@serve.zone/interfaces 15.0.0 → 16.0.0

package/changelog.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 2026-07-20 - 16.0.0
+
+### Breaking Changes
+
+- add attested existing-service adoption contracts (deployment)
+  - Add a mutation-free adoption preflight and a digest-fenced, idempotent adoption request.
+  - Require explicit service-scoped deployment:adopt-existing authority.
+  - Bind registry, release, target-scope, and healthy runtime digest evidence before switching a mutable service to immutable rollout state.
+
 ## 2026-07-20 - 15.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '15.0.0',
+    version: '16.0.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/deploymentadoption.d.ts

@@ -0,0 +1,95 @@
+import type { IDeploymentPreflightRuntimeTask, IOciPlatformDescriptorSummary } from './deploymentpreflight.js';
+import type { IImmutableImageDeploymentPlan, IImmutableImageTargetScope, TOciManifestMediaType, TSha256Digest } from './immutableimage.js';
+import type { IRegistryTarget } from './registry.js';
+export type TServiceDeploymentAdoptionDecision = 'GO' | 'NO-GO';
+/**
+ * Canonical sha256 hash of the complete adoption preflight snapshot. It is a
+ * state/TOCTOU fence and must never be substituted with the OCI image digest.
+ */
+export type TServiceDeploymentAdoptionDigest = TSha256Digest & {
+    readonly __serviceDeploymentAdoptionDigest: unique symbol;
+};
+export type TServiceDeploymentAdoptionBlockerCode = 'INVALID_REQUEST' | 'AUTHORIZATION_MISSING' | 'SERVICE_NOT_FOUND' | 'SERVICE_OWNERSHIP_MISMATCH' | 'SERVICE_ALREADY_IMMUTABLE' | 'SERVICE_STATE_CONFLICT' | 'REGISTRY_TARGET_MISSING' | 'REGISTRY_REFERENCE_INVALID' | 'REGISTRY_DIGEST_MISSING' | 'OCI_INDEX_REQUIRED' | 'OCI_PLATFORM_MISSING' | 'RELEASE_NOT_FOUND' | 'RELEASE_TAG_AMBIGUOUS' | 'TARGET_SCOPE_UNAVAILABLE' | 'RUNTIME_ATTESTATION_INCOMPLETE' | 'RUNTIME_DIGEST_MISMATCH';
+export interface IServiceDeploymentAdoptionBlocker {
+    code: TServiceDeploymentAdoptionBlockerCode;
+    message: string;
+}
+export interface IServiceDeploymentAdoptionPreflightInput {
+    requestId: string;
+    organizationId: string;
+    serviceId: string;
+}
+export interface IServiceDeploymentAdoptionInput extends IServiceDeploymentAdoptionPreflightInput {
+    idempotencyKey: string;
+    expectedAdoptionDigest: TServiceDeploymentAdoptionDigest;
+}
+interface IServiceDeploymentAdoptionReportBase {
+    schemaVersion: 1;
+    mutationPerformed: false;
+    requestId: string;
+    generatedAt: number;
+    runtimeAttestation: {
+        requiredReplicaCount: number;
+        observedReplicaCount: number;
+        healthyReplicaCount: number;
+        observedDigestReplicaCount: number;
+        observedDigestConsistent: boolean;
+    };
+}
+interface IServiceDeploymentAdoptionServiceSnapshot {
+    organizationId: string;
+    serviceId: string;
+    serviceName: string;
+    imageId: string;
+    deployOnPush: boolean;
+    immutableImageRequired: boolean;
+    configuredReference: string;
+    registryTarget: IRegistryTarget;
+}
+interface IServiceDeploymentAdoptionRegistrySnapshot {
+    tag?: string;
+    digest?: TSha256Digest;
+    mediaType?: TOciManifestMediaType;
+    platforms: IOciPlatformDescriptorSummary[];
+    releaseId?: string;
+    releaseTag?: string;
+}
+export interface IServiceDeploymentAdoptionGoReport extends IServiceDeploymentAdoptionReportBase {
+    decision: 'GO';
+    service: IServiceDeploymentAdoptionServiceSnapshot & {
+        deployOnPush: true;
+        immutableImageRequired: false;
+    };
+    registry: IServiceDeploymentAdoptionRegistrySnapshot & {
+        tag: string;
+        digest: TSha256Digest;
+        mediaType: 'application/vnd.oci.image.index.v1+json' | 'application/vnd.docker.distribution.manifest.list.v2+json';
+        platforms: [IOciPlatformDescriptorSummary, ...IOciPlatformDescriptorSummary[]];
+        releaseId: string;
+        releaseTag: string;
+    };
+    runtimeTasks: [IDeploymentPreflightRuntimeTask, ...IDeploymentPreflightRuntimeTask[]];
+    targetScope: IImmutableImageTargetScope;
+    adoptionDigest: TServiceDeploymentAdoptionDigest;
+    blockers: [];
+}
+export interface IServiceDeploymentAdoptionNoGoReport extends IServiceDeploymentAdoptionReportBase {
+    decision: 'NO-GO';
+    service?: IServiceDeploymentAdoptionServiceSnapshot;
+    registry: IServiceDeploymentAdoptionRegistrySnapshot;
+    runtimeTasks: IDeploymentPreflightRuntimeTask[];
+    targetScope?: IImmutableImageTargetScope;
+    adoptionDigest?: never;
+    blockers: [IServiceDeploymentAdoptionBlocker, ...IServiceDeploymentAdoptionBlocker[]];
+}
+export type IServiceDeploymentAdoptionReport = IServiceDeploymentAdoptionGoReport | IServiceDeploymentAdoptionNoGoReport;
+export interface IServiceDeploymentAdoptionResult {
+    adoptionId: string;
+    adoptionDigest: TServiceDeploymentAdoptionDigest;
+    idempotentReplay: boolean;
+    plan: IImmutableImageDeploymentPlan;
+}
+export declare const validateServiceDeploymentAdoptionPreflightInput: (inputArg: unknown) => string[];
+export declare const validateServiceDeploymentAdoptionInput: (inputArg: unknown) => string[];
+export declare const validateServiceDeploymentAdoptionReport: (reportArg: unknown) => string[];
+export {};

