@serve.zone/interfaces 30.6.0 → 30.8.1

package/dist_ts/data/networkprojection.d.ts

@@ -0,0 +1,140 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAssignmentReferenceV1, IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+import type { IRuntimeNetworkHandoffLeaseV1, IRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import type { IPrivateNetworkV1, IServicePrivateNetworksV1, IServicePrivateNetworkDnsPolicyV1 } from './privatenetwork.js';
+export interface IRuntimeNetworkNodeScopeV1 {
+    controller: IRuntimeControllerV1;
+    nodeId: string;
+    runtimeNamespace: string;
+}
+/** Immutable per-attempt address material. Membership and projection revisions are independent. */
+export interface IRuntimeNetworkWorkloadLeaseV1 extends IRuntimeNetworkNodeScopeV1 {
+    schemaVersion: 1;
+    id: string;
+    /** Allocation incarnation, not a mutable desired-state revision. */
+    generation: number;
+    organizationId: string;
+    assignmentId: string;
+    serviceId: string;
+    replicaId: string;
+    attemptId: string;
+    protectedAuthority: IRuntimeAuthorityReferenceV1;
+    routerIncarnationId: string;
+    ipv4: {
+        poolId: string;
+        /** Dedicated, unbridged point-to-point subnet; never the host transit pool. */
+        linkSubnet: string;
+        address: string;
+        /** Exactly address/32, distinct from the link subnet and node-control prefix. */
+        sourcePrefix: string;
+        gateway: string;
+    };
+    /** Router-side reachable address on port 53, injected through CRI dns_config. */
+    dnsServer: string;
+    digest: TSha256Digest;
+}
+/** Controller-owned readiness evidence. A signature does not prove this evidence's provenance. */
+export interface IRuntimeNetworkEndpointV1 {
+    lease: IRuntimeNetworkWorkloadLeaseV1;
+    ready: boolean;
+    observation: {
+        assignment: IRuntimeAssignmentReferenceV1;
+        reporterSessionId: string;
+        sequence: number;
+        digest: TSha256Digest;
+    } | null;
+    /** TCP/UDP only; the complete protected union remains denied. */
+    publicEgress: boolean;
+    platformEndpointIds: string[];
+}
+/** Exact directed grant identity; receiver-owned realization resolves the lease to kernel facts. */
+export interface IRuntimeNetworkPacketGrantV1 {
+    source: IRuntimeAuthorityReferenceV1;
+    destination: {
+        kind: 'workload';
+        lease: IRuntimeAuthorityReferenceV1;
+    } | {
+        kind: 'public';
+    } | {
+        kind: 'platform';
+        id: string;
+        address: string;
+        protocol: 'tcp' | 'udp';
+        port: number;
+    };
+}
+export interface IRuntimeNetworkProjectionV1 extends IRuntimeNetworkNodeScopeV1 {
+    schemaVersion: 1;
+    id: string;
+    generation: number;
+    previous: IRuntimeAuthorityReferenceV1 | null;
+    protectedAuthority: IRuntimeNetworkProtectedAuthorityV1;
+    /** Exact historical authorities needed to authenticate retained allocation material. */
+    allocationAuthorities: IRuntimeNetworkProtectedAuthorityV1[];
+    handoff: IRuntimeNetworkHandoffLeaseV1 | null;
+    /** COMPLETE relevant definitions, including declared names with no ready replicas. */
+    networks: IPrivateNetworkV1[];
+    memberships: IServicePrivateNetworksV1[];
+    endpoints: IRuntimeNetworkEndpointV1[];
+    dns: {
+        issuedAt: number;
+        notBefore: number;
+        expiresAt: number;
+    };
+    /** Explicit denial intent. Carry until the exact predecessor's application is proven. */
+    withdrawals: IRuntimeNetworkPacketGrantV1[];
+    retiredLeases: IRuntimeAuthorityReferenceV1[];
+    retiredHandoffs: IRuntimeAuthorityReferenceV1[];
+    digest: TSha256Digest;
+}
+export interface IRuntimeNetworkDnsViewV1 {
+    source: IRuntimeAuthorityReferenceV1;
+    sourceAddress: string;
+    dnsServer: string;
+    policy: IServicePrivateNetworkDnsPolicyV1;
+    /** Sorted complete A sets; [] is declared NODATA, never an omitted name. AAAA is NODATA. */
+    records: Array<{
+        name: string;
+        addresses: string[];
+    }>;
+}
+export declare const runtimeNetworkProjectionV1Contract: Readonly<{
+    readonly workloadDigestDomain: "serve.zone/runtime-network-workload-lease-v1";
+    readonly projectionDigestDomain: "serve.zone/runtime-network-projection-v1";
+    readonly maximumCanonicalBytes: 917504;
+    readonly maximumAllocationAuthorities: 16;
+    readonly maximumNetworks: 128;
+    readonly maximumMemberships: 256;
+    readonly maximumEndpoints: 256;
+    readonly maximumGrants: 4096;
+    readonly maximumDnsLeaseMs: 900000;
+    readonly positiveTtlSeconds: 5;
+    readonly negativeTtlSeconds: 1;
+    readonly omission: "no-effect-without-explicit-withdrawal";
+    readonly packetLifetime: "until-applied-denial-or-independent-fence";
+    readonly acknowledgement: "admission-is-not-application-or-readiness";
+    readonly allocationReuse: "requires-controller-quarantine-and-all-affected-authority-fences";
+}>;
+export declare const snapshotRuntimeNetworkNodeScopeV1: (value: unknown) => IRuntimeNetworkNodeScopeV1;
+export declare const snapshotRuntimeNetworkWorkloadLeaseV1: (value: unknown) => IRuntimeNetworkWorkloadLeaseV1;
+export declare const computeRuntimeNetworkWorkloadLeaseV1Digest: (value: IRuntimeNetworkWorkloadLeaseV1) => Promise<TSha256Digest>;
+/** Structural snapshot only; use validate/signature/admission helpers before accepting authority. */
+export declare const snapshotRuntimeNetworkProjectionV1: (value: unknown) => IRuntimeNetworkProjectionV1;
+export declare const computeRuntimeNetworkProjectionV1Digest: (value: IRuntimeNetworkProjectionV1) => Promise<TSha256Digest>;
+/** Complete structural, digest, allocation and policy binding. Not an allocation/barrier/readiness proof. */
+export declare const validateRuntimeNetworkProjectionV1: (value: unknown) => Promise<IRuntimeNetworkProjectionV1>;
+/** Complete directed full-mesh and explicitly authorized egress; no DNS readiness dependency. */
+export declare const getRuntimeNetworkProjectionPacketGrantsV1: (value: unknown) => Promise<IRuntimeNetworkPacketGrantV1[]>;
+/** Complete offline DNS material, including authorized names never previously queried. */
+export declare const composeRuntimeNetworkProjectionDnsViewsV1: (value: unknown) => Promise<IRuntimeNetworkDnsViewV1[]>;
+/** Bind immutable address material without a circular assignment-digest dependency. */
+export declare const bindRuntimeNetworkWorkloadLeaseToAssignmentV1: (leaseValue: unknown, assignmentValue: unknown) => Promise<IRuntimeNetworkWorkloadLeaseV1>;
+/**
+ * Pure revision decision. appliedPrevious must be the receiver's exact durable,
+ * joined application receipt, never an incoming ACK field. All prior accepted
+ * material/apply journals survive until effects and DNS/allocation quarantine end.
