@serve.zone/interfaces 31.3.0 → 31.4.0

package/changelog.md

@@ -1,5 +1,52 @@
 # Changelog
 
+## 2026-09-16 - 31.4.0
+
+### Features
+
+- Add the cluster ingress contracts, the first under the rule that a contract carries no version
+  suffix and no schema field: the protocol version is the installed package version.
+  `IClusterRouteTable { revision, issuedAt, routes, portRoutes }` is the whole table a cluster's
+  ingress serves, with `IClusterHttpRoute` (hostname, unicast destinations, the certificate that
+  terminates it, optional Basic authentication) and `IClusterPortRoute` (a TCP or UDP listen port
+  forwarded untouched). `revision` is the feed's only idempotency: a relay and an ingress apply a
+  greater revision and ignore anything else, so a repeated, replayed or crossed push settles the
+  same way. `validateClusterRouteTable` returns one named reason per violation, refuses a second
+  route for one hostname and a second port route for one transport and port, and never quotes
+  certificate material or a password in a reason — a reason travels into logs, and this table
+  carries the private key of every hostname the ingress serves.
+- Add the five methods the feed and its counters travel on: `pushClusterRouteTable` (Cloudly →
+  relay), `getClusterRouteTable` (relay → Cloudly), `getClusterIngressRouteTable` (ingress →
+  relay), `registerClusterIngress` and `getClusterTrafficStatistics` (both one body for two hops:
+  ingress → relay → Cloudly, and Cloudly → relay → ingress). An ingress announces itself through a
+  method rather than a connection tag, so what a relay knows about its ingress is what a server
+  owns. A `null` table means Cloudly has computed none yet — a fact, not an empty table.
+- Authorize the ingress where the authority is. The ingress shares the relay's node listener, so
+  anything reaching it could ask to register and a relay cannot tell an ingress from anything
+  else: `registerClusterIngress` carries the `bearer` Cloudly minted into the ingress workload's
+  assignment environment, the relay forwards it untouched, and Cloudly verifies it and derives the
+  cluster from the identity tag on the relay's own session. The bearer is sensitive ephemeral
+  input on every hop and is never quoted in a reason. Isolation on the shared listener is by
+  authorization, not routing: only the connection whose registration Cloudly accepted is the
+  ingress, and every other connection is refused by name.
+  `validateClusterIngressRegistration` checks shape only.
+- Add `IClusterTrafficStatistics`: one UTC day of one hostname's traffic on one node — requests,
+  bytes in and out, connections and the backend connect, handshake and request failures the proxy
+  can observe — paged exactly like CoreMail's mail statistics, down to the `{ statistics,
+  nextCursor? }` response and the `fromDayUtc`/`toDayUtc`/`cursor`/`limit` request, with `dayUtc`
+  checked against the real calendar through the now-shared UTC calendar-day rule (`2026-13-45` is
+  refused rather than stored; CoreMail's own day check consumes the same helper). Day buckets survive a restart, a
+  poll across midnight and a Cloudly outage, which a rate does not. HTTP status classes are
+  deliberately absent: the proxy exposes no status counters today, and a number the contract
+  cannot source would be a guess.
+- Carry the node's own uplink address on the network report it already sends:
+  `IReportRuntimeNetworkProtectionRequestV1` gains the optional `uplinkAddress`, validated by
+  `runtimeNodeUplinkAddress` as a unicast IPv4 literal that is neither loopback nor link-local.
+  A route to that node's published ports uses exactly this address, and only the node can prove
+  it. Absence stays absent, so a node that states none is told apart from one that states a value,
+  and nothing downstream defaults or infers one. Additive: `networkRecord` now admits declared
+  optional keys, and every existing caller passes none.
+
 ## 2026-09-16 - 31.3.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '31.3.0',
+    version: '31.4.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/clusteringress.d.ts

@@ -0,0 +1,137 @@
+/**
+ * The cluster ingress contracts.
+ *
+ * A cluster's ingress terminates TLS for the hostnames its services publish and
+ * forwards to the host ports Pallet published for the workloads behind them.