package/dist_ts/data/deploymentadoption.js

@@ -0,0 +1,303 @@
+import { normalizeImmutableReleaseTag, normalizeSha256Digest } from './immutableimage.js';
+const boundaryIdentifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const indexMediaTypes = new Set([
+    'application/vnd.oci.image.index.v1+json',
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+]);
+const adoptionBlockerCodes = new Set([
+    'INVALID_REQUEST',
+    'AUTHORIZATION_MISSING',
+    'SERVICE_NOT_FOUND',
+    'SERVICE_OWNERSHIP_MISMATCH',
+    'SERVICE_ALREADY_IMMUTABLE',
+    'SERVICE_STATE_CONFLICT',
+    'REGISTRY_TARGET_MISSING',
+    'REGISTRY_REFERENCE_INVALID',
+    'REGISTRY_DIGEST_MISSING',
+    'OCI_INDEX_REQUIRED',
+    'OCI_PLATFORM_MISSING',
+    'RELEASE_NOT_FOUND',
+    'RELEASE_TAG_AMBIGUOUS',
+    'TARGET_SCOPE_UNAVAILABLE',
+    'RUNTIME_ATTESTATION_INCOMPLETE',
+    'RUNTIME_DIGEST_MISMATCH',
+]);
+const isRecord = (valueArg) => Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg);
+const isBoundedIdentifier = (valueArg) => typeof valueArg === 'string' && boundaryIdentifierRegex.test(valueArg);
+const isCanonicalDigest = (valueArg) => Boolean(normalizeSha256Digest(valueArg)) && normalizeSha256Digest(valueArg) === valueArg;
+const isNonNegativeInteger = (valueArg) => Number.isSafeInteger(valueArg) && valueArg >= 0;
+export const validateServiceDeploymentAdoptionPreflightInput = (inputArg) => {
+    if (!isRecord(inputArg))
+        return ['adoption preflight input must be an object'];
+    const errors = [];
+    if (!isBoundedIdentifier(inputArg.requestId)) {
+        errors.push('requestId must be a bounded canonical identifier');
+    }
+    for (const key of ['organizationId', 'serviceId']) {
+        if (!isBoundedIdentifier(inputArg[key])) {
+            errors.push(`${key} must be a bounded canonical identifier`);
+        }
+    }
+    return errors;
+};
+export const validateServiceDeploymentAdoptionInput = (inputArg) => {
+    const errors = validateServiceDeploymentAdoptionPreflightInput(inputArg);
+    if (!isRecord(inputArg))
+        return errors;
+    if (!isBoundedIdentifier(inputArg.idempotencyKey)) {
+        errors.push('idempotencyKey must be a bounded canonical identifier');
+    }
+    if (!isCanonicalDigest(inputArg.expectedAdoptionDigest)) {
+        errors.push('expectedAdoptionDigest must be a canonical sha256 digest');
+    }
+    return errors;
+};
+export const validateServiceDeploymentAdoptionReport = (reportArg) => {
+    if (!isRecord(reportArg))
+        return ['adoption report must be an object'];
+    const errors = [];
+    if (reportArg.schemaVersion !== 1)
+        errors.push('schemaVersion must be 1');
+    if (reportArg.mutationPerformed !== false) {
+        errors.push('adoption preflight must be mutation-free');
+    }
+    if (!isBoundedIdentifier(reportArg.requestId)) {
+        errors.push('requestId must be a bounded canonical identifier');
+    }
+    if (!isNonNegativeInteger(reportArg.generatedAt)) {
+        errors.push('generatedAt must be a non-negative integer');
+    }
+    if (reportArg.decision !== 'GO' && reportArg.decision !== 'NO-GO') {
+        errors.push('decision must be GO or NO-GO');
+    }
+    const attestation = reportArg.runtimeAttestation;
+    if (!isRecord(attestation)) {
+        errors.push('runtimeAttestation must be an object');
+    }
+    else {
+        for (const key of [
+            'requiredReplicaCount',
+            'observedReplicaCount',
+            'healthyReplicaCount',
+            'observedDigestReplicaCount',
+        ]) {
+            if (!isNonNegativeInteger(attestation[key])) {
+                errors.push(`runtimeAttestation.${key} must be a non-negative integer`);
+            }
+        }
+        if (typeof attestation.observedDigestConsistent !== 'boolean') {
+            errors.push('runtimeAttestation.observedDigestConsistent must be boolean');
+        }
+    }
+    const blockers = reportArg.blockers;
+    if (!Array.isArray(blockers)) {
+        errors.push('blockers must be an array');
+    }
+    else {
+        for (const blocker of blockers) {
+            if (!isRecord(blocker)
+                || !adoptionBlockerCodes.has(blocker.code)
+                || typeof blocker.message !== 'string'
+                || !blocker.message.trim()) {
+                errors.push('each blocker must contain a supported code and non-empty message');
+                break;
+            }
+        }
+    }
+    if (reportArg.decision === 'NO-GO') {
+        if (Array.isArray(blockers) && blockers.length === 0) {
+            errors.push('a NO-GO report must contain at least one blocker');
+        }
+        if (reportArg.adoptionDigest !== undefined) {
+            errors.push('a NO-GO report must not contain an adoption digest');
+        }
+        return errors;
+    }
+    if (reportArg.decision !== 'GO')
+        return errors;
+    if (Array.isArray(blockers) && blockers.length !== 0) {
+        errors.push('a GO report must not contain blockers');
+    }
+    if (!isCanonicalDigest(reportArg.adoptionDigest)) {
+        errors.push('a GO report requires a canonical adoption digest');
+    }
+    const service = reportArg.service;
+    const registry = reportArg.registry;
+    const targetScope = reportArg.targetScope;
+    const runtimeTasks = reportArg.runtimeTasks;
+    if (!isRecord(service)) {
+        errors.push('a GO report requires a service snapshot');
+    }
+    else {
+        for (const key of ['organizationId', 'serviceId', 'serviceName', 'imageId']) {
+            if (!isBoundedIdentifier(service[key]))
+                errors.push(`service.${key} is invalid`);
+        }
+        if (service.deployOnPush !== true || service.immutableImageRequired !== false) {
+            errors.push('a GO report requires the legacy mutable service state');
+        }
+        if (typeof service.configuredReference !== 'string' || !service.configuredReference.trim()) {
+            errors.push('service.configuredReference must be non-empty');
+        }
+        if (!isRecord(service.registryTarget)) {
+            errors.push('service.registryTarget must be present');
+        }
+    }
+    let registryDigest;
+    if (!isRecord(registry)) {
+        errors.push('a GO report requires a registry snapshot');
+    }
+    else {
+        if (!normalizeImmutableReleaseTag(registry.tag) || registry.tag !== registry.releaseTag) {
+            errors.push('registry tag and releaseTag must be the same immutable tag');
+        }
+        if (!isCanonicalDigest(registry.digest)) {
+            errors.push('registry.digest must be a canonical sha256 digest');
+        }
+        else {
+            registryDigest = registry.digest;
+            if (reportArg.adoptionDigest === registry.digest) {
+                errors.push('adoption digest must be a distinct full-state fence, not the image digest');
+            }
+        }
+        if (!indexMediaTypes.has(registry.mediaType)) {
+            errors.push('registry.mediaType must identify an OCI image index');
+        }
+        if (!isBoundedIdentifier(registry.releaseId)) {
+            errors.push('registry.releaseId must be a bounded canonical identifier');
+        }
+        if (!Array.isArray(registry.platforms) || registry.platforms.length === 0) {
+            errors.push('registry.platforms must contain OCI platform evidence');
+        }
+        else {
+            for (const architecture of ['amd64', 'arm64']) {
+                if (!registry.platforms.some((platformArg) => isRecord(platformArg)
+                    && platformArg.os === 'linux'
+                    && platformArg.architecture === architecture
+                    && platformArg.runnable === true
+                    && platformArg.manifestPresent === true
+                    && isCanonicalDigest(platformArg.digest))) {
+                    errors.push(`registry.platforms must contain runnable linux/${architecture} evidence`);
+                }
+            }
+        }
+    }
+    let requiredReplicaCount;
+    let targetNodeNames = [];
+    let replicasPerNode;
+    if (!isRecord(targetScope)) {
+        errors.push('a GO report requires an immutable target scope');
+    }
+    else {
+        const clusterIds = targetScope.targetClusterIds;
+        const nodeNames = targetScope.targetNodeNames;
+        replicasPerNode = targetScope.replicasPerNode;
+        requiredReplicaCount = targetScope.requiredReplicaCount;
+        if (!Array.isArray(clusterIds) || clusterIds.length !== 1
+            || clusterIds.some((valueArg) => !isBoundedIdentifier(valueArg))
+            || new Set(clusterIds).size !== clusterIds.length) {
+            errors.push('targetScope.targetClusterIds must identify exactly one attested cluster');
+        }
+        if (!Array.isArray(nodeNames) || nodeNames.length === 0
+            || nodeNames.some((valueArg) => !isBoundedIdentifier(valueArg))
+            || new Set(nodeNames).size !== nodeNames.length) {
+            errors.push('targetScope.targetNodeNames must be non-empty and unique');
+        }
+        else {
+            targetNodeNames = nodeNames;
+        }
+        if (!Number.isSafeInteger(replicasPerNode) || replicasPerNode < 1) {
+            errors.push('targetScope.replicasPerNode must be a positive integer');
+        }
+        if (!Number.isSafeInteger(requiredReplicaCount) || requiredReplicaCount < 1
+            || requiredReplicaCount !== targetNodeNames.length * (replicasPerNode || 0)) {
+            errors.push('targetScope.requiredReplicaCount must match nodes times replicas');
+        }
+    }
+    if (!Array.isArray(runtimeTasks) || runtimeTasks.length === 0) {
+        errors.push('a GO report requires runtime task evidence');
+    }
+    else {
+        if (requiredReplicaCount !== undefined && runtimeTasks.length !== requiredReplicaCount) {
+            errors.push('runtime task count must equal the required replica count');
+        }
+        const deploymentIds = new Set();
+        const taskCountsByNode = new Map();
+        for (const task of runtimeTasks) {
+            if (!isRecord(task)
+                || !isBoundedIdentifier(task.deploymentId)
+                || deploymentIds.has(task.deploymentId)) {
+                errors.push('runtime task deployment IDs must be valid and unique');
+                continue;
+            }
+            deploymentIds.add(task.deploymentId);
+            if (!isBoundedIdentifier(task.nodeName) || !targetNodeNames.includes(task.nodeName)) {
+                errors.push('every runtime task must belong to the exact target node scope');
+            }
+            else {
+                taskCountsByNode.set(task.nodeName, (taskCountsByNode.get(task.nodeName) || 0) + 1);
+            }
+            if (task.status !== 'running' || task.healthStatus !== 'healthy') {
+                errors.push('every runtime task must be running and healthy');
+            }
+            if (!registryDigest || task.observedDigest !== registryDigest) {
+                errors.push('every runtime task must attest the exact registry digest');
+            }
+            if (typeof task.imageReference !== 'string' || !task.imageReference.trim()) {
+                errors.push('every runtime task must identify its image reference');
+            }
+        }
+        if (replicasPerNode !== undefined
+            && targetNodeNames.some((nodeNameArg) => taskCountsByNode.get(nodeNameArg) !== replicasPerNode)) {
+            errors.push('runtime task evidence must cover every target node and replica');
+        }
+    }
+    if (isRecord(attestation) && requiredReplicaCount !== undefined) {
+        if (attestation.requiredReplicaCount !== requiredReplicaCount
+            || attestation.observedReplicaCount !== requiredReplicaCount
+            || attestation.healthyReplicaCount !== requiredReplicaCount
+            || attestation.observedDigestReplicaCount !== requiredReplicaCount
+            || attestation.observedDigestConsistent !== true) {
+            errors.push('runtime attestation must consistently cover every required replica');
+        }
+    }
+    if (isRecord(service) && isRecord(service.registryTarget) && isRecord(registry)) {
+        const target = service.registryTarget;
+        if (target.protocol !== 'oci'
+            || target.tag !== registry.tag
+            || target.serviceId !== service.serviceId
+            || target.imageId !== service.imageId
+            || typeof target.registryHost !== 'string'
+            || !target.registryHost
+            || typeof target.repository !== 'string'
+            || !target.repository
+            || target.imageUrl !== `${target.registryHost}/${target.repository}:${target.tag}`) {
+            errors.push('service registry target must exactly bind the adopted service, image, and tag');
+        }
+        if (registryDigest) {
+            const digestPinnedReference = `${target.registryHost}/${target.repository}@${registryDigest}`;
+            const tagAndDigestReference = `${target.imageUrl}@${registryDigest}`;
+            const configuredReferences = new Set([
+                target.tag,
+                target.imageUrl,
+                digestPinnedReference,
+                tagAndDigestReference,
