@serve.zone/interfaces 32.59.0 → 32.61.0

package/.smartconfig.json

@@ -47,8 +47,10 @@
       }
     }
   },
-  "@git.zone/tsdoc": {
-    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license.md](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+  "@git.zone/tsrepo": {
+    "docs": {
+      "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license.md](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+    }
   },
   "@ship.zone/szci": {}
 }

package/changelog.md

@@ -1,5 +1,92 @@
 # Changelog
 
+## 2026-10-21 - 32.61.0
+
+### Features
+
+- Delegated admin temp tokens (`data.delegatedAdminTokenContract`): a human administrator who signed in within five minutes mints a token for explicit scopes, which lives one hour by default and at most one hour (`defaultLifetimeMs`, `maximumLifetimeMs`, `minimumLifetimeMs` one minute) and is never extended. `delegatedAdminTokenScopes` is the allowlist (`secrets`, `serviceCredentials`) and `delegatedAdminTokenScopeRequests` names exactly the wire methods each admits (typed as `TDelegatedAdminTokenScopeRequest`, judged by `isDelegatedAdminTokenScopeRequest`): `secrets` the operator-managed secret lifecycle (`getSecretIngressRecipient`, `listSecrets`, `getSecretMetadata`, `createSecret`, `rotateSecret`, `changeSecretLifecycle` with the actions `delegatedAdminTokenSecretLifecycleActions` names, `retire` and `revoke` of a granted key, never `delete`), `serviceCredentials` the service platform credential (`getServiceMachineCredential`, `mutateServiceMachineCredential`). A mint may grant `secretKeyPrefixes` (only with `secrets`, at most `maximumSecretKeyPrefixes` 16, each `isDelegatableSecretKeyPrefix`: `^[A-Z][A-Z0-9]*_$` and overlapping no reserved name either way, so a granted prefix is application-specific such as `GITSYNC_`, and `GIT_`, `NPM_` or `AWS_` are refused), under which alone the token creates, rotates, retires and revokes secrets (`isDelegatedSecretKey`); a token without prefixes does none of these. A token creates a secret only as a launcher-environment variable, never as a file. New requests `requests.admin.IReq_Admin_MintDelegatedAdminToken` (`mintDelegatedAdminToken`: `IDelegatedAdminTokenMint`, i.e. `scopes`, optional `lifetimeMs` and `secretKeyPrefixes`; answers the token once with its metadata), `IReq_Admin_GetDelegatedAdminTokens` (`getDelegatedAdminTokens`: the active tokens, value-free, newest first, at most `maximumListedTokens`, with `truncated`) and `IReq_Admin_RevokeDelegatedAdminToken` (`revokeDelegatedAdminToken`: by `tokenId`, any administrator), with value-free `IDelegatedAdminTokenMetadata` (scopes and `secretKeyPrefixes` included), refusals `delegatedAdminTokenRefusals` as `IDelegatedAdminTokenErrorData`, the exact token form `delegatedAdminToken_<tokenId>_<secret>` (`isDelegatedAdminToken`, `isDelegatedAdminTokenId`, `isDelegatedAdminTokenLifetime`) and exact-key snapshots (`snapshotDelegatedAdminTokenMint`, `snapshotDelegatedAdminTokenMetadata`, `snapshotDelegatedAdminTokenMintResult`). `getIdentityByToken` documents the session a token is exchanged for (`type: 'machine'`, `role: 'api'`, `userId: 'delegated-admin-token:<tokenId>'`). Specs: `test.delegatedadmintoken` (lifetime cap and token form, the scope and request lists and the delegated lifecycle actions, canonical scopes and exact keys, the token answered only by a mint, metadata without any value and with whole revocation, reserved names, grantable prefixes and delegated keys, named refusals).
+- Reserved secret names (`data.secret`): `platformReservedSecretKeyPrefixes` (`SERVEZONE_`, the names the platform injects), `runtimeInjectionSecretKeyPrefixes` (`LD_`, `DYLD_`, `NODE_`, `DENO_`, `BUN_`, `PYTHON`, `PERL`, `RUBY`, `PHP`, `JAVA_`, `JDK_`, `_JAVA_`, `DOTNET_`, `CORECLR_`, `LUA_`, `GEM_`, `BUNDLE_`, `NPM_CONFIG_`, `PIP_`, `GLIBC_`, `MALLOC_`, `GCONV_`, `OPENSSL_`, `SSL_`, `CURL_`, `REQUESTS_`, `GIT_`), `runtimeInjectionSecretKeys` (`PATH`, `HOME`, `SHELL`, `ENV`, `BASH_ENV`, `IFS`, `TMPDIR`, `LOCPATH`, `NLSPATH`, `CLASSPATH`, `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, `NO_PROXY`, `FTP_PROXY`, `AWS_CA_BUNDLE`, `SSLKEYLOGFILE`) and `isReservedSecretKey`. A delegated admin token never writes, retires or revokes such a name; human administrators are not restricted by them yet. The existing key pattern (`^[A-Z_][A-Z0-9_]{0,252}$`) admits a leading underscore, so `_JAVA_*` names exist and are covered.
+
+### Fixes
+
+- Gateway route DNS no longer claims manual records (AGL-523): the `reconcile` mode documentation (`data.TGatewayRouteDnsMode`) now says a gateway creates, updates and deletes only the exact-host A or AAAA record its route ownership holds and never adopts, replaces or deletes a record without gateway DNS ownership. Manual records satisfy a route only when no record at the name is owned and every manual A or AAAA record there matches the desired type, value and proxied flag; a differing record, any CNAME, owned and manual records together, or an operator-protected hostname is a non-retryable `record-conflict` with no mutation. While another enabled route on the gateway still serves the hostname, a withdrawn route releases its record to manual ownership instead of deleting it. `data.TGatewayRouteDnsStatus` gains `manual-satisfied` (every manual record matches; the gateway changes and claims nothing and reports them with `managed: false`) and `managed-released` (the record was released instead of deleted and is reported with `managed: false`); `managed-overwrote-manual`, `managed-orphan-deleted` and `IGatewayRouteDnsResult.overwrittenRecords` are deprecated, as no gateway reports them.
+
+### Maintenance
+
+- Release tooling: `@git.zone/tsrepo` ^1.1.1 replaces tsbuild, tstest, tsrun and tsdoc (deprecated in its favour): the scripts call `tsrepo build tsfolders`, `tsrepo test` and `tsrepo docs`, the specs import `@git.zone/tsrepo/tapbundle`, and the `.smartconfig.json` section `@git.zone/tsdoc` moved to `"@git.zone/tsrepo"` `docs`. `@types/node` 26.6.5 and pnpm 12.13.0 are current.
+
+## 2026-10-20 - 32.60.0
+
+### Fixes
+
+- External registry reads stop carrying the credential the server must never send. Every
+  `requests.externalRegistry` response (`getExternalRegistryById`, `getExternalRegistries`,
+  `createExternalRegistry`, `updateExternalRegistry`, `verifyExternalRegistry`) now answers
+  `data.IExternalRegistryPublic`: the registry without `data.password` and with a required
+  `passwordConfigured`. `IExternalRegistry` stays the stored shape, and its `data.password` is
+  documented as write-only.
+- `IReq_UpdateRegistry.request.registryData` is a `Partial` of the operator fields
+  (`TExternalRegistryOperatorData`, names in `TExternalRegistryOperatorField`): status, last error
+  and timestamps belong to Cloudly and can no longer be sent. A missing or empty `password` keeps
+  the stored one; `authType: 'none'` removes it.
