@serve.zone/interfaces 11.2.0 → 11.4.0

package/changelog.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 2026-07-19 - 11.4.0
+
+### Features
+
+- define least-privilege greenfield deployment preflight contracts (deployment)
+  - Add server-persisted, service-scoped machine capabilities without broad cluster authority.
+  - Define sanitized GO/NO-GO inventory for OCI indexes, runtime digests, Corestore bindings, and namespace collisions.
+  - Bind release evidence and future durable operations to source, version, image, configuration, and namespace digests.
+
+### Maintenance
+
+- replace the broken pnpm 11.13.0 executable pin with pnpm 11.15.0.
+
+## 2026-07-18 - 11.3.0
+
+### Features
+
+- define fail-closed immutable image deployment and runtime evidence contracts (deployment)
+  - Separate observed registry releases, accepted digest rollouts, and exact-digest rollback plans.
+  - Require task-derived Docker runtime evidence and complete healthy replica reports before rollout success.
+  - Add idempotent promotion, compare-and-swap rollback, capability, ordering, and mismatch contracts.
+
 ## 2026-07-15 - 11.2.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '11.2.0',
+    version: '11.4.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/deployment.d.ts

@@ -1,3 +1,4 @@
+import type { IRuntimeImageEvidence } from './immutableimage.js';
 /**
  * a deployment happens when a service is deployed
  * tracks the status of a deployment
@@ -28,6 +29,11 @@ export interface IDeployment {
     slot?: number;
     /** Docker desired state for this task/deployment. */
     desiredState?: string;
+    /** Immutable rollout generation represented by this task, when applicable. */
+    rolloutId?: string;
+    rolloutGeneration?: number;
+    /** Evidence derived from Docker runtime state rather than service intent metadata. */
+    runtimeImageEvidence?: IRuntimeImageEvidence;
     /**
      * Image used for this deployment
      */

package/dist_ts/data/deploymentpreflight.d.ts

@@ -0,0 +1,142 @@
+import type { TOciManifestMediaType, TSha256Digest } from './immutableimage.js';
+import type { TServiceDeploymentCapability } from './user.js';
+export type TDeploymentPreflightDecision = 'GO' | 'NO-GO';
+export type TDeploymentPreflightBlockerCode = 'INVALID_REQUEST' | 'AUTHORIZATION_MISSING' | 'SOURCE_REVISION_INVALID' | 'VERSION_NOT_RESERVED' | 'VERSION_COLLISION' | 'NAMESPACE_NOT_RESERVED' | 'NAMESPACE_COLLISION' | 'NAMESPACE_NOT_PROVEN_BLANK' | 'CONFIGURATION_DIGEST_INVALID' | 'CURRENT_REFERENCE_MUTABLE' | 'CURRENT_RUNTIME_DIGEST_MISSING' | 'OCI_INDEX_DIGEST_REQUIRED' | 'OCI_INDEX_NOT_FOUND' | 'OCI_INDEX_MEDIA_TYPE_REQUIRED' | 'OCI_PLATFORM_MISSING' | 'OCI_PLATFORM_MANIFEST_MISSING' | 'IMMUTABLE_RELEASE_TAG_REQUIRED' | 'IMMUTABLE_RELEASE_TAG_NOT_RESERVED' | 'RELEASE_EVIDENCE_MISSING' | 'RELEASE_EVIDENCE_INVALID' | 'RELEASE_NOT_AUTHORIZED' | 'GREENFIELD_EXECUTION_UNAVAILABLE' | 'ROUTE_PROMOTION_FENCE_UNAVAILABLE' | 'POST_DEPLOYMENT_VERIFICATION_UNAVAILABLE' | 'WOULD_REPLACE_EXISTING_STATE' | 'CORESTORE_INVENTORY_UNAVAILABLE' | 'RUNTIME_ATTESTATION_MISMATCH';
+export interface IDeploymentPreflightBlocker {
+    code: TDeploymentPreflightBlockerCode;
+    message: string;
+}
+export interface IDeploymentPreflightAuthorizationCheck {
+    capability: TServiceDeploymentCapability;
+    granted: boolean;
+}
+export interface IOciPlatformDescriptorSummary {
+    os: string;
+    architecture: string;
+    digest?: TSha256Digest;
+    mediaType?: string;
+    runnable: boolean;
+    manifestPresent: boolean;
+}
+export interface IDeploymentPreflightRuntimeTask {
+    deploymentId: string;
+    nodeName?: string;
+    status: string;
+    healthStatus?: string;
+    imageReference?: string;
+    reportedDigest?: TSha256Digest;
+    verificationStatus?: 'not-required' | 'pending' | 'verified' | 'missing' | 'mismatched';
+}
+export interface IDeploymentPreflightPlatformBinding {
+    capability: 'database' | 'objectstorage';
+    desiredState: 'enabled' | 'disabled';
+    status: 'requested' | 'provisioning' | 'ready' | 'degraded' | 'failed' | 'disabled';
+}
+export interface IDeploymentPreflightCorestoreResource {
+    capability: 'database' | 'objectstorage';
+    provider: string;
+    resourceName: string;
+}
+export interface IDeploymentReleaseEvidenceReference {
+    kind: 'provenance' | 'sbom' | 'signature' | 'vulnerability-policy' | 'release-authorization';
+    statementDigest: TSha256Digest;
+    subjectDigest: TSha256Digest;
+    verifier: string;
+    verifiedAt: number;
+}
+/** Evidence is descriptive input until a trusted Cloudly verifier validates it. */
+export interface IDeploymentReleaseEvidence {
+    sourceRevision: string;
+    version: string;
+    configurationDigest: TSha256Digest;
+    ociIndexDigest: TSha256Digest;
+    releaseAuthorized: boolean;
+    attestations: IDeploymentReleaseEvidenceReference[];
+}
+export interface IDeploymentPreflightRequestData {
+    requestId: string;
+    serviceId: string;
+    sourceRevision: string;
+    version: string;
+    configurationDigest: string;
+    proposedNamespace: string;
+    ociIndexDigest?: string;
+    releaseTag?: string;
+    releaseEvidence?: IDeploymentReleaseEvidence;
+    greenfield: true;
+}
+export interface IDeploymentPreflightReport {
+    schemaVersion: 1;
+    decision: TDeploymentPreflightDecision;
+    mutationPerformed: false;
+    generatedAt: number;
+    service: {
+        serviceId: string;
+        serviceName: string;
+        workspaceIdentity: string;
+        registryRepository: string;
+        deployOnPush: boolean;
+    };
+    source: {
+        revision: string;
+        version: string;
+        configurationDigest?: TSha256Digest;
+    };
+    currentImage: {
+        tag?: string;
+        digest?: TSha256Digest;
+        imageReference?: string;
+        mutableReference: boolean;
+        mediaType?: TOciManifestMediaType;
+        platforms: IOciPlatformDescriptorSummary[];
+    };
+    requestedImage: {
+        digest?: TSha256Digest;
+        releaseTag?: string;
+        tagReserved: boolean;
+        mediaType?: TOciManifestMediaType;
+        platforms: IOciPlatformDescriptorSummary[];
+    };
+    runtimeTasks: IDeploymentPreflightRuntimeTask[];
+    platformBindings: IDeploymentPreflightPlatformBinding[];
+    corestoreResources: IDeploymentPreflightCorestoreResource[];
+    proposed: {
+        namespace: string;
+        namespaceReserved: boolean;
+        namespaceBlank: boolean;
+        versionReserved: boolean;
+        wouldReplaceExistingState: boolean;
+    };
+    authorizationChecks: IDeploymentPreflightAuthorizationCheck[];
+    compatibilityBlockers: IDeploymentPreflightBlocker[];
+}
+export interface IGreenfieldDeploymentFence {
+    sourceServiceId: string;
+    sourceRevision: string;
+    version: string;
+    ociIndexDigest: TSha256Digest;
+    configurationDigest: TSha256Digest;
+    targetNamespace: string;
+}
+export interface IGreenfieldDeploymentOperation {
+    id: string;
+    data: {
+        idempotencyKey: string;
+        requestDigest: TSha256Digest;
+        fence: IGreenfieldDeploymentFence;
+        candidateServiceId?: string;
+        state: 'reserved' | 'provisioning' | 'deploying' | 'verifying' | 'ready-for-promotion' | 'promoting' | 'promoted' | 'rolling-back' | 'rolled-back' | 'failed';
+        routeGeneration?: number;
+        createdAt: number;
+        updatedAt: number;
+        failureCode?: string;
+    };
+}
+export declare const validateDeploymentPreflightRequest: (requestArg: unknown) => IDeploymentPreflightBlocker[];
+export declare const validateDeploymentReleaseEvidence: (argsArg: {
+    evidence: unknown;
+    sourceRevision: string;
+    version: string;
+    configurationDigest: TSha256Digest;
+    ociIndexDigest: TSha256Digest;
+}) => IDeploymentPreflightBlocker[];

package/dist_ts/data/deploymentpreflight.js

@@ -0,0 +1,93 @@
+import { normalizeSha256Digest } from './immutableimage.js';
+const fullGitRevisionRegex = /^[a-f0-9]{40}$/;
+const namespaceRegex = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const requiredEvidenceKinds = new Set([
+    'provenance',
+    'sbom',
+    'signature',
+    'vulnerability-policy',
+    'release-authorization',
+]);
+const isRecord = (valueArg) => Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg);
+export const validateDeploymentPreflightRequest = (requestArg) => {
+    const blockers = [];
+    if (!isRecord(requestArg)) {
+        return [{ code: 'INVALID_REQUEST', message: 'Deployment preflight request must be an object.' }];
+    }
+    if (typeof requestArg.requestId !== 'string' || !requestArg.requestId.trim() || requestArg.requestId.length > 200) {
+        blockers.push({ code: 'INVALID_REQUEST', message: 'A bounded request identifier is required.' });
+    }
+    if (typeof requestArg.serviceId !== 'string' || !requestArg.serviceId.trim() || requestArg.serviceId.length > 200) {
+        blockers.push({ code: 'INVALID_REQUEST', message: 'A bounded service identifier is required.' });
+    }
+    if (typeof requestArg.sourceRevision !== 'string' || !fullGitRevisionRegex.test(requestArg.sourceRevision)) {
+        blockers.push({ code: 'SOURCE_REVISION_INVALID', message: 'Source revision must be a full lower-case Git commit SHA.' });
+    }
+    if (typeof requestArg.version !== 'string' || !requestArg.version.trim() || requestArg.version.length > 100) {
+        blockers.push({ code: 'VERSION_NOT_RESERVED', message: 'A bounded release version is required.' });
+    }
+    if (typeof requestArg.proposedNamespace !== 'string' || !namespaceRegex.test(requestArg.proposedNamespace)) {
+        blockers.push({ code: 'NAMESPACE_NOT_RESERVED', message: 'The proposed namespace is missing or malformed.' });
+    }
+    if (typeof requestArg.configurationDigest !== 'string' || !normalizeSha256Digest(requestArg.configurationDigest)) {
+        blockers.push({ code: 'CONFIGURATION_DIGEST_INVALID', message: 'Configuration digest must be a canonical sha256 digest.' });
+    }
+    if (requestArg.ociIndexDigest !== undefined
+        && (typeof requestArg.ociIndexDigest !== 'string' || !normalizeSha256Digest(requestArg.ociIndexDigest))) {
+        blockers.push({ code: 'OCI_INDEX_DIGEST_REQUIRED', message: 'OCI index digest must be a canonical sha256 digest.' });
+    }
+    if (requestArg.greenfield !== true) {
