@serve.zone/interfaces 32.35.0 → 32.36.0

package/changelog.md

@@ -1,5 +1,60 @@
 # Changelog
 
+## 2026-09-29 - 32.36.0
+
+### Features
+
+- A node's controller can now see and reach its workloads. Four contract families ride on the
+  runtime session in `requests.runtimesession`:
+  - `reportRuntimeAssignmentLogs`: Pallet pushes batches of an attempt's captured output. Lines
+    come in `partial` pieces, and `lost` entries evidence `buffer-overflow`, `line-cut`,
+    `capture-restart` and `not-captured` loss. Batches are acknowledged by sequence, so the
+    controller persists logs as `IRuntimeConfig.logs` requires.
+  - `readRuntimeAssignmentStats`: one CPU, memory, network and writable-layer sample of a
+    running attempt.
+  - `openRuntimeAssignmentExec`, `resizeRuntimeAssignmentExec` and `closeRuntimeAssignmentExec`:
+    a command in a running container, with VirtualStream stdin and output, TTY or not. At most
+    four sessions per node, with a 15-minute idle limit.
+  - `readRuntimeLocalVolumeArchive` and `writeRuntimeLocalVolumeArchive`: a node-local volume as
+    a pax archive. A read refuses a volume a running container holds. A write fills an `import`
+    claim that waits in `import-required` and publishes it only after the whole verified archive.
+
+  Exec and volume archives are refused for any controller but a local one (`onebox`). Each family
+  has exact-schema snapshots and request and response binders (`data.runtimeAssignmentLogContract`,
+  `runtimeAssignmentStatsContract`, `runtimeAssignmentExecContract`,
+  `runtimeLocalVolumeArchiveContract`). Until now a controller had no way to read a Pallet
+  workload's output or resources, run a command in it, or back up and restore its volumes, so
+  Onebox could not move its services off Docker.
+- `TDeploymentPreflightWarningCode` gains `PLATFORM_BINDING_READINESS_DEFERRED`: the promote
+  preflight of a held greenfield service that was never promoted may accept an enabled Corestore
+  `database` or `objectstorage` binding that is not `ready` yet, because a held service receives no
+  credential material and its binding can only become ready once promotion releases the hold. The
+  warning records that acceptance; the route preflight still requires the binding `ready`.
+- A legacy `deployOnPush` service without deployable source can move to a greenfield successor that
+  runs the exact image it ran. `data.ILegacyServiceRuntimeAttestation` is an administrator-captured
+  record that every required replica ran healthy on one registry root, with that root's platform
+  manifests (`ILegacyServiceImageSource`, `ILegacyImagePlatformManifest`);
+  `validateLegacyServiceRuntimeAttestation` and `validateLegacyImageImportReference` state the rules.
+  A greenfield reservation and its preflight may name `legacyImport` (`ILegacyImageImportReference`)
+  in place of `sourceRevision`, `sourceDirty` and release evidence
+  (`ILegacyImportServiceDeploymentReservationInput`), and the operation records the same origin.
+  New preflight blockers: `LEGACY_IMPORT_ATTESTATION_MISSING`, `LEGACY_IMPORT_SOURCE_MISMATCH` and
+  `LEGACY_IMPORT_PLATFORM_MISMATCH`. Release evidence may now be Cloudly's import
+  (`IImageReleaseLegacyImportEvidence`, source `cloudly-legacy-import`) beside the registry push
+  (`IImageReleaseRegistryPushEvidence`); `selectTrustedImageReleaseEvidence` takes an optional
+  `evidenceSource`, which defaults to the registry push. The capability `deployment:import-legacy`
+  is valid on organization-service-slot grants only. New requests:
+  `captureLegacyServiceRuntimeAttestation` and `getLegacyServiceRuntimeAttestations` (administrators)
+  and `importServiceDeploymentLegacyImage`. Until now an immutable deployment needed a source
+  revision and a pushed build, so a legacy service whose source was lost could not leave its
+  legacy runtime.
+- Type widening for consumers: `IServiceDeploymentOperation.data.sourceRevision` and
+  `IDeploymentPreflightReport.source.revision` / `.dirty` are now `string | undefined` /
+  `boolean | undefined`, absent exactly when the origin is a legacy import.
+  `IServiceDeploymentOperation.data` is the new `IServiceDeploymentOperationData`, and
+  `IDeploymentPreflightRequestData` and `IImageReleaseTrustedEvidence` are now union type aliases,
+  so they can no longer be extended as interfaces.