+- `IReq_VerifyRegistry.response` carries a required `outcome` (`TExternalRegistryVerifyOutcome`:
+  `authenticated`, `anonymous`, `credentials-not-exercised`, `authentication-failed`,
+  `unreachable`, `unsupported`) and a required `registry`, so a registry that answers anonymously
+  no longer reads as verified credentials.
+
+### Features
+
+- `composeObjectStorageServiceEnvironment(serviceEnvironment, sources, secretEnvironmentNames?)`:
+  the names, without values, of the variables the workload receives as launcher-environment
+  secrets. The launcher sets a secret over a plain variable of the same name, so a secret named
+  like one of a binding's names (`objectStorageBindingEnvironmentKeys`, such as `S3_ENDPOINT`)
+  would silently replace the binding's value; it is refused as
+  `objectstorage-environment-conflict`, exactly as the same name in the service's own environment
+  is, and the message names it as a secret. Other secret names, including the binding's own
+  credentials (`corestoreObjectStorageCredentialSecretKeys`), are not conflicts. Omitted, the
+  composition treats the workload as receiving none; the input becomes required in the coordinated
+  major.
+- `IRequest_Any_Cloudly_UpdateService.request.serviceData` is a
+  `Partial<TServiceUpdateWritableData>`, matching the merge Cloudly performs: an omitted key keeps
+  its stored value, a stated key replaces it whole, and `containerArgs: null` removes the stored
+  argument vector. A client sends only the fields it changes, so an edit no longer has to restate
+  `placement` or `scaleFactor`, which a service with a runtime spec (and an immutable service)
+  refuses whenever an update states them. The full shape still type-checks, so existing callers
+  compile unchanged.
+- `deriveLauncherSecretDeliveryOwner({ runAs, imageUsers, launcherDeliveries })` (`data`): the one
+  rule for the owner of a workload's launcher-environment secret files, which WorkloadInit reads as
+  the workload's own process identity. A `runAs` pair wins; under `runAs: null` an image without a
+  user is `0:0`, a numeric `user:group` is taken as stated, `root` stands for `0`, and a numeric
+  user without a group or with a named group is `user:0` while every launcher delivery is `0o400`.
+  `imageUsers` is Cloudly's canonical image user (`parseCanonicalImageUser`), one per platform of
+  the pinned digest; group readability is computed from `launcherDeliveries`. A named user, a
+  numeric part above the identity bound, a `0o440` delivery whose group the image does not state
+  numerically (the refusal names it in `variableName`), or platforms that derive different owners
+  refuse as the new service runtime refusal `launcher-secret-ownership-unknown`
+  (`TLauncherSecretDeliveryOwner`, with a `message`); a workload without launcher deliveries is
+  `not-required`. An image running as a non-root user is no longer handed secret files it cannot
+  read. Only a structurally malformed input throws.
+- A resolved secret manifest's deliveries are their own type, `TSecretResolvedDelivery`, whose
+  launcher member `ISecretResolvedLauncherEnvironmentDelivery` requires `uid` and `gid`: the owner
+  the resolver derived, under the same keys, so the manifest's wire format and digest do not change
+  and every node keeps mounting it. `IResolvedSecretManifestEntry.delivery` is that type,
+  `validateSecretResolvedDelivery` checks it (`validateResolvedSecretManifest` uses it), and
+  `createResolvedSecretDelivery(delivery, owner)` builds it from a caller's delivery and the derived
+  owner.
+
+### Deprecations
+
+- `ISecretLauncherEnvironmentDelivery`, the launcher delivery a caller states (a Secret's
+  `defaultDelivery`, a SecretSet attachment override, a create request, an App Store declaration),
+  makes `uid` and `gid` optional and deprecated: the resolver ignores them and writes the derived
+  owner into the resolved delivery. `validateSecretDelivery` prefers neither and tolerates both
+  (bounded) until the next major, which removes them; a sealed context that states them still
+  verifies. File deliveries keep their stated owner.
+
+### Maintenance
+
+- Release tooling: pnpm 12.13.0; the other build and test tooling is current.
+
 ## 2026-10-18 - 32.59.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.59.0',
+    version: '32.61.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/delegatedadmintoken.d.ts

@@ -0,0 +1,142 @@
+/**
+ * A delegated administrator token (a "temp token") hands an agent a narrow, short-lived slice of
+ * one human administrator's authority, without the administrator's password or session.
+ *
+ * - Only a human administrator who signed in within five minutes mints one
+ *   (`mintDelegatedAdminToken`), for scopes named explicitly from `delegatedAdminTokenScopes`.
+ *   The plaintext token is answered exactly once; Cloudly stores only its hash.
+ * - It is exchanged with `getIdentityByToken` for a session that only the requests of its scopes
+ *   (`delegatedAdminTokenScopeRequests`) admit. Every such request re-reads the token, so the
+ *   session carries no validity of its own, and acts as `<administrator> via temp token <id>`.
+ * - It ends at its expiry, at most `maximumLifetimeMs` after the mint and never extended; when any
+ *   administrator revokes it; or when the minting administrator's credential generation changes.
+ * - A delegated session never mints, lists or revokes tokens, and no scope reaches users, roles,
+ *   human credentials, deployment tokens, authority records or organization membership.
+ */
+export declare const delegatedAdminTokenContract: Readonly<{
+    /** The lifetime a mint that names none receives. */
+    defaultLifetimeMs: number;
+    /** The hard cap: a token lives at most one hour from its mint and is never extended. */
+    maximumLifetimeMs: number;
+    minimumLifetimeMs: number;
+    /** Every token is `delegatedAdminToken_<tokenId>_<secret>`, both parts 64 lowercase hex. */
+    tokenPrefix: "delegatedAdminToken_";
+    /** Tokens one listing reports at most, newest first; a listing that leaves any out says so. */
+    maximumListedTokens: 256;
+    /** Secret key prefixes one token is granted at most. */
+    maximumSecretKeyPrefixes: 16;
+}>;
+/**
+ * What a token may be minted for. Each scope admits exactly the requests
+ * `delegatedAdminTokenScopeRequests` names for it, and nothing else does.
+ *
+ * - `secrets`: the operator-managed secrets of services and SecretSets: list and read their
+ *   metadata and read the ingress recipient a value is sealed to; create, rotate, retire and revoke
+ *   those whose key starts with a prefix the token was granted (`secretKeyPrefixes`, see
+ *   `isDelegatedSecretKey`; `changeSecretLifecycle` only with the actions
+ *   `delegatedAdminTokenSecretLifecycleActions` names, never `delete`). A token creates a secret
+ *   only as a launcher-environment variable, never as a file. A token minted without prefixes
+ *   creates, rotates, retires and revokes nothing.
+ * - `serviceCredentials`: a service's platform credential (`SERVEZONE_PLATFORM_AUTHORIZATION`):
+ *   inspect, ensure, rotate and revoke it.
