@serve.zone/interfaces 31.0.0 → 31.2.0

package/changelog.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 2026-09-16 - 31.2.0
+
+### Features
+
+- Add the optional `ICluster.data.relay` block, `IClusterRelayV1 { schemaVersion: 1; origin: string }`:
+  how cluster-side components reach this cluster's relay, absent on a cluster whose nodes still
+  target Cloudly directly, so its presence is what marks a cluster as relayed. `origin` is the
+  exact value a Pallet node stores as its `relayOrigin` — `https:`, an explicit port allowed, no
+  path, query, fragment, userinfo or trailing slash, so `new URL(origin).origin === origin`; a
+  default `:443` and a cased host are therefore not canonical, because `URL` drops the one and
+  lowercases the other. `validateClusterRelayV1(value, pathArg?)` returns one named reason per
+  violation and an empty array for a valid block, following the package's value-free validator
+  shape. The certificate subject is deliberately not a second field: every consumer derives it
+  from the origin with `clusterRelayCertificateDomainName(relay)`, which returns the origin's
+  hostname — the name Cloudly issues the certificate for and owns the A record for — so two
+  fields can never disagree. An origin naming an address literal consequently has no issuable
+  certificate. Additive only: a cluster document without `relay` is unchanged, and nothing was
+  removed or renamed.
+
+## 2026-09-16 - 31.1.0
+
+### Features
+
+- Add the optional `nodeInstanceNonce` to `IRegisterPalletRuntimeSessionRequestV1`: a canonical
+  lowercase UUID, nil rejected, that a Pallet generates once per process start and sends on every
+  registration. It names the registering node process where the transport no longer can, because
+  one cluster relay socket carries the registrations of many nodes. The strict request snapshot
+  validates it when present and keeps it absent otherwise, so a controller can tell a legacy
+  sender from a stated nonce; every other field, key set and rejection is unchanged. The contract
+  now states the registration identity (node, credential generation, node instance nonce), that a
+  controller requires the nonce from a relaying peer and may accept its absence only from a
+  directly connected node, that a changed nonce or generation is a new registration with a new
+  binding and session epoch while an unchanged pair is a replay of the historical binding, and
+  that bearer rotation behind a relay is therefore expressed as a new registration on the same
+  live socket — no carrier reconnect, no disturbance of the other nodes that socket carries.
+  `runtimeSessionV1Contract` gains `nodeInstanceNonceFormat`, `registrationIdentity` and
+  `relayRegistrationRequiresNodeInstanceNonce`. Additive only; nothing was removed or renamed.
+
 ## 2026-09-16 - 31.0.0
 
 ### Breaking Changes

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '31.0.0',
+    version: '31.2.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/cluster.d.ts

@@ -28,5 +28,38 @@ export interface ICluster {
             serverSecret: string;
         };
         sshKeys: plugins.tsclass.network.ISshKey[];
+        /**
+         * How cluster-side components reach this cluster's relay. Absent on a
+         * cluster whose nodes still target Cloudly directly.
+         */
+        relay?: IClusterRelayV1;
     };
 }
+/**
+ * How cluster-side components reach this cluster's relay.
+ *
+ * `origin` is the exact value a Pallet node stores as its `relayOrigin`: an
+ * `https:` origin, an explicit port allowed, with no path, no query, no
+ * fragment, no userinfo and no trailing slash, so that
+ * `new URL(origin).origin === origin`. A default `:443` is therefore written
+ * implicitly, because `URL` drops it from the origin it computes.
+ */
+export interface IClusterRelayV1 {
+    schemaVersion: 1;
+    origin: string;
+}
+/**
+ * Validates one cluster relay block and names every reason it is refused.
+ *
+ * A relay whose origin cannot be trusted verbatim must never reach a node's
+ * identity store: it is the transport authority the node's runtime session
+ * registers over.
+ */
+export declare const validateClusterRelayV1: (valueArg: unknown, pathArg?: string) => string[];
+/**
+ * The name the relay's certificate is issued for, and the A record Cloudly
+ * owns for it. Derived from the origin so every consumer derives it
+ * identically; an origin that names an address literal instead of a domain
+ * therefore has no issuable certificate.
+ */
+export declare const clusterRelayCertificateDomainName: (relayArg: IClusterRelayV1) => string;

package/dist_ts/data/cluster.js

@@ -1,3 +1,72 @@
 import * as plugins from '../plugins.js';
 import {} from '../data/docker.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3Rlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvY2x1c3Rlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEVBQTRCLE1BQU0sbUJBQW1CLENBQUMifQ==
+const maximumClusterRelayOriginLength = 2048;
+const isRecord = (valueArg) => (Boolean(valueArg)
+    && typeof valueArg === 'object'
+    && !Array.isArray(valueArg)
+    && (Object.getPrototypeOf(valueArg) === Object.prototype
+        || Object.getPrototypeOf(valueArg) === null));
+const hasExactKeys = (valueArg, keysArg) => {
+    const actualKeys = Object.keys(valueArg).sort();
+    const expectedKeys = [...keysArg].sort();
+    return actualKeys.length === expectedKeys.length
+        && actualKeys.every((keyArg, indexArg) => keyArg === expectedKeys[indexArg]);
+};
+const validateClusterRelayOrigin = (valueArg, pathArg) => {
+    if (typeof valueArg !== 'string'
+        || valueArg.length === 0
+        || valueArg.length > maximumClusterRelayOriginLength) {
+        return [`${pathArg} must be a string of 1 to ${maximumClusterRelayOriginLength} characters`];
+    }
+    let parsedOrigin;
+    try {
+        parsedOrigin = new URL(valueArg);
+    }
+    catch {
+        return [`${pathArg} must be a parsable URL`];
+    }
+    const errors = [];
+    if (parsedOrigin.protocol !== 'https:') {
+        errors.push(`${pathArg} must use the https scheme`);
+    }
+    if (parsedOrigin.username || parsedOrigin.password) {
+        errors.push(`${pathArg} must not carry userinfo`);
+    }
+    if (parsedOrigin.origin !== valueArg) {
+        errors.push(`${pathArg} must be the canonical origin ${parsedOrigin.origin}, `
+            + 'without a path, query, fragment, trailing slash or default port');
+    }
+    return errors;
+};
+/**
+ * Validates one cluster relay block and names every reason it is refused.
+ *
+ * A relay whose origin cannot be trusted verbatim must never reach a node's
+ * identity store: it is the transport authority the node's runtime session
+ * registers over.
+ */
+export const validateClusterRelayV1 = (valueArg, pathArg = 'cluster relay') => {
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['schemaVersion', 'origin'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (valueArg.schemaVersion !== 1) {
+        errors.push(`${pathArg} schemaVersion must be 1`);
+    }
+    errors.push(...validateClusterRelayOrigin(valueArg.origin, `${pathArg} origin`));
+    return errors;
+};
+/**
+ * The name the relay's certificate is issued for, and the A record Cloudly
+ * owns for it. Derived from the origin so every consumer derives it
+ * identically; an origin that names an address literal instead of a domain
+ * therefore has no issuable certificate.
+ */
+export const clusterRelayCertificateDomainName = (relayArg) => {
+    const errors = validateClusterRelayV1(relayArg);
+    if (errors.length > 0) {
+        throw new Error(errors[0]);
+    }
+    return new URL(relayArg.origin).hostname;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3Rlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvY2x1c3Rlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEVBQTRCLE1BQU0sbUJBQW1CLENBQUM7QUE0RDdELE1BQU0sK0JBQStCLEdBQUcsSUFBSSxDQUFDO0FBRTdDLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUFDLENBQzNFLE9BQU8sQ0FBQyxRQUFRLENBQUM7T0FDZCxPQUFPLFFBQVEsS0FBSyxRQUFRO09BQzVCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7T0FDeEIsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTO1dBQ25ELE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDLENBQy9DLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUNuQixRQUFpQyxFQUNqQyxPQUEwQixFQUNqQixFQUFFO0lBQ1gsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNoRCxNQUFNLFlBQVksR0FBRyxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDekMsT0FBTyxVQUFVLENBQUMsTUFBTSxLQUFLLFlBQVksQ0FBQyxNQUFNO1dBQzNDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFDakYsQ0FBQyxDQUFDO0FBRUYsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDbEYsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQzNCLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNyQixRQUFRLENBQUMsTUFBTSxHQUFHLCtCQUErQixFQUFFLENBQUM7UUFDdkQsT0FBTyxDQUFDLEdBQUcsT0FBTyw2QkFBNkIsK0JBQStCLGFBQWEsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLFlBQWlCLENBQUM7SUFDdEIsSUFBSSxDQUFDO1FBQ0gsWUFBWSxHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsR0FBRyxPQUFPLHlCQUF5QixDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFlBQVksQ0FBQyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsSUFBSSxZQUFZLENBQUMsUUFBUSxJQUFJLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywwQkFBMEIsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFDRCxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDckMsTUFBTSxDQUFDLElBQUksQ0FDVCxHQUFHLE9BQU8saUNBQWlDLFlBQVksQ0FBQyxNQUFNLElBQUk7Y0FDOUQsaUVBQWlFLENBQ3RFLENBQUM7SUFDSixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FDcEMsUUFBaUIsRUFDakIsT0FBTyxHQUFHLGVBQWUsRUFDZixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNqQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywwQkFBMEIsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsMEJBQTBCLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxHQUFHLE9BQU8sU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNqRixPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsUUFBeUIsRUFBVSxFQUFFO0lBQ3JGLE1BQU0sTUFBTSxHQUFHLHNCQUFzQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2hELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFDRCxPQUFPLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUM7QUFDM0MsQ0FBQyxDQUFDIn0=

