@serve.zone/interfaces 32.12.0 → 32.14.0

package/dist_ts/data/index.d.ts

@@ -17,6 +17,7 @@ export * from './docker.js';
 export * from './domain.js';
 export * from './event.js';
 export * from './externalregistry.js';
+export * from './fleetcutover.js';
 export * from './gateway.js';
 export * from './hostedapp.js';
 export * from './image.js';

package/dist_ts/data/index.js

@@ -17,6 +17,7 @@ export * from './docker.js';
 export * from './domain.js';
 export * from './event.js';
 export * from './externalregistry.js';
+export * from './fleetcutover.js';
 export * from './gateway.js';
 export * from './hostedapp.js';
 export * from './image.js';
@@ -61,4 +62,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLHdCQUF3QixDQUFDO0FBRXZDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsd0JBQXdCLENBQUM7QUFFdkMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==

package/dist_ts/requests/fleetcutover.d.ts

@@ -0,0 +1,141 @@
+import * as plugins from '../plugins.js';
+import type { IIdentityCredential } from '../data/user.js';
+import type { IClusterRuntime } from '../data/clusterruntime.js';
+import type { IServiceRuntimeSpec } from '../data/serviceruntime.js';
+import type { IFleetCutoverAcceptedEvidenceReference, IFleetCutoverCorestoreAdoptionReceipt, IFleetCutoverIngressDesignation, IFleetCutoverIngressPreparationRequest, IFleetCutoverIngressAuthority, IFleetCutoverScope, IFleetCutoverScopeClassificationRequest, IFleetCutoverVolumeHandoffIntent, TFleetCutoverPhaseAdvance, TFleetCutoverRuntimeSpecRelease, TFleetCutoverVolumeFence } from '../data/fleetcutover.js';
+export interface IReq_Any_Cloudly_GetFleetCutoverScope extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetFleetCutoverScope> {
+    method: 'getFleetCutoverScope';
+    request: {
+        identity: IIdentityCredential;
+        clusterId: string;
+    };
+    response: {
+        scope: IFleetCutoverScope | null;
+    };
+}
+/**
+ * The administrator classifies the exact current census candidate. Cloudly compares every entry
+ * with its current service, platform-service, credential, and storage authority before it may
+ * persist a complete scope; the request itself is no proof of those facts.
+ */
+export interface IReq_Admin_Cloudly_ClassifyFleetCutoverScope extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_ClassifyFleetCutoverScope> {
+    method: 'classifyFleetCutoverScope';
+    request: {
+        identity: IIdentityCredential;
+        classification: IFleetCutoverScopeClassificationRequest;
+    };
+    response: {
+        scope: IFleetCutoverScope;
+    };
+}
+/**
+ * Forward-only legal phase CAS. All receipt references are dereferenced by Cloudly in the same
+ * transaction; caller-supplied records or booleans never satisfy a cutover condition.
+ */
+export interface IReq_Admin_Cloudly_AdvanceFleetCutoverPhase extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_AdvanceFleetCutoverPhase> {
+    method: 'advanceFleetCutoverPhase';
+    request: {
+        identity: IIdentityCredential;
+        advance: TFleetCutoverPhaseAdvance;
+    };
+    response: {
+        runtime: IClusterRuntime;
+        replayed: boolean;
+    };
+}
+/**
+ * Cloudly designates one existing live service as the new ingress before assignment. It accepts
+ * only current owner state and creates the managed launcher bearer and designation atomically.
+ */
+export interface IReq_Admin_Cloudly_PrepareFleetCutoverIngress extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_PrepareFleetCutoverIngress> {
+    method: 'prepareFleetCutoverIngress';
+    request: {
+        identity: IIdentityCredential;
+        preparation: IFleetCutoverIngressPreparationRequest;
+    };
+    response: {
