@serve.zone/interfaces 32.60.0 → 32.61.0

package/.smartconfig.json

@@ -47,8 +47,10 @@
       }
     }
   },
-  "@git.zone/tsdoc": {
-    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license.md](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+  "@git.zone/tsrepo": {
+    "docs": {
+      "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license.md](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+    }
   },
   "@ship.zone/szci": {}
 }

package/changelog.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2026-10-21 - 32.61.0
+
+### Features
+
+- Delegated admin temp tokens (`data.delegatedAdminTokenContract`): a human administrator who signed in within five minutes mints a token for explicit scopes, which lives one hour by default and at most one hour (`defaultLifetimeMs`, `maximumLifetimeMs`, `minimumLifetimeMs` one minute) and is never extended. `delegatedAdminTokenScopes` is the allowlist (`secrets`, `serviceCredentials`) and `delegatedAdminTokenScopeRequests` names exactly the wire methods each admits (typed as `TDelegatedAdminTokenScopeRequest`, judged by `isDelegatedAdminTokenScopeRequest`): `secrets` the operator-managed secret lifecycle (`getSecretIngressRecipient`, `listSecrets`, `getSecretMetadata`, `createSecret`, `rotateSecret`, `changeSecretLifecycle` with the actions `delegatedAdminTokenSecretLifecycleActions` names, `retire` and `revoke` of a granted key, never `delete`), `serviceCredentials` the service platform credential (`getServiceMachineCredential`, `mutateServiceMachineCredential`). A mint may grant `secretKeyPrefixes` (only with `secrets`, at most `maximumSecretKeyPrefixes` 16, each `isDelegatableSecretKeyPrefix`: `^[A-Z][A-Z0-9]*_$` and overlapping no reserved name either way, so a granted prefix is application-specific such as `GITSYNC_`, and `GIT_`, `NPM_` or `AWS_` are refused), under which alone the token creates, rotates, retires and revokes secrets (`isDelegatedSecretKey`); a token without prefixes does none of these. A token creates a secret only as a launcher-environment variable, never as a file. New requests `requests.admin.IReq_Admin_MintDelegatedAdminToken` (`mintDelegatedAdminToken`: `IDelegatedAdminTokenMint`, i.e. `scopes`, optional `lifetimeMs` and `secretKeyPrefixes`; answers the token once with its metadata), `IReq_Admin_GetDelegatedAdminTokens` (`getDelegatedAdminTokens`: the active tokens, value-free, newest first, at most `maximumListedTokens`, with `truncated`) and `IReq_Admin_RevokeDelegatedAdminToken` (`revokeDelegatedAdminToken`: by `tokenId`, any administrator), with value-free `IDelegatedAdminTokenMetadata` (scopes and `secretKeyPrefixes` included), refusals `delegatedAdminTokenRefusals` as `IDelegatedAdminTokenErrorData`, the exact token form `delegatedAdminToken_<tokenId>_<secret>` (`isDelegatedAdminToken`, `isDelegatedAdminTokenId`, `isDelegatedAdminTokenLifetime`) and exact-key snapshots (`snapshotDelegatedAdminTokenMint`, `snapshotDelegatedAdminTokenMetadata`, `snapshotDelegatedAdminTokenMintResult`). `getIdentityByToken` documents the session a token is exchanged for (`type: 'machine'`, `role: 'api'`, `userId: 'delegated-admin-token:<tokenId>'`). Specs: `test.delegatedadmintoken` (lifetime cap and token form, the scope and request lists and the delegated lifecycle actions, canonical scopes and exact keys, the token answered only by a mint, metadata without any value and with whole revocation, reserved names, grantable prefixes and delegated keys, named refusals).
+- Reserved secret names (`data.secret`): `platformReservedSecretKeyPrefixes` (`SERVEZONE_`, the names the platform injects), `runtimeInjectionSecretKeyPrefixes` (`LD_`, `DYLD_`, `NODE_`, `DENO_`, `BUN_`, `PYTHON`, `PERL`, `RUBY`, `PHP`, `JAVA_`, `JDK_`, `_JAVA_`, `DOTNET_`, `CORECLR_`, `LUA_`, `GEM_`, `BUNDLE_`, `NPM_CONFIG_`, `PIP_`, `GLIBC_`, `MALLOC_`, `GCONV_`, `OPENSSL_`, `SSL_`, `CURL_`, `REQUESTS_`, `GIT_`), `runtimeInjectionSecretKeys` (`PATH`, `HOME`, `SHELL`, `ENV`, `BASH_ENV`, `IFS`, `TMPDIR`, `LOCPATH`, `NLSPATH`, `CLASSPATH`, `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, `NO_PROXY`, `FTP_PROXY`, `AWS_CA_BUNDLE`, `SSLKEYLOGFILE`) and `isReservedSecretKey`. A delegated admin token never writes, retires or revokes such a name; human administrators are not restricted by them yet. The existing key pattern (`^[A-Z_][A-Z0-9_]{0,252}$`) admits a leading underscore, so `_JAVA_*` names exist and are covered.
+
+### Fixes
+
+- Gateway route DNS no longer claims manual records (AGL-523): the `reconcile` mode documentation (`data.TGatewayRouteDnsMode`) now says a gateway creates, updates and deletes only the exact-host A or AAAA record its route ownership holds and never adopts, replaces or deletes a record without gateway DNS ownership. Manual records satisfy a route only when no record at the name is owned and every manual A or AAAA record there matches the desired type, value and proxied flag; a differing record, any CNAME, owned and manual records together, or an operator-protected hostname is a non-retryable `record-conflict` with no mutation. While another enabled route on the gateway still serves the hostname, a withdrawn route releases its record to manual ownership instead of deleting it. `data.TGatewayRouteDnsStatus` gains `manual-satisfied` (every manual record matches; the gateway changes and claims nothing and reports them with `managed: false`) and `managed-released` (the record was released instead of deleted and is reported with `managed: false`); `managed-overwrote-manual`, `managed-orphan-deleted` and `IGatewayRouteDnsResult.overwrittenRecords` are deprecated, as no gateway reports them.
+
+### Maintenance
+
+- Release tooling: `@git.zone/tsrepo` ^1.1.1 replaces tsbuild, tstest, tsrun and tsdoc (deprecated in its favour): the scripts call `tsrepo build tsfolders`, `tsrepo test` and `tsrepo docs`, the specs import `@git.zone/tsrepo/tapbundle`, and the `.smartconfig.json` section `@git.zone/tsdoc` moved to `"@git.zone/tsrepo"` `docs`. `@types/node` 26.6.5 and pnpm 12.13.0 are current.
+
 ## 2026-10-20 - 32.60.0
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.60.0',
+    version: '32.61.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/delegatedadmintoken.d.ts