package/dist_ts/data/runtimesession.d.ts

@@ -24,6 +24,15 @@ export interface IRegisterPalletRuntimeSessionRequestV1 {
     credentialGeneration: number;
     /** Sensitive ephemeral input; exclude the complete request from hooks and logs. */
     bearer: string;
+    /**
+     * Canonical lowercase UUID a Pallet generates once per process start and sends on every
+     * registration. It proves which node process is registering when the transport cannot:
+     * one relay socket carries many nodes, so the physical peer no longer distinguishes a
+     * node restart from a replay. It is not a secret and it grants no authority; the bearer
+     * still authenticates. Absent only from legacy senders, which a controller may accept
+     * exclusively from a directly connected node.
+     */
+    nodeInstanceNonce?: string;
 }
 export interface IApplyRuntimeAssignmentRequestV1 {
     session: IRuntimeSessionBindingV1;
@@ -88,6 +97,11 @@ export declare const runtimeSessionV1Contract: Readonly<{
     readonly maximumRegistryPasswordBytes: 8192;
     readonly registerTransport: "pallet-initiated-wss-on-configured-cloudly-https-origin";
     readonly historicalObservationAuthority: "durable-counter-and-ack-only";
+    readonly nodeInstanceNonceFormat: "canonical-lowercase-uuid-per-node-process";
+    /** The registration a controller must treat as one: a change in any part is a new session. */
+    readonly registrationIdentity: "node-id-and-credential-generation-and-node-instance-nonce";
+    /** A relay socket carries many nodes, so its transport cannot prove a node process. */
+    readonly relayRegistrationRequiresNodeInstanceNonce: true;
     readonly error: "Runtime session contract rejected.";
 }>;
 /** Synchronous detached structural assertion only; never an authentication check. */