+ */
+export declare const admitRuntimeNetworkProjectionV1: (value: unknown, previousValue: unknown | null, trustedScopeValue: unknown, appliedPreviousValue: unknown | null) => Promise<{
+    status: "accepted" | "replay";
+    projection: IRuntimeNetworkProjectionV1;
+}>;

package/dist_ts/data/networkprojection.js

@@ -0,0 +1,371 @@
+import { snapshotRuntimeAssignmentV1, validateRuntimeAssignmentV1 } from './runtimeassignment.js';
+import { bindRuntimeNetworkHandoffLeaseV1, computeRuntimeNetworkProtectedAuthorityV1Digest, snapshotRuntimeNetworkHandoffLeaseV1, snapshotRuntimeNetworkProtectedAuthorityV1 } from './networkauthority.js';
+import { buildPrivateNetworkFqdnV1, composeServicePrivateNetworkDnsPolicyV1, snapshotPrivateNetworkV1, snapshotServicePrivateNetworksV1 } from './privatenetwork.js';
+import { captureNetwork, failNetwork, networkCanonical, networkContains, networkController, networkCounter, networkDigest, networkEqual, networkHash, networkId, networkIpv4, networkIpv4Number, networkList, networkOverlaps, networkPrefixBounds, networkRecord, networkReference, networkReferenceOf, networkRevision, networkSafe, networkSorted, requireNetwork } from '../private/networkcontract.js';
+export const runtimeNetworkProjectionV1Contract = Object.freeze({
+    workloadDigestDomain: 'serve.zone/runtime-network-workload-lease-v1',
+    projectionDigestDomain: 'serve.zone/runtime-network-projection-v1',
+    maximumCanonicalBytes: 917_504,
+    maximumAllocationAuthorities: 16,
+    maximumNetworks: 128,
+    maximumMemberships: 256,
+    maximumEndpoints: 256,
+    maximumGrants: 4096,
+    maximumDnsLeaseMs: 900_000,
+    positiveTtlSeconds: 5,
+    negativeTtlSeconds: 1,
+    omission: 'no-effect-without-explicit-withdrawal',
+    packetLifetime: 'until-applied-denial-or-independent-fence',
+    acknowledgement: 'admission-is-not-application-or-readiness',
+    allocationReuse: 'requires-controller-quarantine-and-all-affected-authority-fences',
+});
+const scope = (item) => ({
+    controller: networkController(item.controller), nodeId: networkId(item.nodeId), runtimeNamespace: networkId(item.runtimeNamespace),
+});
+const sameScope = (left, right) => networkEqual(left.controller, right.controller) && left.nodeId === right.nodeId && left.runtimeNamespace === right.runtimeNamespace;
+const ownerKey = (value) => networkCanonical([value.organizationId, value.serviceId]);
+const attemptKey = (value) => networkCanonical([value.organizationId, value.serviceId, value.replicaId, value.attemptId]);
+const refKey = (value) => networkCanonical(networkReferenceOf(value));
+const sortedReferences = (value) => networkSorted(networkList(value, 256, networkReference), refKey);
+export const snapshotRuntimeNetworkNodeScopeV1 = (value) => networkSafe(() => scope(networkRecord(captureNetwork(value), ['controller', 'nodeId', 'runtimeNamespace'])));
+export const snapshotRuntimeNetworkWorkloadLeaseV1 = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['schemaVersion', 'id', 'generation', 'controller', 'nodeId', 'runtimeNamespace',
+        'organizationId', 'assignmentId', 'serviceId', 'replicaId', 'attemptId', 'protectedAuthority', 'routerIncarnationId', 'ipv4', 'dnsServer', 'digest']);
+    requireNetwork(item.schemaVersion === 1);
+    const ip = networkRecord(item.ipv4, ['poolId', 'linkSubnet', 'address', 'sourcePrefix', 'gateway']);
+    requireNetwork(typeof ip.linkSubnet === 'string' && ip.linkSubnet.length <= 18);
+    const pieces = ip.linkSubnet.split('/');
+    requireNetwork(pieces.length === 2 && /^(?:[89]|[12][0-9]|3[01])$/.test(pieces[1]));
+    const first = networkIpv4Number(networkIpv4(pieces[0]));
+    requireNetwork(first % 2 ** (32 - Number(pieces[1])) === 0
+        && ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'].some(prefix => networkContains(prefix, ip.linkSubnet)));
+    const address = networkIpv4(ip.address), gateway = networkIpv4(ip.gateway), [low, high] = networkPrefixBounds(ip.linkSubnet);
+    requireNetwork(address !== gateway && ip.sourcePrefix === `${address}/32`);
+    for (const current of [address, gateway]) {
+        const number = networkIpv4Number(current);
+        requireNetwork(number >= low && number <= high && (high - low === 1 || (number !== low && number !== high)));
+    }
+    requireNetwork(item.dnsServer === gateway);
+    return { schemaVersion: 1, id: networkId(item.id), generation: networkCounter(item.generation), ...scope(item),
+        organizationId: networkId(item.organizationId), assignmentId: networkId(item.assignmentId), serviceId: networkId(item.serviceId),
+        replicaId: networkId(item.replicaId), attemptId: networkId(item.attemptId), protectedAuthority: networkReference(item.protectedAuthority),
+        routerIncarnationId: networkId(item.routerIncarnationId), ipv4: { poolId: networkId(ip.poolId), linkSubnet: ip.linkSubnet,
+            address, sourcePrefix: ip.sourcePrefix, gateway }, dnsServer: gateway, digest: networkDigest(item.digest) };
+});
+export const computeRuntimeNetworkWorkloadLeaseV1Digest = (value) => networkHash(runtimeNetworkProjectionV1Contract.workloadDigestDomain, snapshotRuntimeNetworkWorkloadLeaseV1(value));
+const packetGrant = (value) => {
+    const item = networkRecord(value, ['source', 'destination']);
+    requireNetwork(item.destination !== null && typeof item.destination === 'object');
+    const kind = item.destination.kind;
+    if (kind === 'workload') {
+        const destination = networkRecord(item.destination, ['kind', 'lease']);
+        const source = networkReference(item.source), lease = networkReference(destination.lease);
+        requireNetwork(!networkEqual(source, lease));
+        return { source, destination: { kind, lease } };
+    }
+    if (kind === 'public') {
+        networkRecord(item.destination, ['kind']);
+        return { source: networkReference(item.source), destination: { kind } };
+    }
+    requireNetwork(kind === 'platform');
+    const destination = networkRecord(item.destination, ['kind', 'id', 'address', 'protocol', 'port']);
+    requireNetwork(destination.protocol === 'tcp' || destination.protocol === 'udp');
+    return { source: networkReference(item.source), destination: { kind, id: networkId(destination.id), address: networkIpv4(destination.address),
+            protocol: destination.protocol, port: networkCounter(destination.port, 65535) } };
+};
+const endpoint = (value) => {
+    const item = networkRecord(value, ['lease', 'ready', 'observation', 'publicEgress', 'platformEndpointIds']);
+    requireNetwork(typeof item.ready === 'boolean' && typeof item.publicEgress === 'boolean');
+    const lease = snapshotRuntimeNetworkWorkloadLeaseV1(item.lease);
+    let observation = null;
+    if (item.observation !== null) {
+        const observed = networkRecord(item.observation, ['assignment', 'reporterSessionId', 'sequence', 'digest']);
+        const assignment = networkRecord(observed.assignment, ['assignmentId', 'generation', 'digest']);
+        requireNetwork(assignment.assignmentId === lease.assignmentId);
+        observation = { assignment: { assignmentId: lease.assignmentId, generation: networkCounter(assignment.generation), digest: networkDigest(assignment.digest) },
+            reporterSessionId: networkId(observed.reporterSessionId), sequence: networkCounter(observed.sequence), digest: networkDigest(observed.digest) };
+    }
+    requireNetwork(!item.ready || (observation !== null && observation.assignment.generation === 1));
+    return { lease, ready: item.ready, observation, publicEgress: item.publicEgress,
+        platformEndpointIds: networkSorted(networkList(item.platformEndpointIds, 64, networkId), value => value) };
+};
+/** Structural snapshot only; use validate/signature/admission helpers before accepting authority. */
+export const snapshotRuntimeNetworkProjectionV1 = (value) => networkSafe(() => {
+    const captured = captureNetwork(value);
+    requireNetwork(new TextEncoder().encode(networkCanonical(captured)).length <= runtimeNetworkProjectionV1Contract.maximumCanonicalBytes);
+    const item = networkRecord(captured, ['schemaVersion', 'id', 'generation', 'previous', 'controller', 'nodeId', 'runtimeNamespace',
+        'protectedAuthority', 'allocationAuthorities', 'handoff', 'networks', 'memberships', 'endpoints', 'dns', 'withdrawals', 'retiredLeases', 'retiredHandoffs', 'digest']);
+    requireNetwork(item.schemaVersion === 1);
+    const dns = networkRecord(item.dns, ['issuedAt', 'notBefore', 'expiresAt']);
