@serve.zone/interfaces 32.21.0 → 32.23.0

package/dist_ts/data/runtimelocalstorageclaim.d.ts

@@ -0,0 +1,124 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAssignment, IRuntimeAuthorityReference, IRuntimeController } from './runtimeassignment.js';
+import type { IRuntimeSessionBinding } from './runtimesession.js';
+/**
+ * Where a local storage claim's bytes live, named by kind and never by path.
+ *
+ * `directory` is a node-local directory the node derives from the claim's identity under a root
+ * only the node knows. Network filesystems join this union as further kinds; their credentials
+ * travel as secrets and never inside a claim.
+ */
+export type TRuntimeLocalStorageSource = {
+    kind: 'directory';
+};
+/** The owner and permission bits a node gives an `empty` volume's root directory when it creates it. */
+export interface IRuntimeLocalStorageOwnership {
+    uid: number;
+    gid: number;
+    /** Numeric directory permission bits, for example `0o750`; setuid is refused. */
+    mode: number;
+}
+/** Where the volume appears inside the workload's container. */
+export interface IRuntimeLocalStorageMount {
+    mountPath: string;
+    readOnly: boolean;
+}
+/**
+ * `bound` keeps the volume and lets the node mount it; `purge` orders the node to delete the
+ * volume's bytes. A purge always follows a bound generation of the same claim.
+ */
+export type TRuntimeLocalStorageLifecycle = 'bound' | 'purge';
+/**
+ * A controller's authority for one retained, node-local volume of one service.
+ *
+ * Cloudly and Onebox issue it alike. It names the volume by identity only: no host path, no
+ * device, no mount option and no credential. The node resolves the identity to its own storage.
+ *
+ * `initialization` says what the node does when the volume does not exist yet. `empty` creates an
+ * empty root with `initialOwnership`, which it must state, so a workload that runs as the image's
+ * own user never meets a root-owned directory by accident. `import` waits for the volume's bytes to
+ * be imported and states no ownership: an imported tree keeps the ownership it carries.
+ */
+export interface IRuntimeLocalStorageClaim {
+    id: string;
+    generation: number;
+    previous: IRuntimeAuthorityReference | null;
+    controller: IRuntimeController;
+    organizationId: string;
+    clusterId: string;
+    nodeId: string;
+    runtimeNamespace: string;
+    serviceId: string;
+    /** The service's own name for this volume, stable across every generation of the claim. */
+    volumeId: string;
+    source: TRuntimeLocalStorageSource;
+    initialization: 'empty' | 'import';
+    /** Required for `empty`, `null` for `import`. */
+    initialOwnership: IRuntimeLocalStorageOwnership | null;
+    mount: IRuntimeLocalStorageMount;
+    accessMode: 'ReadWriteOnce';
+    reclaimPolicy: 'retain';
+    lifecycle: TRuntimeLocalStorageLifecycle;
+    digest: TSha256Digest;
+}
+/**
+ * What the node holds for the volume after admission.
+ *
+ * `ready` exists and may be mounted; `import-required` is an `import` volume whose bytes have not
+ * arrived; `purged` is a volume whose bytes the node deleted; `uncertain` is a volume the node
+ * cannot vouch for, which it neither mounts nor deletes until an operator decides.
+ */
+export type TRuntimeLocalStorageClaimState = 'ready' | 'import-required' | 'purged' | 'uncertain';
+/** Controller push over the node's current authenticated session. */
+export interface IApplyRuntimeLocalStorageClaimRequest {
+    session: IRuntimeSessionBinding;
+    claim: IRuntimeLocalStorageClaim;
+}
+/**
+ * Durable admission acknowledgement. `claim` is the reference of the claim that was sent, also on
+ * a `historical` answer, whose `state` describes the newer generation the node holds.
+ */
+export interface IApplyRuntimeLocalStorageClaimResponse {
+    status: 'accepted' | 'replay' | 'historical';
+    state: TRuntimeLocalStorageClaimState;
+    claim: IRuntimeAuthorityReference;
+}
+export declare const runtimeLocalStorageClaimContract: Readonly<{
+    readonly digestDomain: "serve.zone/runtime-local-storage-claim";
+    readonly error: "Runtime local storage claim contract rejected.";
+    readonly accessMode: "ReadWriteOnce";
+    readonly reclaimPolicy: "retain";
+    /** Every permission bit a claim may state: setgid, sticky and the rwx triplets. */
+    readonly directoryModeBits: 2047;
+}>;
+/** Detached exact-schema snapshot. The digest is a separate check. */
+export declare const snapshotRuntimeLocalStorageClaim: (valueArg: unknown) => IRuntimeLocalStorageClaim;
+export declare const computeRuntimeLocalStorageClaimDigest: (valueArg: unknown) => Promise<TSha256Digest>;
+export declare const validateRuntimeLocalStorageClaim: (valueArg: unknown) => Promise<string[]>;
+/** The `{ id, generation, digest }` an assignment's `workload.storage` seals for this claim. */
+export declare const getRuntimeLocalStorageClaimReference: (valueArg: unknown) => IRuntimeAuthorityReference;
+/**
+ * Content binding only: the assignment seals this exact claim, and both name the same controller,
+ * organization, node, runtime namespace and service. A purge claim binds to no assignment, because
+ * no workload may mount a volume being deleted. The cluster ID must come from the authenticated
+ * session, because an assignment does not contain one.
+ */
+export declare const bindRuntimeLocalStorageClaimToAssignment: (claimArg: unknown, assignmentArg: unknown, expectedClusterIdArg: unknown) => Promise<{
+    claim: IRuntimeLocalStorageClaim;
+    assignment: IRuntimeAssignment;
+}>;
+export declare const snapshotApplyRuntimeLocalStorageClaimRequest: (valueArg: unknown) => IApplyRuntimeLocalStorageClaimRequest;
+export declare const snapshotApplyRuntimeLocalStorageClaimResponse: (valueArg: unknown) => IApplyRuntimeLocalStorageClaimResponse;
+/**
+ * Admission-side content binding, not authentication: `trustedSessionArg` must be the node's
+ * CURRENT authenticated session, never read from the request. The request's session must equal it,
+ * the claim must name its controller, cluster, node and runtime namespace, and its digest must hold.
