@serve.zone/interfaces 32.34.0 → 32.36.0

package/dist_ts/data/runtimelocalvolumearchive.d.ts

@@ -0,0 +1,103 @@
+import type * as plugins from '../plugins.js';
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeLocalStorageClaim } from './runtimelocalstorageclaim.js';
+import type { IRuntimeSessionBinding } from './runtimesession.js';
+/**
+ * The one archive format a volume travels in: a POSIX.1-2001 pax archive of the volume's tree.
+ *
+ * The first entry is the volume's root, `./`, and every other name is relative below it. An entry is
+ * a directory, a regular file, a symbolic link (stored, never followed), a hard link to an earlier
+ * entry of the same archive, or a FIFO. Ownership is numeric: `uid` and `gid`, never user or group
+ * names, so the tree means the same on every host. Mode bits, including setuid, setgid and sticky,
+ * and the modification time travel exactly. A socket carries no bytes and belongs to the process
+ * that created it, so it is omitted; a device node, extended attributes and ACLs are not part of
+ * the format, and a volume that holds a device node is refused. The archive ends with the format's
+ * two zero blocks, so its length is a whole number of 512-byte blocks.
+ */
+export type TRuntimeLocalVolumeArchiveFormat = 'pax';
+/**
+ * A local controller reads one volume as an archive. The node refuses while a running container
+ * holds the volume: it reads a volume no container holds, or one whose holding container is
+ * stopped, which a node never restarts, and no container is granted the volume while it reads.
+ */
+export interface IReadRuntimeLocalVolumeArchiveRequest {
+    session: IRuntimeSessionBinding;
+    /** The reference of the node's current generation of a bound `directory` claim. */
+    claim: IRuntimeAuthorityReference;
+}
+/**
+ * The archive arrives on the stream the TypedRequest answers beside this body. `holder` states
+ * whether the volume was read unheld or under a stopped holder. The stream carries no integrity:
+ * the node learns the archive's length and digest only while it writes it.
+ */
+export interface IReadRuntimeLocalVolumeArchiveResponse {
+    claim: IRuntimeAuthorityReference;
+    format: TRuntimeLocalVolumeArchiveFormat;
+    holder: 'none' | 'stopped';
+}
+/**
+ * A local controller writes one archive as the bytes of an `import` claim that waits in
+ * `import-required`: the online form of an operator's offline import. The node receives the stream
+ * beside this body, whose integrity must be exactly `byteLength` and `digest`, unpacks it into a
+ * private staging tree, and publishes that tree as the volume only after the whole archive
+ * verified. The tree keeps the ownership the archive carries, as every imported tree does.
+ */
+export interface IWriteRuntimeLocalVolumeArchiveRequest {
+    session: IRuntimeSessionBinding;
+    claim: IRuntimeAuthorityReference;
+    format: TRuntimeLocalVolumeArchiveFormat;
+    byteLength: number;
+    digest: TSha256Digest;
+}
+/**
+ * `receiving` permits sending and confirms nothing more. The stream's acceptance receipt is what
+ * confirms that the node published the volume as `ready`; a rejected or aborted stream leaves the
+ * claim in `import-required` with nothing published.
+ */
+export interface IWriteRuntimeLocalVolumeArchiveResponse {
+    claim: IRuntimeAuthorityReference;
+    status: 'receiving';
+}
+/**
+ * Volume archives are a local controller's alone (`controller.kind: 'onebox'`), on the connection
+ * that holds its session, and a node moves one archive per volume at a time: a read or write of a
+ * volume that is already moving one is refused.
+ */
+export declare const runtimeLocalVolumeArchiveContract: Readonly<{
+    readonly error: "Runtime local volume archive contract rejected.";
+    readonly controllerKind: "onebox";
+    readonly format: "pax";
+    readonly entryKinds: readonly ["directory", "file", "symlink", "hardlink", "fifo"];
+    readonly omittedEntryKinds: readonly ["socket"];
+    readonly ownership: "numeric-uid-gid";
+    readonly blockBytes: 512;
+    /** The shortest archive: the root directory's header and the two closing zero blocks. */
+    readonly minimumArchiveBytes: 1536;
+    readonly concurrency: "one-archive-per-volume";
+}>;
+export declare const snapshotReadRuntimeLocalVolumeArchiveRequest: (valueArg: unknown) => IReadRuntimeLocalVolumeArchiveRequest;
+export declare const snapshotReadRuntimeLocalVolumeArchiveResponse: (valueArg: unknown) => IReadRuntimeLocalVolumeArchiveResponse;
+export declare const snapshotWriteRuntimeLocalVolumeArchiveRequest: (valueArg: unknown) => IWriteRuntimeLocalVolumeArchiveRequest;
+export declare const snapshotWriteRuntimeLocalVolumeArchiveResponse: (valueArg: unknown) => IWriteRuntimeLocalVolumeArchiveResponse;
+/** The exact integrity the write's stream must carry: the request's length and digest. */
+export declare const getRuntimeLocalVolumeArchiveIntegrity: (requestArg: unknown) => plugins.typedrequestInterfaces.IVirtualStreamIntegrity;
+/**
+ * Node-side content binding, not authentication. `claimArg` is the node's current generation of the
+ * named claim and `trustedSessionArg` its CURRENT session, on whose own connection the request must
+ * have arrived. Whether the volume is `ready` and who holds it are the node's ledger checks.
+ */
+export declare const bindReadRuntimeLocalVolumeArchiveRequest: (valueArg: unknown, claimArg: unknown, trustedSessionArg: unknown) => Promise<{
+    request: IReadRuntimeLocalVolumeArchiveRequest;
+    claim: IRuntimeLocalStorageClaim;
+}>;
+/**
+ * As the read binding, and the claim must be an `import` claim. That it still waits in
+ * `import-required` is the node's ledger check.
+ */
+export declare const bindWriteRuntimeLocalVolumeArchiveRequest: (valueArg: unknown, claimArg: unknown, trustedSessionArg: unknown) => Promise<{
+    request: IWriteRuntimeLocalVolumeArchiveRequest;
+    claim: IRuntimeLocalStorageClaim;
+}>;
+export declare const bindReadRuntimeLocalVolumeArchiveResponse: (valueArg: unknown, requestArg: unknown) => IReadRuntimeLocalVolumeArchiveResponse;
+export declare const bindWriteRuntimeLocalVolumeArchiveResponse: (valueArg: unknown, requestArg: unknown) => IWriteRuntimeLocalVolumeArchiveResponse;