+    const window = { issuedAt: networkCounter(dns.issuedAt), notBefore: networkCounter(dns.notBefore), expiresAt: networkCounter(dns.expiresAt) };
+    requireNetwork(window.notBefore >= window.issuedAt && window.expiresAt > window.notBefore && window.expiresAt - window.issuedAt <= 900_000);
+    return { schemaVersion: 1, ...networkRevision(item), ...scope(item),
+        protectedAuthority: snapshotRuntimeNetworkProtectedAuthorityV1(item.protectedAuthority),
+        allocationAuthorities: networkSorted(networkList(item.allocationAuthorities, 16, snapshotRuntimeNetworkProtectedAuthorityV1), refKey),
+        handoff: item.handoff === null ? null : snapshotRuntimeNetworkHandoffLeaseV1(item.handoff),
+        networks: networkSorted(networkList(item.networks, 128, snapshotPrivateNetworkV1), value => value.id),
+        memberships: networkSorted(networkList(item.memberships, 256, snapshotServicePrivateNetworksV1), ownerKey),
+        endpoints: networkSorted(networkList(item.endpoints, 256, endpoint), value => value.lease.id), dns: window,
+        withdrawals: networkSorted(networkList(item.withdrawals, 4096, packetGrant), networkCanonical),
+        retiredLeases: sortedReferences(item.retiredLeases), retiredHandoffs: sortedReferences(item.retiredHandoffs), digest: networkDigest(item.digest) };
+});
+const grantsOf = (projection) => {
+    const result = [];
+    const memberships = new Map(projection.memberships.map(member => [ownerKey(member), member]));
+    const append = (grant) => {
+        requireNetwork(result.length < 4096);
+        result.push(grant);
+    };
+    for (const source of projection.endpoints) {
+        const member = memberships.get(ownerKey(source.lease));
+        requireNetwork(member);
+        for (const destination of projection.endpoints) {
+            if (source === destination || (!sameScope(source.lease, projection) && !sameScope(destination.lease, projection)))
+                continue;
+            const target = memberships.get(ownerKey(destination.lease));
+            requireNetwork(target);
+            if (member.organizationId === target.organizationId && member.attachments.some(attachment => target.attachments.some(other => other.networkId === attachment.networkId))) {
+                append({ source: networkReferenceOf(source.lease), destination: { kind: 'workload', lease: networkReferenceOf(destination.lease) } });
+            }
+        }
+        if (!sameScope(source.lease, projection))
+            continue;
+        if (source.publicEgress)
+            append({ source: networkReferenceOf(source.lease), destination: { kind: 'public' } });
+        for (const id of source.platformEndpointIds) {
+            const platform = projection.protectedAuthority.platformEndpoints.find(item => item.id === id);
+            requireNetwork(platform);
+            append({ source: networkReferenceOf(source.lease), destination: { kind: 'platform', ...platform } });
+        }
+    }
+    return result.sort((left, right) => networkCanonical(left) < networkCanonical(right) ? -1 : 1);
+};
+export const computeRuntimeNetworkProjectionV1Digest = (value) => networkHash(runtimeNetworkProjectionV1Contract.projectionDigestDomain, snapshotRuntimeNetworkProjectionV1(value));
+/** Complete structural, digest, allocation and policy binding. Not an allocation/barrier/readiness proof. */
+export const validateRuntimeNetworkProjectionV1 = async (value) => {
+    try {
+        const projection = snapshotRuntimeNetworkProjectionV1(value), current = projection.protectedAuthority;
+        requireNetwork(networkEqual(current.controller, projection.controller) && current.egressAuthorities.some(owner => owner.nodeId === projection.nodeId && owner.runtimeNamespace === projection.runtimeNamespace));
+        const authorities = [current, ...projection.allocationAuthorities];
+        requireNetwork(new Set(authorities.map(refKey)).size === authorities.length);
+        for (const authority of authorities) {
+            requireNetwork(networkEqual(authority.controller, projection.controller)
+                && authority.digest === await computeRuntimeNetworkProtectedAuthorityV1Digest(authority));
+        }
+        const allocationAuthority = (reference) => {
+            const result = authorities.find(authority => networkEqual(networkReferenceOf(authority), reference));
+            requireNetwork(result);
+            return result;
+        };
+        if (projection.handoff !== null) {
+            await bindRuntimeNetworkHandoffLeaseV1(projection.handoff, allocationAuthority(projection.handoff.protectedAuthority));
+            requireNetwork(sameScope(projection.handoff, projection));
+            requireNetwork(current.pools.some(pool => pool.id === projection.handoff.transit.poolId && pool.purpose === 'transit'
+                && networkContains(pool.prefix, projection.handoff.transit.prefix)));
+        }
+        const networks = new Map(projection.networks.map(network => [network.id, network]));
+        const organizationKeys = new Map(), keysToOrganizations = new Map();
+        const names = new Set();
+        for (const network of projection.networks) {
+            requireNetwork(network.state === 'active');
+            const key = `${network.organizationDnsKey}.${network.networkDnsKey}`;
+            requireNetwork(!names.has(key));
+            names.add(key);
+            requireNetwork(!organizationKeys.has(network.organizationId) || organizationKeys.get(network.organizationId) === network.organizationDnsKey);
+            requireNetwork(!keysToOrganizations.has(network.organizationDnsKey) || keysToOrganizations.get(network.organizationDnsKey) === network.organizationId);
+            organizationKeys.set(network.organizationId, network.organizationDnsKey);
+            keysToOrganizations.set(network.organizationDnsKey, network.organizationId);
+            for (const upstream of network.policy.externalDns?.upstreams ?? [])
+                requireNetwork(current.resolvers.some(resolver => resolver.address === upstream.address && resolver.port === upstream.port));
+        }
+        const members = new Map(projection.memberships.map(member => [ownerKey(member), member])), aliases = new Set();
+        for (const member of projection.memberships) {
+            composeServicePrivateNetworkDnsPolicyV1(member, member.attachments.map(attachment => networks.get(attachment.networkId)));
+            for (const attachment of member.attachments)
+                for (const alias of attachment.aliases) {
+                    const name = buildPrivateNetworkFqdnV1(networks.get(attachment.networkId), alias);
+                    requireNetwork(!aliases.has(name));
+                    aliases.add(name);
+                }
+        }
+        const assignments = new Set(), attempts = new Set(), readyReplicas = new Set();
+        for (const endpoint of projection.endpoints) {
+            const lease = endpoint.lease, authority = allocationAuthority(lease.protectedAuthority);
+            requireNetwork(networkEqual(lease.controller, projection.controller) && members.has(ownerKey(lease))
+                && !assignments.has(lease.assignmentId) && !attempts.has(attemptKey(lease)));
+            assignments.add(lease.assignmentId);
+            attempts.add(attemptKey(lease));
+            if (endpoint.ready) {
+                const replica = networkCanonical([lease.organizationId, lease.serviceId, lease.replicaId]);
+                requireNetwork(!readyReplicas.has(replica));
+                readyReplicas.add(replica);
+            }
+            requireNetwork(lease.digest === await computeRuntimeNetworkWorkloadLeaseV1Digest(lease));
+            requireNetwork(authority.egressAuthorities.some(owner => owner.nodeId === lease.nodeId && owner.runtimeNamespace === lease.runtimeNamespace)
+                && current.egressAuthorities.some(owner => owner.nodeId === lease.nodeId && owner.runtimeNamespace === lease.runtimeNamespace));
+            for (const protection of [authority, current])
+                requireNetwork(protection.pools.some(pool => pool.id === lease.ipv4.poolId && pool.purpose === 'workload' && networkContains(pool.prefix, lease.ipv4.linkSubnet)));
+            if (sameScope(lease, projection))
+                requireNetwork(projection.handoff !== null && lease.routerIncarnationId === projection.handoff.routerIncarnationId);
+            for (const id of endpoint.platformEndpointIds)
+                requireNetwork(current.platformEndpoints.some(platform => platform.id === id));
+            requireNetwork(!projection.retiredLeases.some(retired => networkEqual(retired, networkReferenceOf(lease))));