+ */
+export declare const bindApplyRuntimeLocalStorageClaimRequest: (valueArg: unknown, trustedSessionArg: unknown) => Promise<IApplyRuntimeLocalStorageClaimRequest>;
+/**
+ * Matches an answer to the exact claim that was sent. An `accepted` or `replay` answer must state a
+ * state the claim can be in: a bound claim is `ready`, `import-required` (for an `import` claim
+ * only) or `uncertain`; a purge is `purged` or `uncertain`. A `historical` answer describes the
+ * newer generation the node holds, so its state is not judged against the sent claim.
+ */
+export declare const bindApplyRuntimeLocalStorageClaimResponse: (valueArg: unknown, requestArg: unknown) => IApplyRuntimeLocalStorageClaimResponse;

package/dist_ts/data/runtimelocalstorageclaim.js

@@ -0,0 +1,167 @@
+import { snapshotRuntimeAssignment, validateRuntimeAssignment } from './runtimeassignment.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
+import { captureNetwork, networkController, networkDigest, networkEqual, networkHash, networkId, networkNodeId, networkRecord, networkReference, networkReferenceOf, networkRevision, requireNetwork, } from '../private/networkcontract.js';
+import { isRuntimeIdentityNumber } from '../private/runtimepolicy.js';
+import { createStorageContractReaders } from '../private/storagecontract.js';
+export const runtimeLocalStorageClaimContract = Object.freeze({
+    digestDomain: 'serve.zone/runtime-local-storage-claim',
+    error: 'Runtime local storage claim contract rejected.',
+    accessMode: 'ReadWriteOnce',
+    reclaimPolicy: 'retain',
+    /** Every permission bit a claim may state: setgid, sticky and the rwx triplets. */
+    directoryModeBits: 0o3777,
+});
+const fail = () => { throw new Error(runtimeLocalStorageClaimContract.error); };
+const safe = (operationArg) => { try {
+    return operationArg();
+}
+catch {
+    return fail();
+} };
+const { readMountPath } = createStorageContractReaders(fail);
+const claimStates = ['ready', 'import-required', 'purged', 'uncertain'];
+const responseStatuses = ['accepted', 'replay', 'historical'];
+const sourceOf = (valueArg) => {
+    const value = networkRecord(valueArg, ['kind']);
+    requireNetwork(value.kind === 'directory');
+    return { kind: 'directory' };
+};
+const ownershipOf = (valueArg) => {
+    const value = networkRecord(valueArg, ['uid', 'gid', 'mode']);
+    requireNetwork(isRuntimeIdentityNumber(value.uid) && isRuntimeIdentityNumber(value.gid)
+        && Number.isSafeInteger(value.mode) && value.mode >= 0
+        && (value.mode & ~runtimeLocalStorageClaimContract.directoryModeBits) === 0);
+    return { uid: value.uid, gid: value.gid, mode: value.mode };
+};
+const mountOf = (valueArg) => {
+    const value = networkRecord(valueArg, ['mountPath', 'readOnly']);
+    requireNetwork(typeof value.readOnly === 'boolean');
+    return { mountPath: readMountPath(value.mountPath, 'mountPath'), readOnly: value.readOnly };
+};
+/** Detached exact-schema snapshot. The digest is a separate check. */
+export const snapshotRuntimeLocalStorageClaim = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['id', 'generation', 'previous', 'controller',
+        'organizationId', 'clusterId', 'nodeId', 'runtimeNamespace', 'serviceId', 'volumeId', 'source',
+        'initialization', 'initialOwnership', 'mount', 'accessMode', 'reclaimPolicy', 'lifecycle', 'digest']);
+    const { id, generation, previous } = networkRevision(value);
+    requireNetwork((value.initialization === 'empty' && value.initialOwnership !== null)
+        || (value.initialization === 'import' && value.initialOwnership === null));
+    requireNetwork(value.accessMode === 'ReadWriteOnce' && value.reclaimPolicy === 'retain');
+    requireNetwork(value.lifecycle === 'bound' || (value.lifecycle === 'purge' && previous !== null));
+    return {
+        id, generation, previous,
+        controller: networkController(value.controller),
+        organizationId: networkId(value.organizationId),
+        clusterId: networkId(value.clusterId),
+        nodeId: networkNodeId(value.nodeId),
+        runtimeNamespace: networkId(value.runtimeNamespace),
+        serviceId: networkId(value.serviceId),
+        volumeId: networkId(value.volumeId),
+        source: sourceOf(value.source),
+        initialization: value.initialization,
+        initialOwnership: value.initialOwnership === null ? null : ownershipOf(value.initialOwnership),
+        mount: mountOf(value.mount),
+        accessMode: 'ReadWriteOnce',
+        reclaimPolicy: 'retain',
+        lifecycle: value.lifecycle,
+        digest: networkDigest(value.digest),
+    };
+});
+export const computeRuntimeLocalStorageClaimDigest = async (valueArg) => {
+    const claim = snapshotRuntimeLocalStorageClaim(valueArg);
+    try {
+        return await networkHash(runtimeLocalStorageClaimContract.digestDomain, claim);
+    }
+    catch {
+        return fail();
+    }
+};
+export const validateRuntimeLocalStorageClaim = async (valueArg) => {
+    try {
+        const claim = snapshotRuntimeLocalStorageClaim(valueArg);
+        return claim.digest === await computeRuntimeLocalStorageClaimDigest(claim)
+            ? [] : ['runtime local storage claim digest does not match'];
+    }
+    catch {
+        return ['runtime local storage claim must use its exact canonical schema'];
+    }
+};
+/** The `{ id, generation, digest }` an assignment's `workload.storage` seals for this claim. */
+export const getRuntimeLocalStorageClaimReference = (valueArg) => networkReferenceOf(snapshotRuntimeLocalStorageClaim(valueArg));
+/**
+ * Content binding only: the assignment seals this exact claim, and both name the same controller,
+ * organization, node, runtime namespace and service. A purge claim binds to no assignment, because
+ * no workload may mount a volume being deleted. The cluster ID must come from the authenticated
+ * session, because an assignment does not contain one.