+ */
+export declare const delegatedAdminTokenScopes: readonly ['secrets', 'serviceCredentials'];
+export type TDelegatedAdminTokenScope = typeof delegatedAdminTokenScopes[number];
+/** The exact requests each scope admits a delegated session on, by their wire method names. */
+export declare const delegatedAdminTokenScopeRequests: Readonly<{
+    secrets: readonly ["getSecretIngressRecipient", "listSecrets", "getSecretMetadata", "createSecret", "rotateSecret", "changeSecretLifecycle"];
+    serviceCredentials: readonly ["getServiceMachineCredential", "mutateServiceMachineCredential"];
+}>;
+/** A request one scope admits, by its wire method name. */
+export type TDelegatedAdminTokenScopeRequest<TScope extends TDelegatedAdminTokenScope = TDelegatedAdminTokenScope> = (typeof delegatedAdminTokenScopeRequests)[TScope][number];
+/** Whether `scopeArg` admits the request a wire method names. */
+export declare const isDelegatedAdminTokenScopeRequest: <TScope extends TDelegatedAdminTokenScope>(scopeArg: TScope, methodArg: unknown) => methodArg is TDelegatedAdminTokenScopeRequest<TScope>;
+/**
+ * The `changeSecretLifecycle` actions the `secrets` scope delegates, each only for a secret whose key
+ * the token's grant covers (`isDelegatedSecretKey`). Deleting a secret stays with a human
+ * administrator: a delegated session asking for it is refused like a request outside its scope.
+ */
+export declare const delegatedAdminTokenSecretLifecycleActions: readonly ["retire", "revoke"];
+/** One token, value-free. Neither the token nor its hash is ever part of it. */
+export interface IDelegatedAdminTokenMetadata {
+    /** 64 lowercase hex; the part of the token that names it. */
+    tokenId: string;
+    /** The human administrator who minted the token and whom every use acts for. */
+    userId: string;
+    /** Distinct, in `delegatedAdminTokenScopes` order. */
+    scopes: TDelegatedAdminTokenScope[];
+    /**
+     * The secret key prefixes the token creates, rotates, retires and revokes secrets under, sorted
+     * and distinct; empty when it was granted none. Only a token with the `secrets` scope carries any.
+     */
+    secretKeyPrefixes: string[];
+    createdAt: number;
+    expiresAt: number;
+    /** When an administrator revoked the token; `null` while it was never revoked. */
+    revokedAt: number | null;
+    /** The administrator who revoked it; `null` exactly when `revokedAt` is. */
+    revokedBy: string | null;
+}
+/** What a mint states besides the administrator's identity. */
+export interface IDelegatedAdminTokenMint {
+    scopes: TDelegatedAdminTokenScope[];
+    /** Absent: `defaultLifetimeMs`. Otherwise within `minimumLifetimeMs` and `maximumLifetimeMs`. */
+    lifetimeMs?: number;
+    /**
+     * The secret key prefixes the token may create, rotate, retire and revoke secrets under, each
+     * `isDelegatableSecretKeyPrefix`, distinct, at most `maximumSecretKeyPrefixes`; only with the
+     * `secrets` scope. Prefixes must be application-specific (`GITSYNC_`): a prefix that overlaps a
+     * reserved name is refused. Absent or empty: the token creates, rotates, retires and revokes
+     * nothing.
+     */
+    secretKeyPrefixes?: string[];
+}
+export interface IDelegatedAdminTokenMintResult {
+    /** The plaintext token, answered on this answer only; Cloudly keeps only its hash. */
+    token: string;
+    metadata: IDelegatedAdminTokenMetadata;
+}
+/**
+ * Every refusal the token requests name, as `IDelegatedAdminTokenErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: a mint by anyone but a human administrator who signed in
+ *   within five minutes, or a listing or revocation by anyone but an administrator. A delegated
+ *   session is refused here on every request.
+ * - `DELEGATED_ADMIN_TOKEN_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DELEGATED_ADMIN_TOKEN_NOT_FOUND`: no token has that id.
+ * - `DELEGATED_ADMIN_TOKEN_INACTIVE`: the token already ended: it expired, was revoked, or its
+ *   administrator is no longer a human administrator at the credential generation it was minted
+ *   under.
+ */
+export declare const delegatedAdminTokenRefusals: readonly ['ADMIN_AUTHORIZATION_REQUIRED', 'DELEGATED_ADMIN_TOKEN_REQUEST_INVALID', 'DELEGATED_ADMIN_TOKEN_NOT_FOUND', 'DELEGATED_ADMIN_TOKEN_INACTIVE'];
+export type TDelegatedAdminTokenRefusal = typeof delegatedAdminTokenRefusals[number];
+export interface IDelegatedAdminTokenErrorData {
+    code: TDelegatedAdminTokenRefusal;
+    retryable: false;
+}
+/** Whether a value is a delegated admin token in its exact form; it proves nothing else. */
+export declare const isDelegatedAdminToken: (value: unknown) => value is string;
+/** Whether a value names a token: 64 lowercase hex. */
+export declare const isDelegatedAdminTokenId: (value: unknown) => value is string;
+/**
+ * Whether a prefix may be granted: `^[A-Z][A-Z0-9]*_$`, and overlapping no reserved name in
+ * either direction: it neither starts with nor is the start of an entry of
+ * `platformReservedSecretKeyPrefixes` or `runtimeInjectionSecretKeyPrefixes`, and no entry of
+ * `runtimeInjectionSecretKeys` starts with it. So a granted prefix is application-specific:
+ * `GIT_`, `NODE_`, `NPM_` and `AWS_` (`AWS_CA_BUNDLE`) are refused; `GITSYNC_` is not.
+ */
+export declare const isDelegatableSecretKeyPrefix: (value: unknown) => value is string;
+/**
+ * Whether a token granted `prefixesArg` creates, rotates, retires or revokes a secret of key
+ * `keyArg`, or delivers a launcher variable of that name: the key starts with a granted prefix and
+ * is not reserved (`isReservedSecretKey`).
+ */
+export declare const isDelegatedSecretKey: (prefixesArg: readonly string[], keyArg: string) => boolean;
+/** Whether a lifetime is one a mint may state. */
+export declare const isDelegatedAdminTokenLifetime: (value: unknown) => value is number;
+/** Structural copy of a mint; the backend authorizes the administrator and enforces the cap. */
+export declare const snapshotDelegatedAdminTokenMint: (value: unknown) => IDelegatedAdminTokenMint;
+/** Structural copy of listed or answered metadata. */
+export declare const snapshotDelegatedAdminTokenMetadata: (value: unknown) => IDelegatedAdminTokenMetadata;
+/** Structural copy of a mint's answer: a token in its exact form and the metadata that names it. */
+export declare const snapshotDelegatedAdminTokenMintResult: (value: unknown) => IDelegatedAdminTokenMintResult;

package/dist_ts/data/delegatedadmintoken.js

@@ -0,0 +1,197 @@
+import { readDataElements, readDataProperty, readExactDataRecord } from '../private/dataproperties.js';
+import { isReservedSecretKey, platformReservedSecretKeyPrefixes, runtimeInjectionSecretKeyPrefixes, runtimeInjectionSecretKeys, } from './secret.js';
+/**
+ * A delegated administrator token (a "temp token") hands an agent a narrow, short-lived slice of
+ * one human administrator's authority, without the administrator's password or session.
+ *
+ * - Only a human administrator who signed in within five minutes mints one
+ *   (`mintDelegatedAdminToken`), for scopes named explicitly from `delegatedAdminTokenScopes`.
+ *   The plaintext token is answered exactly once; Cloudly stores only its hash.
+ * - It is exchanged with `getIdentityByToken` for a session that only the requests of its scopes
+ *   (`delegatedAdminTokenScopeRequests`) admit. Every such request re-reads the token, so the
+ *   session carries no validity of its own, and acts as `<administrator> via temp token <id>`.