package/dist_ts/data/runtimelocalvolumearchive.js

@@ -0,0 +1,111 @@
+import { getRuntimeLocalStorageClaimReference, snapshotRuntimeLocalStorageClaim, validateRuntimeLocalStorageClaim, } from './runtimelocalstorageclaim.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
+import { captureNetwork, networkDigest, networkEqual, networkRecord, networkReference, requireNetwork, } from '../private/networkcontract.js';
+/**
+ * Volume archives are a local controller's alone (`controller.kind: 'onebox'`), on the connection
+ * that holds its session, and a node moves one archive per volume at a time: a read or write of a
+ * volume that is already moving one is refused.
+ */
+export const runtimeLocalVolumeArchiveContract = Object.freeze({
+    error: 'Runtime local volume archive contract rejected.',
+    controllerKind: 'onebox',
+    format: 'pax',
+    entryKinds: ['directory', 'file', 'symlink', 'hardlink', 'fifo'],
+    omittedEntryKinds: ['socket'],
+    ownership: 'numeric-uid-gid',
+    blockBytes: 512,
+    /** The shortest archive: the root directory's header and the two closing zero blocks. */
+    minimumArchiveBytes: 1536,
+    concurrency: 'one-archive-per-volume',
+});
+const fail = () => { throw new Error(runtimeLocalVolumeArchiveContract.error); };
+const safe = (operationArg) => { try {
+    return operationArg();
+}
+catch {
+    return fail();
+} };
+const archiveBytesOf = (valueArg) => {
+    requireNetwork(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+        && valueArg >= runtimeLocalVolumeArchiveContract.minimumArchiveBytes
+        && valueArg % runtimeLocalVolumeArchiveContract.blockBytes === 0);
+    return valueArg;
+};
+export const snapshotReadRuntimeLocalVolumeArchiveRequest = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['session', 'claim']);
+    return { session: snapshotRuntimeSessionBinding(value.session), claim: networkReference(value.claim) };
+});
+export const snapshotReadRuntimeLocalVolumeArchiveResponse = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['claim', 'format', 'holder']);
+    requireNetwork(value.format === 'pax' && (value.holder === 'none' || value.holder === 'stopped'));
+    return { claim: networkReference(value.claim), format: 'pax', holder: value.holder };
+});
+export const snapshotWriteRuntimeLocalVolumeArchiveRequest = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['session', 'claim', 'format', 'byteLength', 'digest']);
+    requireNetwork(value.format === 'pax');
+    return {
+        session: snapshotRuntimeSessionBinding(value.session), claim: networkReference(value.claim), format: 'pax',
+        byteLength: archiveBytesOf(value.byteLength), digest: networkDigest(value.digest),
+    };
+});
+export const snapshotWriteRuntimeLocalVolumeArchiveResponse = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['claim', 'status']);
+    requireNetwork(value.status === 'receiving');
+    return { claim: networkReference(value.claim), status: 'receiving' };
+});
+/** The exact integrity the write's stream must carry: the request's length and digest. */
+export const getRuntimeLocalVolumeArchiveIntegrity = (requestArg) => {
+    const request = snapshotWriteRuntimeLocalVolumeArchiveRequest(requestArg);
+    return { algorithm: 'sha256', byteLength: request.byteLength, digest: request.digest };
+};
+/**
+ * The claim a request names must be the node's current generation of a bound `directory` claim of
+ * the session's controller, cluster, node and runtime namespace, and the session must be a local
+ * controller's current one.
+ */
+const bindClaim = async (requestArg, claimArg, trustedSessionArg) => {
+    const trustedSession = safe(() => snapshotRuntimeSessionBinding(trustedSessionArg));
+    const claim = safe(() => snapshotRuntimeLocalStorageClaim(claimArg));
+    if ((await validateRuntimeLocalStorageClaim(claim)).length)
+        fail();
+    safe(() => requireNetwork(networkEqual(requestArg.session, trustedSession)
+        && trustedSession.controller.kind === runtimeLocalVolumeArchiveContract.controllerKind
+        && networkEqual(requestArg.claim, getRuntimeLocalStorageClaimReference(claim))
+        && claim.lifecycle === 'bound' && claim.source.kind === 'directory'
+        && networkEqual(claim.controller, trustedSession.controller)
+        && claim.clusterId === trustedSession.clusterId
+        && claim.nodeId === trustedSession.nodeId
+        && claim.runtimeNamespace === trustedSession.runtimeNamespace));
+    return claim;
+};
+/**
+ * Node-side content binding, not authentication. `claimArg` is the node's current generation of the
+ * named claim and `trustedSessionArg` its CURRENT session, on whose own connection the request must
+ * have arrived. Whether the volume is `ready` and who holds it are the node's ledger checks.
+ */
+export const bindReadRuntimeLocalVolumeArchiveRequest = async (valueArg, claimArg, trustedSessionArg) => {
+    const request = snapshotReadRuntimeLocalVolumeArchiveRequest(valueArg);
+    return { request, claim: await bindClaim(request, claimArg, trustedSessionArg) };
+};
+/**
+ * As the read binding, and the claim must be an `import` claim. That it still waits in
+ * `import-required` is the node's ledger check.
+ */
+export const bindWriteRuntimeLocalVolumeArchiveRequest = async (valueArg, claimArg, trustedSessionArg) => {
+    const request = snapshotWriteRuntimeLocalVolumeArchiveRequest(valueArg);
+    const claim = await bindClaim(request, claimArg, trustedSessionArg);
+    if (claim.initialization !== 'import')
+        fail();
+    return { request, claim };
+};
+export const bindReadRuntimeLocalVolumeArchiveResponse = (valueArg, requestArg) => safe(() => {
+    const response = snapshotReadRuntimeLocalVolumeArchiveResponse(valueArg);
+    requireNetwork(networkEqual(response.claim, snapshotReadRuntimeLocalVolumeArchiveRequest(requestArg).claim));
+    return response;
+});
+export const bindWriteRuntimeLocalVolumeArchiveResponse = (valueArg, requestArg) => safe(() => {
+    const response = snapshotWriteRuntimeLocalVolumeArchiveResponse(valueArg);
+    requireNetwork(networkEqual(response.claim, snapshotWriteRuntimeLocalVolumeArchiveRequest(requestArg).claim));
+    return response;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWxvY2Fsdm9sdW1lYXJjaGl2ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvcnVudGltZWxvY2Fsdm9sdW1lYXJjaGl2ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFJQSxPQUFPLEVBQ0wsb0NBQW9DLEVBQUUsZ0NBQWdDLEVBQUUsZ0NBQWdDLEdBQ3pHLE1BQU0sK0JBQStCLENBQUM7QUFFdkMsT0FBTyxFQUFFLDZCQUE2QixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDcEUsT0FBTyxFQUNMLGNBQWMsRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxjQUFjLEdBQzdGLE1BQU0sK0JBQStCLENBQUM7QUErRHZDOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzdELEtBQUssRUFBRSxpREFBaUQ7SUFDeEQsY0FBYyxFQUFFLFFBQVE7SUFDeEIsTUFBTSxFQUFFLEtBQUs7SUFDYixVQUFVLEVBQUUsQ0FBQyxXQUFXLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDO0lBQ2hFLGlCQUFpQixFQUFFLENBQUMsUUFBUSxDQUFDO0lBQzdCLFNBQVMsRUFBRSxpQkFBaUI7SUFDNUIsVUFBVSxFQUFFLEdBQUc7SUFDZix5RkFBeUY7SUFDekYsbUJBQW1CLEVBQUUsSUFBSTtJQUN6QixXQUFXLEVBQUUsd0JBQXdCO0NBQzdCLENBQUMsQ0FBQztBQUVaLE1BQU0sSUFBSSxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsaUNBQWlDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDeEYsTUFBTSxJQUFJLEdBQUcsQ0FBSSxZQUFxQixFQUFLLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO0FBQUMsQ0FBQztBQUFDLE1BQU0sQ0FBQztJQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7QUFBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRTFHLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ25ELGNBQWMsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDeEUsUUFBUSxJQUFJLGlDQUFpQyxDQUFDLG1CQUFtQjtXQUNqRSxRQUFRLEdBQUcsaUNBQWlDLENBQUMsVUFBVSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLENBQzFELFFBQWlCLEVBQ3NCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3BELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUM1RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDekcsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3JGLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLEtBQUssSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNsRyxPQUFPLEVBQUUsS0FBSyxFQUFFLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDdkYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDOUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLENBQUM7SUFDdkMsT0FBTztRQUNMLE9BQU8sRUFBRSw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSztRQUMxRyxVQUFVLEVBQUUsY0FBYyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7S0FDbEYsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FDNUQsUUFBaUIsRUFDd0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDdEQsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzNFLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxDQUFDO0lBQzdDLE9BQU8sRUFBRSxLQUFLLEVBQUUsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUN2RSxDQUFDLENBQUMsQ0FBQztBQUVILDBGQUEwRjtBQUMxRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxDQUNuRCxVQUFtQixFQUNxQyxFQUFFO0lBQzFELE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDekYsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sU0FBUyxHQUFHLEtBQUssRUFDckIsVUFBa0YsRUFDbEYsUUFBaUIsRUFBRSxpQkFBMEIsRUFDVCxFQUFFO0lBQ3RDLE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyw2QkFBNkIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7SUFDcEYsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDckUsSUFBSSxDQUFDLE1BQU0sZ0NBQWdDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNO1FBQUUsSUFBSSxFQUFFLENBQUM7SUFDbkUsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLGNBQWMsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxjQUFjLENBQUM7V0FDckUsY0FBYyxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssaUNBQWlDLENBQUMsY0FBYztXQUNuRixZQUFZLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztXQUMzRSxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU8sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxXQUFXO1dBQ2hFLFlBQVksQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLGNBQWMsQ0FBQyxVQUFVLENBQUM7V0FDekQsS0FBSyxDQUFDLFNBQVMsS0FBSyxjQUFjLENBQUMsU0FBUztXQUM1QyxLQUFLLENBQUMsTUFBTSxLQUFLLGNBQWMsQ0FBQyxNQUFNO1dBQ3RDLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxjQUFjLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLEtBQUssRUFDM0QsUUFBaUIsRUFBRSxRQUFpQixFQUFFLGlCQUEwQixFQUMrQixFQUFFO0lBQ2pHLE1BQU0sT0FBTyxHQUFHLDRDQUE0QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZFLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsaUJBQWlCLENBQUMsRUFBRSxDQUFDO0FBQ25GLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLEtBQUssRUFDNUQsUUFBaUIsRUFBRSxRQUFpQixFQUFFLGlCQUEwQixFQUNnQyxFQUFFO0lBQ2xHLE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sS0FBSyxHQUFHLE1BQU0sU0FBUyxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUNwRSxJQUFJLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUTtRQUFFLElBQUksRUFBRSxDQUFDO0lBQzlDLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FDdkQsUUFBaUIsRUFBRSxVQUFtQixFQUNFLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3JELE1BQU0sUUFBUSxHQUFHLDZDQUE2QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pFLGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSw0Q0FBNEMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzdHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FDeEQsUUFBaUIsRUFBRSxVQUFtQixFQUNHLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3RELE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzFFLGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSw2Q0FBNkMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzlHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/user.d.ts

