@serve.zone/interfaces 28.2.0 → 28.4.0

package/changelog.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 2026-09-09 - 28.4.0
+
+### Features
+
+- export synchronous runtime assignment snapshot helpers (runtimeassignment)
+  - Expose exact-schema snapshot helpers for runtime assignments and observations.
+  - Use snapshot helpers consistently during validation and evaluation canonicalization.
+  - Add tests for detached copies, exact schema rejection, accessor safety, and digest validation boundaries.
+
+### Fixes
+
+- bump @types/node to 26.4.1 (dev-deps)
+  - Updates Node.js type definitions from 26.4.0 to 26.4.1.
+
+## 2026-09-08 - 28.3.0
+
+### Features
+
+- add human credential administration contracts (admin)
+  - Define getHumanCredential and mutateHumanCredential TypedRequest interfaces for inspecting and mutating human credential metadata.
+  - Support password rotation, password login revocation, and session revocation operations with generation checks and replay handling.
+  - Document human credential administration behavior, session invalidation semantics, and password handling expectations.
+
+### Fixes
+
+- pin @types/node and update pnpm package manager (package)
+  - Pins @types/node at 26.4.0 instead of using a caret range.
+  - Updates packageManager from pnpm 11.25.0 to 12.2.1.
+
 ## 2026-09-06 - 28.2.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '28.2.0',
+    version: '28.4.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/runtimeassignment.d.ts

@@ -90,6 +90,13 @@ export declare const runtimeAssignmentV1Contract: Readonly<{
 /** Digest helpers validate structure and exclude only the object's own digest. */
 export declare const computeRuntimeAssignmentV1Digest: (assignmentArg: IRuntimeAssignmentV1) => Promise<TSha256Digest>;
 export declare const validateRuntimeAssignmentV1: (valueArg: unknown) => Promise<string[]>;
+/**
+ * Synchronous exact-schema validation and detached canonical copy for persistence
+ * assertions. This does not verify the digest, authenticate scope, or admit an
+ * attempt. Use validateRuntimeAssignmentV1/evaluateRuntimeAssignmentV1 before
+ * acceptance or effects.
+ */
+export declare const snapshotRuntimeAssignmentV1: (valueArg: unknown) => IRuntimeAssignmentV1;
 export declare const getRuntimeAssignmentV1Reference: (assignmentArg: IRuntimeAssignmentV1) => IRuntimeAssignmentReferenceV1;
 /**
  * Pure CAS decision, not authentication or execution. The caller must persist
@@ -100,6 +107,12 @@ export declare const getRuntimeAssignmentV1Reference: (assignmentArg: IRuntimeAs
  */
 export declare const evaluateRuntimeAssignmentV1: (incomingArg: IRuntimeAssignmentV1, acceptedArg: IRuntimeAssignmentV1 | null, trustedScopeArg: IRuntimeAssignmentScopeV1) => Promise<TRuntimeAssignmentDecisionV1>;
 export declare const computeRuntimeAssignmentObservationV1Digest: (observationArg: IRuntimeAssignmentObservationV1) => Promise<TSha256Digest>;
+/**
+ * Synchronous exact-schema validation and detached canonical copy. Digest,
+ * assignment and reporter authority still require the observation validator and
+ * evaluator; a structurally valid observation is never a writer fence.
+ */
+export declare const snapshotRuntimeAssignmentObservationV1: (valueArg: unknown) => IRuntimeAssignmentObservationV1;
 /** Checks exact assignment evidence; transport must separately bind reporter/session. */
 export declare const validateRuntimeAssignmentObservationV1: (observationArg: unknown, assignmentArg: IRuntimeAssignmentV1) => Promise<string[]>;
 export type TRuntimeObservationDecisionV1 = {