+ * - It ends at its expiry, at most `maximumLifetimeMs` after the mint and never extended; when any
+ *   administrator revokes it; or when the minting administrator's credential generation changes.
+ * - A delegated session never mints, lists or revokes tokens, and no scope reaches users, roles,
+ *   human credentials, deployment tokens, authority records or organization membership.
+ */
+export const delegatedAdminTokenContract = Object.freeze({
+    /** The lifetime a mint that names none receives. */
+    defaultLifetimeMs: 60 * 60 * 1000,
+    /** The hard cap: a token lives at most one hour from its mint and is never extended. */
+    maximumLifetimeMs: 60 * 60 * 1000,
+    minimumLifetimeMs: 60 * 1000,
+    /** Every token is `delegatedAdminToken_<tokenId>_<secret>`, both parts 64 lowercase hex. */
+    tokenPrefix: 'delegatedAdminToken_',
+    /** Tokens one listing reports at most, newest first; a listing that leaves any out says so. */
+    maximumListedTokens: 256,
+    /** Secret key prefixes one token is granted at most. */
+    maximumSecretKeyPrefixes: 16,
+});
+/**
+ * What a token may be minted for. Each scope admits exactly the requests
+ * `delegatedAdminTokenScopeRequests` names for it, and nothing else does.
+ *
+ * - `secrets`: the operator-managed secrets of services and SecretSets: list and read their
+ *   metadata and read the ingress recipient a value is sealed to; create, rotate, retire and revoke
+ *   those whose key starts with a prefix the token was granted (`secretKeyPrefixes`, see
+ *   `isDelegatedSecretKey`; `changeSecretLifecycle` only with the actions
+ *   `delegatedAdminTokenSecretLifecycleActions` names, never `delete`). A token creates a secret
+ *   only as a launcher-environment variable, never as a file. A token minted without prefixes
+ *   creates, rotates, retires and revokes nothing.
+ * - `serviceCredentials`: a service's platform credential (`SERVEZONE_PLATFORM_AUTHORIZATION`):
+ *   inspect, ensure, rotate and revoke it.
+ */
+export const delegatedAdminTokenScopes = ['secrets', 'serviceCredentials'];
+/** The exact requests each scope admits a delegated session on, by their wire method names. */
+export const delegatedAdminTokenScopeRequests = Object.freeze({
+    secrets: Object.freeze([
+        'getSecretIngressRecipient', 'listSecrets', 'getSecretMetadata', 'createSecret', 'rotateSecret',
+        'changeSecretLifecycle',
+    ]),
+    serviceCredentials: Object.freeze(['getServiceMachineCredential', 'mutateServiceMachineCredential']),
+});
+/** Whether `scopeArg` admits the request a wire method names. */
+export const isDelegatedAdminTokenScopeRequest = (scopeArg, methodArg) => (delegatedAdminTokenScopeRequests[scopeArg].includes(methodArg));
+/**
+ * The `changeSecretLifecycle` actions the `secrets` scope delegates, each only for a secret whose key
+ * the token's grant covers (`isDelegatedSecretKey`). Deleting a secret stays with a human
+ * administrator: a delegated session asking for it is refused like a request outside its scope.
+ */
+export const delegatedAdminTokenSecretLifecycleActions = Object.freeze(['retire', 'revoke']);
+/**
+ * Every refusal the token requests name, as `IDelegatedAdminTokenErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: a mint by anyone but a human administrator who signed in
+ *   within five minutes, or a listing or revocation by anyone but an administrator. A delegated
+ *   session is refused here on every request.
+ * - `DELEGATED_ADMIN_TOKEN_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DELEGATED_ADMIN_TOKEN_NOT_FOUND`: no token has that id.
+ * - `DELEGATED_ADMIN_TOKEN_INACTIVE`: the token already ended: it expired, was revoked, or its
+ *   administrator is no longer a human administrator at the credential generation it was minted
+ *   under.
+ */
+export const delegatedAdminTokenRefusals = [
+    'ADMIN_AUTHORIZATION_REQUIRED',
+    'DELEGATED_ADMIN_TOKEN_REQUEST_INVALID',
+    'DELEGATED_ADMIN_TOKEN_NOT_FOUND',
+    'DELEGATED_ADMIN_TOKEN_INACTIVE',
+];
+const fail = () => { throw new Error('Delegated admin token contract rejected.'); };
+function requireValue(value) { if (!value)
+    fail(); }
+const safe = (operation) => { try {
+    return operation();
+}
+catch {
+    return fail();
+} };
+/** Exactly this shape's keys, read once as data; an accessor is refused, never invoked. */
+const object = (value, keys) => {
+    const copy = readExactDataRecord(value, keys);
+    requireValue(copy !== null);
+    return copy;
+};
+const identifier = (value) => {
+    requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+    return value;
+};
+const timestamp = (value) => {
+    requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0);
+    return value;
+};
+const tokenIdPattern = /^[a-f0-9]{64}$/;
+const tokenPattern = /^delegatedAdminToken_[a-f0-9]{64}_[a-f0-9]{64}$/;
+/** Whether a value is a delegated admin token in its exact form; it proves nothing else. */
+export const isDelegatedAdminToken = (value) => (typeof value === 'string' && tokenPattern.test(value));
+/** Whether a value names a token: 64 lowercase hex. */
+export const isDelegatedAdminTokenId = (value) => (typeof value === 'string' && tokenIdPattern.test(value));
+const secretKeyPrefixPattern = /^[A-Z][A-Z0-9]*_$/;
+/**
+ * Whether a prefix may be granted: `^[A-Z][A-Z0-9]*_$`, and overlapping no reserved name in
+ * either direction: it neither starts with nor is the start of an entry of
+ * `platformReservedSecretKeyPrefixes` or `runtimeInjectionSecretKeyPrefixes`, and no entry of
+ * `runtimeInjectionSecretKeys` starts with it. So a granted prefix is application-specific:
+ * `GIT_`, `NODE_`, `NPM_` and `AWS_` (`AWS_CA_BUNDLE`) are refused; `GITSYNC_` is not.
+ */
+export const isDelegatableSecretKeyPrefix = (value) => (typeof value === 'string' && value.length <= 64 && secretKeyPrefixPattern.test(value)
+    && [...platformReservedSecretKeyPrefixes, ...runtimeInjectionSecretKeyPrefixes]
+        .every((reservedArg) => !value.startsWith(reservedArg) && !reservedArg.startsWith(value))
+    && runtimeInjectionSecretKeys.every((reservedArg) => !reservedArg.startsWith(value)));
+/**
+ * Whether a token granted `prefixesArg` creates, rotates, retires or revokes a secret of key
+ * `keyArg`, or delivers a launcher variable of that name: the key starts with a granted prefix and
+ * is not reserved (`isReservedSecretKey`).