@@ -0,0 +1,142 @@
+/**
+ * A delegated administrator token (a "temp token") hands an agent a narrow, short-lived slice of
+ * one human administrator's authority, without the administrator's password or session.
+ *
+ * - Only a human administrator who signed in within five minutes mints one
+ *   (`mintDelegatedAdminToken`), for scopes named explicitly from `delegatedAdminTokenScopes`.
+ *   The plaintext token is answered exactly once; Cloudly stores only its hash.
+ * - It is exchanged with `getIdentityByToken` for a session that only the requests of its scopes
+ *   (`delegatedAdminTokenScopeRequests`) admit. Every such request re-reads the token, so the
+ *   session carries no validity of its own, and acts as `<administrator> via temp token <id>`.
+ * - It ends at its expiry, at most `maximumLifetimeMs` after the mint and never extended; when any
+ *   administrator revokes it; or when the minting administrator's credential generation changes.
+ * - A delegated session never mints, lists or revokes tokens, and no scope reaches users, roles,
+ *   human credentials, deployment tokens, authority records or organization membership.
+ */
+export declare const delegatedAdminTokenContract: Readonly<{
+    /** The lifetime a mint that names none receives. */
+    defaultLifetimeMs: number;
+    /** The hard cap: a token lives at most one hour from its mint and is never extended. */
+    maximumLifetimeMs: number;
+    minimumLifetimeMs: number;
+    /** Every token is `delegatedAdminToken_<tokenId>_<secret>`, both parts 64 lowercase hex. */
+    tokenPrefix: "delegatedAdminToken_";
+    /** Tokens one listing reports at most, newest first; a listing that leaves any out says so. */
+    maximumListedTokens: 256;
+    /** Secret key prefixes one token is granted at most. */
+    maximumSecretKeyPrefixes: 16;
+}>;
+/**
+ * What a token may be minted for. Each scope admits exactly the requests
+ * `delegatedAdminTokenScopeRequests` names for it, and nothing else does.
+ *
+ * - `secrets`: the operator-managed secrets of services and SecretSets: list and read their
+ *   metadata and read the ingress recipient a value is sealed to; create, rotate, retire and revoke
+ *   those whose key starts with a prefix the token was granted (`secretKeyPrefixes`, see
+ *   `isDelegatedSecretKey`; `changeSecretLifecycle` only with the actions
+ *   `delegatedAdminTokenSecretLifecycleActions` names, never `delete`). A token creates a secret
+ *   only as a launcher-environment variable, never as a file. A token minted without prefixes
+ *   creates, rotates, retires and revokes nothing.
+ * - `serviceCredentials`: a service's platform credential (`SERVEZONE_PLATFORM_AUTHORIZATION`):
+ *   inspect, ensure, rotate and revoke it.
+ */
+export declare const delegatedAdminTokenScopes: readonly ['secrets', 'serviceCredentials'];
+export type TDelegatedAdminTokenScope = typeof delegatedAdminTokenScopes[number];
+/** The exact requests each scope admits a delegated session on, by their wire method names. */
+export declare const delegatedAdminTokenScopeRequests: Readonly<{
+    secrets: readonly ["getSecretIngressRecipient", "listSecrets", "getSecretMetadata", "createSecret", "rotateSecret", "changeSecretLifecycle"];
+    serviceCredentials: readonly ["getServiceMachineCredential", "mutateServiceMachineCredential"];
+}>;
+/** A request one scope admits, by its wire method name. */
+export type TDelegatedAdminTokenScopeRequest<TScope extends TDelegatedAdminTokenScope = TDelegatedAdminTokenScope> = (typeof delegatedAdminTokenScopeRequests)[TScope][number];
+/** Whether `scopeArg` admits the request a wire method names. */
+export declare const isDelegatedAdminTokenScopeRequest: <TScope extends TDelegatedAdminTokenScope>(scopeArg: TScope, methodArg: unknown) => methodArg is TDelegatedAdminTokenScopeRequest<TScope>;
+/**
+ * The `changeSecretLifecycle` actions the `secrets` scope delegates, each only for a secret whose key
+ * the token's grant covers (`isDelegatedSecretKey`). Deleting a secret stays with a human
+ * administrator: a delegated session asking for it is refused like a request outside its scope.
+ */
+export declare const delegatedAdminTokenSecretLifecycleActions: readonly ["retire", "revoke"];
+/** One token, value-free. Neither the token nor its hash is ever part of it. */
+export interface IDelegatedAdminTokenMetadata {
+    /** 64 lowercase hex; the part of the token that names it. */
+    tokenId: string;
+    /** The human administrator who minted the token and whom every use acts for. */
+    userId: string;
+    /** Distinct, in `delegatedAdminTokenScopes` order. */
+    scopes: TDelegatedAdminTokenScope[];
+    /**
+     * The secret key prefixes the token creates, rotates, retires and revokes secrets under, sorted
+     * and distinct; empty when it was granted none. Only a token with the `secrets` scope carries any.
+     */
+    secretKeyPrefixes: string[];
+    createdAt: number;
+    expiresAt: number;
+    /** When an administrator revoked the token; `null` while it was never revoked. */
+    revokedAt: number | null;
+    /** The administrator who revoked it; `null` exactly when `revokedAt` is. */
+    revokedBy: string | null;
+}
+/** What a mint states besides the administrator's identity. */
+export interface IDelegatedAdminTokenMint {
+    scopes: TDelegatedAdminTokenScope[];
+    /** Absent: `defaultLifetimeMs`. Otherwise within `minimumLifetimeMs` and `maximumLifetimeMs`. */
+    lifetimeMs?: number;
+    /**
+     * The secret key prefixes the token may create, rotate, retire and revoke secrets under, each
+     * `isDelegatableSecretKeyPrefix`, distinct, at most `maximumSecretKeyPrefixes`; only with the
+     * `secrets` scope. Prefixes must be application-specific (`GITSYNC_`): a prefix that overlaps a
+     * reserved name is refused. Absent or empty: the token creates, rotates, retires and revokes
+     * nothing.
+     */
+    secretKeyPrefixes?: string[];
+}
+export interface IDelegatedAdminTokenMintResult {
+    /** The plaintext token, answered on this answer only; Cloudly keeps only its hash. */
+    token: string;
+    metadata: IDelegatedAdminTokenMetadata;
+}
+/**
+ * Every refusal the token requests name, as `IDelegatedAdminTokenErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: a mint by anyone but a human administrator who signed in
+ *   within five minutes, or a listing or revocation by anyone but an administrator. A delegated
+ *   session is refused here on every request.
+ * - `DELEGATED_ADMIN_TOKEN_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DELEGATED_ADMIN_TOKEN_NOT_FOUND`: no token has that id.
+ * - `DELEGATED_ADMIN_TOKEN_INACTIVE`: the token already ended: it expired, was revoked, or its
+ *   administrator is no longer a human administrator at the credential generation it was minted
+ *   under.
+ */
+export declare const delegatedAdminTokenRefusals: readonly ['ADMIN_AUTHORIZATION_REQUIRED', 'DELEGATED_ADMIN_TOKEN_REQUEST_INVALID', 'DELEGATED_ADMIN_TOKEN_NOT_FOUND', 'DELEGATED_ADMIN_TOKEN_INACTIVE'];
+export type TDelegatedAdminTokenRefusal = typeof delegatedAdminTokenRefusals[number];
+export interface IDelegatedAdminTokenErrorData {
+    code: TDelegatedAdminTokenRefusal;
+    retryable: false;
+}
+/** Whether a value is a delegated admin token in its exact form; it proves nothing else. */
+export declare const isDelegatedAdminToken: (value: unknown) => value is string;
+/** Whether a value names a token: 64 lowercase hex. */
+export declare const isDelegatedAdminTokenId: (value: unknown) => value is string;
+/**
+ * Whether a prefix may be granted: `^[A-Z][A-Z0-9]*_$`, and overlapping no reserved name in
+ * either direction: it neither starts with nor is the start of an entry of
+ * `platformReservedSecretKeyPrefixes` or `runtimeInjectionSecretKeyPrefixes`, and no entry of
+ * `runtimeInjectionSecretKeys` starts with it. So a granted prefix is application-specific:
+ * `GIT_`, `NODE_`, `NPM_` and `AWS_` (`AWS_CA_BUNDLE`) are refused; `GITSYNC_` is not.
+ */
+export declare const isDelegatableSecretKeyPrefix: (value: unknown) => value is string;
+/**
+ * Whether a token granted `prefixesArg` creates, rotates, retires or revokes a secret of key
+ * `keyArg`, or delivers a launcher variable of that name: the key starts with a granted prefix and
+ * is not reserved (`isReservedSecretKey`).
+ */
+export declare const isDelegatedSecretKey: (prefixesArg: readonly string[], keyArg: string) => boolean;
+/** Whether a lifetime is one a mint may state. */
+export declare const isDelegatedAdminTokenLifetime: (value: unknown) => value is number;
+/** Structural copy of a mint; the backend authorizes the administrator and enforces the cap. */
+export declare const snapshotDelegatedAdminTokenMint: (value: unknown) => IDelegatedAdminTokenMint;
+/** Structural copy of listed or answered metadata. */
+export declare const snapshotDelegatedAdminTokenMetadata: (value: unknown) => IDelegatedAdminTokenMetadata;
+/** Structural copy of a mint's answer: a token in its exact form and the metadata that names it. */
+export declare const snapshotDelegatedAdminTokenMintResult: (value: unknown) => IDelegatedAdminTokenMintResult;