+        designation: IFleetCutoverIngressDesignation;
+        /** The resulting exact-cluster spec, still held after preparation. */
+        spec: IServiceRuntimeSpec;
+        replayed: boolean;
+    };
+}
+/**
+ * The only cutover-specific hold release. Ingress releases first under an accepted empty public
+ * port policy; applications require the accepted ingress/port/route authority assembled later.
+ */
+export interface IReq_Admin_Cloudly_ReleaseFleetCutoverRuntimeSpec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_ReleaseFleetCutoverRuntimeSpec> {
+    method: 'releaseFleetCutoverRuntimeSpec';
+    request: {
+        identity: IIdentityCredential;
+        release: TFleetCutoverRuntimeSpecRelease;
+    };
+    response: {
+        spec: IServiceRuntimeSpec;
+        replayed: boolean;
+    };
+}
+export interface IReq_Any_Cloudly_GetFleetCutoverIngressAuthority extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetFleetCutoverIngressAuthority> {
+    method: 'getFleetCutoverIngressAuthority';
+    request: {
+        identity: IIdentityCredential;
+        clusterId: string;
+    };
+    response: {
+        authority: IFleetCutoverIngressAuthority | null;
+    };
+}
+/** Root-local only. Holding an intent creates negative storage authority and no runtime session. */
+export interface IReq_PalletLocal_Pallet_HoldFleetCutoverVolumeFence extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PalletLocal_Pallet_HoldFleetCutoverVolumeFence> {
+    method: 'holdFleetCutoverVolumeFence';
+    request: {
+        fenceId: string;
+        handoffIntent: IFleetCutoverVolumeHandoffIntent;
+    };
+    response: {
+        fence: Extract<TFleetCutoverVolumeFence, {
+            state: 'held';
+        }>;
+    };
+}
+export interface IReq_PalletLocal_Pallet_GetFleetCutoverVolumeFence extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PalletLocal_Pallet_GetFleetCutoverVolumeFence> {
+    method: 'getFleetCutoverVolumeFence';
+    request: {
+        fenceId: string;
+    };
+    response: {
+        fence: TFleetCutoverVolumeFence | null;
+    };
+}
+/**
+ * Pallet consumes the local fence only around a current accepted Corestore adoption result. The
+ * receipt carries the real ready storage-claim reference; the earlier handoff intent does not.
+ */
+export interface IReq_PalletLocal_Pallet_ConsumeFleetCutoverVolumeFence extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PalletLocal_Pallet_ConsumeFleetCutoverVolumeFence> {
+    method: 'consumeFleetCutoverVolumeFence';
+    request: {
+        fence: IFleetCutoverAcceptedEvidenceReference;
+        adoption: IFleetCutoverCorestoreAdoptionReceipt;
+    };
+    response: {
+        fence: Extract<TFleetCutoverVolumeFence, {
+            state: 'consumed';
+        }>;
+    };
+}
+/**
+ * Corestore owns the one-shot initial lineage/RWO CAS. The local caller supplies the held fence
+ * and server-owned handoff intent; Corestore returns the claim only after its provider is ready.
+ */
+export interface IReq_Pallet_Corestore_AdoptFleetCutoverVolume extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Corestore_AdoptFleetCutoverVolume> {
+    method: 'adoptFleetCutoverVolume';
+    request: {
+        handoffIntent: IFleetCutoverVolumeHandoffIntent;
+        palletFence: Extract<TFleetCutoverVolumeFence, {
+            state: 'held';
+        }>;
+    };
+    response: {
+        adoption: IFleetCutoverCorestoreAdoptionReceipt;
+    };
+}

package/dist_ts/requests/fleetcutover.js

@@ -0,0 +1,2 @@
+import * as plugins from '../plugins.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZmxlZXRjdXRvdmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcmVxdWVzdHMvZmxlZXRjdXRvdmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDIn0=

