@serve.zone/interfaces 31.3.0 → 31.5.0

package/dist_ts/private/networkcontract.js

@@ -66,10 +66,14 @@ export const captureNetwork = (value) => networkSafe(() => {
     requireNetwork(encoder.encode(networkCanonical(result)).length <= 1_048_576);
     return result;
 });
-export const networkRecord = (value, keys) => {
+export const networkRecord = (value, keys, optionalKeys = []) => {
     requireNetwork(value !== null && typeof value === 'object' && !Array.isArray(value));
     const actual = Object.keys(value);
-    requireNetwork(actual.length === keys.length && keys.every(key => Object.hasOwn(value, key)));
+    // Absence stays absent: a stated optional key is read, an omitted one is not
+    // defaulted, so a receiver can tell a sender that stated nothing from one that
+    // stated a value.
+    requireNetwork(keys.every(key => Object.hasOwn(value, key))
+        && actual.every(key => keys.includes(key) || optionalKeys.includes(key)));
     return value;
 };
 export const networkList = (value, maximum, read) => {
@@ -131,4 +135,4 @@ export const networkOverlaps = (left, right) => {
     const [a, b] = networkPrefixBounds(left), [c, d] = networkPrefixBounds(right);
     return a <= d && c <= b;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcHJpdmF0ZS9uZXR3b3JrY29udHJhY3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLHNCQUFzQixFQUFFLDRCQUE0QixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFMUYsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM5RyxNQUFNLFVBQVUsY0FBYyxDQUFDLEtBQWMsSUFBbUIsSUFBSSxDQUFDLEtBQUs7SUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFDNUYsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsQ0FBQztBQUN2RyxNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsQ0FBQyxJQUFhLEVBQUUsS0FBYyxFQUFXLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUMzSCxNQUFNLENBQUMsTUFBTSxXQUFXLEdBQUcsQ0FBSSxTQUFrQixFQUFLLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFBQyxPQUFPLFNBQVMsRUFBRSxDQUFDO0FBQUMsQ0FBQztBQUFDLE1BQU0sQ0FBQztJQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7QUFBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXpILDJGQUEyRjtBQUMzRixNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUcsQ0FBQyxLQUFjLEVBQVcsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUUsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLEVBQUUsRUFBRSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNqRSxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQztJQUN6QixNQUFNLE9BQU8sR0FBRyxDQUFDLElBQVksRUFBRSxFQUFFO1FBQy9CLGNBQWMsQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLFNBQVMsQ0FBQyxDQUFDO1FBQ3pDLEtBQUssSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQztRQUNyQyxjQUFjLENBQUMsS0FBSyxJQUFJLFNBQVMsQ0FBQyxDQUFDO0lBQ3JDLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsSUFBYSxFQUFFLEtBQWEsRUFBVyxFQUFFO1FBQ3JELGNBQWMsQ0FBQyxFQUFFLEtBQUssSUFBSSxNQUFNLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ2pELElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7WUFBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7WUFBQyxPQUFPLElBQUksQ0FBQztRQUFDLENBQUM7UUFDN0QsSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFNBQVM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUM1RCxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzdCLGNBQWMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQUMsT0FBTyxJQUFJLENBQUM7UUFDbEYsQ0FBQztRQUNELGNBQWMsQ0FBQyxJQUFJLEtBQUssSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUNsRixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3pHLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDN0csY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLENBQUM7UUFDcEMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNwQixJQUFJLENBQUM7WUFDSCxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLEVBQUUsS0FBSyxDQUFDO2dCQUN0RSxjQUFjLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQyxJQUFJLE1BQU0sSUFBSSxJQUFJLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQzVHLE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztnQkFDN0IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO29CQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUN4RSxjQUFjLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO29CQUM3RSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE9BQU8sTUFBTSxDQUFDO1lBQ2hCLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN2QixjQUFjLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUM7Z0JBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUN0RCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUM5RCxjQUFjLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO2dCQUM3RSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO2dCQUFTLENBQUM7WUFBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQUMsQ0FBQztJQUN2QyxDQUFDLENBQUM7SUFDRixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzlCLGNBQWMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxJQUFJLFNBQVMsQ0FBQyxDQUFDO0lBQzdFLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFHLENBQUMsS0FBYyxFQUFFLElBQWMsRUFBMkIsRUFBRTtJQUN2RixjQUFjLENBQUMsS0FBSyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDckYsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNsQyxjQUFjLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsTUFBTSxJQUFJLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUYsT0FBTyxLQUFnQyxDQUFDO0FBQzFDLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBRyxDQUFJLEtBQWMsRUFBRSxPQUFlLEVBQUUsSUFBMEIsRUFBTyxFQUFFO0lBQ2pHLGNBQWMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLENBQUM7SUFBQyxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDMUYsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFHLENBQUksTUFBVyxFQUFFLEdBQXdCLEVBQU8sRUFBRTtJQUM3RSxjQUFjLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssS0FBSyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQUMsT0FBTyxNQUFNLENBQUM7QUFDcEgsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDbEQsY0FBYyxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUFDLE9BQU8sS0FBSyxDQUFDO0FBQy9HLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFPLEdBQUcsTUFBTSxDQUFDLGdCQUFnQixHQUFHLENBQUMsRUFBVSxFQUFFO0lBQzlGLGNBQWMsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxJQUFJLEtBQUssSUFBSSxPQUFPLENBQUMsQ0FBQztJQUFDLE9BQU8sS0FBSyxDQUFDO0FBQzFILENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBaUIsRUFBRTtJQUM3RCxjQUFjLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQUMsT0FBTyxLQUFzQixDQUFDO0FBQ2xILENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYyxFQUF3QixFQUFFO0lBQ3hFLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDM0QsY0FBYyxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDbEUsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDbkYsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFjLEVBQWdDLEVBQUU7SUFDL0UsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNsRSxPQUFPLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsVUFBVSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsTUFBTSxFQUFFLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUNySCxDQUFDLENBQUM7QUFDRixNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLEtBQW1DLEVBQWdDLEVBQUUsQ0FDdEcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUN6RSxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxJQUE2QixFQUFFLEVBQUU7SUFDL0QsTUFBTSxFQUFFLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxVQUFVLEdBQUcsY0FBYyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUM1RSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakYsY0FBYyxDQUFDLFVBQVUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssVUFBVSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3JILE9BQU8sRUFBRSxFQUFFLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQ3RDLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBRyxLQUFLLEVBQUUsTUFBYyxFQUFFLEtBQWdDLEVBQTBCLEVBQUU7SUFDNUcsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRyxLQUFLLENBQUM7SUFDOUMsT0FBTyxVQUFVLE1BQU0sNEJBQTRCLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUMsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO0FBQzVHLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBVSxFQUFFO0lBQ3BELGNBQWMsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNoRSxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQy9CLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3ZILE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxLQUFhLEVBQVUsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFLENBQUMsR0FBRyxHQUFHLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFDaEksTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxLQUFhLEVBQW9CLEVBQUU7SUFDckUsTUFBTSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUM3RSxPQUFPLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDdkQsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsS0FBYSxFQUFFLEtBQWEsRUFBVyxFQUFFO0lBQ3ZFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxDQUFDLENBQUM7SUFBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUMxRyxDQUFDLENBQUM7QUFDRixNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxJQUFZLEVBQUUsS0FBYSxFQUFXLEVBQUU7SUFDdEUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ3pHLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NvbnRyYWN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvcHJpdmF0ZS9uZXR3b3JrY29udHJhY3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLHNCQUFzQixFQUFFLDRCQUE0QixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFMUYsTUFBTSxDQUFDLE1BQU0sV0FBVyxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM5RyxNQUFNLFVBQVUsY0FBYyxDQUFDLEtBQWMsSUFBbUIsSUFBSSxDQUFDLEtBQUs7SUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFDNUYsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRSxDQUFDLHNCQUFzQixDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsQ0FBQztBQUN2RyxNQUFNLENBQUMsTUFBTSxZQUFZLEdBQUcsQ0FBQyxJQUFhLEVBQUUsS0FBYyxFQUFXLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUMzSCxNQUFNLENBQUMsTUFBTSxXQUFXLEdBQUcsQ0FBSSxTQUFrQixFQUFLLEVBQUUsR0FBRyxJQUFJLENBQUM7SUFBQyxPQUFPLFNBQVMsRUFBRSxDQUFDO0FBQUMsQ0FBQztBQUFDLE1BQU0sQ0FBQztJQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7QUFBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXpILDJGQUEyRjtBQUMzRixNQUFNLENBQUMsTUFBTSxjQUFjLEdBQUcsQ0FBQyxLQUFjLEVBQVcsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUUsTUFBTSxPQUFPLEdBQUcsSUFBSSxXQUFXLEVBQUUsRUFBRSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNqRSxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQztJQUN6QixNQUFNLE9BQU8sR0FBRyxDQUFDLElBQVksRUFBRSxFQUFFO1FBQy9CLGNBQWMsQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLFNBQVMsQ0FBQyxDQUFDO1FBQ3pDLEtBQUssSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQztRQUNyQyxjQUFjLENBQUMsS0FBSyxJQUFJLFNBQVMsQ0FBQyxDQUFDO0lBQ3JDLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsSUFBYSxFQUFFLEtBQWEsRUFBVyxFQUFFO1FBQ3JELGNBQWMsQ0FBQyxFQUFFLEtBQUssSUFBSSxNQUFNLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ2pELElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7WUFBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7WUFBQyxPQUFPLElBQUksQ0FBQztRQUFDLENBQUM7UUFDN0QsSUFBSSxJQUFJLEtBQUssSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFNBQVM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUM1RCxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQzdCLGNBQWMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQUMsT0FBTyxJQUFJLENBQUM7UUFDbEYsQ0FBQztRQUNELGNBQWMsQ0FBQyxJQUFJLEtBQUssSUFBSSxJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUNsRixNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxFQUFFLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ3pHLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDN0csY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLENBQUM7UUFDcEMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNwQixJQUFJLENBQUM7WUFDSCxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxJQUFJLEVBQUUsUUFBUSxDQUFDLEVBQUUsS0FBSyxDQUFDO2dCQUN0RSxjQUFjLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQyxJQUFJLE1BQU0sSUFBSSxJQUFJLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQzVHLE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztnQkFDN0IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO29CQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUN4RSxjQUFjLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO29CQUM3RSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE9BQU8sTUFBTSxDQUFDO1lBQ2hCLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN2QixjQUFjLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUM7Z0JBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUN0RCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUM5RCxjQUFjLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO2dCQUM3RSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO2dCQUFTLENBQUM7WUFBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQUMsQ0FBQztJQUN2QyxDQUFDLENBQUM7SUFDRixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzlCLGNBQWMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxJQUFJLFNBQVMsQ0FBQyxDQUFDO0lBQzdFLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFHLENBQzNCLEtBQWMsRUFBRSxJQUFjLEVBQUUsZUFBeUIsRUFBRSxFQUNsQyxFQUFFO0lBQzNCLGNBQWMsQ0FBQyxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNyRixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ2xDLDZFQUE2RTtJQUM3RSwrRUFBK0U7SUFDL0Usa0JBQWtCO0lBQ2xCLGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsR0FBRyxDQUFDLENBQUM7V0FDdEQsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksWUFBWSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDNUUsT0FBTyxLQUFnQyxDQUFDO0FBQzFDLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBRyxDQUFJLEtBQWMsRUFBRSxPQUFlLEVBQUUsSUFBMEIsRUFBTyxFQUFFO0lBQ2pHLGNBQWMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLENBQUM7SUFBQyxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7QUFDMUYsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0sYUFBYSxHQUFHLENBQUksTUFBVyxFQUFFLEdBQXdCLEVBQU8sRUFBRTtJQUM3RSxjQUFjLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssS0FBSyxDQUFDLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQUMsT0FBTyxNQUFNLENBQUM7QUFDcEgsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDbEQsY0FBYyxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUFDLE9BQU8sS0FBSyxDQUFDO0FBQy9HLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLGNBQWMsR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFPLEdBQUcsTUFBTSxDQUFDLGdCQUFnQixHQUFHLENBQUMsRUFBVSxFQUFFO0lBQzlGLGNBQWMsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLEdBQUcsQ0FBQyxJQUFJLEtBQUssSUFBSSxPQUFPLENBQUMsQ0FBQztJQUFDLE9BQU8sS0FBSyxDQUFDO0FBQzFILENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBaUIsRUFBRTtJQUM3RCxjQUFjLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQUMsT0FBTyxLQUFzQixDQUFDO0FBQ2xILENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYyxFQUF3QixFQUFFO0lBQ3hFLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDM0QsY0FBYyxDQUFDLElBQUksQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDbEUsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLEtBQUssRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDbkYsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxLQUFjLEVBQWdDLEVBQUU7SUFDL0UsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNsRSxPQUFPLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsVUFBVSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsTUFBTSxFQUFFLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUNySCxDQUFDLENBQUM7QUFDRixNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLEtBQW1DLEVBQWdDLEVBQUUsQ0FDdEcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztBQUN6RSxNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxJQUE2QixFQUFFLEVBQUU7SUFDL0QsTUFBTSxFQUFFLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxVQUFVLEdBQUcsY0FBYyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUM1RSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDakYsY0FBYyxDQUFDLFVBQVUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssVUFBVSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3JILE9BQU8sRUFBRSxFQUFFLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQ3RDLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBRyxLQUFLLEVBQUUsTUFBYyxFQUFFLEtBQWdDLEVBQTBCLEVBQUU7SUFDNUcsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRyxLQUFLLENBQUM7SUFDOUMsT0FBTyxVQUFVLE1BQU0sNEJBQTRCLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUMsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO0FBQzVHLENBQUMsQ0FBQztBQUNGLE1BQU0sQ0FBQyxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBVSxFQUFFO0lBQ3BELGNBQWMsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUMsQ0FBQztJQUNoRSxNQUFNLEtBQUssR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQy9CLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMseUJBQXlCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ3ZILE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxLQUFhLEVBQVUsRUFBRSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsR0FBRyxFQUFFLElBQUksRUFBRSxFQUFFLENBQUMsR0FBRyxHQUFHLEdBQUcsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFDaEksTUFBTSxDQUFDLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxLQUFhLEVBQW9CLEVBQUU7SUFDckUsTUFBTSxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsR0FBRyxLQUFLLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUM3RSxPQUFPLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDdkQsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxDQUFDLE1BQU0sZUFBZSxHQUFHLENBQUMsS0FBYSxFQUFFLEtBQWEsRUFBVyxFQUFFO0lBQ3ZFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEdBQUcsbUJBQW1CLENBQUMsS0FBSyxDQUFDLENBQUM7SUFBQyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUMxRyxDQUFDLENBQUM7QUFDRixNQUFNLENBQUMsTUFBTSxlQUFlLEdBQUcsQ0FBQyxJQUFZLEVBQUUsS0FBYSxFQUFXLEVBQUU7SUFDdEUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsR0FBRyxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0FBQ3pHLENBQUMsQ0FBQyJ9

package/dist_ts/private/utccalendarday.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The UTC calendar day every consumer of this package agrees on.
+ *
+ * Two facts, deliberately separate: whether a value has the canonical shape, and whether that
+ * shape names a day that exists. `2026-13-45` passes the first and fails the second, and a
+ * caller that only checked the pattern would store a day no clock can ever produce.
+ */
+export declare const utcCalendarDayPattern: RegExp;
+/**
+ * Whether a canonical `YYYY-MM-DD` string names a real day.
