@serve.zone/interfaces 32.60.0 → 32.62.0

package/.smartconfig.json

@@ -47,8 +47,10 @@
       }
     }
   },
-  "@git.zone/tsdoc": {
-    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license.md](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+  "@git.zone/tsrepo": {
+    "docs": {
+      "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license.md](license.md) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+    }
   },
   "@ship.zone/szci": {}
 }

package/changelog.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 2026-10-23 - 32.62.0
+
+### Features
+
+- Workload replica identity (`data.workloadreplicaidentity`): `IWorkloadReplicaIdentity` is exactly `{ serviceId, replicaId, attemptId, imageDigest }`, the runtime assignment's own values (`buildWorkloadReplicaIdentity(assignment)`, read through the assignment's exact schema), with `validateWorkloadReplicaIdentity` (names every violation) and `snapshotWorkloadReplicaIdentity` (detached frozen copy or throws). `workloadReplicaIdentityEnvironmentNames` spells the names every runtime injects into every workload once: `SERVEZONE_WORKLOAD_SERVICE_ID`, `SERVEZONE_WORKLOAD_REPLICA_ID`, `SERVEZONE_WORKLOAD_ATTEMPT_ID`, `SERVEZONE_WORKLOAD_IMAGE_DIGEST`. `composeWorkloadReplicaEnvironment(configEnvironment, identity)` answers the config environment with the identity added, or `refused` with `workload-identity-environment-conflict` naming every colliding key and no value (`TWorkloadReplicaEnvironmentComposition`); `findWorkloadReplicaIdentityEnvironmentConflicts(names)` is the same judgement over an effective environment's keys and its launcher secrets' variable names, for Cloudly's refusal; `readWorkloadReplicaIdentityEnvironment(process.env)` reads the four names only and throws naming every missing or invalid variable. `workloadReplicaIdentityContract.maximumExecutorEnvironmentEntries` (132) is `runtimeConfigContract.maximumEnvironmentEntries` (128, unchanged for a config) plus `injectedEnvironmentEntries` (4), the bound a runtime's executor admits. `TServiceRuntimeRefusal` gains `workload-identity-environment-conflict`. Cloudly alone states it, in the `IServiceRuntimeStatus` it stores and answers on `getServiceRuntimeSpec`, `getServiceRuntimeSpecForCluster` and `getServiceRuntimeSpecs`; those requests carry no protocol offer, so there is no peer version to gate the reason on, and no earlier refusal names this check. A reader built before this release refuses such a status whole, so every client that reads statuses moves to this release before Cloudly does, and a Cloudly that has stored one is not rolled back below this release. A node never states it: a Pallet whose composition refuses (only a Cloudly before this release places such a run) reports the existing `TRuntimeAssignmentFailureCause` `{ kind: 'refused', reason: 'invalid' }`, which every reader since 32.45.0 reads. Cloudly raises the `minimumPeerVersion` of its Pallet runtime sessions to this release in the commit that first deploys CoreMail 34.
+- CoreMail replica identity: `ICoreMailReconciliationStatus.replica` and `IReq_CoreMailAuthenticateControl.response.replica` accept `IWorkloadReplicaIdentity` (CoreMail 34 and later, whose `attemptId` replaces `taskId`) or the deprecated `ICoreMailReplicaIdentity` (CoreMail before 34); `normalizeCoreMailReplicaIdentity` reads each exactly (a record stating `taskId` is the deprecated shape) and now returns the union. `coreMailRuntimeKeys` gains `port` (`COREMAIL_PORT`), `hostnames` (`COREMAIL_HOSTNAMES`) and `mongoDbMaxPoolSize` (`COREMAIL_MONGODB_MAX_POOL_SIZE`), and `coreMailStorageEnvironmentNames` names the storage CoreMail 34 reads under its bindings' names (`MONGODB_URL`, `MONGODB_DATABASE`, `S3_ENDPOINT`, `S3_REGION`, `S3_BUCKET`, `S3_ACCESS_KEY`, `S3_SECRET_KEY`) in place of `COREMAIL_MONGODB_URL`, `COREMAIL_MONGODB_NAME`, `COREMAIL_STORAGE_DESCRIPTOR` and `COREMAIL_BUCKET_NAME`. Readers first: a reader built before this release refuses CoreMail 34's identity (its normalizer requires `taskId`, `rolloutId` and `rolloutGeneration`), and the Pallet session gate does not reach CoreMail's control readers. `@serve.zone/api`'s `CoreMailControlClient`, and through it Cloudly's CoreMail manager and Onebox's CoreMail provider, move to this release before any CoreMail 34 runs: Cloudly deploys CoreMail 34 only once its own reader is on this release, and Onebox moves its CoreMail pin to 34 only in the release that carries this reader. A CoreMail before 34 keeps writing the deprecated shape, which every reader reads as before.