+ */
+export const bindRuntimeLocalStorageClaimToAssignment = async (claimArg, assignmentArg, expectedClusterIdArg) => {
+    const claim = snapshotRuntimeLocalStorageClaim(claimArg);
+    const assignment = safe(() => snapshotRuntimeAssignment(assignmentArg));
+    if ((await validateRuntimeLocalStorageClaim(claim)).length
+        || (await validateRuntimeAssignment(assignment)).length)
+        fail();
+    safe(() => {
+        const expectedClusterId = networkId(expectedClusterIdArg);
+        const reference = assignment.workload.storage.find((itemArg) => itemArg.id === claim.id);
+        requireNetwork(reference !== undefined
+            && networkEqual(reference, getRuntimeLocalStorageClaimReference(claim))
+            && claim.lifecycle === 'bound'
+            && claim.clusterId === expectedClusterId
+            && networkEqual(assignment.controller, claim.controller)
+            && assignment.organizationId === claim.organizationId
+            && assignment.nodeId === claim.nodeId
+            && assignment.runtimeNamespace === claim.runtimeNamespace
+            && assignment.serviceId === claim.serviceId);
+    });
+    return { claim, assignment };
+};
+export const snapshotApplyRuntimeLocalStorageClaimRequest = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['session', 'claim']);
+    return { session: snapshotRuntimeSessionBinding(value.session), claim: snapshotRuntimeLocalStorageClaim(value.claim) };
+});
+export const snapshotApplyRuntimeLocalStorageClaimResponse = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['status', 'state', 'claim']);
+    requireNetwork(responseStatuses.includes(value.status)
+        && claimStates.includes(value.state));
+    return {
+        status: value.status,
+        state: value.state,
+        claim: networkReference(value.claim),
+    };
+});
+/**
+ * Admission-side content binding, not authentication: `trustedSessionArg` must be the node's
+ * CURRENT authenticated session, never read from the request. The request's session must equal it,
+ * the claim must name its controller, cluster, node and runtime namespace, and its digest must hold.
+ */
+export const bindApplyRuntimeLocalStorageClaimRequest = async (valueArg, trustedSessionArg) => {
+    const request = snapshotApplyRuntimeLocalStorageClaimRequest(valueArg);
+    const trustedSession = safe(() => snapshotRuntimeSessionBinding(trustedSessionArg));
+    if ((await validateRuntimeLocalStorageClaim(request.claim)).length)
+        fail();
+    safe(() => requireNetwork(networkEqual(request.session, trustedSession)
+        && networkEqual(request.claim.controller, trustedSession.controller)
+        && request.claim.clusterId === trustedSession.clusterId
+        && request.claim.nodeId === trustedSession.nodeId
+        && request.claim.runtimeNamespace === trustedSession.runtimeNamespace));
+    return request;
+};
+/**
+ * Matches an answer to the exact claim that was sent. An `accepted` or `replay` answer must state a
+ * state the claim can be in: a bound claim is `ready`, `import-required` (for an `import` claim
+ * only) or `uncertain`; a purge is `purged` or `uncertain`. A `historical` answer describes the
+ * newer generation the node holds, so its state is not judged against the sent claim.
+ */
+export const bindApplyRuntimeLocalStorageClaimResponse = (valueArg, requestArg) => safe(() => {
+    const response = snapshotApplyRuntimeLocalStorageClaimResponse(valueArg);
+    const { claim } = snapshotApplyRuntimeLocalStorageClaimRequest(requestArg);
+    requireNetwork(networkEqual(response.claim, getRuntimeLocalStorageClaimReference(claim)));
+    if (response.status !== 'historical') {
+        requireNetwork(claim.lifecycle === 'purge'
+            ? response.state === 'purged' || response.state === 'uncertain'
+            : response.state === 'ready' || response.state === 'uncertain'
+                || (response.state === 'import-required' && claim.initialization === 'import'));
+    }
+    return response;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWxvY2Fsc3RvcmFnZWNsYWltLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9ydW50aW1lbG9jYWxzdG9yYWdlY2xhaW0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLHlCQUF5QixFQUFFLHlCQUF5QixFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFFOUYsT0FBTyxFQUFFLDZCQUE2QixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDcEUsT0FBTyxFQUFFLGNBQWMsRUFBRSxpQkFBaUIsRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQzdGLGFBQWEsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsZUFBZSxFQUFFLGNBQWMsR0FDcEcsTUFBTSwrQkFBK0IsQ0FBQztBQUN2QyxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUN0RSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQTBGN0UsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM1RCxZQUFZLEVBQUUsd0NBQXdDO0lBQ3RELEtBQUssRUFBRSxnREFBZ0Q7SUFDdkQsVUFBVSxFQUFFLGVBQWU7SUFDM0IsYUFBYSxFQUFFLFFBQVE7SUFDdkIsbUZBQW1GO0lBQ25GLGlCQUFpQixFQUFFLE1BQU07Q0FDakIsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN2RixNQUFNLElBQUksR0FBRyxDQUFJLFlBQXFCLEVBQUssRUFBRSxHQUFHLElBQUksQ0FBQztJQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7QUFBQyxDQUFDO0FBQUMsTUFBTSxDQUFDO0lBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztBQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDMUcsTUFBTSxFQUFFLGFBQWEsRUFBRSxHQUFHLDRCQUE0QixDQUFDLElBQUksQ0FBQyxDQUFDO0FBQzdELE1BQU0sV0FBVyxHQUFHLENBQUMsT0FBTyxFQUFFLGlCQUFpQixFQUFFLFFBQVEsRUFBRSxXQUFXLENBQVUsQ0FBQztBQUNqRixNQUFNLGdCQUFnQixHQUFHLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLENBQVUsQ0FBQztBQUV2RSxNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQThCLEVBQUU7SUFDakUsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDaEQsY0FBYyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDM0MsT0FBTyxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUMvQixDQUFDLENBQUM7QUFFRixNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQWlDLEVBQUU7SUFDdkUsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUM5RCxjQUFjLENBQUMsdUJBQXVCLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUM7V0FDbEYsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUssS0FBSyxDQUFDLElBQWUsSUFBSSxDQUFDO1dBQy9ELENBQUUsS0FBSyxDQUFDLElBQWUsR0FBRyxDQUFDLGdDQUFnQyxDQUFDLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDM0YsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBYSxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBYSxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsSUFBYyxFQUFFLENBQUM7QUFDNUYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUE2QixFQUFFO0lBQy9ELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNqRSxjQUFjLENBQUMsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3BELE9BQU8sRUFBRSxTQUFTLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsV0FBVyxDQUFDLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQztBQUM5RixDQUFDLENBQUM7QUFFRixzRUFBc0U7QUFDdEUsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FBQyxRQUFpQixFQUE2QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUMxRyxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxVQUFVLEVBQUUsWUFBWTtRQUNqRyxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsUUFBUSxFQUFFLGtCQUFrQixFQUFFLFdBQVcsRUFBRSxVQUFVLEVBQUUsUUFBUTtRQUM5RixnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLGVBQWUsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN4RyxNQUFNLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDNUQsY0FBYyxDQUFDLENBQUMsS0FBSyxDQUFDLGNBQWMsS0FBSyxPQUFPLElBQUksS0FBSyxDQUFDLGdCQUFnQixLQUFLLElBQUksQ0FBQztXQUMvRSxDQUFDLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQzdFLGNBQWMsQ0FBQyxLQUFLLENBQUMsVUFBVSxLQUFLLGVBQWUsSUFBSSxLQUFLLENBQUMsYUFBYSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ3pGLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssT0FBTyxJQUFJLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ2xHLE9BQU87UUFDTCxFQUFFLEVBQUUsVUFBVSxFQUFFLFFBQVE7UUFDeEIsVUFBVSxFQUFFLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDL0MsY0FBYyxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDO1FBQy9DLFNBQVMsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUNyQyxNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDbkMsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztRQUNuRCxTQUFTLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDckMsUUFBUSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDO1FBQ25DLE1BQU0sRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUM5QixjQUFjLEVBQUUsS0FBSyxDQUFDLGNBQTZEO1FBQ25GLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztRQUM5RixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDM0IsVUFBVSxFQUFFLGVBQWU7UUFDM0IsYUFBYSxFQUFFLFFBQVE7UUFDdkIsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUEwQztRQUMzRCxNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7S0FDcEMsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsS0FBSyxFQUFFLFFBQWlCLEVBQTBCLEVBQUU7SUFDdkcsTUFBTSxLQUFLLEdBQUcsZ0NBQWdDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekQsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLFdBQVcsQ0FBQyxnQ0FBZ0MsQ0FBQyxZQUFZLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFDaEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQzdGLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLHFDQUFxQyxDQUFDLEtBQUssQ0FBQztZQUN4RSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQzdFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixnR0FBZ0c7QUFDaEcsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FBQyxRQUFpQixFQUE4QixFQUFFLENBQ3BHLGtCQUFrQixDQUFDLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFakU7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxLQUFLLEVBQzNELFFBQWlCLEVBQUUsYUFBc0IsRUFBRSxvQkFBNkIsRUFDTyxFQUFFO0lBQ2pGLE1BQU0sS0FBSyxHQUFHLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyx5QkFBeUIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3hFLElBQUksQ0FBQyxNQUFNLGdDQUFnQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTTtXQUNyRCxDQUFDLE1BQU0seUJBQXlCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNO1FBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEUsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUNSLE1BQU0saUJBQWlCLEdBQUcsU0FBUyxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDMUQsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixjQUFjLENBQUMsU0FBUyxLQUFLLFNBQVM7ZUFDakMsWUFBWSxDQUFDLFNBQVMsRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztlQUNwRSxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU87ZUFDM0IsS0FBSyxDQUFDLFNBQVMsS0FBSyxpQkFBaUI7ZUFDckMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsQ0FBQztlQUNyRCxVQUFVLENBQUMsY0FBYyxLQUFLLEtBQUssQ0FBQyxjQUFjO2VBQ2xELFVBQVUsQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLE1BQU07ZUFDbEMsVUFBVSxDQUFDLGdCQUFnQixLQUFLLEtBQUssQ0FBQyxnQkFBZ0I7ZUFDdEQsVUFBVSxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDakQsQ0FBQyxDQUFDLENBQUM7SUFDSCxPQUFPLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBQy9CLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLENBQzFELFFBQWlCLEVBQ3NCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3BELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUM1RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsZ0NBQWdDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDekgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLGNBQWMsQ0FBRSxnQkFBdUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztXQUN4RSxXQUFrQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNoRSxPQUFPO1FBQ0wsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUEwRDtRQUN4RSxLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQXVDO1FBQ3BELEtBQUssRUFBRSxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDO0tBQ3JDLENBQUM7QUFDSixDQUFDLENBQUMsQ0FBQztBQUVIOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxLQUFLLEVBQzNELFFBQWlCLEVBQUUsaUJBQTBCLEVBQ0csRUFBRTtJQUNsRCxNQUFNLE9BQU8sR0FBRyw0Q0FBNEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2RSxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsNkJBQTZCLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLElBQUksQ0FBQyxNQUFNLGdDQUFnQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU07UUFBRSxJQUFJLEVBQUUsQ0FBQztJQUMzRSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQztXQUNsRSxZQUFZLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsY0FBYyxDQUFDLFVBQVUsQ0FBQztXQUNqRSxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsS0FBSyxjQUFjLENBQUMsU0FBUztXQUNwRCxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxjQUFjLENBQUMsTUFBTTtXQUM5QyxPQUFPLENBQUMsS0FBSyxDQUFDLGdCQUFnQixLQUFLLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDMUUsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxDQUN2RCxRQUFpQixFQUFFLFVBQW1CLEVBQ0UsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDckQsTUFBTSxRQUFRLEdBQUcsNkNBQTZDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekUsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLDRDQUE0QyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzNFLGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQ3JDLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU87WUFDeEMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssV0FBVztZQUMvRCxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxPQUFPLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxXQUFXO21CQUN6RCxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssaUJBQWlCLElBQUksS0FBSyxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMsQ0FBQyJ9

package/dist_ts/data/service.d.ts

@@ -7,6 +7,7 @@ import type { IServiceWebPushConfig } from './webpush.js';
 import type { IImageRolloutStatus, IImmutableImageDeploymentPlan } from './immutableimage.js';
 import type { IServiceDomainRoute, IServicePublicPortMapping, IServiceTargetPort } from './serviceports.js';
 import type { IServiceSecretConfiguration, IServiceSecretDeploymentPlan } from './secret.js';
+import type { TServiceVolumeInitialization } from './servicevolumeinitialization.js';
 export interface IServiceVolume {
     /** Stable Docker volume name. If omitted, Coreflow derives one from service id and mount path. */
     name?: string;
@@ -21,7 +22,15 @@ export interface IServiceVolume {
     backup?: boolean;
     /** Driver-specific options forwarded to Docker's VolumeDriver.Create request. */
     options?: Record<string, string>;
+    /**
+     * Server-managed: how the volume's node-local storage claim starts on a Pallet cluster. Only
+     * `setServiceVolumeInitialization` writes it; a volume without one is refused as
+     * `volume-initialization-unknown` instead of being created empty.
