@serve.zone/interfaces 32.35.0 → 32.36.1

package/dist_ts/data/runtimeassignmentstats.js

@@ -0,0 +1,93 @@
+import { getRuntimeAssignmentReference, snapshotRuntimeAssignment, validateRuntimeAssignment } from './runtimeassignment.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
+import { captureNetwork, networkCounter, networkDigest, networkEqual, networkId, networkRecord, requireNetwork, } from '../private/networkcontract.js';
+export const runtimeAssignmentStatsContract = Object.freeze({
+    error: 'Runtime assignment stats contract rejected.',
+    /** The node answers one read per assignment at a time and refuses a concurrent one. */
+    concurrency: 'one-read-per-assignment',
+});
+const fail = () => { throw new Error(runtimeAssignmentStatsContract.error); };
+const safe = (operationArg) => { try {
+    return operationArg();
+}
+catch {
+    return fail();
+} };
+/** An unsigned 64-bit counter as canonical decimal digits: no sign, no leading zero. */
+const decimalOf = (valueArg) => {
+    requireNetwork(typeof valueArg === 'string' && /^(0|[1-9][0-9]{0,19})$/.test(valueArg)
+        && BigInt(valueArg) <= 18446744073709551615n);
+    return valueArg;
+};
+const bytesOf = (valueArg) => {
+    requireNetwork(typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && valueArg >= 0
+        && !Object.is(valueArg, -0));
+    return valueArg;
+};
+const referenceOf = (valueArg) => {
+    const value = networkRecord(valueArg, ['assignmentId', 'generation', 'digest']);
+    return {
+        assignmentId: networkId(value.assignmentId), generation: networkCounter(value.generation),
+        digest: networkDigest(value.digest),
+    };
+};
+const sampleOf = (valueArg) => {
+    const value = networkRecord(valueArg, ['timestampNs', 'cpuUsageCoreNanoseconds', 'memoryWorkingSetBytes',
+        'memoryLimitBytes', 'network', 'writableLayerBytes']);
+    const timestampNs = decimalOf(value.timestampNs);
+    requireNetwork(timestampNs !== '0');
+    let network = null;
+    if (value.network !== null) {
+        const item = networkRecord(value.network, ['receivedBytes', 'transmittedBytes']);
+        network = { receivedBytes: bytesOf(item.receivedBytes), transmittedBytes: bytesOf(item.transmittedBytes) };
+    }
+    return {
+        timestampNs,
+        cpuUsageCoreNanoseconds: decimalOf(value.cpuUsageCoreNanoseconds),
+        memoryWorkingSetBytes: bytesOf(value.memoryWorkingSetBytes),
+        memoryLimitBytes: networkCounter(value.memoryLimitBytes),
+        network,
+        writableLayerBytes: value.writableLayerBytes === null ? null : bytesOf(value.writableLayerBytes),
+    };
+};
+export const snapshotReadRuntimeAssignmentStatsRequest = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['session', 'assignment']);
+    return { session: snapshotRuntimeSessionBinding(value.session), assignment: referenceOf(value.assignment) };
+});
+export const snapshotReadRuntimeAssignmentStatsResponse = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['status', 'assignment', 'sample']);
+    requireNetwork((value.status === 'sampled' && value.sample !== null)
+        || (value.status === 'not-running' && value.sample === null));
+    return {
+        status: value.status,
+        assignment: referenceOf(value.assignment),
+        sample: value.sample === null ? null : sampleOf(value.sample),
+    };
+});
+/**
+ * Node-side content binding, not authentication. `trustedSessionArg` is the node's CURRENT
+ * session, and the request must have arrived on that session's own connection. `assignmentArg` is
+ * the node's current admitted revision of the named assignment: the request must name exactly it,
+ * and it must belong to the session's controller, node and runtime namespace.
+ */
+export const bindReadRuntimeAssignmentStatsRequest = async (valueArg, assignmentArg, trustedSessionArg) => {
+    const request = snapshotReadRuntimeAssignmentStatsRequest(valueArg);
+    const assignment = safe(() => snapshotRuntimeAssignment(assignmentArg));
+    const trustedSession = safe(() => snapshotRuntimeSessionBinding(trustedSessionArg));
+    if ((await validateRuntimeAssignment(assignment)).length)
+        fail();
+    safe(() => requireNetwork(networkEqual(request.session, trustedSession)
+        && networkEqual(assignment.controller, trustedSession.controller)
+        && assignment.nodeId === trustedSession.nodeId
+        && assignment.runtimeNamespace === trustedSession.runtimeNamespace
+        && networkEqual(request.assignment, getRuntimeAssignmentReference(assignment))));
+    return { request, assignment };
+};
+/** Matches a sample to the exact assignment revision the read named. */
+export const bindReadRuntimeAssignmentStatsResponse = (valueArg, requestArg) => safe(() => {
+    const response = snapshotReadRuntimeAssignmentStatsResponse(valueArg);
+    const request = snapshotReadRuntimeAssignmentStatsRequest(requestArg);
+    requireNetwork(networkEqual(response.assignment, request.assignment));
+    return response;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWFzc2lnbm1lbnRzdGF0cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvcnVudGltZWFzc2lnbm1lbnRzdGF0cy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsNkJBQTZCLEVBQUUseUJBQXlCLEVBQUUseUJBQXlCLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUU3SCxPQUFPLEVBQUUsNkJBQTZCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUNwRSxPQUFPLEVBQ0wsY0FBYyxFQUFFLGNBQWMsRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsY0FBYyxHQUN0RyxNQUFNLCtCQUErQixDQUFDO0FBNkN2QyxNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzFELEtBQUssRUFBRSw2Q0FBNkM7SUFDcEQsdUZBQXVGO0lBQ3ZGLFdBQVcsRUFBRSx5QkFBeUI7Q0FDOUIsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNyRixNQUFNLElBQUksR0FBRyxDQUFJLFlBQXFCLEVBQUssRUFBRSxHQUFHLElBQUksQ0FBQztJQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7QUFBQyxDQUFDO0FBQUMsTUFBTSxDQUFDO0lBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztBQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFMUcsd0ZBQXdGO0FBQ3hGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzlDLGNBQWMsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksd0JBQXdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztXQUNqRixNQUFNLENBQUMsUUFBUSxDQUFDLElBQUkscUJBQTJCLENBQUMsQ0FBQztJQUN0RCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUM1QyxjQUFjLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxJQUFJLENBQUM7V0FDekYsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0IsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxXQUFXLEdBQUcsQ0FBQyxRQUFpQixFQUErQixFQUFFO0lBQ3JFLE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDaEYsT0FBTztRQUNMLFlBQVksRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUN6RixNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7S0FDcEMsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBaUMsRUFBRTtJQUNwRSxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsYUFBYSxFQUFFLHlCQUF5QixFQUFFLHVCQUF1QjtRQUN0RyxrQkFBa0IsRUFBRSxTQUFTLEVBQUUsb0JBQW9CLENBQUMsQ0FBQyxDQUFDO0lBQ3hELE1BQU0sV0FBVyxHQUFHLFNBQVMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDakQsY0FBYyxDQUFDLFdBQVcsS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNwQyxJQUFJLE9BQU8sR0FBMEMsSUFBSSxDQUFDO0lBQzFELElBQUksS0FBSyxDQUFDLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUMzQixNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLGVBQWUsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLENBQUM7UUFDakYsT0FBTyxHQUFHLEVBQUUsYUFBYSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7SUFDN0csQ0FBQztJQUNELE9BQU87UUFDTCxXQUFXO1FBQ1gsdUJBQXVCLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyx1QkFBdUIsQ0FBQztRQUNqRSxxQkFBcUIsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLHFCQUFxQixDQUFDO1FBQzNELGdCQUFnQixFQUFFLGNBQWMsQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUM7UUFDeEQsT0FBTztRQUNQLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxrQkFBa0IsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQztLQUNqRyxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FDdkQsUUFBaUIsRUFDbUIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDakQsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ2pGLE9BQU8sRUFBRSxPQUFPLEVBQUUsNkJBQTZCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDOUcsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUN4RCxRQUFpQixFQUNvQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNsRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzFGLGNBQWMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDO1dBQy9ELENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxhQUFhLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLE9BQU87UUFDTCxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQXVEO1FBQ3JFLFVBQVUsRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQztRQUN6QyxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7S0FDOUQsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxLQUFLLEVBQ3hELFFBQWlCLEVBQUUsYUFBc0IsRUFBRSxpQkFBMEIsRUFDcUIsRUFBRTtJQUM1RixNQUFNLE9BQU8sR0FBRyx5Q0FBeUMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNwRSxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMseUJBQXlCLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUN4RSxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsNkJBQTZCLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLElBQUksQ0FBQyxNQUFNLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsTUFBTTtRQUFFLElBQUksRUFBRSxDQUFDO0lBQ2pFLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxjQUFjLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDO1dBQ2xFLFlBQVksQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLGNBQWMsQ0FBQyxVQUFVLENBQUM7V0FDOUQsVUFBVSxDQUFDLE1BQU0sS0FBSyxjQUFjLENBQUMsTUFBTTtXQUMzQyxVQUFVLENBQUMsZ0JBQWdCLEtBQUssY0FBYyxDQUFDLGdCQUFnQjtXQUMvRCxZQUFZLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSw2QkFBNkIsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNuRixPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBQ2pDLENBQUMsQ0FBQztBQUVGLHdFQUF3RTtBQUN4RSxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxDQUNwRCxRQUFpQixFQUFFLFVBQW1CLEVBQ0QsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDbEQsTUFBTSxRQUFRLEdBQUcsMENBQTBDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDdEUsTUFBTSxPQUFPLEdBQUcseUNBQXlDLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDdEUsY0FBYyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3RFLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/runtimelocalvolumearchive.d.ts

@@ -0,0 +1,103 @@
+import type * as plugins from '../plugins.js';
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeLocalStorageClaim } from './runtimelocalstorageclaim.js';
+import type { IRuntimeSessionBinding } from './runtimesession.js';
+/**
+ * The one archive format a volume travels in: a POSIX.1-2001 pax archive of the volume's tree.
+ *
+ * The first entry is the volume's root, `./`, and every other name is relative below it. An entry is
+ * a directory, a regular file, a symbolic link (stored, never followed), a hard link to an earlier
+ * entry of the same archive, or a FIFO. Ownership is numeric: `uid` and `gid`, never user or group
+ * names, so the tree means the same on every host. Mode bits, including setuid, setgid and sticky,
+ * and the modification time travel exactly. A socket carries no bytes and belongs to the process
+ * that created it, so it is omitted; a device node, extended attributes and ACLs are not part of
+ * the format, and a volume that holds a device node is refused. The archive ends with the format's
+ * two zero blocks, so its length is a whole number of 512-byte blocks.
+ */
+export type TRuntimeLocalVolumeArchiveFormat = 'pax';
+/**
+ * A local controller reads one volume as an archive. The node refuses while a running container
+ * holds the volume: it reads a volume no container holds, or one whose holding container is
+ * stopped, which a node never restarts, and no container is granted the volume while it reads.
+ */
+export interface IReadRuntimeLocalVolumeArchiveRequest {
+    session: IRuntimeSessionBinding;
+    /** The reference of the node's current generation of a bound `directory` claim. */
+    claim: IRuntimeAuthorityReference;
+}
+/**
+ * The archive arrives on the stream the TypedRequest answers beside this body. `holder` states
+ * whether the volume was read unheld or under a stopped holder. The stream carries no integrity:
+ * the node learns the archive's length and digest only while it writes it.