+ */
+export const isDelegatedSecretKey = (prefixesArg, keyArg) => (prefixesArg.some((prefixArg) => keyArg.startsWith(prefixArg)) && !isReservedSecretKey(keyArg));
+/** Whether a lifetime is one a mint may state. */
+export const isDelegatedAdminTokenLifetime = (value) => (typeof value === 'number' && Number.isSafeInteger(value)
+    && value >= delegatedAdminTokenContract.minimumLifetimeMs
+    && value <= delegatedAdminTokenContract.maximumLifetimeMs);
+/** Distinct known scopes, at least one, answered in `delegatedAdminTokenScopes` order. */
+const scopes = (value, canonical) => {
+    const entries = readDataElements(value, delegatedAdminTokenScopes.length);
+    requireValue(entries !== null && entries.length > 0 && new Set(entries).size === entries.length
+        && entries.every((entry) => delegatedAdminTokenScopes.some((scope) => scope === entry)));
+    const ordered = delegatedAdminTokenScopes.filter((scope) => entries.includes(scope));
+    requireValue(!canonical || ordered.every((scope, index) => entries[index] === scope));
+    return ordered;
+};
+/** Distinct grantable prefixes, at most the cap, answered sorted; `canonical` requires them sorted. */
+const secretKeyPrefixes = (value, canonical) => {
+    const entries = readDataElements(value, delegatedAdminTokenContract.maximumSecretKeyPrefixes);
+    requireValue(entries !== null && new Set(entries).size === entries.length
+        && entries.every((entry) => isDelegatableSecretKeyPrefix(entry)));
+    const prefixes = entries.slice().sort();
+    requireValue(!canonical || prefixes.every((prefix, index) => entries[index] === prefix));
+    return prefixes;
+};
+/** Structural copy of a mint; the backend authorizes the administrator and enforces the cap. */
+export const snapshotDelegatedAdminTokenMint = (value) => safe(() => {
+    const namesLifetime = readDataProperty(value, 'lifetimeMs') !== null;
+    const namesPrefixes = readDataProperty(value, 'secretKeyPrefixes') !== null;
+    const mint = object(value, ['scopes', ...(namesLifetime ? ['lifetimeMs'] : []),
+        ...(namesPrefixes ? ['secretKeyPrefixes'] : [])]);
+    const copy = { scopes: scopes(mint.scopes, false) };
+    if (namesLifetime) {
+        requireValue(isDelegatedAdminTokenLifetime(mint.lifetimeMs));
+        copy.lifetimeMs = mint.lifetimeMs;
+    }
+    if (namesPrefixes) {
+        const prefixes = secretKeyPrefixes(mint.secretKeyPrefixes, false);
+        requireValue(prefixes.length === 0 || copy.scopes.includes('secrets'));
+        copy.secretKeyPrefixes = prefixes;
+    }
+    return copy;
+});
+/** Structural copy of listed or answered metadata. */
+export const snapshotDelegatedAdminTokenMetadata = (value) => safe(() => {
+    const metadata = object(value, ['tokenId', 'userId', 'scopes', 'secretKeyPrefixes', 'createdAt', 'expiresAt',
+        'revokedAt', 'revokedBy']);
+    requireValue(isDelegatedAdminTokenId(metadata.tokenId));
+    const createdAt = timestamp(metadata.createdAt);
+    const expiresAt = timestamp(metadata.expiresAt);
+    requireValue(expiresAt > createdAt
+        && expiresAt - createdAt <= delegatedAdminTokenContract.maximumLifetimeMs);
+    const revoked = metadata.revokedAt !== null;
+    requireValue(revoked === (metadata.revokedBy !== null));
+    const revokedAt = revoked ? timestamp(metadata.revokedAt) : null;
+    requireValue(revokedAt === null || revokedAt >= createdAt);
+    const tokenScopes = scopes(metadata.scopes, true);
+    const prefixes = secretKeyPrefixes(metadata.secretKeyPrefixes, true);
+    requireValue(prefixes.length === 0 || tokenScopes.includes('secrets'));
+    return {
+        tokenId: metadata.tokenId, userId: identifier(metadata.userId), scopes: tokenScopes,
+        secretKeyPrefixes: prefixes, createdAt, expiresAt, revokedAt,
+        revokedBy: revoked ? identifier(metadata.revokedBy) : null,
+    };
+});
+/** Structural copy of a mint's answer: a token in its exact form and the metadata that names it. */
+export const snapshotDelegatedAdminTokenMintResult = (value) => safe(() => {
+    const result = object(value, ['token', 'metadata']);
+    requireValue(isDelegatedAdminToken(result.token));
+    const metadata = snapshotDelegatedAdminTokenMetadata(result.metadata);
+    requireValue(result.token.slice(delegatedAdminTokenContract.tokenPrefix.length, delegatedAdminTokenContract.tokenPrefix.length + 64) === metadata.tokenId && metadata.revokedAt === null);
+    return { token: result.token, metadata };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsZWdhdGVkYWRtaW50b2tlbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVsZWdhdGVkYWRtaW50b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsZ0JBQWdCLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUN2RyxPQUFPLEVBQ0wsbUJBQW1CLEVBQUUsaUNBQWlDLEVBQUUsaUNBQWlDLEVBQ3pGLDBCQUEwQixHQUMzQixNQUFNLGFBQWEsQ0FBQztBQUVyQjs7Ozs7Ozs7Ozs7Ozs7R0FjRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDdkQsb0RBQW9EO0lBQ3BELGlCQUFpQixFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSTtJQUNqQyx3RkFBd0Y7SUFDeEYsaUJBQWlCLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJO0lBQ2pDLGlCQUFpQixFQUFFLEVBQUUsR0FBRyxJQUFJO0lBQzVCLDRGQUE0RjtJQUM1RixXQUFXLEVBQUUsc0JBQXNCO0lBQ25DLCtGQUErRjtJQUMvRixtQkFBbUIsRUFBRSxHQUFHO0lBQ3hCLHdEQUF3RDtJQUN4RCx3QkFBd0IsRUFBRSxFQUFFO0NBQzdCLENBQUMsQ0FBQztBQUVIOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLFNBQVMsRUFBRSxvQkFBb0IsQ0FBVSxDQUFDO0FBSXBGLCtGQUErRjtBQUMvRixNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzVELE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ3JCLDJCQUEyQixFQUFFLGFBQWEsRUFBRSxtQkFBbUIsRUFBRSxjQUFjLEVBQUUsY0FBYztRQUMvRix1QkFBdUI7S0FDZixDQUFDO0lBQ1gsa0JBQWtCLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLDZCQUE2QixFQUFFLGdDQUFnQyxDQUFVLENBQUM7Q0FDOUcsQ0FBMEUsQ0FBQztBQU01RSxpRUFBaUU7QUFDakUsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FDL0MsUUFBZ0IsRUFDaEIsU0FBa0IsRUFDcUMsRUFBRSxDQUFDLENBQ3pELGdDQUFnQyxDQUFDLFFBQVEsQ0FBd0IsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQ3ZGLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQVUsQ0FBQyxDQUFDO0FBNEN0Rzs7Ozs7Ozs7Ozs7R0FXRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHO0lBQ3pDLDhCQUE4QjtJQUM5Qix1Q0FBdUM7SUFDdkMsaUNBQWlDO0lBQ2pDLGdDQUFnQztDQUN4QixDQUFDO0FBU1gsTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzNGLFNBQVMsWUFBWSxDQUFDLEtBQWMsSUFBbUIsSUFBSSxDQUFDLEtBQUs7SUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFDNUUsTUFBTSxJQUFJLEdBQUcsQ0FBSSxTQUFrQixFQUFLLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFBQyxPQUFPLFNBQVMsRUFBRSxDQUFDO0FBQUMsQ0FBQztBQUFDLE1BQU0sQ0FBQztJQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7QUFBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQ3BHLDJGQUEyRjtBQUMzRixNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBRSxJQUF1QixFQUEyQixFQUFFO0lBQ2xGLE1BQU0sSUFBSSxHQUFHLG1CQUFtQixDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztJQUM5QyxZQUFZLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQzVCLE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxVQUFVLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUM1QyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUMzQyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxjQUFjLEdBQUcsZ0JBQWdCLENBQUM7QUFDeEMsTUFBTSxZQUFZLEdBQUcsaURBQWlELENBQUM7QUFFdkUsNEZBQTRGO0FBQzVGLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQUMsQ0FDeEUsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLFlBQVksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQ3RELENBQUM7QUFFRix1REFBdUQ7QUFDdkQsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxDQUMxRSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FDeEQsQ0FBQztBQUVGLE1BQU0sc0JBQXNCLEdBQUcsbUJBQW1CLENBQUM7QUFFbkQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxDQUMvRSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxFQUFFLElBQUksc0JBQXNCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQztPQUNsRixDQUFDLEdBQUcsaUNBQWlDLEVBQUUsR0FBRyxpQ0FBaUMsQ0FBQztTQUM1RSxLQUFLLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7T0FDeEYsMEJBQTBCLENBQUMsS0FBSyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FDckYsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLFdBQThCLEVBQUUsTUFBYyxFQUFXLEVBQUUsQ0FBQyxDQUMvRixXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsQ0FDOUYsQ0FBQztBQUVGLGtEQUFrRDtBQUNsRCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUFDLEtBQWMsRUFBbUIsRUFBRSxDQUFDLENBQ2hGLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQztPQUNyRCxLQUFLLElBQUksMkJBQTJCLENBQUMsaUJBQWlCO09BQ3RELEtBQUssSUFBSSwyQkFBMkIsQ0FBQyxpQkFBaUIsQ0FDMUQsQ0FBQztBQUVGLDBGQUEwRjtBQUMxRixNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBRSxTQUFrQixFQUErQixFQUFFO0lBQ2pGLE1BQU0sT0FBTyxHQUFHLGdCQUFnQixDQUFDLEtBQUssRUFBRSx5QkFBeUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMxRSxZQUFZLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLEtBQUssT0FBTyxDQUFDLE1BQU07V0FDMUYsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzNGLE1BQU0sT0FBTyxHQUFHLHlCQUF5QixDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3JGLFlBQVksQ0FBQyxDQUFDLFNBQVMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDdEYsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDO0FBRUYsdUdBQXVHO0FBQ3ZHLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxLQUFjLEVBQUUsU0FBa0IsRUFBWSxFQUFFO0lBQ3pFLE1BQU0sT0FBTyxHQUFHLGdCQUFnQixDQUFDLEtBQUssRUFBRSwyQkFBMkIsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO0lBQzlGLFlBQVksQ0FBQyxPQUFPLEtBQUssSUFBSSxJQUFJLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsTUFBTTtXQUNwRSxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDcEUsTUFBTSxRQUFRLEdBQUksT0FBb0IsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN0RCxZQUFZLENBQUMsQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3pGLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLGdHQUFnRztBQUNoRyxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLEtBQWMsRUFBNEIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDckcsTUFBTSxhQUFhLEdBQUcsZ0JBQWdCLENBQUMsS0FBSyxFQUFFLFlBQVksQ0FBQyxLQUFLLElBQUksQ0FBQztJQUNyRSxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsbUJBQW1CLENBQUMsS0FBSyxJQUFJLENBQUM7SUFDNUUsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDNUUsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDcEQsTUFBTSxJQUFJLEdBQTZCLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUM7SUFDOUUsSUFBSSxhQUFhLEVBQUUsQ0FBQztRQUNsQixZQUFZLENBQUMsNkJBQTZCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDO0lBQ3BDLENBQUM7SUFDRCxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQ2xCLE1BQU0sUUFBUSxHQUFHLGlCQUFpQixDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNsRSxZQUFZLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUN2RSxJQUFJLENBQUMsaUJBQWlCLEdBQUcsUUFBUSxDQUFDO0lBQ3BDLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQyxDQUFDO0FBRUgsc0RBQXNEO0FBQ3RELE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLENBQUMsS0FBYyxFQUFnQyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUM3RyxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLFdBQVc7UUFDMUcsV0FBVyxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDN0IsWUFBWSxDQUFDLHVCQUF1QixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3hELE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEQsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNoRCxZQUFZLENBQUMsU0FBUyxHQUFHLFNBQVM7V0FDN0IsU0FBUyxHQUFHLFNBQVMsSUFBSSwyQkFBMkIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQzdFLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDO0lBQzVDLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDeEQsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDakUsWUFBWSxDQUFDLFNBQVMsS0FBSyxJQUFJLElBQUksU0FBUyxJQUFJLFNBQVMsQ0FBQyxDQUFDO0lBQzNELE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ2xELE1BQU0sUUFBUSxHQUFHLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUNyRSxZQUFZLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLE9BQU87UUFDTCxPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLEVBQUUsV0FBVztRQUNuRixpQkFBaUIsRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTO1FBQzVELFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUk7S0FDM0QsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUgsb0dBQW9HO0FBQ3BHLE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQUMsS0FBYyxFQUFrQyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNqSCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDcEQsWUFBWSxDQUFDLHFCQUFxQixDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2xELE1BQU0sUUFBUSxHQUFHLG1DQUFtQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN0RSxZQUFZLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsMkJBQTJCLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFDNUUsMkJBQTJCLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxFQUFFLENBQUMsS0FBSyxRQUFRLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDNUcsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQzNDLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/externalregistry.d.ts

@@ -1,3 +1,7 @@
+/**
+ * An external registry as Cloudly stores it, credential included. Never answered: every external
+ * registry response carries `IExternalRegistryPublic`.
+ */
 export interface IExternalRegistry {
     id: string;
     data: {
@@ -18,7 +22,10 @@ export interface IExternalRegistry {
          */
         username?: string;
         /**
-         * Password, access token, or API key for authentication (optional for public registries)
+         * Password, access token or API key for authentication (optional for public registries).
+         *
+         * Write-only: Cloudly stores it and uses it server-side, and never answers it. Reads carry
+         * `IExternalRegistryPublic.passwordConfigured` instead.
          */
         password?: string;
         /**
@@ -90,3 +97,32 @@ export interface IExternalRegistry {
         updatedAt?: number;
     };
 }
+/**
+ * An external registry as Cloudly answers it: the stored registry without its credential, and
+ * whether one is stored.
+ */
+export interface IExternalRegistryPublic {
+    id: string;
+    data: Omit<IExternalRegistry['data'], 'password'>;
+    /** Whether a password, access token or API key is stored for the registry. */
+    passwordConfigured: boolean;
+}
+/** The registry fields an operator writes; Cloudly owns status, errors and timestamps. */
+export type TExternalRegistryOperatorField = 'type' | 'name' | 'url' | 'username' | 'password' | 'description' | 'isDefault' | 'authType' | 'insecure' | 'namespace' | 'proxy' | 'config';
+export type TExternalRegistryOperatorData = Pick<IExternalRegistry['data'], TExternalRegistryOperatorField>;
+/**
+ * What a registry verification proved.
+ *
+ * - `authenticated`: the registry admitted the stored credentials (Basic, or a token its Bearer
+ *   realm issued for them).
+ * - `anonymous`: the registry answers without authentication and none is configured.
+ * - `credentials-not-exercised`: credentials are configured, but the registry answers without
+ *   authentication, so they were never checked.
+ * - `authentication-failed`: the registry, or its token realm, refused the credentials, or it
+ *   requires authentication and none is configured.