+
 ## 2026-09-29 - 32.35.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.35.0',
+    version: '32.36.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/deploymentlegacyimport.d.ts

@@ -0,0 +1,92 @@
+import type { TImmutableContainerPlatform, TOciManifestMediaType, TSha256Digest } from './immutableimage.js';
+/**
+ * Legacy image import: a greenfield deployment whose image is the one a legacy `deployOnPush`
+ * service already runs, instead of one built from a source revision.
+ *
+ * A legacy service without deployable source still has an image in Cloudly's registry and, until
+ * its runtime is frozen, healthy replicas running it. An administrator captures that fact once as
+ * a {@link ILegacyServiceRuntimeAttestation} while the replicas still run. A greenfield successor
+ * reservation names the attestation in `legacyImport` instead of a `sourceRevision`, and Cloudly
+ * then imports the attested image into the successor's own repository and release tag itself:
+ * the bytes never leave the registry and the release records that it was imported, not built.
+ *
+ * Deployment roots are indexes. An attested root that already is an index is imported as it is. A
+ * root that is one platform manifest is imported under an index whose only descriptor is that
+ * manifest, in the manifest's own family — a Docker manifest list around a Docker manifest, an OCI
+ * index around an OCI manifest — so the platform manifest stays byte-identical and its digest is
+ * still the one the legacy runtime ran. The attestation states everything that descriptor needs.
+ */
+/** The media types a legacy image's per-platform manifest can carry. */
+export type TLegacyImagePlatformManifestMediaType = 'application/vnd.oci.image.manifest.v1+json' | 'application/vnd.docker.distribution.manifest.v2+json';
+/** The index media type of the family a platform manifest belongs to. */
+export type TLegacyImageImportIndexMediaType = 'application/vnd.oci.image.index.v1+json' | 'application/vnd.docker.distribution.manifest.list.v2+json';
+/** One platform manifest of a legacy image, as Cloudly read it from its own registry. */
+export interface ILegacyImagePlatformManifest {
+    platform: TImmutableContainerPlatform;
+    manifestDigest: TSha256Digest;
+    manifestMediaType: TLegacyImagePlatformManifestMediaType;
+    /** Exact byte length of the platform manifest, which an index descriptor states. */
+    manifestSize: number;
+    imageConfigDigest: TSha256Digest;
+}
+/** The registry image a legacy service ran, under the mutable tag it was deployed from. */
+export interface ILegacyServiceImageSource {
+    registryHost: string;
+    repository: string;
+    /** The mutable tag the legacy service was deployed from, `latest` included. */
+    tag: string;
+    /** Digest of the root the tag named: a single platform manifest or an index. */
+    rootDigest: TSha256Digest;
+    rootMediaType: TOciManifestMediaType;
+    /**
+     * The runnable Linux platforms the root carries, sorted by platform. A single-manifest root
+     * carries exactly one, whose manifest is the root itself.
+     */
+    platforms: ILegacyImagePlatformManifest[];
+}
+/** One healthy replica of the legacy service, observed running the attested digest. */
+export interface ILegacyServiceRuntimeTaskAttestation {
+    deploymentId: string;
+    nodeName: string;
+    observedDigest: TSha256Digest;
+}
+/**
+ * Durable evidence, captured by an administrator while the legacy runtime still ran, that every
+ * required replica of a legacy service was healthy and ran exactly the registry root it names.
+ *
+ * Cloudly writes one and never changes it. A capture only succeeds on complete evidence, so a
+ * stored attestation is by construction one whose runtime digest is its source root digest.
+ */
+export interface ILegacyServiceRuntimeAttestation {
+    id: string;
+    data: {
+        legacyServiceId: string;
+        organizationId: string;
+        source: ILegacyServiceImageSource;
+        runtime: {
+            requiredReplicaCount: number;
+            healthyReplicaCount: number;
+            runtimeDigest: TSha256Digest;
+            /** Sorted by deploymentId, one per required replica. */
+            tasks: ILegacyServiceRuntimeTaskAttestation[];
+        };
+        capturedByUserId: string;
+        capturedAt: number;
+    };
+}
+/**
+ * What a legacy-import reservation names in place of a source revision: the legacy service, the
+ * attestation Cloudly holds for it, and the root digest the deployer asserts that attestation
+ * carries.