package/dist_ts/data/runtimeassignment.js

@@ -95,7 +95,7 @@ const digestPayload = async (domainArg, valueArg) => {
 export const computeRuntimeAssignmentV1Digest = async (assignmentArg) => digestPayload(runtimeAssignmentV1Contract.assignmentDigestDomain, assertAssignment(assignmentArg));
 export const validateRuntimeAssignmentV1 = async (valueArg) => {
     try {
-        const assignment = snapshotAssignment(valueArg);
+        const assignment = snapshotRuntimeAssignmentV1(valueArg);
         return assignment.digest === await computeRuntimeAssignmentV1Digest(assignment)
             ? [] : ['runtime assignment digest does not match'];
     }
@@ -103,7 +103,13 @@ export const validateRuntimeAssignmentV1 = async (valueArg) => {
         return ['runtime assignment must use its exact canonical v1 schema'];
     }
 };
-const snapshotAssignment = (valueArg) => JSON.parse(canonicalizeStrictJson(assertAssignment(valueArg), fail));
+/**
+ * Synchronous exact-schema validation and detached canonical copy for persistence
+ * assertions. This does not verify the digest, authenticate scope, or admit an
+ * attempt. Use validateRuntimeAssignmentV1/evaluateRuntimeAssignmentV1 before
+ * acceptance or effects.
+ */
+export const snapshotRuntimeAssignmentV1 = (valueArg) => JSON.parse(canonicalizeStrictJson(assertAssignment(valueArg), fail));
 export const getRuntimeAssignmentV1Reference = (assignmentArg) => ({
     assignmentId: assignmentArg.assignmentId,
     generation: assignmentArg.generation,
@@ -123,8 +129,8 @@ const immutableAttempt = (assignmentArg) => {
  */
 export const evaluateRuntimeAssignmentV1 = async (incomingArg, acceptedArg, trustedScopeArg) => {
     try {
-        incomingArg = snapshotAssignment(incomingArg);
-        acceptedArg = acceptedArg === null ? null : snapshotAssignment(acceptedArg);
+        incomingArg = snapshotRuntimeAssignmentV1(incomingArg);
+        acceptedArg = acceptedArg === null ? null : snapshotRuntimeAssignmentV1(acceptedArg);
         if (!isExactRecord(trustedScopeArg, ['controller', 'organizationId', 'nodeId', 'runtimeNamespace'])
             || !isController(trustedScopeArg.controller)
             || !isIdentifier(trustedScopeArg.organizationId) || !isIdentifier(trustedScopeArg.nodeId)
@@ -201,11 +207,17 @@ const assertObservation = (valueArg) => {
     return valueArg;
 };
 export const computeRuntimeAssignmentObservationV1Digest = async (observationArg) => digestPayload(runtimeAssignmentV1Contract.observationDigestDomain, assertObservation(observationArg));
+/**
+ * Synchronous exact-schema validation and detached canonical copy. Digest,
+ * assignment and reporter authority still require the observation validator and
+ * evaluator; a structurally valid observation is never a writer fence.
+ */
+export const snapshotRuntimeAssignmentObservationV1 = (valueArg) => JSON.parse(canonical(assertObservation(valueArg)));
 /** Checks exact assignment evidence; transport must separately bind reporter/session. */
 export const validateRuntimeAssignmentObservationV1 = async (observationArg, assignmentArg) => {
     try {
-        const observation = JSON.parse(canonical(assertObservation(observationArg)));
-        assignmentArg = snapshotAssignment(assignmentArg);
+        const observation = snapshotRuntimeAssignmentObservationV1(observationArg);
+        assignmentArg = snapshotRuntimeAssignmentV1(assignmentArg);
         if ((await validateRuntimeAssignmentV1(assignmentArg)).length)
             return ['invalid assignment'];
         if (canonical(observation.assignment) !== canonical(getRuntimeAssignmentV1Reference(assignmentArg))) {
@@ -234,10 +246,10 @@ export const validateRuntimeAssignmentObservationV1 = async (observationArg, ass
  */
 export const evaluateRuntimeAssignmentObservationV1 = async (incomingArg, acceptedArg, assignmentArg, trustedReporterSessionIdArg) => {
     try {
-        incomingArg = JSON.parse(canonical(assertObservation(incomingArg)));
+        incomingArg = snapshotRuntimeAssignmentObservationV1(incomingArg);
         acceptedArg = acceptedArg === null ? null
-            : JSON.parse(canonical(assertObservation(acceptedArg)));
-        assignmentArg = snapshotAssignment(assignmentArg);
+            : snapshotRuntimeAssignmentObservationV1(acceptedArg);
+        assignmentArg = snapshotRuntimeAssignmentV1(assignmentArg);
         if (!isIdentifier(trustedReporterSessionIdArg)
             || (await validateRuntimeAssignmentObservationV1(incomingArg, assignmentArg)).length
             || (acceptedArg !== null && (acceptedArg.digest !== await computeRuntimeAssignmentObservationV1Digest(acceptedArg)
@@ -264,4 +276,4 @@ export const evaluateRuntimeAssignmentObservationV1 = async (incomingArg, accept
         return { status: 'reject', reason: 'invalid' };
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWFzc2lnbm1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVhc3NpZ25tZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN0RixPQUFPLEVBQUUsc0JBQXNCLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQTJGbkcsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RCxzQkFBc0IsRUFBRSxrQ0FBa0M7SUFDMUQsdUJBQXVCLEVBQUUsOENBQThDO0lBQ3ZFLHdCQUF3QixFQUFFLEVBQUU7SUFDNUIsUUFBUSxFQUFFLFdBQVc7SUFDckIsT0FBTyxFQUFFLHlDQUF5QztDQUMxQyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBa0MsQ0FBQyxVQUFVLEVBQUUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDN0YsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQzdELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDdkYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDbEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztBQUNqRixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FDaEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUUzRCwrRUFBK0U7QUFDL0UsTUFBTSxhQUFhLEdBQUcsQ0FDcEIsUUFBaUIsRUFDakIsT0FBMEIsRUFDVyxFQUFFO0lBQ3ZDLElBQUksQ0FBQyxRQUFRLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdkYsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsRCxJQUFJLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxJQUFJLFNBQVMsS0FBSyxJQUFJO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdkUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2QyxPQUFPLElBQUksQ0FBQyxNQUFNLEtBQUssT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUU7UUFDN0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNyRSxPQUFPLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztlQUN4RCxVQUFVLEVBQUUsVUFBVSxLQUFLLElBQUksSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM3RSxDQUFDLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBb0MsRUFBRSxDQUMzRSxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQztPQUM3QyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDO09BQzNELFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLElBQUksWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUMvRCxNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBaUIsRUFBNEMsRUFBRSxDQUMzRixhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQztPQUNwRCxZQUFZLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBQ3RHLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxRQUFpQixFQUE2QyxFQUFFLENBQzdGLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDO09BQzlELFlBQVksQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLElBQUksaUJBQWlCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztPQUM3RSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBRS9CLE1BQU0sY0FBYyxHQUFHO0lBQ3JCLGVBQWUsRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLGtCQUFrQjtJQUM3RSxjQUFjLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLFFBQVE7SUFDaEYsWUFBWSxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxRQUFRO0NBQ3RFLENBQUM7QUFFWCxNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBd0IsRUFBRTtJQUNuRSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxjQUFjLENBQUM7V0FDdkMsUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNsRSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3JFLFFBQVEsQ0FBQyxhQUFhLEtBQUsscUJBQXFCO1dBQ2hELENBQUMsQ0FBQyxLQUFLLEVBQUUsZUFBZSxFQUFFLGlDQUFpQyxDQUFDLENBQUMsUUFBUSxDQUN0RSxRQUFRLENBQUMsV0FBcUIsQ0FDL0I7UUFBRSxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUM3RCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLGtCQUFrQixFQUFFLGNBQWM7UUFDL0UsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQUUsSUFBSSxDQUFDLHNCQUFzQixHQUFHLGlDQUFpQyxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUM5QyxJQUFJLFFBQVEsQ0FBQyxHQUFHLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQUUsSUFBSSxDQUFDLDZCQUE2QixDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLEtBQUssSUFBSTtRQUN4RCxDQUFDLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO2VBQ3RDLFFBQVEsQ0FBQyxRQUFRLENBQUMsWUFBWSxLQUFLLFFBQVEsQ0FBQyxZQUFZO2VBQ3hELFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFNLFFBQVEsQ0FBQyxVQUFxQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzVFLElBQUksQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDO0lBQ25DLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsVUFBVTtRQUNuRixRQUFRLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztXQUN4QyxPQUFPLFFBQVEsQ0FBQyxZQUFZLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxZQUFZLENBQUMsTUFBTSxHQUFHLEdBQUc7V0FDL0UsT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQzNFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDL0IsQ0FBQyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQWtCLENBQUM7V0FDckUsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3RDLENBQUMsUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7V0FDdEUsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxDQUFDLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztXQUN0RSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztXQUNoQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRywyQkFBMkIsQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1FBQ3BGLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCwrQkFBK0IsQ0FBQyxRQUFRLENBQUMsWUFBc0IsRUFDN0QsUUFBUSxDQUFDLFVBQW9CLEVBQUUsUUFBUSxDQUFDLFdBQTRCLENBQUMsQ0FBQztJQUN4RSxJQUFJLFVBQVUsR0FBRyxFQUFFLENBQUM7SUFDcEIsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFJLFFBQVEsQ0FBQyxPQUFxQixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzVFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3BGLElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUM7ZUFDakQsQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxFQUFFLElBQUksVUFBVSxFQUFFLENBQUM7WUFDbEYsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELFVBQVUsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztJQUNuQyxDQUFDO0lBQ0Qsc0JBQXNCLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3ZDLE9BQU8sUUFBMkMsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFFRixNQUFNLGFBQWEsR0FBRyxLQUFLLEVBQUUsU0FBaUIsRUFBRSxRQUFtQyxFQUEwQixFQUFFO0lBQzdHLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsUUFBUSxDQUFDO0lBQ2pELE9BQU8sVUFBVSxNQUFNLDRCQUE0QixDQUNqRCxzQkFBc0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUNuRSxFQUFFLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRixrRkFBa0Y7QUFDbEYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUNuRCxhQUFtQyxFQUNYLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLDJCQUEyQixDQUFDLHNCQUFzQixFQUFFLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxDQUNwRixDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUFFLFFBQWlCLEVBQXFCLEVBQUU7SUFDeEYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxVQUFVLEdBQUcsa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDaEQsT0FBTyxVQUFVLENBQUMsTUFBTSxLQUFLLE1BQU0sZ0NBQWdDLENBQUMsVUFBVSxDQUFDO1lBQzdFLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDdkUsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxRQUFpQixFQUF3QixFQUFFLENBQ3JFLElBQUksQ0FBQyxLQUFLLENBQUMsc0JBQXNCLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQXlCLENBQUM7QUFFL0YsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsYUFBbUMsRUFDSixFQUFFLENBQUMsQ0FBQztJQUNuQyxZQUFZLEVBQUUsYUFBYSxDQUFDLFlBQVk7SUFDeEMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVO0lBQ3BDLE1BQU0sRUFBRSxhQUFhLENBQUMsTUFBTTtDQUM3QixDQUFDLENBQUM7QUFFSCxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN4RixNQUFNLGdCQUFnQixHQUFHLENBQUMsYUFBbUMsRUFBVSxFQUFFO0lBQ3ZFLE1BQU0sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRyxhQUFhLENBQUM7SUFDaEYsT0FBTyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxXQUFpQyxFQUNqQyxXQUF3QyxFQUN4QyxlQUEwQyxFQUNILEVBQUU7SUFDekMsSUFBSSxDQUFDO1FBQ0gsV0FBVyxHQUFHLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzlDLFdBQVcsR0FBRyxXQUFXLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzVFLElBQUksQ0FBQyxhQUFhLENBQUMsZUFBZSxFQUFFLENBQUMsWUFBWSxFQUFFLGdCQUFnQixFQUFFLFFBQVEsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO2VBQzlGLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUM7ZUFDekMsQ0FBQyxZQUFZLENBQUMsZUFBZSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUM7ZUFDdEYsQ0FBQyxZQUFZLENBQUMsZUFBZSxDQUFDLGdCQUFnQixDQUFDO1lBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO1FBQ3JHLGVBQWUsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsQ0FBOEIsQ0FBQztJQUN4RixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQ2pELENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLE1BQU07V0FDdEQsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDdkYsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQ2pELENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxDQUFDLGFBQW1DLEVBQVcsRUFBRSxDQUNwRSxhQUFhLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxlQUFlLENBQUMsVUFBVSxDQUFDLElBQUk7V0FDOUQsYUFBYSxDQUFDLFVBQVUsQ0FBQyxFQUFFLEtBQUssZUFBZSxDQUFDLFVBQVUsQ0FBQyxFQUFFO1dBQzdELGFBQWEsQ0FBQyxVQUFVLENBQUMsS0FBSyxLQUFLLGVBQWUsQ0FBQyxVQUFVLENBQUMsS0FBSztXQUNuRSxhQUFhLENBQUMsY0FBYyxLQUFLLGVBQWUsQ0FBQyxjQUFjO1dBQy9ELGFBQWEsQ0FBQyxNQUFNLEtBQUssZUFBZSxDQUFDLE1BQU07V0FDL0MsYUFBYSxDQUFDLGdCQUFnQixLQUFLLGVBQWUsQ0FBQyxnQkFBZ0IsQ0FBQztJQUN6RSxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdkYsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksV0FBVyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3pCLE9BQU8sV0FBVyxDQUFDLFVBQVUsS0FBSyxDQUFDO2VBQzlCLFdBQVcsQ0FBQyxXQUFXLEtBQUssS0FBSztZQUNwQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUU7WUFDL0MsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQztJQUMzRCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsWUFBWSxLQUFLLFdBQVcsQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUMxRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVO1FBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ2xHLElBQUksV0FBVyxDQUFDLFVBQVUsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDdEQsT0FBTyxXQUFXLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxNQUFNO1lBQzlDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRyxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsS0FBSyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3BFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsRUFBRSxDQUFDO0lBQzFELENBQUM7SUFDRCxNQUFNLEtBQUssR0FBb0Q7UUFDN0QsR0FBRyxFQUFFLENBQUMsRUFBRSxlQUFlLEVBQUUsQ0FBQyxFQUFFLGlDQUFpQyxFQUFFLENBQUM7S0FDakUsQ0FBQztJQUNGLElBQUksS0FBSyxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSx3QkFBd0IsRUFBRSxDQUFDO0lBQ2hFLENBQUM7SUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDdkQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQW1DLEVBQUU7SUFDL0UsSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLG1CQUFtQjtRQUM5RSxVQUFVLEVBQUUsWUFBWSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1dBQzlELFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUMzRSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEYsQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztXQUNyRSxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUNuQyxDQUFDLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQWUsQ0FBQyxFQUFFLENBQUM7UUFDM0csSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFO1FBQ2pFLFdBQVcsRUFBRSxhQUFhLEVBQUUsYUFBYTtLQUMxQyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztXQUN6RixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQUUsSUFBSSxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUM7V0FDL0MsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQztXQUMzRCxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNqRSxJQUFJLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BCLE9BQU8sUUFBc0QsQ0FBQztBQUNoRSxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxLQUFLLEVBQzlELGNBQStDLEVBQ3ZCLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLDJCQUEyQixDQUFDLHVCQUF1QixFQUFFLGlCQUFpQixDQUFDLGNBQWMsQ0FBQyxDQUN2RixDQUFDO0FBRUYseUZBQXlGO0FBQ3pGLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLEtBQUssRUFDekQsY0FBdUIsRUFDdkIsYUFBbUMsRUFDaEIsRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFvQyxDQUFDO1FBQ2hILGFBQWEsR0FBRyxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNsRCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLE1BQU07WUFBRSxPQUFPLENBQUMsb0JBQW9CLENBQUMsQ0FBQztRQUM3RixJQUFJLFNBQVMsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLGFBQWEsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNwRyxPQUFPLENBQUMseURBQXlELENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLE1BQU0sMkNBQTJDLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMxRixPQUFPLENBQUMsMkNBQTJDLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsS0FBSyxJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsS0FBSyxLQUFLO2VBQ3hELFdBQVcsQ0FBQyxPQUFPLEVBQUUsV0FBVyxLQUFLLGFBQWEsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUM5RSxPQUFPLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztBQUNILENBQUMsQ0FBQztBQU1GOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQTRDLEVBQzVDLFdBQW1ELEVBQ25ELGFBQW1DLEVBQ25DLDJCQUFtQyxFQUNLLEVBQUU7SUFDMUMsSUFBSSxDQUFDO1FBQ0gsV0FBVyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQW9DLENBQUM7UUFDdkcsV0FBVyxHQUFHLFdBQVcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDdkMsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQW9DLENBQUM7UUFDN0YsYUFBYSxHQUFHLGtCQUFrQixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ2xELElBQUksQ0FBQyxZQUFZLENBQUMsMkJBQTJCLENBQUM7ZUFDekMsQ0FBQyxNQUFNLHNDQUFzQyxDQUFDLFdBQVcsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDLE1BQU07ZUFDakYsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLENBQzFCLFdBQVcsQ0FBQyxNQUFNLEtBQUssTUFBTSwyQ0FBMkMsQ0FBQyxXQUFXLENBQUM7bUJBQ2xGLFdBQVcsQ0FBQyxVQUFVLENBQUMsWUFBWSxLQUFLLGFBQWEsQ0FBQyxZQUFZO21CQUNsRSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLGFBQWEsQ0FBQyxDQUFDO3VCQUM5RixTQUFTLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FDOUUsQ0FBQztZQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUNyRCxJQUFJLFdBQVcsQ0FBQyxpQkFBaUIsS0FBSywyQkFBMkIsRUFBRSxDQUFDO1lBQ2xFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsRUFBRSxDQUFDO1FBQzFELENBQUM7UUFDRCxJQUFJLFdBQVcsS0FBSyxJQUFJLElBQUksV0FBVyxDQUFDLFFBQVEsSUFBSSxXQUFXLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDekUsSUFBSSxXQUFXLENBQUMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxRQUFRO2dCQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUM5RixPQUFPLFdBQVcsQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLE1BQU07Z0JBQzlDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRTtnQkFDaEQsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDL0MsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLFFBQVEsS0FBSyxDQUFDLFdBQVcsRUFBRSxRQUFRLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDOUQsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxDQUFDO1FBQ3RELENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLENBQUM7SUFDeEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWFzc2lnbm1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVhc3NpZ25tZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN0RixPQUFPLEVBQUUsc0JBQXNCLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQTJGbkcsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RCxzQkFBc0IsRUFBRSxrQ0FBa0M7SUFDMUQsdUJBQXVCLEVBQUUsOENBQThDO0lBQ3ZFLHdCQUF3QixFQUFFLEVBQUU7SUFDNUIsUUFBUSxFQUFFLFdBQVc7SUFDckIsT0FBTyxFQUFFLHlDQUF5QztDQUMxQyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBa0MsQ0FBQyxVQUFVLEVBQUUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDN0YsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQzdELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDdkYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDbEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztBQUNqRixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FDaEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUUzRCwrRUFBK0U7QUFDL0UsTUFBTSxhQUFhLEdBQUcsQ0FDcEIsUUFBaUIsRUFDakIsT0FBMEIsRUFDVyxFQUFFO0lBQ3ZDLElBQUksQ0FBQyxRQUFRLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdkYsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNsRCxJQUFJLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxJQUFJLFNBQVMsS0FBSyxJQUFJO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDdkUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2QyxPQUFPLElBQUksQ0FBQyxNQUFNLEtBQUssT0FBTyxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUU7UUFDN0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNyRSxPQUFPLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztlQUN4RCxVQUFVLEVBQUUsVUFBVSxLQUFLLElBQUksSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM3RSxDQUFDLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBb0MsRUFBRSxDQUMzRSxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQztPQUM3QyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDO09BQzNELFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLElBQUksWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUMvRCxNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBaUIsRUFBNEMsRUFBRSxDQUMzRixhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQztPQUNwRCxZQUFZLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBQ3RHLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxRQUFpQixFQUE2QyxFQUFFLENBQzdGLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDO09BQzlELFlBQVksQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLElBQUksaUJBQWlCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztPQUM3RSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO0FBRS9CLE1BQU0sY0FBYyxHQUFHO0lBQ3JCLGVBQWUsRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLGtCQUFrQjtJQUM3RSxjQUFjLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLFFBQVE7SUFDaEYsWUFBWSxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxRQUFRO0NBQ3RFLENBQUM7QUFFWCxNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBd0IsRUFBRTtJQUNuRSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxjQUFjLENBQUM7V0FDdkMsUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNsRSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3JFLFFBQVEsQ0FBQyxhQUFhLEtBQUsscUJBQXFCO1dBQ2hELENBQUMsQ0FBQyxLQUFLLEVBQUUsZUFBZSxFQUFFLGlDQUFpQyxDQUFDLENBQUMsUUFBUSxDQUN0RSxRQUFRLENBQUMsV0FBcUIsQ0FDL0I7UUFBRSxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUM3RCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLGtCQUFrQixFQUFFLGNBQWM7UUFDL0UsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQUUsSUFBSSxDQUFDLHNCQUFzQixHQUFHLGlDQUFpQyxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUM5QyxJQUFJLFFBQVEsQ0FBQyxHQUFHLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQUUsSUFBSSxDQUFDLDZCQUE2QixDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLEtBQUssSUFBSTtRQUN4RCxDQUFDLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO2VBQ3RDLFFBQVEsQ0FBQyxRQUFRLENBQUMsWUFBWSxLQUFLLFFBQVEsQ0FBQyxZQUFZO2VBQ3hELFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFNLFFBQVEsQ0FBQyxVQUFxQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzVFLElBQUksQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDO0lBQ25DLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsVUFBVTtRQUNuRixRQUFRLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztXQUN4QyxPQUFPLFFBQVEsQ0FBQyxZQUFZLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxZQUFZLENBQUMsTUFBTSxHQUFHLEdBQUc7V0FDL0UsT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQzNFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDL0IsQ0FBQyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQWtCLENBQUM7V0FDckUsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3RDLENBQUMsUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7V0FDdEUsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxDQUFDLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztXQUN0RSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztXQUNoQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRywyQkFBMkIsQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1FBQ3BGLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCwrQkFBK0IsQ0FBQyxRQUFRLENBQUMsWUFBc0IsRUFDN0QsUUFBUSxDQUFDLFVBQW9CLEVBQUUsUUFBUSxDQUFDLFdBQTRCLENBQUMsQ0FBQztJQUN4RSxJQUFJLFVBQVUsR0FBRyxFQUFFLENBQUM7SUFDcEIsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFJLFFBQVEsQ0FBQyxPQUFxQixDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQzVFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3BGLElBQUksQ0FBQyxVQUFVLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUM7ZUFDakQsQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxFQUFFLElBQUksVUFBVSxFQUFFLENBQUM7WUFDbEYsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELFVBQVUsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztJQUNuQyxDQUFDO0lBQ0Qsc0JBQXNCLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ3ZDLE9BQU8sUUFBMkMsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFFRixNQUFNLGFBQWEsR0FBRyxLQUFLLEVBQUUsU0FBaUIsRUFBRSxRQUFtQyxFQUEwQixFQUFFO0lBQzdHLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsUUFBUSxDQUFDO0lBQ2pELE9BQU8sVUFBVSxNQUFNLDRCQUE0QixDQUNqRCxzQkFBc0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUNuRSxFQUFFLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRixrRkFBa0Y7QUFDbEYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUNuRCxhQUFtQyxFQUNYLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLDJCQUEyQixDQUFDLHNCQUFzQixFQUFFLGdCQUFnQixDQUFDLGFBQWEsQ0FBQyxDQUNwRixDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUFFLFFBQWlCLEVBQXFCLEVBQUU7SUFDeEYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxVQUFVLEdBQUcsMkJBQTJCLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDekQsT0FBTyxVQUFVLENBQUMsTUFBTSxLQUFLLE1BQU0sZ0NBQWdDLENBQUMsVUFBVSxDQUFDO1lBQzdFLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDdkUsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsQ0FBQyxRQUFpQixFQUF3QixFQUFFLENBQ3JGLElBQUksQ0FBQyxLQUFLLENBQUMsc0JBQXNCLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQXlCLENBQUM7QUFFL0YsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FDN0MsYUFBbUMsRUFDSixFQUFFLENBQUMsQ0FBQztJQUNuQyxZQUFZLEVBQUUsYUFBYSxDQUFDLFlBQVk7SUFDeEMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVO0lBQ3BDLE1BQU0sRUFBRSxhQUFhLENBQUMsTUFBTTtDQUM3QixDQUFDLENBQUM7QUFFSCxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN4RixNQUFNLGdCQUFnQixHQUFHLENBQUMsYUFBbUMsRUFBVSxFQUFFO0lBQ3ZFLE1BQU0sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRyxhQUFhLENBQUM7SUFDaEYsT0FBTyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxFQUM5QyxXQUFpQyxFQUNqQyxXQUF3QyxFQUN4QyxlQUEwQyxFQUNILEVBQUU7SUFDekMsSUFBSSxDQUFDO1FBQ0gsV0FBVyxHQUFHLDJCQUEyQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3ZELFdBQVcsR0FBRyxXQUFXLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLDJCQUEyQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3JGLElBQUksQ0FBQyxhQUFhLENBQUMsZUFBZSxFQUFFLENBQUMsWUFBWSxFQUFFLGdCQUFnQixFQUFFLFFBQVEsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO2VBQzlGLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUM7ZUFDekMsQ0FBQyxZQUFZLENBQUMsZUFBZSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUM7ZUFDdEYsQ0FBQyxZQUFZLENBQUMsZUFBZSxDQUFDLGdCQUFnQixDQUFDO1lBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO1FBQ3JHLGVBQWUsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsQ0FBOEIsQ0FBQztJQUN4RixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQ2pELENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLE1BQU07V0FDdEQsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDdkYsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQ2pELENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxDQUFDLGFBQW1DLEVBQVcsRUFBRSxDQUNwRSxhQUFhLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxlQUFlLENBQUMsVUFBVSxDQUFDLElBQUk7V0FDOUQsYUFBYSxDQUFDLFVBQVUsQ0FBQyxFQUFFLEtBQUssZUFBZSxDQUFDLFVBQVUsQ0FBQyxFQUFFO1dBQzdELGFBQWEsQ0FBQyxVQUFVLENBQUMsS0FBSyxLQUFLLGVBQWUsQ0FBQyxVQUFVLENBQUMsS0FBSztXQUNuRSxhQUFhLENBQUMsY0FBYyxLQUFLLGVBQWUsQ0FBQyxjQUFjO1dBQy9ELGFBQWEsQ0FBQyxNQUFNLEtBQUssZUFBZSxDQUFDLE1BQU07V0FDL0MsYUFBYSxDQUFDLGdCQUFnQixLQUFLLGVBQWUsQ0FBQyxnQkFBZ0IsQ0FBQztJQUN6RSxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdkYsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksV0FBVyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3pCLE9BQU8sV0FBVyxDQUFDLFVBQVUsS0FBSyxDQUFDO2VBQzlCLFdBQVcsQ0FBQyxXQUFXLEtBQUssS0FBSztZQUNwQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUU7WUFDL0MsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQztJQUMzRCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsWUFBWSxLQUFLLFdBQVcsQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUMxRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsVUFBVSxHQUFHLFdBQVcsQ0FBQyxVQUFVO1FBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDO0lBQ2xHLElBQUksV0FBVyxDQUFDLFVBQVUsS0FBSyxXQUFXLENBQUMsVUFBVSxFQUFFLENBQUM7UUFDdEQsT0FBTyxXQUFXLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxNQUFNO1lBQzlDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRyxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsS0FBSyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3BFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsRUFBRSxDQUFDO0lBQzFELENBQUM7SUFDRCxNQUFNLEtBQUssR0FBb0Q7UUFDN0QsR0FBRyxFQUFFLENBQUMsRUFBRSxlQUFlLEVBQUUsQ0FBQyxFQUFFLGlDQUFpQyxFQUFFLENBQUM7S0FDakUsQ0FBQztJQUNGLElBQUksS0FBSyxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsS0FBSyxLQUFLLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSx3QkFBd0IsRUFBRSxDQUFDO0lBQ2hFLENBQUM7SUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDdkQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQW1DLEVBQUU7SUFDL0UsSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLG1CQUFtQjtRQUM5RSxVQUFVLEVBQUUsWUFBWSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1dBQzlELFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUMzRSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEYsQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztXQUNyRSxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUNuQyxDQUFDLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQWUsQ0FBQyxFQUFFLENBQUM7UUFDM0csSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFO1FBQ2pFLFdBQVcsRUFBRSxhQUFhLEVBQUUsYUFBYTtLQUMxQyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztXQUN6RixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQUUsSUFBSSxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUM7V0FDL0MsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQztXQUMzRCxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNqRSxJQUFJLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BCLE9BQU8sUUFBc0QsQ0FBQztBQUNoRSxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxLQUFLLEVBQzlELGNBQStDLEVBQ3ZCLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLDJCQUEyQixDQUFDLHVCQUF1QixFQUFFLGlCQUFpQixDQUFDLGNBQWMsQ0FBQyxDQUN2RixDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQ3BELFFBQWlCLEVBQ2dCLEVBQUUsQ0FDbkMsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBb0MsQ0FBQztBQUV4Rix5RkFBeUY7QUFDekYsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsS0FBSyxFQUN6RCxjQUF1QixFQUN2QixhQUFtQyxFQUNoQixFQUFFO0lBQ3JCLElBQUksQ0FBQztRQUNILE1BQU0sV0FBVyxHQUFHLHNDQUFzQyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQzNFLGFBQWEsR0FBRywyQkFBMkIsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzRCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLE1BQU07WUFBRSxPQUFPLENBQUMsb0JBQW9CLENBQUMsQ0FBQztRQUM3RixJQUFJLFNBQVMsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLGFBQWEsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNwRyxPQUFPLENBQUMseURBQXlELENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLE1BQU0sMkNBQTJDLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMxRixPQUFPLENBQUMsMkNBQTJDLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsS0FBSyxJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsS0FBSyxLQUFLO2VBQ3hELFdBQVcsQ0FBQyxPQUFPLEVBQUUsV0FBVyxLQUFLLGFBQWEsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUM5RSxPQUFPLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztBQUNILENBQUMsQ0FBQztBQU1GOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxLQUFLLEVBQ3pELFdBQTRDLEVBQzVDLFdBQW1ELEVBQ25ELGFBQW1DLEVBQ25DLDJCQUFtQyxFQUNLLEVBQUU7SUFDMUMsSUFBSSxDQUFDO1FBQ0gsV0FBVyxHQUFHLHNDQUFzQyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ2xFLFdBQVcsR0FBRyxXQUFXLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ3ZDLENBQUMsQ0FBQyxzQ0FBc0MsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUN4RCxhQUFhLEdBQUcsMkJBQTJCLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLFlBQVksQ0FBQywyQkFBMkIsQ0FBQztlQUN6QyxDQUFDLE1BQU0sc0NBQXNDLENBQUMsV0FBVyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUMsTUFBTTtlQUNqRixDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksQ0FDMUIsV0FBVyxDQUFDLE1BQU0sS0FBSyxNQUFNLDJDQUEyQyxDQUFDLFdBQVcsQ0FBQzttQkFDbEYsV0FBVyxDQUFDLFVBQVUsQ0FBQyxZQUFZLEtBQUssYUFBYSxDQUFDLFlBQVk7bUJBQ2xFLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsK0JBQStCLENBQUMsYUFBYSxDQUFDLENBQUM7dUJBQzlGLFNBQVMsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUM5RSxDQUFDO1lBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO1FBQ3JELElBQUksV0FBVyxDQUFDLGlCQUFpQixLQUFLLDJCQUEyQixFQUFFLENBQUM7WUFDbEUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixFQUFFLENBQUM7UUFDMUQsQ0FBQztRQUNELElBQUksV0FBVyxLQUFLLElBQUksSUFBSSxXQUFXLENBQUMsUUFBUSxJQUFJLFdBQVcsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN6RSxJQUFJLFdBQVcsQ0FBQyxRQUFRLEdBQUcsV0FBVyxDQUFDLFFBQVE7Z0JBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDO1lBQzlGLE9BQU8sV0FBVyxDQUFDLE1BQU0sS0FBSyxXQUFXLENBQUMsTUFBTTtnQkFDOUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFO2dCQUNoRCxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsQ0FBQztRQUMvQyxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsUUFBUSxLQUFLLENBQUMsV0FBVyxFQUFFLFFBQVEsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUM5RCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsY0FBYyxFQUFFLENBQUM7UUFDdEQsQ0FBQztRQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsQ0FBQztJQUN4RCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDO0lBQ2pELENBQUM7QUFDSCxDQUFDLENBQUMifQ==