package/dist_ts/data/delegatedadmintoken.js

@@ -0,0 +1,197 @@
+import { readDataElements, readDataProperty, readExactDataRecord } from '../private/dataproperties.js';
+import { isReservedSecretKey, platformReservedSecretKeyPrefixes, runtimeInjectionSecretKeyPrefixes, runtimeInjectionSecretKeys, } from './secret.js';
+/**
+ * A delegated administrator token (a "temp token") hands an agent a narrow, short-lived slice of
+ * one human administrator's authority, without the administrator's password or session.
+ *
+ * - Only a human administrator who signed in within five minutes mints one
+ *   (`mintDelegatedAdminToken`), for scopes named explicitly from `delegatedAdminTokenScopes`.
+ *   The plaintext token is answered exactly once; Cloudly stores only its hash.
+ * - It is exchanged with `getIdentityByToken` for a session that only the requests of its scopes
+ *   (`delegatedAdminTokenScopeRequests`) admit. Every such request re-reads the token, so the
+ *   session carries no validity of its own, and acts as `<administrator> via temp token <id>`.
+ * - It ends at its expiry, at most `maximumLifetimeMs` after the mint and never extended; when any
+ *   administrator revokes it; or when the minting administrator's credential generation changes.
+ * - A delegated session never mints, lists or revokes tokens, and no scope reaches users, roles,
+ *   human credentials, deployment tokens, authority records or organization membership.
+ */
+export const delegatedAdminTokenContract = Object.freeze({
+    /** The lifetime a mint that names none receives. */
+    defaultLifetimeMs: 60 * 60 * 1000,
+    /** The hard cap: a token lives at most one hour from its mint and is never extended. */
+    maximumLifetimeMs: 60 * 60 * 1000,
+    minimumLifetimeMs: 60 * 1000,
+    /** Every token is `delegatedAdminToken_<tokenId>_<secret>`, both parts 64 lowercase hex. */
+    tokenPrefix: 'delegatedAdminToken_',
+    /** Tokens one listing reports at most, newest first; a listing that leaves any out says so. */
+    maximumListedTokens: 256,
+    /** Secret key prefixes one token is granted at most. */
+    maximumSecretKeyPrefixes: 16,
+});
+/**
+ * What a token may be minted for. Each scope admits exactly the requests
+ * `delegatedAdminTokenScopeRequests` names for it, and nothing else does.
+ *
+ * - `secrets`: the operator-managed secrets of services and SecretSets: list and read their
+ *   metadata and read the ingress recipient a value is sealed to; create, rotate, retire and revoke
+ *   those whose key starts with a prefix the token was granted (`secretKeyPrefixes`, see
+ *   `isDelegatedSecretKey`; `changeSecretLifecycle` only with the actions
+ *   `delegatedAdminTokenSecretLifecycleActions` names, never `delete`). A token creates a secret
+ *   only as a launcher-environment variable, never as a file. A token minted without prefixes
+ *   creates, rotates, retires and revokes nothing.
+ * - `serviceCredentials`: a service's platform credential (`SERVEZONE_PLATFORM_AUTHORIZATION`):
+ *   inspect, ensure, rotate and revoke it.
+ */
+export const delegatedAdminTokenScopes = ['secrets', 'serviceCredentials'];
+/** The exact requests each scope admits a delegated session on, by their wire method names. */
+export const delegatedAdminTokenScopeRequests = Object.freeze({
+    secrets: Object.freeze([
+        'getSecretIngressRecipient', 'listSecrets', 'getSecretMetadata', 'createSecret', 'rotateSecret',
+        'changeSecretLifecycle',
+    ]),
+    serviceCredentials: Object.freeze(['getServiceMachineCredential', 'mutateServiceMachineCredential']),
+});
+/** Whether `scopeArg` admits the request a wire method names. */
+export const isDelegatedAdminTokenScopeRequest = (scopeArg, methodArg) => (delegatedAdminTokenScopeRequests[scopeArg].includes(methodArg));
+/**
+ * The `changeSecretLifecycle` actions the `secrets` scope delegates, each only for a secret whose key
+ * the token's grant covers (`isDelegatedSecretKey`). Deleting a secret stays with a human
+ * administrator: a delegated session asking for it is refused like a request outside its scope.
+ */
+export const delegatedAdminTokenSecretLifecycleActions = Object.freeze(['retire', 'revoke']);
+/**
+ * Every refusal the token requests name, as `IDelegatedAdminTokenErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: a mint by anyone but a human administrator who signed in
+ *   within five minutes, or a listing or revocation by anyone but an administrator. A delegated
+ *   session is refused here on every request.
+ * - `DELEGATED_ADMIN_TOKEN_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DELEGATED_ADMIN_TOKEN_NOT_FOUND`: no token has that id.
+ * - `DELEGATED_ADMIN_TOKEN_INACTIVE`: the token already ended: it expired, was revoked, or its
+ *   administrator is no longer a human administrator at the credential generation it was minted
+ *   under.
+ */
+export const delegatedAdminTokenRefusals = [
+    'ADMIN_AUTHORIZATION_REQUIRED',
+    'DELEGATED_ADMIN_TOKEN_REQUEST_INVALID',
+    'DELEGATED_ADMIN_TOKEN_NOT_FOUND',
+    'DELEGATED_ADMIN_TOKEN_INACTIVE',
+];
+const fail = () => { throw new Error('Delegated admin token contract rejected.'); };
+function requireValue(value) { if (!value)
+    fail(); }
+const safe = (operation) => { try {
+    return operation();
+}
+catch {
+    return fail();
+} };
+/** Exactly this shape's keys, read once as data; an accessor is refused, never invoked. */
+const object = (value, keys) => {
+    const copy = readExactDataRecord(value, keys);
+    requireValue(copy !== null);
+    return copy;
+};
+const identifier = (value) => {
+    requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+    return value;
+};
+const timestamp = (value) => {
+    requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0);
+    return value;
+};
+const tokenIdPattern = /^[a-f0-9]{64}$/;
+const tokenPattern = /^delegatedAdminToken_[a-f0-9]{64}_[a-f0-9]{64}$/;
+/** Whether a value is a delegated admin token in its exact form; it proves nothing else. */
+export const isDelegatedAdminToken = (value) => (typeof value === 'string' && tokenPattern.test(value));
+/** Whether a value names a token: 64 lowercase hex. */
+export const isDelegatedAdminTokenId = (value) => (typeof value === 'string' && tokenIdPattern.test(value));
+const secretKeyPrefixPattern = /^[A-Z][A-Z0-9]*_$/;
+/**
+ * Whether a prefix may be granted: `^[A-Z][A-Z0-9]*_$`, and overlapping no reserved name in
+ * either direction: it neither starts with nor is the start of an entry of
+ * `platformReservedSecretKeyPrefixes` or `runtimeInjectionSecretKeyPrefixes`, and no entry of
+ * `runtimeInjectionSecretKeys` starts with it. So a granted prefix is application-specific:
+ * `GIT_`, `NODE_`, `NPM_` and `AWS_` (`AWS_CA_BUNDLE`) are refused; `GITSYNC_` is not.
+ */