+ */
+export interface ILegacyImageImportReference {
+    legacyServiceId: string;
+    attestationId: string;
+    sourceRootDigest: TSha256Digest;
+}
+/** True when a media type names a single platform manifest rather than an index. */
+export declare const isLegacyImagePlatformManifestMediaType: (valueArg: unknown) => valueArg is TLegacyImagePlatformManifestMediaType;
+/** True when a media type names an index of either family. */
+export declare const isLegacyImageImportIndexMediaType: (valueArg: unknown) => valueArg is TLegacyImageImportIndexMediaType;
+export declare const validateLegacyImageImportReference: (referenceArg: unknown) => string[];
+export declare const validateLegacyServiceRuntimeAttestation: (attestationArg: unknown) => string[];

package/dist_ts/data/deploymentlegacyimport.js

@@ -0,0 +1,237 @@
+import { normalizeSha256Digest } from './immutableimage.js';
+import { hasExactKeys, isPlainRecord } from '../private/dataproperties.js';
+const identifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+/** An OCI tag, the mutable `latest` included: the source tag is whatever the legacy service ran. */
+const ociTagRegex = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
+const registryHostRegex = /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::[0-9]{1,5})?$/;
+const repositoryRegex = /^[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:[._]|__|-+)[a-z0-9]+)*)*$/;
+const maximumManifestSize = 4 * 1024 * 1024;
+const maximumReplicaCount = 64;
+const legacyImagePlatformManifestMediaTypes = [
+    'application/vnd.oci.image.manifest.v1+json',
+    'application/vnd.docker.distribution.manifest.v2+json',
+];
+const legacyImageImportIndexMediaTypes = [
+    'application/vnd.oci.image.index.v1+json',
+    'application/vnd.docker.distribution.manifest.list.v2+json',
+];
+const legacyImagePlatforms = ['linux/amd64', 'linux/arm64'];
+const isIdentifier = (valueArg) => (typeof valueArg === 'string' && identifierRegex.test(valueArg));
+const isCanonicalDigest = (valueArg) => (typeof valueArg === 'string' && normalizeSha256Digest(valueArg) === valueArg);
+const isPositiveSafeInteger = (valueArg, maximumArg) => (typeof valueArg === 'number'
+    && Number.isSafeInteger(valueArg)
+    && valueArg >= 1
+    && valueArg <= maximumArg);
+/** True when a media type names a single platform manifest rather than an index. */
+export const isLegacyImagePlatformManifestMediaType = (valueArg) => (legacyImagePlatformManifestMediaTypes.some((mediaTypeArg) => mediaTypeArg === valueArg));
+/** True when a media type names an index of either family. */
+export const isLegacyImageImportIndexMediaType = (valueArg) => (legacyImageImportIndexMediaTypes.some((mediaTypeArg) => mediaTypeArg === valueArg));
+export const validateLegacyImageImportReference = (referenceArg) => {
+    if (!isPlainRecord(referenceArg))
+        return ['legacyImport must be an object'];
+    const errors = [];
+    if (!hasExactKeys(referenceArg, ['legacyServiceId', 'attestationId', 'sourceRootDigest'])) {
+        errors.push('legacyImport must use its exact schema');
+    }
+    if (!isIdentifier(referenceArg.legacyServiceId)) {
+        errors.push('legacyImport.legacyServiceId must be a bounded canonical identifier');
+    }
+    if (!isIdentifier(referenceArg.attestationId)) {
+        errors.push('legacyImport.attestationId must be a bounded canonical identifier');
+    }
+    if (!isCanonicalDigest(referenceArg.sourceRootDigest)) {
+        errors.push('legacyImport.sourceRootDigest must be a canonical sha256 digest');
+    }
+    return errors;
+};
+const validatePlatformManifest = (manifestArg, indexArg) => {
+    const label = `source.platforms[${indexArg}]`;
+    if (!isPlainRecord(manifestArg))
+        return [`${label} must be an object`];
+    const errors = [];
+    if (!hasExactKeys(manifestArg, [
+        'platform',
+        'manifestDigest',
+        'manifestMediaType',
+        'manifestSize',
+        'imageConfigDigest',
+    ])) {
+        errors.push(`${label} must use its exact schema`);
+    }
+    if (!legacyImagePlatforms.some((platformArg) => platformArg === manifestArg.platform)) {
+        errors.push(`${label}.platform must be linux/amd64 or linux/arm64`);
+    }
+    if (!isCanonicalDigest(manifestArg.manifestDigest)) {
+        errors.push(`${label}.manifestDigest must be a canonical sha256 digest`);
+    }
+    if (!isLegacyImagePlatformManifestMediaType(manifestArg.manifestMediaType)) {
+        errors.push(`${label}.manifestMediaType must name an OCI or Docker image manifest`);
+    }