package/dist_ts/requests/index.d.ts

@@ -14,6 +14,7 @@ import * as deploymentRequests from './deployment.js';
 import * as dnsRequests from './dns.js';
 import * as domainRequests from './domain.js';
 import * as externalRegistryRequests from './externalregistry.js';
+import * as fleetCutoverRequests from './fleetcutover.js';
 import * as gatewayRequests from './gateway.js';
 import * as hostedAppRequests from './hostedapp.js';
 import * as identityRequests from './identity.js';
@@ -35,7 +36,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, fleetCutoverRequests as fleetcutover, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -15,6 +15,7 @@ import * as deploymentRequests from './deployment.js';
 import * as dnsRequests from './dns.js';
 import * as domainRequests from './domain.js';
 import * as externalRegistryRequests from './externalregistry.js';
+import * as fleetCutoverRequests from './fleetcutover.js';
 import * as gatewayRequests from './gateway.js';
 import * as hostedAppRequests from './hostedapp.js';
 import * as identityRequests from './identity.js';
@@ -36,9 +37,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, fleetCutoverRequests as fleetcutover, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLHNCQUFzQixNQUFNLHFCQUFxQixDQUFDO0FBQzlELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLHFCQUFxQixNQUFNLHFCQUFxQixDQUFDO0FBQzdELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssa0JBQWtCLE1BQU0saUJBQWlCLENBQUM7QUFDdEQsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLHdCQUF3QixNQUFNLHVCQUF1QixDQUFDO0FBQ2xFLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxhQUFhLE1BQU0sWUFBWSxDQUFDO0FBQzVDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxzQkFBc0IsTUFBTSxxQkFBcUIsQ0FBQztBQUM5RCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixzQkFBc0IsSUFBSSxjQUFjLEVBQ3hDLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIscUJBQXFCLElBQUksYUFBYSxFQUN0QyxpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsc0JBQXNCLElBQUksY0FBYyxFQUN4QyxjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLHNCQUFzQixNQUFNLHFCQUFxQixDQUFDO0FBQzlELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLHFCQUFxQixNQUFNLHFCQUFxQixDQUFDO0FBQzdELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssa0JBQWtCLE1BQU0saUJBQWlCLENBQUM7QUFDdEQsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLHdCQUF3QixNQUFNLHVCQUF1QixDQUFDO0FBQ2xFLE9BQU8sS0FBSyxvQkFBb0IsTUFBTSxtQkFBbUIsQ0FBQztBQUMxRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssaUJBQWlCLE1BQU0sZ0JBQWdCLENBQUM7QUFDcEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssc0JBQXNCLE1BQU0scUJBQXFCLENBQUM7QUFDOUQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUVoRCxPQUFPLEVBQ0wsYUFBYSxJQUFJLEtBQUssRUFDdEIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLG1CQUFtQixJQUFJLFdBQVcsRUFDbEMsZUFBZSxJQUFJLE9BQU8sRUFDMUIsc0JBQXNCLElBQUksY0FBYyxFQUN4QyxjQUFjLElBQUksTUFBTSxFQUN4QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLHFCQUFxQixJQUFJLGFBQWEsRUFDdEMsaUJBQWlCLElBQUksU0FBUyxFQUM5QixrQkFBa0IsSUFBSSxVQUFVLEVBQ2hDLFdBQVcsSUFBSSxHQUFHLEVBQ2xCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLHdCQUF3QixJQUFJLGdCQUFnQixFQUM1QyxvQkFBb0IsSUFBSSxZQUFZLEVBQ3BDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsc0JBQXNCLElBQUksY0FBYyxFQUN4QyxjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.12.0",
+  "version": "32.14.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -173,6 +173,10 @@ bodies and a pallet node posts this one, and the family retires with coreflow
 rather than with this release. `ISparkSwarmNodeHeartbeatRequest` is now owned here,
 so Cloudly and Spark no longer carry private copies of it, and every Swarm-era body
 — request and answer alike — carries `protocol` and is judged in the same order.
+For fleet cutover, that same observation may carry a bounded local Docker snapshot from the
+reporting node and, only when control is available, a manager-visible service/task snapshot. The
+existing node-token, reporter-session, sequence, digest and accepted-receipt rules authenticate
+both; no separate fleet-report route exists.
 