+        }
+        for (let index = 0; index < projection.endpoints.length; index++)
+            for (let previous = 0; previous < index; previous++) {
+                requireNetwork(!networkOverlaps(projection.endpoints[index].lease.ipv4.linkSubnet, projection.endpoints[previous].lease.ipv4.linkSubnet));
+            }
+        if (projection.handoff)
+            requireNetwork(!projection.retiredHandoffs.some(retired => networkEqual(retired, networkReferenceOf(projection.handoff))));
+        const grants = new Set(grantsOf(projection).map(networkCanonical));
+        requireNetwork(projection.withdrawals.every(grant => !grants.has(networkCanonical(grant))));
+        requireNetwork(projection.digest === await computeRuntimeNetworkProjectionV1Digest(projection));
+        return projection;
+    }
+    catch {
+        return failNetwork();
+    }
+};
+/** Complete directed full-mesh and explicitly authorized egress; no DNS readiness dependency. */
+export const getRuntimeNetworkProjectionPacketGrantsV1 = async (value) => grantsOf(await validateRuntimeNetworkProjectionV1(value));
+/** Complete offline DNS material, including authorized names never previously queried. */
+export const composeRuntimeNetworkProjectionDnsViewsV1 = async (value) => {
+    const projection = await validateRuntimeNetworkProjectionV1(value);
+    const networks = new Map(projection.networks.map(network => [network.id, network]));
+    const members = new Map(projection.memberships.map(member => [ownerKey(member), member]));
+    return projection.endpoints.filter(endpoint => sameScope(endpoint.lease, projection)).map(endpoint => {
+        const member = members.get(ownerKey(endpoint.lease));
+        const policy = composeServicePrivateNetworkDnsPolicyV1(member, member.attachments.map(attachment => networks.get(attachment.networkId)));
+        const records = [];
+        for (const target of projection.memberships) {
+            if (target.organizationId !== member.organizationId)
+                continue;
+            const addresses = projection.endpoints.filter(candidate => candidate.ready && ownerKey(candidate.lease) === ownerKey(target))
+                .map(candidate => candidate.lease.ipv4.address).sort();
+            for (const attachment of target.attachments) {
+                if (!member.attachments.some(own => own.networkId === attachment.networkId))
+                    continue;
+                for (const alias of attachment.aliases)
+                    records.push({ name: buildPrivateNetworkFqdnV1(networks.get(attachment.networkId), alias), addresses: [...addresses] });
+            }
+        }
+        records.sort((left, right) => left.name < right.name ? -1 : 1);
+        return { source: networkReferenceOf(endpoint.lease), sourceAddress: endpoint.lease.ipv4.address, dnsServer: endpoint.lease.dnsServer, policy, records };
+    });
+};
+/** Bind immutable address material without a circular assignment-digest dependency. */
+export const bindRuntimeNetworkWorkloadLeaseToAssignmentV1 = async (leaseValue, assignmentValue) => {
+    try {
+        const lease = snapshotRuntimeNetworkWorkloadLeaseV1(leaseValue), assignment = snapshotRuntimeAssignmentV1(assignmentValue);
+        requireNetwork((await validateRuntimeAssignmentV1(assignment)).length === 0 && sameScope(lease, assignment)
+            && lease.organizationId === assignment.organizationId && lease.assignmentId === assignment.assignmentId
+            && lease.serviceId === assignment.serviceId && lease.replicaId === assignment.replicaId && lease.attemptId === assignment.attemptId
+            && networkEqual(networkReferenceOf(lease), assignment.workload.network)
+            && lease.digest === await computeRuntimeNetworkWorkloadLeaseV1Digest(lease));
+        return lease;
+    }
+    catch {
+        return failNetwork();
+    }
+};
+/**
+ * Pure revision decision. appliedPrevious must be the receiver's exact durable,
+ * joined application receipt, never an incoming ACK field. All prior accepted
+ * material/apply journals survive until effects and DNS/allocation quarantine end.
+ */
+export const admitRuntimeNetworkProjectionV1 = async (value, previousValue, trustedScopeValue, appliedPreviousValue) => {
+    try {
+        // Snapshot ALL caller-owned inputs before the first asynchronous operation.
+        const incoming = snapshotRuntimeNetworkProjectionV1(value);
+        const previousInput = previousValue === null ? null : snapshotRuntimeNetworkProjectionV1(previousValue);
+        const trusted = snapshotRuntimeNetworkNodeScopeV1(trustedScopeValue);
+        const applied = appliedPreviousValue === null ? null : networkReference(captureNetwork(appliedPreviousValue));
+        const projection = await validateRuntimeNetworkProjectionV1(incoming);
+        requireNetwork(sameScope(projection, trusted));
+        if (previousInput === null) {
+            requireNetwork(projection.generation === 1 && applied === null && projection.withdrawals.length === 0
+                && projection.retiredLeases.length === 0 && projection.retiredHandoffs.length === 0);
+            return { status: 'accepted', projection };
+        }
+        const previous = await validateRuntimeNetworkProjectionV1(previousInput);
+        requireNetwork(sameScope(previous, trusted) && previous.id === projection.id);
+        requireNetwork(applied === null || networkEqual(applied, networkReferenceOf(previous)));
+        if (projection.generation === previous.generation) {
+            requireNetwork(networkEqual(previous, projection));
+            return { status: 'replay', projection };
+        }
+        requireNetwork(networkEqual(projection.previous, networkReferenceOf(previous)));
+        requireNetwork(projection.dns.issuedAt >= previous.dns.issuedAt);
+        for (const old of previous.networks) {
+            const current = projection.networks.find(network => network.id === old.id);
+            if (!current)
+                continue;
+            requireNetwork(current.organizationId === old.organizationId && current.organizationDnsKey === old.organizationDnsKey
+                && current.networkDnsKey === old.networkDnsKey && current.createdAt === old.createdAt && current.revision >= old.revision);
+            if (current.revision === old.revision)
+                requireNetwork(networkEqual(current, old));
+        }
+        for (const old of previous.memberships) {
+            const current = projection.memberships.find(member => ownerKey(member) === ownerKey(old));
+            if (!current)
+                continue;
+            requireNetwork(current.revision >= old.revision);
+            if (current.revision === old.revision)
+                requireNetwork(networkEqual(current, old));
+        }
+        const grants = new Set(grantsOf(projection).map(networkCanonical)), withdrawn = new Set(projection.withdrawals.map(networkCanonical));
+        const previousGrants = grantsOf(previous);
+        for (const grant of previousGrants)
+            requireNetwork(grants.has(networkCanonical(grant)) || withdrawn.has(networkCanonical(grant)));
+        const knownWithdrawals = new Set([...previousGrants, ...previous.withdrawals].map(networkCanonical));
+        requireNetwork(projection.withdrawals.every(grant => knownWithdrawals.has(networkCanonical(grant))));
+        const knownLeases = [...previous.endpoints.map(endpoint => networkReferenceOf(endpoint.lease)), ...previous.retiredLeases];
+        const knownHandoffs = [...(previous.handoff ? [networkReferenceOf(previous.handoff)] : []), ...previous.retiredHandoffs];
+        requireNetwork(projection.retiredLeases.every(retired => knownLeases.some(known => networkEqual(known, retired)))
+            && projection.retiredHandoffs.every(retired => knownHandoffs.some(known => networkEqual(known, retired))));
+        const requireCarried = (old, next) => {
+            for (const reference of old)
+                requireNetwork(next.some(item => networkEqual(item, reference)));
+        };
+        if (applied === null) {
+            for (const grant of previous.withdrawals)
+                requireNetwork(withdrawn.has(networkCanonical(grant)));
+            requireCarried(previous.retiredLeases, projection.retiredLeases);
+            requireCarried(previous.retiredHandoffs, projection.retiredHandoffs);
+        }
+        for (const old of previous.endpoints) {
+            // A different allocation ID cannot rename the same immutable execution attempt.