+- Service mail environment: `ICloudlySettings.dcrouterMailEndpointUrl`, the canonical HTTPS URL of dcrouter's tenant mail listener, is the only value of `MAIL_TYPED_URL` and `MAIL_<TOKEN>_TYPED_URL` (never `dcrouterGatewayUrl`, never CoreMail); absent, Cloudly refuses the typed dcrouter-direct binding naming it. `validateDcrouterMailEndpointUrl` accepts only an `https:` URL without credentials, query or fragment, at most `dcrouterMailEndpointUrlMaximumLength` (2,048) characters, in its `new URL(value).href` form. `serviceMailEnvironmentNames` spells the default sender's names (`MAIL_FROM`, `MAIL_TYPED_URL`, `MAIL_API_CREDENTIAL_*`, `SMTP_*`, `MAIL_COREMAIL_*`) and `createServiceMailAddressEnvironmentNames(token)` the `MAIL_<TOKEN>_*` names of a further sender address. Specs: `test.workloadreplicaidentity`, `test.servicemailenvironment`, `test.serviceruntime`.
+
+### Deprecations
+
+- `ICoreMailReplicaIdentity` (`taskId`, `serviceId`, `rolloutId`, `rolloutGeneration`, `imageDigest`): CoreMail 34 reports `IWorkloadReplicaIdentity`. The normalizer and both carrying types keep reading it, exactly, from a CoreMail before 34; removed in the next major.
+- Type-level break in this minor, shipped in 32.x by arbiter ruling because an interfaces major makes every Cloudly, Pallet and Spark handshake refuse its peer. On the wire, what existing writers send is unchanged and this release reads it as before; what is new, CoreMail 34's `IWorkloadReplicaIdentity` and the refusal `workload-identity-environment-conflict`, is refused by every reader built before this release, so readers upgrade first (see Features). In source, `ICoreMailReconciliationStatus.replica`, `IReq_CoreMailAuthenticateControl.response.replica` and the return value of `normalizeCoreMailReplicaIdentity` are now `IWorkloadReplicaIdentity | ICoreMailReplicaIdentity`, so code that reads `.taskId`, `.rolloutId` or `.rolloutGeneration` directly no longer compiles until it narrows, e.g. `'taskId' in replica ? replica.taskId : replica.attemptId`. The consumers that move with it: `@serve.zone/api` (`CoreMailControlClient`), Cloudly (CoreMail manager), Onebox (CoreMail provider) and CoreMail.
+
+### Maintenance
+
+- Release tooling currency: pnpm 12.13.0 -> 12.14.0 (`@git.zone/tsrepo` ^1.1.1 and `@types/node` 26.6.5 are current).