+            ]);
+            if (!configuredReferences.has(service.configuredReference)) {
+                errors.push('service configured reference must exactly bind the adopted registry target');
+            }
+            const runtimeReferences = new Set([
+                target.imageUrl,
+                digestPinnedReference,
+                tagAndDigestReference,
+            ]);
+            if (Array.isArray(runtimeTasks)
+                && runtimeTasks.some((taskArg) => !isRecord(taskArg)
+                    || !runtimeReferences.has(taskArg.imageReference))) {
+                errors.push('every runtime task image reference must exactly bind the adopted registry target');
+            }
+        }
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudGFkb3B0aW9uLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9kZXBsb3ltZW50YWRvcHRpb24udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBVUEsT0FBTyxFQUFFLDRCQUE0QixFQUFFLHFCQUFxQixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUErSDFGLE1BQU0sdUJBQXVCLEdBQUcscUNBQXFDLENBQUM7QUFDdEUsTUFBTSxlQUFlLEdBQUcsSUFBSSxHQUFHLENBQXdCO0lBQ3JELHlDQUF5QztJQUN6QywyREFBMkQ7Q0FDNUQsQ0FBQyxDQUFDO0FBQ0gsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLEdBQUcsQ0FBd0M7SUFDMUUsaUJBQWlCO0lBQ2pCLHVCQUF1QjtJQUN2QixtQkFBbUI7SUFDbkIsNEJBQTRCO0lBQzVCLDJCQUEyQjtJQUMzQix3QkFBd0I7SUFDeEIseUJBQXlCO0lBQ3pCLDRCQUE0QjtJQUM1Qix5QkFBeUI7SUFDekIsb0JBQW9CO0lBQ3BCLHNCQUFzQjtJQUN0QixtQkFBbUI7SUFDbkIsdUJBQXVCO0lBQ3ZCLDBCQUEwQjtJQUMxQixnQ0FBZ0M7SUFDaEMseUJBQXlCO0NBQzFCLENBQUMsQ0FBQztBQUVILE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUMxRSxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUVoRixNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUNwRSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksdUJBQXVCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRXpFLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUE2QixFQUFFLENBQ3pFLE9BQU8sQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxLQUFLLFFBQVEsQ0FBQztBQUUzRixNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUNyRSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLElBQUksQ0FBQyxDQUFDO0FBRTlELE1BQU0sQ0FBQyxNQUFNLCtDQUErQyxHQUFHLENBQzdELFFBQWlCLEVBQ1AsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDL0UsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxXQUFXLENBQVUsRUFBRSxDQUFDO1FBQzNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxHQUFHLHlDQUF5QyxDQUFDLENBQUM7UUFDL0QsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxDQUFDLFFBQWlCLEVBQVksRUFBRTtJQUNwRixNQUFNLE1BQU0sR0FBRywrQ0FBK0MsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN6RSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sTUFBTSxDQUFDO0lBQ3ZDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsc0JBQXNCLENBQUMsRUFBRSxDQUFDO1FBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FBQyxTQUFrQixFQUFZLEVBQUU7SUFDdEYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7UUFBRSxPQUFPLENBQUMsbUNBQW1DLENBQUMsQ0FBQztJQUN2RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxTQUFTLENBQUMsYUFBYSxLQUFLLENBQUM7UUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDMUUsSUFBSSxTQUFTLENBQUMsaUJBQWlCLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDMUMsTUFBTSxDQUFDLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDOUMsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLENBQUMsb0JBQW9CLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQzVELENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLFNBQVMsQ0FBQyxRQUFRLEtBQUssT0FBTyxFQUFFLENBQUM7UUFDbEUsTUFBTSxDQUFDLElBQUksQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFFRCxNQUFNLFdBQVcsR0FBRyxTQUFTLENBQUMsa0JBQWtCLENBQUM7SUFDakQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0NBQXNDLENBQUMsQ0FBQztJQUN0RCxDQUFDO1NBQU0sQ0FBQztRQUNOLEtBQUssTUFBTSxHQUFHLElBQUk7WUFDaEIsc0JBQXNCO1lBQ3RCLHNCQUFzQjtZQUN0QixxQkFBcUI7WUFDckIsNEJBQTRCO1NBQ3BCLEVBQUUsQ0FBQztZQUNYLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO2dCQUM1QyxNQUFNLENBQUMsSUFBSSxDQUFDLHNCQUFzQixHQUFHLGlDQUFpQyxDQUFDLENBQUM7WUFDMUUsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLE9BQU8sV0FBVyxDQUFDLHdCQUF3QixLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzlELE1BQU0sQ0FBQyxJQUFJLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLFNBQVMsQ0FBQyxRQUFRLENBQUM7SUFDcEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUM3QixNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixDQUFDLENBQUM7SUFDM0MsQ0FBQztTQUFNLENBQUM7UUFDTixLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQy9CLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO21CQUNqQixDQUFDLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsSUFBNkMsQ0FBQzttQkFDaEYsT0FBTyxPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVE7bUJBQ25DLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUM3QixNQUFNLENBQUMsSUFBSSxDQUFDLGtFQUFrRSxDQUFDLENBQUM7Z0JBQ2hGLE1BQU07WUFDUixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLFNBQVMsQ0FBQyxRQUFRLEtBQUssT0FBTyxFQUFFLENBQUM7UUFDbkMsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDckQsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyxjQUFjLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDM0MsTUFBTSxDQUFDLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMsUUFBUSxLQUFLLElBQUk7UUFBRSxPQUFPLE1BQU0sQ0FBQztJQUUvQyxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUVELE1BQU0sT0FBTyxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUM7SUFDbEMsTUFBTSxRQUFRLEdBQUcsU0FBUyxDQUFDLFFBQVEsQ0FBQztJQUNwQyxNQUFNLFdBQVcsR0FBRyxTQUFTLENBQUMsV0FBVyxDQUFDO0lBQzFDLE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxZQUFZLENBQUM7SUFDNUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sQ0FBQyxJQUFJLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUN6RCxDQUFDO1NBQU0sQ0FBQztRQUNOLEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLFNBQVMsQ0FBVSxFQUFFLENBQUM7WUFDckYsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsR0FBRyxhQUFhLENBQUMsQ0FBQztRQUNuRixDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsWUFBWSxLQUFLLElBQUksSUFBSSxPQUFPLENBQUMsc0JBQXNCLEtBQUssS0FBSyxFQUFFLENBQUM7WUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLG1CQUFtQixLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQzNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztZQUN0QyxNQUFNLENBQUMsSUFBSSxDQUFDLHdDQUF3QyxDQUFDLENBQUM7UUFDeEQsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLGNBQXlDLENBQUM7SUFDOUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sQ0FBQyxJQUFJLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUMxRCxDQUFDO1NBQU0sQ0FBQztRQUNOLElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksUUFBUSxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDeEYsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO1FBQzVFLENBQUM7UUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO1FBQ25FLENBQUM7YUFBTSxDQUFDO1lBQ04sY0FBYyxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUM7WUFDakMsSUFBSSxTQUFTLENBQUMsY0FBYyxLQUFLLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywyRUFBMkUsQ0FBQyxDQUFDO1lBQzNGLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLFNBQWtDLENBQUMsRUFBRSxDQUFDO1lBQ3RFLE1BQU0sQ0FBQyxJQUFJLENBQUMscURBQXFELENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQzdDLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUN2RSxDQUFDO2FBQU0sQ0FBQztZQUNOLEtBQUssTUFBTSxZQUFZLElBQUksQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDOUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO3VCQUM5RCxXQUFXLENBQUMsRUFBRSxLQUFLLE9BQU87dUJBQzFCLFdBQVcsQ0FBQyxZQUFZLEtBQUssWUFBWTt1QkFDekMsV0FBVyxDQUFDLFFBQVEsS0FBSyxJQUFJO3VCQUM3QixXQUFXLENBQUMsZUFBZSxLQUFLLElBQUk7dUJBQ3BDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7b0JBQzVDLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0RBQWtELFlBQVksV0FBVyxDQUFDLENBQUM7Z0JBQ3pGLENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLG9CQUF3QyxDQUFDO0lBQzdDLElBQUksZUFBZSxHQUFhLEVBQUUsQ0FBQztJQUNuQyxJQUFJLGVBQW1DLENBQUM7SUFDeEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQzNCLE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUNoRSxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sVUFBVSxHQUFHLFdBQVcsQ0FBQyxnQkFBZ0IsQ0FBQztRQUNoRCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsZUFBZSxDQUFDO1FBQzlDLGVBQWUsR0FBRyxXQUFXLENBQUMsZUFBeUIsQ0FBQztRQUN4RCxvQkFBb0IsR0FBRyxXQUFXLENBQUMsb0JBQThCLENBQUM7UUFDbEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ3BELFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsbUJBQW1CLENBQUMsUUFBUSxDQUFDLENBQUM7ZUFDN0QsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNwRCxNQUFNLENBQUMsSUFBSSxDQUFDLHlFQUF5RSxDQUFDLENBQUM7UUFDekYsQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQztlQUNsRCxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxDQUFDO2VBQzVELElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbEQsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzFFLENBQUM7YUFBTSxDQUFDO1lBQ04sZUFBZSxHQUFHLFNBQXFCLENBQUM7UUFDMUMsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGVBQWUsQ0FBQyxJQUFJLGVBQWUsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNsRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdEQUF3RCxDQUFDLENBQUM7UUFDeEUsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLG9CQUFvQixDQUFDLElBQUksb0JBQW9CLEdBQUcsQ0FBQztlQUN0RSxvQkFBb0IsS0FBSyxlQUFlLENBQUMsTUFBTSxHQUFHLENBQUMsZUFBZSxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO1FBQ2xGLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLDRDQUE0QyxDQUFDLENBQUM7SUFDNUQsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLG9CQUFvQixLQUFLLFNBQVMsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLG9CQUFvQixFQUFFLENBQUM7WUFDdkYsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxNQUFNLGFBQWEsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ3hDLE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7UUFDbkQsS0FBSyxNQUFNLElBQUksSUFBSSxZQUFZLEVBQUUsQ0FBQztZQUNoQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQzttQkFDZCxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7bUJBQ3ZDLGFBQWEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFlBQXNCLENBQUMsRUFBRSxDQUFDO2dCQUNwRCxNQUFNLENBQUMsSUFBSSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7Z0JBQ3BFLFNBQVM7WUFDWCxDQUFDO1lBQ0QsYUFBYSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsWUFBc0IsQ0FBQyxDQUFDO1lBQy9DLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO2dCQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7WUFDL0UsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztZQUN0RixDQUFDO1lBQ0QsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxJQUFJLENBQUMsWUFBWSxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUNqRSxNQUFNLENBQUMsSUFBSSxDQUFDLGdEQUFnRCxDQUFDLENBQUM7WUFDaEUsQ0FBQztZQUNELElBQUksQ0FBQyxjQUFjLElBQUksSUFBSSxDQUFDLGNBQWMsS0FBSyxjQUFjLEVBQUUsQ0FBQztnQkFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1lBQzFFLENBQUM7WUFDRCxJQUFJLE9BQU8sSUFBSSxDQUFDLGNBQWMsS0FBSyxRQUFRLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7Z0JBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsc0RBQXNELENBQUMsQ0FBQztZQUN0RSxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksZUFBZSxLQUFLLFNBQVM7ZUFDNUIsZUFBZSxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxLQUFLLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDbEcsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxRQUFRLENBQUMsV0FBVyxDQUFDLElBQUksb0JBQW9CLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDaEUsSUFBSSxXQUFXLENBQUMsb0JBQW9CLEtBQUssb0JBQW9CO2VBQ3hELFdBQVcsQ0FBQyxvQkFBb0IsS0FBSyxvQkFBb0I7ZUFDekQsV0FBVyxDQUFDLG1CQUFtQixLQUFLLG9CQUFvQjtlQUN4RCxXQUFXLENBQUMsMEJBQTBCLEtBQUssb0JBQW9CO2VBQy9ELFdBQVcsQ0FBQyx3QkFBd0IsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxjQUFjLENBQUM7UUFDdEMsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLEtBQUs7ZUFDeEIsTUFBTSxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsR0FBRztlQUMzQixNQUFNLENBQUMsU0FBUyxLQUFLLE9BQU8sQ0FBQyxTQUFTO2VBQ3RDLE1BQU0sQ0FBQyxPQUFPLEtBQUssT0FBTyxDQUFDLE9BQU87ZUFDbEMsT0FBTyxNQUFNLENBQUMsWUFBWSxLQUFLLFFBQVE7ZUFDdkMsQ0FBQyxNQUFNLENBQUMsWUFBWTtlQUNwQixPQUFPLE1BQU0sQ0FBQyxVQUFVLEtBQUssUUFBUTtlQUNyQyxDQUFDLE1BQU0sQ0FBQyxVQUFVO2VBQ2xCLE1BQU0sQ0FBQyxRQUFRLEtBQUssR0FBRyxNQUFNLENBQUMsWUFBWSxJQUFJLE1BQU0sQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDckYsTUFBTSxDQUFDLElBQUksQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQy9GLENBQUM7UUFDRCxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLE1BQU0scUJBQXFCLEdBQUcsR0FBRyxNQUFNLENBQUMsWUFBWSxJQUFJLE1BQU0sQ0FBQyxVQUFVLElBQUksY0FBYyxFQUFFLENBQUM7WUFDOUYsTUFBTSxxQkFBcUIsR0FBRyxHQUFHLE1BQU0sQ0FBQyxRQUFRLElBQUksY0FBYyxFQUFFLENBQUM7WUFDckUsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLEdBQUcsQ0FBQztnQkFDbkMsTUFBTSxDQUFDLEdBQUc7Z0JBQ1YsTUFBTSxDQUFDLFFBQVE7Z0JBQ2YscUJBQXFCO2dCQUNyQixxQkFBcUI7YUFDdEIsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsbUJBQTZCLENBQUMsRUFBRSxDQUFDO2dCQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLDRFQUE0RSxDQUFDLENBQUM7WUFDNUYsQ0FBQztZQUNELE1BQU0saUJBQWlCLEdBQUcsSUFBSSxHQUFHLENBQUM7Z0JBQ2hDLE1BQU0sQ0FBQyxRQUFRO2dCQUNmLHFCQUFxQjtnQkFDckIscUJBQXFCO2FBQ3RCLENBQUMsQ0FBQztZQUNILElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7bUJBQzFCLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQzt1QkFDL0MsQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLGNBQXdCLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0ZBQWtGLENBQUMsQ0FBQztZQUNsRyxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/data/index.d.ts