+export const isDelegatableSecretKeyPrefix = (value) => (typeof value === 'string' && value.length <= 64 && secretKeyPrefixPattern.test(value)
+    && [...platformReservedSecretKeyPrefixes, ...runtimeInjectionSecretKeyPrefixes]
+        .every((reservedArg) => !value.startsWith(reservedArg) && !reservedArg.startsWith(value))
+    && runtimeInjectionSecretKeys.every((reservedArg) => !reservedArg.startsWith(value)));
+/**
+ * Whether a token granted `prefixesArg` creates, rotates, retires or revokes a secret of key
+ * `keyArg`, or delivers a launcher variable of that name: the key starts with a granted prefix and
+ * is not reserved (`isReservedSecretKey`).
+ */
+export const isDelegatedSecretKey = (prefixesArg, keyArg) => (prefixesArg.some((prefixArg) => keyArg.startsWith(prefixArg)) && !isReservedSecretKey(keyArg));
+/** Whether a lifetime is one a mint may state. */
+export const isDelegatedAdminTokenLifetime = (value) => (typeof value === 'number' && Number.isSafeInteger(value)
+    && value >= delegatedAdminTokenContract.minimumLifetimeMs
+    && value <= delegatedAdminTokenContract.maximumLifetimeMs);
+/** Distinct known scopes, at least one, answered in `delegatedAdminTokenScopes` order. */
+const scopes = (value, canonical) => {
+    const entries = readDataElements(value, delegatedAdminTokenScopes.length);
+    requireValue(entries !== null && entries.length > 0 && new Set(entries).size === entries.length
+        && entries.every((entry) => delegatedAdminTokenScopes.some((scope) => scope === entry)));
+    const ordered = delegatedAdminTokenScopes.filter((scope) => entries.includes(scope));
+    requireValue(!canonical || ordered.every((scope, index) => entries[index] === scope));
+    return ordered;
+};
+/** Distinct grantable prefixes, at most the cap, answered sorted; `canonical` requires them sorted. */
+const secretKeyPrefixes = (value, canonical) => {
+    const entries = readDataElements(value, delegatedAdminTokenContract.maximumSecretKeyPrefixes);
+    requireValue(entries !== null && new Set(entries).size === entries.length
+        && entries.every((entry) => isDelegatableSecretKeyPrefix(entry)));
+    const prefixes = entries.slice().sort();
+    requireValue(!canonical || prefixes.every((prefix, index) => entries[index] === prefix));
+    return prefixes;
+};
+/** Structural copy of a mint; the backend authorizes the administrator and enforces the cap. */
+export const snapshotDelegatedAdminTokenMint = (value) => safe(() => {
+    const namesLifetime = readDataProperty(value, 'lifetimeMs') !== null;
+    const namesPrefixes = readDataProperty(value, 'secretKeyPrefixes') !== null;
+    const mint = object(value, ['scopes', ...(namesLifetime ? ['lifetimeMs'] : []),
+        ...(namesPrefixes ? ['secretKeyPrefixes'] : [])]);
+    const copy = { scopes: scopes(mint.scopes, false) };
+    if (namesLifetime) {
+        requireValue(isDelegatedAdminTokenLifetime(mint.lifetimeMs));
+        copy.lifetimeMs = mint.lifetimeMs;
+    }
+    if (namesPrefixes) {
+        const prefixes = secretKeyPrefixes(mint.secretKeyPrefixes, false);
+        requireValue(prefixes.length === 0 || copy.scopes.includes('secrets'));
+        copy.secretKeyPrefixes = prefixes;
+    }
+    return copy;
+});
+/** Structural copy of listed or answered metadata. */
+export const snapshotDelegatedAdminTokenMetadata = (value) => safe(() => {
+    const metadata = object(value, ['tokenId', 'userId', 'scopes', 'secretKeyPrefixes', 'createdAt', 'expiresAt',
+        'revokedAt', 'revokedBy']);
+    requireValue(isDelegatedAdminTokenId(metadata.tokenId));
+    const createdAt = timestamp(metadata.createdAt);
+    const expiresAt = timestamp(metadata.expiresAt);
+    requireValue(expiresAt > createdAt
+        && expiresAt - createdAt <= delegatedAdminTokenContract.maximumLifetimeMs);
+    const revoked = metadata.revokedAt !== null;
+    requireValue(revoked === (metadata.revokedBy !== null));
+    const revokedAt = revoked ? timestamp(metadata.revokedAt) : null;
+    requireValue(revokedAt === null || revokedAt >= createdAt);
+    const tokenScopes = scopes(metadata.scopes, true);
+    const prefixes = secretKeyPrefixes(metadata.secretKeyPrefixes, true);
+    requireValue(prefixes.length === 0 || tokenScopes.includes('secrets'));
+    return {
+        tokenId: metadata.tokenId, userId: identifier(metadata.userId), scopes: tokenScopes,
+        secretKeyPrefixes: prefixes, createdAt, expiresAt, revokedAt,
+        revokedBy: revoked ? identifier(metadata.revokedBy) : null,
+    };
+});
+/** Structural copy of a mint's answer: a token in its exact form and the metadata that names it. */
+export const snapshotDelegatedAdminTokenMintResult = (value) => safe(() => {
+    const result = object(value, ['token', 'metadata']);
+    requireValue(isDelegatedAdminToken(result.token));
+    const metadata = snapshotDelegatedAdminTokenMetadata(result.metadata);
+    requireValue(result.token.slice(delegatedAdminTokenContract.tokenPrefix.length, delegatedAdminTokenContract.tokenPrefix.length + 64) === metadata.tokenId && metadata.revokedAt === null);
+    return { token: result.token, metadata };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVsZWdhdGVkYWRtaW50b2tlbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVsZWdhdGVkYWRtaW50b2tlbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsZ0JBQWdCLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUN2RyxPQUFPLEVBQ0wsbUJBQW1CLEVBQUUsaUNBQWlDLEVBQUUsaUNBQWlDLEVBQ3pGLDBCQUEwQixHQUMzQixNQUFNLGFBQWEsQ0FBQztBQUVyQjs7Ozs7Ozs7Ozs7Ozs7R0FjRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDdkQsb0RBQW9EO0lBQ3BELGlCQUFpQixFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSTtJQUNqQyx3RkFBd0Y7SUFDeEYsaUJBQWlCLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJO0lBQ2pDLGlCQUFpQixFQUFFLEVBQUUsR0FBRyxJQUFJO0lBQzVCLDRGQUE0RjtJQUM1RixXQUFXLEVBQUUsc0JBQXNCO0lBQ25DLCtGQUErRjtJQUMvRixtQkFBbUIsRUFBRSxHQUFHO0lBQ3hCLHdEQUF3RDtJQUN4RCx3QkFBd0IsRUFBRSxFQUFFO0NBQzdCLENBQUMsQ0FBQztBQUVIOzs7Ozs7Ozs7Ozs7O0dBYUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLFNBQVMsRUFBRSxvQkFBb0IsQ0FBVSxDQUFDO0FBSXBGLCtGQUErRjtBQUMvRixNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzVELE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ3JCLDJCQUEyQixFQUFFLGFBQWEsRUFBRSxtQkFBbUIsRUFBRSxjQUFjLEVBQUUsY0FBYztRQUMvRix1QkFBdUI7S0FDZixDQUFDO0lBQ1gsa0JBQWtCLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLDZCQUE2QixFQUFFLGdDQUFnQyxDQUFVLENBQUM7Q0FDOUcsQ0FBMEUsQ0FBQztBQU01RSxpRUFBaUU7QUFDakUsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FDL0MsUUFBZ0IsRUFDaEIsU0FBa0IsRUFDcUMsRUFBRSxDQUFDLENBQ3pELGdDQUFnQyxDQUFDLFFBQVEsQ0FBd0IsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQ3ZGLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQVUsQ0FBQyxDQUFDO0FBNEN0Rzs7Ozs7Ozs7Ozs7R0FXRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHO0lBQ3pDLDhCQUE4QjtJQUM5Qix1Q0FBdUM7SUFDdkMsaUNBQWlDO0lBQ2pDLGdDQUFnQztDQUN4QixDQUFDO0FBU1gsTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzNGLFNBQVMsWUFBWSxDQUFDLEtBQWMsSUFBbUIsSUFBSSxDQUFDLEtBQUs7SUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFDNUUsTUFBTSxJQUFJLEdBQUcsQ0FBSSxTQUFrQixFQUFLLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFBQyxPQUFPLFNBQVMsRUFBRSxDQUFDO0FBQUMsQ0FBQztBQUFDLE1BQU0sQ0FBQztJQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7QUFBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQ3BHLDJGQUEyRjtBQUMzRixNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBRSxJQUF1QixFQUEyQixFQUFFO0lBQ2xGLE1BQU0sSUFBSSxHQUFHLG1CQUFtQixDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztJQUM5QyxZQUFZLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQzVCLE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxVQUFVLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUM1QyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUMzQyxZQUFZLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxjQUFjLEdBQUcsZ0JBQWdCLENBQUM7QUFDeEMsTUFBTSxZQUFZLEdBQUcsaURBQWlELENBQUM7QUFFdkUsNEZBQTRGO0FBQzVGLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQUMsQ0FDeEUsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLFlBQVksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQ3RELENBQUM7QUFFRix1REFBdUQ7QUFDdkQsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxDQUMxRSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FDeEQsQ0FBQztBQUVGLE1BQU0sc0JBQXNCLEdBQUcsbUJBQW1CLENBQUM7QUFFbkQ7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxLQUFjLEVBQW1CLEVBQUUsQ0FBQyxDQUMvRSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxFQUFFLElBQUksc0JBQXNCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQztPQUNsRixDQUFDLEdBQUcsaUNBQWlDLEVBQUUsR0FBRyxpQ0FBaUMsQ0FBQztTQUM1RSxLQUFLLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7T0FDeEYsMEJBQTBCLENBQUMsS0FBSyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FDckYsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLFdBQThCLEVBQUUsTUFBYyxFQUFXLEVBQUUsQ0FBQyxDQUMvRixXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsQ0FDOUYsQ0FBQztBQUVGLGtEQUFrRDtBQUNsRCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUFDLEtBQWMsRUFBbUIsRUFBRSxDQUFDLENBQ2hGLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQztPQUNyRCxLQUFLLElBQUksMkJBQTJCLENBQUMsaUJBQWlCO09BQ3RELEtBQUssSUFBSSwyQkFBMkIsQ0FBQyxpQkFBaUIsQ0FDMUQsQ0FBQztBQUVGLDBGQUEwRjtBQUMxRixNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQWMsRUFBRSxTQUFrQixFQUErQixFQUFFO0lBQ2pGLE1BQU0sT0FBTyxHQUFHLGdCQUFnQixDQUFDLEtBQUssRUFBRSx5QkFBeUIsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMxRSxZQUFZLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLEtBQUssT0FBTyxDQUFDLE1BQU07V0FDMUYsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLEtBQUssS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzNGLE1BQU0sT0FBTyxHQUFHLHlCQUF5QixDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3JGLFlBQVksQ0FBQyxDQUFDLFNBQVMsSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDdEYsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDO0FBRUYsdUdBQXVHO0FBQ3ZHLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxLQUFjLEVBQUUsU0FBa0IsRUFBWSxFQUFFO0lBQ3pFLE1BQU0sT0FBTyxHQUFHLGdCQUFnQixDQUFDLEtBQUssRUFBRSwyQkFBMkIsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO0lBQzlGLFlBQVksQ0FBQyxPQUFPLEtBQUssSUFBSSxJQUFJLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsTUFBTTtXQUNwRSxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDcEUsTUFBTSxRQUFRLEdBQUksT0FBb0IsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN0RCxZQUFZLENBQUMsQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3pGLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLGdHQUFnRztBQUNoRyxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLEtBQWMsRUFBNEIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDckcsTUFBTSxhQUFhLEdBQUcsZ0JBQWdCLENBQUMsS0FBSyxFQUFFLFlBQVksQ0FBQyxLQUFLLElBQUksQ0FBQztJQUNyRSxNQUFNLGFBQWEsR0FBRyxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsbUJBQW1CLENBQUMsS0FBSyxJQUFJLENBQUM7SUFDNUUsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDNUUsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDcEQsTUFBTSxJQUFJLEdBQTZCLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUM7SUFDOUUsSUFBSSxhQUFhLEVBQUUsQ0FBQztRQUNsQixZQUFZLENBQUMsNkJBQTZCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDN0QsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDO0lBQ3BDLENBQUM7SUFDRCxJQUFJLGFBQWEsRUFBRSxDQUFDO1FBQ2xCLE1BQU0sUUFBUSxHQUFHLGlCQUFpQixDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNsRSxZQUFZLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUN2RSxJQUFJLENBQUMsaUJBQWlCLEdBQUcsUUFBUSxDQUFDO0lBQ3BDLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQyxDQUFDO0FBRUgsc0RBQXNEO0FBQ3RELE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLENBQUMsS0FBYyxFQUFnQyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUM3RyxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsbUJBQW1CLEVBQUUsV0FBVyxFQUFFLFdBQVc7UUFDMUcsV0FBVyxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDN0IsWUFBWSxDQUFDLHVCQUF1QixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3hELE1BQU0sU0FBUyxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDaEQsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNoRCxZQUFZLENBQUMsU0FBUyxHQUFHLFNBQVM7V0FDN0IsU0FBUyxHQUFHLFNBQVMsSUFBSSwyQkFBMkIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQzdFLE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDO0lBQzVDLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDeEQsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDakUsWUFBWSxDQUFDLFNBQVMsS0FBSyxJQUFJLElBQUksU0FBUyxJQUFJLFNBQVMsQ0FBQyxDQUFDO0lBQzNELE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ2xELE1BQU0sUUFBUSxHQUFHLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUNyRSxZQUFZLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLE9BQU87UUFDTCxPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLEVBQUUsV0FBVztRQUNuRixpQkFBaUIsRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTO1FBQzVELFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUk7S0FDM0QsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUgsb0dBQW9HO0FBQ3BHLE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQUMsS0FBYyxFQUFrQyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNqSCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDcEQsWUFBWSxDQUFDLHFCQUFxQixDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2xELE1BQU0sUUFBUSxHQUFHLG1DQUFtQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN0RSxZQUFZLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsMkJBQTJCLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFDNUUsMkJBQTJCLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxFQUFFLENBQUMsS0FBSyxRQUFRLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDNUcsT0FBTyxFQUFFLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQzNDLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/gateway.d.ts