+    if (!isPositiveSafeInteger(manifestArg.manifestSize, maximumManifestSize)) {
+        errors.push(`${label}.manifestSize must be a positive bounded byte length`);
+    }
+    if (!isCanonicalDigest(manifestArg.imageConfigDigest)) {
+        errors.push(`${label}.imageConfigDigest must be a canonical sha256 digest`);
+    }
+    return errors;
+};
+const validateImageSource = (sourceArg) => {
+    if (!isPlainRecord(sourceArg))
+        return ['source must be an object'];
+    const errors = [];
+    if (!hasExactKeys(sourceArg, [
+        'registryHost',
+        'repository',
+        'tag',
+        'rootDigest',
+        'rootMediaType',
+        'platforms',
+    ])) {
+        errors.push('source must use its exact schema');
+    }
+    if (typeof sourceArg.registryHost !== 'string' || !registryHostRegex.test(sourceArg.registryHost)) {
+        errors.push('source.registryHost must be a canonical registry host');
+    }
+    if (typeof sourceArg.repository !== 'string'
+        || sourceArg.repository.length > 255
+        || !repositoryRegex.test(sourceArg.repository)) {
+        errors.push('source.repository must be a canonical OCI repository name');
+    }
+    if (typeof sourceArg.tag !== 'string' || !ociTagRegex.test(sourceArg.tag)) {
+        errors.push('source.tag must be an OCI tag');
+    }
+    if (!isCanonicalDigest(sourceArg.rootDigest)) {
+        errors.push('source.rootDigest must be a canonical sha256 digest');
+    }
+    const rootIsManifest = isLegacyImagePlatformManifestMediaType(sourceArg.rootMediaType);
+    const rootIsIndex = isLegacyImageImportIndexMediaType(sourceArg.rootMediaType);
+    if (!rootIsManifest && !rootIsIndex) {
+        errors.push('source.rootMediaType must name an OCI or Docker manifest or index');
+    }
+    if (!Array.isArray(sourceArg.platforms)
+        || sourceArg.platforms.length < 1
+        || sourceArg.platforms.length > legacyImagePlatforms.length) {
+        errors.push('source.platforms must carry one or two runnable Linux platforms');
+        return errors;
+    }
+    const platforms = sourceArg.platforms;
+    platforms.forEach((manifestArg, indexArg) => {
+        errors.push(...validatePlatformManifest(manifestArg, indexArg));
+    });
+    const platformNames = platforms.map((manifestArg) => (isPlainRecord(manifestArg) ? manifestArg.platform : undefined));
+    const sortedPlatformNames = legacyImagePlatforms.filter((platformArg) => (platformNames.includes(platformArg)));
+    if (JSON.stringify(platformNames) !== JSON.stringify(sortedPlatformNames)) {
+        errors.push('source.platforms must be unique and sorted by platform');
+    }
+    if (rootIsManifest) {
+        const onlyPlatform = platforms[0];
+        if (platforms.length !== 1
+            || !isPlainRecord(onlyPlatform)
+            || onlyPlatform.manifestDigest !== sourceArg.rootDigest
+            || onlyPlatform.manifestMediaType !== sourceArg.rootMediaType) {
+            errors.push('a single-manifest source root must be its own one platform manifest');
+        }
+    }
+    if (rootIsIndex && platforms.some((manifestArg) => (isPlainRecord(manifestArg) && manifestArg.manifestDigest === sourceArg.rootDigest))) {
+        errors.push('an index source root cannot also be one of its platform manifests');
+    }
+    return errors;
+};
+const validateRuntime = (runtimeArg, rootDigestArg) => {
+    if (!isPlainRecord(runtimeArg))
+        return ['runtime must be an object'];
+    const errors = [];
+    if (!hasExactKeys(runtimeArg, [
+        'requiredReplicaCount',
+        'healthyReplicaCount',
+        'runtimeDigest',
+        'tasks',
+    ])) {
+        errors.push('runtime must use its exact schema');
+    }
+    if (!isPositiveSafeInteger(runtimeArg.requiredReplicaCount, maximumReplicaCount)) {
+        errors.push('runtime.requiredReplicaCount must be a positive bounded replica count');
+    }
+    if (runtimeArg.healthyReplicaCount !== runtimeArg.requiredReplicaCount) {
+        errors.push('runtime.healthyReplicaCount must equal the required replica count');
+    }
+    if (!isCanonicalDigest(runtimeArg.runtimeDigest)) {
+        errors.push('runtime.runtimeDigest must be a canonical sha256 digest');
+    }
+    else if (runtimeArg.runtimeDigest !== rootDigestArg) {
+        errors.push('runtime.runtimeDigest must be the attested source root digest');
+    }
+    if (!Array.isArray(runtimeArg.tasks) || runtimeArg.tasks.length !== runtimeArg.requiredReplicaCount) {
+        errors.push('runtime.tasks must hold exactly one task per required replica');