@@ -3,7 +3,12 @@ export interface IToken {
     expiresAt: number;
     assignedRoles: string[];
 }
-export type TServiceDeploymentCapability = 'deployment:preflight' | 'deployment:reserve' | 'deployment:registry-push' | 'deployment:release-read' | 'deployment:promote-image' | 'deployment:adopt-existing' | 'deployment:status' | 'deployment:create-greenfield' | 'deployment:promote-route' | 'deployment:rollback-image' | 'deployment:rollback-route' | 'deployment:retry' | 'deployment:cleanup';
+export type TServiceDeploymentCapability = 'deployment:preflight' | 'deployment:reserve' | 'deployment:registry-push' | 'deployment:release-read' | 'deployment:promote-image' | 'deployment:adopt-existing' | 'deployment:status' | 'deployment:create-greenfield'
+/**
+ * Reserve a greenfield successor whose image Cloudly imports from an attested legacy service,
+ * and have Cloudly import it. Granted on an organization-service-slot grant only.
+ */
+ | 'deployment:import-legacy' | 'deployment:promote-route' | 'deployment:rollback-image' | 'deployment:rollback-route' | 'deployment:retry' | 'deployment:cleanup';
 /**
  * Server-persisted authority for one logical service. These grants are never
  * accepted from the identity payload supplied by a caller; Cloudly reloads

