@serve.zone/interfaces 32.21.0 → 32.23.0

package/dist_ts/data/corestorelegacyadoption.d.ts

@@ -0,0 +1,178 @@
+import type { IObjectStorageRetentionIntent } from '../platform/objectstorageretention.js';
+import type { TPlatformBindingStatusReason } from '../platform/types.js';
+/**
+ * Moving a service's legacy Corestore resources into credential bindings.
+ *
+ * A Corestore root converted from a release before 32 still holds the databases and buckets
+ * `/resources/provision` created, one per service and capability, in its manifest. Corestore
+ * refuses a credential binding beside such a resource until an operator authorizes that exact
+ * binding to adopt it, offline, with a plan file. The flow across the three owners:
+ *
+ * 1. Corestore answers `GET /control/legacy-resources` with its `ICorestoreLegacyResourceInventory`;
+ *    the cluster relay reads it for Cloudly (`getClusterCorestoreLegacyResources`).
+ * 2. `adoptCorestoreLegacyResources` checks the admin's selection against that inventory at an
+ *    exact digest, creates each adopting binding with the legacy bucket and retention intent, and
+ *    answers the plan (`ICorestoreLegacyResourceAdoptionPlanEntry[]`).
+ * 3. The operator stops Corestore and runs its `legacy-resource-adoption` migration with that plan.
+ *    Until then Corestore refuses the binding, which reports `legacy-adoption-pending`.
+ */
+export type TCorestoreLegacyCapability = 'database' | 'objectstorage';
+/**
+ * Why Corestore's offline adoption would refuse an unadopted resource:
+ *
+ * - `not-adoptable`: its identity is not what a credential binding can adopt (an
+ *   allocation-managed database, another provider, a resource name that differs from its database
+ *   or bucket name, or a bucket name that is not a canonical S3 name);
+ * - `ordinary-credentials-rotated`: its credentials were rotated, so the delivered ones are no
+ *   longer the generation a binding adopts;
+ * - `owned-by-binding`: a credential binding or a named storage binding already owns the service
+ *   capability, the resource or the bucket.
+ */
+export type TCorestoreLegacyResourceBlocker = 'not-adoptable' | 'ordinary-credentials-rotated' | 'owned-by-binding';
+/**
+ * `unadopted` names what would stop the offline adoption, or `null` when nothing would;
+ * `authorized` names the binding the operator authorized, which is the only binding Corestore will
+ * let take the resource. A consumed adoption leaves no legacy resource behind, so it never appears.
+ */
+export type TCorestoreLegacyResourceAdoption = {
+    state: 'unadopted';
+    blocker: TCorestoreLegacyResourceBlocker | null;
+} | {
+    state: 'authorized';
+    bindingId: string;
+};
+/**
+ * One legacy resource, by the identity Corestore's manifest states. A database is named by its
+ * database name, a bucket by its bucket name and its retention intent, `null` when it has none.
+ */
+export type TCorestoreLegacyResource = {
+    capability: 'database';
+    databaseName: string;
+    adoption: TCorestoreLegacyResourceAdoption;
+} | {
+    capability: 'objectstorage';
+    bucketName: string;
+    retention: IObjectStorageRetentionIntent | null;
+    adoption: TCorestoreLegacyResourceAdoption;
+};
+/** One service's legacy resources, at most one per capability, `database` first. */
+export interface ICorestoreLegacyServiceResources {
+    serviceId: string;
+    resources: TCorestoreLegacyResource[];
+}
+/** What Corestore answers on `GET /control/legacy-resources`: every service, sorted by id. */
+export interface ICorestoreLegacyResourceInventory {
+    services: ICorestoreLegacyServiceResources[];
+}
+/**
+ * One node's legacy resources as the cluster relay read them. An unreachable node names why and
+ * lists nothing, because a silent empty list would read as a node with nothing to adopt.
+ */
+export type TClusterCorestoreLegacyResourceInventory = {
+    nodeId: string;
+    checkedAt: number;
+    reachable: true;
+    services: ICorestoreLegacyServiceResources[];
+} | {
+    nodeId: string;
+    checkedAt: number;
+    reachable: false;
+    errorCode: 'CORESTORE_ENDPOINT_UNKNOWN' | 'CORESTORE_UNREACHABLE';
+};
+/** One resource an administrator selects for adoption. */
+export interface ICorestoreLegacyResourceSelection {
+    serviceId: string;
+    capability: TCorestoreLegacyCapability;
+}
+/**
+ * One entry of Corestore's offline adoption plan, exactly the object its
+ * `legacy-resource-adoption` migration reads: the service, the capability and the binding that may
+ * adopt its legacy resource. The legacy identity is Corestore's own and is not restated here.
+ */
+export interface ICorestoreLegacyResourceAdoptionPlanEntry {
+    serviceId: string;
+    capability: TCorestoreLegacyCapability;
+    bindingId: string;
+}
+/**
+ * Why `adoptCorestoreLegacyResources` wrote nothing:
+ *
+ * - `legacy-inventory-unreachable`: the relay could not read the node's Corestore (retryable);
+ * - `legacy-inventory-changed`: the inventory no longer has `expectedInventorySha256`;
+ * - `legacy-resource-absent`: a selected service has no legacy resource of that capability;
+ * - `legacy-resource-blocked`: a selected resource is unadopted with a blocker;
+ * - `legacy-resource-authorized-elsewhere`: a selected resource is authorized for a binding Cloudly
+ *   does not hold as that resource's adoption;
+ * - `service-absent`: Cloudly has no such service;
+ * - `binding-exists`: the service already has a binding of that capability that adopts nothing,
+ *   or adopts another resource.