+ */
+export interface IReadRuntimeLocalVolumeArchiveResponse {
+    claim: IRuntimeAuthorityReference;
+    format: TRuntimeLocalVolumeArchiveFormat;
+    holder: 'none' | 'stopped';
+}
+/**
+ * A local controller writes one archive as the bytes of an `import` claim that waits in
+ * `import-required`: the online form of an operator's offline import. The node receives the stream
+ * beside this body, whose integrity must be exactly `byteLength` and `digest`, unpacks it into a
+ * private staging tree, and publishes that tree as the volume only after the whole archive
+ * verified. The tree keeps the ownership the archive carries, as every imported tree does.
+ */
+export interface IWriteRuntimeLocalVolumeArchiveRequest {
+    session: IRuntimeSessionBinding;
+    claim: IRuntimeAuthorityReference;
+    format: TRuntimeLocalVolumeArchiveFormat;
+    byteLength: number;
+    digest: TSha256Digest;
+}
+/**
+ * `receiving` permits sending and confirms nothing more. The stream's acceptance receipt is what
+ * confirms that the node published the volume as `ready`; a rejected or aborted stream leaves the
+ * claim in `import-required` with nothing published.
+ */
+export interface IWriteRuntimeLocalVolumeArchiveResponse {
+    claim: IRuntimeAuthorityReference;
+    status: 'receiving';
+}
+/**
+ * Volume archives are a local controller's alone (`controller.kind: 'onebox'`), on the connection
+ * that holds its session, and a node moves one archive per volume at a time: a read or write of a
+ * volume that is already moving one is refused.
+ */
+export declare const runtimeLocalVolumeArchiveContract: Readonly<{
+    readonly error: "Runtime local volume archive contract rejected.";
+    readonly controllerKind: "onebox";
+    readonly format: "pax";
+    readonly entryKinds: readonly ["directory", "file", "symlink", "hardlink", "fifo"];
+    readonly omittedEntryKinds: readonly ["socket"];
+    readonly ownership: "numeric-uid-gid";
+    readonly blockBytes: 512;
+    /** The shortest archive: the root directory's header and the two closing zero blocks. */
+    readonly minimumArchiveBytes: 1536;
+    readonly concurrency: "one-archive-per-volume";
+}>;
+export declare const snapshotReadRuntimeLocalVolumeArchiveRequest: (valueArg: unknown) => IReadRuntimeLocalVolumeArchiveRequest;
+export declare const snapshotReadRuntimeLocalVolumeArchiveResponse: (valueArg: unknown) => IReadRuntimeLocalVolumeArchiveResponse;
+export declare const snapshotWriteRuntimeLocalVolumeArchiveRequest: (valueArg: unknown) => IWriteRuntimeLocalVolumeArchiveRequest;
+export declare const snapshotWriteRuntimeLocalVolumeArchiveResponse: (valueArg: unknown) => IWriteRuntimeLocalVolumeArchiveResponse;
+/** The exact integrity the write's stream must carry: the request's length and digest. */
+export declare const getRuntimeLocalVolumeArchiveIntegrity: (requestArg: unknown) => plugins.typedrequestInterfaces.IVirtualStreamIntegrity;
+/**
+ * Node-side content binding, not authentication. `claimArg` is the node's current generation of the
+ * named claim and `trustedSessionArg` its CURRENT session, on whose own connection the request must
+ * have arrived. Whether the volume is `ready` and who holds it are the node's ledger checks.
+ */
+export declare const bindReadRuntimeLocalVolumeArchiveRequest: (valueArg: unknown, claimArg: unknown, trustedSessionArg: unknown) => Promise<{
+    request: IReadRuntimeLocalVolumeArchiveRequest;
+    claim: IRuntimeLocalStorageClaim;
+}>;
+/**
+ * As the read binding, and the claim must be an `import` claim. That it still waits in
+ * `import-required` is the node's ledger check.
+ */
+export declare const bindWriteRuntimeLocalVolumeArchiveRequest: (valueArg: unknown, claimArg: unknown, trustedSessionArg: unknown) => Promise<{
+    request: IWriteRuntimeLocalVolumeArchiveRequest;
+    claim: IRuntimeLocalStorageClaim;
+}>;
+export declare const bindReadRuntimeLocalVolumeArchiveResponse: (valueArg: unknown, requestArg: unknown) => IReadRuntimeLocalVolumeArchiveResponse;
+export declare const bindWriteRuntimeLocalVolumeArchiveResponse: (valueArg: unknown, requestArg: unknown) => IWriteRuntimeLocalVolumeArchiveResponse;

package/dist_ts/data/runtimelocalvolumearchive.js

@@ -0,0 +1,111 @@
+import { getRuntimeLocalStorageClaimReference, snapshotRuntimeLocalStorageClaim, validateRuntimeLocalStorageClaim, } from './runtimelocalstorageclaim.js';
+import { snapshotRuntimeSessionBinding } from './runtimesession.js';
+import { captureNetwork, networkDigest, networkEqual, networkRecord, networkReference, requireNetwork, } from '../private/networkcontract.js';
+/**
+ * Volume archives are a local controller's alone (`controller.kind: 'onebox'`), on the connection
+ * that holds its session, and a node moves one archive per volume at a time: a read or write of a
+ * volume that is already moving one is refused.