+ * Cloudly computes the table — it is the only party that knows every service,
+ * every ready endpoint and every certificate — and the relay carries it to the
+ * ingress and the ingress's counters back.
+ *
+ * Names here carry no version suffix and no schema field: the protocol version
+ * is the installed `@serve.zone/interfaces` version.
+ */
+export declare const clusterIngressLimits: Readonly<{
+    minimumIngressBearerLength: 16;
+    maximumIngressBearerLength: 4096;
+    maximumHostNameLength: 253;
+    maximumRoutes: 4096;
+    maximumPortRoutes: 1024;
+    maximumDestinationsPerRoute: 64;
+    maximumStatisticsPageSize: 1000;
+    maximumCursorLength: 512;
+    maximumIdentifierLength: 200;
+    maximumIngressCapabilities: 32;
+}>;
+/** One backend a route forwards to: an address a node answers on, and its port. */
+export interface IClusterRouteDestination {
+    address: string;
+    port: number;
+}
+/** Basic authentication for a route, as the proxy has always expressed it. */
+export interface IClusterRouteAuthentication {
+    type: 'Basic';
+    user: string;
+    pass: string;
+}
+/**
+ * One hostname the ingress serves.
+ *
+ * `certificate` carries the private key the ingress needs to terminate TLS for
+ * `hostName`. A route table is therefore secret-bearing end to end: it is never
+ * logged, never journaled, never written to disk, and no validation reason
+ * derived from it ever quotes it.
+ */
+export interface IClusterHttpRoute {
+    hostName: string;
+    destinations: IClusterRouteDestination[];
+    certificate: {
+        publicKey: string;
+        privateKey: string;
+    };
+    authentication?: IClusterRouteAuthentication;
+}
+/** One TCP or UDP port the ingress forwards without terminating anything. */
+export interface IClusterPortRoute {
+    name: string;
+    listenPort: number;
+    transport: 'tcp' | 'udp';
+    destinations: IClusterRouteDestination[];
+}
+/**
+ * Everything a cluster's ingress serves, as one table.
+ *
+ * `revision` is the only idempotency the feed has: an ingress and a relay apply
+ * a table whose revision is greater than the one they hold and ignore anything
+ * else, so a repeated push, a replayed push and a push that crossed a newer one
+ * all settle the same way.
+ */
+export interface IClusterRouteTable {
+    revision: number;
+    issuedAt: number;
+    routes: IClusterHttpRoute[];
+    portRoutes: IClusterPortRoute[];
+}
+/**
+ * One day of one hostname's traffic on one node, as the ingress counted it.
+ *
+ * Day buckets rather than rates: a rate answers "how busy is it now", which the
+ * live proxy already answers, while a bucket survives a restart, a poll that
+ * straddles midnight and a Cloudly outage.
+ */
+export interface IClusterTrafficStatistics {
+    serviceId: string;
+    hostName: string;
+    nodeId: string;
+    /** UTC calendar day, `YYYY-MM-DD`. */
+    dayUtc: string;
+    requests: number;
+    bytesIn: number;
+    bytesOut: number;
+    connections: number;
+    /**
+     * What the proxy could observe about its backends. HTTP status classes are
+     * deliberately absent: the proxy exposes no status counters today, and a
+     * number this contract cannot source would be a guess.
+     */
+    backendErrors: {
+        connect: number;
+        handshake: number;
+        request: number;
+    };
+    updatedAt: number;
+}
+/**
+ * A hostname a certificate can be issued for and a browser can present.
+ *
+ * Lowercase labels only, because a certificate names the lowercase form and a
+ * table that carried both would serve one of them without a certificate.
+ */
+export declare const isClusterIngressHostName: (valueArg: unknown) => valueArg is string;
+/**
+ * Validates one route table and names every reason it is refused.
+ *
+ * Shape only. Whether a hostname belongs to the cluster, whether a certificate
+ * matches it, and whether a destination is a node of this cluster are decisions
+ * for the party that computed the table; a table that passes here has claimed
+ * none of them. No reason ever quotes certificate material.