package/dist_ts/data/runtimesession.js

@@ -8,6 +8,11 @@ export const runtimeSessionV1Contract = Object.freeze({
     maximumRegistryPasswordBytes: 8192,
     registerTransport: 'pallet-initiated-wss-on-configured-cloudly-https-origin',
     historicalObservationAuthority: 'durable-counter-and-ack-only',
+    nodeInstanceNonceFormat: 'canonical-lowercase-uuid-per-node-process',
+    /** The registration a controller must treat as one: a change in any part is a new session. */
+    registrationIdentity: 'node-id-and-credential-generation-and-node-instance-nonce',
+    /** A relay socket carries many nodes, so its transport cannot prove a node process. */
+    relayRegistrationRequiresNodeInstanceNonce: true,
     error: 'Runtime session contract rejected.',
 });
 const fail = () => { throw new Error(runtimeSessionV1Contract.error); };
@@ -37,6 +42,13 @@ const nodeId = (valueArg) => {
     requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg));
     return valueArg;
 };
+/** One node process, in the same canonical form as the native boot UUID. */
+const nodeInstanceNonce = (valueArg) => {
+    requireValue(typeof valueArg === 'string'
+        && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(valueArg)
+        && valueArg !== '00000000-0000-0000-0000-000000000000');
+    return valueArg;
+};
 /** Bound decoded JSON before canonicalization; copy data descriptors, never getters. */
 const capture = (valueArg) => safe(() => {
     let nodes = 0;
@@ -92,10 +104,11 @@ const capture = (valueArg) => safe(() => {
     requireValue(encoder.encode(serialized).byteLength <= runtimeSessionV1Contract.maximumWireCanonicalBytes);
     return JSON.parse(serialized);
 });
-const record = (valueArg, keysArg) => {
+const record = (valueArg, keysArg, optionalKeysArg = []) => {
     requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
     const keys = Object.keys(valueArg);
-    requireValue(keys.length === keysArg.length && keys.every((key) => keysArg.includes(key)));
+    requireValue(keysArg.every((key) => keys.includes(key))
+        && keys.every((key) => keysArg.includes(key) || optionalKeysArg.includes(key)));
     return valueArg;
 };
 const reference = (valueArg) => {
@@ -124,11 +137,15 @@ const matchesAssignment = (sessionArg, assignmentArg) => sessionArg.nodeId === a
 /** Synchronous detached structural assertion only; never an authentication check. */
 export const snapshotRuntimeSessionBindingV1 = (valueArg) => safe(() => session(capture(valueArg)));
 export const snapshotRegisterPalletRuntimeSessionRequestV1 = (valueArg) => safe(() => {
-    const value = record(capture(valueArg), ['schemaVersion', 'nodeId', 'credentialGeneration', 'bearer']);
+    const value = record(capture(valueArg), ['schemaVersion', 'nodeId', 'credentialGeneration', 'bearer'], ['nodeInstanceNonce']);
     requireValue(value.schemaVersion === 1 && typeof value.bearer === 'string'
         && /^palletToken[0-9a-f]{64}$/.test(value.bearer));
-    return { schemaVersion: 1, nodeId: nodeId(value.nodeId),
+    const request = { schemaVersion: 1, nodeId: nodeId(value.nodeId),
         credentialGeneration: positive(value.credentialGeneration), bearer: value.bearer };
+    // Absence stays absent: a controller distinguishes a legacy sender from a stated nonce.
+    if (Object.hasOwn(value, 'nodeInstanceNonce'))
+        request.nodeInstanceNonce = nodeInstanceNonce(value.nodeInstanceNonce);
+    return request;
 });
 export const snapshotApplyRuntimeAssignmentRequestV1 = (valueArg) => safe(() => {
     const value = record(capture(valueArg), ['session', 'assignment', 'config', 'predecessor']);
@@ -285,4 +302,4 @@ export const bindGetRuntimeRegistryCredentialRequestV1 = async (valueArg, assign
         return fail();
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXNlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVzZXNzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUtyRCxPQUFPLEVBQ0wsK0JBQStCLEVBQUUsc0NBQXNDLEVBQ3ZFLDJCQUEyQixFQUFFLHNDQUFzQyxFQUFFLDJCQUEyQixHQUNqRyxNQUFNLHdCQUF3QixDQUFDO0FBRWhDLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSx1QkFBdUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzlGLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBK0ZyRSxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3BELHlCQUF5QixFQUFFLE9BQU87SUFDbEMsc0JBQXNCLEVBQUUsTUFBTTtJQUM5Qiw0QkFBNEIsRUFBRSxJQUFJO0lBQ2xDLGlCQUFpQixFQUFFLHlEQUF5RDtJQUM1RSw4QkFBOEIsRUFBRSw4QkFBOEI7SUFDOUQsS0FBSyxFQUFFLG9DQUFvQztDQUNuQyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQy9FLFNBQVMsWUFBWSxDQUFDLFlBQXFCO0lBQ3pDLElBQUksQ0FBQyxZQUFZO1FBQUUsSUFBSSxFQUFFLENBQUM7QUFDNUIsQ0FBQztBQUNELE1BQU0sSUFBSSxHQUFHLENBQUksWUFBcUIsRUFBSyxFQUFFO0lBQzNDLElBQUksQ0FBQztRQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDekQsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQztBQUNsQyxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN4RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUM3QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQy9DLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUNBQXFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDbkcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDM0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN0RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRix3RkFBd0Y7QUFDeEYsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUFXLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3hELElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLElBQUksV0FBVyxHQUFHLENBQUMsQ0FBQztJQUNwQixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3BDLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYSxFQUFRLEVBQUU7UUFDdEMsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLElBQUksd0JBQXdCLENBQUMseUJBQXlCLENBQUMsQ0FBQztRQUNqRixXQUFXLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFDaEQsWUFBWSxDQUFDLFdBQVcsSUFBSSx3QkFBd0IsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2xGLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBYyxFQUFFLEtBQWEsRUFBVyxFQUFFO1FBQ3RELFlBQVksQ0FBQyxFQUFFLEtBQUssSUFBSSxNQUFNLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssQ0FBQztRQUFDLENBQUM7UUFDaEUsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDNUYsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ25GLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNuQyxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQy9DLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7WUFDM0csTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNwQyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxHQUFHLENBQUMsQ0FBQztZQUNqQyxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLEVBQUUsS0FBSyxDQUFDO2dCQUN2RSxZQUFZLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQyxJQUFJLE1BQU0sSUFBSSxHQUFHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQ3pHLE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztnQkFDN0IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO29CQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUN6RSxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO29CQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE9BQU8sTUFBTSxDQUFDO1lBQ2hCLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN2QixZQUFZLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUM7Z0JBQ3RDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDYixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUMvRCxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO2dCQUMzRSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO2dCQUFTLENBQUM7WUFBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQUMsQ0FBQztJQUN4QyxDQUFDLENBQUM7SUFDRixNQUFNLFVBQVUsR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hELFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLFVBQVUsSUFBSSx3QkFBd0IsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQzFHLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUNoQyxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUEwQixFQUEyQixFQUFFO0lBQ3hGLFlBQVksQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDM0YsT0FBTyxRQUFtQyxDQUFDO0FBQzdDLENBQUMsQ0FBQztBQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBaUMsRUFBRTtJQUNyRSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMvRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUN4SCxDQUFDLENBQUM7QUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQTRCLEVBQUU7SUFDOUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGVBQWUsRUFBRSxtQkFBbUIsRUFBRSxRQUFRLEVBQUUsc0JBQXNCO1FBQ3BHLGNBQWMsRUFBRSxzQkFBc0IsRUFBRSxZQUFZLEVBQUUsa0JBQWtCLENBQUMsQ0FBQyxDQUFDO0lBQzdFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLFlBQVksQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLFVBQVUsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQztJQUMzRyxPQUFPO1FBQ0wsYUFBYSxFQUFFLENBQUMsRUFBRSxpQkFBaUIsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3RHLG9CQUFvQixFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsb0JBQW9CLENBQUMsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7UUFDdEcsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQztRQUM1RCxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUksRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRTtRQUN6RyxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDO0tBQ3JELENBQUM7QUFDSixDQUFDLENBQUM7QUFDRixNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQWlDLEVBQUUsUUFBa0MsRUFBVyxFQUFFLENBQ3JHLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0MsTUFBTSxTQUFTLEdBQUcsQ0FBQyxPQUFpQyxFQUFFLFFBQWtDLEVBQVcsRUFBRSxDQUNuRyxPQUFPLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLGdCQUFnQixLQUFLLFFBQVEsQ0FBQyxnQkFBZ0I7T0FDekYsU0FBUyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ3RFLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxVQUFvQyxFQUFFLGFBQW1DLEVBQVcsRUFBRSxDQUMvRyxVQUFVLENBQUMsTUFBTSxLQUFLLGFBQWEsQ0FBQyxNQUFNLElBQUksVUFBVSxDQUFDLGdCQUFnQixLQUFLLGFBQWEsQ0FBQyxnQkFBZ0I7T0FDekcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBRTlFLHFGQUFxRjtBQUNyRixNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxDQUFDLFFBQWlCLEVBQTRCLEVBQUUsQ0FDN0YsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXpDLE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLENBQzNELFFBQWlCLEVBQ3VCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3JELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxlQUFlLEVBQUUsUUFBUSxFQUFFLHNCQUFzQixFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDdkcsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRO1dBQ3JFLDJCQUEyQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNyRCxPQUFPLEVBQUUsYUFBYSxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDckQsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDdkYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxRQUFpQixFQUNpQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUMvQyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFlBQVksRUFBRSxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLFVBQVUsR0FBRywyQkFBMkIsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDakUsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNyRix5RkFBeUY7SUFDekYsWUFBWSxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksV0FBVyxDQUFDLFlBQVksS0FBSyxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDM0YsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsdUJBQXVCLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDO0FBQ3JILENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsQ0FDdEQsUUFBaUIsRUFDa0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDaEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLFVBQVUsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFlBQVksQ0FBQyxDQUFDO0lBQ3hHLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxVQUFVLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO0FBQzNFLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sbURBQW1ELEdBQUcsQ0FDakUsUUFBaUIsRUFDNkIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDM0QsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLE9BQU8sRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxXQUFXLEVBQUUsc0NBQXNDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7QUFDckgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSxvREFBb0QsR0FBRyxDQUNsRSxRQUFpQixFQUM4QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUM1RCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsYUFBYSxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDekUsWUFBWSxDQUFDLEtBQUssQ0FBQyxZQUFZLEtBQUssaUJBQWlCLElBQUksS0FBSyxDQUFDLFlBQVksS0FBSyxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3ZHLE9BQU8sRUFBRSxXQUFXLEVBQUUsc0NBQXNDLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFFLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUM7QUFDdEgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDbkUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDdEYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUM1RCxRQUFpQixFQUN3QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUN0RCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQy9FLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxJQUFJLElBQUksSUFBSSxDQUFDLDBCQUEwQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RyxZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3ZFLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLFVBQVUsSUFBSSx3QkFBd0IsQ0FBQyw0QkFBNEI7V0FDbEcsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDcEQsT0FBTyxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDdEcsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsZUFBZSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDdkUsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2pELFlBQVksQ0FBQyxLQUFLLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxPQUFPLFFBQVEsQ0FBQyxHQUFHLEtBQUssUUFBUTtXQUNyRSxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyxzQkFBc0I7V0FDdEUsa0RBQWtELENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVFLE9BQU8sRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLFFBQVEsRUFBRSxFQUFFLEdBQUcsRUFBRSxRQUFRLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQztBQUMvRCxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQzVELFFBQWlCLEVBQ3dCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3RELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ3hELFlBQVksQ0FBQyxLQUFLLENBQUMsVUFBVSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQ3hDLE9BQU8sRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDOUIsQ0FBQyxDQUFDLENBQUM7QUFFSCx5RkFBeUY7QUFDekYsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FDeEQsUUFBaUIsRUFBRSxVQUFtQixFQUNaLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3ZDLE1BQU0sUUFBUSxHQUFHLCtCQUErQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzNELE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFFLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTTtXQUNwRixRQUFRLENBQUMsb0JBQW9CLEtBQUssT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDckUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSCw2R0FBNkc7QUFDN0csTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsQ0FDeEQsUUFBaUIsRUFBRSxNQUFjLEVBQ1EsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDdEQsTUFBTSxRQUFRLEdBQUcsOENBQThDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDMUUsWUFBWSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDcEQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsS0FBSyxFQUN0RCxRQUFpQixFQUFFLGlCQUEwQixFQUNGLEVBQUU7SUFDN0MsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsdUNBQXVDLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDbEUsTUFBTSxjQUFjLEdBQUcsK0JBQStCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUMxRSxZQUFZLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLElBQUksaUJBQWlCLENBQUMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3BILE1BQU0sK0JBQStCLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDMUUsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUVGLG1HQUFtRztBQUNuRyxNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxDQUNsRCxRQUFpQixFQUFFLFVBQW1CLEVBQ0gsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDaEQsTUFBTSxRQUFRLEdBQUcsd0NBQXdDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEUsTUFBTSxPQUFPLEdBQUcsdUNBQXVDLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDcEUsWUFBWSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEgsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUMxQyxVQUFtQixFQUFFLG9CQUE0QixFQUFFLGFBQXNCLEVBQ3pFLGlCQUEwQixFQUFFLGtCQUEyQixFQUNyQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUMvQyxNQUFNLGVBQWUsR0FBRywrQkFBK0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNwRSxNQUFNLGlCQUFpQixHQUFHLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQzNELE1BQU0sVUFBVSxHQUFHLDJCQUEyQixDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLE1BQU0sY0FBYyxHQUFHLCtCQUErQixDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFDMUUsTUFBTSxlQUFlLEdBQUcsK0JBQStCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUM1RSxZQUFZLENBQUMsV0FBVyxDQUFDLGVBQWUsRUFBRSxjQUFjLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxjQUFjLEVBQUUsVUFBVSxDQUFDO1dBQ3JHLGlCQUFpQixLQUFLLGVBQWUsQ0FBQyxpQkFBaUIsSUFBSSxTQUFTLENBQUMsY0FBYyxFQUFFLGVBQWUsQ0FBQyxDQUFDLENBQUM7SUFDNUcsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLGVBQWUsRUFBRSxjQUFjLENBQUMsQ0FBQztJQUM3RCxZQUFZLENBQUMsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLGlCQUFpQixLQUFLLGNBQWMsQ0FBQyxpQkFBaUI7V0FDMUYsZUFBZSxDQUFDLFlBQVksR0FBRyxjQUFjLENBQUMsWUFBWTtXQUMxRCxlQUFlLENBQUMsb0JBQW9CLElBQUksY0FBYyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQztJQUNuRixPQUFPLEVBQUUsT0FBTyxFQUFFLGVBQWUsRUFBRSxVQUFVLEVBQUUsZUFBZTtRQUM1RCxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMscUJBQXFCLEVBQUUsQ0FBQztBQUN4RSxDQUFDLENBQUMsQ0FBQztBQUVIOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLENBQUMsTUFBTSwrQ0FBK0MsR0FBRyxLQUFLLEVBQ2xFLFFBQWlCLEVBQUUsYUFBc0IsRUFBRSxpQkFBMEIsRUFBRSxrQkFBMkIsRUFDbUIsRUFBRTtJQUN2SCxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyxtREFBbUQsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM5RSxNQUFNLE9BQU8sR0FBRyw0QkFBNEIsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEVBQ2pHLGFBQWEsRUFBRSxpQkFBaUIsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3hELFlBQVksQ0FBQyxDQUFDLE1BQU0sc0NBQXNDLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDbkgsT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQ3pELENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUM1QixDQUFDLENBQUM7QUFFRixzRkFBc0Y7QUFDdEYsTUFBTSxDQUFDLE1BQU0sZ0RBQWdELEdBQUcsQ0FDOUQsUUFBaUIsRUFBRSxVQUFtQixFQUNTLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQzVELE1BQU0sUUFBUSxHQUFHLG9EQUFvRCxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2hGLE1BQU0sT0FBTyxHQUFHLG1EQUFtRCxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2hGLFlBQVksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1dBQzFFLFFBQVEsQ0FBQyxZQUFZLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLGlCQUFpQixLQUFLLE9BQU8sQ0FBQyxPQUFPLENBQUMsaUJBQWlCO1lBQ3ZHLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDO0lBQ2xELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUgsa0dBQWtHO0FBQ2xHLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLEtBQUssRUFDNUQsUUFBaUIsRUFBRSxhQUFzQixFQUFFLGlCQUEwQixFQUNwQixFQUFFO0lBQ25ELElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3hFLE1BQU0sVUFBVSxHQUFHLDJCQUEyQixDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sY0FBYyxHQUFHLCtCQUErQixDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDMUUsWUFBWSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxJQUFJLGlCQUFpQixDQUFDLGNBQWMsRUFBRSxVQUFVLENBQUM7ZUFDckcsVUFBVSxDQUFDLFdBQVcsS0FBSyxLQUFLO2VBQ2hDLFNBQVMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLCtCQUErQixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMvRixZQUFZLENBQUMsQ0FBQyxNQUFNLDJCQUEyQixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQzNFLE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUM1QixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXNlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVzZXNzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUtyRCxPQUFPLEVBQ0wsK0JBQStCLEVBQUUsc0NBQXNDLEVBQ3ZFLDJCQUEyQixFQUFFLHNDQUFzQyxFQUFFLDJCQUEyQixHQUNqRyxNQUFNLHdCQUF3QixDQUFDO0FBRWhDLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSx1QkFBdUIsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzlGLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBd0dyRSxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3BELHlCQUF5QixFQUFFLE9BQU87SUFDbEMsc0JBQXNCLEVBQUUsTUFBTTtJQUM5Qiw0QkFBNEIsRUFBRSxJQUFJO0lBQ2xDLGlCQUFpQixFQUFFLHlEQUF5RDtJQUM1RSw4QkFBOEIsRUFBRSw4QkFBOEI7SUFDOUQsdUJBQXVCLEVBQUUsMkNBQTJDO0lBQ3BFLDhGQUE4RjtJQUM5RixvQkFBb0IsRUFBRSwyREFBMkQ7SUFDakYsdUZBQXVGO0lBQ3ZGLDBDQUEwQyxFQUFFLElBQUk7SUFDaEQsS0FBSyxFQUFFLG9DQUFvQztDQUNuQyxDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQy9FLFNBQVMsWUFBWSxDQUFDLFlBQXFCO0lBQ3pDLElBQUksQ0FBQyxZQUFZO1FBQUUsSUFBSSxFQUFFLENBQUM7QUFDNUIsQ0FBQztBQUNELE1BQU0sSUFBSSxHQUFHLENBQUksWUFBcUIsRUFBSyxFQUFFO0lBQzNDLElBQUksQ0FBQztRQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDekQsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQztBQUNsQyxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztBQUN4RixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUM3QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQy9DLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUNBQXFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDbkcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDM0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN0RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRiw0RUFBNEU7QUFDNUUsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUN0RCxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUTtXQUNwQyxnRUFBZ0UsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO1dBQy9FLFFBQVEsS0FBSyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQzFELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQVcsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDeEQsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsSUFBSSxXQUFXLEdBQUcsQ0FBQyxDQUFDO0lBQ3BCLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDcEMsTUFBTSxPQUFPLEdBQUcsQ0FBQyxLQUFhLEVBQVEsRUFBRTtRQUN0QyxZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sSUFBSSx3QkFBd0IsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1FBQ2pGLFdBQVcsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFVBQVUsQ0FBQztRQUNoRCxZQUFZLENBQUMsV0FBVyxJQUFJLHdCQUF3QixDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDbEYsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxJQUFJLEdBQUcsQ0FBQyxLQUFjLEVBQUUsS0FBYSxFQUFXLEVBQUU7UUFDdEQsWUFBWSxDQUFDLEVBQUUsS0FBSyxJQUFJLE1BQU0sSUFBSSxLQUFLLElBQUksRUFBRSxDQUFDLENBQUM7UUFDL0MsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUFDLE9BQU8sS0FBSyxDQUFDO1FBQUMsQ0FBQztRQUNoRSxJQUFJLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVE7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUM1RixZQUFZLENBQUMsS0FBSyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDbkYsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyQixJQUFJLENBQUM7WUFDSCxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ25DLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDL0MsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsU0FBUyxLQUFLLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxJQUFJLFNBQVMsS0FBSyxJQUFJLENBQUMsQ0FBQztZQUMzRyxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3BDLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLEdBQUcsQ0FBQyxDQUFDO1lBQ2pDLElBQUksS0FBSyxFQUFFLENBQUM7Z0JBQ1YsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsRUFBRSxLQUFLLENBQUM7Z0JBQ3ZFLFlBQVksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sSUFBSSxDQUFDLElBQUksTUFBTSxJQUFJLEdBQUcsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztnQkFDekcsTUFBTSxNQUFNLEdBQWMsRUFBRSxDQUFDO2dCQUM3QixLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7b0JBQzVDLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7b0JBQ3pFLFlBQVksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7b0JBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ2pELENBQUM7Z0JBQ0QsT0FBTyxNQUFNLENBQUM7WUFDaEIsQ0FBQztZQUNELE1BQU0sTUFBTSxHQUE0QixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVELEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQ3ZCLFlBQVksQ0FBQyxPQUFPLEdBQUcsS0FBSyxRQUFRLENBQUMsQ0FBQztnQkFDdEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUNiLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUM7Z0JBQy9ELFlBQVksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7Z0JBQzNFLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDbEQsQ0FBQztZQUNELE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUM7Z0JBQVMsQ0FBQztZQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFBQyxDQUFDO0lBQ3hDLENBQUMsQ0FBQztJQUNGLE1BQU0sVUFBVSxHQUFHLFNBQVMsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEQsWUFBWSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsVUFBVSxJQUFJLHdCQUF3QixDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDMUcsT0FBTyxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ2hDLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxNQUFNLEdBQUcsQ0FDYixRQUFpQixFQUFFLE9BQTBCLEVBQUUsa0JBQXFDLEVBQUUsRUFDN0QsRUFBRTtJQUMzQixZQUFZLENBQUMsUUFBUSxLQUFLLElBQUksSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDNUYsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuQyxZQUFZLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztXQUNsRCxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLGVBQWUsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2xGLE9BQU8sUUFBbUMsQ0FBQztBQUM3QyxDQUFDLENBQUM7QUFDRixNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQWlDLEVBQUU7SUFDckUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLGNBQWMsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN6RSxZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxjQUFjLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDL0UsT0FBTyxFQUFFLFlBQVksRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDeEgsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUE0QixFQUFFO0lBQzlELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsbUJBQW1CLEVBQUUsUUFBUSxFQUFFLHNCQUFzQjtRQUNwRyxjQUFjLEVBQUUsc0JBQXNCLEVBQUUsWUFBWSxFQUFFLGtCQUFrQixDQUFDLENBQUMsQ0FBQztJQUM3RSxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLFVBQVUsRUFBRSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNyRSxZQUFZLENBQUMsS0FBSyxDQUFDLGFBQWEsS0FBSyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDM0csT0FBTztRQUNMLGFBQWEsRUFBRSxDQUFDLEVBQUUsaUJBQWlCLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUN0RyxvQkFBb0IsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQ3RHLG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsb0JBQW9CLENBQUM7UUFDNUQsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUU7UUFDekcsZ0JBQWdCLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztLQUNyRCxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBQ0YsTUFBTSxXQUFXLEdBQUcsQ0FBQyxPQUFpQyxFQUFFLFFBQWtDLEVBQVcsRUFBRSxDQUNyRyxTQUFTLENBQUMsT0FBTyxDQUFDLEtBQUssU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQzdDLE1BQU0sU0FBUyxHQUFHLENBQUMsT0FBaUMsRUFBRSxRQUFrQyxFQUFXLEVBQUUsQ0FDbkcsT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxnQkFBZ0IsS0FBSyxRQUFRLENBQUMsZ0JBQWdCO09BQ3pGLFNBQVMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUN0RSxNQUFNLGlCQUFpQixHQUFHLENBQUMsVUFBb0MsRUFBRSxhQUFtQyxFQUFXLEVBQUUsQ0FDL0csVUFBVSxDQUFDLE1BQU0sS0FBSyxhQUFhLENBQUMsTUFBTSxJQUFJLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxhQUFhLENBQUMsZ0JBQWdCO09BQ3pHLFNBQVMsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUU5RSxxRkFBcUY7QUFDckYsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyxRQUFpQixFQUE0QixFQUFFLENBQzdGLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUV6QyxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsZUFBZSxFQUFFLFFBQVEsRUFBRSxzQkFBc0IsRUFBRSxRQUFRLENBQUMsRUFDbkcsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLENBQUM7SUFDekIsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRO1dBQ3JFLDJCQUEyQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNyRCxNQUFNLE9BQU8sR0FBMkMsRUFBRSxhQUFhLEVBQUUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUN0RyxvQkFBb0IsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUNyRix3RkFBd0Y7SUFDeEYsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxtQkFBbUIsQ0FBQztRQUFFLE9BQU8sQ0FBQyxpQkFBaUIsR0FBRyxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsQ0FBQztJQUN0SCxPQUFPLE9BQU8sQ0FBQztBQUNqQixDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLHVDQUF1QyxHQUFHLENBQ3JELFFBQWlCLEVBQ2lCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQy9DLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sVUFBVSxHQUFHLDJCQUEyQixDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNqRSxNQUFNLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ3JGLHlGQUF5RjtJQUN6RixZQUFZLENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxXQUFXLENBQUMsWUFBWSxLQUFLLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUMzRixPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDckgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxDQUN0RCxRQUFpQixFQUNrQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNoRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDbEUsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssVUFBVSxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLENBQUM7SUFDeEcsT0FBTyxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDM0UsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSxtREFBbUQsR0FBRyxDQUNqRSxRQUFpQixFQUM2QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUMzRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDcEUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFdBQVcsRUFBRSxzQ0FBc0MsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztBQUNySCxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLG9EQUFvRCxHQUFHLENBQ2xFLFFBQWlCLEVBQzhCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQzVELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxhQUFhLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUN6RSxZQUFZLENBQUMsS0FBSyxDQUFDLFlBQVksS0FBSyxpQkFBaUIsSUFBSSxLQUFLLENBQUMsWUFBWSxLQUFLLHFCQUFxQixDQUFDLENBQUM7SUFDdkcsT0FBTyxFQUFFLFdBQVcsRUFBRSxzQ0FBc0MsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLEVBQUUsWUFBWSxFQUFFLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQztBQUN0SCxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLENBQzNELFFBQWlCLEVBQ3VCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3JELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUNuRSxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsVUFBVSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztBQUN0RixDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQzVELFFBQWlCLEVBQ3dCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3RELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxVQUFVLEVBQUUsVUFBVSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDL0UsWUFBWSxDQUFDLE9BQU8sS0FBSyxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUN2RSxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxVQUFVLElBQUksSUFBSSxJQUFJLENBQUMsMEJBQTBCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzVHLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxJQUFJLHdCQUF3QixDQUFDLDRCQUE0QjtXQUNsRyxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNwRCxPQUFPLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztBQUN0RyxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLENBQzNELFFBQWlCLEVBQ3VCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3JELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxlQUFlLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUN2RSxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDakQsWUFBWSxDQUFDLEtBQUssQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLEdBQUcsS0FBSyxRQUFRO1dBQ3JFLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxJQUFJLHdCQUF3QixDQUFDLHNCQUFzQjtXQUN0RSxrREFBa0QsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDNUUsT0FBTyxFQUFFLGFBQWEsRUFBRSxDQUFDLEVBQUUsUUFBUSxFQUFFLEVBQUUsR0FBRyxFQUFFLFFBQVEsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDO0FBQy9ELENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FDNUQsUUFBaUIsRUFDd0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDdEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDeEQsWUFBWSxDQUFDLEtBQUssQ0FBQyxVQUFVLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDeEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsQ0FBQztBQUM5QixDQUFDLENBQUMsQ0FBQztBQUVILHlGQUF5RjtBQUN6RixNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUN4RCxRQUFpQixFQUFFLFVBQW1CLEVBQ1osRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDdkMsTUFBTSxRQUFRLEdBQUcsK0JBQStCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDM0QsTUFBTSxPQUFPLEdBQUcsNkNBQTZDLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDMUUsWUFBWSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNO1dBQ3BGLFFBQVEsQ0FBQyxvQkFBb0IsS0FBSyxPQUFPLENBQUMsb0JBQW9CLENBQUMsQ0FBQztJQUNyRSxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMsQ0FBQztBQUVILDZHQUE2RztBQUM3RyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxDQUN4RCxRQUFpQixFQUFFLE1BQWMsRUFDUSxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUN0RCxNQUFNLFFBQVEsR0FBRyw4Q0FBOEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMxRSxZQUFZLENBQUMsUUFBUSxDQUFDLFNBQVMsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNwRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMsQ0FBQztBQUVIOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxLQUFLLEVBQ3RELFFBQWlCLEVBQUUsaUJBQTBCLEVBQ0YsRUFBRTtJQUM3QyxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyx1Q0FBdUMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNsRSxNQUFNLGNBQWMsR0FBRywrQkFBK0IsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzFFLFlBQVksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxjQUFjLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxjQUFjLEVBQUUsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDcEgsTUFBTSwrQkFBK0IsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMxRSxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUYsbUdBQW1HO0FBQ25HLE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLENBQ2xELFFBQWlCLEVBQUUsVUFBbUIsRUFDSCxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNoRCxNQUFNLFFBQVEsR0FBRyx3Q0FBd0MsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNwRSxNQUFNLE9BQU8sR0FBRyx1Q0FBdUMsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNwRSxZQUFZLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsK0JBQStCLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNoSCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMsQ0FBQztBQUVIOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQzFDLFVBQW1CLEVBQUUsb0JBQTRCLEVBQUUsYUFBc0IsRUFDekUsaUJBQTBCLEVBQUUsa0JBQTJCLEVBQ3JCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQy9DLE1BQU0sZUFBZSxHQUFHLCtCQUErQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3BFLE1BQU0saUJBQWlCLEdBQUcsVUFBVSxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDM0QsTUFBTSxVQUFVLEdBQUcsMkJBQTJCLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDdkUsTUFBTSxjQUFjLEdBQUcsK0JBQStCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztJQUMxRSxNQUFNLGVBQWUsR0FBRywrQkFBK0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBQzVFLFlBQVksQ0FBQyxXQUFXLENBQUMsZUFBZSxFQUFFLGNBQWMsQ0FBQyxJQUFJLGlCQUFpQixDQUFDLGNBQWMsRUFBRSxVQUFVLENBQUM7V0FDckcsaUJBQWlCLEtBQUssZUFBZSxDQUFDLGlCQUFpQixJQUFJLFNBQVMsQ0FBQyxjQUFjLEVBQUUsZUFBZSxDQUFDLENBQUMsQ0FBQztJQUM1RyxNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsZUFBZSxFQUFFLGNBQWMsQ0FBQyxDQUFDO0lBQzdELFlBQVksQ0FBQyxPQUFPLElBQUksQ0FBQyxlQUFlLENBQUMsaUJBQWlCLEtBQUssY0FBYyxDQUFDLGlCQUFpQjtXQUMxRixlQUFlLENBQUMsWUFBWSxHQUFHLGNBQWMsQ0FBQyxZQUFZO1dBQzFELGVBQWUsQ0FBQyxvQkFBb0IsSUFBSSxjQUFjLENBQUMsb0JBQW9CLENBQUMsQ0FBQyxDQUFDO0lBQ25GLE9BQU8sRUFBRSxPQUFPLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxlQUFlO1FBQzVELFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO0FBQ3hFLENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7Ozs7R0FVRztBQUNILE1BQU0sQ0FBQyxNQUFNLCtDQUErQyxHQUFHLEtBQUssRUFDbEUsUUFBaUIsRUFBRSxhQUFzQixFQUFFLGlCQUEwQixFQUFFLGtCQUEyQixFQUNtQixFQUFFO0lBQ3ZILElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLG1EQUFtRCxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzlFLE1BQU0sT0FBTyxHQUFHLDRCQUE0QixDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsRUFDakcsYUFBYSxFQUFFLGlCQUFpQixFQUFFLGtCQUFrQixDQUFDLENBQUM7UUFDeEQsWUFBWSxDQUFDLENBQUMsTUFBTSxzQ0FBc0MsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNuSCxPQUFPLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLENBQUM7SUFDekQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUVGLHNGQUFzRjtBQUN0RixNQUFNLENBQUMsTUFBTSxnREFBZ0QsR0FBRyxDQUM5RCxRQUFpQixFQUFFLFVBQW1CLEVBQ1MsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDNUQsTUFBTSxRQUFRLEdBQUcsb0RBQW9ELENBQUMsUUFBUSxDQUFDLENBQUM7SUFDaEYsTUFBTSxPQUFPLEdBQUcsbURBQW1ELENBQUMsVUFBVSxDQUFDLENBQUM7SUFDaEYsWUFBWSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEtBQUssU0FBUyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7V0FDMUUsUUFBUSxDQUFDLFlBQVksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEtBQUssT0FBTyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUI7WUFDdkcsQ0FBQyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7SUFDbEQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSCxrR0FBa0c7QUFDbEcsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxRQUFpQixFQUFFLGFBQXNCLEVBQUUsaUJBQTBCLEVBQ3BCLEVBQUU7SUFDbkQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsNkNBQTZDLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDeEUsTUFBTSxVQUFVLEdBQUcsMkJBQTJCLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7UUFDdkUsTUFBTSxjQUFjLEdBQUcsK0JBQStCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUMxRSxZQUFZLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLElBQUksaUJBQWlCLENBQUMsY0FBYyxFQUFFLFVBQVUsQ0FBQztlQUNyRyxVQUFVLENBQUMsV0FBVyxLQUFLLEtBQUs7ZUFDaEMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsK0JBQStCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQy9GLFlBQVksQ0FBQyxDQUFDLE1BQU0sMkJBQTJCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDM0UsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQyJ9

package/dist_ts/requests/runtimesession.d.ts

@@ -28,7 +28,11 @@ export interface IReq_Controller_Pallet_ApplyRuntimeNetworkProjectionV1 extends
     request: network.IApplyRuntimeNetworkProjectionRequestV1;
     response: network.IApplyRuntimeNetworkAuthorityResponseV1;
 }
-/** WSS-only Pallet bootstrap. Derive physical peer/process/idempotency server-side. */
+/**
+ * WSS-only Pallet bootstrap. Derive physical peer/idempotency server-side; the registering
+ * node process is named by `request.nodeInstanceNonce`, because one relay socket may carry
+ * the registrations of every node in a cluster.
+ */
 export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1 extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1> {
     method: 'registerPalletRuntimeSessionV1';
     request: data.IRegisterPalletRuntimeSessionRequestV1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "31.0.0",
+  "version": "31.2.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -523,7 +523,9 @@ Existing numeric configurations retain their exact meaning and digest.
 `requests.runtimesession` defines `registerPalletRuntimeSessionV1`,
 `applyRuntimeAssignmentV1`, `reportRuntimeAssignmentObservationV1`, and
 `getRuntimeRegistryCredentialV1`. Pallet initiates WSS through its configured
-Cloudly HTTPS origin. The receiver derives the physical peer, process instance
+Cloudly HTTPS origin, or, on a relayed cluster, through the relay origin its
+cluster publishes in [`ICluster.data.relay`](#cluster-relay-block) while Cloudly
+remains the credential authority. The receiver derives the physical peer, process instance
 and registration idempotency; callers cannot supply those authorities. A serialized
 `IRuntimeSessionBindingV1` provides content to compare with authenticated peer
 state and does not itself authenticate a connection. Registry credentials are
@@ -538,6 +540,25 @@ exact body; it cannot restore active readiness, routes or liveness. Those requir
 a fresh observation from the current session. The contract helpers validate and
 classify content; authentication and atomic receipt persistence remain server-owned.
 
+A registration is identified by its node, its credential generation and
+`nodeInstanceNonce`: a canonical lowercase UUID that Pallet generates once per
+process start and sends on every registration. Version 31.1 adds that optional
+field. One physical socket may carry the registrations of many nodes — a cluster
+relay forwards a whole cluster — so the transport alone can no longer tell a
+node restart from a replay. A controller must require the nonce whenever the
+registering peer is such a relay, and may accept its absence only from a
+directly connected node, whose own socket names its process. The nonce is not a
+secret, is not authentication, and grants nothing on its own: the bearer still
+authenticates every registration.
+
+A changed nonce, or a changed credential generation, is a new registration: the
+controller mints a new binding and a new session epoch and fences the node's
+previous session. An unchanged nonce with an unchanged generation is a replay
+and must return the exact historical binding. Bearer rotation therefore needs no
+transport reconnect: a node that rotates behind a relay registers again with its
+unchanged nonce and its new generation on the same live socket, and the other
+nodes that socket carries are untouched.
+
 `registerCloudlyClientSessionV1` separately authenticates a current human or
 machine JWT on a physical TypedSocket so the server can own its identity tag.
 Both registration methods reject HTTP transport. Sensitive requests and registry
@@ -1035,7 +1056,8 @@ const service: data.IService = {
 
 Common data contracts include:
 
-- `ICluster` and `IClusterNode` for cluster membership and provisioning state.
+- `ICluster` and `IClusterNode` for cluster membership and provisioning state, including the
+  optional `ICluster.data.relay` block described below.
 - `IService`, `IDeployment`, `IImage`, `IRegistryTarget`, and `IExternalRegistry` for workload delivery.
 - Service port contracts including `IServiceTargetPort`, `IServiceDomainRoute`, and `IServicePublicPortMapping` for canonical backend targets, domain target references, and edge/Coretraffic TCP/UDP public exposure.
 - `IDomain`, `IDnsEntry`, and traffic contracts for routing and DNS management.
@@ -1061,6 +1083,36 @@ Common data contracts include:
 - `IUser`, JWT-only `IIdentityCredential`, full `IIdentity`, and token-related contracts for authentication context. `IIdentity` extends `IIdentityCredential` with server-issued user metadata.
 - `ICloudlyConfig`, `ICloudlySettings`, status, server, bare-metal, BaseOS, backup, and task execution interfaces for control-plane state.
 