+        return errors;
+    }
+    const tasks = runtimeArg.tasks;
+    tasks.forEach((taskArg, indexArg) => {
+        const label = `runtime.tasks[${indexArg}]`;
+        if (!isPlainRecord(taskArg)) {
+            errors.push(`${label} must be an object`);
+            return;
+        }
+        if (!hasExactKeys(taskArg, ['deploymentId', 'nodeName', 'observedDigest'])) {
+            errors.push(`${label} must use its exact schema`);
+        }
+        if (!isIdentifier(taskArg.deploymentId)) {
+            errors.push(`${label}.deploymentId must be a bounded canonical identifier`);
+        }
+        if (typeof taskArg.nodeName !== 'string' || !taskArg.nodeName || taskArg.nodeName.length > 253) {
+            errors.push(`${label}.nodeName must be a bounded non-empty name`);
+        }
+        if (taskArg.observedDigest !== runtimeArg.runtimeDigest) {
+            errors.push(`${label}.observedDigest must be the attested runtime digest`);
+        }
+    });
+    const deploymentIds = tasks.map((taskArg) => (isPlainRecord(taskArg) ? taskArg.deploymentId : undefined));
+    const sortedDeploymentIds = deploymentIds
+        .filter((idArg) => typeof idArg === 'string')
+        .sort();
+    if (new Set(deploymentIds).size !== deploymentIds.length
+        || JSON.stringify(deploymentIds) !== JSON.stringify(sortedDeploymentIds)) {
+        errors.push('runtime.tasks must be unique and sorted by deploymentId');
+    }
+    return errors;
+};
+export const validateLegacyServiceRuntimeAttestation = (attestationArg) => {
+    if (!isPlainRecord(attestationArg))
+        return ['attestation must be an object'];
+    const errors = [];
+    if (!hasExactKeys(attestationArg, ['id', 'data'])) {
+        errors.push('attestation must use its exact schema');
+    }
+    if (!isIdentifier(attestationArg.id)) {
+        errors.push('id must be a bounded canonical identifier');
+    }
+    const data = attestationArg.data;
+    if (!isPlainRecord(data))
+        return [...errors, 'data must be an object'];
+    if (!hasExactKeys(data, [
+        'legacyServiceId',
+        'organizationId',
+        'source',
+        'runtime',
+        'capturedByUserId',
+        'capturedAt',
+    ])) {
+        errors.push('data must use its exact schema');
+    }
+    if (!isIdentifier(data.legacyServiceId)) {
+        errors.push('legacyServiceId must be a bounded canonical identifier');
+    }
+    if (!isIdentifier(data.organizationId)) {
+        errors.push('organizationId must be a bounded canonical identifier');
+    }
+    if (!isIdentifier(data.capturedByUserId)) {
+        errors.push('capturedByUserId must be a bounded canonical identifier');
+    }
+    if (!isPositiveSafeInteger(data.capturedAt, Number.MAX_SAFE_INTEGER)) {
+        errors.push('capturedAt must be a positive timestamp');
+    }
+    errors.push(...validateImageSource(data.source));
+    errors.push(...validateRuntime(data.runtime, isPlainRecord(data.source) ? data.source.rootDigest : undefined));
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudGxlZ2FjeWltcG9ydC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudGxlZ2FjeWltcG9ydC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUM1RCxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBbUczRSxNQUFNLGVBQWUsR0FBRyxxQ0FBcUMsQ0FBQztBQUM5RCxvR0FBb0c7QUFDcEcsTUFBTSxXQUFXLEdBQUcscUNBQXFDLENBQUM7QUFDMUQsTUFBTSxpQkFBaUIsR0FBRywwREFBMEQsQ0FBQztBQUNyRixNQUFNLGVBQWUsR0FBRyxxRkFBcUYsQ0FBQztBQUM5RyxNQUFNLG1CQUFtQixHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxDQUFDO0FBQzVDLE1BQU0sbUJBQW1CLEdBQUcsRUFBRSxDQUFDO0FBRS9CLE1BQU0scUNBQXFDLEdBQXFEO0lBQzlGLDRDQUE0QztJQUM1QyxzREFBc0Q7Q0FDdkQsQ0FBQztBQUNGLE1BQU0sZ0NBQWdDLEdBQWdEO0lBQ3BGLHlDQUF5QztJQUN6QywyREFBMkQ7Q0FDNUQsQ0FBQztBQUNGLE1BQU0sb0JBQW9CLEdBQTJDLENBQUMsYUFBYSxFQUFFLGFBQWEsQ0FBQyxDQUFDO0FBRXBHLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQzlELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUMvRCxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FBQyxDQUMxRSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUJBQXFCLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUSxDQUM3RSxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsVUFBa0IsRUFBc0IsRUFBRSxDQUFDLENBQzNGLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDekIsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7T0FDOUIsUUFBUSxJQUFJLENBQUM7T0FDYixRQUFRLElBQUksVUFBVSxDQUMxQixDQUFDO0FBRUYsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQ3BELFFBQWlCLEVBQ2tDLEVBQUUsQ0FBQyxDQUN0RCxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVksS0FBSyxRQUFRLENBQUMsQ0