+ */
+export declare const validateClusterRouteTable: (valueArg: unknown, pathArg?: string) => string[];
+/** Validates one day bucket of ingress counters. */
+export declare const validateClusterTrafficStatistics: (valueArg: unknown, pathArg?: string) => string[];
+/**
+ * Validates one page of ingress counters, as a reader receives it.
+ *
+ * The cursor is opaque to everyone but the ingress that issued it: bounded and
+ * printable here, meaningful only there.
+ */
+export declare const validateClusterTrafficStatisticsPage: (valueArg: unknown, pathArg?: string) => string[];
+/**
+ * Validates one cluster ingress registration and names every reason it is refused.
+ *
+ * Shape only, and deliberately so: whether the bearer is the one Cloudly minted
+ * for this cluster's ingress is Cloudly's to verify against its own records, and
+ * which cluster is speaking comes from the identity tag on the relay's session.
+ * A registration that passes here has proven nothing — and no reason it returns
+ * ever quotes the bearer, because a reason travels into logs.
+ */
+export declare const validateClusterIngressRegistration: (valueArg: unknown, pathArg?: string) => string[];

package/dist_ts/data/clusteringress.js

@@ -0,0 +1,302 @@
+import { isPlausibleUnicastIpv4 } from '../private/ipv4.js';
+import { isUtcCalendarDay } from '../private/utccalendarday.js';
+/**
+ * The cluster ingress contracts.
+ *
+ * A cluster's ingress terminates TLS for the hostnames its services publish and
+ * forwards to the host ports Pallet published for the workloads behind them.
+ * Cloudly computes the table — it is the only party that knows every service,
+ * every ready endpoint and every certificate — and the relay carries it to the
+ * ingress and the ingress's counters back.
+ *
+ * Names here carry no version suffix and no schema field: the protocol version
+ * is the installed `@serve.zone/interfaces` version.
+ */
+export const clusterIngressLimits = Object.freeze({
+    minimumIngressBearerLength: 16,
+    maximumIngressBearerLength: 4096,
+    maximumHostNameLength: 253,
+    maximumRoutes: 4096,
+    maximumPortRoutes: 1024,
+    maximumDestinationsPerRoute: 64,
+    maximumStatisticsPageSize: 1000,
+    maximumCursorLength: 512,
+    maximumIdentifierLength: 200,
+    maximumIngressCapabilities: 32,
+});
+const isRecord = (valueArg) => (Boolean(valueArg)
+    && typeof valueArg === 'object'
+    && !Array.isArray(valueArg)
+    && (Object.getPrototypeOf(valueArg) === Object.prototype
+        || Object.getPrototypeOf(valueArg) === null));
+const hasExactKeys = (valueArg, keysArg, optionalKeysArg = []) => {
+    const actualKeys = Object.keys(valueArg);
+    return keysArg.every((keyArg) => actualKeys.includes(keyArg))
+        && actualKeys.every((keyArg) => keysArg.includes(keyArg) || optionalKeysArg.includes(keyArg));
+};
+const isCounter = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg >= 0);
+const isPort = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg >= 1 && valueArg <= 65_535);
+const hostLabelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+// Built from the limit rather than beside it, so the two can never disagree.
+const identifierPattern = new RegExp(`^[A-Za-z0-9][A-Za-z0-9:._-]{0,${clusterIngressLimits.maximumIdentifierLength - 1}}$`);
+/**
+ * A hostname a certificate can be issued for and a browser can present.
+ *
+ * Lowercase labels only, because a certificate names the lowercase form and a
+ * table that carried both would serve one of them without a certificate.