+ */
+export type TCorestoreLegacyAdoptionRefusal = 'legacy-inventory-unreachable' | 'legacy-inventory-changed' | 'legacy-resource-absent' | 'legacy-resource-blocked' | 'legacy-resource-authorized-elsewhere' | 'service-absent' | 'binding-exists';
+/** The named refusal of `adoptCorestoreLegacyResources`, sent as `TypedResponseError.errorData`. */
+export interface ICorestoreLegacyAdoptionErrorData {
+    code: TCorestoreLegacyAdoptionRefusal;
+    /** True for `legacy-inventory-unreachable` only; every other refusal needs a new read first. */
+    retryable: boolean;
+}
+export declare const corestoreLegacyAdoptionContract: Readonly<{
+    /** Corestore's control path for its legacy inventory, bearer-authenticated like every other. */
+    readonly inventoryPath: "/control/legacy-resources";
+    /** Corestore's own plan bound, which also bounds a selection and an inventory. */
+    readonly maximumPlanEntries: 4096;
+    readonly maximumServices: 4096;
+    readonly maximumNameLength: 255;
+    readonly digestDomain: "serve.zone/corestore-legacy-resources";
+}>;
+/** Validates Corestore's answer on its legacy inventory path and names every reason it is refused. */
+export declare const validateCorestoreLegacyResourceInventory: (valueArg: unknown, pathArg?: string) => string[];
+/** Validates one node's legacy inventory as the relay reports it. Shape only. */
+export declare const validateClusterCorestoreLegacyResourceInventory: (valueArg: unknown, pathArg?: string) => string[];
+/**
+ * The digest an adoption is checked against: the node and its services, not the read time, so two
+ * reads of an unchanged Corestore agree. Throws for an invalid or unreachable inventory.
+ */
+export declare const computeClusterCorestoreLegacyResourceInventorySha256: (inventoryArg: TClusterCorestoreLegacyResourceInventory) => Promise<string>;
+/** Validates an administrator's selection: 1..4096 exact entries, sorted by service then capability. */
+export declare const validateCorestoreLegacyResourceSelections: (valueArg: unknown, pathArg?: string) => string[];
+/**
+ * Validates an adoption plan by the rules Corestore's migration applies: a non-empty array of at
+ * most 4096 exact `{ serviceId, capability, bindingId }` entries, canonical identifiers, and no
+ * service capability or binding id twice. Order is free.
+ */
+export declare const validateCorestoreLegacyResourceAdoptionPlan: (valueArg: unknown, pathArg?: string) => string[];
+/** The binding fields an adoption judges; a full `IPlatformBinding` satisfies it. */
+export interface ICorestoreLegacyAdoptionBindingView {
+    id: string;
+    serviceId: string;
+    capability: string;
+    objectstorageBucketName?: string;
+    objectstorageRetention?: {
+        intent: IObjectStorageRetentionIntent;
+    };
+    corestoreLegacyAdoption?: {
+        nodeId: string;
+        resourceName: string;
+        inventorySha256: string;
+    };
+}
+/**
+ * Content check of one adopting binding against the inventory it was adopted at, and the one rule
+ * that lets a binding carry a legacy bucket name: the binding names this node, this inventory
+ * digest and the legacy resource's name; the resource is unadopted without a blocker or authorized
+ * for exactly this binding; an adopted bucket's `objectstorageBucketName` is the legacy bucket and
+ * its retention intent the legacy intent exactly, absent when the legacy bucket has none; a
+ * database binding carries neither. Whether the digest is current is the caller's to check.
+ */
+export declare const validatePlatformBindingCorestoreLegacyAdoption: (bindingArg: ICorestoreLegacyAdoptionBindingView, inventoryArg: TClusterCorestoreLegacyResourceInventory, inventorySha256Arg: string, pathArg?: string) => string[];
+/**
+ * The plan for every adopting binding, sorted by service then capability, in the exact entry shape
+ * Corestore's migration reads. Throws unless every binding adopts a legacy resource and the result
+ * is a valid plan.
+ */
+export declare const createCorestoreLegacyResourceAdoptionPlan: (bindingsArg: readonly ICorestoreLegacyAdoptionBindingView[]) => ICorestoreLegacyResourceAdoptionPlanEntry[];
+/**
+ * The binding status reason a Corestore control answer names: a 409 whose body is
+ * `{ ok: false, error, code }` with `code` one of the legacy adoption reasons. Every other answer,
+ * including a 409 with another code, names none and keeps its ordinary failure handling.