 Each of the four routes has its validator here, so a server never writes its own
 member checks: `data.validateSparkSwarmNodeHeartbeatRequest`,
@@ -1035,6 +1039,131 @@ the record. Which phase may follow which belongs to the cutover, whose requests
 (`service-multi-cluster-scope`, `service-authority-unsupported`, `platform-binding-present`) name
 the `serviceId`.
 
+### Fleet Runtime Cutover Authority
+
+`data.IFleetCutoverCensus` is Cloudly's accepted, Spark-authenticated Docker census. It carries
+only immutable Docker service/spec identity, exact mode and replica count, hashed constraint
+identity, the ownership labels used by the cutover, exact tasks and value-free mounts. A manager
+reports only manager-visible `/nodes`, `/services` and `/tasks` state. Every node separately reports
+its own complete local physical-container list through the existing authenticated
+`sparkSwarmNodeContracts.swarmObservation` route; a manager never attests remote Docker-daemon
+contents. The local list is fenced by exact sorted container-ID set digests read before and after
+all bounded inspect calls, so a container appearing or disappearing during inspection refuses the
+snapshot. The accepted census references two consecutive manager observations with identical
+Swarm and inventory digests and one current accepted local observation for every target node.
+Every reference preserves the authenticating node, credential generation, reporter session,
+sequence, observation time and fixed `freshUntil`; assembling a later census cannot renew an old
+observation. It never transports environment, arbitrary labels, mount paths, volume names,
+registry credentials or secret values.
+
+Mount identity has three explicit canonical domains. `serve.zone/fleet-cutover-mount-source-identity`
+hashes `{ type, source }`, where `source` is the exact UTF-8 `Mount.Source` returned by Docker,
+including an empty string. `serve.zone/fleet-cutover-mount-target-identity` hashes `{ target }`,
+where `target` is the exact UTF-8 `Mount.Destination`. `serve.zone/fleet-cutover-mount-identity`
+then hashes `{ type, classification, sourceIdentityDigest, targetIdentityDigest, readOnly }`.
+All three use strict canonical JSON and no case, slash, path, volume-name or alias normalization.
+Only the digests and classification cross the wire. `unknown` type/classification remains visible
+and prevents Cloudly accepting a complete scope; missing, unmanaged or conflicting service/container
+ownership also prevents completion rather than omitting the container. Structural validation does
+not establish freshness, authentication, manager consensus, ownership or Docker truth; Cloudly
+establishes those policy facts while dereferencing the accepted observations.
+
+`data.IFleetCutoverScope` is the server-owned authoritative service set. It starts `incomplete`;
+every `complete` entry binds an exact Docker service id to the current service authority and an
+accepted classification authority. `unknown` cannot appear in a complete structural snapshot.
+An authenticated administrator may submit `IFleetCutoverScopeClassificationRequest` against the
+exact current census, including for an unlabeled legacy Coretraffic or Corestore service. Cloudly
+still compares the declaration with current service, platform-service, credential, storage and
+census authority before accepting it. A classification is an operator decision, never a client
+proof boolean or a service-name inference.
+
+`data.TFleetCutoverPhaseAdvance` permits only `swarm -> draining -> switching -> pallet` and carries
+opaque references to owner-accepted records. `requests.fleetcutover.advanceFleetCutoverPhase`
+dereferences and joins them inside Cloudly's phase CAS. Leaving `draining` requires the accepted
+fresh census/quiescence decision, the complete current scope and target set, every runtime spec
+held, and the accepted set of root-local volume fences. Entering `pallet` still requires every
+spec held. `switching` grants session and network preparation only; it runs no service. Structural
+snapshots enforce the closed forward shape but do not claim the referenced records exist or are
+current.
+
+Before the first `swarm -> draining` CAS, Spark starts the replacement Coreflow32 relay as the
+exact Docker service/spec/image, delivers only its new generation-bearing credential and obtains
+the live accepted relay registration. Cloudly then revokes the old credential and accepts the
+current Spark bundle/unit/configuration and old-mode refusal evidence. This is a pre-switch Docker
+owner; it is never represented as a Pallet assignment. Downstream service holds and storage fences
+therefore depend on a live relay without requiring assignment authority that cannot exist yet.
+
+The storage bootstrap has two different authorities. `IFleetCutoverVolumeHandoffIntent` is
+Cloudly's accepted pre-switch statement of exact service, volume, source-lineage and storage-request
+identity. It also binds the exact persistent `mountIdentityDigest` and accepted source-node
+observation. It is not a ready `IRuntimeStorageClaim`. Pallet persists a root-local
+`TFleetCutoverVolumeFence` in `held` state while the cluster is draining. That state carries no
+claim, session, assignment, attachment, reservation, confirmation or execution authority, and the