+
+## 2026-10-21 - 32.61.0
+
+### Features
+
+- Delegated admin temp tokens (`data.delegatedAdminTokenContract`): a human administrator who signed in within five minutes mints a token for explicit scopes, which lives one hour by default and at most one hour (`defaultLifetimeMs`, `maximumLifetimeMs`, `minimumLifetimeMs` one minute) and is never extended. `delegatedAdminTokenScopes` is the allowlist (`secrets`, `serviceCredentials`) and `delegatedAdminTokenScopeRequests` names exactly the wire methods each admits (typed as `TDelegatedAdminTokenScopeRequest`, judged by `isDelegatedAdminTokenScopeRequest`): `secrets` the operator-managed secret lifecycle (`getSecretIngressRecipient`, `listSecrets`, `getSecretMetadata`, `createSecret`, `rotateSecret`, `changeSecretLifecycle` with the actions `delegatedAdminTokenSecretLifecycleActions` names, `retire` and `revoke` of a granted key, never `delete`), `serviceCredentials` the service platform credential (`getServiceMachineCredential`, `mutateServiceMachineCredential`). A mint may grant `secretKeyPrefixes` (only with `secrets`, at most `maximumSecretKeyPrefixes` 16, each `isDelegatableSecretKeyPrefix`: `^[A-Z][A-Z0-9]*_$` and overlapping no reserved name either way, so a granted prefix is application-specific such as `GITSYNC_`, and `GIT_`, `NPM_` or `AWS_` are refused), under which alone the token creates, rotates, retires and revokes secrets (`isDelegatedSecretKey`); a token without prefixes does none of these. A token creates a secret only as a launcher-environment variable, never as a file. New requests `requests.admin.IReq_Admin_MintDelegatedAdminToken` (`mintDelegatedAdminToken`: `IDelegatedAdminTokenMint`, i.e. `scopes`, optional `lifetimeMs` and `secretKeyPrefixes`; answers the token once with its metadata), `IReq_Admin_GetDelegatedAdminTokens` (`getDelegatedAdminTokens`: the active tokens, value-free, newest first, at most `maximumListedTokens`, with `truncated`) and `IReq_Admin_RevokeDelegatedAdminToken` (`revokeDelegatedAdminToken`: by `tokenId`, any administrator), with value-free `IDelegatedAdminTokenMetadata` (scopes and `secretKeyPrefixes` included), refusals `delegatedAdminTokenRefusals` as `IDelegatedAdminTokenErrorData`, the exact token form `delegatedAdminToken_<tokenId>_<secret>` (`isDelegatedAdminToken`, `isDelegatedAdminTokenId`, `isDelegatedAdminTokenLifetime`) and exact-key snapshots (`snapshotDelegatedAdminTokenMint`, `snapshotDelegatedAdminTokenMetadata`, `snapshotDelegatedAdminTokenMintResult`). `getIdentityByToken` documents the session a token is exchanged for (`type: 'machine'`, `role: 'api'`, `userId: 'delegated-admin-token:<tokenId>'`). Specs: `test.delegatedadmintoken` (lifetime cap and token form, the scope and request lists and the delegated lifecycle actions, canonical scopes and exact keys, the token answered only by a mint, metadata without any value and with whole revocation, reserved names, grantable prefixes and delegated keys, named refusals).
+- Reserved secret names (`data.secret`): `platformReservedSecretKeyPrefixes` (`SERVEZONE_`, the names the platform injects), `runtimeInjectionSecretKeyPrefixes` (`LD_`, `DYLD_`, `NODE_`, `DENO_`, `BUN_`, `PYTHON`, `PERL`, `RUBY`, `PHP`, `JAVA_`, `JDK_`, `_JAVA_`, `DOTNET_`, `CORECLR_`, `LUA_`, `GEM_`, `BUNDLE_`, `NPM_CONFIG_`, `PIP_`, `GLIBC_`, `MALLOC_`, `GCONV_`, `OPENSSL_`, `SSL_`, `CURL_`, `REQUESTS_`, `GIT_`), `runtimeInjectionSecretKeys` (`PATH`, `HOME`, `SHELL`, `ENV`, `BASH_ENV`, `IFS`, `TMPDIR`, `LOCPATH`, `NLSPATH`, `CLASSPATH`, `HTTP_PROXY`, `HTTPS_PROXY`, `ALL_PROXY`, `NO_PROXY`, `FTP_PROXY`, `AWS_CA_BUNDLE`, `SSLKEYLOGFILE`) and `isReservedSecretKey`. A delegated admin token never writes, retires or revokes such a name; human administrators are not restricted by them yet. The existing key pattern (`^[A-Z_][A-Z0-9_]{0,252}$`) admits a leading underscore, so `_JAVA_*` names exist and are covered.
+
+### Fixes
+
+- Gateway route DNS no longer claims manual records (AGL-523): the `reconcile` mode documentation (`data.TGatewayRouteDnsMode`) now says a gateway creates, updates and deletes only the exact-host A or AAAA record its route ownership holds and never adopts, replaces or deletes a record without gateway DNS ownership. Manual records satisfy a route only when no record at the name is owned and every manual A or AAAA record there matches the desired type, value and proxied flag; a differing record, any CNAME, owned and manual records together, or an operator-protected hostname is a non-retryable `record-conflict` with no mutation. While another enabled route on the gateway still serves the hostname, a withdrawn route releases its record to manual ownership instead of deleting it. `data.TGatewayRouteDnsStatus` gains `manual-satisfied` (every manual record matches; the gateway changes and claims nothing and reports them with `managed: false`) and `managed-released` (the record was released instead of deleted and is reported with `managed: false`); `managed-overwrote-manual`, `managed-orphan-deleted` and `IGatewayRouteDnsResult.overwrittenRecords` are deprecated, as no gateway reports them.