@@ -2,6 +2,7 @@ export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './config.js';
 export * from './deployment.js';
+export * from './deploymentadoption.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
 export * from './migration.js';

package/dist_ts/data/index.js

@@ -2,6 +2,7 @@ export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './config.js';
 export * from './deployment.js';
+export * from './deploymentadoption.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
 export * from './migration.js';
@@ -32,4 +33,4 @@ export * from './taskexecution.js';
 export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQyJ9

package/dist_ts/data/user.d.ts

@@ -3,7 +3,7 @@ export interface IToken {
     expiresAt: number;
     assignedRoles: string[];
 }
-export type TServiceDeploymentCapability = 'deployment:preflight' | 'deployment:reserve' | 'deployment:registry-push' | 'deployment:release-read' | 'deployment:promote-image' | 'deployment:status' | 'deployment:create-greenfield' | 'deployment:promote-route' | 'deployment:rollback-image' | 'deployment:rollback-route' | 'deployment:retry' | 'deployment:cleanup';
+export type TServiceDeploymentCapability = 'deployment:preflight' | 'deployment:reserve' | 'deployment:registry-push' | 'deployment:release-read' | 'deployment:promote-image' | 'deployment:adopt-existing' | 'deployment:status' | 'deployment:create-greenfield' | 'deployment:promote-route' | 'deployment:rollback-image' | 'deployment:rollback-route' | 'deployment:retry' | 'deployment:cleanup';
 /**
  * Server-persisted authority for one logical service. These grants are never
  * accepted from the identity payload supplied by a caller; Cloudly reloads

package/dist_ts/data/user.js

@@ -4,6 +4,7 @@ const serviceDeploymentCapabilities = new Set([
     'deployment:registry-push',
     'deployment:release-read',
     'deployment:promote-image',
+    'deployment:adopt-existing',
     'deployment:status',
     'deployment:create-greenfield',
     'deployment:promote-route',
@@ -49,6 +50,10 @@ export const validateServiceDeploymentGrant = (grantArg) => {
         && !capabilities.includes('deployment:create-greenfield')) {
         errors.push('an organization-service-slot grant must authorize greenfield creation');
     }
+    if (capabilities && grant.scope !== 'service'
+        && capabilities.includes('deployment:adopt-existing')) {
+        errors.push('deployment:adopt-existing requires an existing-service grant');
+    }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXNlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvdXNlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUE2Q0EsTUFBTSw2QkFBNkIsR0FBRyxJQUFJLEdBQUcsQ0FBK0I7SUFDMUUsc0JBQXNCO0lBQ3RCLG9CQUFvQjtJQUNwQiwwQkFBMEI7SUFDMUIseUJBQXlCO0lBQ3pCLDBCQUEwQjtJQUMxQixtQkFBbUI7SUFDbkIsOEJBQThCO0lBQzlCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IsMkJBQTJCO0lBQzNCLGtCQUFrQjtJQUNsQixvQkFBb0I7Q0FDckIsQ0FBQyxDQUFDO0FBRUgsTUFBTSxpQ0FBaUMsR0FBRyxxQ0FBcUMsQ0FBQztBQUVoRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxRQUFpQixFQUNQLEVBQUU7SUFDWixNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFFBQVEsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ3pFLE9BQU8sQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ3JDLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxRQUFtQyxDQUFDO0lBQ2xELElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSywyQkFBMkIsRUFBRSxDQUFDO1FBQzdFLE1BQU0sQ0FBQyxJQUFJLENBQUMseUVBQXlFLENBQUMsQ0FBQztJQUN6RixDQUFDO0lBQ0QsSUFBSSxPQUFPLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUTtXQUN2QyxDQUFDLGlDQUFpQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUNuRSxNQUFNLENBQUMsSUFBSSxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksT0FBTyxLQUFLLENBQUMsU0FBUyxLQUFLLFFBQVE7V0FDbEMsQ0FBQyxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7UUFDcEQsQ0FBQyxDQUFDLEtBQUssQ0FBQyxZQUFZO1FBQ3BCLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDZCxJQUFJLENBQUMsWUFBWTtXQUNaLFlBQVksQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUN2QixZQUFZLENBQUMsTUFBTSxHQUFHLDZCQUE2QixDQUFDLElBQUk7V0FDeEQsSUFBSSxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUMsSUFBSSxLQUFLLFlBQVksQ0FBQyxNQUFNO1dBQ2xELFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQyxhQUFhLEVBQUUsRUFBRSxDQUFDLENBQ3RDLE9BQU8sYUFBYSxLQUFLLFFBQVE7ZUFDOUIsQ0FBQyw2QkFBNkIsQ0FBQyxHQUFHLENBQUMsYUFBNkMsQ0FBQyxDQUNyRixDQUFDLEVBQUUsQ0FBQztRQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0ZBQWtGLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsSUFBSSxZQUFZLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyxTQUFTO1dBQ3hDLFlBQVksQ0FBQyxRQUFRLENBQUMsOEJBQThCLENBQUMsRUFBRSxDQUFDO1FBQzNELE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsSUFBSSxZQUFZLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSywyQkFBMkI7V0FDMUQsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLDhCQUE4QixDQUFDLEVBQUUsQ0FBQztRQUM1RCxNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXNlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvdXNlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUE4Q0EsTUFBTSw2QkFBNkIsR0FBRyxJQUFJLEdBQUcsQ0FBK0I7SUFDMUUsc0JBQXNCO0lBQ3RCLG9CQUFvQjtJQUNwQiwwQkFBMEI7SUFDMUIseUJBQXlCO0lBQ3pCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IsbUJBQW1CO0lBQ25CLDhCQUE4QjtJQUM5QiwwQkFBMEI7SUFDMUIsMkJBQTJCO0lBQzNCLDJCQUEyQjtJQUMzQixrQkFBa0I7SUFDbEIsb0JBQW9CO0NBQ3JCLENBQUMsQ0FBQztBQUVILE1BQU0saUNBQWlDLEdBQUcscUNBQXFDLENBQUM7QUFFaEYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FDNUMsUUFBaUIsRUFDUCxFQUFFO0lBQ1osTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxRQUFRLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN6RSxPQUFPLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsUUFBbUMsQ0FBQztJQUNsRCxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssMkJBQTJCLEVBQUUsQ0FBQztRQUM3RSxNQUFNLENBQUMsSUFBSSxDQUFDLHlFQUF5RSxDQUFDLENBQUM7SUFDekYsQ0FBQztJQUNELElBQUksT0FBTyxLQUFLLENBQUMsY0FBYyxLQUFLLFFBQVE7V0FDdkMsQ0FBQyxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ2xDLENBQUMsaUNBQWlDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzlELE1BQU0sQ0FBQyxJQUFJLENBQUMsa0RBQWtELENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQ3BELENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWTtRQUNwQixDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ2QsSUFBSSxDQUFDLFlBQVk7V0FDWixZQUFZLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkIsWUFBWSxDQUFDLE1BQU0sR0FBRyw2QkFBNkIsQ0FBQyxJQUFJO1dBQ3hELElBQUksR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDLElBQUksS0FBSyxZQUFZLENBQUMsTUFBTTtXQUNsRCxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxDQUN0QyxPQUFPLGFBQWEsS0FBSyxRQUFRO2VBQzlCLENBQUMsNkJBQTZCLENBQUMsR0FBRyxDQUFDLGFBQTZDLENBQUMsQ0FDckYsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLGtGQUFrRixDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksWUFBWSxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssU0FBUztXQUN4QyxZQUFZLENBQUMsUUFBUSxDQUFDLDhCQUE4QixDQUFDLEVBQUUsQ0FBQztRQUMzRCxNQUFNLENBQUMsSUFBSSxDQUFDLGdFQUFnRSxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELElBQUksWUFBWSxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssMkJBQTJCO1dBQzFELENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyw4QkFBOEIsQ0FBQyxFQUFFLENBQUM7UUFDNUQsTUFBTSxDQUFDLElBQUksQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO0lBQ3ZGLENBQUM7SUFDRCxJQUFJLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDeEMsWUFBWSxDQUFDLFFBQVEsQ0FBQywyQkFBMkIsQ0FBQyxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/requests/service.d.ts