+storage owner must block all those operations for the volume. After the cluster reaches `pallet`,
+Corestore performs its one-shot initial lineage/ReadWriteOnce CAS for the same mount identity under
+that held native fence and returns `IFleetCutoverCorestoreAdoptionReceipt`, which for the first time
+binds the real ready
+`IRuntimeStorageClaim` reference. Only that exact accepted receipt can consume the Pallet fence.
+This separation prevents a pre-switch fence from fabricating provider readiness merely to satisfy
+cutover ordering.
+
+`IFleetCutoverCoreflowRetirementEvidence` binds the real pre-switch Docker Coreflow32 relay by exact
+service ID, container ID, spec version/spec digest and image digest to accepted manager and local
+node observations. It requires no Pallet assignment. Cloudly dereferences those observations to
+require a live exact container without Docker/cgroup mounts, then joins its generation-bearing
+relay credential and accepted live registration to the current Spark credential, bundle, unit and
+accepted observation. It separately binds invalidation of the
+legacy credential, refusal of the old callable mode, and Spark's configuration CAS. The legacy
+source is identified by SHA-256 and may be `retained-inert` or `removed`; deletion and secure
+erasure are not cutover requirements. Its exact owner generation is retained with that disposition.
+Retained recovery evidence is valid only while the released
+owner cannot consume it into live mode and the old credential remains revoked.
+
+Before any post-pallet assignment exists, an administrator calls
+`requests.fleetcutover.prepareFleetCutoverIngress` with the exact server-created service ID,
+current `pallet` runtime, complete accepted scope and target set, held exact-cluster spec revision,
+and `expectedDesignation`. Null creates the first designation; an exact current designation
+reference permits only same-service credential rotation. Replacing the designated service is a
+different owner flow and is refused here. Cloudly's one owning transaction verifies the admin,
+same-organization live service, current references, held exact-cluster spec, zero configured and
+actual published/public ports, and absence of a conflicting designation. It generates the managed
+launcher-environment bearer privately, stores its active version and hash authority, advances the
+held spec if its secret input changed, and accepts `IFleetCutoverIngressDesignation`. The public
+designation exposes only credential ID/generation and the active `ISecretVersionReference`; neither
+it nor the response exposes the bearer, hash, private key, or any other secret value. Preparation
+requires no assignment, runtime session, ingress registration, legacy absence, publication,
+port-transfer, readback, or `IFleetCutoverIngressAuthority`.
+
+The preparation request is a closed compare-and-swap body. A replay requires the same mutation ID
+and exactly the original normalized request payload and returns the recorded designation/spec
+result; it does not renew generation, acceptance time, freshness, or authority. Every downstream
+authorization must dereference the current designation, held spec, runtime, scope, and target set.
+A historical replay response never grants current authority. `snapshotFleetCutoverIngressPreparationRequest`
+and `snapshotFleetCutoverIngressDesignation` check exact structure, reference relationships and the
+designation's canonical digest. They cannot establish admin identity, currentness, organization,
+service liveness, held state, zero ports, or absence of a conflicting designation; Cloudly owns all
+of those acceptance checks.
+
+The remaining post-pallet order is represented without a second route or publication model. First
+Cloudly releases only the designated new ingress spec under an accepted empty published-port
+policy. It then accepts
+the existing cluster-ingress registration and route-table revision, exact Spark evidence that the
+old ingress is absent, the current source and target publication records and owning port-transfer
+receipt, and a readback of the current route revision as `IFleetCutoverIngressAuthority`. Only an
+application release may cite that authority. The legacy Docker Coretraffic instance therefore
+remains through `switching`; the new ingress runs without public ports before exact port ownership
+moves, and applications remain held until the new authoritative route is read back.
+
+The owner methods live under `requests.fleetcutover`: administrator scope classification, ingress
+preparation and forward phase CAS, root-local Pallet volume-fence hold/read/
+consume, one-shot Corestore adoption, ingress-authority read, and ingress/application spec release.
+Spark transports local and manager evidence through its existing authenticated Swarm-observation
+route, and Cloudly assembles census and Coreflow-retirement records from accepted owner state; there
+is no caller-supplied census or retirement proof endpoint.
+Accepted evidence references are opaque `{ id, generation, digest }` records. They contain no
+secret bytes and gain meaning only when the named server owner dereferences them under current
+authorization and policy.
+
 ### Service Runtime Specs And Status
 