+
+### Maintenance
+
+- Release tooling: `@git.zone/tsrepo` ^1.1.1 replaces tsbuild, tstest, tsrun and tsdoc (deprecated in its favour): the scripts call `tsrepo build tsfolders`, `tsrepo test` and `tsrepo docs`, the specs import `@git.zone/tsrepo/tapbundle`, and the `.smartconfig.json` section `@git.zone/tsdoc` moved to `"@git.zone/tsrepo"` `docs`. `@types/node` 26.6.5 and pnpm 12.13.0 are current.
+
 ## 2026-10-20 - 32.60.0
 
 ### Fixes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.60.0',
+    version: '32.62.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/coremail.d.ts

@@ -6,6 +6,7 @@
  * delivery identifiers only and never caller-selected tenant, service, or
  * binding authority.
  */
+import type { IWorkloadReplicaIdentity } from './workloadreplicaidentity.js';
 export type TCoreMailSha256 = `sha256:${string}`;
 export type TCoreMailCapability = 'outbound' | 'inbound';
 export type TCoreMailBindingState = 'active' | 'draining' | 'disabled';
@@ -222,6 +223,15 @@ export interface ICoreMailDesiredState {
     smtp?: ICoreMailSmtpDesiredState;
     cursorKeys: ICoreMailRuntimeKeyReference[];
 }
+/**
+ * The replica identity CoreMail before 34 reports, read from the `COREMAIL_*` variables its
+ * provisioner fabricated.
+ *
+ * @deprecated CoreMail 34 and later report `IWorkloadReplicaIdentity`, which its runtime injects
+ * (`workloadReplicaIdentityEnvironmentNames`); `taskId` is that identity's `attemptId`.
+ * `normalizeCoreMailReplicaIdentity` still reads this shape, exactly, from a CoreMail before 34;
+ * removed in the next major.
+ */
 export interface ICoreMailReplicaIdentity {
     taskId: string;
     serviceId: string;
@@ -241,7 +251,11 @@ export interface ICoreMailBindingReconciliationStatus {
     }>;
 }
 export interface ICoreMailReconciliationStatus {
-    replica: ICoreMailReplicaIdentity;
+    /**
+     * The reporting replica: `IWorkloadReplicaIdentity` from CoreMail 34 on, the deprecated
+     * `ICoreMailReplicaIdentity` from an earlier CoreMail. Each is read exactly.
+     */
+    replica: IWorkloadReplicaIdentity | ICoreMailReplicaIdentity;
     state: TCoreMailReconciliationState;
     appliedConfigEpoch: number;
     appliedDesiredStateDigest: TCoreMailSha256;
@@ -387,4 +401,26 @@ export declare const coreMailRuntimeKeys: Readonly<{
     readonly controlBootstrap: 'COREMAIL_CONTROL_BOOTSTRAP';
     readonly controlCredentialSecret: 'COREMAIL_CONTROL_CREDENTIAL_SECRET';
     readonly gatewayCredentialSecret: 'COREMAIL_GATEWAY_CREDENTIAL';
+    /** Optional listener port inside the workload. */
+    readonly port: 'COREMAIL_PORT';
+    /** Optional comma-separated canonical hostname list. */
+    readonly hostnames: 'COREMAIL_HOSTNAMES';
+    /** Optional MongoDB connection pool bound. */
+    readonly mongoDbMaxPoolSize: 'COREMAIL_MONGODB_MAX_POOL_SIZE';
+}>;
+/**
+ * The storage CoreMail 34 and later read, under the names its platform bindings deliver: the
+ * Corestore database binding's `MONGODB_URL` and `MONGODB_DATABASE`, the object-storage binding's
+ * `S3_ENDPOINT`, `S3_REGION` and `S3_BUCKET`, and that binding's `S3_ACCESS_KEY` and
+ * `S3_SECRET_KEY` secrets. They replace `COREMAIL_MONGODB_URL`, `COREMAIL_MONGODB_NAME`,
+ * `COREMAIL_STORAGE_DESCRIPTOR` and `COREMAIL_BUCKET_NAME`.