+ *
+ * Round-trips through `Date.UTC`, which normalises an impossible day into a neighbouring one:
+ * a value that survives the round trip unchanged is the day it claims to be.
+ */
+export declare const isRealUtcCalendarDay: (valueArg: string) => boolean;
+/** Both facts at once, for a caller that reports one reason. */
+export declare const isUtcCalendarDay: (valueArg: unknown) => valueArg is string;

package/dist_ts/private/utccalendarday.js

@@ -0,0 +1,27 @@
+/**
+ * The UTC calendar day every consumer of this package agrees on.
+ *
+ * Two facts, deliberately separate: whether a value has the canonical shape, and whether that
+ * shape names a day that exists. `2026-13-45` passes the first and fails the second, and a
+ * caller that only checked the pattern would store a day no clock can ever produce.
+ */
+export const utcCalendarDayPattern = /^[0-9]{4}-[0-9]{2}-[0-9]{2}$/;
+/**
+ * Whether a canonical `YYYY-MM-DD` string names a real day.
+ *
+ * Round-trips through `Date.UTC`, which normalises an impossible day into a neighbouring one:
+ * a value that survives the round trip unchanged is the day it claims to be.
+ */
+export const isRealUtcCalendarDay = (valueArg) => {
+    if (!utcCalendarDayPattern.test(valueArg)) {
+        return false;
+    }
+    const [year, month, day] = valueArg.split('-').map(Number);
+    const parsed = new Date(Date.UTC(year, month - 1, day));
+    return parsed.getUTCFullYear() === year
+        && parsed.getUTCMonth() + 1 === month
+        && parsed.getUTCDate() === day;
+};
+/** Both facts at once, for a caller that reports one reason. */
+export const isUtcCalendarDay = (valueArg) => (typeof valueArg === 'string' && isRealUtcCalendarDay(valueArg));
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidXRjY2FsZW5kYXJkYXkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9wcml2YXRlL3V0Y2NhbGVuZGFyZGF5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLDhCQUE4QixDQUFDO0FBRXBFOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxRQUFnQixFQUFXLEVBQUU7SUFDaEUsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzFDLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLEdBQUcsQ0FBQyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQzNELE1BQU0sTUFBTSxHQUFHLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLEtBQUssR0FBRyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUN4RCxPQUFPLE1BQU0sQ0FBQyxjQUFjLEVBQUUsS0FBSyxJQUFJO1dBQ2xDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsR0FBRyxDQUFDLEtBQUssS0FBSztXQUNsQyxNQUFNLENBQUMsVUFBVSxFQUFFLEtBQUssR0FBRyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGLGdFQUFnRTtBQUNoRSxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN6RSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksb0JBQW9CLENBQUMsUUFBUSxDQUFDLENBQy9ELENBQUMifQ==

package/dist_ts/requests/cluster.d.ts

@@ -83,6 +83,23 @@ export interface IReq_Any_Cloudly_DisableClusterRelayV1 extends plugins.typedreq
         relay: null;
     };
 }
+/**
+ * The relay registrations an administrator asks Cloudly about.
+ *
+ * Read-only: it answers with what Cloudly accepted, plus whether a verified socket carries each
+ * relay at this instant. `clusterIds` narrows the answer to the named clusters; omitting it asks
+ * for every cluster whose relay ever registered.
+ */
+export interface IReq_Any_Cloudly_GetClusterRelayRegistrations extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetClusterRelayRegistrations> {
+    method: 'getClusterRelayRegistrations';
+    request: {
+        identity: userInterfaces.IIdentity;
+        clusterIds?: string[];
+    };
+    response: {
+        registrations: clusterInterfaces.IClusterRelayRegistration[];
+    };
+}
 /**
  * The cluster relay tells Cloudly where it listens, over its own authenticated socket.
  *

package/dist_ts/requests/clusteringress.d.ts

@@ -0,0 +1,120 @@
+import * as clusterIngressInterfaces from '../data/clusteringress.js';
+import * as plugins from '../plugins.js';
+/**
+ * Cloudly hands a cluster's relay the table its ingress serves.