 `data.IServiceRuntimeSpec` is what Cloudly runs for one service on a Pallet cluster:

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.12.0',
+  version: '32.14.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusternode.ts

@@ -1,6 +1,12 @@
 import * as plugins from '../plugins.js';
 import type { TSha256Digest, TImmutableContainerPlatform } from './immutableimage.js';
 import type { ISparkNodeReportRecord } from './sparknodereport.js';
+import {
+  validateFleetCutoverLocalNodeSnapshot,
+  validateFleetCutoverManagerSnapshot,
+  type IFleetCutoverLocalNodeSnapshot,
+  type IFleetCutoverManagerSnapshot,
+} from './fleetcutover.js';
 import { protocolRefusalHttpStatus, validateProtocolOfferOn, type IProtocolOffer } from '../protocol.js';
 import {
   canonicalizeStrictJson,
@@ -119,13 +125,13 @@ export const sparkSwarmNodeContracts = Object.freeze({
     maxResponseBytes: 2048,
   } as const),
   /**
-   * By far the largest of the four: a manager snapshot carries up to the 1024 observed nodes
-   * `validateSparkSwarmObservationRequest` admits, each with two identifiers of up to 200
-   * characters, which is close to 600 KiB of body this route must still be able to read.
+   * The largest route: beside 1024 observed nodes, a cutover observation may carry independently
+   * bounded local-container and manager-service snapshots. Four MiB covers those validators while
+   * preserving one transport-level refusal before JSON is accepted.
    */
   swarmObservation: Object.freeze({
     endpoint: '/spark/swarm-nodes/swarm-observation',
-    maxRequestBytes: 786_432,
+    maxRequestBytes: 4_194_304,
     maxResponseBytes: 2048,
   } as const),
   protocolRefusalStatus: protocolRefusalHttpStatus,
@@ -229,6 +235,8 @@ export type TSparkSwarmObservation =
       state: 'member';
       localSwarmNodeId: string;
       controlAvailable: false;
+      /** Local Docker-daemon evidence; it is accepted under this node's own credential. */
+      fleetCutoverLocalSnapshot?: IFleetCutoverLocalNodeSnapshot;
     })
   | (ISparkSwarmObservationBase & {
       state: 'member';
@@ -236,6 +244,10 @@ export type TSparkSwarmObservation =
       localSwarmNodeId: string;
       controlAvailable: true;
       managerSnapshot?: ISwarmManagerSnapshot;
+      /** A manager still reports physical containers only from its own local Docker daemon. */
+      fleetCutoverLocalSnapshot?: IFleetCutoverLocalNodeSnapshot;
+      /** Manager-visible services/tasks only; it never claims remote physical containers. */
+      fleetCutoverManagerSnapshot?: IFleetCutoverManagerSnapshot;
     });
 