+ */
+export declare const coreMailStorageEnvironmentNames: Readonly<{
+    readonly databaseUrl: 'MONGODB_URL';
+    readonly databaseName: 'MONGODB_DATABASE';
+    readonly objectStorageEndpoint: 'S3_ENDPOINT';
+    readonly objectStorageRegion: 'S3_REGION';
+    readonly objectStorageBucket: 'S3_BUCKET';
+    readonly objectStorageAccessKey: 'S3_ACCESS_KEY';
+    readonly objectStorageSecretKey: 'S3_SECRET_KEY';
 }>;

package/dist_ts/data/coremail.js

@@ -100,5 +100,27 @@ export const coreMailRuntimeKeys = Object.freeze({
     controlBootstrap: 'COREMAIL_CONTROL_BOOTSTRAP',
     controlCredentialSecret: 'COREMAIL_CONTROL_CREDENTIAL_SECRET',
     gatewayCredentialSecret: 'COREMAIL_GATEWAY_CREDENTIAL',
+    /** Optional listener port inside the workload. */
+    port: 'COREMAIL_PORT',
+    /** Optional comma-separated canonical hostname list. */
+    hostnames: 'COREMAIL_HOSTNAMES',
+    /** Optional MongoDB connection pool bound. */
+    mongoDbMaxPoolSize: 'COREMAIL_MONGODB_MAX_POOL_SIZE',
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZW1haWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NvcmVtYWlsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7O0dBT0c7QUFxWUgsTUFBTSxDQUFDLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDMUMsbUJBQW1CLEVBQUUsRUFBRSxHQUFHLElBQUk7SUFDOUIsaUJBQWlCLEVBQUUsQ0FBQyxHQUFHLElBQUksR0FBRyxJQUFJO0lBQ2xDLGFBQWEsRUFBRSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUk7SUFDOUIsYUFBYSxFQUFFLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSTtJQUM5QixlQUFlLEVBQUUsRUFBRTtJQUNuQixlQUFlLEVBQUUsRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJO0lBQ2pDLHdCQUF3QixFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSTtJQUMxQyxnQkFBZ0IsRUFBRSxHQUFHLEdBQUcsSUFBSTtJQUM1QixtQkFBbUIsRUFBRSxFQUFFLEdBQUcsSUFBSSxHQUFHLElBQUk7SUFDckMsY0FBYyxFQUFFLEdBQUc7SUFDbkIsZUFBZSxFQUFFLEdBQUc7SUFDcEIsZ0JBQWdCLEVBQUUsRUFBRSxHQUFHLElBQUk7SUFDM0IsV0FBVyxFQUFFLEtBQUs7SUFDbEIseUJBQXlCLEVBQUUsRUFBRTtJQUM3QixrQkFBa0IsRUFBRSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDakMsa0JBQWtCLEVBQUUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJO0lBQ2pDLHVCQUF1QixFQUFFLEVBQUUsR0FBRyxJQUFJO0lBQ2xDLHFCQUFxQixFQUFFLEVBQUUsR0FBRyxJQUFJO0lBQ2hDLHdCQUF3QixFQUFFLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSTtDQUMvQixDQUFDLENBQUM7QUFFWixNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3ZELE1BQU0sRUFBRSxlQUF3QjtJQUNoQyxZQUFZLEVBQUUsRUFBRTtJQUNoQixpQkFBaUIsRUFBRSxFQUFFO0NBQ3RCLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDM0QsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDcEIsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDdEIsbUNBQW1DO1lBQ25DLG1DQUFtQztZQUNuQyxvQ0FBb0M7WUFDcEMsb0NBQW9DO1lBQ3BDLCtCQUErQjtTQUNPLENBQUM7UUFDekMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDckIsK0JBQStCO1lBQy9CLDZCQUE2QjtZQUM3Qiw4QkFBOEI7WUFDOUIsb0NBQW9DO1NBQ0UsQ0FBQztLQUMxQyxDQUFDO0lBQ0YsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDdEIsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDdEIsK0JBQStCO1NBQ08sQ0FBQztRQUN6QyxPQUFPLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNyQiwrQkFBK0I7WUFDL0IsNkJBQTZCO1lBQzdCLDhCQUE4QjtZQUM5QixvQ0FBb0M7U0FDRSxDQUFDO0tBQzFDLENBQUM7SUFDRixRQUFRLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQztRQUN0QixRQUFRLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUF5QyxDQUFDO1FBQ2xFLE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQXlDLENBQUM7S0FDbEUsQ0FBQztDQUNILENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbkQsa0JBQWtCLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDNUMscUJBQXFCLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDL0Msb0JBQW9CLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDOUMsbUJBQW1CLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSTtJQUN4QyxzQkFBc0IsRUFBRSxLQUFjO0NBQ3ZDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDL0MsT0FBTyxFQUFFLDBCQUFtQztJQUM1QyxZQUFZLEVBQUUsa0NBQTJDO0lBQ3pELDBCQUEwQixFQUFFLEtBQWM7SUFDMUMsb0JBQW9CLEVBQUUsQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLFNBQVMsQ0FBVTtJQUNqRSxrQ0FBa0MsRUFBRSxJQUFhO0NBQ2xELENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDcEQsVUFBVSxFQUFFLGFBQWE7SUFDekIsbUJBQW1CLEVBQUUsUUFBUTtJQUM3QixnQkFBZ0IsRUFBRSxHQUFHO0lBQ3JCLGdCQUFnQixFQUFFLEdBQUc7SUFDckIsb0JBQW9CLEVBQUUsSUFBSTtJQUMxQixrQkFBa0IsRUFBRSxJQUFJO0lBQ3hCLGVBQWUsRUFBRSwrQkFBd0M7Q0FDMUQsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM1RCxNQUFNLEVBQUUsVUFBbUI7SUFDM0IsT0FBTyxFQUFFLEVBQUU7SUFDWCxVQUFVLEVBQUUsTUFBTTtJQUNsQixRQUFRLEVBQUUsQ0FBQztJQUNYLFdBQVcsRUFBRSxDQUFDO0lBQ2QsZUFBZSxFQUFFLEVBQUU7SUFDbkIsZUFBZSxFQUFFLEVBQUU7Q0FDWCxDQUFDLENBQUM7QUFFWixNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQy9DLGdCQUFnQixFQUFFLDRCQUE0QjtJQUM5Qyx1QkFBdUIsRUFBRSxvQ0FBb0M7SUFDN0QsdUJBQXVCLEVBQUUsNkJBQTZCO0NBQzlDLENBQUMsQ0FBQyJ9
+/**
+ * The storage CoreMail 34 and later read, under the names its platform bindings deliver: the
+ * Corestore database binding's `MONGODB_URL` and `MONGODB_DATABASE`, the object-storage binding's
+ * `S3_ENDPOINT`, `S3_REGION` and `S3_BUCKET`, and that binding's `S3_ACCESS_KEY` and
+ * `S3_SECRET_KEY` secrets. They replace `COREMAIL_MONGODB_URL`, `COREMAIL_MONGODB_NAME`,
+ * `COREMAIL_STORAGE_DESCRIPTOR` and `COREMAIL_BUCKET_NAME`.