+ */
+export declare const readCorestoreLegacyAdoptionRefusal: (statusCodeArg: number, bodyArg: unknown) => TPlatformBindingStatusReason | null;

package/dist_ts/data/corestorelegacyadoption.js

@@ -0,0 +1,289 @@
+import { objectStorageRetentionIntentsEqual, validateObjectStorageRetentionIntent, } from '../platform/objectstorageretention.js';
+import { validatePlatformObjectStorageBucketName } from '../platform/objectstorage.js';
+import { platformBindingStatusReasons } from '../platform/types.js';
+import { canonicalizeStrictJson, compareWireTokens, createCanonicalJsonSha256Hex, } from '../private/canonicaljson.js';
+import { hasExactKeys, isPlainRecord } from '../private/dataproperties.js';
+import { isClusterNodeId } from '../private/nodeidentifier.js';
+export const corestoreLegacyAdoptionContract = Object.freeze({
+    /** Corestore's control path for its legacy inventory, bearer-authenticated like every other. */
+    inventoryPath: '/control/legacy-resources',
+    /** Corestore's own plan bound, which also bounds a selection and an inventory. */
+    maximumPlanEntries: 4096,
+    maximumServices: 4096,
+    maximumNameLength: 255,
+    digestDomain: 'serve.zone/corestore-legacy-resources',
+});
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const printableNamePattern = /^[\x21-\x7e]+$/;
+const bareSha256Pattern = /^[a-f0-9]{64}$/;
+const blockers = [
+    'not-adoptable', 'ordinary-credentials-rotated', 'owned-by-binding',
+];
+const isIdentifier = (valueArg) => (typeof valueArg === 'string' && identifierPattern.test(valueArg));
+const isLegacyName = (valueArg) => (typeof valueArg === 'string'
+    && valueArg.length <= corestoreLegacyAdoptionContract.maximumNameLength
+    && printableNamePattern.test(valueArg));
+const isCapability = (valueArg) => (valueArg === 'database' || valueArg === 'objectstorage');
+const validateAdoption = (valueArg, pathArg) => {
+    if (!isPlainRecord(valueArg))
+        return [`${pathArg} must use its exact schema`];
+    if (valueArg.state === 'unadopted') {
+        if (!hasExactKeys(valueArg, ['state', 'blocker']))
+            return [`${pathArg} must use its exact schema`];
+        return valueArg.blocker === null || blockers.includes(valueArg.blocker)
+            ? []
+            : [`${pathArg} blocker must be null or a named blocker`];
+    }
+    if (valueArg.state === 'authorized') {
+        if (!hasExactKeys(valueArg, ['state', 'bindingId']))
+            return [`${pathArg} must use its exact schema`];
+        return isIdentifier(valueArg.bindingId) ? [] : [`${pathArg} bindingId must be a canonical identifier`];
+    }
+    return [`${pathArg} state must be unadopted or authorized`];
+};
+/** An adoptable resource is one the offline adoption could authorize or already did. */
+const isAdoptable = (adoptionArg) => (isPlainRecord(adoptionArg) && (adoptionArg.state === 'authorized' || adoptionArg.blocker === null));
+const validateResource = (valueArg, pathArg) => {
+    if (!isPlainRecord(valueArg))
+        return [`${pathArg} must use its exact schema`];
+    if (valueArg.capability === 'database') {
+        if (!hasExactKeys(valueArg, ['capability', 'databaseName', 'adoption'])) {
+            return [`${pathArg} must use its exact schema`];
+        }
+        const errors = validateAdoption(valueArg.adoption, `${pathArg} adoption`);
+        if (!isLegacyName(valueArg.databaseName))
+            errors.push(`${pathArg} databaseName must be a bounded printable name`);
+        return errors;
+    }
+    if (valueArg.capability === 'objectstorage') {
+        if (!hasExactKeys(valueArg, ['capability', 'bucketName', 'retention', 'adoption'])) {
+            return [`${pathArg} must use its exact schema`];
+        }
+        const errors = validateAdoption(valueArg.adoption, `${pathArg} adoption`);
+        if (!isLegacyName(valueArg.bucketName)) {
+            errors.push(`${pathArg} bucketName must be a bounded printable name`);
+        }
+        else if (errors.length === 0 && isAdoptable(valueArg.adoption)) {
+            // A binding request carries only a canonical bucket, so an adoptable bucket has to be one.
+            errors.push(...validatePlatformObjectStorageBucketName(valueArg.bucketName, `${pathArg} bucketName`));
+        }
+        if (valueArg.retention !== null) {
+            errors.push(...validateObjectStorageRetentionIntent(valueArg.retention, `${pathArg} retention`));
+        }
+        return errors;
+    }
+    return [`${pathArg} capability must be database or objectstorage`];
+};
+const validateServices = (valueArg, pathArg) => {
+    if (!Array.isArray(valueArg) || valueArg.length > corestoreLegacyAdoptionContract.maximumServices) {
+        return [`${pathArg} must be a bounded array`];
+    }
+    const errors = [];
+    let previousServiceId;
+    for (const [index, service] of valueArg.entries()) {
+        const servicePath = `${pathArg}[${index}]`;
+        if (!isPlainRecord(service) || !hasExactKeys(service, ['serviceId', 'resources'])) {
+            errors.push(`${servicePath} must use its exact schema`);
+            continue;
+        }
+        if (!isIdentifier(service.serviceId)) {
+            errors.push(`${servicePath} serviceId must be a canonical identifier`);
+        }
+        else {
+            if (previousServiceId !== undefined && compareWireTokens(previousServiceId, service.serviceId) >= 0) {
+                errors.push(`${pathArg} must be sorted by serviceId without repeats`);
+            }
+            previousServiceId = service.serviceId;
+        }
+        if (!Array.isArray(service.resources) || service.resources.length < 1 || service.resources.length > 2) {
+            errors.push(`${servicePath} resources must list one or two resources`);
+            continue;
+        }
+        for (const [resourceIndex, resource] of service.resources.entries()) {
+            errors.push(...validateResource(resource, `${servicePath} resources[${resourceIndex}]`));
+        }
+        if (service.resources.length === 2
+            && !(isPlainRecord(service.resources[0]) && service.resources[0].capability === 'database'
+                && isPlainRecord(service.resources[1]) && service.resources[1].capability === 'objectstorage')) {
+            errors.push(`${servicePath} resources must hold one database before one objectstorage resource`);
+        }
+    }
+    return errors;
+};
+/** Validates Corestore's answer on its legacy inventory path and names every reason it is refused. */
+export const validateCorestoreLegacyResourceInventory = (valueArg, pathArg = 'corestore legacy resource inventory') => {
+    if (!isPlainRecord(valueArg) || !hasExactKeys(valueArg, ['services'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    return validateServices(valueArg.services, `${pathArg} services`);
+};
+/** Validates one node's legacy inventory as the relay reports it. Shape only. */
+export const validateClusterCorestoreLegacyResourceInventory = (valueArg, pathArg = 'cluster corestore legacy resource inventory') => {
+    if (!isPlainRecord(valueArg))
+        return [`${pathArg} must use its exact schema`];
+    const reachable = valueArg.reachable;
+    if (reachable === true
+        ? !hasExactKeys(valueArg, ['nodeId', 'checkedAt', 'reachable', 'services'])
+        : reachable !== false || !hasExactKeys(valueArg, ['nodeId', 'checkedAt', 'reachable', 'errorCode'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (!isClusterNodeId(valueArg.nodeId))
+        errors.push(`${pathArg} nodeId must be a node id`);
+    if (!Number.isSafeInteger(valueArg.checkedAt) || valueArg.checkedAt < 0) {
+        errors.push(`${pathArg} checkedAt must be a non-negative safe integer`);
+    }
+    if (reachable === true) {
+        errors.push(...validateServices(valueArg.services, `${pathArg} services`));
+    }
+    else if (valueArg.errorCode !== 'CORESTORE_ENDPOINT_UNKNOWN' && valueArg.errorCode !== 'CORESTORE_UNREACHABLE') {
+        errors.push(`${pathArg} errorCode must name why the node could not be read`);
+    }
+    return errors;
+};
+const failDigest = (reasonArg) => {
+    throw new Error(reasonArg);
+};
+/**
+ * The digest an adoption is checked against: the node and its services, not the read time, so two
+ * reads of an unchanged Corestore agree. Throws for an invalid or unreachable inventory.