@@ -7,6 +7,26 @@ import type { IImageRelease } from '../data/immutableimage.js';
 import type { IDeploymentPreflightReport, IDeploymentPreflightRequestData } from '../data/deploymentpreflight.js';
 import type { IDeploymentReservationInput, IServiceDeploymentOperation, IServiceDeploymentStatus } from '../data/deploymentoperation.js';
 import type { TSha256Digest } from '../data/immutableimage.js';
+import type { IServiceDeploymentAdoptionInput, IServiceDeploymentAdoptionPreflightInput, IServiceDeploymentAdoptionReport, IServiceDeploymentAdoptionResult } from '../data/deploymentadoption.js';
+export interface IRequest_Any_Cloudly_GetServiceDeploymentAdoptionPreflight extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetServiceDeploymentAdoptionPreflight> {
+    method: 'getServiceDeploymentAdoptionPreflight';
+    request: IServiceDeploymentAdoptionPreflightInput & {
+        identity: IIdentityCredential;
+    };
+    response: {
+        report: IServiceDeploymentAdoptionReport;
+    };
+}
+export interface IRequest_Any_Cloudly_AdoptServiceDeployment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_AdoptServiceDeployment> {
+    method: 'adoptServiceDeployment';
+    request: IServiceDeploymentAdoptionInput & {
+        identity: IIdentityCredential;
+    };
+    response: {
+        service: IService;
+        result: IServiceDeploymentAdoptionResult;
+    };
+}
 export interface IRequest_Any_Cloudly_GetDeploymentPreflight extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetDeploymentPreflight> {
     method: 'getDeploymentPreflight';
     request: IDeploymentPreflightRequestData & {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "15.0.0",
+  "version": "16.0.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '15.0.0',
+  version: '16.0.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/deploymentadoption.ts