@@ -10,16 +10,32 @@ export type TManagedRouteKind = 'letsencrypt-http01-forward';
 /**
  * DNS handling requested alongside a gateway route synchronization.
  *
- * - 'reconcile' claims or replaces exact-host manual A, AAAA, and CNAME
- *   records, including already-correct records, with gateway-managed state.
+ * - 'reconcile' creates, updates and deletes the exact-host A or AAAA record
+ *   the route's gateway DNS ownership holds. It never adopts, replaces or
+ *   deletes a record without gateway DNS ownership. The route is satisfied by
+ *   manual records only when no record at the name is owned and every manual A
+ *   or AAAA record there matches the desired type, value and proxied flag (TTL
+ *   ignored); anything else (a differing record, any CNAME, owned and manual
+ *   records together) and an operator-protected hostname is a non-retryable
+ *   `record-conflict` with no mutation. When the route stops claiming the
+ *   hostname while another enabled route on the gateway serves it, the owned
+ *   record is released to manual ownership instead of deleted.
  * - 'observe' reports DNS state without mutating it.
  * - 'skip' bypasses DNS inspection and mutation and is the default when omitted.
  */
 export type TGatewayRouteDnsMode = 'reconcile' | 'observe' | 'skip';
 /**
  * Detailed DNS outcome reported by a gateway route synchronization.
+ *
+ * - `manual-satisfied`: every manual A or AAAA record at the name matches the desired type,
+ *   value and proxied flag; the gateway changes and claims nothing and reports them in
+ *   `records` with `managed: false`.
+ * - `managed-released`: the route no longer claims the hostname, but another enabled route on
+ *   the gateway still serves it, so the gateway released its record to manual ownership instead
+ *   of deleting it; the released record is reported in `records` with `managed: false`.
+ * - `managed-overwrote-manual` and `managed-orphan-deleted`: deprecated; no gateway reports them.
  */
-export type TGatewayRouteDnsStatus = 'not-applicable' | 'skipped' | 'managed-created' | 'managed-updated' | 'managed-overwrote-manual' | 'managed-unchanged' | 'observed-satisfied' | 'managed-deleted' | 'managed-orphan-deleted' | 'record-missing' | 'target-invalid' | 'zone-unmanaged' | 'zone-unavailable' | 'record-conflict' | 'mutation-failed' | 'compensation-failed';
+export type TGatewayRouteDnsStatus = 'not-applicable' | 'skipped' | 'managed-created' | 'managed-updated' | 'managed-overwrote-manual' | 'managed-unchanged' | 'manual-satisfied' | 'observed-satisfied' | 'managed-deleted' | 'managed-released' | 'managed-orphan-deleted' | 'record-missing' | 'target-invalid' | 'zone-unmanaged' | 'zone-unavailable' | 'record-conflict' | 'mutation-failed' | 'compensation-failed';
 /**
  * DNS record evidence attached to a gateway route synchronization result.
  */
@@ -48,7 +64,10 @@ export interface IGatewayRouteDnsResult {
     zoneName?: string;
     nameservers?: string[];
     records?: IGatewayRouteDnsRecord[];
-    /** Prior manual records replaced by this reconciliation, preserved as evidence. */
+    /**
+     * Prior manual records replaced by this reconciliation, preserved as evidence.
+     * @deprecated No gateway replaces manual records; it accompanied `managed-overwrote-manual`.
+     */
     overwrittenRecords?: IGatewayRouteDnsRecord[];
     /** Time at which the gateway checked the DNS state, as Unix epoch milliseconds. */
     checkedAt: number;