+ */
+export const computeClusterCorestoreLegacyResourceInventorySha256 = async (inventoryArg) => {
+    const errors = validateClusterCorestoreLegacyResourceInventory(inventoryArg);
+    if (errors.length > 0)
+        throw new Error(errors[0]);
+    if (inventoryArg.reachable !== true)
+        throw new Error('an unreachable legacy inventory has no digest');
+    return createCanonicalJsonSha256Hex(canonicalizeStrictJson({
+        domain: corestoreLegacyAdoptionContract.digestDomain,
+        nodeId: inventoryArg.nodeId,
+        services: inventoryArg.services,
+    }, failDigest, 'corestore legacy resource inventory'), failDigest);
+};
+const selectionKey = (entryArg) => `${entryArg.serviceId}\u0000${entryArg.capability}`;
+/** Validates an administrator's selection: 1..4096 exact entries, sorted by service then capability. */
+export const validateCorestoreLegacyResourceSelections = (valueArg, pathArg = 'corestore legacy resource selection') => {
+    if (!Array.isArray(valueArg) || valueArg.length < 1
+        || valueArg.length > corestoreLegacyAdoptionContract.maximumPlanEntries) {
+        return [`${pathArg} must be a non-empty bounded array`];
+    }
+    const errors = [];
+    let previous;
+    for (const [index, entry] of valueArg.entries()) {
+        if (!isPlainRecord(entry) || !hasExactKeys(entry, ['serviceId', 'capability'])
+            || !isIdentifier(entry.serviceId) || !isCapability(entry.capability)) {
+            errors.push(`${pathArg}[${index}] must be an exact { serviceId, capability }`);
+            continue;
+        }
+        const key = selectionKey(entry);
+        if (previous !== undefined && compareWireTokens(previous, key) >= 0) {
+            errors.push(`${pathArg} must be sorted by serviceId then capability without repeats`);
+        }
+        previous = key;
+    }
+    return errors;
+};
+/**
+ * Validates an adoption plan by the rules Corestore's migration applies: a non-empty array of at
+ * most 4096 exact `{ serviceId, capability, bindingId }` entries, canonical identifiers, and no
+ * service capability or binding id twice. Order is free.
+ */
+export const validateCorestoreLegacyResourceAdoptionPlan = (valueArg, pathArg = 'adoption plan') => {
+    if (!Array.isArray(valueArg) || valueArg.length === 0
+        || valueArg.length > corestoreLegacyAdoptionContract.maximumPlanEntries) {
+        return [`${pathArg} must be a non-empty bounded array`];
+    }
+    const errors = [];
+    const serviceCapabilities = new Set();
+    const bindingIds = new Set();
+    for (const [index, entry] of valueArg.entries()) {
+        if (!isPlainRecord(entry) || !hasExactKeys(entry, ['serviceId', 'capability', 'bindingId'])
+            || !isIdentifier(entry.serviceId) || !isIdentifier(entry.bindingId) || !isCapability(entry.capability)) {
+            errors.push(`${pathArg} entry ${index} must be an exact { serviceId, capability, bindingId }`);
+            continue;
+        }
+        const serviceCapability = selectionKey(entry);
+        if (serviceCapabilities.has(serviceCapability) || bindingIds.has(entry.bindingId)) {
+            errors.push(`${pathArg} entry ${index} repeats a service capability or binding id`);
+        }
+        serviceCapabilities.add(serviceCapability);
+        bindingIds.add(entry.bindingId);
+    }
+    return errors;
+};
+/**
+ * Content check of one adopting binding against the inventory it was adopted at, and the one rule
+ * that lets a binding carry a legacy bucket name: the binding names this node, this inventory
+ * digest and the legacy resource's name; the resource is unadopted without a blocker or authorized
+ * for exactly this binding; an adopted bucket's `objectstorageBucketName` is the legacy bucket and
+ * its retention intent the legacy intent exactly, absent when the legacy bucket has none; a
+ * database binding carries neither. Whether the digest is current is the caller's to check.