+ */
+export const isClusterIngressHostName = (valueArg) => {
+    if (typeof valueArg !== 'string'
+        || valueArg.length === 0
+        || valueArg.length > clusterIngressLimits.maximumHostNameLength) {
+        return false;
+    }
+    const labels = valueArg.split('.');
+    return labels.length >= 2 && labels.every((labelArg) => hostLabelPattern.test(labelArg));
+};
+const validateDestinations = (valueArg, pathArg) => {
+    if (!Array.isArray(valueArg)
+        || valueArg.length === 0
+        || valueArg.length > clusterIngressLimits.maximumDestinationsPerRoute) {
+        return [`${pathArg} must list 1 to `
+                + `${clusterIngressLimits.maximumDestinationsPerRoute} destinations`];
+    }
+    const errors = [];
+    for (const [index, destination] of valueArg.entries()) {
+        const destinationPath = `${pathArg}[${index}]`;
+        if (!isRecord(destination) || !hasExactKeys(destination, ['address', 'port'])) {
+            errors.push(`${destinationPath} must use its exact schema`);
+            continue;
+        }
+        if (!isPlausibleUnicastIpv4(destination.address)) {
+            errors.push(`${destinationPath} address must be a unicast IPv4 literal`);
+        }
+        if (!isPort(destination.port)) {
+            errors.push(`${destinationPath} port must be an integer from 1 to 65535`);
+        }
+    }
+    return errors;
+};
+const validateCertificate = (valueArg, pathArg) => {
+    // Presence and shape only. The material itself is never described in a reason:
+    // a validation message travels into logs, and this one would carry a key.
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['publicKey', 'privateKey'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (typeof valueArg.publicKey !== 'string' || valueArg.publicKey.length === 0) {
+        errors.push(`${pathArg} publicKey must be a non-empty PEM string`);
+    }
+    if (typeof valueArg.privateKey !== 'string' || valueArg.privateKey.length === 0) {
+        errors.push(`${pathArg} privateKey must be a non-empty PEM string`);
+    }
+    return errors;
+};
+const validateAuthentication = (valueArg, pathArg) => {
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['type', 'user', 'pass'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    return valueArg.type === 'Basic'
+        && typeof valueArg.user === 'string' && valueArg.user.length > 0
+        && typeof valueArg.pass === 'string' && valueArg.pass.length > 0
+        ? []
+        : [`${pathArg} must be Basic authentication with a user and a pass`];
+};
+const validateHttpRoute = (valueArg, pathArg) => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['hostName', 'destinations', 'certificate'], ['authentication'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (!isClusterIngressHostName(valueArg.hostName)) {
+        errors.push(`${pathArg} hostName must be a lowercase dotted hostname a certificate can name`);
+    }
+    errors.push(...validateDestinations(valueArg.destinations, `${pathArg} destinations`));
+    errors.push(...validateCertificate(valueArg.certificate, `${pathArg} certificate`));
+    if (valueArg.authentication !== undefined) {
+        errors.push(...validateAuthentication(valueArg.authentication, `${pathArg} authentication`));
+    }
+    return errors;
+};
+const validatePortRoute = (valueArg, pathArg) => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['name', 'listenPort', 'transport', 'destinations'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (typeof valueArg.name !== 'string' || !identifierPattern.test(valueArg.name)) {
+        errors.push(`${pathArg} name must be a bounded identifier`);
+    }
+    if (!isPort(valueArg.listenPort)) {
+        errors.push(`${pathArg} listenPort must be an integer from 1 to 65535`);
+    }
+    if (valueArg.transport !== 'tcp' && valueArg.transport !== 'udp') {
+        errors.push(`${pathArg} transport must be tcp or udp`);
+    }
+    errors.push(...validateDestinations(valueArg.destinations, `${pathArg} destinations`));
+    return errors;
+};
+/**
+ * Validates one route table and names every reason it is refused.
+ *
+ * Shape only. Whether a hostname belongs to the cluster, whether a certificate
+ * matches it, and whether a destination is a node of this cluster are decisions
+ * for the party that computed the table; a table that passes here has claimed
+ * none of them. No reason ever quotes certificate material.