+### Cluster Relay Block
+
+`ICluster.data.relay` is the optional `IClusterRelayV1 { schemaVersion: 1; origin: string }`
+that states how cluster-side components reach this cluster's relay. It is absent on a cluster
+whose nodes still target Cloudly directly, so its presence is what marks a cluster as relayed.
+
+`origin` is the exact value a Pallet node stores as its `relayOrigin` — the origin its runtime
+session registers over, as described in [Authenticated Runtime Sessions](#authenticated-runtime-sessions).
+It must be an `https:` origin with no path, query, fragment, userinfo or trailing slash, so that
+`new URL(origin).origin === origin`; an explicit port is allowed, and because `URL` drops a
+default port and lowercases the host, `https://relay.example:443` and `https://Relay.example`
+are not canonical origins. `validateClusterRelayV1(value, path?)` returns one named reason per
+violation and an empty array for a valid block.
+
+The relay's certificate subject is not a second field: every consumer derives it from the origin
+with `clusterRelayCertificateDomainName(relay)`, which returns the origin's hostname — the name
+Cloudly issues the certificate for and owns the A record for. An origin naming an address literal
+therefore has no issuable certificate.
+
+```typescript
+const relay: data.IClusterRelayV1 = {
+  schemaVersion: 1,
+  origin: 'https://relay.cluster-a.serve.zone:8443',
+};
+
+const reasons = data.validateClusterRelayV1(relay); // []
+const certificateDomainName = data.clusterRelayCertificateDomainName(relay);
+// 'relay.cluster-a.serve.zone'
+```
+
 Shared service port helpers are exported from `data` so Cloudly, App Store resolution, Coreflow, Coretraffic, Onebox, and dcrouter agree on the same normalization rules:
 
 ```typescript

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '31.0.0',
+  version: '31.2.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/cluster.ts

@@ -37,5 +37,109 @@ export interface ICluster {
     };
 
     sshKeys: plugins.tsclass.network.ISshKey[];
+
+    /**
+     * How cluster-side components reach this cluster's relay. Absent on a
+     * cluster whose nodes still target Cloudly directly.
+     */
+    relay?: IClusterRelayV1;
   };
 }
+
+/**
+ * How cluster-side components reach this cluster's relay.
+ *
+ * `origin` is the exact value a Pallet node stores as its `relayOrigin`: an
+ * `https:` origin, an explicit port allowed, with no path, no query, no
+ * fragment, no userinfo and no trailing slash, so that
+ * `new URL(origin).origin === origin`. A default `:443` is therefore written
+ * implicitly, because `URL` drops it from the origin it computes.
+ */
+export interface IClusterRelayV1 {
+  schemaVersion: 1;
+  origin: string;
+}
+
+const maximumClusterRelayOriginLength = 2048;
+
+const isRecord = (valueArg: unknown): valueArg is Record<string, unknown> => (
+  Boolean(valueArg)
+  && typeof valueArg === 'object'
+  && !Array.isArray(valueArg)
+  && (Object.getPrototypeOf(valueArg) === Object.prototype
+    || Object.getPrototypeOf(valueArg) === null)
+);
+
+const hasExactKeys = (
+  valueArg: Record<string, unknown>,
+  keysArg: readonly string[],
+): boolean => {
+  const actualKeys = Object.keys(valueArg).sort();
+  const expectedKeys = [...keysArg].sort();
+  return actualKeys.length === expectedKeys.length
+    && actualKeys.every((keyArg, indexArg) => keyArg === expectedKeys[indexArg]);
+};
+
+const validateClusterRelayOrigin = (valueArg: unknown, pathArg: string): string[] => {
+  if (typeof valueArg !== 'string'
+    || valueArg.length === 0
+    || valueArg.length > maximumClusterRelayOriginLength) {
+    return [`${pathArg} must be a string of 1 to ${maximumClusterRelayOriginLength} characters`];
+  }
+  let parsedOrigin: URL;
+  try {
+    parsedOrigin = new URL(valueArg);
+  } catch {
+    return [`${pathArg} must be a parsable URL`];
+  }
+  const errors: string[] = [];
+  if (parsedOrigin.protocol !== 'https:') {
+    errors.push(`${pathArg} must use the https scheme`);
+  }
+  if (parsedOrigin.username || parsedOrigin.password) {
+    errors.push(`${pathArg} must not carry userinfo`);
+  }
+  if (parsedOrigin.origin !== valueArg) {
+    errors.push(
+      `${pathArg} must be the canonical origin ${parsedOrigin.origin}, `
+        + 'without a path, query, fragment, trailing slash or default port',
+    );
+  }
+  return errors;
+};
+
+/**
+ * Validates one cluster relay block and names every reason it is refused.
+ *
+ * A relay whose origin cannot be trusted verbatim must never reach a node's
+ * identity store: it is the transport authority the node's runtime session
+ * registers over.
+ */
+export const validateClusterRelayV1 = (
+  valueArg: unknown,
+  pathArg = 'cluster relay',
+): string[] => {
+  if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['schemaVersion', 'origin'])) {
+    return [`${pathArg} must use its exact schema`];
+  }
+  const errors: string[] = [];
+  if (valueArg.schemaVersion !== 1) {
+    errors.push(`${pathArg} schemaVersion must be 1`);
+  }
+  errors.push(...validateClusterRelayOrigin(valueArg.origin, `${pathArg} origin`));
+  return errors;
+};
+
+/**
+ * The name the relay's certificate is issued for, and the A record Cloudly
+ * owns for it. Derived from the origin so every consumer derives it
+ * identically; an origin that names an address literal instead of a domain
+ * therefore has no issuable certificate.
+ */
+export const clusterRelayCertificateDomainName = (relayArg: IClusterRelayV1): string => {
+  const errors = validateClusterRelayV1(relayArg);
+  if (errors.length > 0) {
+    throw new Error(errors[0]);
+  }
+  return new URL(relayArg.origin).hostname;
+};

package/ts/data/runtimesession.ts

@@ -36,6 +36,15 @@ export interface IRegisterPalletRuntimeSessionRequestV1 {
   credentialGeneration: number;
   /** Sensitive ephemeral input; exclude the complete request from hooks and logs. */
   bearer: string;
+  /**
+   * Canonical lowercase UUID a Pallet generates once per process start and sends on every
+   * registration. It proves which node process is registering when the transport cannot:
+   * one relay socket carries many nodes, so the physical peer no longer distinguishes a
+   * node restart from a replay. It is not a secret and it grants no authority; the bearer
+   * still authenticates. Absent only from legacy senders, which a controller may accept
+   * exclusively from a directly connected node.
+   */
+  nodeInstanceNonce?: string;
 }
 
 export interface IApplyRuntimeAssignmentRequestV1 {
@@ -111,6 +120,11 @@ export const runtimeSessionV1Contract = Object.freeze({
   maximumRegistryPasswordBytes: 8192,
   registerTransport: 'pallet-initiated-wss-on-configured-cloudly-https-origin',
   historicalObservationAuthority: 'durable-counter-and-ack-only',
+  nodeInstanceNonceFormat: 'canonical-lowercase-uuid-per-node-process',
+  /** The registration a controller must treat as one: a change in any part is a new session. */
+  registrationIdentity: 'node-id-and-credential-generation-and-node-instance-nonce',
+  /** A relay socket carries many nodes, so its transport cannot prove a node process. */
+  relayRegistrationRequiresNodeInstanceNonce: true,
   error: 'Runtime session contract rejected.',
 } as const);
 
@@ -135,6 +149,13 @@ const nodeId = (valueArg: unknown): string => {
   requireValue(typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg));
   return valueArg;
 };
+/** One node process, in the same canonical form as the native boot UUID. */
+const nodeInstanceNonce = (valueArg: unknown): string => {
+  requireValue(typeof valueArg === 'string'
+    && /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(valueArg)
+    && valueArg !== '00000000-0000-0000-0000-000000000000');
+  return valueArg;
+};
 
 /** Bound decoded JSON before canonicalization; copy data descriptors, never getters. */
 const capture = (valueArg: unknown): unknown => safe(() => {
@@ -185,10 +206,13 @@ const capture = (valueArg: unknown): unknown => safe(() => {
   return JSON.parse(serialized);
 });
 
-const record = (valueArg: unknown, keysArg: readonly string[]): Record<string, unknown> => {
+const record = (
+  valueArg: unknown, keysArg: readonly string[], optionalKeysArg: readonly string[] = [],
+): Record<string, unknown> => {
   requireValue(valueArg !== null && typeof valueArg === 'object' && !Array.isArray(valueArg));
   const keys = Object.keys(valueArg);
-  requireValue(keys.length === keysArg.length && keys.every((key) => keysArg.includes(key)));
+  requireValue(keysArg.every((key) => keys.includes(key))
+    && keys.every((key) => keysArg.includes(key) || optionalKeysArg.includes(key)));
   return valueArg as Record<string, unknown>;
 };
 const reference = (valueArg: unknown): IRuntimeAssignmentReferenceV1 => {
@@ -225,11 +249,15 @@ export const snapshotRuntimeSessionBindingV1 = (valueArg: unknown): IRuntimeSess
 export const snapshotRegisterPalletRuntimeSessionRequestV1 = (
   valueArg: unknown,
 ): IRegisterPalletRuntimeSessionRequestV1 => safe(() => {
-  const value = record(capture(valueArg), ['schemaVersion', 'nodeId', 'credentialGeneration', 'bearer']);
+  const value = record(capture(valueArg), ['schemaVersion', 'nodeId', 'credentialGeneration', 'bearer'],
+    ['nodeInstanceNonce']);
   requireValue(value.schemaVersion === 1 && typeof value.bearer === 'string'
     && /^palletToken[0-9a-f]{64}$/.test(value.bearer));
-  return { schemaVersion: 1, nodeId: nodeId(value.nodeId),
+  const request: IRegisterPalletRuntimeSessionRequestV1 = { schemaVersion: 1, nodeId: nodeId(value.nodeId),
     credentialGeneration: positive(value.credentialGeneration), bearer: value.bearer };
+  // Absence stays absent: a controller distinguishes a legacy sender from a stated nonce.
+  if (Object.hasOwn(value, 'nodeInstanceNonce')) request.nodeInstanceNonce = nodeInstanceNonce(value.nodeInstanceNonce);
+  return request;
 });
 
 export const snapshotApplyRuntimeAssignmentRequestV1 = (

package/ts/requests/runtimesession.ts

@@ -41,7 +41,11 @@ export interface IReq_Controller_Pallet_ApplyRuntimeNetworkProjectionV1 extends
   response: network.IApplyRuntimeNetworkAuthorityResponseV1;
 }
 
-/** WSS-only Pallet bootstrap. Derive physical peer/process/idempotency server-side. */
+/**
+ * WSS-only Pallet bootstrap. Derive physical peer/idempotency server-side; the registering
+ * node process is named by `request.nodeInstanceNonce`, because one relay socket may carry
+ * the registrations of every node in a cluster.
+ */
 export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1 extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,
   IReq_Pallet_Cloudly_RegisterPalletRuntimeSessionV1