package/dist_ts/data/user.js

@@ -7,6 +7,7 @@ const serviceDeploymentCapabilities = new Set([
     'deployment:adopt-existing',
     'deployment:status',
     'deployment:create-greenfield',
+    'deployment:import-legacy',
     'deployment:promote-route',
     'deployment:rollback-image',
     'deployment:rollback-route',
@@ -54,6 +55,10 @@ export const validateServiceDeploymentGrant = (grantArg) => {
         && capabilities.includes('deployment:adopt-existing')) {
         errors.push('deployment:adopt-existing requires an existing-service grant');
     }
+    if (capabilities && grant.scope !== 'organization-service-slot'
+        && capabilities.includes('deployment:import-legacy')) {
+        errors.push('deployment:import-legacy requires an organization-service-slot grant');
+    }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXNlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvdXNlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUE4Q0EsTUFBTSw2QkFBNkIsR0FBRyxJQUFJLEdBQUcsQ0FBK0I7SUFDMUUsc0JBQXNCO0lBQ3RCLG9CQUFvQjtJQUNwQiwwQkFBMEI7SUFDMUIseUJBQXlCO0lBQ3pCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IsbUJBQW1CO0lBQ25CLDhCQUE4QjtJQUM5QiwwQkFBMEI7SUFDMUIsMkJBQTJCO0lBQzNCLDJCQUEyQjtJQUMzQixrQkFBa0I7SUFDbEIsb0JBQW9CO0NBQ3JCLENBQUMsQ0FBQztBQUVILE1BQU0saUNBQWlDLEdBQUcscUNBQXFDLENBQUM7QUFFaEYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FDNUMsUUFBaUIsRUFDUCxFQUFFO0lBQ1osTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxRQUFRLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN6RSxPQUFPLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsUUFBbUMsQ0FBQztJQUNsRCxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssMkJBQTJCLEVBQUUsQ0FBQztRQUM3RSxNQUFNLENBQUMsSUFBSSxDQUFDLHlFQUF5RSxDQUFDLENBQUM7SUFDekYsQ0FBQztJQUNELElBQUksT0FBTyxLQUFLLENBQUMsY0FBYyxLQUFLLFFBQVE7V0FDdkMsQ0FBQyxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ2xDLENBQUMsaUNBQWlDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzlELE1BQU0sQ0FBQyxJQUFJLENBQUMsa0RBQWtELENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQ3BELENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWTtRQUNwQixDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ2QsSUFBSSxDQUFDLFlBQVk7V0FDWixZQUFZLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkIsWUFBWSxDQUFDLE1BQU0sR0FBRyw2QkFBNkIsQ0FBQyxJQUFJO1dBQ3hELElBQUksR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDLElBQUksS0FBSyxZQUFZLENBQUMsTUFBTTtXQUNsRCxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxDQUN0QyxPQUFPLGFBQWEsS0FBSyxRQUFRO2VBQzlCLENBQUMsNkJBQTZCLENBQUMsR0FBRyxDQUFDLGFBQTZDLENBQUMsQ0FDckYsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLGtGQUFrRixDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksWUFBWSxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssU0FBUztXQUN4QyxZQUFZLENBQUMsUUFBUSxDQUFDLDhCQUE4QixDQUFDLEVBQUUsQ0FBQztRQUMzRCxNQUFNLENBQUMsSUFBSSxDQUFDLGdFQUFnRSxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELElBQUksWUFBWSxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssMkJBQTJCO1dBQzFELENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyw4QkFBOEIsQ0FBQyxFQUFFLENBQUM7UUFDNUQsTUFBTSxDQUFDLElBQUksQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO0lBQ3ZGLENBQUM7SUFDRCxJQUFJLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDeEMsWUFBWSxDQUFDLFFBQVEsQ0FBQywyQkFBMkIsQ0FBQyxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXNlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvdXNlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFtREEsTUFBTSw2QkFBNkIsR0FBRyxJQUFJLEdBQUcsQ0FBK0I7SUFDMUUsc0JBQXNCO0lBQ3RCLG9CQUFvQjtJQUNwQiwwQkFBMEI7SUFDMUIseUJBQXlCO0lBQ3pCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IsbUJBQW1CO0lBQ25CLDhCQUE4QjtJQUM5QiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLDJCQUEyQjtJQUMzQiwyQkFBMkI7SUFDM0Isa0JBQWtCO0lBQ2xCLG9CQUFvQjtDQUNyQixDQUFDLENBQUM7QUFFSCxNQUFNLGlDQUFpQyxHQUFHLHFDQUFxQyxDQUFDO0FBRWhGLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLENBQzVDLFFBQWlCLEVBQ1AsRUFBRTtJQUNaLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDekUsT0FBTyxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDckMsQ0FBQztJQUNELE1BQU0sS0FBSyxHQUFHLFFBQW1DLENBQUM7SUFDbEQsSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLDJCQUEyQixFQUFFLENBQUM7UUFDN0UsTUFBTSxDQUFDLElBQUksQ0FBQyx5RUFBeUUsQ0FBQyxDQUFDO0lBQ3pGLENBQUM7SUFDRCxJQUFJLE9BQU8sS0FBSyxDQUFDLGNBQWMsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsaUNBQWlDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQ25FLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsSUFBSSxPQUFPLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUNsQyxDQUFDLGlDQUFpQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQztRQUNwRCxDQUFDLENBQUMsS0FBSyxDQUFDLFlBQVk7UUFDcEIsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNkLElBQUksQ0FBQyxZQUFZO1dBQ1osWUFBWSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3ZCLFlBQVksQ0FBQyxNQUFNLEdBQUcsNkJBQTZCLENBQUMsSUFBSTtXQUN4RCxJQUFJLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxJQUFJLEtBQUssWUFBWSxDQUFDLE1BQU07V0FDbEQsWUFBWSxDQUFDLElBQUksQ0FBQyxDQUFDLGFBQWEsRUFBRSxFQUFFLENBQUMsQ0FDdEMsT0FBTyxhQUFhLEtBQUssUUFBUTtlQUM5QixDQUFDLDZCQUE2QixDQUFDLEdBQUcsQ0FBQyxhQUE2QyxDQUFDLENBQ3JGLENBQUMsRUFBRSxDQUFDO1FBQ0wsTUFBTSxDQUFDLElBQUksQ0FBQyxrRkFBa0YsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFDRCxJQUFJLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDeEMsWUFBWSxDQUFDLFFBQVEsQ0FBQyw4QkFBOEIsQ0FBQyxFQUFFLENBQUM7UUFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCxJQUFJLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLDJCQUEyQjtXQUMxRCxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsOEJBQThCLENBQUMsRUFBRSxDQUFDO1FBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSxZQUFZLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyxTQUFTO1dBQ3hDLFlBQVksQ0FBQyxRQUFRLENBQUMsMkJBQTJCLENBQUMsRUFBRSxDQUFDO1FBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsOERBQThELENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBQ0QsSUFBSSxZQUFZLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSywyQkFBMkI7V0FDMUQsWUFBWSxDQUFDLFFBQVEsQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLENBQUM7UUFDdkQsTUFBTSxDQUFDLElBQUksQ0FBQyxzRUFBc0UsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/requests/runtimesession.d.ts

@@ -9,6 +9,10 @@ import type * as assignmentSecret from '../runtime.assignmentsecret.js';
 import type * as fleet from '../data/fleetcutover.js';
 import type { IRuntimeStorageClaim } from '../data/runtimestorageclaim.js';
 import type * as localStorage from '../data/runtimelocalstorageclaim.js';
+import type * as logs from '../data/runtimeassignmentlogs.js';
+import type * as stats from '../data/runtimeassignmentstats.js';
+import type * as exec from '../data/runtimeassignmentexec.js';
+import type * as volumeArchive from '../data/runtimelocalvolumearchive.js';
 /** Current-peer, exact-projection authorization; response contains secret keys. */
 export interface IReq_Pallet_Controller_GetRuntimeManagedVpnCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeManagedVpnCredential> {
     method: 'getRuntimeManagedVpnCredential';
@@ -161,6 +165,83 @@ export interface IReq_Pallet_Controller_ReportRuntimeAssignmentTerminalReceipt e
     request: terminal.IReportRuntimeAssignmentTerminalReceiptRequest;
     response: terminal.IReportRuntimeAssignmentTerminalReceiptResponse;
 }
+/**
+ * Pallet pushes one batch of one attempt's captured output over its current session and sends the
+ * next only after this one is acknowledged (`runtimeAssignmentLogContract`). The controller owns
+ * log persistence; the node's capture files are disposable transport artifacts.
+ */
+export interface IReq_Pallet_Controller_ReportRuntimeAssignmentLogs extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportRuntimeAssignmentLogs> {
+    method: 'reportRuntimeAssignmentLogs';
+    request: logs.IReportRuntimeAssignmentLogsRequest;
+    response: logs.IReportRuntimeAssignmentLogsResponse;
+}
+/** Controller read of one resource sample of one attempt, over the node's current session. */
+export interface IReq_Controller_Pallet_ReadRuntimeAssignmentStats extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ReadRuntimeAssignmentStats> {
+    method: 'readRuntimeAssignmentStats';
+    request: stats.IReadRuntimeAssignmentStatsRequest;
+    response: stats.IReadRuntimeAssignmentStatsResponse;
+}
+/**
+ * A local controller runs one command in one running attempt's container
+ * (`runtimeAssignmentExecContract`). The controller sends standard input on `stdin`, or states
+ * `null` for none. The node answers once the process runs: `stdout` carries a `tty` session's
+ * whole output, and `stderr` is `null` exactly for a `tty` session. The streams outlive this
+ * request and end when the process's output ends or the session ends.
+ */
+export interface IReq_Onebox_Pallet_OpenRuntimeAssignmentExec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_OpenRuntimeAssignmentExec> {
+    method: 'openRuntimeAssignmentExec';
+    request: {
+        exec: exec.IOpenRuntimeAssignmentExecRequest;
+        /** Requester sends standard input; the TypedHandler receives the opposite endpoint. */
+        stdin: plugins.typedrequestInterfaces.TVirtualStream<'send'> | null;
+    };
+    response: {
+        exec: exec.IOpenRuntimeAssignmentExecResponse;
+        /** Requester receives output; the TypedHandler returns sender endpoints. */
+        stdout: plugins.typedrequestInterfaces.TVirtualStream<'receive'>;
+        stderr: plugins.typedrequestInterfaces.TVirtualStream<'receive'> | null;
+    };
+}
+/** A local controller resizes the terminal of one `tty` exec session. */
+export interface IReq_Onebox_Pallet_ResizeRuntimeAssignmentExec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_ResizeRuntimeAssignmentExec> {
+    method: 'resizeRuntimeAssignmentExec';
+    request: exec.IResizeRuntimeAssignmentExecRequest;
+    response: exec.IResizeRuntimeAssignmentExecResponse;
+}
+/** A local controller ends one exec session, releases its slot and learns how it ended. */
+export interface IReq_Onebox_Pallet_CloseRuntimeAssignmentExec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_CloseRuntimeAssignmentExec> {
+    method: 'closeRuntimeAssignmentExec';
+    request: exec.ICloseRuntimeAssignmentExecRequest;
+    response: exec.ICloseRuntimeAssignmentExecResponse;
+}
+/**
+ * A local controller reads one node-local volume as a pax archive
+ * (`runtimeLocalVolumeArchiveContract`). The archive arrives on `archive`, which outlives this
+ * request; the node's completion of that stream is the end of the archive.
+ */
+export interface IReq_Onebox_Pallet_ReadRuntimeLocalVolumeArchive extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_ReadRuntimeLocalVolumeArchive> {
+    method: 'readRuntimeLocalVolumeArchive';
+    request: volumeArchive.IReadRuntimeLocalVolumeArchiveRequest;
+    response: {
+        volume: volumeArchive.IReadRuntimeLocalVolumeArchiveResponse;
+        /** Requester receives archive bytes; the TypedHandler returns a sender endpoint. */
+        archive: plugins.typedrequestInterfaces.TVirtualStream<'receive'>;
+    };
+}
+/**
+ * A local controller writes one pax archive as the bytes of an `import` claim waiting in
+ * `import-required`. The stream's integrity is `getRuntimeLocalVolumeArchiveIntegrity(volume)`;
+ * its acceptance receipt confirms that the node published the volume as `ready`.
+ */
+export interface IReq_Onebox_Pallet_WriteRuntimeLocalVolumeArchive extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_WriteRuntimeLocalVolumeArchive> {
+    method: 'writeRuntimeLocalVolumeArchive';
+    request: {
+        volume: volumeArchive.IWriteRuntimeLocalVolumeArchiveRequest;
+        /** Requester sends archive bytes; the TypedHandler receives the opposite endpoint. */
+        archive: plugins.typedrequestInterfaces.TVirtualStream<'send'>;
+    };
+    response: volumeArchive.IWriteRuntimeLocalVolumeArchiveResponse;
+}
 /** Current-peer, exact current assignment authorization; response is secret material. */
 export interface IReq_Pallet_Controller_GetRuntimeRegistryCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeRegistryCredential> {
     method: 'getRuntimeRegistryCredential';