+ */
+export const validateClusterRouteTable = (valueArg, pathArg = 'cluster route table') => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['revision', 'issuedAt', 'routes', 'portRoutes'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (!isCounter(valueArg.revision)) {
+        errors.push(`${pathArg} revision must be a non-negative safe integer`);
+    }
+    if (!Number.isSafeInteger(valueArg.issuedAt) || valueArg.issuedAt <= 0) {
+        errors.push(`${pathArg} issuedAt must be a positive epoch millisecond timestamp`);
+    }
+    if (!Array.isArray(valueArg.routes)
+        || valueArg.routes.length > clusterIngressLimits.maximumRoutes) {
+        errors.push(`${pathArg} routes must list at most ${clusterIngressLimits.maximumRoutes} routes`);
+    }
+    else {
+        const seenHostNames = new Set();
+        for (const [index, route] of valueArg.routes.entries()) {
+            errors.push(...validateHttpRoute(route, `${pathArg} routes[${index}]`));
+            const hostName = isRecord(route) ? route.hostName : undefined;
+            if (typeof hostName === 'string') {
+                if (seenHostNames.has(hostName)) {
+                    errors.push(`${pathArg} routes[${index}] repeats hostName ${hostName}`);
+                }
+                seenHostNames.add(hostName);
+            }
+        }
+    }
+    if (!Array.isArray(valueArg.portRoutes)
+        || valueArg.portRoutes.length > clusterIngressLimits.maximumPortRoutes) {
+        errors.push(`${pathArg} portRoutes must list at most `
+            + `${clusterIngressLimits.maximumPortRoutes} port routes`);
+    }
+    else {
+        const seenPorts = new Set();
+        for (const [index, portRoute] of valueArg.portRoutes.entries()) {
+            errors.push(...validatePortRoute(portRoute, `${pathArg} portRoutes[${index}]`));
+            if (!isRecord(portRoute)) {
+                continue;
+            }
+            const key = `${String(portRoute.transport)}:${String(portRoute.listenPort)}`;
+            if (seenPorts.has(key)) {
+                errors.push(`${pathArg} portRoutes[${index}] repeats ${key}`);
+            }
+            seenPorts.add(key);
+        }
+    }
+    return errors;
+};
+/** Validates one day bucket of ingress counters. */
+export const validateClusterTrafficStatistics = (valueArg, pathArg = 'cluster traffic statistics') => {
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, [
+        'serviceId', 'hostName', 'nodeId', 'dayUtc', 'requests', 'bytesIn', 'bytesOut',
+        'connections', 'backendErrors', 'updatedAt',
+    ])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    for (const key of ['serviceId', 'nodeId']) {
+        const value = valueArg[key];
+        if (typeof value !== 'string' || !identifierPattern.test(value)) {
+            errors.push(`${pathArg} ${key} must be a bounded identifier`);
+        }
+    }
+    if (!isClusterIngressHostName(valueArg.hostName)) {
+        errors.push(`${pathArg} hostName must be a lowercase dotted hostname`);
+    }
+    if (!isUtcCalendarDay(valueArg.dayUtc)) {
+        errors.push(`${pathArg} dayUtc must be a real YYYY-MM-DD UTC calendar day`);
+    }
+    for (const key of ['requests', 'bytesIn', 'bytesOut', 'connections']) {
+        if (!isCounter(valueArg[key])) {
+            errors.push(`${pathArg} ${key} must be a non-negative safe integer`);
+        }
+    }
+    const backendErrors = valueArg.backendErrors;
+    if (!isRecord(backendErrors)
+        || !hasExactKeys(backendErrors, ['connect', 'handshake', 'request'])
+        || !isCounter(backendErrors.connect)
+        || !isCounter(backendErrors.handshake)
+        || !isCounter(backendErrors.request)) {
+        errors.push(`${pathArg} backendErrors must count connect, handshake and request failures`);
+    }
+    if (!Number.isSafeInteger(valueArg.updatedAt) || valueArg.updatedAt <= 0) {
+        errors.push(`${pathArg} updatedAt must be a positive epoch millisecond timestamp`);
+    }
+    return errors;
+};
+/**
+ * Validates one page of ingress counters, as a reader receives it.
+ *
+ * The cursor is opaque to everyone but the ingress that issued it: bounded and
+ * printable here, meaningful only there.