+ */
+export const runtimeLocalVolumeArchiveContract = Object.freeze({
+    error: 'Runtime local volume archive contract rejected.',
+    controllerKind: 'onebox',
+    format: 'pax',
+    entryKinds: ['directory', 'file', 'symlink', 'hardlink', 'fifo'],
+    omittedEntryKinds: ['socket'],
+    ownership: 'numeric-uid-gid',
+    blockBytes: 512,
+    /** The shortest archive: the root directory's header and the two closing zero blocks. */
+    minimumArchiveBytes: 1536,
+    concurrency: 'one-archive-per-volume',
+});
+const fail = () => { throw new Error(runtimeLocalVolumeArchiveContract.error); };
+const safe = (operationArg) => { try {
+    return operationArg();
+}
+catch {
+    return fail();
+} };
+const archiveBytesOf = (valueArg) => {
+    requireNetwork(typeof valueArg === 'number' && Number.isSafeInteger(valueArg)
+        && valueArg >= runtimeLocalVolumeArchiveContract.minimumArchiveBytes
+        && valueArg % runtimeLocalVolumeArchiveContract.blockBytes === 0);
+    return valueArg;
+};
+export const snapshotReadRuntimeLocalVolumeArchiveRequest = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['session', 'claim']);
+    return { session: snapshotRuntimeSessionBinding(value.session), claim: networkReference(value.claim) };
+});
+export const snapshotReadRuntimeLocalVolumeArchiveResponse = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['claim', 'format', 'holder']);
+    requireNetwork(value.format === 'pax' && (value.holder === 'none' || value.holder === 'stopped'));
+    return { claim: networkReference(value.claim), format: 'pax', holder: value.holder };
+});
+export const snapshotWriteRuntimeLocalVolumeArchiveRequest = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['session', 'claim', 'format', 'byteLength', 'digest']);
+    requireNetwork(value.format === 'pax');
+    return {
+        session: snapshotRuntimeSessionBinding(value.session), claim: networkReference(value.claim), format: 'pax',
+        byteLength: archiveBytesOf(value.byteLength), digest: networkDigest(value.digest),
+    };
+});
+export const snapshotWriteRuntimeLocalVolumeArchiveResponse = (valueArg) => safe(() => {
+    const value = networkRecord(captureNetwork(valueArg), ['claim', 'status']);
+    requireNetwork(value.status === 'receiving');
+    return { claim: networkReference(value.claim), status: 'receiving' };
+});
+/** The exact integrity the write's stream must carry: the request's length and digest. */
+export const getRuntimeLocalVolumeArchiveIntegrity = (requestArg) => {
+    const request = snapshotWriteRuntimeLocalVolumeArchiveRequest(requestArg);
+    return { algorithm: 'sha256', byteLength: request.byteLength, digest: request.digest };
+};
+/**
+ * The claim a request names must be the node's current generation of a bound `directory` claim of
+ * the session's controller, cluster, node and runtime namespace, and the session must be a local
+ * controller's current one.
+ */
+const bindClaim = async (requestArg, claimArg, trustedSessionArg) => {
+    const trustedSession = safe(() => snapshotRuntimeSessionBinding(trustedSessionArg));
+    const claim = safe(() => snapshotRuntimeLocalStorageClaim(claimArg));
+    if ((await validateRuntimeLocalStorageClaim(claim)).length)
+        fail();
+    safe(() => requireNetwork(networkEqual(requestArg.session, trustedSession)
+        && trustedSession.controller.kind === runtimeLocalVolumeArchiveContract.controllerKind
+        && networkEqual(requestArg.claim, getRuntimeLocalStorageClaimReference(claim))
+        && claim.lifecycle === 'bound' && claim.source.kind === 'directory'
+        && networkEqual(claim.controller, trustedSession.controller)
+        && claim.clusterId === trustedSession.clusterId
+        && claim.nodeId === trustedSession.nodeId
+        && claim.runtimeNamespace === trustedSession.runtimeNamespace));
+    return claim;
+};
+/**
+ * Node-side content binding, not authentication. `claimArg` is the node's current generation of the
+ * named claim and `trustedSessionArg` its CURRENT session, on whose own connection the request must
+ * have arrived. Whether the volume is `ready` and who holds it are the node's ledger checks.
+ */
+export const bindReadRuntimeLocalVolumeArchiveRequest = async (valueArg, claimArg, trustedSessionArg) => {
+    const request = snapshotReadRuntimeLocalVolumeArchiveRequest(valueArg);
+    return { request, claim: await bindClaim(request, claimArg, trustedSessionArg) };
+};
+/**
+ * As the read binding, and the claim must be an `import` claim. That it still waits in
+ * `import-required` is the node's ledger check.
+ */
+export const bindWriteRuntimeLocalVolumeArchiveRequest = async (valueArg, claimArg, trustedSessionArg) => {
+    const request = snapshotWriteRuntimeLocalVolumeArchiveRequest(valueArg);
+    const claim = await bindClaim(request, claimArg, trustedSessionArg);
+    if (claim.initialization !== 'import')
+        fail();
+    return { request, claim };
+};
+export const bindReadRuntimeLocalVolumeArchiveResponse = (valueArg, requestArg) => safe(() => {
+    const response = snapshotReadRuntimeLocalVolumeArchiveResponse(valueArg);
+    requireNetwork(networkEqual(response.claim, snapshotReadRuntimeLocalVolumeArchiveRequest(requestArg).claim));
+    return response;
+});
+export const bindWriteRuntimeLocalVolumeArchiveResponse = (valueArg, requestArg) => safe(() => {
+    const response = snapshotWriteRuntimeLocalVolumeArchiveResponse(valueArg);
+    requireNetwork(networkEqual(response.claim, snapshotWriteRuntimeLocalVolumeArchiveRequest(requestArg).claim));