package/dist_ts/requests/service.d.ts

@@ -9,6 +9,7 @@ import type { IImageRelease } from '../data/immutableimage.js';
 import type { IDeploymentPreflightReport, IDeploymentPreflightRequestData } from '../data/deploymentpreflight.js';
 import type { IDeploymentReservationInput, IServiceDeploymentOperation, IServiceDeploymentStatus } from '../data/deploymentoperation.js';
 import type { TSha256Digest } from '../data/immutableimage.js';
+import type { ILegacyServiceRuntimeAttestation } from '../data/deploymentlegacyimport.js';
 import type { IProtocolOffer } from '../protocol.js';
 import type { IServiceRuntimeAssignmentView, IServiceRuntimeSpec, IServiceRuntimeStatus, TServiceRuntimeSpecWritableData } from '../data/serviceruntime.js';
 import type { IServiceDeploymentAdoptionInput, IServiceDeploymentAdoptionImagePromotionInput, IServiceDeploymentAdoptionImagePromotionResult, IServiceDeploymentAdoptionRolloutInput, IServiceDeploymentAdoptionRolloutResult, IServiceDeploymentAdoptionPreflightInput, IServiceDeploymentAdoptionReport, IServiceDeploymentAdoptionResult } from '../data/deploymentadoption.js';
@@ -221,6 +222,56 @@ export interface IRequest_Any_Cloudly_CleanupServiceDeployment extends plugins.t
         operation: IServiceDeploymentOperation;
     };
 }
+/**
+ * Captures durable evidence that a legacy `deployOnPush` service runs exactly the registry root its
+ * tag names: every required replica observed healthy on that one digest, with the root's platform
+ * manifests read from Cloudly's own registry. Administrators only, and only while the legacy
+ * runtime still runs — incomplete evidence is refused, never stored.
+ *
+ * `expectedRuntimeDigest`, when stated, is an assertion the observed digest must equal. Capturing
+ * again for an unchanged digest returns the attestation already stored.
+ */
+export interface IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation> {
+    method: 'captureLegacyServiceRuntimeAttestation';
+    request: {
+        identity: IIdentityCredential;
+        legacyServiceId: string;
+        expectedRuntimeDigest?: TSha256Digest;
+    };
+    response: {
+        attestation: ILegacyServiceRuntimeAttestation;
+    };
+}
+/** Every attestation Cloudly holds for one legacy service, oldest first. Administrators only. */
+export interface IRequest_Any_Cloudly_GetLegacyServiceRuntimeAttestations extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetLegacyServiceRuntimeAttestations> {
+    method: 'getLegacyServiceRuntimeAttestations';
+    request: {
+        identity: IIdentityCredential;
+        legacyServiceId: string;
+    };
+    response: {
+        attestations: ILegacyServiceRuntimeAttestation[];
+    };
+}
+/**
+ * Imports the attested legacy image of a reserved legacy-import operation into the operation's own
+ * repository and release tag. Cloudly does it from its own registry — nothing is pushed — and
+ * records release evidence of source `cloudly-legacy-import`; the operation then continues exactly
+ * like one whose image was pushed. Replaying it after the import returns the recorded release.
+ */
+export interface IRequest_Any_Cloudly_ImportServiceDeploymentLegacyImage extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_ImportServiceDeploymentLegacyImage> {
+    method: 'importServiceDeploymentLegacyImage';
+    request: {
+        identity: IIdentityCredential;
+        serviceId: string;
+        operationId: string;
+        expectedOperationRevision: number;
+    };
+    response: {
+        operation: IServiceDeploymentOperation;
+        release: IImageRelease;
+    };
+}
 export interface IRequest_Any_Cloudly_CreateService extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_CreateService> {
     method: 'createService';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.34.0",
+  "version": "32.36.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -29,7 +29,7 @@
   "devDependencies": {
     "@git.zone/tsbuild": "^5.0.0",
     "@git.zone/tsdoc": "^2.2.2",
-    "@git.zone/tsrun": "^3.0.1",
+    "@git.zone/tsrun": "^3.0.2",
     "@git.zone/tstest": "6.3.2",
     "@types/node": "26.6.2"
   },

package/readme.md

@@ -963,7 +963,10 @@ refusal has one type.
 
 `requests.network.getRuntimeNetworkNodeReadiness { identity, nodeId }` answers
 `data.IRuntimeNetworkNodeReadiness`: `ready: true` with nothing missing, or `ready: false` with at
-least one `TRuntimeNetworkNodeReadinessGap`. The gaps follow the node producer's order: the node
+least one `TRuntimeNetworkNodeReadinessGap`. The first gap is liveness: `node-observation-stale`
+states that no accepted node report newer than `data.clusterNodeObservationFreshnessMs` (180 s, three
+of Spark's default 60 s reporting intervals) shows the node running, with `lastObservedAt` the time
+Cloudly accepted its last report, or `null` when the node's status is not `online`. The remaining gaps follow the node producer's order: the node
 joins the protected authority's egress (`egress-pending`), every egress owner reports current
 protection (`protection-receipts-pending`, naming those `owners`, at least one), a handoff is reserved
 (`handoff-pending`), the router selection carries it (`selection-pending`), the node's acknowledged
@@ -1224,6 +1227,104 @@ only the named Pallet attempt. They do not authorize storage relocation, prove
 whole-host or Docker/Coreflow absence, grant another controller or organization
 authority, or replace independently qualified readiness and routing evidence.
 