+        blockers.push({ code: 'WOULD_REPLACE_EXISTING_STATE', message: 'Only greenfield deployment preflight is supported.' });
+    }
+    return blockers;
+};
+export const validateDeploymentReleaseEvidence = (argsArg) => {
+    const blockers = [];
+    if (!isRecord(argsArg.evidence)) {
+        return [{ code: 'RELEASE_EVIDENCE_INVALID', message: 'Release evidence must be an object.' }];
+    }
+    const evidence = argsArg.evidence;
+    if (evidence.releaseAuthorized !== true) {
+        blockers.push({ code: 'RELEASE_NOT_AUTHORIZED', message: 'Release authorization evidence is explicitly false.' });
+    }
+    if (evidence.sourceRevision !== argsArg.sourceRevision
+        || evidence.version !== argsArg.version
+        || evidence.configurationDigest !== argsArg.configurationDigest
+        || evidence.ociIndexDigest !== argsArg.ociIndexDigest) {
+        blockers.push({ code: 'RELEASE_EVIDENCE_INVALID', message: 'Release evidence is not bound to the requested deployment fence.' });
+    }
+    const seenKinds = new Set();
+    const attestations = Array.isArray(evidence.attestations) ? evidence.attestations : [];
+    if (!Array.isArray(evidence.attestations)) {
+        blockers.push({ code: 'RELEASE_EVIDENCE_INVALID', message: 'Release attestations must be an array.' });
+    }
+    for (const attestation of attestations) {
+        if (!isRecord(attestation)) {
+            blockers.push({ code: 'RELEASE_EVIDENCE_INVALID', message: 'Release attestation must be an object.' });
+            continue;
+        }
+        const kind = attestation.kind;
+        if (typeof kind !== 'string' || !requiredEvidenceKinds.has(kind)) {
+            blockers.push({ code: 'RELEASE_EVIDENCE_INVALID', message: 'Release attestation kind is invalid.' });
+            continue;
+        }
+        seenKinds.add(kind);
+        if (attestation.subjectDigest !== argsArg.ociIndexDigest
+            || typeof attestation.statementDigest !== 'string'
+            || !normalizeSha256Digest(attestation.statementDigest)
+            || typeof attestation.verifier !== 'string'
+            || !attestation.verifier.trim()
+            || typeof attestation.verifiedAt !== 'number'
+            || !Number.isSafeInteger(attestation.verifiedAt)
+            || attestation.verifiedAt < 1) {
+            blockers.push({ code: 'RELEASE_EVIDENCE_INVALID', message: `Invalid ${kind} evidence.` });
+        }
+    }
+    for (const requiredKind of requiredEvidenceKinds) {
+        if (!seenKinds.has(requiredKind)) {
+            blockers.push({ code: 'RELEASE_EVIDENCE_MISSING', message: `Missing ${requiredKind} evidence.` });
+        }
+    }
+    return blockers;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudHByZWZsaWdodC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudHByZWZsaWdodC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFJQSxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQTBMNUQsTUFBTSxvQkFBb0IsR0FBRyxnQkFBZ0IsQ0FBQztBQUM5QyxNQUFNLGNBQWMsR0FBRyx3Q0FBd0MsQ0FBQztBQUNoRSxNQUFNLHFCQUFxQixHQUFHLElBQUksR0FBRyxDQUE4QztJQUNqRixZQUFZO0lBQ1osTUFBTTtJQUNOLFdBQVc7SUFDWCxzQkFBc0I7SUFDdEIsdUJBQXVCO0NBQ3hCLENBQUMsQ0FBQztBQUVILE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUMxRSxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUVoRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUNoRCxVQUFtQixFQUNZLEVBQUU7SUFDakMsTUFBTSxRQUFRLEdBQWtDLEVBQUUsQ0FBQztJQUNuRCxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxpREFBaUQsRUFBRSxDQUFDLENBQUM7SUFDbkcsQ0FBQztJQUNELElBQUksT0FBTyxVQUFVLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLElBQUksVUFBVSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7UUFDbEgsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsMkNBQTJDLEVBQUUsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxJQUFJLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQ2xILFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDJDQUEyQyxFQUFFLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQzNHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsT0FBTyxFQUFFLDJEQUEyRCxFQUFFLENBQUMsQ0FBQztJQUMzSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsSUFBSSxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUM1RyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLE9BQU8sRUFBRSx3Q0FBd0MsRUFBRSxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELElBQUksT0FBTyxVQUFVLENBQUMsaUJBQWlCLEtBQUssUUFBUSxJQUFJLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO1FBQzNHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsT0FBTyxFQUFFLGlEQUFpRCxFQUFFLENBQUMsQ0FBQztJQUNoSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxtQkFBbUIsS0FBSyxRQUFRLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQ2pILFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsOEJBQThCLEVBQUUsT0FBTyxFQUFFLHlEQUF5RCxFQUFFLENBQUMsQ0FBQztJQUM5SCxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsY0FBYyxLQUFLLFNBQVM7V0FDdEMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMxRyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDJCQUEyQixFQUFFLE9BQU8sRUFBRSxxREFBcUQsRUFBRSxDQUFDLENBQUM7SUFDdkgsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNuQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDhCQUE4QixFQUFFLE9BQU8sRUFBRSxvREFBb0QsRUFBRSxDQUFDLENBQUM7SUFDekgsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsT0FNakQsRUFBaUMsRUFBRTtJQUNsQyxNQUFNLFFBQVEsR0FBa0MsRUFBRSxDQUFDO0lBQ25ELElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUM7SUFDbEMsSUFBSSxRQUFRLENBQUMsaUJBQWlCLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDeEMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSx3QkFBd0IsRUFBRSxPQUFPLEVBQUUscURBQXFELEVBQUUsQ0FBQyxDQUFDO0lBQ3BILENBQUM7SUFDRCxJQUNFLFFBQVEsQ0FBQyxjQUFjLEtBQUssT0FBTyxDQUFDLGNBQWM7V0FDL0MsUUFBUSxDQUFDLE9BQU8sS0FBSyxPQUFPLENBQUMsT0FBTztXQUNwQyxRQUFRLENBQUMsbUJBQW1CLEtBQUssT0FBTyxDQUFDLG1CQUFtQjtXQUM1RCxRQUFRLENBQUMsY0FBYyxLQUFLLE9BQU8sQ0FBQyxjQUFjLEVBQ3JELENBQUM7UUFDRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxrRUFBa0UsRUFBRSxDQUFDLENBQUM7SUFDbkksQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUErQyxDQUFDO0lBQ3pFLE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDdkYsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDMUMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsd0NBQXdDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7SUFDRCxLQUFLLE1BQU0sV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMzQixRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSx3Q0FBd0MsRUFBRSxDQUFDLENBQUM7WUFDdkcsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxXQUFXLENBQUMsSUFBSSxDQUFDO1FBQzlCLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLENBQUMscUJBQXFCLENBQUMsR0FBRyxDQUFDLElBQW1ELENBQUMsRUFBRSxDQUFDO1lBQ2hILFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLHNDQUFzQyxFQUFFLENBQUMsQ0FBQztZQUNyRyxTQUFTO1FBQ1gsQ0FBQztRQUNELFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBbUQsQ0FBQyxDQUFDO1FBQ25FLElBQ0UsV0FBVyxDQUFDLGFBQWEsS0FBSyxPQUFPLENBQUMsY0FBYztlQUNqRCxPQUFPLFdBQVcsQ0FBQyxlQUFlLEtBQUssUUFBUTtlQUMvQyxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQUM7ZUFDbkQsT0FBTyxXQUFXLENBQUMsUUFBUSxLQUFLLFFBQVE7ZUFDeEMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRTtlQUM1QixPQUFPLFdBQVcsQ0FBQyxVQUFVLEtBQUssUUFBUTtlQUMxQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQztlQUM3QyxXQUFXLENBQUMsVUFBVSxHQUFHLENBQUMsRUFDN0IsQ0FBQztZQUNELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLFdBQVcsSUFBSSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQzVGLENBQUM7SUFDSCxDQUFDO0lBQ0QsS0FBSyxNQUFNLFlBQVksSUFBSSxxQkFBcUIsRUFBRSxDQUFDO1FBQ2pELElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7WUFDakMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsV0FBVyxZQUFZLFlBQVksRUFBRSxDQUFDLENBQUM7UUFDcEcsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMifQ==

package/dist_ts/data/image.d.ts

@@ -1,4 +1,4 @@
-import type { IRegistryPushEvent } from './registry.js';
+import type { IImmutableRegistryPushEvent, IRegistryPushEvent } from './registry.js';
 export interface IImage {
     id: string;
     data: {
@@ -13,6 +13,8 @@ export interface IImage {
         versions: Array<{
             versionString: string;
             digest?: string;
+            releaseId?: string;
+            manifestMediaType?: string;
             registryRepository?: string;
             registryTag?: string;
             source?: 'upload' | 'registry';
@@ -20,6 +22,6 @@ export interface IImage {
             size: number;
             createdAt: number;
         }>;
-        lastPushEvent?: IRegistryPushEvent;
+        lastPushEvent?: IRegistryPushEvent | IImmutableRegistryPushEvent;
     };
 }

package/dist_ts/data/immutableimage.d.ts

@@ -0,0 +1,145 @@
+/** Canonical lower-case OCI sha256 digest. */
+export type TSha256Digest = `sha256:${string}`;
+export type TImageDeploymentPolicy = 'legacy-tag' | 'immutable-digest';
+export type TOciManifestMediaType = 'application/vnd.oci.image.index.v1+json' | 'application/vnd.oci.image.manifest.v1+json' | 'application/vnd.docker.distribution.manifest.list.v2+json' | 'application/vnd.docker.distribution.manifest.v2+json';
+export type TImmutableImageRolloutMode = 'promotion' | 'automatic' | 'rollback';
+export type TImmutableImageMismatchReason = 'immutable-plan-missing' | 'requested-digest-missing' | 'requested-digest-malformed' | 'registry-digest-inconsistent' | 'runtime-capability-missing' | 'pull-failed' | 'pulled-digest-missing' | 'pulled-digest-mismatch' | 'service-image-not-digest-pinned' | 'service-image-digest-mismatch' | 'task-image-not-digest-pinned' | 'task-image-digest-mismatch' | 'container-inspection-unavailable' | 'container-image-id-missing' | 'container-repodigest-missing' | 'container-repodigest-mismatch' | 'runtime-attestation-missing' | 'required-replica-missing' | 'replica-unhealthy' | 'replica-failed' | 'stale-rollout-report' | 'rollback-target-not-accepted';
+export type TRuntimeImageVerificationStatus = 'not-required' | 'pending' | 'verified' | 'missing' | 'mismatched';
+export type TImmutableImageRolloutStatus = 'pending' | 'deploying' | 'verifying' | 'succeeded' | 'failed' | 'mismatched' | 'rolling-back' | 'rolled-back';
+export interface ICoreflowRuntimeCapabilities {
+    immutableImageDeploymentVersion: 1;
+}
+/**
+ * A registry manifest observed by Cloudly. Observation alone does not make the
+ * release deployable: acceptedAt is set only by an explicit promotion or a
+ * configured automatic promotion.
+ */
+export interface IImageRelease {
+    id: string;
+    data: {
+        serviceId: string;
+        imageId: string;
+        registryHost: string;
+        repository: string;
+        /** Digest of the registry root descriptor, preserving an index/list when submitted. */
+        registryRootDigest: TSha256Digest;
+        digestPinnedImageReference: string;
+        manifestMediaType: TOciManifestMediaType;
+        observedTags: string[];
+        firstObservedAt: number;
+        lastObservedAt: number;
+        observationCount: number;
+        acceptedAt?: number;
+        lastPromotedAt?: number;
+        promotionCount?: number;
+    };
+}
+export interface IImmutableImageTargetScope {
+    targetClusterIds: string[];
+    targetNodeNames: string[];
+    replicasPerNode: number;
+    requiredReplicaCount: number;
+}
+/** Immutable desired state issued by Cloudly and consumed by Coreflow. */
+export interface IImmutableImageDeploymentPlan {
+    policy: 'immutable-digest';
+    rolloutId: string;
+    rolloutGeneration: number;
+    releaseId: string;
+    registryHost: string;
+    repository: string;
+    requestedDigest: TSha256Digest;
+    digestPinnedImageReference: string;
+    manifestMediaType: TOciManifestMediaType;
+    createdAt: number;
+    mode: TImmutableImageRolloutMode;
+    rollbackOfRolloutId?: string;
+    targetScope: IImmutableImageTargetScope;
+}
+/** Runtime evidence collected from Docker service, task, container and image state. */
+interface IRuntimeImageEvidenceBase {
+    rolloutId?: string;
+    rolloutGeneration?: number;
+    expectedDigest?: TSha256Digest;
+    serviceImageReference?: string;
+    taskImageReference?: string;
+    taskReportedDigest?: TSha256Digest;
+    containerImageId?: string;
+    containerConfigImageReference?: string;
+    resolvedDigest?: TSha256Digest;
+    platformManifestDigest?: TSha256Digest;
+    repoDigests?: string[];
+    evidenceSource?: 'task-spec' | 'local-container-inspect';
+    observedAt: number;
+}
+export interface IVerifiedRuntimeImageEvidence extends IRuntimeImageEvidenceBase {
+    verificationStatus: 'verified';
+    rolloutId: string;
+    rolloutGeneration: number;
+    expectedDigest: TSha256Digest;
+    serviceImageReference: string;
+    taskImageReference: string;
+    taskReportedDigest: TSha256Digest;
+    containerImageId: string;
+    containerConfigImageReference: string;
+    resolvedDigest: TSha256Digest;
+    repoDigests: string[];
+    evidenceSource: 'local-container-inspect';
+    mismatchReason?: never;
+}
+export interface IUnverifiedRuntimeImageEvidence extends IRuntimeImageEvidenceBase {
+    verificationStatus: 'missing' | 'mismatched';
+    mismatchReason: TImmutableImageMismatchReason;
+}
+export interface IPendingRuntimeImageEvidence extends IRuntimeImageEvidenceBase {
+    verificationStatus: 'pending' | 'not-required';
+    mismatchReason?: never;
+}
+export type IRuntimeImageEvidence = IVerifiedRuntimeImageEvidence | IUnverifiedRuntimeImageEvidence | IPendingRuntimeImageEvidence;
+/** Mandatory security envelope when reporting an immutable rollout. */
+export interface IImmutableRolloutReportEnvelope {
+    rolloutId: string;
+    rolloutGeneration: number;
+    reporterSessionId: string;
+    reportSequence: number;
+    reporterCapabilities: ICoreflowRuntimeCapabilities;
+    reporterNodeIds: string[];
+    reporterNodeNames: string[];
+}
+export interface IImageRolloutReporterStatus {
+    reporterId: string;
+    reporterSessionId: string;
+    clusterId: string;
+    reporterNodeNames: string[];
+    rolloutId: string;
+    rolloutGeneration: number;
+    reportSequence: number;
+    reportedAt: number;
+    requiredReplicaCount: number;
+    observedReplicaCount: number;
+    healthyReplicaCount: number;
+    verifiedReplicaCount: number;
+    failedReplicaCount: number;
+    mismatchReason?: TImmutableImageMismatchReason;
+}
+export interface IImageRolloutStatus {
+    rolloutId: string;
+    rolloutGeneration: number;
+    expectedDigest: TSha256Digest;
+    status: TImmutableImageRolloutStatus;
+    requiredReplicaCount: number;
+    observedReplicaCount: number;
+    healthyReplicaCount: number;
+    verifiedReplicaCount: number;
+    failedReplicaCount: number;
+    mismatchReason?: TImmutableImageMismatchReason;
+    updatedAt: number;
+    reporters: IImageRolloutReporterStatus[];
+}
+export declare const normalizeSha256Digest: (digest: string) => TSha256Digest | undefined;
+export declare const isSha256Digest: (digest: string) => digest is TSha256Digest;
+export declare const buildDigestPinnedImageReference: (registryHost: string, repository: string, digest: TSha256Digest) => string;
+export declare const getDigestFromPinnedImageReference: (imageReference: string) => TSha256Digest | undefined;
+export declare const validateImmutableImageDeploymentPlan: (planArg: IImmutableImageDeploymentPlan) => string[];
+export declare const validateImageRolloutStatus: (statusArg: IImageRolloutStatus) => string[];
+export {};

package/dist_ts/data/immutableimage.js

@@ -0,0 +1,146 @@
+const sha256DigestRegex = /^sha256:[a-f0-9]{64}$/;
+export const normalizeSha256Digest = (digest) => {
+    const normalizedDigest = digest.trim().toLowerCase();
+    return sha256DigestRegex.test(normalizedDigest)
+        ? normalizedDigest
+        : undefined;
+};
+export const isSha256Digest = (digest) => sha256DigestRegex.test(digest);
+const registryHostRegex = /^(?:localhost|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::[1-9][0-9]{0,4})?$/;
+const repositoryRegex = /^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
+export const buildDigestPinnedImageReference = (registryHost, repository, digest) => {
+    if (!registryHostRegex.test(registryHost) || !repositoryRegex.test(repository)) {
+        throw new Error('registry host and repository must be canonical OCI names');
+    }
+    if (!isSha256Digest(digest)) {
+        throw new Error('digest must be a canonical sha256 digest');
+    }
+    return `${registryHost}/${repository}@${digest}`;
+};
+export const getDigestFromPinnedImageReference = (imageReference) => {
+    const separatorIndex = imageReference.lastIndexOf('@');
+    if (separatorIndex < 0) {
+        return undefined;
+    }
+    return normalizeSha256Digest(imageReference.slice(separatorIndex + 1));
+};
+export const validateImmutableImageDeploymentPlan = (planArg) => {
+    const errors = [];
+    if (!Number.isSafeInteger(planArg.rolloutGeneration) || planArg.rolloutGeneration < 1) {
+        errors.push('rolloutGeneration must be a positive safe integer');
+    }
+    if (!Number.isSafeInteger(planArg.createdAt) || planArg.createdAt < 1) {
+        errors.push('createdAt must be a positive safe integer');
+    }
+    let expectedReference;
+    try {
+        expectedReference = buildDigestPinnedImageReference(planArg.registryHost, planArg.repository, planArg.requestedDigest);
+    }
+    catch (error) {
+        errors.push(error.message);
+    }
+    if (expectedReference && planArg.digestPinnedImageReference !== expectedReference) {
+        errors.push('digestPinnedImageReference does not match registry, repository and digest');
+    }
+    const scope = planArg.targetScope;
+    if (!Number.isSafeInteger(scope.replicasPerNode) || scope.replicasPerNode < 1) {
+        errors.push('replicasPerNode must be a positive safe integer');
+    }
+    if (scope.targetClusterIds.length < 1 || scope.targetNodeNames.length < 1) {
+        errors.push('immutable rollout target scope must contain clusters and nodes');
+    }
+    if (new Set(scope.targetClusterIds).size !== scope.targetClusterIds.length
+        || new Set(scope.targetNodeNames).size !== scope.targetNodeNames.length) {
+        errors.push('immutable rollout target scope must not contain duplicates');
+    }
+    if (scope.requiredReplicaCount !== scope.targetNodeNames.length * scope.replicasPerNode) {
+        errors.push('requiredReplicaCount does not match target nodes and replicasPerNode');
+    }
+    if (planArg.mode === 'rollback' && !planArg.rollbackOfRolloutId) {
+        errors.push('rollback rollout must identify the rollout it replaces');
+    }
+    if (planArg.mode !== 'rollback' && planArg.rollbackOfRolloutId) {
+        errors.push('only rollback rollouts may set rollbackOfRolloutId');
+    }
+    return errors;
+};
+export const validateImageRolloutStatus = (statusArg) => {
+    const errors = [];
+    const counts = [
+        statusArg.requiredReplicaCount,
+        statusArg.observedReplicaCount,
+        statusArg.healthyReplicaCount,
+        statusArg.verifiedReplicaCount,
+        statusArg.failedReplicaCount,
+    ];
+    if (counts.some((countArg) => !Number.isSafeInteger(countArg) || countArg < 0)) {
+        errors.push('rollout replica counts must be non-negative safe integers');
+    }
+    const reporterIds = statusArg.reporters.map((reporterArg) => reporterArg.reporterId);
+    const reporterSessionIds = statusArg.reporters.map((reporterArg) => reporterArg.reporterSessionId);
+    const reporterNodeNames = statusArg.reporters.flatMap((reporterArg) => reporterArg.reporterNodeNames);
+    if (new Set(reporterIds).size !== reporterIds.length
+        || new Set(reporterSessionIds).size !== reporterSessionIds.length) {
+        errors.push('rollout status must contain one latest report per reporter and session');
+    }
+    for (const reporter of statusArg.reporters) {
+        const reporterCounts = [
+            reporter.requiredReplicaCount,
+            reporter.observedReplicaCount,
+            reporter.healthyReplicaCount,
+            reporter.verifiedReplicaCount,
+            reporter.failedReplicaCount,
+        ];
+        if (reporterCounts.some((countArg) => !Number.isSafeInteger(countArg) || countArg < 0)) {
+            errors.push('reporter replica counts must be non-negative safe integers');
+        }
+        if (reporter.rolloutId !== statusArg.rolloutId
+            || reporter.rolloutGeneration !== statusArg.rolloutGeneration) {
+            errors.push('reporter rollout identity does not match aggregate rollout identity');
+        }
+        if (reporter.observedReplicaCount > reporter.requiredReplicaCount
+            || reporter.healthyReplicaCount > reporter.observedReplicaCount
+            || reporter.verifiedReplicaCount > reporter.observedReplicaCount) {
+            errors.push('reporter replica counts are contradictory');
+        }
+    }
+    if (statusArg.status === 'succeeded' || statusArg.status === 'rolled-back') {
+        if (statusArg.requiredReplicaCount < 1
+            || statusArg.observedReplicaCount !== statusArg.requiredReplicaCount
+            || statusArg.healthyReplicaCount !== statusArg.requiredReplicaCount
+            || statusArg.verifiedReplicaCount !== statusArg.requiredReplicaCount
+            || statusArg.failedReplicaCount !== 0) {
+            errors.push('successful rollout status requires every replica to be observed, healthy and verified');
+        }
+        if (statusArg.mismatchReason || statusArg.reporters.length < 1) {
+            errors.push('successful rollout status requires reporters without mismatch reasons');
+        }
+        if (new Set(reporterNodeNames).size !== reporterNodeNames.length) {
+            errors.push('successful rollout status must not count a node in multiple reporters');
+        }
+        if (statusArg.reporters.some((reporterArg) => (reporterArg.requiredReplicaCount < 1
+            || reporterArg.observedReplicaCount !== reporterArg.requiredReplicaCount
+            || reporterArg.healthyReplicaCount !== reporterArg.requiredReplicaCount
+            || reporterArg.verifiedReplicaCount !== reporterArg.requiredReplicaCount
+            || reporterArg.failedReplicaCount !== 0
+            || Boolean(reporterArg.mismatchReason)))) {
+            errors.push('successful rollout requires every reporter replica to be healthy and verified');
+        }
+        const reporterTotals = statusArg.reporters.reduce((totalsArg, reporterArg) => ({
+            required: totalsArg.required + reporterArg.requiredReplicaCount,
+            observed: totalsArg.observed + reporterArg.observedReplicaCount,
+            healthy: totalsArg.healthy + reporterArg.healthyReplicaCount,
+            verified: totalsArg.verified + reporterArg.verifiedReplicaCount,
+            failed: totalsArg.failed + reporterArg.failedReplicaCount,
+        }), { required: 0, observed: 0, healthy: 0, verified: 0, failed: 0 });
+        if (reporterTotals.required !== statusArg.requiredReplicaCount
+            || reporterTotals.observed !== statusArg.observedReplicaCount
+            || reporterTotals.healthy !== statusArg.healthyReplicaCount
+            || reporterTotals.verified !== statusArg.verifiedReplicaCount
+            || reporterTotals.failed !== statusArg.failedReplicaCount) {
+            errors.push('successful rollout aggregate must exactly match successful reporter evidence');
+        }
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW1tdXRhYmxlaW1hZ2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2ltbXV0YWJsZWltYWdlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQXVNQSxNQUFNLGlCQUFpQixHQUFHLHVCQUF1QixDQUFDO0FBRWxELE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLENBQUMsTUFBYyxFQUE2QixFQUFFO0lBQ2pGLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQ3JELE9BQU8saUJBQWlCLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDO1FBQzdDLENBQUMsQ0FBRSxnQkFBa0M7UUFDckMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUcsQ0FBQyxNQUFjLEVBQTJCLEVBQUUsQ0FDeEUsaUJBQWlCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBRWpDLE1BQU0saUJBQWlCLEdBQUcsdUVBQXVFLENBQUM7QUFDbEcsTUFBTSxlQUFlLEdBQUcsbUVBQW1FLENBQUM7QUFFNUYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsWUFBb0IsRUFDcEIsVUFBa0IsRUFDbEIsTUFBcUIsRUFDYixFQUFFO0lBQ1YsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMvRSxNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1QixNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELE9BQU8sR0FBRyxZQUFZLElBQUksVUFBVSxJQUFJLE1BQU0sRUFBRSxDQUFDO0FBQ25ELENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQy9DLGNBQXNCLEVBQ0ssRUFBRTtJQUM3QixNQUFNLGNBQWMsR0FBRyxjQUFjLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3ZELElBQUksY0FBYyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3ZCLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFDRCxPQUFPLHFCQUFxQixDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsY0FBYyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDekUsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsT0FBc0MsRUFDNUIsRUFBRTtJQUNaLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsSUFBSSxPQUFPLENBQUMsaUJBQWlCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksT0FBTyxDQUFDLFNBQVMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0RSxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksaUJBQXFDLENBQUM7SUFDMUMsSUFBSSxDQUFDO1FBQ0gsaUJBQWlCLEdBQUcsK0JBQStCLENBQ2pELE9BQU8sQ0FBQyxZQUFZLEVBQ3BCLE9BQU8sQ0FBQyxVQUFVLEVBQ2xCLE9BQU8sQ0FBQyxlQUFlLENBQ3hCLENBQUM7SUFDSixDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE1BQU0sQ0FBQyxJQUFJLENBQUUsS0FBZSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFDRCxJQUFJLGlCQUFpQixJQUFJLE9BQU8sQ0FBQywwQkFBMEIsS0FBSyxpQkFBaUIsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkVBQTJFLENBQUMsQ0FBQztJQUMzRixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLFdBQVcsQ0FBQztJQUNsQyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLElBQUksS0FBSyxDQUFDLGVBQWUsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLGVBQWUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDMUUsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLElBQUksS0FBSyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsTUFBTTtXQUNyRSxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUUsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFDRCxJQUFJLEtBQUssQ0FBQyxvQkFBb0IsS0FBSyxLQUFLLENBQUMsZUFBZSxDQUFDLE1BQU0sR0FBRyxLQUFLLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDeEYsTUFBTSxDQUFDLElBQUksQ0FBQyxzRUFBc0UsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssVUFBVSxJQUFJLENBQUMsT0FBTyxDQUFDLG1CQUFtQixFQUFFLENBQUM7UUFDaEUsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssVUFBVSxJQUFJLE9BQU8sQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQy9ELE1BQU0sQ0FBQyxJQUFJLENBQUMsb0RBQW9ELENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxTQUE4QixFQUFZLEVBQUU7SUFDckYsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sTUFBTSxHQUFHO1FBQ2IsU0FBUyxDQUFDLG9CQUFvQjtRQUM5QixTQUFTLENBQUMsb0JBQW9CO1FBQzlCLFNBQVMsQ0FBQyxtQkFBbUI7UUFDN0IsU0FBUyxDQUFDLG9CQUFvQjtRQUM5QixTQUFTLENBQUMsa0JBQWtCO0tBQzdCLENBQUM7SUFDRixJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMvRSxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLFNBQVMsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDckYsTUFBTSxrQkFBa0IsR0FBRyxTQUFTLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFDbkcsTUFBTSxpQkFBaUIsR0FBRyxTQUFTLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FDbkQsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsQ0FDL0MsQ0FBQztJQUNGLElBQUksSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxLQUFLLFdBQVcsQ0FBQyxNQUFNO1dBQy9DLElBQUksR0FBRyxDQUFDLGtCQUFrQixDQUFDLENBQUMsSUFBSSxLQUFLLGtCQUFrQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3BFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsS0FBSyxNQUFNLFFBQVEsSUFBSSxTQUFTLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDM0MsTUFBTSxjQUFjLEdBQUc7WUFDckIsUUFBUSxDQUFDLG9CQUFvQjtZQUM3QixRQUFRLENBQUMsb0JBQW9CO1lBQzdCLFFBQVEsQ0FBQyxtQkFBbUI7WUFDNUIsUUFBUSxDQUFDLG9CQUFvQjtZQUM3QixRQUFRLENBQUMsa0JBQWtCO1NBQzVCLENBQUM7UUFDRixJQUFJLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN2RixNQUFNLENBQUMsSUFBSSxDQUFDLDREQUE0RCxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsU0FBUztlQUN6QyxRQUFRLENBQUMsaUJBQWlCLEtBQUssU0FBUyxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDaEUsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7UUFDRCxJQUNFLFFBQVEsQ0FBQyxvQkFBb0IsR0FBRyxRQUFRLENBQUMsb0JBQW9CO2VBQzFELFFBQVEsQ0FBQyxtQkFBbUIsR0FBRyxRQUFRLENBQUMsb0JBQW9CO2VBQzVELFFBQVEsQ0FBQyxvQkFBb0IsR0FBRyxRQUFRLENBQUMsb0JBQW9CLEVBQ2hFLENBQUM7WUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLDJDQUEyQyxDQUFDLENBQUM7UUFDM0QsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssV0FBVyxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssYUFBYSxFQUFFLENBQUM7UUFDM0UsSUFDRSxTQUFTLENBQUMsb0JBQW9CLEdBQUcsQ0FBQztlQUMvQixTQUFTLENBQUMsb0JBQW9CLEtBQUssU0FBUyxDQUFDLG9CQUFvQjtlQUNqRSxTQUFTLENBQUMsbUJBQW1CLEtBQUssU0FBUyxDQUFDLG9CQUFvQjtlQUNoRSxTQUFTLENBQUMsb0JBQW9CLEtBQUssU0FBUyxDQUFDLG9CQUFvQjtlQUNqRSxTQUFTLENBQUMsa0JBQWtCLEtBQUssQ0FBQyxFQUNyQyxDQUFDO1lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyx1RkFBdUYsQ0FBQyxDQUFDO1FBQ3ZHLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyxjQUFjLElBQUksU0FBUyxDQUFDLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDL0QsTUFBTSxDQUFDLElBQUksQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7UUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUMsSUFBSSxLQUFLLGlCQUFpQixDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztRQUN2RixDQUFDO1FBQ0QsSUFBSSxTQUFTLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FDNUMsV0FBVyxDQUFDLG9CQUFvQixHQUFHLENBQUM7ZUFDakMsV0FBVyxDQUFDLG9CQUFvQixLQUFLLFdBQVcsQ0FBQyxvQkFBb0I7ZUFDckUsV0FBVyxDQUFDLG1CQUFtQixLQUFLLFdBQVcsQ0FBQyxvQkFBb0I7ZUFDcEUsV0FBVyxDQUFDLG9CQUFvQixLQUFLLFdBQVcsQ0FBQyxvQkFBb0I7ZUFDckUsV0FBVyxDQUFDLGtCQUFrQixLQUFLLENBQUM7ZUFDcEMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsQ0FDdkMsQ0FBQyxFQUFFLENBQUM7WUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLCtFQUErRSxDQUFDLENBQUM7UUFDL0YsQ0FBQztRQUNELE1BQU0sY0FBYyxHQUFHLFNBQVMsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsU0FBUyxFQUFFLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FBQztZQUM3RSxRQUFRLEVBQUUsU0FBUyxDQUFDLFFBQVEsR0FBRyxXQUFXLENBQUMsb0JBQW9CO1lBQy9ELFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxvQkFBb0I7WUFDL0QsT0FBTyxFQUFFLFNBQVMsQ0FBQyxPQUFPLEdBQUcsV0FBVyxDQUFDLG1CQUFtQjtZQUM1RCxRQUFRLEVBQUUsU0FBUyxDQUFDLFFBQVEsR0FBRyxXQUFXLENBQUMsb0JBQW9CO1lBQy9ELE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTSxHQUFHLFdBQVcsQ0FBQyxrQkFBa0I7U0FDMUQsQ0FBQyxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDLEVBQUUsUUFBUSxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN0RSxJQUNFLGNBQWMsQ0FBQyxRQUFRLEtBQUssU0FBUyxDQUFDLG9CQUFvQjtlQUN2RCxjQUFjLENBQUMsUUFBUSxLQUFLLFNBQVMsQ0FBQyxvQkFBb0I7ZUFDMUQsY0FBYyxDQUFDLE9BQU8sS0FBSyxTQUFTLENBQUMsbUJBQW1CO2VBQ3hELGNBQWMsQ0FBQyxRQUFRLEtBQUssU0FBUyxDQUFDLG9CQUFvQjtlQUMxRCxjQUFjLENBQUMsTUFBTSxLQUFLLFNBQVMsQ0FBQyxrQkFBa0IsRUFDekQsQ0FBQztZQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsOEVBQThFLENBQUMsQ0FBQztRQUM5RixDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyJ9

package/dist_ts/data/index.d.ts

@@ -2,6 +2,7 @@ export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './config.js';
 export * from './deployment.js';
+export * from './deploymentpreflight.js';
 export * from './migration.js';
 export * from './dns.js';
 export * from './docker.js';
@@ -11,6 +12,7 @@ export * from './externalregistry.js';
 export * from './gateway.js';
 export * from './hostedapp.js';
 export * from './image.js';
+export * from './immutableimage.js';
 export * from './isolatedrestore.js';
 export * from './isolatedrestore.golden.js';
 export * from './mail.js';