+ */
+export const validateClusterTrafficStatisticsPage = (valueArg, pathArg = 'cluster traffic statistics page') => {
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['statistics'], ['nextCursor'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (!Array.isArray(valueArg.statistics)
+        || valueArg.statistics.length > clusterIngressLimits.maximumStatisticsPageSize) {
+        errors.push(`${pathArg} statistics must list at most `
+            + `${clusterIngressLimits.maximumStatisticsPageSize} entries`);
+    }
+    else {
+        for (const [index, item] of valueArg.statistics.entries()) {
+            errors.push(...validateClusterTrafficStatistics(item, `${pathArg} statistics[${index}]`));
+        }
+    }
+    if (valueArg.nextCursor !== undefined
+        && (typeof valueArg.nextCursor !== 'string'
+            || valueArg.nextCursor.length === 0
+            || valueArg.nextCursor.length > clusterIngressLimits.maximumCursorLength)) {
+        errors.push(`${pathArg} nextCursor must be 1 to `
+            + `${clusterIngressLimits.maximumCursorLength} characters when present`);
+    }
+    return errors;
+};
+/**
+ * Validates one cluster ingress registration and names every reason it is refused.
+ *
+ * Shape only, and deliberately so: whether the bearer is the one Cloudly minted
+ * for this cluster's ingress is Cloudly's to verify against its own records, and
+ * which cluster is speaking comes from the identity tag on the relay's session.
+ * A registration that passes here has proven nothing — and no reason it returns
+ * ever quotes the bearer, because a reason travels into logs.
+ */
+export const validateClusterIngressRegistration = (valueArg, pathArg = 'cluster ingress registration') => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['bearer', 'version', 'nodeId'], ['capabilities'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (typeof valueArg.bearer !== 'string'
+        || valueArg.bearer.length < clusterIngressLimits.minimumIngressBearerLength
+        || valueArg.bearer.length > clusterIngressLimits.maximumIngressBearerLength) {
+        errors.push(`${pathArg} bearer must be ${clusterIngressLimits.minimumIngressBearerLength} to `
+            + `${clusterIngressLimits.maximumIngressBearerLength} characters`);
+    }
+    if (typeof valueArg.version !== 'string' || !identifierPattern.test(valueArg.version)) {
+        errors.push(`${pathArg} version must be a bounded identifier`);
+    }
+    if (typeof valueArg.nodeId !== 'string' || !identifierPattern.test(valueArg.nodeId)) {
+        errors.push(`${pathArg} nodeId must be a bounded identifier`);
+    }
+    if (valueArg.capabilities !== undefined
+        && (!Array.isArray(valueArg.capabilities)
+            || valueArg.capabilities.length > clusterIngressLimits.maximumIngressCapabilities
+            || !valueArg.capabilities.every((capabilityArg) => (typeof capabilityArg === 'string' && identifierPattern.test(capabilityArg))))) {
+        errors.push(`${pathArg} capabilities must be at most `
+            + `${clusterIngressLimits.maximumIngressCapabilities} bounded identifiers when present`);
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcmluZ3Jlc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJpbmdyZXNzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzVELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRWhFOzs7Ozs7Ozs7OztHQVdHO0FBRUgsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNoRCwwQkFBMEIsRUFBRSxFQUFFO0lBQzlCLDBCQUEwQixFQUFFLElBQUk7SUFDaEMscUJBQXFCLEVBQUUsR0FBRztJQUMxQixhQUFhLEVBQUUsSUFBSTtJQUNuQixpQkFBaUIsRUFBRSxJQUFJO0lBQ3ZCLDJCQUEyQixFQUFFLEVBQUU7SUFDL0IseUJBQXlCLEVBQUUsSUFBSTtJQUMvQixtQkFBbUIsRUFBRSxHQUFHO0lBQ3hCLHVCQUF1QixFQUFFLEdBQUc7SUFDNUIsMEJBQTBCLEVBQUUsRUFBRTtDQUMvQixDQUFDLENBQUM7QUFzRkgsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsQ0FDM0UsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUNkLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDNUIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUN4QixDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssTUFBTSxDQUFDLFNBQVM7V0FDbkQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQ25CLFFBQWlDLEVBQ2pDLE9BQTBCLEVBQzFCLGtCQUFxQyxFQUFFLEVBQzlCLEVBQUU7SUFDWCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pDLE9BQU8sT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztXQUN4RCxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztBQUNsRyxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUMzRCxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLElBQUksQ0FBQyxDQUM1RCxDQUFDO0FBRUYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDeEQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSyxRQUFtQixJQUFJLENBQUMsSUFBSyxRQUFtQixJQUFJLE1BQU0sQ0FDOUYsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsd0NBQXdDLENBQUM7QUFDbEUsNkVBQTZFO0FBQzdFLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxNQUFNLENBQ2xDLGlDQUFpQyxvQkFBb0IsQ0FBQyx1QkFBdUIsR0FBRyxDQUFDLElBQUksQ0FDdEYsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFO0lBQ2hGLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUTtXQUMzQixRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDckIsUUFBUSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1FBQ2xFLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbkMsT0FBTyxNQUFNLENBQUMsTUFBTSxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUMzRixDQUFDLENBQUM7QUFFRixNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUM1RSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7V0FDdkIsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3JCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsMkJBQTJCLEVBQUUsQ0FBQztRQUN4RSxPQUFPLENBQUMsR0FBRyxPQUFPLGtCQUFrQjtrQkFDaEMsR0FBRyxvQkFBb0IsQ0FBQywyQkFBMkIsZUFBZSxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsV0FBVyxDQUFDLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDdEQsTUFBTSxlQUFlLEdBQUcsR0FBRyxPQUFPLElBQUksS0FBSyxHQUFHLENBQUM7UUFDL0MsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxlQUFlLDRCQUE0QixDQUFDLENBQUM7WUFDNUQsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsc0JBQXNCLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUseUNBQXlDLENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUM5QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSwwQ0FBMEMsQ0FBQyxDQUFDO1FBQzVFLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDM0UsK0VBQStFO0lBQy9FLDBFQUEwRTtJQUMxRSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFdBQVcsRUFBRSxZQUFZLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLFFBQVEsQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDJDQUEyQyxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNoRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLHNCQUFzQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUM5RSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzdFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLE9BQU87V0FDM0IsT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQzdELE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQztRQUNoRSxDQUFDLENBQUMsRUFBRTtRQUNKLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTyxzREFBc0QsQ0FBQyxDQUFDO0FBQ3pFLENBQUMsQ0FBQztBQUVGLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQ3pFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFVBQVUsRUFBRSxjQUFjLEVBQUUsYUFBYSxDQUFDLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM5RixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsd0JBQXdCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sc0VBQXNFLENBQUMsQ0FBQztJQUNoRyxDQUFDO0lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsR0FBRyxPQUFPLGVBQWUsQ0FBQyxDQUFDLENBQUM7SUFDdkYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsR0FBRyxPQUFPLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDcEYsSUFBSSxRQUFRLENBQUMsY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxzQkFBc0IsQ0FBQyxRQUFRLENBQUMsY0FBYyxFQUFFLEdBQUcsT0FBTyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7SUFDL0YsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQ3pFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNsRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sb0NBQW9DLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNqQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxnREFBZ0QsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssS0FBSyxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDakUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sK0JBQStCLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsR0FBRyxPQUFPLGVBQWUsQ0FBQyxDQUFDLENBQUM7SUFDdkYsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQ3ZDLFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxxQkFBcUIsRUFDckIsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFVBQVUsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFlBQVksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMvRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLCtDQUErQyxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSyxRQUFRLENBQUMsUUFBbUIsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNuRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywwREFBMEQsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQzlCLFFBQVEsQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDZCQUE2QixvQkFBb0IsQ0FBQyxhQUFhLFNBQVMsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7U0FBTSxDQUFDO1FBQ04sTUFBTSxhQUFhLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUN4QyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQ3ZELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxLQUFLLEVBQUUsR0FBRyxPQUFPLFdBQVcsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1lBQzlELElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQ2pDLElBQUksYUFBYSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO29CQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxXQUFXLEtBQUssc0JBQXNCLFFBQVEsRUFBRSxDQUFDLENBQUM7Z0JBQzFFLENBQUM7Z0JBQ0QsYUFBYSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUM5QixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