package/dist_ts/requests/admin.d.ts

@@ -1,5 +1,49 @@
 import * as plugins from '../plugins.js';
 import type { IIdentity, IIdentityCredential, IServiceDeploymentGrant } from '../data/user.js';
+/** Backend-owned human credential metadata; never includes a password verifier. */
+export interface IHumanCredentialMetadata {
+    userId: string;
+    generation: number;
+    passwordEnabled: boolean;
+    updatedAt: number;
+}
+export interface IReq_Admin_GetHumanCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_GetHumanCredential> {
+    method: 'getHumanCredential';
+    request: {
+        identity: IIdentityCredential;
+        userId: string;
+    };
+    response: {
+        credential: IHumanCredentialMetadata;
+    };
+}
+/**
+ * Requires a recently authenticated human administrator. Each operation invalidates
+ * previously issued human UI/API and registry sessions. Revoking a password retains
+ * the user's upstream OIDC binding, so a new trusted OIDC login remains possible.
+ */
+export interface IReq_Admin_MutateHumanCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_MutateHumanCredential> {
+    method: 'mutateHumanCredential';
+    request: {
+        identity: IIdentityCredential;
+        userId: string;
+        mutationId: string;
+        expectedGeneration: number;
+        operation: {
+            kind: 'rotatePassword';
+            password: string;
+        } | {
+            kind: 'revokePassword';
+        } | {
+            kind: 'revokeSessions';
+        };
+    };
+    response: {
+        /** Historical on replay; read getHumanCredential for current state. */
+        credential: IHumanCredentialMetadata;
+        replayed: boolean;
+    };
+}
 export interface IReq_Admin_LoginWithUsernameAndPassword extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_LoginWithUsernameAndPassword> {
     method: 'adminLoginWithUsernameAndPassword';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "28.2.0",
+  "version": "28.4.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -31,7 +31,7 @@
     "@git.zone/tsdoc": "^2.2.0",
     "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "^4.0.0",
-    "@types/node": "^26.4.1"
+    "@types/node": "26.4.1"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -47,6 +47,21 @@ validator; unlike `@serve.zone/interfaces/runtime`, it does not load the general
 runtime graph, `plugins.js`, SmartCrypto, TypedRequest, Corestore, or settlement
 runtime modules.
 
+### Human Credential Administration
+
+`requests.admin.getHumanCredential` and `mutateHumanCredential` describe human
+credential inspection and mutation for recently authenticated administrators.
+Operations rotate a password, revoke password login, or revoke existing sessions.
+Each successful mutation advances the generation and invalidates older human
+UI/API and OCI registry sessions. Upstream OIDC identity bindings remain intact.
+
+Send the expected generation and a stable mutation ID. After a lost response,
+authenticate again and repeat the same request. A replay returns the original
+metadata without applying the operation again; inspect current metadata separately.
+Requests containing passwords must never be logged. Responses contain no passwords
+or verifiers. Cloudly owns validation, atomic persistence, and session enforcement;
+these shared contracts alone do not implement an endpoint.
+
 ### Node Credential Administration
 
 `requests.node` defines `getNodeCredential`, `rotateNodeCredential` and

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '28.2.0',
+  version: '28.4.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/runtimeassignment.ts

@@ -207,7 +207,7 @@ export const computeRuntimeAssignmentV1Digest = async (
 
 export const validateRuntimeAssignmentV1 = async (valueArg: unknown): Promise<string[]> => {
   try {
-    const assignment = snapshotAssignment(valueArg);
+    const assignment = snapshotRuntimeAssignmentV1(valueArg);
     return assignment.digest === await computeRuntimeAssignmentV1Digest(assignment)
       ? [] : ['runtime assignment digest does not match'];
   } catch {
@@ -215,7 +215,13 @@ export const validateRuntimeAssignmentV1 = async (valueArg: unknown): Promise<st
   }
 };
 