+    return response;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWxvY2Fsdm9sdW1lYXJjaGl2ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvcnVudGltZWxvY2Fsdm9sdW1lYXJjaGl2ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFJQSxPQUFPLEVBQ0wsb0NBQW9DLEVBQUUsZ0NBQWdDLEVBQUUsZ0NBQWdDLEdBQ3pHLE1BQU0sK0JBQStCLENBQUM7QUFFdkMsT0FBTyxFQUFFLDZCQUE2QixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDcEUsT0FBTyxFQUNMLGNBQWMsRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxjQUFjLEdBQzdGLE1BQU0sK0JBQStCLENBQUM7QUErRHZDOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzdELEtBQUssRUFBRSxpREFBaUQ7SUFDeEQsY0FBYyxFQUFFLFFBQVE7SUFDeEIsTUFBTSxFQUFFLEtBQUs7SUFDYixVQUFVLEVBQUUsQ0FBQyxXQUFXLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsTUFBTSxDQUFDO0lBQ2hFLGlCQUFpQixFQUFFLENBQUMsUUFBUSxDQUFDO0lBQzdCLFNBQVMsRUFBRSxpQkFBaUI7SUFDNUIsVUFBVSxFQUFFLEdBQUc7SUFDZix5RkFBeUY7SUFDekYsbUJBQW1CLEVBQUUsSUFBSTtJQUN6QixXQUFXLEVBQUUsd0JBQXdCO0NBQzdCLENBQUMsQ0FBQztBQUVaLE1BQU0sSUFBSSxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsaUNBQWlDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDeEYsTUFBTSxJQUFJLEdBQUcsQ0FBSSxZQUFxQixFQUFLLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO0FBQUMsQ0FBQztBQUFDLE1BQU0sQ0FBQztJQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7QUFBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRTFHLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ25ELGNBQWMsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDeEUsUUFBUSxJQUFJLGlDQUFpQyxDQUFDLG1CQUFtQjtXQUNqRSxRQUFRLEdBQUcsaUNBQWlDLENBQUMsVUFBVSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLENBQzFELFFBQWlCLEVBQ3NCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3BELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUM1RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDekcsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3JGLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLEtBQUssSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssTUFBTSxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNsRyxPQUFPLEVBQUUsS0FBSyxFQUFFLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDdkYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDOUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLENBQUM7SUFDdkMsT0FBTztRQUNMLE9BQU8sRUFBRSw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSztRQUMxRyxVQUFVLEVBQUUsY0FBYyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7S0FDbEYsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FDNUQsUUFBaUIsRUFDd0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDdEQsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzNFLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxDQUFDO0lBQzdDLE9BQU8sRUFBRSxLQUFLLEVBQUUsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUN2RSxDQUFDLENBQUMsQ0FBQztBQUVILDBGQUEwRjtBQUMxRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxDQUNuRCxVQUFtQixFQUNxQyxFQUFFO0lBQzFELE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDekYsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sU0FBUyxHQUFHLEtBQUssRUFDckIsVUFBa0YsRUFDbEYsUUFBaUIsRUFBRSxpQkFBMEIsRUFDVCxFQUFFO0lBQ3RDLE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyw2QkFBNkIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7SUFDcEYsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDckUsSUFBSSxDQUFDLE1BQU0sZ0NBQWdDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNO1FBQUUsSUFBSSxFQUFFLENBQUM7SUFDbkUsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLGNBQWMsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxjQUFjLENBQUM7V0FDckUsY0FBYyxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssaUNBQWlDLENBQUMsY0FBYztXQUNuRixZQUFZLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztXQUMzRSxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU8sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxXQUFXO1dBQ2hFLFlBQVksQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLGNBQWMsQ0FBQyxVQUFVLENBQUM7V0FDekQsS0FBSyxDQUFDLFNBQVMsS0FBSyxjQUFjLENBQUMsU0FBUztXQUM1QyxLQUFLLENBQUMsTUFBTSxLQUFLLGNBQWMsQ0FBQyxNQUFNO1dBQ3RDLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxjQUFjLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLEtBQUssRUFDM0QsUUFBaUIsRUFBRSxRQUFpQixFQUFFLGlCQUEwQixFQUMrQixFQUFFO0lBQ2pHLE1BQU0sT0FBTyxHQUFHLDRDQUE0QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZFLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0sU0FBUyxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsaUJBQWlCLENBQUMsRUFBRSxDQUFDO0FBQ25GLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLEtBQUssRUFDNUQsUUFBaUIsRUFBRSxRQUFpQixFQUFFLGlCQUEwQixFQUNnQyxFQUFFO0lBQ2xHLE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sS0FBSyxHQUFHLE1BQU0sU0FBUyxDQUFDLE9BQU8sRUFBRSxRQUFRLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUNwRSxJQUFJLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUTtRQUFFLElBQUksRUFBRSxDQUFDO0lBQzlDLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FDdkQsUUFBaUIsRUFBRSxVQUFtQixFQUNFLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3JELE1BQU0sUUFBUSxHQUFHLDZDQUE2QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pFLGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSw0Q0FBNEMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzdHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FDeEQsUUFBaUIsRUFBRSxVQUFtQixFQUNHLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3RELE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzFFLGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSw2Q0FBNkMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzlHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/user.d.ts

@@ -3,7 +3,12 @@ export interface IToken {
     expiresAt: number;
     assignedRoles: string[];
 }
-export type TServiceDeploymentCapability = 'deployment:preflight' | 'deployment:reserve' | 'deployment:registry-push' | 'deployment:release-read' | 'deployment:promote-image' | 'deployment:adopt-existing' | 'deployment:status' | 'deployment:create-greenfield' | 'deployment:promote-route' | 'deployment:rollback-image' | 'deployment:rollback-route' | 'deployment:retry' | 'deployment:cleanup';
+export type TServiceDeploymentCapability = 'deployment:preflight' | 'deployment:reserve' | 'deployment:registry-push' | 'deployment:release-read' | 'deployment:promote-image' | 'deployment:adopt-existing' | 'deployment:status' | 'deployment:create-greenfield'
+/**
+ * Reserve a greenfield successor whose image Cloudly imports from an attested legacy service,
+ * and have Cloudly import it. Granted on an organization-service-slot grant only.