+            for (const candidate of projection.endpoints) {
+                if (candidate.lease.assignmentId === old.lease.assignmentId || attemptKey(candidate.lease) === attemptKey(old.lease)) {
+                    requireNetwork(networkEqual(candidate.lease, old.lease));
+                }
+            }
+            const current = projection.endpoints.find(item => item.lease.id === old.lease.id);
+            if (current) {
+                requireNetwork(networkEqual(current.lease, old.lease));
+                if (old.observation) {
+                    requireNetwork(current.observation !== null && current.observation.sequence >= old.observation.sequence);
+                    requireNetwork(current.observation.assignment.generation >= old.observation.assignment.generation);
+                    if (current.observation.assignment.generation === old.observation.assignment.generation) {
+                        requireNetwork(networkEqual(current.observation.assignment, old.observation.assignment));
+                    }
+                    if (current.observation.sequence === old.observation.sequence)
+                        requireNetwork(networkEqual(current.observation, old.observation)
+                            && (!current.ready || old.ready));
+                }
+            }
+            else
+                requireNetwork(projection.retiredLeases.some(item => networkEqual(item, networkReferenceOf(old.lease))));
+        }
+        if (previous.handoff && !networkEqual(previous.handoff, projection.handoff))
+            requireNetwork(projection.retiredHandoffs.some(item => networkEqual(item, networkReferenceOf(previous.handoff))));
+        const protection = projection.protectedAuthority, oldProtection = previous.protectedAuthority;
+        requireNetwork(networkEqual(protection, oldProtection) || (protection.id === oldProtection.id
+            && networkEqual(protection.previous, networkReferenceOf(oldProtection))));
+        return { status: 'accepted', projection };
+    }
+    catch {
+        return failNetwork();
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya3Byb2plY3Rpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtwcm9qZWN0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSwyQkFBMkIsRUFBRSwyQkFBMkIsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBRWxHLE9BQU8sRUFBRSxnQ0FBZ0MsRUFBRSwrQ0FBK0MsRUFDeEYsb0NBQW9DLEVBQUUsMENBQTBDLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUVsSCxPQUFPLEVBQUUseUJBQXlCLEVBQUUsdUNBQXVDLEVBQ3pFLHdCQUF3QixFQUFFLGdDQUFnQyxFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDMUYsT0FBTyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLEVBQUUsZUFBZSxFQUFFLGlCQUFpQixFQUFFLGNBQWMsRUFDeEcsYUFBYSxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxpQkFBaUIsRUFBRSxXQUFXLEVBQ2hHLGVBQWUsRUFBRSxtQkFBbUIsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsZUFBZSxFQUMxRyxXQUFXLEVBQUUsYUFBYSxFQUFFLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBeUZwRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzlELG9CQUFvQixFQUFFLDhDQUE4QztJQUNwRSxzQkFBc0IsRUFBRSwwQ0FBMEM7SUFDbEUscUJBQXFCLEVBQUUsT0FBTztJQUM5Qiw0QkFBNEIsRUFBRSxFQUFFO0lBQ2hDLGVBQWUsRUFBRSxHQUFHO0lBQ3BCLGtCQUFrQixFQUFFLEdBQUc7SUFDdkIsZ0JBQWdCLEVBQUUsR0FBRztJQUNyQixhQUFhLEVBQUUsSUFBSTtJQUNuQixpQkFBaUIsRUFBRSxPQUFPO0lBQzFCLGtCQUFrQixFQUFFLENBQUM7SUFDckIsa0JBQWtCLEVBQUUsQ0FBQztJQUNyQixRQUFRLEVBQUUsdUNBQXVDO0lBQ2pELGNBQWMsRUFBRSwyQ0FBMkM7SUFDM0QsZUFBZSxFQUFFLDJDQUEyQztJQUM1RCxlQUFlLEVBQUUsa0VBQWtFO0NBQzNFLENBQUMsQ0FBQztBQUVaLE1BQU0sS0FBSyxHQUFHLENBQUMsSUFBNkIsRUFBOEIsRUFBRSxDQUFDLENBQUM7SUFDNUUsVUFBVSxFQUFFLGlCQUFpQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxNQUFNLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDO0NBQ25JLENBQUMsQ0FBQztBQUNILE1BQU0sU0FBUyxHQUFHLENBQUMsSUFBZ0MsRUFBRSxLQUFpQyxFQUFXLEVBQUUsQ0FDakcsWUFBWSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsQ0FBQyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLE1BQU0sSUFBSSxJQUFJLENBQUMsZ0JBQWdCLEtBQUssS0FBSyxDQUFDLGdCQUFnQixDQUFDO0FBQ3RJLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBb0QsRUFBVSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxLQUFLLENBQUMsY0FBYyxFQUFFLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO0FBQzdJLE1BQU0sVUFBVSxHQUFHLENBQUMsS0FBcUMsRUFBVSxFQUFFLENBQ25FLGdCQUFnQixDQUFDLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7QUFDOUYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxLQUFtQyxFQUFVLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBQzVHLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFjLEVBQWtDLEVBQUUsQ0FDMUUsYUFBYSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLGdCQUFnQixDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7QUFFbkUsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FBQyxLQUFjLEVBQThCLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFLENBQ2hILEtBQUssQ0FBQyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsWUFBWSxFQUFFLFFBQVEsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRTdGLE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQUMsS0FBYyxFQUFrQyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUN4SCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsZUFBZSxFQUFFLElBQUksRUFBRSxZQUFZLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxrQkFBa0I7UUFDaEksZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLG9CQUFvQixFQUFFLHFCQUFxQixFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN4SixjQUFjLENBQUMsSUFBSSxDQUFDLGFBQWEsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUN6QyxNQUFNLEVBQUUsR0FBRyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDLFFBQVEsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO0lBQ3BHLGNBQWMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLEVBQUUsQ0FBQyxVQUFVLENBQUMsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ2hGLE1BQU0sTUFBTSxHQUFHLEVBQUUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3hDLGNBQWMsQ0FBQyxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSw0QkFBNEIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwRixNQUFNLEtBQUssR0FBRyxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN4RCxjQUFjLENBQUMsS0FBSyxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO1dBQ3JELENBQUMsWUFBWSxFQUFFLGVBQWUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLFVBQW9CLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDekgsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxPQUFPLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsR0FBRyxtQkFBbUIsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDN0gsY0FBYyxDQUFDLE9BQU8sS0FBSyxPQUFPLElBQUksRUFBRSxDQUFDLFlBQVksS0FBSyxHQUFHLE9BQU8sS0FBSyxDQUFDLENBQUM7SUFDM0UsS0FBSyxNQUFNLE9BQU8sSUFBSSxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sTUFBTSxHQUFHLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzFDLGNBQWMsQ0FBQyxNQUFNLElBQUksR0FBRyxJQUFJLE1BQU0sSUFBSSxJQUFJLElBQUksQ0FBQyxJQUFJLEdBQUcsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxHQUFHLElBQUksTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMvRyxDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLEtBQUssT0FBTyxDQUFDLENBQUM7SUFDM0MsT0FBTyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsVUFBVSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDO1FBQzVHLGNBQWMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLFlBQVksRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNoSSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxrQkFBa0IsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUM7UUFDekksbUJBQW1CLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLElBQUksRUFBRSxFQUFFLE1BQU0sRUFBRSxTQUFTLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVTtZQUN2SCxPQUFPLEVBQUUsWUFBWSxFQUFFLEVBQUUsQ0FBQyxZQUFZLEVBQUUsT0FBTyxFQUFFLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0FBQ2xILENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FBQyxLQUFxQyxFQUEwQixFQUFFLENBQzFILFdBQVcsQ0FBQyxrQ0FBa0MsQ0FBQyxvQkFBb0IsRUFBRSxxQ0FBcUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBRXJILE1BQU0sV0FBVyxHQUFHLENBQUMsS0FBYyxFQUFnQyxFQUFFO0lBQ25FLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUM3RCxjQUFjLENBQUMsSUFBSSxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksT0FBTyxJQUFJLENBQUMsV0FBVyxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ2xGLE1BQU0sSUFBSSxHQUFJLElBQUksQ0FBQyxXQUF1QyxDQUFDLElBQUksQ0FBQztJQUNoRSxJQUFJLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUN4QixNQUFNLFdBQVcsR0FBRyxhQUFhLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxLQUFLLEdBQUcsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQzFGLGNBQWMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUM3QyxPQUFPLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO0lBQ2xELENBQUM7SUFDRCxJQUFJLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN0QixhQUFhLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxXQUFXLEVBQUUsRUFBRSxJQUFJLEVBQUUsRUFBRSxDQUFDO0lBQ3JILENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sV0FBVyxHQUFHLGFBQWEsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDbkcsY0FBYyxDQUFDLFdBQVcsQ0FBQyxRQUFRLEtBQUssS0FBSyxJQUFJLFdBQVcsQ0FBQyxRQUFRLEtBQUssS0FBSyxDQUFDLENBQUM7SUFDakYsT0FBTyxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQztZQUMzSSxRQUFRLEVBQUUsV0FBVyxDQUFDLFFBQVEsRUFBRSxJQUFJLEVBQUUsY0FBYyxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUFDO0FBQ3RGLENBQUMsQ0FBQztBQUNGLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBYyxFQUE2QixFQUFFO0lBQzdELE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLGFBQWEsRUFBRSxjQUFjLEVBQUUscUJBQXFCLENBQUMsQ0FBQyxDQUFDO0lBQzVHLGNBQWMsQ0FBQyxPQUFPLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sSUFBSSxDQUFDLFlBQVksS0FBSyxTQUFTLENBQUMsQ0FBQztJQUMxRixNQUFNLEtBQUssR0FBRyxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDaEUsSUFBSSxXQUFXLEdBQTZDLElBQUksQ0FBQztJQUNqRSxJQUFJLElBQUksQ0FBQyxXQUFXLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDOUIsTUFBTSxRQUFRLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxZQUFZLEVBQUUsbUJBQW1CLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDNUcsTUFBTSxVQUFVLEdBQUcsYUFBYSxDQUFDLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDaEcsY0FBYyxDQUFDLFVBQVUsQ0FBQyxZQUFZLEtBQUssS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQy9ELFdBQVcsR0FBRyxFQUFFLFVBQVUsRUFBRSxFQUFFLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWSxFQUFFLFVBQVUsRUFBRSxjQUFjLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxhQUFhLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFO1lBQzNKLGlCQUFpQixFQUFFLFNBQVMsQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUMsRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxNQUFNLEVBQUUsYUFBYSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0lBQ3BKLENBQUM7SUFDRCxjQUFjLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxXQUFXLENBQUMsVUFBVSxDQUFDLFVBQVUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pHLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtRQUM3RSxtQkFBbUIsRUFBRSxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQy9HLENBQUMsQ0FBQztBQUVGLHFHQUFxRztBQUNyRyxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLEtBQWMsRUFBK0IsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDbEgsTUFBTSxRQUFRLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZDLGNBQWMsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sSUFBSSxrQ0FBa0MsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3hJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxrQkFBa0I7UUFDL0gsb0JBQW9CLEVBQUUsdUJBQXVCLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFFLGlCQUFpQixFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDekssY0FBYyxDQUFDLElBQUksQ0FBQyxhQUFhLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDekMsTUFBTSxHQUFHLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxVQUFVLEVBQUUsV0FBVyxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDNUUsTUFBTSxNQUFNLEdBQUcsRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxTQUFTLEVBQUUsY0FBYyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsRUFBRSxTQUFTLEVBQUUsY0FBYyxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0lBQzlJLGNBQWMsQ0FBQyxNQUFNLENBQUMsU0FBUyxJQUFJLE1BQU0sQ0FBQyxRQUFRLElBQUksTUFBTSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBUyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEdBQUcsTUFBTSxDQUFDLFFBQVEsSUFBSSxPQUFPLENBQUMsQ0FBQztJQUM1SSxPQUFPLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxHQUFHLGVBQWUsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUM7UUFDakUsa0JBQWtCLEVBQUUsMENBQTBDLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDO1FBQ3ZGLHFCQUFxQixFQUFFLGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLHFCQUFxQixFQUFFLEVBQUUsRUFBRSwwQ0FBMEMsQ0FBQyxFQUFFLE1BQU0sQ0FBQztRQUNySSxPQUFPLEVBQUUsSUFBSSxDQUFDLE9BQU8sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsb0NBQW9DLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUMxRixRQUFRLEVBQUUsYUFBYSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLEdBQUcsRUFBRSx3QkFBd0IsQ0FBQyxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNyRyxXQUFXLEVBQUUsYUFBYSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsV0FBVyxFQUFFLEdBQUcsRUFBRSxnQ0FBZ0MsQ0FBQyxFQUFFLFFBQVEsQ0FBQztRQUMxRyxTQUFTLEVBQUUsYUFBYSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxRQUFRLENBQUMsRUFBRSxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQUUsR0FBRyxFQUFFLE1BQU07UUFDMUcsV0FBVyxFQUFFLGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxJQUFJLEVBQUUsV0FBVyxDQUFDLEVBQUUsZ0JBQWdCLENBQUM7UUFDOUYsYUFBYSxFQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsRUFBRSxlQUFlLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDdkosQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFFBQVEsR0FBRyxDQUFDLFVBQXVDLEVBQWtDLEVBQUU7SUFDM0YsTUFBTSxNQUFNLEdBQW1DLEVBQUUsQ0FBQztJQUNsRCxNQUFNLFdBQVcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM5RixNQUFNLE1BQU0sR0FBRyxDQUFDLEtBQW1DLEVBQUUsRUFBRTtRQUNyRCxjQUFjLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsQ0FBQztRQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDM0QsQ0FBQyxDQUFDO0lBQ0YsS0FBSyxNQUFNLE1BQU0sSUFBSSxVQUFVLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDMUMsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDL0UsS0FBSyxNQUFNLFdBQVcsSUFBSSxVQUFVLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDL0MsSUFBSSxNQUFNLEtBQUssV0FBVyxJQUFJLENBQUMsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxVQUFVLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxDQUFDO2dCQUFFLFNBQVM7WUFDNUgsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7WUFBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDcEYsSUFBSSxNQUFNLENBQUMsY0FBYyxLQUFLLE1BQU0sQ0FBQyxjQUFjLElBQUksTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FDMUYsTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQzlFLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUUsa0JBQWtCLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQ3hJLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQztZQUFFLFNBQVM7UUFDbkQsSUFBSSxNQUFNLENBQUMsWUFBWTtZQUFFLE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUMvRyxLQUFLLE1BQU0sRUFBRSxJQUFJLE1BQU0sQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1lBQzVDLE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxrQkFBa0IsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3hILE1BQU0sQ0FBQyxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsV0FBVyxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxHQUFHLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN2RyxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxHQUFHLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDakcsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsQ0FBQyxLQUFrQyxFQUEwQixFQUFFLENBQ3BILFdBQVcsQ0FBQyxrQ0FBa0MsQ0FBQyxzQkFBc0IsRUFBRSxrQ0FBa0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBRXBILDZHQUE2RztBQUM3RyxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUF3QyxFQUFFO0lBQy9HLElBQUksQ0FBQztRQUNILE1BQU0sVUFBVSxHQUFHLGtDQUFrQyxDQUFDLEtBQUssQ0FBQyxFQUFFLE9BQU8sR0FBRyxVQUFVLENBQUMsa0JBQWtCLENBQUM7UUFDdEcsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsSUFBSSxPQUFPLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQy9HLEtBQUssQ0FBQyxNQUFNLEtBQUssVUFBVSxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0JBQWdCLEtBQUssVUFBVSxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQztRQUNqRyxNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQU8sRUFBRSxHQUFHLFVBQVUsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO1FBQ25FLGNBQWMsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM3RSxLQUFLLE1BQU0sU0FBUyxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQ3BDLGNBQWMsQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVSxDQUFDO21CQUNuRSxTQUFTLENBQUMsTUFBTSxLQUFLLE1BQU0sK0NBQStDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztRQUM5RixDQUFDO1FBQ0QsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLFNBQXVDLEVBQUUsRUFBRTtZQUN0RSxNQUFNLE1BQU0sR0FBRyxXQUFXLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLFNBQVMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7WUFBQyxPQUFPLE1BQU0sQ0FBQztRQUM5SSxDQUFDLENBQUM7UUFDRixJQUFJLFVBQVUsQ0FBQyxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDaEMsTUFBTSxnQ0FBZ0MsQ0FBQyxVQUFVLENBQUMsT0FBTyxFQUFFLG1CQUFtQixDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDO1lBQ3ZILGNBQWMsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO1lBQzFELGNBQWMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssVUFBVSxDQUFDLE9BQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxPQUFPLEtBQUssU0FBUzttQkFDakgsZUFBZSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLE9BQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDcEYsTUFBTSxnQkFBZ0IsR0FBRyxJQUFJLEdBQUcsRUFBa0IsRUFBRSxtQkFBbUIsR0FBRyxJQUFJLEdBQUcsRUFBa0IsQ0FBQztRQUNwRyxNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ2hDLEtBQUssTUFBTSxPQUFPLElBQUksVUFBVSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQzFDLGNBQWMsQ0FBQyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDO1lBQzNDLE1BQU0sR0FBRyxHQUFHLEdBQUcsT0FBTyxDQUFDLGtCQUFrQixJQUFJLE9BQU8sQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUNyRSxjQUFjLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ2hELGNBQWMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLElBQUksZ0JBQWdCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsS0FBSyxPQUFPLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUM3SSxjQUFjLENBQUMsQ0FBQyxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDLElBQUksbUJBQW1CLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUN2SixnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLGNBQWMsRUFBRSxPQUFPLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQ3RKLEtBQUssTUFBTSxRQUFRLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsU0FBUyxJQUFJLEVBQUU7Z0JBQUUsY0FBYyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQ25ILFFBQVEsQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQy9FLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUN2SCxLQUFLLE1BQU0sTUFBTSxJQUFJLFVBQVUsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUM1Qyx1Q0FBdUMsQ0FBQyxNQUFNLEVBQUUsTUFBTSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDMUgsS0FBSyxNQUFNLFVBQVUsSUFBSSxNQUFNLENBQUMsV0FBVztnQkFBRSxLQUFLLE1BQU0sS0FBSyxJQUFJLFVBQVUsQ0FBQyxPQUFPLEVBQUUsQ0FBQztvQkFDcEYsTUFBTSxJQUFJLEdBQUcseUJBQXlCLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxDQUFDLENBQUM7b0JBQ2xGLGNBQWMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztvQkFBQyxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO2dCQUN4RCxDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxFQUFVLEVBQUUsUUFBUSxHQUFHLElBQUksR0FBRyxFQUFVLEVBQUUsYUFBYSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7UUFDdkcsS0FBSyxNQUFNLFFBQVEsSUFBSSxVQUFVLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDNUMsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLEtBQUssRUFBRSxTQUFTLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFDeEYsY0FBYyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQzttQkFDL0YsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUMvRSxXQUFXLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7WUFDckUsSUFBSSxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7Z0JBQ25CLE1BQU0sT0FBTyxHQUFHLGdCQUFnQixDQUFDLENBQUMsS0FBSyxDQUFDLGNBQWMsRUFBRSxLQUFLLENBQUMsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO2dCQUMzRixjQUFjLENBQUMsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7Z0JBQUMsYUFBYSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUMxRSxDQUFDO1lBQ0QsY0FBYyxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssTUFBTSwwQ0FBMEMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1lBQ3pGLGNBQWMsQ0FBQyxTQUFTLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxLQUFLLENBQUMsZ0JBQWdCLENBQUM7bUJBQ3ZJLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLEtBQUssQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLGdCQUFnQixLQUFLLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7WUFDbEksS0FBSyxNQUFNLFVBQVUsSUFBSSxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUM7Z0JBQUUsY0FBYyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQ3pGLElBQUksQ0FBQyxFQUFFLEtBQUssS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxVQUFVLElBQUksZUFBZSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDeEgsSUFBSSxTQUFTLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQztnQkFBRSxjQUFjLENBQUMsVUFBVSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksS0FBSyxDQUFDLG1CQUFtQixLQUFLLFVBQVUsQ0FBQyxPQUFPLENBQUMsbUJBQW1CLENBQUMsQ0FBQztZQUN0SixLQUFLLE1BQU0sRUFBRSxJQUFJLFFBQVEsQ0FBQyxtQkFBbUI7Z0JBQUUsY0FBYyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDOUgsY0FBYyxDQUFDLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzlHLENBQUM7UUFDRCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsVUFBVSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFO1lBQUUsS0FBSyxJQUFJLFFBQVEsR0FBRyxDQUFDLEVBQUUsUUFBUSxHQUFHLEtBQUssRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDO2dCQUN0SCxjQUFjLENBQUMsQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztZQUM1SSxDQUFDO1FBQ0QsSUFBSSxVQUFVLENBQUMsT0FBTztZQUFFLGNBQWMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsT0FBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDcEosTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7UUFDbkUsY0FBYyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzVGLGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLE1BQU0sdUNBQXVDLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUNoRyxPQUFPLFVBQVUsQ0FBQztJQUNwQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUYsaUdBQWlHO0FBQ2pHLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLEtBQUssRUFBRSxLQUFjLEVBQTJDLEVBQUUsQ0FDekgsUUFBUSxDQUFDLE1BQU0sa0NBQWtDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztBQUU1RCwwRkFBMEY7QUFDMUYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUFFLEtBQWMsRUFBdUMsRUFBRTtJQUNySCxNQUFNLFVBQVUsR0FBRyxNQUFNLGtDQUFrQyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ25FLE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsRUFBRSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNwRixNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUMxRixPQUFPLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFDbkcsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFFLENBQUM7UUFDdEQsTUFBTSxNQUFNLEdBQUcsdUNBQXVDLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3pJLE1BQU0sT0FBTyxHQUF3QyxFQUFFLENBQUM7UUFDeEQsS0FBSyxNQUFNLE1BQU0sSUFBSSxVQUFVLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDNUMsSUFBSSxNQUFNLENBQUMsY0FBYyxLQUFLLE1BQU0sQ0FBQyxjQUFjO2dCQUFFLFNBQVM7WUFDOUQsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO2lCQUMxSCxHQUFHLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUN6RCxLQUFLLE1BQU0sVUFBVSxJQUFJLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztnQkFDNUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLFNBQVMsS0FBSyxVQUFVLENBQUMsU0FBUyxDQUFDO29CQUFFLFNBQVM7Z0JBQ3RGLEtBQUssTUFBTSxLQUFLLElBQUksVUFBVSxDQUFDLE9BQU87b0JBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSx5QkFBeUIsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxHQUFHLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNsSyxDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxHQUFHLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMvRCxPQUFPLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxhQUFhLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVMsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUM7SUFDMUosQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUM7QUFFRix1RkFBdUY7QUFDdkYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsS0FBSyxFQUFFLFVBQW1CLEVBQUUsZUFBd0IsRUFBMkMsRUFBRTtJQUM1SixJQUFJLENBQUM7UUFDSCxNQUFNLEtBQUssR0FBRyxxQ0FBcUMsQ0FBQyxVQUFVLENBQUMsRUFBRSxVQUFVLEdBQUcsMkJBQTJCLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0gsY0FBYyxDQUFDLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksU0FBUyxDQUFDLEtBQUssRUFBRSxVQUFVLENBQUM7ZUFDdEcsS0FBSyxDQUFDLGNBQWMsS0FBSyxVQUFVLENBQUMsY0FBYyxJQUFJLEtBQUssQ0FBQyxZQUFZLEtBQUssVUFBVSxDQUFDLFlBQVk7ZUFDcEcsS0FBSyxDQUFDLFNBQVMsS0FBSyxVQUFVLENBQUMsU0FBUyxJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFDLFNBQVMsSUFBSSxLQUFLLENBQUMsU0FBUyxLQUFLLFVBQVUsQ0FBQyxTQUFTO2VBQ2hJLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsRUFBRSxVQUFVLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztlQUNwRSxLQUFLLENBQUMsTUFBTSxLQUFLLE1BQU0sMENBQTBDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUMvRSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsS0FBSyxFQUNsRCxLQUFjLEVBQUUsYUFBNkIsRUFBRSxpQkFBMEIsRUFBRSxvQkFBb0MsRUFDMUIsRUFBRTtJQUN2RixJQUFJLENBQUM7UUFDSCw0RUFBNEU7UUFDNUUsTUFBTSxRQUFRLEdBQUcsa0NBQWtDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0QsTUFBTSxhQUFhLEdBQUcsYUFBYSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxrQ0FBa0MsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUN4RyxNQUFNLE9BQU8sR0FBRyxpQ0FBaUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sT0FBTyxHQUFHLG9CQUFvQixLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxjQUFjLENBQUMsb0JBQW9CLENBQUMsQ0FBQyxDQUFDO1FBQzlHLE1BQU0sVUFBVSxHQUFHLE1BQU0sa0NBQWtDLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDdEUsY0FBYyxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUMvQyxJQUFJLGFBQWEsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUMzQixjQUFjLENBQUMsVUFBVSxDQUFDLFVBQVUsS0FBSyxDQUFDLElBQUksT0FBTyxLQUFLLElBQUksSUFBSSxVQUFVLENBQUMsV0FBVyxDQUFDLE1BQU0sS0FBSyxDQUFDO21CQUNoRyxVQUFVLENBQUMsYUFBYSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksVUFBVSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7WUFDdkYsT0FBTyxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDNUMsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLE1BQU0sa0NBQWtDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDekUsY0FBYyxDQUFDLFNBQVMsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLElBQUksUUFBUSxDQUFDLEVBQUUsS0FBSyxVQUFVLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDOUUsY0FBYyxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksWUFBWSxDQUFDLE9BQU8sRUFBRSxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDeEYsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNsRCxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO1lBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDOUYsQ0FBQztRQUNELGNBQWMsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLFFBQVEsRUFBRSxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDaEYsY0FBYyxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDakUsS0FBSyxNQUFNLEdBQUcsSUFBSSxRQUFRLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDcEMsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMzRSxJQUFJLENBQUMsT0FBTztnQkFBRSxTQUFTO1lBQ3ZCLGNBQWMsQ0FBQyxPQUFPLENBQUMsY0FBYyxLQUFLLEdBQUcsQ0FBQyxjQUFjLElBQUksT0FBTyxDQUFDLGtCQUFrQixLQUFLLEdBQUcsQ0FBQyxrQkFBa0I7bUJBQ2hILE9BQU8sQ0FBQyxhQUFhLEtBQUssR0FBRyxDQUFDLGFBQWEsSUFBSSxPQUFPLENBQUMsU0FBUyxLQUFLLEdBQUcsQ0FBQyxTQUFTLElBQUksT0FBTyxDQUFDLFFBQVEsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDN0gsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLEdBQUcsQ0FBQyxRQUFRO2dCQUFFLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELEtBQUssTUFBTSxHQUFHLElBQUksUUFBUSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3ZDLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFLLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQzFGLElBQUksQ0FBQyxPQUFPO2dCQUFFLFNBQVM7WUFDdkIsY0FBYyxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ2pELElBQUksT0FBTyxDQUFDLFFBQVEsS0FBSyxHQUFHLENBQUMsUUFBUTtnQkFBRSxjQUFjLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ3BGLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDLENBQUMsRUFBRSxTQUFTLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO1FBQ3RJLE1BQU0sY0FBYyxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMxQyxLQUFLLE1BQU0sS0FBSyxJQUFJLGNBQWM7WUFBRSxjQUFjLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xJLE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxHQUFHLENBQUMsQ0FBQyxHQUFHLGNBQWMsRUFBRSxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO1FBQ3JHLGNBQWMsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNyRyxNQUFNLFdBQVcsR0FBRyxDQUFDLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxHQUFHLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzSCxNQUFNLGFBQWEsR0FBRyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxHQUFHLFFBQVEsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUN6SCxjQUFjLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO2VBQzVHLFVBQVUsQ0FBQyxlQUFlLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDN0csTUFBTSxjQUFjLEdBQUcsQ0FBQyxHQUFtQyxFQUFFLElBQW9DLEVBQUUsRUFBRTtZQUNuRyxLQUFLLE1BQU0sU0FBUyxJQUFJLEdBQUc7Z0JBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNoRyxDQUFDLENBQUM7UUFDRixJQUFJLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNyQixLQUFLLE1BQU0sS0FBSyxJQUFJLFFBQVEsQ0FBQyxXQUFXO2dCQUFFLGNBQWMsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNqRyxjQUFjLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxVQUFVLENBQUMsYUFBYSxDQUFDLENBQUM7WUFBQyxjQUFjLENBQUMsUUFBUSxDQUFDLGVBQWUsRUFBRSxVQUFVLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDekksQ0FBQztRQUNELEtBQUssTUFBTSxHQUFHLElBQUksUUFBUSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ3JDLGdGQUFnRjtZQUNoRixLQUFLLE1BQU0sU0FBUyxJQUFJLFVBQVUsQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDN0MsSUFBSSxTQUFTLENBQUMsS0FBSyxDQUFDLFlBQVksS0FBSyxHQUFHLENBQUMsS0FBSyxDQUFDLFlBQVksSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxLQUFLLFVBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztvQkFDckgsY0FBYyxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO2dCQUMzRCxDQUFDO1lBQ0gsQ0FBQztZQUNELE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNsRixJQUFJLE9BQU8sRUFBRSxDQUFDO2dCQUNaLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztnQkFDdkQsSUFBSSxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUM7b0JBQ3BCLGNBQWMsQ0FBQyxPQUFPLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDO29CQUN6RyxjQUFjLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsVUFBVSxJQUFJLEdBQUcsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO29CQUNuRyxJQUFJLE9BQU8sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLFVBQVUsS0FBSyxHQUFHLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUUsQ0FBQzt3QkFDeEYsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7b0JBQzNGLENBQUM7b0JBQ0QsSUFBSSxPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsS0FBSyxHQUFHLENBQUMsV0FBVyxDQUFDLFFBQVE7d0JBQUUsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLEdBQUcsQ0FBQyxXQUFXLENBQUM7K0JBQzNILENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO2dCQUN0QyxDQUFDO1lBQ0gsQ0FBQzs7Z0JBQ0ksY0FBYyxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLElBQUksRUFBRSxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDaEgsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUM7WUFBRSxjQUFjLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDakksWUFBWSxDQUFDLElBQUksRUFBRSxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsT0FBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDOUQsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLGtCQUFrQixFQUFFLGFBQWEsR0FBRyxRQUFRLENBQUMsa0JBQWtCLENBQUM7UUFDOUYsY0FBYyxDQUFDLFlBQVksQ0FBQyxVQUFVLEVBQUUsYUFBYSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxLQUFLLGFBQWEsQ0FBQyxFQUFFO2VBQ3hGLFlBQVksQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLGtCQUFrQixDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzVFLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQzVDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUMifQ==

package/dist_ts/data/networksigning.d.ts

@@ -0,0 +1,46 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReferenceV1, IRuntimeControllerV1 } from './runtimeassignment.js';
+import type { IRuntimeNetworkProjectionV1 } from './networkprojection.js';
+export interface ISignedRuntimeNetworkProjectionV1 {
+    schemaVersion: 1;
+    authority: IRuntimeAuthorityReferenceV1;
+    projection: IRuntimeNetworkProjectionV1;
+    /** Ed25519 signature of the complete domain-separated envelope, lowercase hex. */
+    signature: string;
+}
+export declare const snapshotSignedRuntimeNetworkProjectionV1: (value: unknown) => ISignedRuntimeNetworkProjectionV1;
+/**
+ * Dedicated controller signing authority, installed through the CURRENT authenticated
+ * physical session. Never obtain trusted authority from an envelope being verified.
+ * null revokes signing; rotation requires a new complete signed projection for DNS.
+ * Existing packet grants still require applied denial or independent fencing.
+ */
+export interface IRuntimeNetworkSigningAuthorityV1 {
+    schemaVersion: 1;
+    id: string;
+    generation: number;
+    previous: IRuntimeAuthorityReferenceV1 | null;
+    controller: IRuntimeControllerV1;
+    algorithm: 'Ed25519';
+    /** Canonical 32-byte raw public key, lowercase hex. No private material. */
+    publicKey: string | null;
+    digest: TSha256Digest;
+}
+export declare const runtimeNetworkSigningV1Contract: Readonly<{
+    readonly authorityDigestDomain: "serve.zone/runtime-network-signing-authority-v1";
+    readonly signatureDomain: "serve.zone/runtime-network-projection-signature-v1";
+    readonly trust: "current-authenticated-physical-session-and-durable-revision-fence";
+    readonly rotation: "replace-dns-authority-with-new-signed-projection";
+    readonly revocation: "no-implicit-packet-denial-or-allocation-reuse";
+}>;
+export declare const snapshotRuntimeNetworkSigningAuthorityV1: (value: unknown) => IRuntimeNetworkSigningAuthorityV1;
+export declare const computeRuntimeNetworkSigningAuthorityV1Digest: (value: IRuntimeNetworkSigningAuthorityV1) => Promise<TSha256Digest>;
+/**
+ * Detached content/CAS check. Caller must fence the live peer and commit atomically.
+ * A newly enrolled node bootstraps the controller's CURRENT authority at any generation;
+ * it must not fabricate local history or use this bootstrap path to erase existing trust.
+ */
+export declare const admitRuntimeNetworkSigningAuthorityV1: (value: unknown, previousValue: unknown | null, trustedSessionValue: unknown) => Promise<{
+    status: "accepted" | "replay";
+    authority: IRuntimeNetworkSigningAuthorityV1;
+}>;