+     */
+    initialization?: TServiceVolumeInitialization;
 }
+/** Caller-writable volume declaration. Its initialization has its own fenced request. */
+export type TServiceWritableVolume = Omit<IServiceVolume, 'initialization'>;
 /** Validates the canonical organization authority used by service operations. */
 export declare const validateOrganizationId: (valueArg: unknown) => string[];
 export declare const serviceContainerArgLimits: {
@@ -169,12 +178,17 @@ export interface IService {
  * Caller-writable service data. Immutable rollout state and SecretSet
  * attachments are changed only through their dedicated fenced APIs.
  */
-export type TServiceWritableData = Omit<IService['data'], 'organizationId' | 'immutableImageRequired' | 'imageDeployment' | 'imageRolloutStatus' | 'secretConfiguration' | 'secretDeployment' | 'mail'> & {
+export type TServiceWritableData = Omit<IService['data'], 'organizationId' | 'immutableImageRequired' | 'imageDeployment' | 'imageRolloutStatus' | 'secretConfiguration' | 'secretDeployment' | 'mail' | 'volumes'> & {
     /**
      * Mail configuration stays caller-writable, except for the CoreMail binding
      * metadata Cloudly derives from reconciliation.
      */
     mail?: TServiceMailWritableConfig;
+    /**
+     * Volumes stay caller-writable, except for their initialization, which Cloudly refuses here.
+     * A stored initialization stays with the volume of the same mount path and goes with it.
+     */
+    volumes?: TServiceWritableVolume[];
 };
 /** Caller-writable update data. Null explicitly removes an existing argument vector. */
 export type TServiceUpdateWritableData = Omit<TServiceWritableData, 'containerArgs'> & {

package/dist_ts/data/service.js

@@ -65,4 +65,4 @@ export const validateServiceContainerArgs = (containerArgsArg) => {
     }
     return [];
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFvQ0EsTUFBTSxtQkFBbUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUVsRSxpRkFBaUY7QUFDakYsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUFZLEVBQUU7SUFDcEUsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN4RSxPQUFPLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsT0FBTyxFQUFFLENBQUM7QUFDWixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRztJQUN2QyxXQUFXLEVBQUUsRUFBRTtJQUNmLGVBQWUsRUFBRSxJQUFJO0lBQ3JCLGlCQUFpQixFQUFFLEVBQUUsR0FBRyxJQUFJO0NBQ3BCLENBQUM7QUFFWCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLE9BQWUsRUFBc0IsRUFBRTtJQUNsRixJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVE7V0FDMUIsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztXQUN4QixPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztXQUN0QixPQUFPLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQzFCLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBYSxFQUFFLENBQUM7SUFDOUIsS0FBSyxNQUFNLE9BQU8sSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDLE9BQU8sSUFBSSxPQUFPLEtBQUssR0FBRztZQUFFLFNBQVM7UUFDMUMsSUFBSSxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDckIsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7Z0JBQUUsT0FBTyxTQUFTLENBQUM7WUFDNUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2YsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBQ3pELFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDekIsQ0FBQztJQUNELE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7QUFDbEMsQ0FBQyxDQUFDO0FBRUYsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsZ0JBQXlCLEVBQVksRUFBRTtJQUNsRixJQUFJLGdCQUFnQixLQUFLLFNBQVM7UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUM5QyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQztRQUFFLE9BQU8sQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO0lBQ2hGLElBQUksZ0JBQWdCLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLGdCQUFnQixDQUFDLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNwRSxPQUFPLENBQUMsc0NBQXNDLHlCQUF5QixDQUFDLFdBQVcsVUFBVSxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELElBQUksVUFBVSxHQUFHLENBQUMsQ0FBQztJQUNuQixLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLElBQUksZ0JBQWdCLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUMzRCxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFELE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzNDLE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7UUFDRCxNQUFNLGFBQWEsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFDcEUsSUFBSSxhQUFhLEdBQUcseUJBQXlCLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDOUQsT0FBTyxDQUFDLGlCQUFpQixLQUFLLG9DQUFvQyxDQUFDLENBQUM7UUFDdEUsQ0FBQztRQUNELFVBQVUsSUFBSSxhQUFhLENBQUM7SUFDOUIsQ0FBQztJQUNELElBQUksVUFBVSxHQUFHLHlCQUF5QixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDN0QsT0FBTyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE9BQU8sRUFBRSxDQUFDO0FBQ1osQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvc2VydmljZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUE4Q0EsTUFBTSxtQkFBbUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUVsRSxpRkFBaUY7QUFDakYsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUFZLEVBQUU7SUFDcEUsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN4RSxPQUFPLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsT0FBTyxFQUFFLENBQUM7QUFDWixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRztJQUN2QyxXQUFXLEVBQUUsRUFBRTtJQUNmLGVBQWUsRUFBRSxJQUFJO0lBQ3JCLGlCQUFpQixFQUFFLEVBQUUsR0FBRyxJQUFJO0NBQ3BCLENBQUM7QUFFWCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLE9BQWUsRUFBc0IsRUFBRTtJQUNsRixJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVE7V0FDMUIsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztXQUN4QixPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztXQUN0QixPQUFPLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQzFCLE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBYSxFQUFFLENBQUM7SUFDOUIsS0FBSyxNQUFNLE9BQU8sSUFBSSxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDLE9BQU8sSUFBSSxPQUFPLEtBQUssR0FBRztZQUFFLFNBQVM7UUFDMUMsSUFBSSxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDckIsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7Z0JBQUUsT0FBTyxTQUFTLENBQUM7WUFDNUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2YsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBQ3pELFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDekIsQ0FBQztJQUNELE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7QUFDbEMsQ0FBQyxDQUFDO0FBRUYsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsZ0JBQXlCLEVBQVksRUFBRTtJQUNsRixJQUFJLGdCQUFnQixLQUFLLFNBQVM7UUFBRSxPQUFPLEVBQUUsQ0FBQztJQUM5QyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQztRQUFFLE9BQU8sQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO0lBQ2hGLElBQUksZ0JBQWdCLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLGdCQUFnQixDQUFDLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNwRSxPQUFPLENBQUMsc0NBQXNDLHlCQUF5QixDQUFDLFdBQVcsVUFBVSxDQUFDLENBQUM7SUFDakcsQ0FBQztJQUNELElBQUksVUFBVSxHQUFHLENBQUMsQ0FBQztJQUNuQixLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLElBQUksZ0JBQWdCLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUMzRCxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFELE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzNDLE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7UUFDRCxNQUFNLGFBQWEsR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFDcEUsSUFBSSxhQUFhLEdBQUcseUJBQXlCLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDOUQsT0FBTyxDQUFDLGlCQUFpQixLQUFLLG9DQUFvQyxDQUFDLENBQUM7UUFDdEUsQ0FBQztRQUNELFVBQVUsSUFBSSxhQUFhLENBQUM7SUFDOUIsQ0FBQztJQUNELElBQUksVUFBVSxHQUFHLHlCQUF5QixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDN0QsT0FBTyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE9BQU8sRUFBRSxDQUFDO0FBQ1osQ0FBQyxDQUFDIn0=

package/dist_ts/data/serviceruntime.d.ts

@@ -71,12 +71,16 @@ export declare const serviceRuntimeContract: Readonly<{
     /** The largest `limit` `getClusterRuntimeAssignments` accepts; Cloudly refuses a larger one. */
     readonly maximumAssignmentPageSize: 256;
 }>;
-declare const serviceRuntimeWaitingReasons: readonly ["node-network-pending", "conflict", "failure-backoff"];
-declare const serviceRuntimeRefusals: readonly ["cluster-runtime-missing", "organization-missing", "image-plan-missing", "platform-unsupported", "secrets-unsupported", "volumes-unsupported", "port-protocol-unsupported", "ports-too-many", "readiness-target-undeclared", "environment-too-large", "no-eligible-node", "replica-limit", "node-authority-unsupported", "network-policy-missing", "network-policy-mismatch", "network-workload-pool-missing", "network-workload-pool-exhausted"];
+declare const serviceRuntimeWaitingReasons: readonly ["node-network-pending", "conflict", "failure-backoff", "storage-import-pending", "bindings-pending", "legacy-adoption-pending"];
+declare const serviceRuntimeRefusals: readonly ["cluster-runtime-missing", "organization-missing", "image-plan-missing", "platform-unsupported", "secrets-unsupported", "volumes-unsupported", "port-protocol-unsupported", "ports-too-many", "readiness-target-undeclared", "environment-too-large", "no-eligible-node", "replica-limit", "node-authority-unsupported", "network-policy-missing", "network-policy-mismatch", "network-workload-pool-missing", "network-workload-pool-exhausted", "volume-driver-unsupported", "volume-options-unsupported", "volume-shared-unsupported", "volume-placement-unsupported", "volume-initialization-unknown", "volume-ownership-unknown"];
 /**
  * Why the producer is not converging yet, though nothing needs an administrator:
  * `node-network-pending` waits for a node's network readiness, `conflict` for a sweep over inputs
- * that changed while it ran, `failure-backoff` for a failed replica's backoff to elapse.
+ * that changed while it ran, `failure-backoff` for a failed replica's backoff to elapse,
+ * `storage-import-pending` for an `import` local storage claim whose bytes have not arrived on its
+ * node, `bindings-pending` for the secret manifest to cover every enabled binding of the service, and
+ * `legacy-adoption-pending` for a Corestore binding whose legacy resource waits for the offline
+ * adoption Corestore requires (the binding's `statusReason` of the same name).
  */
 export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[number];
 /**
@@ -88,6 +92,14 @@ export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[n
  * node whose session resolved fewer workload authorities than this spec needs, which the admit step
  * refuses rather than handing the node work it would silently park. An attached network needs an
  * explicit matching policy and a current workload address pool; neither is defaulted.
+ *
+ * The volume refusals name what a local storage claim cannot express: `volume-driver-unsupported`
+ * a volume of a driver other than a node-local directory, `volume-options-unsupported` driver or
+ * mount options, `volume-shared-unsupported` one volume mounted by more than one replica or service,
+ * and `volume-placement-unsupported` a placement that does not pin each volume to one node.
+ * `volume-initialization-unknown` is a volume without an initialization and
+ * `volume-ownership-unknown` a `run-as` ownership under `runAs: null`
+ * (`deriveServiceVolumeClaimInitialization`); neither is defaulted.
  */
 export type TServiceRuntimeRefusal = typeof serviceRuntimeRefusals[number];
 interface IServiceRuntimeStatusBase {

package/dist_ts/data/serviceruntime.js

@@ -14,13 +14,18 @@ export const serviceRuntimeContract = Object.freeze({
     /** The largest `limit` `getClusterRuntimeAssignments` accepts; Cloudly refuses a larger one. */
     maximumAssignmentPageSize: 256,
 });
-const serviceRuntimeWaitingReasons = ['node-network-pending', 'conflict', 'failure-backoff'];
+const serviceRuntimeWaitingReasons = [
+    'node-network-pending', 'conflict', 'failure-backoff', 'storage-import-pending', 'bindings-pending',
+    'legacy-adoption-pending',
+];
 const serviceRuntimeRefusals = [
     'cluster-runtime-missing', 'organization-missing', 'image-plan-missing', 'platform-unsupported',
     'secrets-unsupported', 'volumes-unsupported', 'port-protocol-unsupported', 'ports-too-many',
     'readiness-target-undeclared', 'environment-too-large', 'no-eligible-node', 'replica-limit',
     'node-authority-unsupported', 'network-policy-missing', 'network-policy-mismatch',
     'network-workload-pool-missing', 'network-workload-pool-exhausted',
+    'volume-driver-unsupported', 'volume-options-unsupported', 'volume-shared-unsupported',
+    'volume-placement-unsupported', 'volume-initialization-unknown', 'volume-ownership-unknown',
 ];
 /** Sorted, duplicate-free and read by the vocabulary the ids belong to: a node's, or the canonical one. */
 const sortedIds = (value, maximum, read) => networkSorted(networkList(value, maximum, read), id => id);
@@ -94,4 +99,4 @@ export const snapshotServiceRuntimeStatus = (value) => producerSafe(() => {
     requireNetwork(item.state === 'refused' && isOneOf(serviceRuntimeRefusals, item.reason));
     return { ...base, state: item.state, reason: item.reason };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF3RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRyxDQUFDLHNCQUFzQixFQUFFLFVBQVUsRUFBRSxpQkFBaUIsQ0FBVSxDQUFDO0FBQ3RHLE1BQU0sc0JBQXNCLEdBQUc7SUFDN0IseUJBQXlCLEVBQUUsc0JBQXNCLEVBQUUsb0JBQW9CLEVBQUUsc0JBQXNCO0lBQy9GLHFCQUFxQixFQUFFLHFCQUFxQixFQUFFLDJCQUEyQixFQUFFLGdCQUFnQjtJQUMzRiw2QkFBNkIsRUFBRSx1QkFBdUIsRUFBRSxrQkFBa0IsRUFBRSxlQUFlO0lBQzNGLDRCQUE0QixFQUFFLHdCQUF3QixFQUFFLHlCQUF5QjtJQUNqRiwrQkFBK0IsRUFBRSxpQ0FBaUM7Q0FDMUQsQ0FBQztBQTJEWCwyR0FBMkc7QUFDM0csTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBZSxFQUFFLElBQStCLEVBQVksRUFBRSxDQUMvRixhQUFhLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUU3RCxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBNEIsRUFBRTtJQUMvRCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQzFCLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9CLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsQ0FBQztJQUNqQyxNQUFNLE9BQU8sR0FBRyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxzQkFBc0IsQ0FBQyxrQkFBa0IsRUFBRSxhQUFhLENBQUMsQ0FBQztJQUN2SSxjQUFjLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNuQyxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQzNCLENBQUMsQ0FBQztBQUVGLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYyxFQUFtQyxFQUFFO0lBQ2xFLElBQUksS0FBSyxLQUFLLElBQUk7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNoQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDckQsY0FBYyxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUMxRixPQUFPLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztBQUNoRCxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBMEIsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsV0FBVyxFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDaEgsY0FBYyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO1dBQ3RGLGtCQUFrQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxPQUFPLElBQUksQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDaEYsNEdBQTRHO0lBQzVHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQ2pFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDO0lBQzFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRSxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7UUFDL0QsU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUE0QjtRQUNsRixJQUFJLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsRUFBRSxjQUFjLEVBQUUsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQ3JJLENBQUMsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUEwQixFQUFFO0lBQzNELE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdEMsSUFBSSxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEIsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDL0IsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsY0FBYyxFQUFFLHFCQUFxQixDQUFDLENBQUMsQ0FBQztJQUNuRixjQUFjLENBQUMsT0FBTyxJQUFJLENBQUMsWUFBWSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZELE9BQU8sRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1FBQzVDLG1CQUFtQixFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsc0JBQXNCLENBQUMsd0JBQXdCLEVBQUUsU0FBUyxDQUFDLEVBQUUsQ0FBQztBQUMzSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLEtBQWMsRUFBdUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDbkcsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsV0FBVztRQUNqRyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUMsRUFBRSxzQkFBc0IsQ0FBQyxzQkFBc0IsQ0FBQztXQUNsRyxPQUFPLElBQUksQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDckMsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLGNBQWMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNuSCxTQUFTLEVBQUUsV0FBVyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWUsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7UUFDOUYsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsUUFBUSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztBQUNsSCxDQUFDLENBQUMsQ0FBQztBQUVILHdGQUF3RjtBQUN4RixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLEtBQWMsRUFBeUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDdkcsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzFHLE1BQU0sSUFBSSxHQUE4QixFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLFlBQVksRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQztRQUMvRyxTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0lBQzlDLElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxXQUFXLElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUM5RCxjQUFjLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQztRQUNyQyxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDN0IsY0FBYyxDQUFDLE9BQU8sQ0FBQyw0QkFBNEIsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUNuRSxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxzQkFBc0IsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN6RixPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUM3RCxDQUFDLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF3RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRztJQUNuQyxzQkFBc0IsRUFBRSxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsd0JBQXdCLEVBQUUsa0JBQWtCO0lBQ25HLHlCQUF5QjtDQUNqQixDQUFDO0FBQ1gsTUFBTSxzQkFBc0IsR0FBRztJQUM3Qix5QkFBeUIsRUFBRSxzQkFBc0IsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0I7SUFDL0YscUJBQXFCLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsZ0JBQWdCO0lBQzNGLDZCQUE2QixFQUFFLHVCQUF1QixFQUFFLGtCQUFrQixFQUFFLGVBQWU7SUFDM0YsNEJBQTRCLEVBQUUsd0JBQXdCLEVBQUUseUJBQXlCO0lBQ2pGLCtCQUErQixFQUFFLGlDQUFpQztJQUNsRSwyQkFBMkIsRUFBRSw0QkFBNEIsRUFBRSwyQkFBMkI7SUFDdEYsOEJBQThCLEVBQUUsK0JBQStCLEVBQUUsMEJBQTBCO0NBQ25GLENBQUM7QUF1RVgsMkdBQTJHO0FBQzNHLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFFLE9BQWUsRUFBRSxJQUErQixFQUFZLEVBQUUsQ0FDL0YsYUFBYSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7QUFFN0QsTUFBTSxXQUFXLEdBQUcsQ0FBQyxLQUFjLEVBQTRCLEVBQUU7SUFDL0QsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0QyxJQUFJLElBQUksS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUMxQixhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLEtBQUssT0FBTyxDQUFDLENBQUM7SUFDakMsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxPQUFPLEVBQUUsc0JBQXNCLENBQUMsa0JBQWtCLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDdkksY0FBYyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbkMsT0FBTyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUMzQixDQUFDLENBQUM7QUFFRixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRTtJQUNsRSxJQUFJLEtBQUssS0FBSyxJQUFJO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDaEMsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3JELGNBQWMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksdUJBQXVCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUYsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUU7SUFDM0QsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLFdBQVcsRUFBRSxhQUFhLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ2hILGNBQWMsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksb0JBQW9CLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQztXQUN0RixrQkFBa0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksT0FBTyxJQUFJLENBQUMsY0FBYyxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ2hGLDRHQUE0RztJQUM1RyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLENBQUMsQ0FBQztJQUNqRSxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQztJQUMxRSxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLEVBQUUsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXO1FBQy9ELFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBNEI7UUFDbEYsSUFBSSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLEVBQUUsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUNySSxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBMEIsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3hCLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9CLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksS0FBSyxVQUFVLENBQUMsQ0FBQztJQUNwQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLGNBQWMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7SUFDbkYsY0FBYyxDQUFDLE9BQU8sSUFBSSxDQUFDLFlBQVksS0FBSyxTQUFTLENBQUMsQ0FBQztJQUN2RCxPQUFPLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtRQUM1QyxtQkFBbUIsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLHNCQUFzQixDQUFDLHdCQUF3QixFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDM0gsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxLQUFjLEVBQXVCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ25HLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFdBQVc7UUFDakcsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNoRSxjQUFjLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDLEVBQUUsc0JBQXNCLENBQUMsc0JBQXNCLENBQUM7V0FDbEcsT0FBTyxJQUFJLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3JDLE9BQU8sRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxjQUFjLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDbkgsU0FBUyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsZUFBZSxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQzlGLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFFBQVEsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7QUFDbEgsQ0FBQyxDQUFDLENBQUM7QUFFSCx3RkFBd0Y7QUFDeEYsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxLQUFjLEVBQXlCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ3ZHLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsY0FBYyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMxRyxNQUFNLElBQUksR0FBOEIsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxZQUFZLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7UUFDL0csU0FBUyxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM5QyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssV0FBVyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDOUQsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDckMsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzdCLGNBQWMsQ0FBQyxPQUFPLENBQUMsNEJBQTRCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDbkUsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDN0QsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDekYsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDN0QsQ0FBQyxDQUFDLENBQUMifQ==

package/dist_ts/data/servicevolumeinitialization.d.ts

@@ -0,0 +1,91 @@
+import type { IRuntimeLocalStorageOwnership } from './runtimelocalstorageclaim.js';
+import type { IServiceRuntimeProfile } from './serviceruntime.js';
+/**
+ * Where an `import` volume's bytes come from.
+ *
+ * `docker-volume` is a Docker volume on the host the claim's node runs on, named exactly as Docker
+ * lists it; a Corestore-driver volume is named the same way. The operator copies its tree into the
+ * node's import directory; the node never reads this reference, and the local storage claim does
+ * not carry it.
+ */
+export type TServiceVolumeImportSource = {
+    kind: 'docker-volume';
+    volumeName: string;
+};
+/**
+ * The owner and permission bits an `empty` volume's root directory gets.
+ *
+ * `explicit` states the numeric owner. `run-as` takes the owner from the runtime spec's
+ * `profile.runAs` (user and group) when the claim is first issued; the mode is always stated,
+ * because no mode is right for every image.
+ */
+export type TServiceVolumeOwnership = {
+    kind: 'explicit';
+    uid: number;
+    gid: number;
+    mode: number;
+} | {
+    kind: 'run-as';
+    mode: number;
+};
+/**
+ * How a service volume's node-local claim starts: `empty` creates a fresh root with the stated
+ * ownership, `import` waits for the bytes of an existing volume.
+ */
+export type TServiceVolumeInitialization = {
+    kind: 'empty';
+    ownership: TServiceVolumeOwnership;
+} | {
+    kind: 'import';
+    source: TServiceVolumeImportSource;
+};
+/**
+ * What a volume's initialization derives for a local storage claim, or why it derives nothing.
+ *
+ * `volume-initialization-unknown` is a volume with no initialization: Cloudly never assumes
+ * `empty`, because an empty volume in front of a service whose data sits in a legacy volume would
+ * start that service without its data. `volume-ownership-unknown` is a `run-as` ownership while
+ * the runtime spec runs the image's own user (`runAs: null`), whose numeric identity Cloudly does
+ * not know.
+ */
+export type TServiceVolumeClaimInitialization = {
+    status: 'derived';
+    initialization: 'empty';
+    initialOwnership: IRuntimeLocalStorageOwnership;
+} | {
+    status: 'derived';
+    initialization: 'import';
+    initialOwnership: null;
+} | {
+    status: 'refused';
+    reason: 'volume-initialization-unknown' | 'volume-ownership-unknown';
+};
+/**
+ * Why `setServiceVolumeInitialization` wrote nothing. `volume-not-found` names no declared volume
+ * at that mount path, `conflict` a stored initialization other than `expected`,
+ * `volume-initialization-invalid` a value this contract refuses, and
+ * `volume-initialization-bound` a change while a bound local storage claim of the volume exists:
+ * a claim keeps the initialization and ownership it was issued with for its whole life.
+ */
+export type TServiceVolumeInitializationRefusal = 'volume-not-found' | 'conflict' | 'volume-initialization-invalid' | 'volume-initialization-bound';
+/** The named refusal of `setServiceVolumeInitialization`, sent as `TypedResponseError.errorData`. */
+export interface IServiceVolumeInitializationErrorData {
+    code: TServiceVolumeInitializationRefusal;
+    retryable: false;
+}
+export declare const serviceVolumeInitializationContract: Readonly<{
+    /** Every permission bit an ownership may state, the local storage claim's own bound. */
+    readonly directoryModeBits: 2047;
+    readonly maximumDockerVolumeNameLength: 255;
+}>;
+/** Validates one volume initialization and names every reason it is refused. */
+export declare const validateServiceVolumeInitialization: (valueArg: unknown, pathArg?: string) => string[];
+/**
+ * The claim fields a volume's initialization derives under a runtime spec's `runAs`.
+ *
+ * Absent initialization refuses as `volume-initialization-unknown`; a `run-as` ownership under
+ * `runAs: null` refuses as `volume-ownership-unknown`. Nothing is defaulted. The answer is for the
+ * first generation of a claim only: later generations carry that claim's own initialization and
+ * ownership, whatever `runAs` says by then. A malformed initialization or `runAs` throws.
+ */
+export declare const deriveServiceVolumeClaimInitialization: (initializationArg: TServiceVolumeInitialization | undefined, runAsArg: IServiceRuntimeProfile["runAs"]) => TServiceVolumeClaimInitialization;