@@ -0,0 +1,445 @@
+import type {
+  IDeploymentPreflightRuntimeTask,
+  IOciPlatformDescriptorSummary,
+} from './deploymentpreflight.js';
+import type {
+  IImmutableImageDeploymentPlan,
+  IImmutableImageTargetScope,
+  TOciManifestMediaType,
+  TSha256Digest,
+} from './immutableimage.js';
+import { normalizeImmutableReleaseTag, normalizeSha256Digest } from './immutableimage.js';
+import type { IRegistryTarget } from './registry.js';
+
+export type TServiceDeploymentAdoptionDecision = 'GO' | 'NO-GO';
+
+/**
+ * Canonical sha256 hash of the complete adoption preflight snapshot. It is a
+ * state/TOCTOU fence and must never be substituted with the OCI image digest.
+ */
+export type TServiceDeploymentAdoptionDigest = TSha256Digest & {
+  readonly __serviceDeploymentAdoptionDigest: unique symbol;
+};
+
+export type TServiceDeploymentAdoptionBlockerCode =
+  | 'INVALID_REQUEST'
+  | 'AUTHORIZATION_MISSING'
+  | 'SERVICE_NOT_FOUND'
+  | 'SERVICE_OWNERSHIP_MISMATCH'
+  | 'SERVICE_ALREADY_IMMUTABLE'
+  | 'SERVICE_STATE_CONFLICT'
+  | 'REGISTRY_TARGET_MISSING'
+  | 'REGISTRY_REFERENCE_INVALID'
+  | 'REGISTRY_DIGEST_MISSING'
+  | 'OCI_INDEX_REQUIRED'
+  | 'OCI_PLATFORM_MISSING'
+  | 'RELEASE_NOT_FOUND'
+  | 'RELEASE_TAG_AMBIGUOUS'
+  | 'TARGET_SCOPE_UNAVAILABLE'
+  | 'RUNTIME_ATTESTATION_INCOMPLETE'
+  | 'RUNTIME_DIGEST_MISMATCH';
+
+export interface IServiceDeploymentAdoptionBlocker {
+  code: TServiceDeploymentAdoptionBlockerCode;
+  message: string;
+}
+
+export interface IServiceDeploymentAdoptionPreflightInput {
+  requestId: string;
+  organizationId: string;
+  serviceId: string;
+}
+
+export interface IServiceDeploymentAdoptionInput
+extends IServiceDeploymentAdoptionPreflightInput {
+  idempotencyKey: string;
+  expectedAdoptionDigest: TServiceDeploymentAdoptionDigest;
+}
+
+interface IServiceDeploymentAdoptionReportBase {
+  schemaVersion: 1;
+  mutationPerformed: false;
+  requestId: string;
+  generatedAt: number;
+  runtimeAttestation: {
+    requiredReplicaCount: number;
+    observedReplicaCount: number;
+    healthyReplicaCount: number;
+    observedDigestReplicaCount: number;
+    observedDigestConsistent: boolean;
+  };
+}
+
+interface IServiceDeploymentAdoptionServiceSnapshot {
+  organizationId: string;
+  serviceId: string;
+  serviceName: string;
+  imageId: string;
+  deployOnPush: boolean;
+  immutableImageRequired: boolean;
+  configuredReference: string;
+  registryTarget: IRegistryTarget;
+}
+
+interface IServiceDeploymentAdoptionRegistrySnapshot {
+  tag?: string;
+  digest?: TSha256Digest;
+  mediaType?: TOciManifestMediaType;
+  platforms: IOciPlatformDescriptorSummary[];
+  releaseId?: string;
+  releaseTag?: string;
+}
+
+export interface IServiceDeploymentAdoptionGoReport
+extends IServiceDeploymentAdoptionReportBase {
+  decision: 'GO';
+  service: IServiceDeploymentAdoptionServiceSnapshot & {
+    deployOnPush: true;
+    immutableImageRequired: false;
+  };
+  registry: IServiceDeploymentAdoptionRegistrySnapshot & {
+    tag: string;
+    digest: TSha256Digest;
+    mediaType:
+      | 'application/vnd.oci.image.index.v1+json'
+      | 'application/vnd.docker.distribution.manifest.list.v2+json';
+    platforms: [IOciPlatformDescriptorSummary, ...IOciPlatformDescriptorSummary[]];
+    releaseId: string;
+    releaseTag: string;
+  };
+  runtimeTasks: [IDeploymentPreflightRuntimeTask, ...IDeploymentPreflightRuntimeTask[]];
+  targetScope: IImmutableImageTargetScope;
+  adoptionDigest: TServiceDeploymentAdoptionDigest;
+  blockers: [];
+}
+
+export interface IServiceDeploymentAdoptionNoGoReport
+extends IServiceDeploymentAdoptionReportBase {
+  decision: 'NO-GO';
+  service?: IServiceDeploymentAdoptionServiceSnapshot;
+  registry: IServiceDeploymentAdoptionRegistrySnapshot;
+  runtimeTasks: IDeploymentPreflightRuntimeTask[];
+  targetScope?: IImmutableImageTargetScope;
+  adoptionDigest?: never;
+  blockers: [IServiceDeploymentAdoptionBlocker, ...IServiceDeploymentAdoptionBlocker[]];
+}
+
+export type IServiceDeploymentAdoptionReport =
+  | IServiceDeploymentAdoptionGoReport
+  | IServiceDeploymentAdoptionNoGoReport;
+
+export interface IServiceDeploymentAdoptionResult {
+  adoptionId: string;
+  adoptionDigest: TServiceDeploymentAdoptionDigest;
+  idempotentReplay: boolean;
+  plan: IImmutableImageDeploymentPlan;
+}
+
+const boundaryIdentifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const indexMediaTypes = new Set<TOciManifestMediaType>([
+  'application/vnd.oci.image.index.v1+json',
+  'application/vnd.docker.distribution.manifest.list.v2+json',
+]);
+const adoptionBlockerCodes = new Set<TServiceDeploymentAdoptionBlockerCode>([
+  'INVALID_REQUEST',
+  'AUTHORIZATION_MISSING',
+  'SERVICE_NOT_FOUND',
+  'SERVICE_OWNERSHIP_MISMATCH',
+  'SERVICE_ALREADY_IMMUTABLE',
+  'SERVICE_STATE_CONFLICT',
+  'REGISTRY_TARGET_MISSING',
+  'REGISTRY_REFERENCE_INVALID',
+  'REGISTRY_DIGEST_MISSING',
+  'OCI_INDEX_REQUIRED',
+  'OCI_PLATFORM_MISSING',
+  'RELEASE_NOT_FOUND',
+  'RELEASE_TAG_AMBIGUOUS',
+  'TARGET_SCOPE_UNAVAILABLE',
+  'RUNTIME_ATTESTATION_INCOMPLETE',
+  'RUNTIME_DIGEST_MISMATCH',
+]);
+
+const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> =>
+  Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg);
+
+const isBoundedIdentifier = (valueArg: unknown): valueArg is string =>
+  typeof valueArg === 'string' && boundaryIdentifierRegex.test(valueArg);
+
+const isCanonicalDigest = (valueArg: unknown): valueArg is TSha256Digest =>
+  Boolean(normalizeSha256Digest(valueArg)) && normalizeSha256Digest(valueArg) === valueArg;
+
+const isNonNegativeInteger = (valueArg: unknown): valueArg is number =>
+  Number.isSafeInteger(valueArg) && (valueArg as number) >= 0;
+
+export const validateServiceDeploymentAdoptionPreflightInput = (
+  inputArg: unknown,
+): string[] => {
+  if (!isRecord(inputArg)) return ['adoption preflight input must be an object'];
+  const errors: string[] = [];
+  if (!isBoundedIdentifier(inputArg.requestId)) {
+    errors.push('requestId must be a bounded canonical identifier');
+  }
+  for (const key of ['organizationId', 'serviceId'] as const) {
+    if (!isBoundedIdentifier(inputArg[key])) {
+      errors.push(`${key} must be a bounded canonical identifier`);
+    }
+  }
+  return errors;
+};
+
+export const validateServiceDeploymentAdoptionInput = (inputArg: unknown): string[] => {
+  const errors = validateServiceDeploymentAdoptionPreflightInput(inputArg);
+  if (!isRecord(inputArg)) return errors;
+  if (!isBoundedIdentifier(inputArg.idempotencyKey)) {
+    errors.push('idempotencyKey must be a bounded canonical identifier');
+  }
+  if (!isCanonicalDigest(inputArg.expectedAdoptionDigest)) {
+    errors.push('expectedAdoptionDigest must be a canonical sha256 digest');
+  }
+  return errors;
+};
+
+export const validateServiceDeploymentAdoptionReport = (reportArg: unknown): string[] => {
+  if (!isRecord(reportArg)) return ['adoption report must be an object'];
+  const errors: string[] = [];
+  if (reportArg.schemaVersion !== 1) errors.push('schemaVersion must be 1');
+  if (reportArg.mutationPerformed !== false) {
+    errors.push('adoption preflight must be mutation-free');
+  }
+  if (!isBoundedIdentifier(reportArg.requestId)) {
+    errors.push('requestId must be a bounded canonical identifier');
+  }
+  if (!isNonNegativeInteger(reportArg.generatedAt)) {
+    errors.push('generatedAt must be a non-negative integer');
+  }
+  if (reportArg.decision !== 'GO' && reportArg.decision !== 'NO-GO') {
+    errors.push('decision must be GO or NO-GO');
+  }
+
+  const attestation = reportArg.runtimeAttestation;
+  if (!isRecord(attestation)) {
+    errors.push('runtimeAttestation must be an object');
+  } else {
+    for (const key of [
+      'requiredReplicaCount',
+      'observedReplicaCount',
+      'healthyReplicaCount',
+      'observedDigestReplicaCount',
+    ] as const) {
+      if (!isNonNegativeInteger(attestation[key])) {
+        errors.push(`runtimeAttestation.${key} must be a non-negative integer`);
+      }
+    }
+    if (typeof attestation.observedDigestConsistent !== 'boolean') {
+      errors.push('runtimeAttestation.observedDigestConsistent must be boolean');
+    }
+  }
+
+  const blockers = reportArg.blockers;
+  if (!Array.isArray(blockers)) {
+    errors.push('blockers must be an array');
+  } else {
+    for (const blocker of blockers) {
+      if (!isRecord(blocker)
+        || !adoptionBlockerCodes.has(blocker.code as TServiceDeploymentAdoptionBlockerCode)
+        || typeof blocker.message !== 'string'
+        || !blocker.message.trim()) {
+        errors.push('each blocker must contain a supported code and non-empty message');
+        break;
+      }
+    }
+  }
+
+  if (reportArg.decision === 'NO-GO') {
+    if (Array.isArray(blockers) && blockers.length === 0) {
+      errors.push('a NO-GO report must contain at least one blocker');
+    }
+    if (reportArg.adoptionDigest !== undefined) {
+      errors.push('a NO-GO report must not contain an adoption digest');
+    }
+    return errors;
+  }
+  if (reportArg.decision !== 'GO') return errors;
+
+  if (Array.isArray(blockers) && blockers.length !== 0) {
+    errors.push('a GO report must not contain blockers');
+  }
+  if (!isCanonicalDigest(reportArg.adoptionDigest)) {
+    errors.push('a GO report requires a canonical adoption digest');
+  }
+
+  const service = reportArg.service;
+  const registry = reportArg.registry;
+  const targetScope = reportArg.targetScope;
+  const runtimeTasks = reportArg.runtimeTasks;
+  if (!isRecord(service)) {
+    errors.push('a GO report requires a service snapshot');
+  } else {
+    for (const key of ['organizationId', 'serviceId', 'serviceName', 'imageId'] as const) {
+      if (!isBoundedIdentifier(service[key])) errors.push(`service.${key} is invalid`);
+    }
+    if (service.deployOnPush !== true || service.immutableImageRequired !== false) {
+      errors.push('a GO report requires the legacy mutable service state');
+    }
+    if (typeof service.configuredReference !== 'string' || !service.configuredReference.trim()) {
+      errors.push('service.configuredReference must be non-empty');
+    }
+    if (!isRecord(service.registryTarget)) {
+      errors.push('service.registryTarget must be present');
+    }
+  }
+
+  let registryDigest: TSha256Digest | undefined;
+  if (!isRecord(registry)) {
+    errors.push('a GO report requires a registry snapshot');
+  } else {
+    if (!normalizeImmutableReleaseTag(registry.tag) || registry.tag !== registry.releaseTag) {
+      errors.push('registry tag and releaseTag must be the same immutable tag');
+    }
+    if (!isCanonicalDigest(registry.digest)) {
+      errors.push('registry.digest must be a canonical sha256 digest');
+    } else {
+      registryDigest = registry.digest;
+      if (reportArg.adoptionDigest === registry.digest) {
+        errors.push('adoption digest must be a distinct full-state fence, not the image digest');
+      }
+    }
+    if (!indexMediaTypes.has(registry.mediaType as TOciManifestMediaType)) {
+      errors.push('registry.mediaType must identify an OCI image index');
+    }
+    if (!isBoundedIdentifier(registry.releaseId)) {
+      errors.push('registry.releaseId must be a bounded canonical identifier');
+    }
+    if (!Array.isArray(registry.platforms) || registry.platforms.length === 0) {
+      errors.push('registry.platforms must contain OCI platform evidence');
+    } else {
+      for (const architecture of ['amd64', 'arm64']) {
+        if (!registry.platforms.some((platformArg) => isRecord(platformArg)
+          && platformArg.os === 'linux'
+          && platformArg.architecture === architecture
+          && platformArg.runnable === true
+          && platformArg.manifestPresent === true
+          && isCanonicalDigest(platformArg.digest))) {
+          errors.push(`registry.platforms must contain runnable linux/${architecture} evidence`);
+        }
+      }
+    }
+  }
+
+  let requiredReplicaCount: number | undefined;
+  let targetNodeNames: string[] = [];
+  let replicasPerNode: number | undefined;
+  if (!isRecord(targetScope)) {
+    errors.push('a GO report requires an immutable target scope');
+  } else {
+    const clusterIds = targetScope.targetClusterIds;
+    const nodeNames = targetScope.targetNodeNames;
+    replicasPerNode = targetScope.replicasPerNode as number;
+    requiredReplicaCount = targetScope.requiredReplicaCount as number;
+    if (!Array.isArray(clusterIds) || clusterIds.length !== 1
+      || clusterIds.some((valueArg) => !isBoundedIdentifier(valueArg))
+      || new Set(clusterIds).size !== clusterIds.length) {
+      errors.push('targetScope.targetClusterIds must identify exactly one attested cluster');
+    }
+    if (!Array.isArray(nodeNames) || nodeNames.length === 0
+      || nodeNames.some((valueArg) => !isBoundedIdentifier(valueArg))
+      || new Set(nodeNames).size !== nodeNames.length) {
+      errors.push('targetScope.targetNodeNames must be non-empty and unique');
+    } else {
+      targetNodeNames = nodeNames as string[];
+    }
+    if (!Number.isSafeInteger(replicasPerNode) || replicasPerNode < 1) {
+      errors.push('targetScope.replicasPerNode must be a positive integer');
+    }
+    if (!Number.isSafeInteger(requiredReplicaCount) || requiredReplicaCount < 1
+      || requiredReplicaCount !== targetNodeNames.length * (replicasPerNode || 0)) {
+      errors.push('targetScope.requiredReplicaCount must match nodes times replicas');
+    }
+  }
+
+  if (!Array.isArray(runtimeTasks) || runtimeTasks.length === 0) {
+    errors.push('a GO report requires runtime task evidence');
+  } else {
+    if (requiredReplicaCount !== undefined && runtimeTasks.length !== requiredReplicaCount) {
+      errors.push('runtime task count must equal the required replica count');
+    }
+    const deploymentIds = new Set<string>();
+    const taskCountsByNode = new Map<string, number>();
+    for (const task of runtimeTasks) {
+      if (!isRecord(task)
+        || !isBoundedIdentifier(task.deploymentId)
+        || deploymentIds.has(task.deploymentId as string)) {
+        errors.push('runtime task deployment IDs must be valid and unique');
+        continue;
+      }
+      deploymentIds.add(task.deploymentId as string);
+      if (!isBoundedIdentifier(task.nodeName) || !targetNodeNames.includes(task.nodeName)) {
+        errors.push('every runtime task must belong to the exact target node scope');
+      } else {
+        taskCountsByNode.set(task.nodeName, (taskCountsByNode.get(task.nodeName) || 0) + 1);
+      }
+      if (task.status !== 'running' || task.healthStatus !== 'healthy') {
+        errors.push('every runtime task must be running and healthy');
+      }
+      if (!registryDigest || task.observedDigest !== registryDigest) {
+        errors.push('every runtime task must attest the exact registry digest');
+      }
+      if (typeof task.imageReference !== 'string' || !task.imageReference.trim()) {
+        errors.push('every runtime task must identify its image reference');
+      }
+    }
+    if (replicasPerNode !== undefined
+      && targetNodeNames.some((nodeNameArg) => taskCountsByNode.get(nodeNameArg) !== replicasPerNode)) {
+      errors.push('runtime task evidence must cover every target node and replica');
+    }
+  }
+
+  if (isRecord(attestation) && requiredReplicaCount !== undefined) {
+    if (attestation.requiredReplicaCount !== requiredReplicaCount
+      || attestation.observedReplicaCount !== requiredReplicaCount
+      || attestation.healthyReplicaCount !== requiredReplicaCount
+      || attestation.observedDigestReplicaCount !== requiredReplicaCount
+      || attestation.observedDigestConsistent !== true) {
+      errors.push('runtime attestation must consistently cover every required replica');
+    }
+  }
+
+  if (isRecord(service) && isRecord(service.registryTarget) && isRecord(registry)) {
+    const target = service.registryTarget;
+    if (target.protocol !== 'oci'
+      || target.tag !== registry.tag
+      || target.serviceId !== service.serviceId
+      || target.imageId !== service.imageId
+      || typeof target.registryHost !== 'string'
+      || !target.registryHost
+      || typeof target.repository !== 'string'
+      || !target.repository
+      || target.imageUrl !== `${target.registryHost}/${target.repository}:${target.tag}`) {
+      errors.push('service registry target must exactly bind the adopted service, image, and tag');
+    }
+    if (registryDigest) {
+      const digestPinnedReference = `${target.registryHost}/${target.repository}@${registryDigest}`;
+      const tagAndDigestReference = `${target.imageUrl}@${registryDigest}`;
+      const configuredReferences = new Set([
+        target.tag,
+        target.imageUrl,
+        digestPinnedReference,
+        tagAndDigestReference,
+      ]);
+      if (!configuredReferences.has(service.configuredReference as string)) {
+        errors.push('service configured reference must exactly bind the adopted registry target');
+      }
+      const runtimeReferences = new Set([
+        target.imageUrl,
+        digestPinnedReference,
+        tagAndDigestReference,
+      ]);
+      if (Array.isArray(runtimeTasks)
+        && runtimeTasks.some((taskArg) => !isRecord(taskArg)
+          || !runtimeReferences.has(taskArg.imageReference as string))) {
+        errors.push('every runtime task image reference must exactly bind the adopted registry target');
+      }
+    }
+  }
+  return errors;
+};