package/dist_ts/data/gateway.js

@@ -112,4 +112,4 @@ export const isGatewayClientDnsRecordAllowed = (recordArg, allowedDnsRecordAddre
         return prefix !== null && ipPrefixContains(prefix, address);
     });
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2F0ZXdheS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZ2F0ZXdheS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDbEcsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDNUQsT0FBTyxFQUNMLGdCQUFnQixFQUNoQix1QkFBdUIsRUFDdkIsc0JBQXNCLEdBQ3ZCLE1BQU0seUJBQXlCLENBQUM7QUFvZWpDOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN6RCxNQUFNLEVBQUUsRUFBRTtJQUNWLE1BQU0sRUFBRSxNQUFNO0lBQ2QsVUFBVSxFQUFFLEdBQUc7SUFDZiw0QkFBNEIsRUFBRSxFQUFFO0lBQ2hDLGNBQWMsRUFBRSxHQUFHO0lBQ25CLGlCQUFpQixFQUFFLEdBQUc7Q0FDdkIsQ0FBQyxDQUFDO0FBbUpILE1BQU0sb0JBQW9CLEdBQUcsd0NBQXdDLENBQUM7QUFDdEUsTUFBTSxZQUFZLEdBQUcsK0JBQStCLENBQUM7QUFFckQsb0dBQW9HO0FBQ3BHLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ2hGLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDekIsUUFBUSxDQUFDLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxpQkFBaUI7T0FDbEUsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQztPQUMvQixRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQ2hGLENBQUM7QUFFRiw2RUFBNkU7QUFDN0UsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLFdBQVcsRUFDWCxFQUFFO0lBQ1osTUFBTSxTQUFTLEdBQUcsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDL0MsSUFBSSxTQUFTLEtBQUssSUFBSSxJQUFJLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDMUUsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLEtBQUssQ0FBQztJQUM5QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLDZCQUE2QixDQUFDLGNBQWM7V0FDdkYsQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0IsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sdUJBQXVCLDZCQUE2QixDQUFDLGNBQWMsR0FBRztjQUN4RixrR0FBa0csQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxJQUFJLENBQUMsdUJBQXVCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8seURBQXlEO2NBQzNFLG9DQUFvQyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDOUUsc0JBQXNCLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDO0FBRTVDLG1GQUFtRjtBQUNuRixNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxDQUN0RCxRQUFpQixFQUNqQixPQUFPLEdBQUcsMkJBQTJCLEVBQzNCLEVBQUU7SUFDWixNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyw0QkFBNEIsQ0FBQztJQUMzRSxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDckQsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDdEIsT0FBTyxDQUFDLEdBQUcsT0FBTyw4QkFBOEIsT0FBTyxtQkFBbUIsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsRUFBRTtRQUN2QyxJQUFJLENBQUMsc0JBQXNCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxJQUFJLFFBQVEsK0RBQStELENBQUMsQ0FBQztRQUNyRyxDQUFDO2FBQU0sSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3BELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksUUFBUSxhQUFhLFNBQVMsRUFBRSxDQUFDLENBQUM7UUFDOUQsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsK0ZBQStGO0FBQy9GLE1BQU0sK0JBQStCLEdBQUcsQ0FDdEMsT0FBb0MsRUFDcEMsUUFBaUIsRUFDRyxFQUFFO0lBQ3RCLElBQUksT0FBTyxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ3BCLE9BQU8sc0JBQXNCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELCtFQUErRTtJQUMvRSxPQUFPLE9BQU8sRUFBRSxNQUFNLEtBQUssQ0FBQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssRUFBRSxJQUFJLE9BQU8sQ0FBQyxLQUFLLElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQztBQUMxRixDQUFDLENBQUM7QUFFRixtRkFBbUY7QUFDbkYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQU8sR0FBRyxRQUFRLEVBQVksRUFBRTtJQUNoRyxNQUFNLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM1QyxJQUFJLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3pFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztJQUN6QixJQUFJLElBQUksS0FBSyxHQUFHLElBQUksSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ3BDLE9BQU8sQ0FBQyxHQUFHLE9BQU8seUJBQXlCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekQsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssR0FBRztZQUN0QixDQUFDLENBQUMsR0FBRyxPQUFPLHFGQUFxRjtZQUNqRyxDQUFDLENBQUMsR0FBRyxPQUFPLHNGQUFzRixDQUFDLENBQUM7SUFDeEcsQ0FBQztJQUNELE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsNkJBQTZCLENBQUM7SUFDekQsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7V0FDL0QsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLEdBQUcsSUFBSSxNQUFNLElBQUksTUFBTSxDQUFDLEdBQUcsSUFBSSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQyxNQUFNLE9BQU8sTUFBTSxVQUFVLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUM3QyxTQUFrQyxFQUNsQyw0QkFBMkQsRUFDbEQsRUFBRTtJQUNYLElBQUksOEJBQThCLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN6RCxNQUFNLFNBQVMsR0FBRyw0QkFBNEIsS0FBSyxTQUFTO1FBQzFELENBQUMsQ0FBQyxFQUFFO1FBQ0osQ0FBQyxDQUFDLGdCQUFnQixDQUFDLDRCQUE0QixFQUFFLDZCQUE2QixDQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDL0csT0FBTyxPQUFPLEtBQUssSUFBSSxJQUFJLFNBQVMsS0FBSyxJQUFJLElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFO1FBQzVFLE1BQU0sTUFBTSxHQUFHLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2pELE9BQU8sTUFBTSxLQUFLLElBQUksSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDOUQsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2F0ZXdheS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZ2F0ZXdheS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsWUFBWSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDbEcsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDNUQsT0FBTyxFQUNMLGdCQUFnQixFQUNoQix1QkFBdUIsRUFDdkIsc0JBQXNCLEdBQ3ZCLE1BQU0seUJBQXlCLENBQUM7QUF5ZmpDOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN6RCxNQUFNLEVBQUUsRUFBRTtJQUNWLE1BQU0sRUFBRSxNQUFNO0lBQ2QsVUFBVSxFQUFFLEdBQUc7SUFDZiw0QkFBNEIsRUFBRSxFQUFFO0lBQ2hDLGNBQWMsRUFBRSxHQUFHO0lBQ25CLGlCQUFpQixFQUFFLEdBQUc7Q0FDdkIsQ0FBQyxDQUFDO0FBbUpILE1BQU0sb0JBQW9CLEdBQUcsd0NBQXdDLENBQUM7QUFDdEUsTUFBTSxZQUFZLEdBQUcsK0JBQStCLENBQUM7QUFFckQsb0dBQW9HO0FBQ3BHLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ2hGLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDekIsUUFBUSxDQUFDLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxpQkFBaUI7T0FDbEUsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQztPQUMvQixRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQ2hGLENBQUM7QUFFRiw2RUFBNkU7QUFDN0UsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLFdBQVcsRUFDWCxFQUFFO0lBQ1osTUFBTSxTQUFTLEdBQUcsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDL0MsSUFBSSxTQUFTLEtBQUssSUFBSSxJQUFJLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDMUUsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxLQUFLLEdBQUcsU0FBUyxDQUFDLEtBQUssQ0FBQztJQUM5QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLDZCQUE2QixDQUFDLGNBQWM7V0FDdkYsQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDL0IsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sdUJBQXVCLDZCQUE2QixDQUFDLGNBQWMsR0FBRztjQUN4RixrR0FBa0csQ0FBQyxDQUFDO0lBQzFHLENBQUM7SUFDRCxJQUFJLENBQUMsdUJBQXVCLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8seURBQXlEO2NBQzNFLG9DQUFvQyxDQUFDLENBQUM7SUFDNUMsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLHVGQUF1RjtBQUN2RixNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDOUUsc0JBQXNCLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDO0FBRTVDLG1GQUFtRjtBQUNuRixNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxDQUN0RCxRQUFpQixFQUNqQixPQUFPLEdBQUcsMkJBQTJCLEVBQzNCLEVBQUU7SUFDWixNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyw0QkFBNEIsQ0FBQztJQUMzRSxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDckQsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDdEIsT0FBTyxDQUFDLEdBQUcsT0FBTyw4QkFBOEIsT0FBTyxtQkFBbUIsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsRUFBRTtRQUN2QyxJQUFJLENBQUMsc0JBQXNCLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxJQUFJLFFBQVEsK0RBQStELENBQUMsQ0FBQztRQUNyRyxDQUFDO2FBQU0sSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3BELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksUUFBUSxhQUFhLFNBQVMsRUFBRSxDQUFDLENBQUM7UUFDOUQsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsK0ZBQStGO0FBQy9GLE1BQU0sK0JBQStCLEdBQUcsQ0FDdEMsT0FBb0MsRUFDcEMsUUFBaUIsRUFDRyxFQUFFO0lBQ3RCLElBQUksT0FBTyxLQUFLLEdBQUcsRUFBRSxDQUFDO1FBQ3BCLE9BQU8sc0JBQXNCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELCtFQUErRTtJQUMvRSxPQUFPLE9BQU8sRUFBRSxNQUFNLEtBQUssQ0FBQyxJQUFJLE9BQU8sQ0FBQyxLQUFLLEtBQUssRUFBRSxJQUFJLE9BQU8sQ0FBQyxLQUFLLElBQUksSUFBSSxLQUFLLEtBQUssQ0FBQztBQUMxRixDQUFDLENBQUM7QUFFRixtRkFBbUY7QUFDbkYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQU8sR0FBRyxRQUFRLEVBQVksRUFBRTtJQUNoRyxNQUFNLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM1QyxJQUFJLE1BQU0sS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3pFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztJQUN6QixJQUFJLElBQUksS0FBSyxHQUFHLElBQUksSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDO1FBQ3BDLE9BQU8sQ0FBQyxHQUFHLE9BQU8seUJBQXlCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxJQUFJLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDekQsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssR0FBRztZQUN0QixDQUFDLENBQUMsR0FBRyxPQUFPLHFGQUFxRjtZQUNqRyxDQUFDLENBQUMsR0FBRyxPQUFPLHNGQUFzRixDQUFDLENBQUM7SUFDeEcsQ0FBQztJQUNELE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLEdBQUcsNkJBQTZCLENBQUM7SUFDekQsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7V0FDL0QsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksTUFBTSxDQUFDLEdBQUcsSUFBSSxNQUFNLElBQUksTUFBTSxDQUFDLEdBQUcsSUFBSSxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQyxNQUFNLE9BQU8sTUFBTSxVQUFVLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUM3QyxTQUFrQyxFQUNsQyw0QkFBMkQsRUFDbEQsRUFBRTtJQUNYLElBQUksOEJBQThCLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3pELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLHVCQUF1QixDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN6RCxNQUFNLFNBQVMsR0FBRyw0QkFBNEIsS0FBSyxTQUFTO1FBQzFELENBQUMsQ0FBQyxFQUFFO1FBQ0osQ0FBQyxDQUFDLGdCQUFnQixDQUFDLDRCQUE0QixFQUFFLDZCQUE2QixDQUFDLDRCQUE0QixDQUFDLENBQUM7SUFDL0csT0FBTyxPQUFPLEtBQUssSUFBSSxJQUFJLFNBQVMsS0FBSyxJQUFJLElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFO1FBQzVFLE1BQU0sTUFBTSxHQUFHLHNCQUFzQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2pELE9BQU8sTUFBTSxLQUFLLElBQUksSUFBSSxnQkFBZ0IsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDOUQsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMifQ==