FDeEYsQ0FBQztBQUVGLDhEQUE4RDtBQUM5RCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUMvQyxRQUFpQixFQUM2QixFQUFFLENBQUMsQ0FDakQsZ0NBQWdDLENBQUMsSUFBSSxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyxZQUFZLEtBQUssUUFBUSxDQUFDLENBQ25GLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLFlBQXFCLEVBQVksRUFBRTtJQUNwRixJQUFJLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQztRQUFFLE9BQU8sQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO0lBQzVFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksRUFBRSxDQUFDLGlCQUFpQixFQUFFLGVBQWUsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMxRixNQUFNLENBQUMsSUFBSSxDQUFDLHdDQUF3QyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1FBQzlDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLHdCQUF3QixHQUFHLENBQy9CLFdBQW9CLEVBQ3BCLFFBQWdCLEVBQ04sRUFBRTtJQUNaLE1BQU0sS0FBSyxHQUFHLG9CQUFvQixRQUFRLEdBQUcsQ0FBQztJQUM5QyxJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLEtBQUssb0JBQW9CLENBQUMsQ0FBQztJQUN2RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUU7UUFDN0IsVUFBVTtRQUNWLGdCQUFnQjtRQUNoQixtQkFBbUI7UUFDbkIsY0FBYztRQUNkLG1CQUFtQjtLQUNwQixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLDRCQUE0QixDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUNELElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLFdBQVcsS0FBSyxXQUFXLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN0RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsV0FBVyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDbkQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssbURBQW1ELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHNDQUFzQyxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssOERBQThELENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxZQUFZLEVBQUUsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLHNEQUFzRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO1FBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLHNEQUFzRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxTQUFrQixFQUFZLEVBQUU7SUFDM0QsSUFBSSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUM7UUFBRSxPQUFPLENBQUMsMEJBQTBCLENBQUMsQ0FBQztJQUNuRSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUU7UUFDM0IsY0FBYztRQUNkLFlBQVk7UUFDWixLQUFLO1FBQ0wsWUFBWTtRQUNaLGVBQWU7UUFDZixXQUFXO0tBQ1osQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELElBQUksT0FBTyxTQUFTLENBQUMsWUFBWSxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNsRyxNQUFNLENBQUMsSUFBSSxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksT0FBTyxTQUFTLENBQUMsVUFBVSxLQUFLLFFBQVE7V0FDdkMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUNqQyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLE9BQU8sU0FBUyxDQUFDLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0JBQStCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzdDLE1BQU0sQ0FBQyxJQUFJLENBQUMscURBQXFELENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsc0NBQXNDLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3ZGLE1BQU0sV0FBVyxHQUFHLGlDQUFpQyxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMvRSxJQUFJLENBQUMsY0FBYyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQ2xDLFNBQVMsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDOUIsU0FBUyxDQUFDLFNBQVMsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1FBQy9FLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxTQUFTLENBQUMsU0FBc0IsQ0FBQztJQUNuRCxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsV0FBVyxFQUFFLFFBQVEsRUFBRSxFQUFFO1FBQzFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx3QkFBd0IsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNsRSxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sYUFBYSxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQ25ELGFBQWEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUM5RCxDQUFDLENBQUM7SUFDSCxNQUFNLG1CQUFtQixHQUFHLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FDdkUsYUFBYSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FDcEMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0RBQXdELENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxjQUFjLEVBQUUsQ0FBQztRQUNuQixNQUFNLFlBQVksR0FBRyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbEMsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDckIsQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDO2VBQzVCLFlBQVksQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLFVBQVU7ZUFDcEQsWUFBWSxDQUFDLGlCQUFpQixLQUFLLFNBQVMsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDckYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFdBQVcsSUFBSSxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUNqRCxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsVUFBVSxDQUNsRixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxVQUFtQixFQUFFLGFBQXNCLEVBQVksRUFBRTtJQUNoRixJQUFJLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQztRQUFFLE9BQU8sQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO0lBQ3JFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLFVBQVUsRUFBRTtRQUM1QixzQkFBc0I7UUFDdEIscUJBQXFCO1FBQ3JCLGVBQWU7UUFDZixPQUFPO0tBQ1IsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFtQyxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsb0JBQW9CLEVBQUUsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQ2pGLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsbUJBQW1CLEtBQUssVUFBVSxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7U0FBTSxJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssYUFBYSxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssVUFBVSxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDcEcsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO1FBQzdFLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBa0IsQ0FBQztJQUM1QyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFO1FBQ2xDLE1BQU0sS0FBSyxHQUFHLGlCQUFpQixRQUFRLEdBQUcsQ0FBQztRQUMzQyxJQUFJLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDNUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssb0JBQW9CLENBQUMsQ0FBQztZQUMxQyxPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyw0QkFBNEIsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLHNEQUFzRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7WUFDL0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssNENBQTRDLENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLFVBQVUsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN4RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxxREFBcUQsQ0FBQyxDQUFDO1FBQzdFLENBQUM7SUFDSCxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sYUFBYSxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQzNDLGFBQWEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUMxRCxDQUFDLENBQUM7SUFDSCxNQUFNLG1CQUFtQixHQUFHLGFBQWE7U0FDdEMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFtQixFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDO1NBQzdELElBQUksRUFBRSxDQUFDO0lBQ1YsSUFBSSxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsQ0FBQyxJQUFJLEtBQUssYUFBYSxDQUFDLE1BQU07V0FDbkQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVDQUF1QyxHQUFHLENBQUMsY0FBdUIsRUFBWSxFQUFFO0lBQzNGLElBQUksQ0FBQyxhQUFhLENBQUMsY0FBYyxDQUFDO1FBQUUsT0FBTyxDQUFDLCtCQUErQixDQUFDLENBQUM7SUFDN0UsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxFQUFFLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDckMsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDO0lBQ2pDLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDO1FBQUUsT0FBTyxDQUFDLEdBQUcsTUFBTSxFQUFFLHdCQUF3QixDQUFDLENBQUM7SUFDdkUsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUU7UUFDdEIsaUJBQWlCO1FBQ2pCLGdCQUFnQjtRQUNoQixRQUFRO1FBQ1IsU0FBUztRQUNULGtCQUFrQjtRQUNsQixZQUFZO0tBQ2IsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSxDQUM1QixJQUFJLENBQUMsT0FBTyxFQUNaLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQ2hFLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyJ9

package/dist_ts/data/deploymentoperation.d.ts

@@ -1,6 +1,7 @@
 import type { IDeploymentPreflightProposedConfiguration, IDeploymentPreflightRuntimeTask } from './deploymentpreflight.js';
 import type { IGatewayRouteDnsResult } from './gateway.js';
 import type { IImageRolloutStatus, IImmutableImageDeploymentPlan, TSha256Digest } from './immutableimage.js';
+import type { ILegacyImageImportReference } from './deploymentlegacyimport.js';
 import type { IRegistryTarget } from './registry.js';
 import type { TServiceTargetPortRef } from './serviceports.js';
 export type TDeploymentOperationMode = 'existing-service' | 'greenfield';
@@ -9,24 +10,42 @@ interface IDeploymentReservationInputBase {
     organizationId: string;
     serviceId: string;
     idempotencyKey: string;
-    sourceRevision: string;
     version: string;
     intentDigest: TSha256Digest;
     proposedConfiguration: IDeploymentPreflightProposedConfiguration;
     releaseTag: string;
     routes: IDeploymentRouteRequest[];
 }
-export interface IExistingServiceDeploymentReservationInput extends IDeploymentReservationInputBase {
+/** A deployment whose image its deployer builds and pushes from one source revision. */
+interface ISourceDeploymentOrigin {
+    sourceRevision: string;
+    legacyImport?: never;
+}
+/**
+ * A greenfield deployment whose image Cloudly imports from an attested legacy service instead:
+ * there is no source revision, so none is stated.
