@serve.zone/interfaces 32.59.0 → 32.61.0

package/dist_ts/data/index.d.ts

@@ -9,6 +9,7 @@ export * from './config.js';
 export * from './corestore.js';
 export * from './corestorecontroltoken.js';
 export * from './corestorelegacyadoption.js';
+export * from './delegatedadmintoken.js';
 export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
@@ -81,6 +82,7 @@ export * from './servicecredential.js';
 export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
+export * from './launchersecretowner.js';
 export * from './servicevolumeinitialization.js';
 export * from './status.js';
 export * from './taskexecution.js';

package/dist_ts/data/index.js

@@ -9,6 +9,7 @@ export * from './config.js';
 export * from './corestore.js';
 export * from './corestorecontroltoken.js';
 export * from './corestorelegacyadoption.js';
+export * from './delegatedadmintoken.js';
 export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
@@ -77,6 +78,7 @@ export * from './servicecredential.js';
 export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
+export * from './launchersecretowner.js';
 export * from './servicevolumeinitialization.js';
 export * from './status.js';
 export * from './taskexecution.js';
@@ -84,4 +86,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBR3ZDLE9BQU8sRUFBRSwwQkFBMEIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRzlELE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBRXBGLE9BQU8sRUFBRSwwQ0FBMEMsRUFBRSwwQ0FBMEMsRUFBRSxNQUFNLGtDQUFrQyxDQUFDO0FBQzFJLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywrQkFBK0IsQ0FBQztBQUM5QyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsOEJBQThCLENBQUM7QUFDN0MsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsd0JBQXdCLENBQUM7QUFHdkMsT0FBTyxFQUFFLDBCQUEwQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFHOUQsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFFcEYsT0FBTyxFQUFFLDBDQUEwQyxFQUFFLDBDQUEwQyxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFDMUksY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsZ0NBQWdDLENBQUM7QUFDL0MsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYywrQkFBK0IsQ0FBQztBQUM5QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGtDQUFrQyxDQUFDO0FBQ2pELGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==

package/dist_ts/data/launchersecretowner.d.ts

@@ -0,0 +1,60 @@
+import type { ISecretLauncherEnvironmentDelivery } from './secret.js';
+import type { IServiceRuntimeProfile, TServiceRuntimeRefusal } from './serviceruntime.js';
+/** What the owner of a workload's launcher-environment secret files derives from. */
+export interface ILauncherSecretDeliveryOwnerInput {
+    /** The runtime spec's `profile.runAs`; null runs the image's own OCI user. */
+    runAs: IServiceRuntimeProfile['runAs'];
+    /**
+     * The unresolved OCI `config.User` of the pinned digest's image config in Cloudly's canonical
+     * form (what its registry manager's `parseCanonicalImageUser` answers, never the raw registry
+     * value): `user` or `user:group`, each part a numeric identity or a name, and null for an image
+     * that states none or an empty `User`. One entry for a single-platform manifest, one per
+     * platform of a multi-platform index; never empty.
+     */
+    imageUsers: (string | null)[];
+    /**
+     * Every launcher-environment delivery the workload receives, as its caller states it. A `0o440`
+     * delivery grants the derived group, so that group has to be one the image states numerically.
+     */
+    launcherDeliveries: Pick<ISecretLauncherEnvironmentDelivery, 'variableName' | 'mode'>[];
+}
+/**
+ * The numeric owner of a workload's launcher-environment secret files, or why it derives none.
+ *
+ * `not-required` is a workload without launcher-environment deliveries: no file needs an owner, so
+ * nothing about the image refuses it.
+ *
+ * `launcher-secret-ownership-unknown` is a runtime spec that runs the image's own user
+ * (`runAs: null`) while that user's numeric owner is not known: a named user other than `root`, a
+ * numeric part above the runtime identity bound, a group-readable (`0o440`) delivery whose group
+ * the image does not state numerically, or platforms of a multi-platform index that derive
+ * different owners. `variableName` names the group-readable delivery that caused it (the first by
+ * name), null for the others; `message` states the cause.
+ */
+export type TLauncherSecretDeliveryOwner = {
+    status: 'derived';
+    uid: number;
+    gid: number;
+} | {
+    status: 'not-required';
+} | {
+    status: 'refused';
+    reason: Extract<TServiceRuntimeRefusal, 'launcher-secret-ownership-unknown'>;
+    variableName: string | null;
+    message: string;
+};
+/**
+ * The owner Cloudly gives every launcher-environment secret file of a workload, which WorkloadInit
+ * reads as the workload's own process identity before it starts the image.
+ *
+ * Without launcher deliveries it is `not-required`. A `runAs` pair wins over the image. Under
+ * `runAs: null` an image without a user runs as root (`0:0`, the runtime config's own default), a
+ * numeric `user:group` is taken as stated and `root` stands for `0` in either part. A numeric user
+ * without a group, or with a named group, is `user:0` while every delivery is owner-readable
+ * (`0o400`), which grants the group nothing; a `0o440` delivery would grant it, so it refuses and
+ * names that delivery. A named user, or a numeric part above the runtime identity bound, refuses.
+ * Every platform of a multi-platform index must derive
+ * the same owner, or it refuses: a workload gets one delivery, never one per platform. Nothing is
+ * guessed. A structurally malformed input throws, whatever it would answer.
+ */
+export declare const deriveLauncherSecretDeliveryOwner: (inputArg: ILauncherSecretDeliveryOwnerInput) => TLauncherSecretDeliveryOwner;

package/dist_ts/data/launchersecretowner.js

@@ -0,0 +1,94 @@
+import { hasExactKeys, isPlainRecord } from '../private/dataproperties.js';
+import { isRuntimeIdentityNumber, runtimePolicyLimits } from '../private/runtimepolicy.js';
+const imageUserPartPattern = /^[^:\u0000-\u001f\u007f]+$/;
+const imageUserPart = (partArg) => {
+    if (partArg === 'root')
+        return 0;
+    if (!/^[0-9]+$/.test(partArg))
+        return 'named';
+    const identity = Number(partArg);
+    return isRuntimeIdentityNumber(identity) ? identity : 'unbounded';
+};
+/** One platform's user and group; an absent group is `undefined`. A malformed image user throws. */
+const imageUserParts = (imageUserArg) => {
+    if (imageUserArg === null)
+        return { user: 0, group: 0 };
+    const parts = typeof imageUserArg === 'string' ? imageUserArg.split(':') : [];
+    if (parts.length === 0 || parts.length > 2 || !parts.every((partArg) => imageUserPartPattern.test(partArg))) {
+        throw new Error('image user must be null, user or user:group');
+    }
+    return { user: imageUserPart(parts[0]), group: parts[1] === undefined ? undefined : imageUserPart(parts[1]) };
+};
+/** The names of the group-readable (`0o440`) deliveries, sorted; a malformed delivery throws. */
+const groupReadableVariableNames = (deliveriesArg) => {
+    if (!Array.isArray(deliveriesArg))
+        throw new Error('launcherDeliveries must list the launcher deliveries');
+    const names = [];
+    for (const delivery of deliveriesArg) {
+        if (!isPlainRecord(delivery) || typeof delivery.variableName !== 'string' || delivery.variableName === ''
+            || (delivery.mode !== 0o400 && delivery.mode !== 0o440)) {
+            throw new Error('a launcher delivery must state its variableName and a 0400 or 0440 mode');
+        }
+        if (delivery.mode === 0o440)
+            names.push(delivery.variableName);
+    }
+    return names.sort();
+};
+const refusal = (variableNameArg, messageArg) => ({
+    status: 'refused', reason: 'launcher-secret-ownership-unknown', variableName: variableNameArg, message: messageArg,
+});
+/**
+ * The owner Cloudly gives every launcher-environment secret file of a workload, which WorkloadInit
+ * reads as the workload's own process identity before it starts the image.
+ *
+ * Without launcher deliveries it is `not-required`. A `runAs` pair wins over the image. Under
+ * `runAs: null` an image without a user runs as root (`0:0`, the runtime config's own default), a
+ * numeric `user:group` is taken as stated and `root` stands for `0` in either part. A numeric user
+ * without a group, or with a named group, is `user:0` while every delivery is owner-readable
+ * (`0o400`), which grants the group nothing; a `0o440` delivery would grant it, so it refuses and
+ * names that delivery. A named user, or a numeric part above the runtime identity bound, refuses.
+ * Every platform of a multi-platform index must derive
+ * the same owner, or it refuses: a workload gets one delivery, never one per platform. Nothing is
+ * guessed. A structurally malformed input throws, whatever it would answer.
+ */
+export const deriveLauncherSecretDeliveryOwner = (inputArg) => {
+    const { runAs, imageUsers, launcherDeliveries } = inputArg;
+    if (runAs !== null && !(isPlainRecord(runAs) && hasExactKeys(runAs, ['user', 'group'])
+        && isRuntimeIdentityNumber(runAs.user) && isRuntimeIdentityNumber(runAs.group))) {
+        throw new Error('runAs must be null or an exact user and group');