+ */
+export const validatePlatformBindingCorestoreLegacyAdoption = (bindingArg, inventoryArg, inventorySha256Arg, pathArg = 'platform binding corestoreLegacyAdoption') => {
+    if (validateClusterCorestoreLegacyResourceInventory(inventoryArg).length > 0 || inventoryArg.reachable !== true
+        || typeof inventorySha256Arg !== 'string' || !bareSha256Pattern.test(inventorySha256Arg)) {
+        return [`${pathArg} needs a valid reachable inventory and its digest`];
+    }
+    const adoption = bindingArg.corestoreLegacyAdoption;
+    if (!isPlainRecord(adoption) || !hasExactKeys(adoption, ['nodeId', 'resourceName', 'inventorySha256'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    if (adoption.nodeId !== inventoryArg.nodeId || adoption.inventorySha256 !== inventorySha256Arg) {
+        return [`${pathArg} must name the inventory's node and digest`];
+    }
+    if (!isCapability(bindingArg.capability))
+        return [`${pathArg} needs a database or objectstorage binding`];
+    const resource = inventoryArg.services.find((serviceArg) => serviceArg.serviceId === bindingArg.serviceId)
+        ?.resources.find((resourceArg) => resourceArg.capability === bindingArg.capability);
+    if (!resource)
+        return [`${pathArg} names no legacy resource of the service and capability`];
+    const errors = [];
+    const legacyName = resource.capability === 'database' ? resource.databaseName : resource.bucketName;
+    if (adoption.resourceName !== legacyName)
+        errors.push(`${pathArg} resourceName must be the legacy resource's name`);
+    if (resource.adoption.state === 'unadopted' ? resource.adoption.blocker !== null
+        : resource.adoption.bindingId !== bindingArg.id) {
+        errors.push(`${pathArg} names a resource that is blocked or authorized for another binding`);
+    }
+    if (resource.capability === 'objectstorage') {
+        if (bindingArg.objectstorageBucketName !== resource.bucketName) {
+            errors.push(`${pathArg} objectstorageBucketName must be the legacy bucket`);
+        }
+        if (resource.retention === null
+            ? bindingArg.objectstorageRetention !== undefined
+            : !objectStorageRetentionIntentsEqual(bindingArg.objectstorageRetention?.intent, resource.retention)) {
+            errors.push(`${pathArg} retention intent must be the legacy bucket's exactly`);
+        }
+    }
+    else if (bindingArg.objectstorageBucketName !== undefined || bindingArg.objectstorageRetention !== undefined) {
+        errors.push(`${pathArg} database binding must carry no bucket or retention`);
+    }
+    return errors;
+};
+/**
+ * The plan for every adopting binding, sorted by service then capability, in the exact entry shape
+ * Corestore's migration reads. Throws unless every binding adopts a legacy resource and the result
+ * is a valid plan.
+ */
+export const createCorestoreLegacyResourceAdoptionPlan = (bindingsArg) => {
+    const plan = bindingsArg.map((bindingArg) => {
+        if (bindingArg.corestoreLegacyAdoption === undefined || !isCapability(bindingArg.capability)) {
+            throw new Error(`binding ${bindingArg.id} adopts no legacy Corestore resource`);
+        }
+        return { serviceId: bindingArg.serviceId, capability: bindingArg.capability, bindingId: bindingArg.id };
+    }).sort((leftArg, rightArg) => compareWireTokens(selectionKey(leftArg), selectionKey(rightArg)));
+    const errors = validateCorestoreLegacyResourceAdoptionPlan(plan);
+    if (errors.length > 0)
+        throw new Error(errors[0]);
+    return plan;
+};
+/**
+ * The binding status reason a Corestore control answer names: a 409 whose body is
+ * `{ ok: false, error, code }` with `code` one of the legacy adoption reasons. Every other answer,
+ * including a 409 with another code, names none and keeps its ordinary failure handling.
+ */
+export const readCorestoreLegacyAdoptionRefusal = (statusCodeArg, bodyArg) => (statusCodeArg === 409 && isPlainRecord(bodyArg) && bodyArg.ok === false
+    && platformBindingStatusReasons.includes(bodyArg.code)
+    ? bodyArg.code
+    : null);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZXN0b3JlbGVnYWN5YWRvcHRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NvcmVzdG9yZWxlZ2FjeWFkb3B0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFDTCxrQ0FBa0MsRUFDbEMsb0NBQW9DLEdBQ3JDLE1BQU0sdUNBQXVDLENBQUM7QUFDL0MsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFdkYsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDcEUsT0FBTyxFQUNMLHNCQUFzQixFQUN0QixpQkFBaUIsRUFDakIsNEJBQTRCLEdBQzdCLE1BQU0sNkJBQTZCLENBQUM7QUFDckMsT0FBTyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUMzRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFpSS9ELE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDM0QsZ0dBQWdHO0lBQ2hHLGFBQWEsRUFBRSwyQkFBMkI7SUFDMUMsa0ZBQWtGO0lBQ2xGLGtCQUFrQixFQUFFLElBQUk7SUFDeEIsZUFBZSxFQUFFLElBQUk7SUFDckIsaUJBQWlCLEVBQUUsR0FBRztJQUN0QixZQUFZLEVBQUUsdUNBQXVDO0NBQzdDLENBQUMsQ0FBQztBQUVaLE1BQU0saUJBQWlCLEdBQUcscUNBQXFDLENBQUM7QUFDaEUsTUFBTSxvQkFBb0IsR0FBRyxnQkFBZ0IsQ0FBQztBQUM5QyxNQUFNLGlCQUFpQixHQUFHLGdCQUFnQixDQUFDO0FBQzNDLE1BQU0sUUFBUSxHQUErQztJQUMzRCxlQUFlLEVBQUUsOEJBQThCLEVBQUUsa0JBQWtCO0NBQ3BFLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUM5RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksaUJBQWlCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUNqRSxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDOUQsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUN6QixRQUFRLENBQUMsTUFBTSxJQUFJLCtCQUErQixDQUFDLGlCQUFpQjtPQUNwRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3ZDLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQTBDLEVBQUUsQ0FBQyxDQUNsRixRQUFRLEtBQUssVUFBVSxJQUFJLFFBQVEsS0FBSyxlQUFlLENBQ3hELENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN4RSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUM5RSxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssV0FBVyxFQUFFLENBQUM7UUFDbkMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFBRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7UUFDbkcsT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSyxRQUErQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO1lBQzdGLENBQUMsQ0FBQyxFQUFFO1lBQ0osQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLDBDQUEwQyxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUNwQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQztZQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztRQUNyRyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8sMkNBQTJDLENBQUMsQ0FBQztJQUN6RyxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsT0FBTyx3Q0FBd0MsQ0FBQyxDQUFDO0FBQzlELENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLFdBQVcsR0FBRyxDQUFDLFdBQW9CLEVBQVcsRUFBRSxDQUFDLENBQ3JELGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEtBQUssWUFBWSxJQUFJLFdBQVcsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQ25HLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN4RSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUM5RSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDdkMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxZQUFZLEVBQUUsY0FBYyxFQUFFLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN4RSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsR0FBRyxPQUFPLFdBQVcsQ0FBQyxDQUFDO1FBQzFFLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQztZQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdEQUFnRCxDQUFDLENBQUM7UUFDbEgsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUM1QyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFlBQVksRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNuRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsR0FBRyxPQUFPLFdBQVcsQ0FBQyxDQUFDO1FBQzFFLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztRQUN4RSxDQUFDO2FBQU0sSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxXQUFXLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDakUsMkZBQTJGO1lBQzNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx1Q0FBdUMsQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLEdBQUcsT0FBTyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3hHLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDaEMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLG9DQUFvQyxDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsR0FBRyxPQUFPLFlBQVksQ0FBQyxDQUFDLENBQUM7UUFDbkcsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxPQUFPLENBQUMsR0FBRyxPQUFPLCtDQUErQyxDQUFDLENBQUM7QUFDckUsQ0FBQyxDQUFDO0FBRUYsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDeEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRywrQkFBK0IsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNsRyxPQUFPLENBQUMsR0FBRyxPQUFPLDBCQUEwQixDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLGlCQUFxQyxDQUFDO0lBQzFDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNsRCxNQUFNLFdBQVcsR0FBRyxHQUFHLE9BQU8sSUFBSSxLQUFLLEdBQUcsQ0FBQztRQUMzQyxJQUFJLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxDQUFDLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFdBQVcsNEJBQTRCLENBQUMsQ0FBQztZQUN4RCxTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDckMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFdBQVcsMkNBQTJDLENBQUMsQ0FBQztRQUN6RSxDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksaUJBQWlCLEtBQUssU0FBUyxJQUFJLGlCQUFpQixDQUFDLGlCQUFpQixFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDcEcsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztZQUN4RSxDQUFDO1lBQ0QsaUJBQWlCLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBQztRQUN4QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN0RyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVywyQ0FBMkMsQ0FBQyxDQUFDO1lBQ3ZFLFNBQVM7UUFDWCxDQUFDO1FBQ0QsS0FBSyxNQUFNLENBQUMsYUFBYSxFQUFFLFFBQVEsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLEdBQUcsV0FBVyxjQUFjLGFBQWEsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQzdCLENBQUMsQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsVUFBVSxLQUFLLFVBQVU7bUJBQ3JGLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLEtBQUssZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUNuRyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVyxxRUFBcUUsQ0FBQyxDQUFDO1FBQ25HLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsc0dBQXNHO0FBQ3RHLE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLENBQ3RELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxxQ0FBcUMsRUFDckMsRUFBRTtJQUNaLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsVUFBVSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3RFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsT0FBTyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLEdBQUcsT0FBTyxXQUFXLENBQUMsQ0FBQztBQUNwRSxDQUFDLENBQUM7QUFFRixpRkFBaUY7QUFDakYsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsQ0FDN0QsUUFBaUIsRUFDakIsT0FBTyxHQUFHLDZDQUE2QyxFQUM3QyxFQUFFO0lBQ1osSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7UUFBRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDOUUsTUFBTSxTQUFTLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQztJQUNyQyxJQUFJLFNBQVMsS0FBSyxJQUFJO1FBQ3BCLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUMzRSxDQUFDLENBQUMsU0FBUyxLQUFLLEtBQUssSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdEcsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMkJBQTJCLENBQUMsQ0FBQztJQUMxRixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUssUUFBUSxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sZ0RBQWdELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxTQUFTLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDdkIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsR0FBRyxPQUFPLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDN0UsQ0FBQztTQUFNLElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyw0QkFBNEIsSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLHVCQUF1QixFQUFFLENBQUM7UUFDakgsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8scURBQXFELENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxVQUFVLEdBQUcsQ0FBQyxTQUFpQixFQUFTLEVBQUU7SUFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztBQUM3QixDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxvREFBb0QsR0FBRyxLQUFLLEVBQ3ZFLFlBQXNELEVBQ3JDLEVBQUU7SUFDbkIsTUFBTSxNQUFNLEdBQUcsK0NBQStDLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDN0UsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2xELElBQUksWUFBWSxDQUFDLFNBQVMsS0FBSyxJQUFJO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO0lBQ3RHLE9BQU8sNEJBQTRCLENBQUMsc0JBQXNCLENBQUM7UUFDekQsTUFBTSxFQUFFLCtCQUErQixDQUFDLFlBQVk7UUFDcEQsTUFBTSxFQUFFLFlBQVksQ0FBQyxNQUFNO1FBQzNCLFFBQVEsRUFBRSxZQUFZLENBQUMsUUFBUTtLQUNoQyxFQUFFLFVBQVUsRUFBRSxxQ0FBcUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0FBQ3JFLENBQUMsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBbUQsRUFBVSxFQUFFLENBQ25GLEdBQUcsUUFBUSxDQUFDLFNBQVMsU0FBUyxRQUFRLENBQUMsVUFBVSxFQUFFLENBQUM7QUFFdEQsd0dBQXdHO0FBQ3hHLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLENBQ3ZELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxxQ0FBcUMsRUFDckMsRUFBRTtJQUNaLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUM5QyxRQUFRLENBQUMsTUFBTSxHQUFHLCtCQUErQixDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDMUUsT0FBTyxDQUFDLEdBQUcsT0FBTyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxRQUE0QixDQUFDO0lBQ2pDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxDQUFDLFdBQVcsRUFBRSxZQUFZLENBQUMsQ0FBQztlQUN6RSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sSUFBSSxLQUFLLDhDQUE4QyxDQUFDLENBQUM7WUFDL0UsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLEdBQUcsR0FBRyxZQUFZLENBQUMsS0FBcUQsQ0FBQyxDQUFDO1FBQ2hGLElBQUksUUFBUSxLQUFLLFNBQVMsSUFBSSxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOERBQThELENBQUMsQ0FBQztRQUN4RixDQUFDO1FBQ0QsUUFBUSxHQUFHLEdBQUcsQ0FBQztJQUNqQixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJDQUEyQyxHQUFHLENBQ3pELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxlQUFlLEVBQ2YsRUFBRTtJQUNaLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNoRCxRQUFRLENBQUMsTUFBTSxHQUFHLCtCQUErQixDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDMUUsT0FBTyxDQUFDLEdBQUcsT0FBTyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQzlDLE1BQU0sVUFBVSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDckMsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ2hELElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsQ0FBQztlQUN0RixDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3pHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLFVBQVUsS0FBSyx3REFBd0QsQ0FBQyxDQUFDO1lBQy9GLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxpQkFBaUIsR0FBRyxZQUFZLENBQUMsS0FBcUQsQ0FBQyxDQUFDO1FBQzlGLElBQUksbUJBQW1CLENBQUMsR0FBRyxDQUFDLGlCQUFpQixDQUFDLElBQUksVUFBVSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBbUIsQ0FBQyxFQUFFLENBQUM7WUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sVUFBVSxLQUFLLDZDQUE2QyxDQUFDLENBQUM7UUFDdEYsQ0FBQztRQUNELG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzNDLFVBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLFNBQW1CLENBQUMsQ0FBQztJQUM1QyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBWUY7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQzVELFVBQStDLEVBQy9DLFlBQXNELEVBQ3RELGtCQUEwQixFQUMxQixPQUFPLEdBQUcsMENBQTBDLEVBQzFDLEVBQUU7SUFDWixJQUFJLCtDQUErQyxDQUFDLFlBQVksQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksWUFBWSxDQUFDLFNBQVMsS0FBSyxJQUFJO1dBQzFHLE9BQU8sa0JBQWtCLEtBQUssUUFBUSxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUMzRixPQUFPLENBQUMsR0FBRyxPQUFPLG1EQUFtRCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQztJQUNwRCxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsRUFBRSxjQUFjLEVBQUUsaUJBQWlCLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdkcsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLE1BQU0sSUFBSSxRQUFRLENBQUMsZUFBZSxLQUFLLGtCQUFrQixFQUFFLENBQUM7UUFDL0YsT0FBTyxDQUFDLEdBQUcsT0FBTyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUM7UUFBRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRDQUE0QyxDQUFDLENBQUM7SUFDMUcsTUFBTSxRQUFRLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFDLFNBQVMsQ0FBQztRQUN4RyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxVQUFVLEtBQUssVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3RGLElBQUksQ0FBQyxRQUFRO1FBQUUsT0FBTyxDQUFDLEdBQUcsT0FBTyx5REFBeUQsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixNQUFNLFVBQVUsR0FBRyxRQUFRLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztJQUNwRyxJQUFJLFFBQVEsQ0FBQyxZQUFZLEtBQUssVUFBVTtRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGtEQUFrRCxDQUFDLENBQUM7SUFDcEgsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUk7UUFDOUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLFVBQVUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxxRUFBcUUsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssZUFBZSxFQUFFLENBQUM7UUFDNUMsSUFBSSxVQUFVLENBQUMsdUJBQXVCLEtBQUssUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQy9ELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLG9EQUFvRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxJQUFJO1lBQzdCLENBQUMsQ0FBQyxVQUFVLENBQUMsc0JBQXNCLEtBQUssU0FBUztZQUNqRCxDQUFDLENBQUMsQ0FBQyxrQ0FBa0MsQ0FBQyxVQUFVLENBQUMsc0JBQXNCLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3ZHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLHVEQUF1RCxDQUFDLENBQUM7UUFDakYsQ0FBQztJQUNILENBQUM7U0FBTSxJQUFJLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxTQUFTLElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQy9HLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLHFEQUFxRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxDQUN2RCxXQUEyRCxFQUNkLEVBQUU7SUFDL0MsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFO1FBQzFDLElBQUksVUFBVSxDQUFDLHVCQUF1QixLQUFLLFNBQVMsSUFBSSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUM3RixNQUFNLElBQUksS0FBSyxDQUFDLFdBQVcsVUFBVSxDQUFDLEVBQUUsc0NBQXNDLENBQUMsQ0FBQztRQUNsRixDQUFDO1FBQ0QsT0FBTyxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVSxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsRUFBRSxFQUFFLENBQUM7SUFDMUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLENBQUMsaUJBQWlCLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDakcsTUFBTSxNQUFNLEdBQUcsMkNBQTJDLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDakUsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2xELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELGFBQXFCLEVBQ3JCLE9BQWdCLEVBQ3FCLEVBQUUsQ0FBQyxDQUN4QyxhQUFhLEtBQUssR0FBRyxJQUFJLGFBQWEsQ0FBQyxPQUFPLENBQUMsSUFBSSxPQUFPLENBQUMsRUFBRSxLQUFLLEtBQUs7T0FDakUsNEJBQW1ELENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7SUFDOUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFvQztJQUM5QyxDQUFDLENBQUMsSUFBSSxDQUNULENBQUMifQ==

package/dist_ts/data/index.d.ts

@@ -3,9 +3,11 @@ export * from './cluster.js';
 export * from './clusterruntime.js';
 export * from './clustervpn.js';
 export * from './clusteringress.js';
+export * from './clusteringressdesignation.js';
 export * from './clusterrelaycredential.js';
 export * from './config.js';
 export * from './corestore.js';
+export * from './corestorelegacyadoption.js';