+ */
+export const coreMailStorageEnvironmentNames = Object.freeze({
+    databaseUrl: 'MONGODB_URL',
+    databaseName: 'MONGODB_DATABASE',
+    objectStorageEndpoint: 'S3_ENDPOINT',
+    objectStorageRegion: 'S3_REGION',
+    objectStorageBucket: 'S3_BUCKET',
+    objectStorageAccessKey: 'S3_ACCESS_KEY',
+    objectStorageSecretKey: 'S3_SECRET_KEY',
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZW1haWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NvcmVtYWlsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7O0dBT0c7QUFzWkgsTUFBTSxDQUFDLE1BQU0sY0FBYyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDMUMsbUJBQW1CLEVBQUUsRUFBRSxHQUFHLElBQUk7SUFDOUIsaUJBQWlCLEVBQUUsQ0FBQyxHQUFHLElBQUksR0FBRyxJQUFJO0lBQ2xDLGFBQWEsRUFBRSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUk7SUFDOUIsYUFBYSxFQUFFLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSTtJQUM5QixlQUFlLEVBQUUsRUFBRTtJQUNuQixlQUFlLEVBQUUsRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJO0lBQ2pDLHdCQUF3QixFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSTtJQUMxQyxnQkFBZ0IsRUFBRSxHQUFHLEdBQUcsSUFBSTtJQUM1QixtQkFBbUIsRUFBRSxFQUFFLEdBQUcsSUFBSSxHQUFHLElBQUk7SUFDckMsY0FBYyxFQUFFLEdBQUc7SUFDbkIsZUFBZSxFQUFFLEdBQUc7SUFDcEIsZ0JBQWdCLEVBQUUsRUFBRSxHQUFHLElBQUk7SUFDM0IsV0FBVyxFQUFFLEtBQUs7SUFDbEIseUJBQXlCLEVBQUUsRUFBRTtJQUM3QixrQkFBa0IsRUFBRSxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDakMsa0JBQWtCLEVBQUUsQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJO0lBQ2pDLHVCQUF1QixFQUFFLEVBQUUsR0FBRyxJQUFJO0lBQ2xDLHFCQUFxQixFQUFFLEVBQUUsR0FBRyxJQUFJO0lBQ2hDLHdCQUF3QixFQUFFLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSTtDQUMvQixDQUFDLENBQUM7QUFFWixNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3ZELE1BQU0sRUFBRSxlQUF3QjtJQUNoQyxZQUFZLEVBQUUsRUFBRTtJQUNoQixpQkFBaUIsRUFBRSxFQUFFO0NBQ3RCLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDM0QsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDcEIsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDdEIsbUNBQW1DO1lBQ25DLG1DQUFtQztZQUNuQyxvQ0FBb0M7WUFDcEMsb0NBQW9DO1lBQ3BDLCtCQUErQjtTQUNPLENBQUM7UUFDekMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDckIsK0JBQStCO1lBQy9CLDZCQUE2QjtZQUM3Qiw4QkFBOEI7WUFDOUIsb0NBQW9DO1NBQ0UsQ0FBQztLQUMxQyxDQUFDO0lBQ0YsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDdEIsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDdEIsK0JBQStCO1NBQ08sQ0FBQztRQUN6QyxPQUFPLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNyQiwrQkFBK0I7WUFDL0IsNkJBQTZCO1lBQzdCLDhCQUE4QjtZQUM5QixvQ0FBb0M7U0FDRSxDQUFDO0tBQzFDLENBQUM7SUFDRixRQUFRLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQztRQUN0QixRQUFRLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUF5QyxDQUFDO1FBQ2xFLE9BQU8sRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQXlDLENBQUM7S0FDbEUsQ0FBQztDQUNILENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbkQsa0JBQWtCLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDNUMscUJBQXFCLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDL0Msb0JBQW9CLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDOUMsbUJBQW1CLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSTtJQUN4QyxzQkFBc0IsRUFBRSxLQUFjO0NBQ3ZDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDL0MsT0FBTyxFQUFFLDBCQUFtQztJQUM1QyxZQUFZLEVBQUUsa0NBQTJDO0lBQ3pELDBCQUEwQixFQUFFLEtBQWM7SUFDMUMsb0JBQW9CLEVBQUUsQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLFNBQVMsQ0FBVTtJQUNqRSxrQ0FBa0MsRUFBRSxJQUFhO0NBQ2xELENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDcEQsVUFBVSxFQUFFLGFBQWE7SUFDekIsbUJBQW1CLEVBQUUsUUFBUTtJQUM3QixnQkFBZ0IsRUFBRSxHQUFHO0lBQ3JCLGdCQUFnQixFQUFFLEdBQUc7SUFDckIsb0JBQW9CLEVBQUUsSUFBSTtJQUMxQixrQkFBa0IsRUFBRSxJQUFJO0lBQ3hCLGVBQWUsRUFBRSwrQkFBd0M7Q0FDMUQsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM1RCxNQUFNLEVBQUUsVUFBbUI7SUFDM0IsT0FBTyxFQUFFLEVBQUU7SUFDWCxVQUFVLEVBQUUsTUFBTTtJQUNsQixRQUFRLEVBQUUsQ0FBQztJQUNYLFdBQVcsRUFBRSxDQUFDO0lBQ2QsZUFBZSxFQUFFLEVBQUU7SUFDbkIsZUFBZSxFQUFFLEVBQUU7Q0FDWCxDQUFDLENBQUM7QUFFWixNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQy9DLGdCQUFnQixFQUFFLDRCQUE0QjtJQUM5Qyx1QkFBdUIsRUFBRSxvQ0FBb0M7SUFDN0QsdUJBQXVCLEVBQUUsNkJBQTZCO0lBQ3RELGtEQUFrRDtJQUNsRCxJQUFJLEVBQUUsZUFBZTtJQUNyQix3REFBd0Q7SUFDeEQsU0FBUyxFQUFFLG9CQUFvQjtJQUMvQiw4Q0FBOEM7SUFDOUMsa0JBQWtCLEVBQUUsZ0NBQWdDO0NBQzVDLENBQUMsQ0FBQztBQUVaOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDM0QsV0FBVyxFQUFFLGFBQWE7SUFDMUIsWUFBWSxFQUFFLGtCQUFrQjtJQUNoQyxxQkFBcUIsRUFBRSxhQUFhO0lBQ3BDLG1CQUFtQixFQUFFLFdBQVc7SUFDaEMsbUJBQW1CLEVBQUUsV0FBVztJQUNoQyxzQkFBc0IsRUFBRSxlQUFlO0lBQ3ZDLHNCQUFzQixFQUFFLGVBQWU7Q0FFOEUsQ0FBQyxDQUFDIn0=

package/dist_ts/data/coremail.runtime.d.ts

@@ -1,5 +1,6 @@
 import { type ICoreMailBindingCredentialVerifier, type ICoreMailControlBootstrap, type ICoreMailDesiredState, type ICoreMailDownloadGrant, type ICoreMailEnvelope, type ICoreMailErrorData, type ICoreMailGatewayMessageDescriptor, type ICoreMailGatewayOutboundStatus, type ICoreMailGatewayPeerDesiredState, type ICoreMailInboundDelivery, type ICoreMailInboundDeliveryPage, type ICoreMailOutboundMessageDescriptor, type ICoreMailRecipientResolution, type ICoreMailRuntimeKeyReference, type ICoreMailReconciliationStatus, type ICoreMailReplicaIdentity, type ICoreMailServiceMailStatistics, type ICoreMailSubmission, type ICoreMailTransferGrant, type ICoreMailUploadGrant, type TCoreMailCapability, type TCoreMailBindingState, type TCoreMailErrorCode, type TCoreMailSha256, type TCoreMailWorkloadOperation } from './coremail.js';
 import type { IMailConnectionInfo } from './mail.js';
+import { type IWorkloadReplicaIdentity } from './workloadreplicaidentity.js';
 export declare const coreMailCanonicalJsonRules: Readonly<{
     encoding: 'utf-8';
     objectKeyOrdering: 'utf-16-code-unit-ascending';
@@ -53,7 +54,15 @@ export declare const normalizeCoreMailInboundDelivery: (valueArg: unknown, pathA
 export declare const normalizeCoreMailInboundCursor: (valueArg: unknown, pathArg?: string) => string;
 export declare const normalizeCoreMailInboundDeliveryPage: (valueArg: unknown, pathArg?: string) => ICoreMailInboundDeliveryPage;
 export declare const normalizeCoreMailDesiredState: (valueArg: unknown) => ICoreMailDesiredState;
-export declare const normalizeCoreMailReplicaIdentity: (valueArg: unknown, pathArg?: string) => ICoreMailReplicaIdentity;
+/**
+ * The replica a CoreMail reports, read exactly as one of two closed shapes.
+ *
+ * CoreMail 34 and later report `IWorkloadReplicaIdentity`, the identity its runtime injects, and
+ * it is read by that contract's own rules (`validateWorkloadReplicaIdentity`). A CoreMail before
+ * 34 reports the deprecated `ICoreMailReplicaIdentity`, recognised by its `taskId`, and it is read
+ * as before. Neither shape admits a member of the other.
+ */
+export declare const normalizeCoreMailReplicaIdentity: (valueArg: unknown, pathArg?: string) => IWorkloadReplicaIdentity | ICoreMailReplicaIdentity;
 export declare const normalizeCoreMailReconciliationStatus: (valueArg: unknown, pathArg?: string) => ICoreMailReconciliationStatus;
 export declare const canonicalizeCoreMailDesiredState: (valueArg: unknown) => string;
 export declare const createCoreMailDesiredStateDigest: (valueArg: unknown) => Promise<TCoreMailSha256>;