+### Runtime Workload Logs, Stats, Exec And Volume Archives
+
+These requests ride on a node's authenticated runtime session (`requests.runtimesession`). Every
+request carries `session`, and the receiver compares it with its own current session and with the
+connection the request arrived on: a serialized session is never authentication. Exec and volume
+archives belong to a controller on the node's own host alone (`controller.kind: 'onebox'`, which
+only a local controller binding carries), because the local socket's root-only permissions are
+what authenticate that controller.
+
+**Logs.** `IReq_Pallet_Controller_ReportRuntimeAssignmentLogs` (`reportRuntimeAssignmentLogs`)
+pushes one `IRuntimeAssignmentLogBatch { assignmentId, attemptId, captureId, sequence, entries,
+final }` from the node to its controller. Logs are the controller's to keep
+(`IRuntimeConfig.logs`); the node's capture files are disposable transport artifacts, so the node
+pushes and the controller persists. The node discards a batch only after the controller
+acknowledged it, and sends the next one only then.
+
+- `entries` are in capture order. A `line` entry `{ stream, timestampNs, text, partial }` is one
+  piece of one line: `text` holds no `\n`, invalid UTF-8 becomes U+FFFD, and a line longer than
+  one entry (`maximumEntryTextBytes`, 64 KiB) travels as pieces that state `partial: true` up to
+  the last. The joined line is at most the config's `logs.maximumLineBytes`.
+- A `lost` entry `{ reason, stream, timestampNs, bytes, lines }` is evidence of output that did not
+  arrive, placed where it was lost: `buffer-overflow` (the node's buffer reached
+  `logs.maximumBufferedBytes` and it dropped the oldest bytes), `line-cut` (the rest of a line
+  beyond `maximumLineBytes`, right after that line's last piece), `capture-restart` and
+  `not-captured` (a container started without capture). The last two cannot know how much was
+  lost and state `bytes` and `lines` as `null`; the others count exactly.
+- `captureId` names one capture of the attempt. `sequence` counts that capture's batches from 1.
+  `final` states that the container is gone and its output drained; only a final batch may be
+  empty. A report is at most 1 024 entries and one mebibyte of canonical JSON, and timestamps are
+  nanoseconds since the Unix epoch as decimal digits.
+
+The answer `{ status, assignmentId, captureId, sequence }` is `accepted`, or `replay` for a batch
+the controller already holds. The controller never refuses a batch for a gap in `sequence`: the
+node only discards what was acknowledged, so a gap is the controller's own loss, which it records.
+`bindReportRuntimeAssignmentLogsRequest(request, assignment, logPolicy, trustedSession)` checks the
+session, that the assignment is this node's and carries the batch's attempt, and every line's
+joined length against the policy. `bindReportRuntimeAssignmentLogsResponse(response, request)`
+binds the acknowledgement to the batch.
+
+**Stats.** `IReq_Controller_Pallet_ReadRuntimeAssignmentStats` (`readRuntimeAssignmentStats`)
+reads one sample of one attempt: `{ session, assignment }` names the exact current revision, and
+the answer is `{ status: 'sampled', assignment, sample }` or `{ status: 'not-running', assignment,
+sample: null }`. An `IRuntimeAssignmentStatsSample` states `timestampNs`, the cumulative
+`cpuUsageCoreNanoseconds` (decimal digits: it outgrows a JSON number; utilisation comes from two
+samples), `memoryWorkingSetBytes`, `memoryLimitBytes` (the limit the node enforces, the config's
+`memoryBytes`), `network { receivedBytes, transmittedBytes }` of the sandbox, or `null`, and
+`writableLayerBytes`, or `null`. Any controller may read stats; a node answers one read per
+assignment at a time. `bindReadRuntimeAssignmentStatsRequest(request, assignment, trustedSession)`
+and `bindReadRuntimeAssignmentStatsResponse(response, request)` bind both sides.
+
+**Exec.** `IReq_Onebox_Pallet_OpenRuntimeAssignmentExec` (`openRuntimeAssignmentExec`) runs one
+command in the container of a `run` assignment's running attempt. The request is `{ exec: { session,
+assignment, command, tty, terminalSize }, stdin }`: `command` is the argument vector the runtime
+executes directly (at most 256 arguments and 64 KiB, no NUL, a non-empty first element),
+`terminalSize { columns, rows }` is stated exactly for `tty`, and `stdin` is a sending
+VirtualStream or `null`, whose end is the process's end of input. The answer `{ exec: { execId,
+assignment, tty, idleTimeoutMs }, stdout, stderr }` returns receiving streams that outlive the
+request; a `tty` session's whole output is on `stdout` and its `stderr` is `null`.
+`resizeRuntimeAssignmentExec` changes a `tty` session's terminal size, and
+`closeRuntimeAssignmentExec` ends a session, releases its slot and answers how it ended: `exited`
+with `exitCode` (128 plus the signal number for a signalled process) or `terminated` with the
+`termination` that ended it first, `closed`, `idle-timeout` or `container-stopped`.
+`runtimeAssignmentExecContract` fixes the bounds: four sessions per node, counting ended ones not
+yet closed, and 15 minutes without a byte in either direction before the node ends one. A session
+also ends with the controller session it was opened under, and its `execId` is gone with it.
+`bindOpenRuntimeAssignmentExecRequest`, `bindResizeRuntimeAssignmentExecRequest` and
+`bindCloseRuntimeAssignmentExecRequest` take the node's trusted session and refuse any controller
+but a local one; the response binders match the answer to its request.
+
+**Volume archives.** A local controller backs up and restores a node-local volume as one POSIX
+pax archive (`runtimeLocalVolumeArchiveContract`). The first entry is the volume root `./`, and
+entries are directories, regular files, symbolic links (stored, never followed), hard links to
+earlier entries and FIFOs, with numeric `uid`/`gid`, exact mode bits and modification times.
+Sockets are omitted; a device node is refused, and extended attributes and ACLs are not carried.
+An archive is a whole number of 512-byte blocks and at least 1 536 bytes. A node moves one archive
+per volume at a time.
+
+- `readRuntimeLocalVolumeArchive` (`IReq_Onebox_Pallet_ReadRuntimeLocalVolumeArchive`):
+  `{ session, claim }` names the node's current generation of a bound `directory` claim. The node
+  refuses while a running container holds the volume. It reads a volume nobody holds, or one whose
+  holder is stopped, which a node never restarts, and grants the volume to no container meanwhile.
+  The answer `{ volume: { claim, format: 'pax', holder }, archive }` streams the archive. It
+  carries no integrity, because the node learns the length and digest only while writing.
+- `writeRuntimeLocalVolumeArchive` (`IReq_Onebox_Pallet_WriteRuntimeLocalVolumeArchive`):
+  `{ volume: { session, claim, format, byteLength, digest }, archive }` writes an archive as the
+  bytes of an `import` claim that waits in `import-required`, the online form of the offline
+  import. The stream's integrity must be `getRuntimeLocalVolumeArchiveIntegrity(volume)`. The node
+  unpacks into a private staging tree and publishes it as the volume only after the whole archive
+  verified. The tree keeps the archive's ownership, as every imported tree does. The answer
+  `{ claim, status: 'receiving' }` permits sending; the stream's acceptance receipt confirms the
+  volume is `ready`, and a rejected or aborted stream publishes nothing.
+
+`bindReadRuntimeLocalVolumeArchiveRequest(request, claim, trustedSession)` and
+`bindWriteRuntimeLocalVolumeArchiveRequest` require a local controller's current session and the
+exact reference of a bound `directory` claim of its controller, cluster, node and runtime
+namespace, an `import` claim for a write. Whether the volume is `ready` or still
+`import-required`, and who holds it, are the node's ledger checks.
+
 ### Cluster Runtime Phase
 