1dBQ2xDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sZ0NBQWdDO2NBQ2xELEdBQUcsb0JBQW9CLENBQUMsaUJBQWlCLGNBQWMsQ0FBQyxDQUFDO0lBQy9ELENBQUM7U0FBTSxDQUFDO1FBQ04sTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUNwQyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQy9ELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxTQUFTLEVBQUUsR0FBRyxPQUFPLGVBQWUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2hGLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDekIsU0FBUztZQUNYLENBQUM7WUFDRCxNQUFNLEdBQUcsR0FBRyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLElBQUksTUFBTSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQzdFLElBQUksU0FBUyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUN2QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxlQUFlLEtBQUssYUFBYSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ2hFLENBQUM7WUFDRCxTQUFTLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3JCLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsb0RBQW9EO0FBQ3BELE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQzlDLFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyw0QkFBNEIsRUFDNUIsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFO1FBQ2pELFdBQVcsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLFVBQVU7UUFDOUUsYUFBYSxFQUFFLGVBQWUsRUFBRSxXQUFXO0tBQzVDLENBQUMsRUFBRSxDQUFDO1FBQ0gsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQVUsRUFBRSxDQUFDO1FBQ25ELE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM1QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksR0FBRywrQkFBK0IsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLCtDQUErQyxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxvREFBb0QsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsYUFBYSxDQUFVLEVBQUUsQ0FBQztRQUM5RSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDOUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sSUFBSSxHQUFHLHNDQUFzQyxDQUFDLENBQUM7UUFDdkUsQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsYUFBYSxDQUFDO0lBQzdDLElBQUksQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDO1dBQ3ZCLENBQUMsWUFBWSxDQUFDLGFBQWEsRUFBRSxDQUFDLFNBQVMsRUFBRSxXQUFXLEVBQUUsU0FBUyxDQUFDLENBQUM7V0FDakUsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQztXQUNqQyxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDO1dBQ25DLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLG1FQUFtRSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSyxRQUFRLENBQUMsU0FBb0IsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNyRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywyREFBMkQsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLENBQ2xELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxpQ0FBaUMsRUFDakMsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDbkYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNsQyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyx5QkFBeUIsRUFBRSxDQUFDO1FBQ2pGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQztjQUNsRCxHQUFHLG9CQUFvQixDQUFDLHlCQUF5QixVQUFVLENBQUMsQ0FBQztJQUNuRSxDQUFDO1NBQU0sQ0FBQztRQUNOLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7WUFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGdDQUFnQyxDQUFDLElBQUksRUFBRSxHQUFHLE9BQU8sZUFBZSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDNUYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssU0FBUztXQUNoQyxDQUFDLE9BQU8sUUFBUSxDQUFDLFVBQVUsS0FBSyxRQUFRO2VBQ3RDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDaEMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDJCQUEyQjtjQUM3QyxHQUFHLG9CQUFvQixDQUFDLG1CQUFtQiwwQkFBMEIsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyw4QkFBOEIsRUFDOUIsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLEVBQUUsQ0FBQyxjQUFjLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLFFBQVEsQ0FBQyxNQUFNLEtBQUssUUFBUTtXQUNsQyxRQUFRLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEI7V0FDeEUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsMEJBQTBCLEVBQUUsQ0FBQztRQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxtQkFBbUIsb0JBQW9CLENBQUMsMEJBQTBCLE1BQU07Y0FDMUYsR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEIsYUFBYSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUN0RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxJQUFJLE9BQU8sUUFBUSxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDcEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sc0NBQXNDLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsWUFBWSxLQUFLLFNBQVM7V0FDbEMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQztlQUNwQyxRQUFRLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEI7ZUFDOUUsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLGFBQWEsRUFBRSxFQUFFLENBQUMsQ0FDakQsT0FBTyxhQUFhLEtBQUssUUFBUSxJQUFJLGlCQUFpQixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FDM0UsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNSLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQztjQUNsRCxHQUFHLG9CQUFvQixDQUFDLDBCQUEwQixtQ0FBbUMsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==