-const snapshotAssignment = (valueArg: unknown): IRuntimeAssignmentV1 =>
+/**
+ * Synchronous exact-schema validation and detached canonical copy for persistence
+ * assertions. This does not verify the digest, authenticate scope, or admit an
+ * attempt. Use validateRuntimeAssignmentV1/evaluateRuntimeAssignmentV1 before
+ * acceptance or effects.
+ */
+export const snapshotRuntimeAssignmentV1 = (valueArg: unknown): IRuntimeAssignmentV1 =>
   JSON.parse(canonicalizeStrictJson(assertAssignment(valueArg), fail)) as IRuntimeAssignmentV1;
 
 export const getRuntimeAssignmentV1Reference = (
@@ -245,8 +251,8 @@ export const evaluateRuntimeAssignmentV1 = async (
   trustedScopeArg: IRuntimeAssignmentScopeV1,
 ): Promise<TRuntimeAssignmentDecisionV1> => {
   try {
-    incomingArg = snapshotAssignment(incomingArg);
-    acceptedArg = acceptedArg === null ? null : snapshotAssignment(acceptedArg);
+    incomingArg = snapshotRuntimeAssignmentV1(incomingArg);
+    acceptedArg = acceptedArg === null ? null : snapshotRuntimeAssignmentV1(acceptedArg);
     if (!isExactRecord(trustedScopeArg, ['controller', 'organizationId', 'nodeId', 'runtimeNamespace'])
       || !isController(trustedScopeArg.controller)
       || !isIdentifier(trustedScopeArg.organizationId) || !isIdentifier(trustedScopeArg.nodeId)
@@ -327,14 +333,24 @@ export const computeRuntimeAssignmentObservationV1Digest = async (
   runtimeAssignmentV1Contract.observationDigestDomain, assertObservation(observationArg),
 );
 
+/**
+ * Synchronous exact-schema validation and detached canonical copy. Digest,
+ * assignment and reporter authority still require the observation validator and
+ * evaluator; a structurally valid observation is never a writer fence.
+ */
+export const snapshotRuntimeAssignmentObservationV1 = (
+  valueArg: unknown,
+): IRuntimeAssignmentObservationV1 =>
+  JSON.parse(canonical(assertObservation(valueArg))) as IRuntimeAssignmentObservationV1;
+
 /** Checks exact assignment evidence; transport must separately bind reporter/session. */
 export const validateRuntimeAssignmentObservationV1 = async (
   observationArg: unknown,
   assignmentArg: IRuntimeAssignmentV1,
 ): Promise<string[]> => {
   try {
-    const observation = JSON.parse(canonical(assertObservation(observationArg))) as IRuntimeAssignmentObservationV1;
-    assignmentArg = snapshotAssignment(assignmentArg);
+    const observation = snapshotRuntimeAssignmentObservationV1(observationArg);
+    assignmentArg = snapshotRuntimeAssignmentV1(assignmentArg);
     if ((await validateRuntimeAssignmentV1(assignmentArg)).length) return ['invalid assignment'];
     if (canonical(observation.assignment) !== canonical(getRuntimeAssignmentV1Reference(assignmentArg))) {
       return ['runtime observation does not match the exact assignment'];
@@ -371,10 +387,10 @@ export const evaluateRuntimeAssignmentObservationV1 = async (
   trustedReporterSessionIdArg: string,
 ): Promise<TRuntimeObservationDecisionV1> => {
   try {
-    incomingArg = JSON.parse(canonical(assertObservation(incomingArg))) as IRuntimeAssignmentObservationV1;
+    incomingArg = snapshotRuntimeAssignmentObservationV1(incomingArg);
     acceptedArg = acceptedArg === null ? null
-      : JSON.parse(canonical(assertObservation(acceptedArg))) as IRuntimeAssignmentObservationV1;
-    assignmentArg = snapshotAssignment(assignmentArg);
+      : snapshotRuntimeAssignmentObservationV1(acceptedArg);
+    assignmentArg = snapshotRuntimeAssignmentV1(assignmentArg);
     if (!isIdentifier(trustedReporterSessionIdArg)
       || (await validateRuntimeAssignmentObservationV1(incomingArg, assignmentArg)).length
       || (acceptedArg !== null && (

package/ts/requests/admin.ts

@@ -1,6 +1,50 @@
 import * as plugins from '../plugins.js';
 import type { IIdentity, IIdentityCredential, IServiceDeploymentGrant } from '../data/user.js';
 
+/** Backend-owned human credential metadata; never includes a password verifier. */
+export interface IHumanCredentialMetadata {
+  userId: string;
+  generation: number;
+  passwordEnabled: boolean;
+  updatedAt: number;
+}
+
+export interface IReq_Admin_GetHumanCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Admin_GetHumanCredential
+> {
+  method: 'getHumanCredential';
+  request: { identity: IIdentityCredential; userId: string };
+  response: { credential: IHumanCredentialMetadata };
+}
+
+/**
+ * Requires a recently authenticated human administrator. Each operation invalidates
+ * previously issued human UI/API and registry sessions. Revoking a password retains
+ * the user's upstream OIDC binding, so a new trusted OIDC login remains possible.
+ */
+export interface IReq_Admin_MutateHumanCredential extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest,
+  IReq_Admin_MutateHumanCredential
+> {
+  method: 'mutateHumanCredential';
+  request: {
+    identity: IIdentityCredential;
+    userId: string;
+    mutationId: string;
+    expectedGeneration: number;
+    operation:
+      | { kind: 'rotatePassword'; password: string }
+      | { kind: 'revokePassword' }
+      | { kind: 'revokeSessions' };
+  };
+  response: {
+    /** Historical on replay; read getHumanCredential for current state. */
+    credential: IHumanCredentialMetadata;
+    replayed: boolean;
+  };
+}
+
 export interface IReq_Admin_LoginWithUsernameAndPassword extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
   IReq_Admin_LoginWithUsernameAndPassword