 `data.IClusterRuntime { id, phase, generation, changedAt, changedBy }` records which runtime owns a
@@ -2993,6 +3094,13 @@ The immutable deployment workflow is:
 4. Observe exact rollout and runtime-digest evidence with `getServiceDeploymentStatus`.
 5. For a greenfield service, expose and verify its public route with `promoteServiceDeploymentRoute` only after the immutable rollout succeeds.
 
+A legacy `deployOnPush` service without deployable source moves to a greenfield successor by a legacy import, which replaces step 2:
+
+- While the legacy replicas still run — before its runtime is frozen — an administrator captures the evidence with `captureLegacyServiceRuntimeAttestation` (`requests.service.IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation`). The stored `data.ILegacyServiceRuntimeAttestation` records every required replica healthy on one digest, the registry root the legacy tag names, and that root's platform manifests; `data.validateLegacyServiceRuntimeAttestation` states its rules. Incomplete evidence is refused, never stored, and there is no substitute once the runtime is stopped. `getLegacyServiceRuntimeAttestations` lists what Cloudly holds for a legacy service; both requests are for administrators only.
+- The greenfield reservation, and every preflight of it, names `legacyImport` (`data.ILegacyImageImportReference`: legacy service, attestation, asserted source root digest) instead of `sourceRevision`, `sourceDirty` and release evidence. Refusals are the blockers `LEGACY_IMPORT_ATTESTATION_MISSING`, `LEGACY_IMPORT_SOURCE_MISMATCH` and `LEGACY_IMPORT_PLATFORM_MISMATCH`.
+- Instead of the registry push, the deployer calls `importServiceDeploymentLegacyImage`: Cloudly imports the attested image from its own registry into the reserved tag — an index root as it is, a single platform manifest under a one-descriptor index of the manifest's own family — and records release evidence of source `cloudly-legacy-import` naming the legacy source. Steps 3 to 5 follow unchanged; `selectTrustedImageReleaseEvidence` accepts that evidence only with `evidenceSource: 'cloudly-legacy-import'`.
+- The reservation and the import need the capability `deployment:import-legacy`, which only an organization-service-slot grant can carry.
+
 `data.IDeploymentRouteRequest.proxied` carries provider-specific DNS proxy intent as an optional boolean. New route declarations should set it explicitly; omission remains valid for persisted historical operations and legacy callers.
 
 `data.IServiceDeploymentOperation` is the durable revisioned compare-and-set fence for this workflow. Image promotion requires Cloudly-created trusted evidence that binds the operation, actor, repository, exact tag, root digest, and OCI index media type. The service request group also exposes deployment preflight, exact-digest rollback, retry, and cleanup contracts.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.34.0',
+  version: '32.36.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusternode.ts

@@ -1700,6 +1700,17 @@ export interface ISparkNodeRuntimeInfo {
   lastError?: string;
 }
 
+/**
+ * How long one accepted node report stands as evidence that the node is running.
+ *
+ * Spark reports while its node runtime runs and stops when that runtime stops, so a node whose
+ * last accepted report (`IClusterNode.data.lastHealthCheck`) is older than this is not observed
+ * running. Three reporting intervals at Spark's 60 s default: a pass waits one interval after it
+ * settles, a failed pass waits the same interval, and a pass takes at most the transport's 10 s,
+ * so one failed pass between two accepted ones leaves at most about 151 s without a report.
+ */
+export const clusterNodeObservationFreshnessMs = 180_000;
+
 export interface IClusterNode {
   id: string;
   data: {
@@ -1719,7 +1730,10 @@ export interface IClusterNode {
     nodeType: 'baremetal' | 'vm' | 'container';
     
     /**
-     * Current status of the node
+     * Current status of the node.
+     *
+     * Cloudly answers `offline` for a node whose last accepted report is older than
+     * `clusterNodeObservationFreshnessMs`, whatever the last report stated.
      */
     status: 'initializing' | 'online' | 'offline' | 'maintenance';
     
@@ -1734,7 +1748,8 @@ export interface IClusterNode {
     joinedAt: number;
     
     /**
-     * Last health check timestamp
+     * When Cloudly accepted the node's last report, on Cloudly's clock; the enrollment time while
+     * the node is `initializing` and has not reported yet.
      */
     lastHealthCheck: number;