVBQUUsVUFBa0IsRUFBZ0MsRUFBRSxDQUFDLENBQUM7SUFDckcsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsbUNBQW1DLEVBQUUsWUFBWSxFQUFFLGVBQWUsRUFBRSxPQUFPLEVBQUUsVUFBVTtDQUNuSCxDQUFDLENBQUM7QUFFSDs7Ozs7Ozs7Ozs7OztHQWFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FDL0MsUUFBMkMsRUFDYixFQUFFO0lBQ2hDLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLGtCQUFrQixFQUFFLEdBQUcsUUFBUSxDQUFDO0lBQzNELElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLFlBQVksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7V0FDakYsdUJBQXVCLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDbEYsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzFELE1BQU0sSUFBSSxLQUFLLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUNqRCxNQUFNLGFBQWEsR0FBRywwQkFBMEIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ3JFLElBQUksa0JBQWtCLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxDQUFDO0lBQ3ZFLElBQUksS0FBSyxLQUFLLElBQUk7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3BGLE1BQU0sTUFBTSxHQUFHLENBQUMsWUFBZ0UsRUFBNkIsRUFBRSxDQUFDLENBQzlHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxhQUFhLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ25GLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksV0FBVyxDQUFDLEtBQUssS0FBSyxXQUFXLENBQUMsQ0FBQztJQUNqSCxJQUFJLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM1QixPQUFPLE9BQU8sQ0FBQyxJQUFJLEVBQUUsZUFBZSxTQUFTLDZCQUE2QjtjQUN0RSxHQUFHLG1CQUFtQixDQUFDLHFCQUFxQixFQUFFLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxDQUFDO0lBQ3hFLElBQUksU0FBUyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sT0FBTyxDQUFDLElBQUksRUFBRSxlQUFlLFNBQVMsMERBQTBELENBQUMsQ0FBQztJQUMzRyxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxPQUFPLFdBQVcsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDakYsSUFBSSxTQUFTLEtBQUssU0FBUyxJQUFJLGFBQWEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEQsT0FBTyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLCtCQUErQixhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxxQkFBcUI7Y0FDekcsMkJBQTJCLFNBQVMsMkJBQTJCLENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsNkZBQTZGO0lBQzdGLE1BQU0sQ0FBQyxLQUFLLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZELEdBQUcsRUFBRSxXQUFXLENBQUMsSUFBYyxFQUFFLEdBQUcsRUFBRSxPQUFPLFdBQVcsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0tBQ3BHLENBQUMsQ0FBQyxDQUFDO0lBQ0osSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsR0FBRyxLQUFLLEtBQUssQ0FBQyxHQUFHLElBQUksUUFBUSxDQUFDLEdBQUcsS0FBSyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0RixNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDakcsT0FBTyxPQUFPLENBQUMsSUFBSSxFQUFFLDhCQUE4QixLQUFLLDBCQUEwQixDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUM7QUFDL0QsQ0FBQyxDQUFDIn0=

package/dist_ts/data/secret.d.ts

@@ -151,7 +151,32 @@ export interface ISecretSetConsumerRolloutStatus {
     errorCode?: string;
     updatedAt: number;
 }
+/**
+ * A launcher-environment delivery as a caller states it: on a Secret's `defaultDelivery`, a
+ * SecretSet attachment override, a create request or an App Store declaration. The owner of the
+ * file WorkloadInit reads is not the caller's to state; the resolver derives it.
+ */
 export interface ISecretLauncherEnvironmentDelivery {
+    type: 'launcher-environment';
+    variableName: string;
+    /**
+     * @deprecated Derived by the resolver from the workload identity
+     * (`deriveLauncherSecretDeliveryOwner`); ignored; removed in the next major.
+     */
+    uid?: number;
+    /**
+     * @deprecated Derived by the resolver from the workload identity
+     * (`deriveLauncherSecretDeliveryOwner`); ignored; removed in the next major.
+     */
+    gid?: number;
+    mode: 0o400 | 0o440;
+}
+/**
+ * A launcher-environment delivery of a resolved secret manifest. `uid` and `gid` are the owner the
+ * resolver derived from the workload identity (`deriveLauncherSecretDeliveryOwner`), written by
+ * `createResolvedSecretDelivery`; the node mounts the file with them.
+ */
+export interface ISecretResolvedLauncherEnvironmentDelivery {
     type: 'launcher-environment';
     variableName: string;
     uid: number;
@@ -165,7 +190,10 @@ export interface ISecretFileDelivery {
     gid: number;
     mode: 0o400 | 0o440;
 }
+/** A delivery as a caller states it. */
 export type TSecretDelivery = ISecretLauncherEnvironmentDelivery | ISecretFileDelivery;
+/** A delivery of a resolved secret manifest: every owner is stated. */
+export type TSecretResolvedDelivery = ISecretResolvedLauncherEnvironmentDelivery | ISecretFileDelivery;
 export declare const secretValueLimits: Readonly<{
     maximumBytes: number;
     minimumGeneratedBytes: 16;
@@ -211,7 +239,7 @@ export interface IResolvedSecretManifestEntry {
     key: string;
     environment: TSecretEnvironment;
     owner: TWorkloadSecretOwner;
-    delivery: TSecretDelivery;
+    delivery: TSecretResolvedDelivery;
 }
 /** Immutable, value-free runtime snapshot. */
 export interface IResolvedSecretManifest {
@@ -272,7 +300,22 @@ export declare const verifySecretVersionPurgeIntentDigest: (intentArg: ISecretVe
 export declare const validateSecretVersionPurgeOperation: (operationArg: unknown) => Promise<string[]>;
 export declare const validateSecretOwner: (ownerArg: unknown) => string[];
 export declare const validateSecretManagementScope: (sourceArg: TSecretManagementSource, scopeArg: unknown) => string[];
+/**
+ * Validates a delivery as a caller states it. A launcher delivery should state no owner; one that
+ * states the deprecated `uid` and `gid` (both, bounded) is tolerated until the next major.
+ */
 export declare const validateSecretDelivery: (deliveryArg: unknown) => string[];
+/** Validates a resolved manifest's delivery: a launcher delivery states its derived owner. */
+export declare const validateSecretResolvedDelivery: (deliveryArg: unknown) => string[];
+/**
+ * The resolved manifest delivery of a caller's delivery: a launcher delivery takes the owner the
+ * resolver derived (`deriveLauncherSecretDeliveryOwner`) and drops any deprecated owner the caller
+ * stated; a file delivery keeps its own.
+ */
+export declare const createResolvedSecretDelivery: (deliveryArg: TSecretDelivery, ownerArg: {
+    uid: number;
+    gid: number;
+}) => TSecretResolvedDelivery;
 export declare const validateSecretMetadata: (secretArg: unknown) => string[];
 export declare const validateSecretValueInput: (valueInputArg: unknown) => string[];
 /** Checks the SmartCrypto context digest without opening or decrypting the envelope. */