 export type TSparkSwarmObservationRejectionCode =
@@ -573,7 +585,13 @@ export const validateSparkSwarmObservation = async (
       : observation.state === 'not-member'
         ? commonKeys
         : observation.state === 'member' && observation.controlAvailable === false
-          ? [...commonKeys, 'localSwarmNodeId', 'controlAvailable']
+          ? [
+              ...commonKeys,
+              'localSwarmNodeId',
+              'controlAvailable',
+              ...(observation.fleetCutoverLocalSnapshot === undefined
+                ? [] : ['fleetCutoverLocalSnapshot']),
+            ]
           : observation.state === 'member' && observation.controlAvailable === true
             ? [
                 ...commonKeys,
@@ -581,6 +599,10 @@ export const validateSparkSwarmObservation = async (
                 'localSwarmNodeId',
                 'controlAvailable',
                 ...(observation.managerSnapshot === undefined ? [] : ['managerSnapshot']),
+                ...(observation.fleetCutoverLocalSnapshot === undefined
+                  ? [] : ['fleetCutoverLocalSnapshot']),
+                ...(observation.fleetCutoverManagerSnapshot === undefined
+                  ? [] : ['fleetCutoverManagerSnapshot']),
               ]
             : [];
     if (expectedKeys.length === 0 || !hasExactKeys(observation, expectedKeys)) {
@@ -602,6 +624,17 @@ export const validateSparkSwarmObservation = async (
         || typeof observation.controlAvailable !== 'boolean') {
         errors.push('Spark Swarm member observation must have canonical local authority');
       }
+      if (observation.fleetCutoverLocalSnapshot !== undefined) {
+        const localErrors = await validateFleetCutoverLocalNodeSnapshot(
+          observation.fleetCutoverLocalSnapshot,
+        );
+        errors.push(...localErrors.map(errorArg => `Spark Swarm observation ${errorArg}`));
+        if (isRuntimeRecord(observation.fleetCutoverLocalSnapshot)
+          && observation.fleetCutoverLocalSnapshot.swarmNodeId
+            !== observation.localSwarmNodeId) {
+          errors.push('Spark Swarm cutover local snapshot must name the local Swarm node');
+        }
+      }
       if (observation.controlAvailable === true) {
         if (!isRuntimeIdentifier(observation.swarmClusterId)) {
           errors.push('Spark Swarm manager observation must have canonical cluster authority');
@@ -613,6 +646,23 @@ export const validateSparkSwarmObservation = async (
             observation.managerSnapshot,
           ));
         }
+        if (observation.fleetCutoverManagerSnapshot !== undefined) {
+          if (observation.managerSnapshot === undefined) {
+            errors.push('Spark Swarm cutover manager snapshot requires the same manager observation');
+          }
+          const managerErrors = await validateFleetCutoverManagerSnapshot(
+            observation.fleetCutoverManagerSnapshot,
+          );
+          errors.push(...managerErrors.map(errorArg => `Spark Swarm observation ${errorArg}`));
+          if (isRuntimeRecord(observation.fleetCutoverManagerSnapshot)
+            && isRuntimeRecord(observation.fleetCutoverManagerSnapshot.inventory)) {
+            const cutoverInventory = observation.fleetCutoverManagerSnapshot.inventory;
+            if (cutoverInventory.swarmClusterId !== observation.swarmClusterId
+              || cutoverInventory.managerSwarmNodeId !== observation.localSwarmNodeId) {
+              errors.push('Spark Swarm cutover manager snapshot must name the observed authority');
+            }
+          }
+        }
       }
     }
     return errors;