+ */
+interface ILegacyImportDeploymentOrigin {
+    legacyImport: ILegacyImageImportReference;
+    sourceRevision?: never;
+}
+export interface IExistingServiceDeploymentReservationInput extends IDeploymentReservationInputBase, ISourceDeploymentOrigin {
     mode: 'existing-service';
     expectedRolloutGeneration: number;
     expectedCurrentRolloutId?: string;
 }
-export interface IGreenfieldServiceDeploymentReservationInput extends IDeploymentReservationInputBase {
+export interface IGreenfieldServiceDeploymentReservationInput extends IDeploymentReservationInputBase, ISourceDeploymentOrigin {
     mode: 'greenfield';
     expectedRolloutGeneration?: never;
     expectedCurrentRolloutId?: never;
 }
-export type IDeploymentReservationInput = IExistingServiceDeploymentReservationInput | IGreenfieldServiceDeploymentReservationInput;
+/** A greenfield successor slot whose image is a legacy service's attested image. */
+export interface ILegacyImportServiceDeploymentReservationInput extends IDeploymentReservationInputBase, ILegacyImportDeploymentOrigin {
+    mode: 'greenfield';
+    expectedRolloutGeneration?: never;
+    expectedCurrentRolloutId?: never;
+}
+export type IDeploymentReservationInput = IExistingServiceDeploymentReservationInput | IGreenfieldServiceDeploymentReservationInput | ILegacyImportServiceDeploymentReservationInput;
 export type TDeploymentOperationState = 'reserving' | 'reserved' | 'provisioning' | 'awaiting-image' | 'image-recorded' | 'promoting-image' | 'rolling-out' | 'ready-for-route' | 'promoting-route' | 'verifying-route' | 'succeeded' | 'rolling-back' | 'rolled-back' | 'failed' | 'cleaning' | 'cleaned';
 export interface IDeploymentRouteRequest {
     hostname: string;
@@ -107,40 +126,46 @@ export interface IDeploymentOperationFailure {
 export interface IServiceDeploymentOperation {
     id: string;
     revision: number;
-    data: {
-        mode: TDeploymentOperationMode;
-        organizationId: string;
-        serviceId: string;
-        actorUserId: string;
-        idempotencyKey: string;
-        requestDigest: TSha256Digest;
-        sourceRevision: string;
-        version: string;
-        intentDigest: TSha256Digest;
-        configurationDigest: TSha256Digest;
-        proposedConfiguration: IDeploymentPreflightProposedConfiguration;
-        namespace: string;
-        registryTarget: IRegistryTarget;
-        releaseTag: string;
-        routes: IDeploymentRouteRequest[];
-        claimKeys: string[];
-        state: TDeploymentOperationState;
-        releaseId?: string;
-        registryRootDigest?: TSha256Digest;
-        rolloutId?: string;
-        rolloutGeneration?: number;
-        routeGeneration?: number;
-        routeVerification?: IDeploymentRouteVerificationEvidence[];
-        /**
-         * Most recent failure record. Set when the operation fails and retained
-         * as audit history through 'cleaning' and 'cleaned'; cleared only by a
-         * forward transition such as a successful retry. A populated failure does
-         * therefore NOT imply state === 'failed'.
-         */
-        failure?: IDeploymentOperationFailure;
-        createdAt: number;
-        updatedAt: number;
-    };
+    data: IServiceDeploymentOperationData;
+}
+/**
+ * An operation's durable state. It states where its image comes from exactly as its reservation
+ * did: a `sourceRevision` for an image its deployer builds, or a `legacyImport` (greenfield only)
+ * for a legacy service's attested image Cloudly imports.
+ */
+export type IServiceDeploymentOperationData = IServiceDeploymentOperationStateData & (ISourceDeploymentOrigin | ILegacyImportDeploymentOrigin);
+interface IServiceDeploymentOperationStateData {
+    mode: TDeploymentOperationMode;
+    organizationId: string;
+    serviceId: string;
+    actorUserId: string;
+    idempotencyKey: string;
+    requestDigest: TSha256Digest;
+    version: string;
+    intentDigest: TSha256Digest;
+    configurationDigest: TSha256Digest;
+    proposedConfiguration: IDeploymentPreflightProposedConfiguration;
+    namespace: string;
+    registryTarget: IRegistryTarget;
+    releaseTag: string;
+    routes: IDeploymentRouteRequest[];
+    claimKeys: string[];
+    state: TDeploymentOperationState;
+    releaseId?: string;
+    registryRootDigest?: TSha256Digest;
+    rolloutId?: string;
+    rolloutGeneration?: number;
+    routeGeneration?: number;
+    routeVerification?: IDeploymentRouteVerificationEvidence[];
+    /**
+     * Most recent failure record. Set when the operation fails and retained
+     * as audit history through 'cleaning' and 'cleaned'; cleared only by a
+     * forward transition such as a successful retry. A populated failure does
+     * therefore NOT imply state === 'failed'.
+     */
+    failure?: IDeploymentOperationFailure;
+    createdAt: number;
+    updatedAt: number;
 }
 export interface IServiceDeploymentStatus {
     operation: IServiceDeploymentOperation;