+    }
+    if (!Array.isArray(imageUsers) || imageUsers.length === 0) {
+        throw new Error('imageUsers must name the user of every platform');
+    }
+    const platforms = imageUsers.map(imageUserParts);
+    const groupReadable = groupReadableVariableNames(launcherDeliveries);
+    if (launcherDeliveries.length === 0)
+        return { status: 'not-required' };
+    if (runAs !== null)
+        return { status: 'derived', uid: runAs.user, gid: runAs.group };
+    const userOf = (predicateArg) => (imageUsers.find((_imageUserArg, indexArg) => predicateArg(platforms[indexArg])));
+    const unbounded = userOf((platformArg) => platformArg.user === 'unbounded' || platformArg.group === 'unbounded');
+    if (unbounded !== undefined) {
+        return refusal(null, `image user '${unbounded}' states an identity above `
+            + `${runtimePolicyLimits.maximumIdentityNumber}`);
+    }
+    const namedUser = userOf((platformArg) => platformArg.user === 'named');
+    if (namedUser !== undefined) {
+        return refusal(null, `image user '${namedUser}' names a user only the image's root filesystem resolves`);
+    }
+    const ungrouped = userOf((platformArg) => typeof platformArg.group !== 'number');
+    if (ungrouped !== undefined && groupReadable.length > 0) {
+        return refusal(groupReadable[0], `launcher-environment secret ${groupReadable.join(', ')} is group-readable `
+            + `(0440), but image user '${ungrouped}' states no numeric group`);
+    }
+    // Every part is now a bounded number, or a group that an owner-readable file does not grant.
+    const [first, ...rest] = platforms.map((platformArg) => ({
+        uid: platformArg.user, gid: typeof platformArg.group === 'number' ? platformArg.group : 0,
+    }));
+    if (rest.some((ownerArg) => ownerArg.uid !== first.uid || ownerArg.gid !== first.gid)) {
+        const users = imageUsers.map((userArg) => userArg === null ? 'none' : `'${userArg}'`).join(', ');
+        return refusal(null, `the platforms' image users ${users} derive different owners`);
+    }
+    return { status: 'derived', uid: first.uid, gid: first.gid };
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGF1bmNoZXJzZWNyZXRvd25lci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvbGF1bmNoZXJzZWNyZXRvd25lci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzNFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxtQkFBbUIsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBNEMzRixNQUFNLG9CQUFvQixHQUFHLDRCQUE0QixDQUFDO0FBUTFELE1BQU0sYUFBYSxHQUFHLENBQUMsT0FBZSxFQUFrQixFQUFFO0lBQ3hELElBQUksT0FBTyxLQUFLLE1BQU07UUFBRSxPQUFPLENBQUMsQ0FBQztJQUNqQyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUM7UUFBRSxPQUFPLE9BQU8sQ0FBQztJQUM5QyxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDakMsT0FBTyx1QkFBdUIsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUM7QUFDcEUsQ0FBQyxDQUFDO0FBRUYsb0dBQW9HO0FBQ3BHLE1BQU0sY0FBYyxHQUFHLENBQUMsWUFBcUIsRUFBK0QsRUFBRTtJQUM1RyxJQUFJLFlBQVksS0FBSyxJQUFJO1FBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxDQUFDO0lBQ3hELE1BQU0sS0FBSyxHQUFHLE9BQU8sWUFBWSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQzlFLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzVHLE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsT0FBTyxFQUFFLElBQUksRUFBRSxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7QUFDaEgsQ0FBQyxDQUFDO0FBRUYsaUdBQWlHO0FBQ2pHLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxhQUFzQixFQUFZLEVBQUU7SUFDdEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0lBQzNHLE1BQU0sS0FBSyxHQUFhLEVBQUUsQ0FBQztJQUMzQixLQUFLLE1BQU0sUUFBUSxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxRQUFRLENBQUMsWUFBWSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsWUFBWSxLQUFLLEVBQUU7ZUFDcEcsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDMUQsTUFBTSxJQUFJLEtBQUssQ0FBQyx5RUFBeUUsQ0FBQyxDQUFDO1FBQzdGLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssS0FBSztZQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxPQUFPLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztBQUN0QixDQUFDLENBQUM7QUFFRixNQUFNLE9BQU8sR0FBRyxDQUFDLGVBQThCLEVBQUUsVUFBa0IsRUFBZ0MsRUFBRSxDQUFDLENBQUM7SUFDckcsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsbUNBQW1DLEVBQUUsWUFBWSxFQUFFLGVBQWUsRUFBRSxPQUFPLEVBQUUsVUFBVTtDQUNuSCxDQUFDLENBQUM7QUFFSDs7Ozs7Ozs7Ozs7OztHQWFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FDL0MsUUFBMkMsRUFDYixFQUFFO0lBQ2hDLE1BQU0sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLGtCQUFrQixFQUFFLEdBQUcsUUFBUSxDQUFDO0lBQzNELElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLFlBQVksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7V0FDakYsdUJBQXVCLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDbEYsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzFELE1BQU0sSUFBSSxLQUFLLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUNqRCxNQUFNLGFBQWEsR0FBRywwQkFBMEIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQ3JFLElBQUksa0JBQWtCLENBQUMsTUFBTSxLQUFLLENBQUM7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxDQUFDO0lBQ3ZFLElBQUksS0FBSyxLQUFLLElBQUk7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLElBQUksRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3BGLE1BQU0sTUFBTSxHQUFHLENBQUMsWUFBZ0UsRUFBNkIsRUFBRSxDQUFDLENBQzlHLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxhQUFhLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ25GLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLElBQUksS0FBSyxXQUFXLElBQUksV0FBVyxDQUFDLEtBQUssS0FBSyxXQUFXLENBQUMsQ0FBQztJQUNqSCxJQUFJLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM1QixPQUFPLE9BQU8sQ0FBQyxJQUFJLEVBQUUsZUFBZSxTQUFTLDZCQUE2QjtjQUN0RSxHQUFHLG1CQUFtQixDQUFDLHFCQUFxQixFQUFFLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxDQUFDO0lBQ3hFLElBQUksU0FBUyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzVCLE9BQU8sT0FBTyxDQUFDLElBQUksRUFBRSxlQUFlLFNBQVMsMERBQTBELENBQUMsQ0FBQztJQUMzRyxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxPQUFPLFdBQVcsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDakYsSUFBSSxTQUFTLEtBQUssU0FBUyxJQUFJLGFBQWEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEQsT0FBTyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLCtCQUErQixhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxxQkFBcUI7Y0FDekcsMkJBQTJCLFNBQVMsMkJBQTJCLENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsNkZBQTZGO0lBQzdGLE1BQU0sQ0FBQyxLQUFLLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZELEdBQUcsRUFBRSxXQUFXLENBQUMsSUFBYyxFQUFFLEdBQUcsRUFBRSxPQUFPLFdBQVcsQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0tBQ3BHLENBQUMsQ0FBQyxDQUFDO0lBQ0osSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsR0FBRyxLQUFLLEtBQUssQ0FBQyxHQUFHLElBQUksUUFBUSxDQUFDLEdBQUcsS0FBSyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0RixNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDakcsT0FBTyxPQUFPLENBQUMsSUFBSSxFQUFFLDhCQUE4QixLQUFLLDBCQUEwQixDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUM7QUFDL0QsQ0FBQyxDQUFDIn0=