+ * - `unreachable`: no usable answer (connection, TLS, timeout or an unexpected HTTP status).
+ * - `unsupported`: the registry or its configuration cannot be verified (an npm registry, OAuth2,
+ *   an unknown or missing authentication challenge, a redirect, or credentials over plain HTTP
+ *   without `insecure`).
+ */
+export type TExternalRegistryVerifyOutcome = 'authenticated' | 'anonymous' | 'credentials-not-exercised' | 'authentication-failed' | 'unreachable' | 'unsupported';

package/dist_ts/data/gateway.d.ts

@@ -10,16 +10,32 @@ export type TManagedRouteKind = 'letsencrypt-http01-forward';
 /**
  * DNS handling requested alongside a gateway route synchronization.
  *
- * - 'reconcile' claims or replaces exact-host manual A, AAAA, and CNAME
- *   records, including already-correct records, with gateway-managed state.
+ * - 'reconcile' creates, updates and deletes the exact-host A or AAAA record
+ *   the route's gateway DNS ownership holds. It never adopts, replaces or
+ *   deletes a record without gateway DNS ownership. The route is satisfied by
+ *   manual records only when no record at the name is owned and every manual A
+ *   or AAAA record there matches the desired type, value and proxied flag (TTL
+ *   ignored); anything else (a differing record, any CNAME, owned and manual
+ *   records together) and an operator-protected hostname is a non-retryable
+ *   `record-conflict` with no mutation. When the route stops claiming the
+ *   hostname while another enabled route on the gateway serves it, the owned
+ *   record is released to manual ownership instead of deleted.
  * - 'observe' reports DNS state without mutating it.
  * - 'skip' bypasses DNS inspection and mutation and is the default when omitted.
  */
 export type TGatewayRouteDnsMode = 'reconcile' | 'observe' | 'skip';
 /**
  * Detailed DNS outcome reported by a gateway route synchronization.
+ *
+ * - `manual-satisfied`: every manual A or AAAA record at the name matches the desired type,
+ *   value and proxied flag; the gateway changes and claims nothing and reports them in
+ *   `records` with `managed: false`.
+ * - `managed-released`: the route no longer claims the hostname, but another enabled route on
+ *   the gateway still serves it, so the gateway released its record to manual ownership instead
+ *   of deleting it; the released record is reported in `records` with `managed: false`.
+ * - `managed-overwrote-manual` and `managed-orphan-deleted`: deprecated; no gateway reports them.
  */
-export type TGatewayRouteDnsStatus = 'not-applicable' | 'skipped' | 'managed-created' | 'managed-updated' | 'managed-overwrote-manual' | 'managed-unchanged' | 'observed-satisfied' | 'managed-deleted' | 'managed-orphan-deleted' | 'record-missing' | 'target-invalid' | 'zone-unmanaged' | 'zone-unavailable' | 'record-conflict' | 'mutation-failed' | 'compensation-failed';
+export type TGatewayRouteDnsStatus = 'not-applicable' | 'skipped' | 'managed-created' | 'managed-updated' | 'managed-overwrote-manual' | 'managed-unchanged' | 'manual-satisfied' | 'observed-satisfied' | 'managed-deleted' | 'managed-released' | 'managed-orphan-deleted' | 'record-missing' | 'target-invalid' | 'zone-unmanaged' | 'zone-unavailable' | 'record-conflict' | 'mutation-failed' | 'compensation-failed';
 /**
  * DNS record evidence attached to a gateway route synchronization result.
  */
@@ -48,7 +64,10 @@ export interface IGatewayRouteDnsResult {
     zoneName?: string;
     nameservers?: string[];
     records?: IGatewayRouteDnsRecord[];
-    /** Prior manual records replaced by this reconciliation, preserved as evidence. */
+    /**
+     * Prior manual records replaced by this reconciliation, preserved as evidence.
+     * @deprecated No gateway replaces manual records; it accompanied `managed-overwrote-manual`.
+     */
     overwrittenRecords?: IGatewayRouteDnsRecord[];
     /** Time at which the gateway checked the DNS state, as Unix epoch milliseconds. */
     checkedAt: number;

package/dist_ts/data/gateway.js

@@ -112,4 +112,4 @@ export const isGatewayClientDnsRecordAllowed = (recordArg, allowedDnsRecordAddre
         return prefix !== null && ipPrefixContains(prefix, address);
     });
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2F0ZXdheS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZ2F0ZXdheS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDbEcsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDNUQsT0FBTyxFQUNMLGdCQUFnQixFQUNoQix1QkFBdUIsRUFDdkIsc0JBQXNCLEdBQ3ZCLE1BQU0seUJBQXlCLENBQUM7QUFvZWpDOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN6RCxNQUFNLEVBQUUsRUFBRTtJQUNWLE1BQU0sRUFBRSxNQUFNO0lBQ2QsVUFBVSxFQUFFLEdBQUc7SUFDZiw0QkFBNEIsRUFBRSxFQUFFO0lBQ2hDLGNBQWMsRUFBRSxHQUFHO0lBQ25CLGlCQUFpQixFQUFFLEdBQUc7Q0FDdkIsQ0FBQyxDQUFDO0FBbUpILE1BQU0sb0JBQW9CLEdBQUcsd0NBQXdDLENBQUM7QUFDdEUsTUFBTSxZQUFZLEdBQUcsK0JBQStCLENBQUM7QUFFckQsb0dBQW9HO0FBQ3BHLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ2hGLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDekIsUUFBUSxDQUFDLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxpQkFBaUI7T0FDbEUsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQztPQUMvQixRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQ2hGLENBQUM7QUFFRiw2RUFBNkU7QUFDN0UsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLFdBQVcsRUFDWCxFQUFFO0lBQ1osTUFBTSxTQUFTLEdBQUcsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDL0MsSUFBSSxTQUFTLEtBQUssSUFBSSxJQUFJLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDMUUsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLEtBQUssQ0FBQztJQUM5QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLDZCQUE2QixDQUFDLGNBQWM7V0FDdkYsQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0IsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sdUJBQXVCLDZCQUE2QixDQUFDLGNBQWMsR0FBRztjQUN4RixrR0FBa0csQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxJQUFJLENBQUMsdUJBQXVCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8seURBQXlEO2NBQzNFLG9DQUFvQyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDOUUsc0JBQXNCLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDO0FBRTVDLG1GQUFtRjtBQUNuRixNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxDQUN0RCxRQUFpQixFQUNqQixPQUFPLEdBQUcsMkJBQTJCLEVBQzNCLEVBQUU7SUFDWixNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyw0QkFBNEIsQ0FBQztJQUMzRSxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDckQsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDdEIsT0FBTyxDQUFDLEdBQUcsT0FBTyw4QkFBOEIsT0FBTyxtQkFBbUIsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsRUFBRTtRQUN2QyxJQUFJLENBQUMsc0JBQXNCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxJQUFJLFFBQVEsK0RBQStELENBQUMsQ0FBQztRQUNyRyxDQUFDO2FBQU0sSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3BELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksUUFBUSxhQUFhLFNBQVMsRUFBRSxDQUFDLENBQUM7UUFDOUQsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsK0ZBQStGO0FBQy9GLE1BQU0sK0JBQStCLEdBQUcsQ0FDdEMsT0FBb0MsRUFDcEMsUUFBaUIsRUFDRyxFQUFFO0lBQ3RCLElBQUksT0FBTyxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ3BCLE9BQU8sc0JBQXNCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELCtFQUErRTtJQUMvRSxPQUFPLE9BQU8sRUFBRSxNQUFNLEtBQUssQ0FBQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssRUFBRSxJQUFJLE9BQU8sQ0FBQyxLQUFLLElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQztBQUMxRixDQUFDLENBQUM7QUFFRixtRkFBbUY7QUFDbkYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQU8sR0FBRyxRQUFRLEVBQVksRUFBRTtJQUNoRyxNQUFNLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM1QyxJQUFJLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3pFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztJQUN6QixJQUFJLElBQUksS0FBSyxHQUFHLElBQUksSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ3BDLE9BQU8sQ0FBQyxHQUFHLE9BQU8seUJBQXlCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekQsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssR0FBRztZQUN0QixDQUFDLENBQUMsR0FBRyxPQUFPLHFGQUFxRjtZQUNqRyxDQUFDLENBQUMsR0FBRyxPQUFPLHNGQUFzRixDQUFDLENBQUM7SUFDeEcsQ0FBQztJQUNELE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsNkJBQTZCLENBQUM7SUFDekQsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7V0FDL0QsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLEdBQUcsSUFBSSxNQUFNLElBQUksTUFBTSxDQUFDLEdBQUcsSUFBSSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQyxNQUFNLE9BQU8sTUFBTSxVQUFVLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUM3QyxTQUFrQyxFQUNsQyw0QkFBMkQsRUFDbEQsRUFBRTtJQUNYLElBQUksOEJBQThCLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN6RCxNQUFNLFNBQVMsR0FBRyw0QkFBNEIsS0FBSyxTQUFTO1FBQzFELENBQUMsQ0FBQyxFQUFFO1FBQ0osQ0FBQyxDQUFDLGdCQUFnQixDQUFDLDRCQUE0QixFQUFFLDZCQUE2QixDQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDL0csT0FBTyxPQUFPLEtBQUssSUFBSSxJQUFJLFNBQVMsS0FBSyxJQUFJLElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFO1FBQzVFLE1BQU0sTUFBTSxHQUFHLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2pELE9BQU8sTUFBTSxLQUFLLElBQUksSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDOUQsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2F0ZXdheS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZ2F0ZXdheS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDbEcsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDNUQsT0FBTyxFQUNMLGdCQUFnQixFQUNoQix1QkFBdUIsRUFDdkIsc0JBQXNCLEdBQ3ZCLE1BQU0seUJBQXlCLENBQUM7QUF5ZmpDOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN6RCxNQUFNLEVBQUUsRUFBRTtJQUNWLE1BQU0sRUFBRSxNQUFNO0lBQ2QsVUFBVSxFQUFFLEdBQUc7SUFDZiw0QkFBNEIsRUFBRSxFQUFFO0lBQ2hDLGNBQWMsRUFBRSxHQUFHO0lBQ25CLGlCQUFpQixFQUFFLEdBQUc7Q0FDdkIsQ0FBQyxDQUFDO0FBbUpILE1BQU0sb0JBQW9CLEdBQUcsd0NBQXdDLENBQUM7QUFDdEUsTUFBTSxZQUFZLEdBQUcsK0JBQStCLENBQUM7QUFFckQsb0dBQW9HO0FBQ3BHLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ2hGLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDekIsUUFBUSxDQUFDLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxpQkFBaUI7T0FDbEUsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQztPQUMvQixRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQ2hGLENBQUM7QUFFRiw2RUFBNkU7QUFDN0UsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLFdBQVcsRUFDWCxFQUFFO0lBQ1osTUFBTSxTQUFTLEdBQUcsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDL0MsSUFBSSxTQUFTLEtBQUssSUFBSSxJQUFJLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDMUUsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLEtBQUssQ0FBQztJQUM5QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLDZCQUE2QixDQUFDLGNBQWM7V0FDdkYsQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0IsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sdUJBQXVCLDZCQUE2QixDQUFDLGNBQWMsR0FBRztjQUN4RixrR0FBa0csQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxJQUFJLENBQUMsdUJBQXVCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8seURBQXlEO2NBQzNFLG9DQUFvQyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDOUUsc0JBQXNCLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDO0FBRTVDLG1GQUFtRjtBQUNuRixNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxDQUN0RCxRQUFpQixFQUNqQixPQUFPLEdBQUcsMkJBQTJCLEVBQzNCLEVBQUU7SUFDWixNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyw0QkFBNEIsQ0FBQztJQUMzRSxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDckQsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDdEIsT0FBTyxDQUFDLEdBQUcsT0FBTyw4QkFBOEIsT0FBTyxtQkFBbUIsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsRUFBRTtRQUN2QyxJQUFJLENBQUMsc0JBQXNCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxJQUFJLFFBQVEsK0RBQStELENBQUMsQ0FBQztRQUNyRyxDQUFDO2FBQU0sSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3BELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksUUFBUSxhQUFhLFNBQVMsRUFBRSxDQUFDLENBQUM7UUFDOUQsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsK0ZBQStGO0FBQy9GLE1BQU0sK0JBQStCLEdBQUcsQ0FDdEMsT0FBb0MsRUFDcEMsUUFBaUIsRUFDRyxFQUFFO0lBQ3RCLElBQUksT0FBTyxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ3BCLE9BQU8sc0JBQXNCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELCtFQUErRTtJQUMvRSxPQUFPLE9BQU8sRUFBRSxNQUFNLEtBQUssQ0FBQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssRUFBRSxJQUFJLE9BQU8sQ0FBQyxLQUFLLElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQztBQUMxRixDQUFDLENBQUM7QUFFRixtRkFBbUY7QUFDbkYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQU8sR0FBRyxRQUFRLEVBQVksRUFBRTtJQUNoRyxNQUFNLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM1QyxJQUFJLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3pFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztJQUN6QixJQUFJLElBQUksS0FBSyxHQUFHLElBQUksSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ3BDLE9BQU8sQ0FBQyxHQUFHLE9BQU8seUJBQXlCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekQsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssR0FBRztZQUN0QixDQUFDLENBQUMsR0FBRyxPQUFPLHFGQUFxRjtZQUNqRyxDQUFDLENBQUMsR0FBRyxPQUFPLHNGQUFzRixDQUFDLENBQUM7SUFDeEcsQ0FBQztJQUNELE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsNkJBQTZCLENBQUM7SUFDekQsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7V0FDL0QsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLEdBQUcsSUFBSSxNQUFNLElBQUksTUFBTSxDQUFDLEdBQUcsSUFBSSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQyxNQUFNLE9BQU8sTUFBTSxVQUFVLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUM3QyxTQUFrQyxFQUNsQyw0QkFBMkQsRUFDbEQsRUFBRTtJQUNYLElBQUksOEJBQThCLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN6RCxNQUFNLFNBQVMsR0FBRyw0QkFBNEIsS0FBSyxTQUFTO1FBQzFELENBQUMsQ0FBQyxFQUFFO1FBQ0osQ0FBQyxDQUFDLGdCQUFnQixDQUFDLDRCQUE0QixFQUFFLDZCQUE2QixDQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDL0csT0FBTyxPQUFPLEtBQUssSUFBSSxJQUFJLFNBQVMsS0FBSyxJQUFJLElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFO1FBQzVFLE1BQU0sTUFBTSxHQUFHLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2pELE9BQU8sTUFBTSxLQUFLLElBQUksSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDOUQsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMifQ==