@serve.zone/interfaces 14.0.0 → 16.0.0

package/changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2026-07-20 - 16.0.0
+
+### Breaking Changes
+
+- add attested existing-service adoption contracts (deployment)
+  - Add a mutation-free adoption preflight and a digest-fenced, idempotent adoption request.
+  - Require explicit service-scoped deployment:adopt-existing authority.
+  - Bind registry, release, target-scope, and healthy runtime digest evidence before switching a mutable service to immutable rollout state.
+
+## 2026-07-20 - 15.0.0
+
+### Breaking Changes
+
+- add scoped immutable deployment operation contracts (deployment)
+  - Replace machine deployment grant fields with an exact organization/service or organization/service-slot grant and use JWT-only credentials on scoped deployment RPCs.
+  - Add revisioned reserve, status, route promotion, retry, and cleanup contracts with complete configuration, rollout, wildcard-route, readiness, and TLS evidence validation.
+  - Require authenticated registry evidence bound to the operation, actor, service, image, registry host, repository, exact tag, root digest, and OCI index media type.
+  - Require promotion and rollback requests to carry exact operation/repository/tag/digest fences and immutable plans and verified runtime tasks to expose exact rollout and digest evidence.
+
 ## 2026-07-19 - 14.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '14.0.0',
+    version: '16.0.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/deploymentadoption.d.ts

@@ -0,0 +1,95 @@
+import type { IDeploymentPreflightRuntimeTask, IOciPlatformDescriptorSummary } from './deploymentpreflight.js';
+import type { IImmutableImageDeploymentPlan, IImmutableImageTargetScope, TOciManifestMediaType, TSha256Digest } from './immutableimage.js';
+import type { IRegistryTarget } from './registry.js';
+export type TServiceDeploymentAdoptionDecision = 'GO' | 'NO-GO';
+/**
+ * Canonical sha256 hash of the complete adoption preflight snapshot. It is a
+ * state/TOCTOU fence and must never be substituted with the OCI image digest.
+ */
+export type TServiceDeploymentAdoptionDigest = TSha256Digest & {
+    readonly __serviceDeploymentAdoptionDigest: unique symbol;
+};
+export type TServiceDeploymentAdoptionBlockerCode = 'INVALID_REQUEST' | 'AUTHORIZATION_MISSING' | 'SERVICE_NOT_FOUND' | 'SERVICE_OWNERSHIP_MISMATCH' | 'SERVICE_ALREADY_IMMUTABLE' | 'SERVICE_STATE_CONFLICT' | 'REGISTRY_TARGET_MISSING' | 'REGISTRY_REFERENCE_INVALID' | 'REGISTRY_DIGEST_MISSING' | 'OCI_INDEX_REQUIRED' | 'OCI_PLATFORM_MISSING' | 'RELEASE_NOT_FOUND' | 'RELEASE_TAG_AMBIGUOUS' | 'TARGET_SCOPE_UNAVAILABLE' | 'RUNTIME_ATTESTATION_INCOMPLETE' | 'RUNTIME_DIGEST_MISMATCH';
+export interface IServiceDeploymentAdoptionBlocker {
+    code: TServiceDeploymentAdoptionBlockerCode;
+    message: string;
+}
+export interface IServiceDeploymentAdoptionPreflightInput {
+    requestId: string;
+    organizationId: string;
+    serviceId: string;
+}
+export interface IServiceDeploymentAdoptionInput extends IServiceDeploymentAdoptionPreflightInput {
+    idempotencyKey: string;
+    expectedAdoptionDigest: TServiceDeploymentAdoptionDigest;
+}
+interface IServiceDeploymentAdoptionReportBase {
+    schemaVersion: 1;
+    mutationPerformed: false;
+    requestId: string;
+    generatedAt: number;
+    runtimeAttestation: {
+        requiredReplicaCount: number;
+        observedReplicaCount: number;
+        healthyReplicaCount: number;
+        observedDigestReplicaCount: number;
+        observedDigestConsistent: boolean;
+    };
+}
+interface IServiceDeploymentAdoptionServiceSnapshot {
+    organizationId: string;
+    serviceId: string;
+    serviceName: string;
+    imageId: string;
+    deployOnPush: boolean;
+    immutableImageRequired: boolean;
+    configuredReference: string;
+    registryTarget: IRegistryTarget;
+}
+interface IServiceDeploymentAdoptionRegistrySnapshot {
+    tag?: string;
+    digest?: TSha256Digest;
+    mediaType?: TOciManifestMediaType;
+    platforms: IOciPlatformDescriptorSummary[];
+    releaseId?: string;
+    releaseTag?: string;
+}
+export interface IServiceDeploymentAdoptionGoReport extends IServiceDeploymentAdoptionReportBase {
+    decision: 'GO';
+    service: IServiceDeploymentAdoptionServiceSnapshot & {
+        deployOnPush: true;
+        immutableImageRequired: false;
+    };
+    registry: IServiceDeploymentAdoptionRegistrySnapshot & {
+        tag: string;
+        digest: TSha256Digest;
+        mediaType: 'application/vnd.oci.image.index.v1+json' | 'application/vnd.docker.distribution.manifest.list.v2+json';
+        platforms: [IOciPlatformDescriptorSummary, ...IOciPlatformDescriptorSummary[]];
+        releaseId: string;
+        releaseTag: string;
+    };
+    runtimeTasks: [IDeploymentPreflightRuntimeTask, ...IDeploymentPreflightRuntimeTask[]];
+    targetScope: IImmutableImageTargetScope;
+    adoptionDigest: TServiceDeploymentAdoptionDigest;
+    blockers: [];
+}
+export interface IServiceDeploymentAdoptionNoGoReport extends IServiceDeploymentAdoptionReportBase {
+    decision: 'NO-GO';
+    service?: IServiceDeploymentAdoptionServiceSnapshot;
+    registry: IServiceDeploymentAdoptionRegistrySnapshot;
+    runtimeTasks: IDeploymentPreflightRuntimeTask[];
+    targetScope?: IImmutableImageTargetScope;
+    adoptionDigest?: never;
+    blockers: [IServiceDeploymentAdoptionBlocker, ...IServiceDeploymentAdoptionBlocker[]];
+}
+export type IServiceDeploymentAdoptionReport = IServiceDeploymentAdoptionGoReport | IServiceDeploymentAdoptionNoGoReport;
+export interface IServiceDeploymentAdoptionResult {
+    adoptionId: string;
+    adoptionDigest: TServiceDeploymentAdoptionDigest;
+    idempotentReplay: boolean;
+    plan: IImmutableImageDeploymentPlan;
+}
+export declare const validateServiceDeploymentAdoptionPreflightInput: (inputArg: unknown) => string[];
+export declare const validateServiceDeploymentAdoptionInput: (inputArg: unknown) => string[];
+export declare const validateServiceDeploymentAdoptionReport: (reportArg: unknown) => string[];
+export {};

package/dist_ts/data/deploymentadoption.js

@@ -0,0 +1,303 @@
+import { normalizeImmutableReleaseTag, normalizeSha256Digest } from './immutableimage.js';
+const boundaryIdentifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const indexMediaTypes = new Set([
+    'application/vnd.oci.image.index.v1+json',
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+]);
+const adoptionBlockerCodes = new Set([
+    'INVALID_REQUEST',
+    'AUTHORIZATION_MISSING',
+    'SERVICE_NOT_FOUND',
+    'SERVICE_OWNERSHIP_MISMATCH',
+    'SERVICE_ALREADY_IMMUTABLE',
+    'SERVICE_STATE_CONFLICT',
+    'REGISTRY_TARGET_MISSING',
+    'REGISTRY_REFERENCE_INVALID',
+    'REGISTRY_DIGEST_MISSING',
+    'OCI_INDEX_REQUIRED',
+    'OCI_PLATFORM_MISSING',
+    'RELEASE_NOT_FOUND',
+    'RELEASE_TAG_AMBIGUOUS',
+    'TARGET_SCOPE_UNAVAILABLE',
+    'RUNTIME_ATTESTATION_INCOMPLETE',
+    'RUNTIME_DIGEST_MISMATCH',
+]);
+const isRecord = (valueArg) => Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg);
+const isBoundedIdentifier = (valueArg) => typeof valueArg === 'string' && boundaryIdentifierRegex.test(valueArg);
+const isCanonicalDigest = (valueArg) => Boolean(normalizeSha256Digest(valueArg)) && normalizeSha256Digest(valueArg) === valueArg;
+const isNonNegativeInteger = (valueArg) => Number.isSafeInteger(valueArg) && valueArg >= 0;
+export const validateServiceDeploymentAdoptionPreflightInput = (inputArg) => {
+    if (!isRecord(inputArg))
+        return ['adoption preflight input must be an object'];
+    const errors = [];
+    if (!isBoundedIdentifier(inputArg.requestId)) {
+        errors.push('requestId must be a bounded canonical identifier');
+    }
+    for (const key of ['organizationId', 'serviceId']) {
+        if (!isBoundedIdentifier(inputArg[key])) {
+            errors.push(`${key} must be a bounded canonical identifier`);
+        }
+    }
+    return errors;
+};
+export const validateServiceDeploymentAdoptionInput = (inputArg) => {
+    const errors = validateServiceDeploymentAdoptionPreflightInput(inputArg);
+    if (!isRecord(inputArg))
+        return errors;
+    if (!isBoundedIdentifier(inputArg.idempotencyKey)) {
+        errors.push('idempotencyKey must be a bounded canonical identifier');
+    }
+    if (!isCanonicalDigest(inputArg.expectedAdoptionDigest)) {
+        errors.push('expectedAdoptionDigest must be a canonical sha256 digest');
+    }
+    return errors;
+};
+export const validateServiceDeploymentAdoptionReport = (reportArg) => {
+    if (!isRecord(reportArg))
+        return ['adoption report must be an object'];
+    const errors = [];
+    if (reportArg.schemaVersion !== 1)
+        errors.push('schemaVersion must be 1');
+    if (reportArg.mutationPerformed !== false) {
+        errors.push('adoption preflight must be mutation-free');
+    }
+    if (!isBoundedIdentifier(reportArg.requestId)) {
+        errors.push('requestId must be a bounded canonical identifier');
+    }
+    if (!isNonNegativeInteger(reportArg.generatedAt)) {
+        errors.push('generatedAt must be a non-negative integer');
+    }
+    if (reportArg.decision !== 'GO' && reportArg.decision !== 'NO-GO') {
+        errors.push('decision must be GO or NO-GO');
+    }
+    const attestation = reportArg.runtimeAttestation;
+    if (!isRecord(attestation)) {
+        errors.push('runtimeAttestation must be an object');
+    }
+    else {
+        for (const key of [
+            'requiredReplicaCount',
+            'observedReplicaCount',
+            'healthyReplicaCount',
+            'observedDigestReplicaCount',
+        ]) {
+            if (!isNonNegativeInteger(attestation[key])) {
+                errors.push(`runtimeAttestation.${key} must be a non-negative integer`);
+            }
+        }
+        if (typeof attestation.observedDigestConsistent !== 'boolean') {
