# SDK configuration contract

Use portal-generated configuration and retain its identity and trust fields.

## Generated by the portal

Download the sigillum.sdk-config/2 configuration. Do not generate signed fields manually. Adding an application UUID to entryPoints does not extend the authorised signed scope.

## Configuration fields

| Field | Responsibility |
|---|---|
| formatVersion | Configuration generation |
| institutionId, environmentId, serviceId | Actual service scope |
| sourceToken | Service transfer credential |
| transferEndpoint | Internal HTTPS /api/transfer endpoint |
| rootCertificatePem | Installation CA trust; hostname validation still applies |
| custodyTrust | Durable receipt public key and pin |
| scopeTrust | Signed execution-scope verification key |
| contextKeyBase64 | Institution/environment propagation key |
| entryPoints | Actual entry points and signed scope |
| limits | Queue, timeout, retry and chunk limits |
| license | Product-issued institutional licence policy |
| localTransfer | Agent endpoint/token when the product agent is supplied |

Distribute the complete configuration as a secret. Never place real keys or tokens in examples.

## Runtime limits

Consult the language reference for JSON size, attachment and bounded-queue behaviour. Increasing a limit does not create unlimited memory or guarantee lossless delivery.