+ */
+ | 'deployment:import-legacy' | 'deployment:promote-route' | 'deployment:rollback-image' | 'deployment:rollback-route' | 'deployment:retry' | 'deployment:cleanup';
 /**
  * Server-persisted authority for one logical service. These grants are never
  * accepted from the identity payload supplied by a caller; Cloudly reloads

package/dist_ts/data/user.js

@@ -7,6 +7,7 @@ const serviceDeploymentCapabilities = new Set([
     'deployment:adopt-existing',
     'deployment:status',
     'deployment:create-greenfield',
+    'deployment:import-legacy',
     'deployment:promote-route',
     'deployment:rollback-image',
     'deployment:rollback-route',
@@ -54,6 +55,10 @@ export const validateServiceDeploymentGrant = (grantArg) => {
         && capabilities.includes('deployment:adopt-existing')) {
         errors.push('deployment:adopt-existing requires an existing-service grant');
     }
+    if (capabilities && grant.scope !== 'organization-service-slot'
+        && capabilities.includes('deployment:import-legacy')) {
+        errors.push('deployment:import-legacy requires an organization-service-slot grant');
+    }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXNlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvdXNlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUE4Q0EsTUFBTSw2QkFBNkIsR0FBRyxJQUFJLEdBQUcsQ0FBK0I7SUFDMUUsc0JBQXNCO0lBQ3RCLG9CQUFvQjtJQUNwQiwwQkFBMEI7SUFDMUIseUJBQXlCO0lBQ3pCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IsbUJBQW1CO0lBQ25CLDhCQUE4QjtJQUM5QiwwQkFBMEI7SUFDMUIsMkJBQTJCO0lBQzNCLDJCQUEyQjtJQUMzQixrQkFBa0I7SUFDbEIsb0JBQW9CO0NBQ3JCLENBQUMsQ0FBQztBQUVILE1BQU0saUNBQWlDLEdBQUcscUNBQXFDLENBQUM7QUFFaEYsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsQ0FDNUMsUUFBaUIsRUFDUCxFQUFFO0lBQ1osTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxRQUFRLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN6RSxPQUFPLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUNyQyxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsUUFBbUMsQ0FBQztJQUNsRCxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssMkJBQTJCLEVBQUUsQ0FBQztRQUM3RSxNQUFNLENBQUMsSUFBSSxDQUFDLHlFQUF5RSxDQUFDLENBQUM7SUFDekYsQ0FBQztJQUNELElBQUksT0FBTyxLQUFLLENBQUMsY0FBYyxLQUFLLFFBQVE7V0FDdkMsQ0FBQyxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDbkUsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxJQUFJLE9BQU8sS0FBSyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ2xDLENBQUMsaUNBQWlDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzlELE1BQU0sQ0FBQyxJQUFJLENBQUMsa0RBQWtELENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQ3BELENBQUMsQ0FBQyxLQUFLLENBQUMsWUFBWTtRQUNwQixDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ2QsSUFBSSxDQUFDLFlBQVk7V0FDWixZQUFZLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkIsWUFBWSxDQUFDLE1BQU0sR0FBRyw2QkFBNkIsQ0FBQyxJQUFJO1dBQ3hELElBQUksR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDLElBQUksS0FBSyxZQUFZLENBQUMsTUFBTTtXQUNsRCxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxDQUN0QyxPQUFPLGFBQWEsS0FBSyxRQUFRO2VBQzlCLENBQUMsNkJBQTZCLENBQUMsR0FBRyxDQUFDLGFBQTZDLENBQUMsQ0FDckYsQ0FBQyxFQUFFLENBQUM7UUFDTCxNQUFNLENBQUMsSUFBSSxDQUFDLGtGQUFrRixDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksWUFBWSxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssU0FBUztXQUN4QyxZQUFZLENBQUMsUUFBUSxDQUFDLDhCQUE4QixDQUFDLEVBQUUsQ0FBQztRQUMzRCxNQUFNLENBQUMsSUFBSSxDQUFDLGdFQUFnRSxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELElBQUksWUFBWSxJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssMkJBQTJCO1dBQzFELENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyw4QkFBOEIsQ0FBQyxFQUFFLENBQUM7UUFDNUQsTUFBTSxDQUFDLElBQUksQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO0lBQ3ZGLENBQUM7SUFDRCxJQUFJLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDeEMsWUFBWSxDQUFDLFFBQVEsQ0FBQywyQkFBMkIsQ0FBQyxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXNlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvdXNlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFtREEsTUFBTSw2QkFBNkIsR0FBRyxJQUFJLEdBQUcsQ0FBK0I7SUFDMUUsc0JBQXNCO0lBQ3RCLG9CQUFvQjtJQUNwQiwwQkFBMEI7SUFDMUIseUJBQXlCO0lBQ3pCLDBCQUEwQjtJQUMxQiwyQkFBMkI7SUFDM0IsbUJBQW1CO0lBQ25CLDhCQUE4QjtJQUM5QiwwQkFBMEI7SUFDMUIsMEJBQTBCO0lBQzFCLDJCQUEyQjtJQUMzQiwyQkFBMkI7SUFDM0Isa0JBQWtCO0lBQ2xCLG9CQUFvQjtDQUNyQixDQUFDLENBQUM7QUFFSCxNQUFNLGlDQUFpQyxHQUFHLHFDQUFxQyxDQUFDO0FBRWhGLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLENBQzVDLFFBQWlCLEVBQ1AsRUFBRTtJQUNaLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDekUsT0FBTyxDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDckMsQ0FBQztJQUNELE1BQU0sS0FBSyxHQUFHLFFBQW1DLENBQUM7SUFDbEQsSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLDJCQUEyQixFQUFFLENBQUM7UUFDN0UsTUFBTSxDQUFDLElBQUksQ0FBQyx5RUFBeUUsQ0FBQyxDQUFDO0lBQ3pGLENBQUM7SUFDRCxJQUFJLE9BQU8sS0FBSyxDQUFDLGNBQWMsS0FBSyxRQUFRO1dBQ3ZDLENBQUMsaUNBQWlDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQ25FLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsSUFBSSxPQUFPLEtBQUssQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUNsQyxDQUFDLGlDQUFpQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQztRQUNwRCxDQUFDLENBQUMsS0FBSyxDQUFDLFlBQVk7UUFDcEIsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNkLElBQUksQ0FBQyxZQUFZO1dBQ1osWUFBWSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3ZCLFlBQVksQ0FBQyxNQUFNLEdBQUcsNkJBQTZCLENBQUMsSUFBSTtXQUN4RCxJQUFJLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxJQUFJLEtBQUssWUFBWSxDQUFDLE1BQU07V0FDbEQsWUFBWSxDQUFDLElBQUksQ0FBQyxDQUFDLGFBQWEsRUFBRSxFQUFFLENBQUMsQ0FDdEMsT0FBTyxhQUFhLEtBQUssUUFBUTtlQUM5QixDQUFDLDZCQUE2QixDQUFDLEdBQUcsQ0FBQyxhQUE2QyxDQUFDLENBQ3JGLENBQUMsRUFBRSxDQUFDO1FBQ0wsTUFBTSxDQUFDLElBQUksQ0FBQyxrRkFBa0YsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFDRCxJQUFJLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDeEMsWUFBWSxDQUFDLFFBQVEsQ0FBQyw4QkFBOEIsQ0FBQyxFQUFFLENBQUM7UUFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCxJQUFJLFlBQVksSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLDJCQUEyQjtXQUMxRCxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsOEJBQThCLENBQUMsRUFBRSxDQUFDO1FBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSxZQUFZLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSyxTQUFTO1dBQ3hDLFlBQVksQ0FBQyxRQUFRLENBQUMsMkJBQTJCLENBQUMsRUFBRSxDQUFDO1FBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsOERBQThELENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBQ0QsSUFBSSxZQUFZLElBQUksS0FBSyxDQUFDLEtBQUssS0FBSywyQkFBMkI7V0FDMUQsWUFBWSxDQUFDLFFBQVEsQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLENBQUM7UUFDdkQsTUFBTSxDQUFDLElBQUksQ0FBQyxzRUFBc0UsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/dist_ts/requests/runtimesession.d.ts

@@ -9,6 +9,10 @@ import type * as assignmentSecret from '../runtime.assignmentsecret.js';
 import type * as fleet from '../data/fleetcutover.js';
 import type { IRuntimeStorageClaim } from '../data/runtimestorageclaim.js';
 import type * as localStorage from '../data/runtimelocalstorageclaim.js';
+import type * as logs from '../data/runtimeassignmentlogs.js';
+import type * as stats from '../data/runtimeassignmentstats.js';
+import type * as exec from '../data/runtimeassignmentexec.js';
+import type * as volumeArchive from '../data/runtimelocalvolumearchive.js';
 /** Current-peer, exact-projection authorization; response contains secret keys. */
 export interface IReq_Pallet_Controller_GetRuntimeManagedVpnCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeManagedVpnCredential> {
     method: 'getRuntimeManagedVpnCredential';
@@ -161,6 +165,83 @@ export interface IReq_Pallet_Controller_ReportRuntimeAssignmentTerminalReceipt e
     request: terminal.IReportRuntimeAssignmentTerminalReceiptRequest;
     response: terminal.IReportRuntimeAssignmentTerminalReceiptResponse;
 }
+/**
+ * Pallet pushes one batch of one attempt's captured output over its current session and sends the
+ * next only after this one is acknowledged (`runtimeAssignmentLogContract`). The controller owns
+ * log persistence; the node's capture files are disposable transport artifacts.
+ */
+export interface IReq_Pallet_Controller_ReportRuntimeAssignmentLogs extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportRuntimeAssignmentLogs> {
+    method: 'reportRuntimeAssignmentLogs';
+    request: logs.IReportRuntimeAssignmentLogsRequest;
+    response: logs.IReportRuntimeAssignmentLogsResponse;
+}
+/** Controller read of one resource sample of one attempt, over the node's current session. */
+export interface IReq_Controller_Pallet_ReadRuntimeAssignmentStats extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ReadRuntimeAssignmentStats> {
+    method: 'readRuntimeAssignmentStats';
+    request: stats.IReadRuntimeAssignmentStatsRequest;
+    response: stats.IReadRuntimeAssignmentStatsResponse;
+}
+/**
+ * A local controller runs one command in one running attempt's container
+ * (`runtimeAssignmentExecContract`). The controller sends standard input on `stdin`, or states
+ * `null` for none. The node answers once the process runs: `stdout` carries a `tty` session's
+ * whole output, and `stderr` is `null` exactly for a `tty` session. The streams outlive this
+ * request and end when the process's output ends or the session ends.
+ */
+export interface IReq_Onebox_Pallet_OpenRuntimeAssignmentExec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_OpenRuntimeAssignmentExec> {
+    method: 'openRuntimeAssignmentExec';
+    request: {
+        exec: exec.IOpenRuntimeAssignmentExecRequest;
+        /** Requester sends standard input; the TypedHandler receives the opposite endpoint. */
+        stdin: plugins.typedrequestInterfaces.TVirtualStream<'send'> | null;
+    };
+    response: {
+        exec: exec.IOpenRuntimeAssignmentExecResponse;
+        /** Requester receives output; the TypedHandler returns sender endpoints. */
+        stdout: plugins.typedrequestInterfaces.TVirtualStream<'receive'>;
+        stderr: plugins.typedrequestInterfaces.TVirtualStream<'receive'> | null;
+    };
+}
+/** A local controller resizes the terminal of one `tty` exec session. */
+export interface IReq_Onebox_Pallet_ResizeRuntimeAssignmentExec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_ResizeRuntimeAssignmentExec> {
+    method: 'resizeRuntimeAssignmentExec';
+    request: exec.IResizeRuntimeAssignmentExecRequest;
+    response: exec.IResizeRuntimeAssignmentExecResponse;
+}
+/** A local controller ends one exec session, releases its slot and learns how it ended. */
+export interface IReq_Onebox_Pallet_CloseRuntimeAssignmentExec extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_CloseRuntimeAssignmentExec> {
+    method: 'closeRuntimeAssignmentExec';
+    request: exec.ICloseRuntimeAssignmentExecRequest;
+    response: exec.ICloseRuntimeAssignmentExecResponse;
+}
+/**
+ * A local controller reads one node-local volume as a pax archive
+ * (`runtimeLocalVolumeArchiveContract`). The archive arrives on `archive`, which outlives this
+ * request; the node's completion of that stream is the end of the archive.