package/ts/data/index.ts

@@ -2,6 +2,7 @@ export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './config.js';
 export * from './deployment.js';
+export * from './deploymentadoption.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
 export * from './migration.js';

package/ts/data/user.ts

@@ -10,6 +10,7 @@ export type TServiceDeploymentCapability =
   | 'deployment:registry-push'
   | 'deployment:release-read'
   | 'deployment:promote-image'
+  | 'deployment:adopt-existing'
   | 'deployment:status'
   | 'deployment:create-greenfield'
   | 'deployment:promote-route'
@@ -49,6 +50,7 @@ const serviceDeploymentCapabilities = new Set<TServiceDeploymentCapability>([
   'deployment:registry-push',
   'deployment:release-read',
   'deployment:promote-image',
+  'deployment:adopt-existing',
   'deployment:status',
   'deployment:create-greenfield',
   'deployment:promote-route',
@@ -100,6 +102,10 @@ export const validateServiceDeploymentGrant = (
     && !capabilities.includes('deployment:create-greenfield')) {
     errors.push('an organization-service-slot grant must authorize greenfield creation');
   }
+  if (capabilities && grant.scope !== 'service'
+    && capabilities.includes('deployment:adopt-existing')) {
+    errors.push('deployment:adopt-existing requires an existing-service grant');
+  }
   return errors;
 };
 

package/ts/requests/service.ts

@@ -15,6 +15,41 @@ import type {
   IServiceDeploymentStatus,
 } from '../data/deploymentoperation.js';
 import type { TSha256Digest } from '../data/immutableimage.js';
+import type {
+  IServiceDeploymentAdoptionInput,
+  IServiceDeploymentAdoptionPreflightInput,
+  IServiceDeploymentAdoptionReport,
+  IServiceDeploymentAdoptionResult,
+} from '../data/deploymentadoption.js';
+
+export interface IRequest_Any_Cloudly_GetServiceDeploymentAdoptionPreflight
+extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IRequest_Any_Cloudly_GetServiceDeploymentAdoptionPreflight
+> {
+  method: 'getServiceDeploymentAdoptionPreflight';
+  request: IServiceDeploymentAdoptionPreflightInput & {
+    identity: IIdentityCredential;
+  };
+  response: {
+    report: IServiceDeploymentAdoptionReport;
+  };
+}
+
+export interface IRequest_Any_Cloudly_AdoptServiceDeployment
+extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IRequest_Any_Cloudly_AdoptServiceDeployment
+> {
+  method: 'adoptServiceDeployment';
+  request: IServiceDeploymentAdoptionInput & {
+    identity: IIdentityCredential;
+  };
+  response: {
+    service: IService;
+    result: IServiceDeploymentAdoptionResult;
+  };
+}
 
 export interface IRequest_Any_Cloudly_GetDeploymentPreflight
 extends plugins.typedrequestInterfaces.implementsTR<