package/dist_ts/data/index.d.ts

@@ -9,6 +9,7 @@ export * from './config.js';
 export * from './corestore.js';
 export * from './corestorecontroltoken.js';
 export * from './corestorelegacyadoption.js';
+export * from './delegatedadmintoken.js';
 export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';

package/dist_ts/data/index.js

@@ -9,6 +9,7 @@ export * from './config.js';
 export * from './corestore.js';
 export * from './corestorecontroltoken.js';
 export * from './corestorelegacyadoption.js';
+export * from './delegatedadmintoken.js';
 export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
@@ -85,4 +86,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBR3ZDLE9BQU8sRUFBRSwwQkFBMEIsRUFBRSxNQUFNLGtCQUFrQixDQUFDO0FBRzlELE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBRXBGLE9BQU8sRUFBRSwwQ0FBMEMsRUFBRSwwQ0FBMEMsRUFBRSxNQUFNLGtDQUFrQyxDQUFDO0FBQzFJLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywrQkFBK0IsQ0FBQztBQUM5QyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxrQ0FBa0MsQ0FBQztBQUNqRCxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsOEJBQThCLENBQUM7QUFDN0MsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsd0JBQXdCLENBQUM7QUFHdkMsT0FBTyxFQUFFLDBCQUEwQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFHOUQsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFFcEYsT0FBTyxFQUFFLDBDQUEwQyxFQUFFLDBDQUEwQyxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFDMUksY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsZ0NBQWdDLENBQUM7QUFDL0MsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYywrQkFBK0IsQ0FBQztBQUM5QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGtDQUFrQyxDQUFDO0FBQ2pELGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==

package/dist_ts/data/secret.d.ts

@@ -194,6 +194,29 @@ export interface ISecretFileDelivery {
 export type TSecretDelivery = ISecretLauncherEnvironmentDelivery | ISecretFileDelivery;
 /** A delivery of a resolved secret manifest: every owner is stated. */
 export type TSecretResolvedDelivery = ISecretResolvedLauncherEnvironmentDelivery | ISecretFileDelivery;
+/**
+ * Prefixes of the names the platform injects into a workload itself (`SERVEZONE_*`): a secret of
+ * such a name would replace what the platform delivers.
+ */
+export declare const platformReservedSecretKeyPrefixes: readonly ["SERVEZONE_"];
+/**
+ * Prefixes of the names a loader, language runtime, package manager or library reads to change
+ * what a process loads, runs or trusts (`LD_PRELOAD`, `NODE_OPTIONS`, `PYTHONPATH`, `OPENSSL_CONF`,
+ * `DOTNET_STARTUP_HOOKS`, `NPM_CONFIG_REGISTRY`, …). Matched as plain prefixes, so `PYTHON`, `PERL`,
+ * `RUBY` and `PHP` cover every name that starts with them.
+ */
+export declare const runtimeInjectionSecretKeyPrefixes: readonly ["LD_", "DYLD_", "NODE_", "DENO_", "BUN_", "PYTHON", "PERL", "RUBY", "PHP", "JAVA_", "JDK_", "_JAVA_", "DOTNET_", "CORECLR_", "LUA_", "GEM_", "BUNDLE_", "NPM_CONFIG_", "PIP_", "GLIBC_", "MALLOC_", "GCONV_", "OPENSSL_", "SSL_", "CURL_", "REQUESTS_", "GIT_"];
+/**
+ * Exact names a shell, loader, runtime or HTTP client reads to change where a process looks,
+ * connects or what it trusts or records (`CLASSPATH`, `AWS_CA_BUNDLE`, `SSLKEYLOGFILE`).
+ */
+export declare const runtimeInjectionSecretKeys: readonly ["PATH", "HOME", "SHELL", "ENV", "BASH_ENV", "IFS", "TMPDIR", "LOCPATH", "NLSPATH", "CLASSPATH", "HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY", "FTP_PROXY", "AWS_CA_BUNDLE", "SSLKEYLOGFILE"];
+/**
+ * Whether a secret key, or a name a secret is delivered under, is reserved: one of
+ * `runtimeInjectionSecretKeys`, or starting with an entry of `platformReservedSecretKeyPrefixes`
+ * or `runtimeInjectionSecretKeyPrefixes`. A delegated administrator token never writes such a name.
+ */
+export declare const isReservedSecretKey: (keyArg: string) => boolean;
 export declare const secretValueLimits: Readonly<{
     maximumBytes: number;
     minimumGeneratedBytes: 16;