+            errors.push('runtimeAttestation.observedDigestConsistent must be boolean');
+        }
+    }
+    const blockers = reportArg.blockers;
+    if (!Array.isArray(blockers)) {
+        errors.push('blockers must be an array');
+    }
+    else {
+        for (const blocker of blockers) {
+            if (!isRecord(blocker)
+                || !adoptionBlockerCodes.has(blocker.code)
+                || typeof blocker.message !== 'string'
+                || !blocker.message.trim()) {
+                errors.push('each blocker must contain a supported code and non-empty message');
+                break;
+            }
+        }
+    }
+    if (reportArg.decision === 'NO-GO') {
+        if (Array.isArray(blockers) && blockers.length === 0) {
+            errors.push('a NO-GO report must contain at least one blocker');
+        }
+        if (reportArg.adoptionDigest !== undefined) {
+            errors.push('a NO-GO report must not contain an adoption digest');
+        }
+        return errors;
+    }
+    if (reportArg.decision !== 'GO')
+        return errors;
+    if (Array.isArray(blockers) && blockers.length !== 0) {
+        errors.push('a GO report must not contain blockers');
+    }
+    if (!isCanonicalDigest(reportArg.adoptionDigest)) {
+        errors.push('a GO report requires a canonical adoption digest');
+    }
+    const service = reportArg.service;
+    const registry = reportArg.registry;
+    const targetScope = reportArg.targetScope;
+    const runtimeTasks = reportArg.runtimeTasks;
+    if (!isRecord(service)) {
+        errors.push('a GO report requires a service snapshot');
+    }
+    else {
+        for (const key of ['organizationId', 'serviceId', 'serviceName', 'imageId']) {
+            if (!isBoundedIdentifier(service[key]))
+                errors.push(`service.${key} is invalid`);
+        }
+        if (service.deployOnPush !== true || service.immutableImageRequired !== false) {
+            errors.push('a GO report requires the legacy mutable service state');
+        }
+        if (typeof service.configuredReference !== 'string' || !service.configuredReference.trim()) {
+            errors.push('service.configuredReference must be non-empty');
+        }
+        if (!isRecord(service.registryTarget)) {
+            errors.push('service.registryTarget must be present');
+        }
+    }
+    let registryDigest;
+    if (!isRecord(registry)) {
+        errors.push('a GO report requires a registry snapshot');
+    }
+    else {
+        if (!normalizeImmutableReleaseTag(registry.tag) || registry.tag !== registry.releaseTag) {
+            errors.push('registry tag and releaseTag must be the same immutable tag');
+        }
+        if (!isCanonicalDigest(registry.digest)) {
+            errors.push('registry.digest must be a canonical sha256 digest');
+        }
+        else {
+            registryDigest = registry.digest;
+            if (reportArg.adoptionDigest === registry.digest) {
+                errors.push('adoption digest must be a distinct full-state fence, not the image digest');
+            }
+        }
+        if (!indexMediaTypes.has(registry.mediaType)) {
+            errors.push('registry.mediaType must identify an OCI image index');
+        }
+        if (!isBoundedIdentifier(registry.releaseId)) {
+            errors.push('registry.releaseId must be a bounded canonical identifier');
+        }
+        if (!Array.isArray(registry.platforms) || registry.platforms.length === 0) {
+            errors.push('registry.platforms must contain OCI platform evidence');
+        }
+        else {
+            for (const architecture of ['amd64', 'arm64']) {
+                if (!registry.platforms.some((platformArg) => isRecord(platformArg)
+                    && platformArg.os === 'linux'
+                    && platformArg.architecture === architecture
+                    && platformArg.runnable === true
+                    && platformArg.manifestPresent === true
+                    && isCanonicalDigest(platformArg.digest))) {
+                    errors.push(`registry.platforms must contain runnable linux/${architecture} evidence`);
+                }
+            }
+        }
+    }
+    let requiredReplicaCount;
+    let targetNodeNames = [];
+    let replicasPerNode;
+    if (!isRecord(targetScope)) {
+        errors.push('a GO report requires an immutable target scope');
+    }
+    else {
+        const clusterIds = targetScope.targetClusterIds;
+        const nodeNames = targetScope.targetNodeNames;
+        replicasPerNode = targetScope.replicasPerNode;
+        requiredReplicaCount = targetScope.requiredReplicaCount;
+        if (!Array.isArray(clusterIds) || clusterIds.length !== 1
+            || clusterIds.some((valueArg) => !isBoundedIdentifier(valueArg))
+            || new Set(clusterIds).size !== clusterIds.length) {
+            errors.push('targetScope.targetClusterIds must identify exactly one attested cluster');
+        }
+        if (!Array.isArray(nodeNames) || nodeNames.length === 0
+            || nodeNames.some((valueArg) => !isBoundedIdentifier(valueArg))
+            || new Set(nodeNames).size !== nodeNames.length) {
+            errors.push('targetScope.targetNodeNames must be non-empty and unique');
+        }
+        else {
+            targetNodeNames = nodeNames;
+        }
+        if (!Number.isSafeInteger(replicasPerNode) || replicasPerNode < 1) {
+            errors.push('targetScope.replicasPerNode must be a positive integer');
+        }
+        if (!Number.isSafeInteger(requiredReplicaCount) || requiredReplicaCount < 1
+            || requiredReplicaCount !== targetNodeNames.length * (replicasPerNode || 0)) {
+            errors.push('targetScope.requiredReplicaCount must match nodes times replicas');
+        }
+    }
+    if (!Array.isArray(runtimeTasks) || runtimeTasks.length === 0) {
+        errors.push('a GO report requires runtime task evidence');
+    }
+    else {
+        if (requiredReplicaCount !== undefined && runtimeTasks.length !== requiredReplicaCount) {
+            errors.push('runtime task count must equal the required replica count');
+        }
+        const deploymentIds = new Set();
+        const taskCountsByNode = new Map();
+        for (const task of runtimeTasks) {
+            if (!isRecord(task)
+                || !isBoundedIdentifier(task.deploymentId)
+                || deploymentIds.has(task.deploymentId)) {
+                errors.push('runtime task deployment IDs must be valid and unique');
+                continue;
+            }
+            deploymentIds.add(task.deploymentId);
+            if (!isBoundedIdentifier(task.nodeName) || !targetNodeNames.includes(task.nodeName)) {
+                errors.push('every runtime task must belong to the exact target node scope');
+            }
+            else {
+                taskCountsByNode.set(task.nodeName, (taskCountsByNode.get(task.nodeName) || 0) + 1);
+            }
+            if (task.status !== 'running' || task.healthStatus !== 'healthy') {
+                errors.push('every runtime task must be running and healthy');
+            }
+            if (!registryDigest || task.observedDigest !== registryDigest) {
+                errors.push('every runtime task must attest the exact registry digest');
+            }
+            if (typeof task.imageReference !== 'string' || !task.imageReference.trim()) {
+                errors.push('every runtime task must identify its image reference');
+            }
+        }
+        if (replicasPerNode !== undefined
+            && targetNodeNames.some((nodeNameArg) => taskCountsByNode.get(nodeNameArg) !== replicasPerNode)) {
+            errors.push('runtime task evidence must cover every target node and replica');
+        }
+    }
+    if (isRecord(attestation) && requiredReplicaCount !== undefined) {
+        if (attestation.requiredReplicaCount !== requiredReplicaCount
+            || attestation.observedReplicaCount !== requiredReplicaCount
+            || attestation.healthyReplicaCount !== requiredReplicaCount
+            || attestation.observedDigestReplicaCount !== requiredReplicaCount
+            || attestation.observedDigestConsistent !== true) {
+            errors.push('runtime attestation must consistently cover every required replica');
+        }
+    }
+    if (isRecord(service) && isRecord(service.registryTarget) && isRecord(registry)) {
+        const target = service.registryTarget;
+        if (target.protocol !== 'oci'
+            || target.tag !== registry.tag
+            || target.serviceId !== service.serviceId
+            || target.imageId !== service.imageId
+            || typeof target.registryHost !== 'string'
+            || !target.registryHost
+            || typeof target.repository !== 'string'
+            || !target.repository
+            || target.imageUrl !== `${target.registryHost}/${target.repository}:${target.tag}`) {
+            errors.push('service registry target must exactly bind the adopted service, image, and tag');
+        }
+        if (registryDigest) {
+            const digestPinnedReference = `${target.registryHost}/${target.repository}@${registryDigest}`;
+            const tagAndDigestReference = `${target.imageUrl}@${registryDigest}`;
+            const configuredReferences = new Set([
+                target.tag,
+                target.imageUrl,
+                digestPinnedReference,
+                tagAndDigestReference,
+            ]);
+            if (!configuredReferences.has(service.configuredReference)) {
+                errors.push('service configured reference must exactly bind the adopted registry target');
+            }
+            const runtimeReferences = new Set([
+                target.imageUrl,
+                digestPinnedReference,
+                tagAndDigestReference,
+            ]);
+            if (Array.isArray(runtimeTasks)
+                && runtimeTasks.some((taskArg) => !isRecord(taskArg)
+                    || !runtimeReferences.has(taskArg.imageReference))) {
+                errors.push('every runtime task image reference must exactly bind the adopted registry target');
+            }
+        }
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudGFkb3B0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9kZXBsb3ltZW50YWRvcHRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBVUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLHFCQUFxQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUErSDFGLE1BQU0sdUJBQXVCLEdBQUcscUNBQXFDLENBQUM7QUFDdEUsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLENBQXdCO0lBQ3JELHlDQUF5QztJQUN6QywyREFBMkQ7Q0FDNUQsQ0FBQyxDQUFDO0FBQ0gsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLEdBQUcsQ0FBd0M7SUFDMUUsaUJBQWlCO0lBQ2pCLHVCQUF1QjtJQUN2QixtQkFBbUI7SUFDbkIsNEJBQTRCO0lBQzVCLDJCQUEyQjtJQUMzQix3QkFBd0I7SUFDeEIseUJBQXlCO0lBQ3pCLDRCQUE0QjtJQUM1Qix5QkFBeUI7SUFDekIsb0JBQW9CO0lBQ3BCLHNCQUFzQjtJQUN0QixtQkFBbUI7SUFDbkIsdUJBQXVCO0lBQ3ZCLDBCQUEwQjtJQUMxQixnQ0FBZ0M7SUFDaEMseUJBQXlCO0NBQzFCLENBQUMsQ0FBQztBQUVILE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUMxRSxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUVoRixNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUNwRSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksdUJBQXVCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRXpFLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUE2QixFQUFFLENBQ3pFLE9BQU8sQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxLQUFLLFFBQVEsQ0FBQztBQUUzRixNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUNyRSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLElBQUksQ0FBQyxDQUFDO0FBRTlELE1BQU0sQ0FBQyxNQUFNLCtDQUErQyxHQUFHLENBQzdELFFBQWlCLEVBQ1AsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDL0UsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxXQUFXLENBQVUsRUFBRSxDQUFDO1FBQzNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxHQUFHLHlDQUF5QyxDQUFDLENBQUM7UUFDL0QsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxDQUFDLFFBQWlCLEVBQVksRUFBRTtJQUNwRixNQUFNLE1BQU0sR0FBRywrQ0FBK0MsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN6RSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sTUFBTSxDQUFDO0lBQ3ZDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsc0JBQXNCLENBQUMsRUFBRSxDQUFDO1FBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FBQyxTQUFrQixFQUFZLEVBQUU7SUFDdEYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7UUFBRSxPQUFPLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUN2RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxTQUFTLENBQUMsYUFBYSxLQUFLLENBQUM7UUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDMUUsSUFBSSxTQUFTLENBQUMsaUJBQWlCLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDMUMsTUFBTSxDQUFDLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDOUMsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLENBQUMsb0JBQW9CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLFNBQVMsQ0FBQyxRQUFRLEtBQUssT0FBTyxFQUFFLENBQUM7UUFDbEUsTUFBTSxDQUFDLElBQUksQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFFRCxNQUFNLFdBQVcsR0FBRyxTQUFTLENBQUMsa0JBQWtCLENBQUM7SUFDakQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0NBQXNDLENBQUMsQ0FBQztJQUN0RCxDQUFDO1NBQU0sQ0FBQztRQUNOLEtBQUssTUFBTSxHQUFHLElBQUk7WUFDaEIsc0JBQXNCO1lBQ3RCLHNCQUFzQjtZQUN0QixxQkFBcUI7WUFDckIsNEJBQTRCO1NBQ3BCLEVBQUUsQ0FBQztZQUNYLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUM1QyxNQUFNLENBQUMsSUFBSSxDQUFDLHNCQUFzQixHQUFHLGlDQUFpQyxDQUFDLENBQUM7WUFDMUUsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLE9BQU8sV0FBVyxDQUFDLHdCQUF3QixLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlELE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUM7SUFDcEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUM3QixNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixDQUFDLENBQUM7SUFDM0MsQ0FBQztTQUFNLENBQUM7UUFDTixLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQy9CLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO21CQUNqQixDQUFDLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBNkMsQ0FBQzttQkFDaEYsT0FBTyxPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVE7bUJBQ25DLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUM3QixNQUFNLENBQUMsSUFBSSxDQUFDLGtFQUFrRSxDQUFDLENBQUM7Z0JBQ2hGLE1BQU07WUFDUixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLFNBQVMsQ0FBQyxRQUFRLEtBQUssT0FBTyxFQUFFLENBQUM7UUFDbkMsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDckQsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyxjQUFjLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDM0MsTUFBTSxDQUFDLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMsUUFBUSxLQUFLLElBQUk7UUFBRSxPQUFPLE1BQU0sQ0FBQztJQUUvQyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUM7SUFDbEMsTUFBTSxRQUFRLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQztJQUNwQyxNQUFNLFdBQVcsR0FBRyxTQUFTLENBQUMsV0FBVyxDQUFDO0lBQzFDLE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxZQUFZLENBQUM7SUFDNUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sQ0FBQyxJQUFJLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUN6RCxDQUFDO1NBQU0sQ0FBQztRQUNOLEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLFNBQVMsQ0FBVSxFQUFFLENBQUM7WUFDckYsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsR0FBRyxhQUFhLENBQUMsQ0FBQztRQUNuRixDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsWUFBWSxLQUFLLElBQUksSUFBSSxPQUFPLENBQUMsc0JBQXNCLEtBQUssS0FBSyxFQUFFLENBQUM7WUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLG1CQUFtQixLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQzNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztZQUN0QyxNQUFNLENBQUMsSUFBSSxDQUFDLHdDQUF3QyxDQUFDLENBQUM7UUFDeEQsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLGNBQXlDLENBQUM7SUFDOUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sQ0FBQyxJQUFJLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUMxRCxDQUFDO1NBQU0sQ0FBQztRQUNOLElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksUUFBUSxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDeEYsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO1FBQzVFLENBQUM7UUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO1FBQ25FLENBQUM7YUFBTSxDQUFDO1lBQ04sY0FBYyxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUM7WUFDakMsSUFBSSxTQUFTLENBQUMsY0FBYyxLQUFLLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywyRUFBMkUsQ0FBQyxDQUFDO1lBQzNGLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLFNBQWtDLENBQUMsRUFBRSxDQUFDO1lBQ3RFLE1BQU0sQ0FBQyxJQUFJLENBQUMscURBQXFELENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQzdDLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUN2RSxDQUFDO2FBQU0sQ0FBQztZQUNOLEtBQUssTUFBTSxZQUFZLElBQUksQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO3VCQUM5RCxXQUFXLENBQUMsRUFBRSxLQUFLLE9BQU87dUJBQzFCLFdBQVcsQ0FBQyxZQUFZLEtBQUssWUFBWTt1QkFDekMsV0FBVyxDQUFDLFFBQVEsS0FBSyxJQUFJO3VCQUM3QixXQUFXLENBQUMsZUFBZSxLQUFLLElBQUk7dUJBQ3BDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7b0JBQzVDLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0RBQWtELFlBQVksV0FBVyxDQUFDLENBQUM7Z0JBQ3pGLENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLG9CQUF3QyxDQUFDO0lBQzdDLElBQUksZUFBZSxHQUFhLEVBQUUsQ0FBQztJQUNuQyxJQUFJLGVBQW1DLENBQUM7SUFDeEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUNoRSxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxnQkFBZ0IsQ0FBQztRQUNoRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsZUFBZSxDQUFDO1FBQzlDLGVBQWUsR0FBRyxXQUFXLENBQUMsZUFBeUIsQ0FBQztRQUN4RCxvQkFBb0IsR0FBRyxXQUFXLENBQUMsb0JBQThCLENBQUM7UUFDbEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ3BELFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsbUJBQW1CLENBQUMsUUFBUSxDQUFDLENBQUM7ZUFDN0QsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNwRCxNQUFNLENBQUMsSUFBSSxDQUFDLHlFQUF5RSxDQUFDLENBQUM7UUFDekYsQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQztlQUNsRCxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxDQUFDO2VBQzVELElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbEQsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzFFLENBQUM7YUFBTSxDQUFDO1lBQ04sZUFBZSxHQUFHLFNBQXFCLENBQUM7UUFDMUMsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGVBQWUsQ0FBQyxJQUFJLGVBQWUsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNsRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdEQUF3RCxDQUFDLENBQUM7UUFDeEUsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLG9CQUFvQixDQUFDLElBQUksb0JBQW9CLEdBQUcsQ0FBQztlQUN0RSxvQkFBb0IsS0FBSyxlQUFlLENBQUMsTUFBTSxHQUFHLENBQUMsZUFBZSxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO1FBQ2xGLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDNUQsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLG9CQUFvQixLQUFLLFNBQVMsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLG9CQUFvQixFQUFFLENBQUM7WUFDdkYsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxNQUFNLGFBQWEsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ3hDLE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7UUFDbkQsS0FBSyxNQUFNLElBQUksSUFBSSxZQUFZLEVBQUUsQ0FBQztZQUNoQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQzttQkFDZCxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7bUJBQ3ZDLGFBQWEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFlBQXNCLENBQUMsRUFBRSxDQUFDO2dCQUNwRCxNQUFNLENBQUMsSUFBSSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7Z0JBQ3BFLFNBQVM7WUFDWCxDQUFDO1lBQ0QsYUFBYSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsWUFBc0IsQ0FBQyxDQUFDO1lBQy9DLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO2dCQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7WUFDL0UsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztZQUN0RixDQUFDO1lBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxJQUFJLENBQUMsWUFBWSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUNqRSxNQUFNLENBQUMsSUFBSSxDQUFDLGdEQUFnRCxDQUFDLENBQUM7WUFDaEUsQ0FBQztZQUNELElBQUksQ0FBQyxjQUFjLElBQUksSUFBSSxDQUFDLGNBQWMsS0FBSyxjQUFjLEVBQUUsQ0FBQztnQkFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1lBQzFFLENBQUM7WUFDRCxJQUFJLE9BQU8sSUFBSSxDQUFDLGNBQWMsS0FBSyxRQUFRLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0RBQXNELENBQUMsQ0FBQztZQUN0RSxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksZUFBZSxLQUFLLFNBQVM7ZUFDNUIsZUFBZSxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxLQUFLLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDbEcsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxRQUFRLENBQUMsV0FBVyxDQUFDLElBQUksb0JBQW9CLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDaEUsSUFBSSxXQUFXLENBQUMsb0JBQW9CLEtBQUssb0JBQW9CO2VBQ3hELFdBQVcsQ0FBQyxvQkFBb0IsS0FBSyxvQkFBb0I7ZUFDekQsV0FBVyxDQUFDLG1CQUFtQixLQUFLLG9CQUFvQjtlQUN4RCxXQUFXLENBQUMsMEJBQTBCLEtBQUssb0JBQW9CO2VBQy9ELFdBQVcsQ0FBQyx3QkFBd0IsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxjQUFjLENBQUM7UUFDdEMsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLEtBQUs7ZUFDeEIsTUFBTSxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsR0FBRztlQUMzQixNQUFNLENBQUMsU0FBUyxLQUFLLE9BQU8sQ0FBQyxTQUFTO2VBQ3RDLE1BQU0sQ0FBQyxPQUFPLEtBQUssT0FBTyxDQUFDLE9BQU87ZUFDbEMsT0FBTyxNQUFNLENBQUMsWUFBWSxLQUFLLFFBQVE7ZUFDdkMsQ0FBQyxNQUFNLENBQUMsWUFBWTtlQUNwQixPQUFPLE1BQU0sQ0FBQyxVQUFVLEtBQUssUUFBUTtlQUNyQyxDQUFDLE1BQU0sQ0FBQyxVQUFVO2VBQ2xCLE1BQU0sQ0FBQyxRQUFRLEtBQUssR0FBRyxNQUFNLENBQUMsWUFBWSxJQUFJLE1BQU0sQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDckYsTUFBTSxDQUFDLElBQUksQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFDRCxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLE1BQU0scUJBQXFCLEdBQUcsR0FBRyxNQUFNLENBQUMsWUFBWSxJQUFJLE1BQU0sQ0FBQyxVQUFVLElBQUksY0FBYyxFQUFFLENBQUM7WUFDOUYsTUFBTSxxQkFBcUIsR0FBRyxHQUFHLE1BQU0sQ0FBQyxRQUFRLElBQUksY0FBYyxFQUFFLENBQUM7WUFDckUsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLEdBQUcsQ0FBQztnQkFDbkMsTUFBTSxDQUFDLEdBQUc7Z0JBQ1YsTUFBTSxDQUFDLFFBQVE7Z0JBQ2YscUJBQXFCO2dCQUNyQixxQkFBcUI7YUFDdEIsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsbUJBQTZCLENBQUMsRUFBRSxDQUFDO2dCQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLDRFQUE0RSxDQUFDLENBQUM7WUFDNUYsQ0FBQztZQUNELE1BQU0saUJBQWlCLEdBQUcsSUFBSSxHQUFHLENBQUM7Z0JBQ2hDLE1BQU0sQ0FBQyxRQUFRO2dCQUNmLHFCQUFxQjtnQkFDckIscUJBQXFCO2FBQ3RCLENBQUMsQ0FBQztZQUNILElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7bUJBQzFCLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQzt1QkFDL0MsQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLGNBQXdCLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0ZBQWtGLENBQUMsQ0FBQztZQUNsRyxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/data/deploymentoperation.d.ts

@@ -0,0 +1,161 @@
+import type { IDeploymentPreflightProposedConfiguration, IDeploymentPreflightRuntimeTask } from './deploymentpreflight.js';
+import type { IImageRolloutStatus, IImmutableImageDeploymentPlan, TSha256Digest } from './immutableimage.js';
+import type { IRegistryTarget } from './registry.js';
+import type { TServiceTargetPortRef } from './serviceports.js';
+export type TDeploymentOperationMode = 'existing-service' | 'greenfield';
+export type TDeploymentOperationPhase = 'reserve' | 'promote' | 'route';
+interface IDeploymentReservationInputBase {
+    organizationId: string;
+    serviceId: string;
+    idempotencyKey: string;
+    sourceRevision: string;
+    version: string;
+    intentDigest: TSha256Digest;
+    proposedConfiguration: IDeploymentPreflightProposedConfiguration;
+    releaseTag: string;
+    routes: IDeploymentRouteRequest[];
+}
+export interface IExistingServiceDeploymentReservationInput extends IDeploymentReservationInputBase {
+    mode: 'existing-service';
+    expectedRolloutGeneration: number;
+    expectedCurrentRolloutId?: string;
+}
+export interface IGreenfieldServiceDeploymentReservationInput extends IDeploymentReservationInputBase {
+    mode: 'greenfield';
+    expectedRolloutGeneration?: never;
+    expectedCurrentRolloutId?: never;
+}
+export type IDeploymentReservationInput = IExistingServiceDeploymentReservationInput | IGreenfieldServiceDeploymentReservationInput;
+export type TDeploymentOperationState = 'reserving' | 'reserved' | 'provisioning' | 'awaiting-image' | 'image-recorded' | 'promoting-image' | 'rolling-out' | 'ready-for-route' | 'promoting-route' | 'verifying-route' | 'succeeded' | 'rolling-back' | 'rolled-back' | 'failed' | 'cleaning' | 'cleaned';
+export interface IDeploymentRouteRequest {
+    hostname: string;
+    targetPort: Extract<TServiceTargetPortRef, number>;
+    /** Required exact one-label hostname used to verify a wildcard route. */
+    verificationHostname?: string;
+    readinessPath?: string;
+    expectedStatusCodes?: number[];
+}
+export interface IDeploymentRouteClaimTarget {
+    hostname: string;
+    bucketHostname: string;
+    wildcard: boolean;
+}
+export declare const canonicalizeDeploymentHostname: (hostnameArg: unknown) => string | undefined;
+/**
+ * Wildcards match exactly one label. Exact siblings share a bucket document
+ * but may coexist; a wildcard claim excludes every exact name in its bucket.
+ */
+export declare const getDeploymentRouteClaimTarget: (hostnameArg: string) => IDeploymentRouteClaimTarget | undefined;
+export declare const getDeploymentRouteVerificationHostname: (routeArg: IDeploymentRouteRequest) => string | undefined;
+export declare const normalizeDeploymentReadinessPath: (pathArg?: unknown) => string | undefined;
+export declare const validateDeploymentProposedConfiguration: (configurationArg: unknown) => string[];
+export declare const validateDeploymentReservationInput: (inputArg: unknown) => string[];
+interface IDeploymentRouteVerificationEvidenceBase {
+    hostname: string;
+    url: string;
+    checkedAt: number;
+    resolvedAddresses: string[];
+    rolloutId: string;
+    rolloutGeneration: number;
+    expectedDigest: TSha256Digest;
+}
+export interface IDeploymentRouteVerificationSuccessEvidence extends IDeploymentRouteVerificationEvidenceBase {
+    outcome: 'succeeded';
+    tls: {
+        authorized: true;
+        servername: string;
+        subjectAlternativeNames: string[];
+        validFrom?: string;
+        validTo?: string;
+    };
+    http: {
+        statusCode: number;
+        redirected: false;
+    };
+    readiness: {
+        path: string;
+        expectedStatusCodes: number[];
+        ready: true;
+    };
+}
+export interface IDeploymentRouteVerificationFailureEvidence extends IDeploymentRouteVerificationEvidenceBase {
+    outcome: 'failed';
+    stage: 'dns' | 'address-policy' | 'connect' | 'tls' | 'http' | 'readiness';
+    code: string;
+    message: string;
+    tls?: IDeploymentRouteVerificationSuccessEvidence['tls'];
+    http?: IDeploymentRouteVerificationSuccessEvidence['http'];
+    readiness?: IDeploymentRouteVerificationSuccessEvidence['readiness'];
+}
+export type IDeploymentRouteVerificationEvidence = IDeploymentRouteVerificationSuccessEvidence | IDeploymentRouteVerificationFailureEvidence;
+export interface IDeploymentOperationFailure {
+    code: string;
+    message: string;
+    retryable: boolean;
+    failedAt: number;
+}
+/**
+ * Durable deployment fence. All state transitions compare-and-set both id and
+ * revision. Claim keys are server-generated and never accepted as authority.
+ */
+export interface IServiceDeploymentOperation {
+    id: string;
+    revision: number;
+    data: {
+        mode: TDeploymentOperationMode;
+        organizationId: string;
+        serviceId: string;
+        actorUserId: string;
+        idempotencyKey: string;
+        requestDigest: TSha256Digest;
+        sourceRevision: string;
+        version: string;
+        intentDigest: TSha256Digest;
+        configurationDigest: TSha256Digest;
+        proposedConfiguration: IDeploymentPreflightProposedConfiguration;
+        namespace: string;
+        registryTarget: IRegistryTarget;
+        releaseTag: string;
+        routes: IDeploymentRouteRequest[];
+        claimKeys: string[];
+        state: TDeploymentOperationState;
+        releaseId?: string;
+        registryRootDigest?: TSha256Digest;
+        rolloutId?: string;
+        rolloutGeneration?: number;
+        routeGeneration?: number;
+        routeVerification?: IDeploymentRouteVerificationEvidence[];
+        failure?: IDeploymentOperationFailure;
+        createdAt: number;
+        updatedAt: number;
+    };
+}
+export interface IServiceDeploymentStatus {
+    operation: IServiceDeploymentOperation;
+    imageDeployment?: IImmutableImageDeploymentPlan;
+    imageRolloutStatus?: IImageRolloutStatus;
+    runtimeTasks: IDeploymentRuntimeTaskEvidence[];
+    routeVerification: IDeploymentRouteVerificationEvidence[];
+    immutableRolloutSucceeded: boolean;
+    runtimeDigestVerified: boolean;
+    routeVerified: boolean;
+    succeeded: boolean;
+}
+interface IDeploymentRuntimeTaskEvidenceBase extends Omit<IDeploymentPreflightRuntimeTask, 'verificationStatus' | 'observedDigest' | 'reportedDigest'> {
+    rolloutId: string;
+    rolloutGeneration: number;
+    expectedDigest: TSha256Digest;
+    observedAt: number;
+}
+export interface IVerifiedDeploymentRuntimeTaskEvidence extends IDeploymentRuntimeTaskEvidenceBase {
+    verificationStatus: 'verified';
+    observedDigest: TSha256Digest;
+    reportedDigest: TSha256Digest;
+}
+export interface IUnverifiedDeploymentRuntimeTaskEvidence extends IDeploymentRuntimeTaskEvidenceBase {
+    verificationStatus: 'missing' | 'mismatched';
+    observedDigest?: TSha256Digest;
+    reportedDigest?: TSha256Digest;
+}
+export type IDeploymentRuntimeTaskEvidence = IVerifiedDeploymentRuntimeTaskEvidence | IUnverifiedDeploymentRuntimeTaskEvidence;
+export {};