 export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
@@ -40,6 +42,8 @@ export * from './networkprojection.js';
 export type { IRuntimeNetworkRouterPacketGrant, IRuntimeNetworkRouterProjection } from './networkrouter.js';
 export type { IRuntimeNetworkHostIngress, IRuntimeNetworkHostPacketGrant, IRuntimeNetworkHostProjection } from './networkhost.js';
 export { runtimeNetworkHostContract } from './networkhost.js';
+export type { IRuntimeNetworkWorkloadIngress, IRuntimeNetworkWorkloadIngressPacketGrant, IRuntimeNetworkWorkloadIngressProjection } from './networkworkloadingress.js';
+export { runtimeNetworkWorkloadIngressContract } from './networkworkloadingress.js';
 export * from './networkprotection.js';
 export * from './networksigning.js';
 export * from './privatenetwork.js';
@@ -48,6 +52,7 @@ export * from './releaseversion.js';
 export * from './runtimeassignment.js';
 export * from './runtimeconfig.js';
 export * from './runtimestorageclaim.js';
+export * from './runtimelocalstorageclaim.js';
 export * from './runtimesession.js';
 export * from './runtimeterminalreceipt.js';
 export * from './secret.js';
@@ -62,6 +67,7 @@ export * from './service.js';
 export * from './servicecredential.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
+export * from './servicevolumeinitialization.js';
 export * from './status.js';
 export * from './taskexecution.js';
 export * from './traffic.js';

package/dist_ts/data/index.js

@@ -3,9 +3,11 @@ export * from './cluster.js';
 export * from './clusterruntime.js';
 export * from './clustervpn.js';
 export * from './clusteringress.js';
+export * from './clusteringressdesignation.js';
 export * from './clusterrelaycredential.js';
 export * from './config.js';
 export * from './corestore.js';
+export * from './corestorelegacyadoption.js';
 export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
@@ -38,6 +40,7 @@ export * from './networklease.js';
 export * from './networknode.js';
 export * from './networkprojection.js';
 export { runtimeNetworkHostContract } from './networkhost.js';
+export { runtimeNetworkWorkloadIngressContract } from './networkworkloadingress.js';
 export * from './networkprotection.js';
 export * from './networksigning.js';
 export * from './privatenetwork.js';
@@ -46,6 +49,7 @@ export * from './releaseversion.js';
 export * from './runtimeassignment.js';
 export * from './runtimeconfig.js';
 export * from './runtimestorageclaim.js';
+export * from './runtimelocalstorageclaim.js';
 export * from './runtimesession.js';
 export * from './runtimeterminalreceipt.js';
 export * from './secret.js';
@@ -60,10 +64,11 @@ export * from './service.js';
 export * from './servicecredential.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
+export * from './servicevolumeinitialization.js';
 export * from './status.js';
 export * from './taskexecution.js';
 export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyx3QkFBd0IsQ0FBQztBQUd2QyxPQUFPLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUM5RCxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsd0JBQXdCLENBQUM7QUFHdkMsT0FBTyxFQUFFLDBCQUEwQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFHOUQsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDcEYsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9

package/dist_ts/data/networkprojection.d.ts

@@ -4,6 +4,7 @@ import type { IRuntimeNetworkHandoffLease, IRuntimeNetworkProtectedAuthority } f
 import type { IPrivateNetwork, IServicePrivateNetworks, IServicePrivateNetworkDnsPolicy } from './privatenetwork.js';
 import { type IRuntimeNetworkRouterPacketGrant, type IRuntimeNetworkRouterProjection } from './networkrouter.js';
 import { type IRuntimeNetworkHostPacketGrant, type IRuntimeNetworkHostProjection } from './networkhost.js';
+import { type IRuntimeNetworkWorkloadIngressPacketGrant, type IRuntimeNetworkWorkloadIngressProjection } from './networkworkloadingress.js';
 export interface IRuntimeNetworkNodeScope {
     controller: IRuntimeController;
     nodeId: string;
@@ -154,6 +155,21 @@ export interface IRuntimeNetworkProjection extends IRuntimeNetworkNodeScope {
      * host-origin flow; any other controller kind carrying it is refused.
      */
     host?: IRuntimeNetworkHostProjection;
+    /**
+     * One-way workload ingress selections of a `cloudly` projection: the cluster ingress workload dials
+     * exact target workload ports across organizations (`IRuntimeNetworkWorkloadIngressPacketGrant`).
+     * Omitted, it keeps the canonical bytes and grants no such flow; any other controller kind
+     * carrying it is refused.
+     */
+    workloadIngress?: IRuntimeNetworkWorkloadIngressProjection;
+    /**
+     * Ids of the protected authority's platform endpoints whose address this projection's node's own
+     * host carries, such as a relay listener or a Corestore beside the node on one machine. The node
+     * delivers workload flows to them locally instead of forwarding them. Sorted, unique and never
+     * empty when present; omitted, it keeps the canonical bytes and states that no endpoint is local.
+     * It grants nothing: a workload still reaches only the endpoints it selects.
+     */
+    hostPlatformEndpointIds?: string[];
     digest: TSha256Digest;
 }
 export interface IRuntimeNetworkDnsView {
@@ -203,6 +219,8 @@ export declare const getRuntimeNetworkProjectionPacketGrants: (value: unknown) =
 export declare const getRuntimeNetworkProjectionRouterPacketGrants: (value: unknown) => Promise<IRuntimeNetworkRouterPacketGrant[]>;
 /** Host-origin authority comes only from explicit signed `onebox` selections of local workload ports. */
 export declare const getRuntimeNetworkProjectionHostPacketGrants: (value: unknown) => Promise<IRuntimeNetworkHostPacketGrant[]>;
+/** One-way workload ingress authority comes only from explicit signed `cloudly` selections of exact target ports. */
+export declare const getRuntimeNetworkProjectionWorkloadIngressPacketGrants: (value: unknown) => Promise<IRuntimeNetworkWorkloadIngressPacketGrant[]>;
 /** Complete offline DNS material, including authorized names never previously queried. */
 /** Select exact local receivers before expansion; all targets still come from
  * the complete validated projection. Selection supplies no attachment authority. */