+ */
+export interface IReq_Onebox_Pallet_ReadRuntimeLocalVolumeArchive extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_ReadRuntimeLocalVolumeArchive> {
+    method: 'readRuntimeLocalVolumeArchive';
+    request: volumeArchive.IReadRuntimeLocalVolumeArchiveRequest;
+    response: {
+        volume: volumeArchive.IReadRuntimeLocalVolumeArchiveResponse;
+        /** Requester receives archive bytes; the TypedHandler returns a sender endpoint. */
+        archive: plugins.typedrequestInterfaces.TVirtualStream<'receive'>;
+    };
+}
+/**
+ * A local controller writes one pax archive as the bytes of an `import` claim waiting in
+ * `import-required`. The stream's integrity is `getRuntimeLocalVolumeArchiveIntegrity(volume)`;
+ * its acceptance receipt confirms that the node published the volume as `ready`.
+ */
+export interface IReq_Onebox_Pallet_WriteRuntimeLocalVolumeArchive extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_WriteRuntimeLocalVolumeArchive> {
+    method: 'writeRuntimeLocalVolumeArchive';
+    request: {
+        volume: volumeArchive.IWriteRuntimeLocalVolumeArchiveRequest;
+        /** Requester sends archive bytes; the TypedHandler receives the opposite endpoint. */
+        archive: plugins.typedrequestInterfaces.TVirtualStream<'send'>;
+    };
+    response: volumeArchive.IWriteRuntimeLocalVolumeArchiveResponse;
+}
 /** Current-peer, exact current assignment authorization; response is secret material. */
 export interface IReq_Pallet_Controller_GetRuntimeRegistryCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeRegistryCredential> {
     method: 'getRuntimeRegistryCredential';

package/dist_ts/requests/service.d.ts

@@ -9,6 +9,7 @@ import type { IImageRelease } from '../data/immutableimage.js';
 import type { IDeploymentPreflightReport, IDeploymentPreflightRequestData } from '../data/deploymentpreflight.js';
 import type { IDeploymentReservationInput, IServiceDeploymentOperation, IServiceDeploymentStatus } from '../data/deploymentoperation.js';
 import type { TSha256Digest } from '../data/immutableimage.js';
+import type { ILegacyServiceRuntimeAttestation } from '../data/deploymentlegacyimport.js';
 import type { IProtocolOffer } from '../protocol.js';
 import type { IServiceRuntimeAssignmentView, IServiceRuntimeSpec, IServiceRuntimeStatus, TServiceRuntimeSpecWritableData } from '../data/serviceruntime.js';
 import type { IServiceDeploymentAdoptionInput, IServiceDeploymentAdoptionImagePromotionInput, IServiceDeploymentAdoptionImagePromotionResult, IServiceDeploymentAdoptionRolloutInput, IServiceDeploymentAdoptionRolloutResult, IServiceDeploymentAdoptionPreflightInput, IServiceDeploymentAdoptionReport, IServiceDeploymentAdoptionResult } from '../data/deploymentadoption.js';
@@ -221,6 +222,56 @@ export interface IRequest_Any_Cloudly_CleanupServiceDeployment extends plugins.t
         operation: IServiceDeploymentOperation;
     };
 }
+/**
+ * Captures durable evidence that a legacy `deployOnPush` service runs exactly the registry root its
+ * tag names: every required replica observed healthy on that one digest, with the root's platform
+ * manifests read from Cloudly's own registry. Administrators only, and only while the legacy
+ * runtime still runs — incomplete evidence is refused, never stored.
+ *
+ * `expectedRuntimeDigest`, when stated, is an assertion the observed digest must equal. Capturing
+ * again for an unchanged digest returns the attestation already stored.
+ */
+export interface IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation> {
+    method: 'captureLegacyServiceRuntimeAttestation';
+    request: {
+        identity: IIdentityCredential;
+        legacyServiceId: string;
+        expectedRuntimeDigest?: TSha256Digest;
+    };
+    response: {
+        attestation: ILegacyServiceRuntimeAttestation;
+    };
+}
+/** Every attestation Cloudly holds for one legacy service, oldest first. Administrators only. */
+export interface IRequest_Any_Cloudly_GetLegacyServiceRuntimeAttestations extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_GetLegacyServiceRuntimeAttestations> {
+    method: 'getLegacyServiceRuntimeAttestations';
+    request: {
+        identity: IIdentityCredential;
+        legacyServiceId: string;
+    };
+    response: {
+        attestations: ILegacyServiceRuntimeAttestation[];
+    };
+}
+/**
+ * Imports the attested legacy image of a reserved legacy-import operation into the operation's own
+ * repository and release tag. Cloudly does it from its own registry — nothing is pushed — and
+ * records release evidence of source `cloudly-legacy-import`; the operation then continues exactly
+ * like one whose image was pushed. Replaying it after the import returns the recorded release.
+ */
+export interface IRequest_Any_Cloudly_ImportServiceDeploymentLegacyImage extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_ImportServiceDeploymentLegacyImage> {
+    method: 'importServiceDeploymentLegacyImage';
+    request: {
+        identity: IIdentityCredential;
+        serviceId: string;
+        operationId: string;
+        expectedOperationRevision: number;
+    };
+    response: {
+        operation: IServiceDeploymentOperation;
+        release: IImageRelease;
+    };
+}
 export interface IRequest_Any_Cloudly_CreateService extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_CreateService> {
     method: 'createService';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.35.0",
+  "version": "32.36.1",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {