@serve.zone/interfaces 32.8.0 → 32.10.0

package/dist_ts/requests/runtimesession.d.ts

@@ -4,6 +4,7 @@ import type * as terminal from '../data/runtimeterminalreceipt.js';
 import type * as network from '../data/networkdelivery.js';
 import type * as protection from '../data/networkprotection.js';
 import type * as credential from '../data/networkcredential.js';
+import type * as assignmentSecret from '../runtime.assignmentsecret.js';
 /** Current-peer, exact-projection authorization; response contains secret keys. */
 export interface IReq_Pallet_Controller_GetRuntimeManagedVpnCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeManagedVpnCredential> {
     method: 'getRuntimeManagedVpnCredential';
@@ -82,6 +83,28 @@ export interface IReq_Pallet_Controller_GetRuntimeRegistryCredential extends plu
     request: data.IGetRuntimeRegistryCredentialRequest;
     response: data.IGetRuntimeRegistryCredentialResponse;
 }
+/** Current authenticated Pallet node only; serialized session is not authentication. */
+export interface IReq_Pallet_Controller_GetRuntimeSecretRecipientState extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeSecretRecipientState> {
+    method: 'getRuntimeSecretRecipientState';
+    request: assignmentSecret.IGetRuntimeSecretRecipientStateRequest;
+    response: assignmentSecret.IGetRuntimeSecretRecipientStateResponse;
+}
+export interface IReq_Pallet_Controller_BeginRuntimeSecretRecipientEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_BeginRuntimeSecretRecipientEnrollment> {
+    method: 'beginRuntimeSecretRecipientEnrollment';
+    request: assignmentSecret.IBeginRuntimeSecretRecipientEnrollmentRequest;
+    response: assignmentSecret.IBeginRuntimeSecretRecipientEnrollmentResponse;
+}
+export interface IReq_Pallet_Controller_CompleteRuntimeSecretRecipientEnrollment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_CompleteRuntimeSecretRecipientEnrollment> {
+    method: 'completeRuntimeSecretRecipientEnrollment';
+    request: assignmentSecret.ICompleteRuntimeSecretRecipientEnrollmentRequest;
+    response: assignmentSecret.ICompleteRuntimeSecretRecipientEnrollmentResponse;
+}
+/** Sealed material for one exact current generation-one run; exclude bodies from logs. */
+export interface IReq_Pallet_Controller_GetRuntimeAssignmentSecretMaterial extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeAssignmentSecretMaterial> {
+    method: 'getRuntimeAssignmentSecretMaterial';
+    request: assignmentSecret.IGetRuntimeAssignmentSecretMaterialRequest;
+    response: assignmentSecret.IGetRuntimeAssignmentSecretMaterialResponse;
+}
 /**
  * WSS-only JWT authentication; server-owned identity tag, never client-authored claims.
  *

package/dist_ts/runtime.assignmentsecret.d.ts

@@ -0,0 +1,151 @@
+import * as plugins from './plugins.js';
+import type { IActiveSecretRecipientMetadata, IResolvedSecretManifest, IResolvedSecretManifestReference, IRuntimeAssignmentReference, IRuntimeAuthorityReference, IRuntimeSessionBinding, TImmutableContainerPlatform, TSecretRecipientMetadata, TSha256Digest } from './data/index.js';
+import { type IWorkloadInitActiveApprovalAuthority, type IWorkloadInitApprovalAuthorityReference, type IWorkloadInitApprovedArtifact } from './runtime.workloadinit.js';
+/**
+ * Content contracts only. Authentication of the physical peer, current session,
+ * node credential and slot, recipient-generation CAS, accepted manifest/version
+ * retention, challenge consumption and material issuance are Cloudly-owned.
+ */
+export declare const runtimeAssignmentSecretContract: Readonly<{
+    readonly descriptorDomain: "serve.zone/runtime-assignment-secret-authority";
+    readonly maximumRequestBytes: 327680;
+    readonly maximumMaterialBytes: number;
+    readonly error: "Runtime assignment secret contract rejected.";
+}>;
+export interface IRuntimeAssignmentSecretLauncher {
+    approval: IWorkloadInitApprovalAuthorityReference;
+    artifact: IWorkloadInitApprovedArtifact;
+}
+/**
+ * Value-free descriptor hashed BEFORE the assignment is sealed. Its manifest is
+ * already independently hashed; neither digest contains the assignment digest.
+ */
+export interface IRuntimeAssignmentSecretAuthority extends IRuntimeAuthorityReference {
+    organizationId: string;
+    serviceId: string;
+    platform: TImmutableContainerPlatform;
+    manifest: IResolvedSecretManifestReference;
+    workloadInit: IRuntimeAssignmentSecretLauncher | null;
+}
+export declare const snapshotRuntimeAssignmentSecretAuthority: (valueArg: unknown) => IRuntimeAssignmentSecretAuthority;
+export declare const computeRuntimeAssignmentSecretAuthorityDigest: (authorityArg: IRuntimeAssignmentSecretAuthority) => Promise<TSha256Digest>;
+export declare const validateRuntimeAssignmentSecretAuthority: (valueArg: unknown) => Promise<string[]>;
+/** Producer creates this before assignment digest computation. */
+export declare const createRuntimeAssignmentSecretAuthority: (manifestArg: unknown, platformArg: TImmutableContainerPlatform, workloadInitArg: IRuntimeAssignmentSecretLauncher | null) => Promise<IRuntimeAssignmentSecretAuthority>;
+/** Trusted manifest/config are required: the reference alone is no authorization. */
+export declare const bindRuntimeAssignmentSecretAuthority: (authorityArg: unknown, manifestArg: unknown, assignmentArg: unknown, configArg: unknown, trustedClusterIdArg: string) => Promise<IRuntimeAssignmentSecretAuthority>;
+export interface IRuntimeSecretRecipientState {
+    nodeId: string;
+    generation: number;
+    recipients: TSecretRecipientMetadata[];
+}
+export interface IGetRuntimeSecretRecipientStateRequest {
+    session: IRuntimeSessionBinding;
+}
+export interface IGetRuntimeSecretRecipientStateResponse {
+    state: IRuntimeSecretRecipientState;
+}
+export interface IBeginRuntimeSecretRecipientEnrollmentRequest {
+    session: IRuntimeSessionBinding;
+    proposedRecipientKeyId: string;
+    proposedPublicKey: string;
+    expectedGeneration: number;
+}
+export interface IRuntimeSecretRecipientEnrollmentChallenge {
+    session: IRuntimeSessionBinding;
+    enrollmentId: string;
+    recipientKeyId: string;
+    publicKey: string;
+    generation: number;
+    expiresAt: number;
+    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
+}
+export interface IBeginRuntimeSecretRecipientEnrollmentResponse {
+    challenge: IRuntimeSecretRecipientEnrollmentChallenge;
+}
+export interface ICompleteRuntimeSecretRecipientEnrollmentRequest {
+    session: IRuntimeSessionBinding;
+    enrollmentId: string;
+    expectedGeneration: number;
+    /** Canonical unpadded base64url encoding of the opened 32-byte challenge. */
+    response: string;
+}
+export interface ICompleteRuntimeSecretRecipientEnrollmentResponse {
+    recipient: IActiveSecretRecipientMetadata;
+}
+export declare const snapshotRuntimeSecretRecipientState: (valueArg: unknown) => IRuntimeSecretRecipientState;
+export declare const bindGetRuntimeSecretRecipientStateRequest: (valueArg: unknown, trustedSessionArg: unknown) => IGetRuntimeSecretRecipientStateRequest;
+export declare const bindGetRuntimeSecretRecipientStateResponse: (valueArg: unknown, requestArg: unknown) => IGetRuntimeSecretRecipientStateResponse;
+export declare const bindBeginRuntimeSecretRecipientEnrollmentRequest: (valueArg: unknown, trustedSessionArg: unknown, currentStateArg: unknown) => IBeginRuntimeSecretRecipientEnrollmentRequest;
+/** Use the existing SmartCrypto X25519 envelope and one-time challenge proof. */
+export declare const createRuntimeSecretRecipientEnrollmentChallengeContext: (challengeArg: Omit<IRuntimeSecretRecipientEnrollmentChallenge, "envelope">) => Uint8Array;
+export declare const bindBeginRuntimeSecretRecipientEnrollmentResponse: (valueArg: unknown, requestArg: unknown, trustedSessionArg: unknown, nowArg: number) => Promise<IBeginRuntimeSecretRecipientEnrollmentResponse>;
+export declare const bindCompleteRuntimeSecretRecipientEnrollmentRequest: (valueArg: unknown, challengeArg: unknown, trustedSessionArg: unknown, nowArg: number) => Promise<ICompleteRuntimeSecretRecipientEnrollmentRequest>;
+export declare const bindCompleteRuntimeSecretRecipientEnrollmentResponse: (valueArg: unknown, challengeArg: unknown) => ICompleteRuntimeSecretRecipientEnrollmentResponse;
+export interface IGetRuntimeAssignmentSecretMaterialRequest {
+    session: IRuntimeSessionBinding;
+    /** Exact current generation-one run assignment, never a historical receipt. */
+    assignment: IRuntimeAssignmentReference;
+    secrets: IRuntimeAuthorityReference;
+    expectedRecipientKeyId: string;
+    expectedRecipientGeneration: number;
+}
+export interface ISealedRuntimeAssignmentSecretMaterialEntry {
+    secretVersionId: string;
+    envelope: plugins.smartcrypto.IX25519EnvelopeV1;
+}
+/** Sensitive ephemeral sealed material; exclude the complete body from hooks and logs. */
+export interface ISealedRuntimeAssignmentSecretMaterial {
+    assignment: IRuntimeAssignmentReference;
+    nodeId: string;
+    secrets: IRuntimeAuthorityReference;
+    recipientKeyId: string;
+    recipientGeneration: number;
+    authority: IRuntimeAssignmentSecretAuthority;
+    manifest: IResolvedSecretManifest;
+    /** Full approved immutable launcher authority, exactly when an entry needs it. */
+    workloadInit: IWorkloadInitActiveApprovalAuthority | null;
+    /** Sorted exact one-to-one coverage of the pinned manifest's versions. */
+    entries: ISealedRuntimeAssignmentSecretMaterialEntry[];
+}
+export interface IGetRuntimeAssignmentSecretMaterialResponse {
+    material: ISealedRuntimeAssignmentSecretMaterial;
+}
+/**
+ * The descriptor was hashed before assignment seal. This context binds each
+ * envelope to the final run digest, node and recipient generation afterwards.
+ * Use SmartCrypto sealX25519Envelope with these exact bytes.
+ */
+export declare const createRuntimeAssignmentSecretMaterialEnvelopeContext: (contextArg: {
+    recipientKeyId: string;
+    recipientGeneration: number;
+    organizationId: string;
+    clusterId: string;
+    serviceId: string;
+    nodeId: string;
+    assignment: IRuntimeAssignmentReference;
+    authorityDigest: TSha256Digest;
+    manifestId: string;
+    manifestDigest: TSha256Digest;
+    imageRolloutId: string;
+    imageRolloutGeneration: number;
+    requestedImageDigest: TSha256Digest;
+    invocationDigest: TSha256Digest;
+    secretRolloutId: string;
+    secretRolloutGeneration: number;
+    secretId: string;
+    secretVersionId: string;
+}) => Uint8Array;
+/**
+ * trustedSessionArg MUST be the current authenticated connection's server-owned
+ * binding; assignmentArg MUST be its current durable run. Content checks here
+ * do not prove either source, recipient possession, version issuance policy or
+ * the native workload's mount ownership.
+ */
+export declare const bindGetRuntimeAssignmentSecretMaterialRequest: (valueArg: unknown, assignmentArg: unknown, trustedSessionArg: unknown, activeRecipientArg: unknown) => Promise<IGetRuntimeAssignmentSecretMaterialRequest>;
+/**
+ * Verify one complete response without opening a private key. The caller must
+ * supply its authenticated current session, current assignment, pinned config,
+ * enrolled cluster and active recipient from their respective trusted owners.
+ */
+export declare const bindGetRuntimeAssignmentSecretMaterialResponse: (valueArg: unknown, requestArg: unknown, assignmentArg: unknown, configArg: unknown, trustedSessionArg: unknown, trustedClusterIdArg: string, activeRecipientArg: unknown) => Promise<IGetRuntimeAssignmentSecretMaterialResponse>;