package/dist_ts/data/secret.d.ts

@@ -151,7 +151,32 @@ export interface ISecretSetConsumerRolloutStatus {
     errorCode?: string;
     updatedAt: number;
 }
+/**
+ * A launcher-environment delivery as a caller states it: on a Secret's `defaultDelivery`, a
+ * SecretSet attachment override, a create request or an App Store declaration. The owner of the
+ * file WorkloadInit reads is not the caller's to state; the resolver derives it.
+ */
 export interface ISecretLauncherEnvironmentDelivery {
+    type: 'launcher-environment';
+    variableName: string;
+    /**
+     * @deprecated Derived by the resolver from the workload identity
+     * (`deriveLauncherSecretDeliveryOwner`); ignored; removed in the next major.
+     */
+    uid?: number;
+    /**
+     * @deprecated Derived by the resolver from the workload identity
+     * (`deriveLauncherSecretDeliveryOwner`); ignored; removed in the next major.
+     */
+    gid?: number;
+    mode: 0o400 | 0o440;
+}
+/**
+ * A launcher-environment delivery of a resolved secret manifest. `uid` and `gid` are the owner the
+ * resolver derived from the workload identity (`deriveLauncherSecretDeliveryOwner`), written by
+ * `createResolvedSecretDelivery`; the node mounts the file with them.
+ */
+export interface ISecretResolvedLauncherEnvironmentDelivery {
     type: 'launcher-environment';
     variableName: string;
     uid: number;
@@ -165,7 +190,33 @@ export interface ISecretFileDelivery {
     gid: number;
     mode: 0o400 | 0o440;
 }
+/** A delivery as a caller states it. */
 export type TSecretDelivery = ISecretLauncherEnvironmentDelivery | ISecretFileDelivery;
+/** A delivery of a resolved secret manifest: every owner is stated. */
+export type TSecretResolvedDelivery = ISecretResolvedLauncherEnvironmentDelivery | ISecretFileDelivery;
+/**
+ * Prefixes of the names the platform injects into a workload itself (`SERVEZONE_*`): a secret of
+ * such a name would replace what the platform delivers.
+ */
+export declare const platformReservedSecretKeyPrefixes: readonly ["SERVEZONE_"];
+/**
+ * Prefixes of the names a loader, language runtime, package manager or library reads to change
+ * what a process loads, runs or trusts (`LD_PRELOAD`, `NODE_OPTIONS`, `PYTHONPATH`, `OPENSSL_CONF`,
+ * `DOTNET_STARTUP_HOOKS`, `NPM_CONFIG_REGISTRY`, …). Matched as plain prefixes, so `PYTHON`, `PERL`,
+ * `RUBY` and `PHP` cover every name that starts with them.
+ */
+export declare const runtimeInjectionSecretKeyPrefixes: readonly ["LD_", "DYLD_", "NODE_", "DENO_", "BUN_", "PYTHON", "PERL", "RUBY", "PHP", "JAVA_", "JDK_", "_JAVA_", "DOTNET_", "CORECLR_", "LUA_", "GEM_", "BUNDLE_", "NPM_CONFIG_", "PIP_", "GLIBC_", "MALLOC_", "GCONV_", "OPENSSL_", "SSL_", "CURL_", "REQUESTS_", "GIT_"];
+/**
+ * Exact names a shell, loader, runtime or HTTP client reads to change where a process looks,
+ * connects or what it trusts or records (`CLASSPATH`, `AWS_CA_BUNDLE`, `SSLKEYLOGFILE`).
+ */
+export declare const runtimeInjectionSecretKeys: readonly ["PATH", "HOME", "SHELL", "ENV", "BASH_ENV", "IFS", "TMPDIR", "LOCPATH", "NLSPATH", "CLASSPATH", "HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY", "FTP_PROXY", "AWS_CA_BUNDLE", "SSLKEYLOGFILE"];
+/**
+ * Whether a secret key, or a name a secret is delivered under, is reserved: one of
+ * `runtimeInjectionSecretKeys`, or starting with an entry of `platformReservedSecretKeyPrefixes`
+ * or `runtimeInjectionSecretKeyPrefixes`. A delegated administrator token never writes such a name.
+ */
+export declare const isReservedSecretKey: (keyArg: string) => boolean;
 export declare const secretValueLimits: Readonly<{
     maximumBytes: number;
     minimumGeneratedBytes: 16;
@@ -211,7 +262,7 @@ export interface IResolvedSecretManifestEntry {
     key: string;
     environment: TSecretEnvironment;
     owner: TWorkloadSecretOwner;
-    delivery: TSecretDelivery;
+    delivery: TSecretResolvedDelivery;
 }
 /** Immutable, value-free runtime snapshot. */
 export interface IResolvedSecretManifest {
@@ -272,7 +323,22 @@ export declare const verifySecretVersionPurgeIntentDigest: (intentArg: ISecretVe
 export declare const validateSecretVersionPurgeOperation: (operationArg: unknown) => Promise<string[]>;
 export declare const validateSecretOwner: (ownerArg: unknown) => string[];
 export declare const validateSecretManagementScope: (sourceArg: TSecretManagementSource, scopeArg: unknown) => string[];
+/**
+ * Validates a delivery as a caller states it. A launcher delivery should state no owner; one that
+ * states the deprecated `uid` and `gid` (both, bounded) is tolerated until the next major.
+ */
 export declare const validateSecretDelivery: (deliveryArg: unknown) => string[];
+/** Validates a resolved manifest's delivery: a launcher delivery states its derived owner. */
+export declare const validateSecretResolvedDelivery: (deliveryArg: unknown) => string[];
+/**
+ * The resolved manifest delivery of a caller's delivery: a launcher delivery takes the owner the
+ * resolver derived (`deriveLauncherSecretDeliveryOwner`) and drops any deprecated owner the caller
+ * stated; a file delivery keeps its own.
+ */
+export declare const createResolvedSecretDelivery: (deliveryArg: TSecretDelivery, ownerArg: {
+    uid: number;
+    gid: number;
+}) => TSecretResolvedDelivery;
 export declare const validateSecretMetadata: (secretArg: unknown) => string[];
 export declare const validateSecretValueInput: (valueInputArg: unknown) => string[];
 /** Checks the SmartCrypto context digest without opening or decrypting the envelope. */