+ *
+ * Cloudly computes it: it is the only party that knows every service, every
+ * ready endpoint, the node address each published port answers on and the
+ * certificate each hostname needs. The relay caches it in memory and serves it
+ * to the ingress; it never authors one.
+ *
+ * The table carries private keys, so this request is secret-bearing: exclude it
+ * from hooks, logs and journals on both sides.
+ */
+export interface IReq_Cloudly_Relay_PushClusterRouteTable extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_Relay_PushClusterRouteTable> {
+    method: 'pushClusterRouteTable';
+    request: {
+        table: clusterIngressInterfaces.IClusterRouteTable;
+    };
+    response: {
+        /**
+         * The revision the relay now holds. Lower than the pushed revision means
+         * the relay already held a newer table and kept it.
+         */
+        appliedRevision: number;
+    };
+}
+/**
+ * The relay asks for the current table.
+ *
+ * Its own session decides which cluster it speaks for, so the request carries no
+ * cluster of its own. `null` means Cloudly has computed no table yet — a fact,
+ * not an empty table, which the relay must not serve as one.
+ */
+export interface IReq_Relay_Cloudly_GetClusterRouteTable extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Relay_Cloudly_GetClusterRouteTable> {
+    method: 'getClusterRouteTable';
+    request: Record<string, never>;
+    response: {
+        table: clusterIngressInterfaces.IClusterRouteTable | null;
+    };
+}
+/**
+ * The cluster ingress announces itself, and Cloudly decides whether it is one.
+ *
+ * One body for both hops: the ingress sends it to its relay, and the relay
+ * forwards it to Cloudly untouched. The relay cannot decide this — anything that
+ * reaches its listener could ask — so the bearer Cloudly minted into the ingress
+ * workload's assignment environment is what authorizes the registration, and
+ * Cloudly derives which cluster is speaking from the identity tag on the relay's
+ * own session, never from a request field.
+ *
+ * A method, not a connection tag: what a relay knows about its ingress is what
+ * it registered through, which a server owns, rather than a label a client
+ * authored. Only an accepted registration binds the connection; every other
+ * ingress method is answered for that connection alone.
+ *
+ * `revision` is the table the relay holds, so an accepted ingress knows at once
+ * whether it has to fetch one. Cloudly answers `null`: the table is the relay's
+ * to state, not Cloudly's to echo.
+ */
+export interface IReq_Ingress_Relay_Cloudly_RegisterClusterIngress extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Ingress_Relay_Cloudly_RegisterClusterIngress> {
+    method: 'registerClusterIngress';
+    request: {
+        /**
+         * Sensitive ephemeral input: exclude the complete request from hooks, logs,
+         * diagnostics and durable journals on every hop. Cloudly mints it into the
+         * ingress workload's assignment environment and verifies it here.
+         */
+        bearer: string;
+        /** The ingress build that registered, for operators reading a relay's log. */
+        version: string;
+        /** The node this ingress runs on, as its assignment names it. */
+        nodeId: string;
+        /** Optional capability names; an ingress that states none states nothing. */
+        capabilities?: string[];
+    };
+    response: {
+        accepted: true;
+        revision: number | null;
+    };
+}
+/**
+ * The ingress fetches the table the relay holds.
+ *
+ * `knownRevision` is what the ingress already applied: the relay answers `null`
+ * when it holds nothing newer, so a reconnect costs one round trip and not a
+ * certificate transfer.
+ */
+export interface IReq_Ingress_Relay_GetClusterIngressRouteTable extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Ingress_Relay_GetClusterIngressRouteTable> {
+    method: 'getClusterIngressRouteTable';
+    request: {
+        knownRevision: number | null;
+    };
+    response: {
+        table: clusterIngressInterfaces.IClusterRouteTable | null;
+    };
+}
+/**
+ * One page of the ingress's day-bucketed counters.
+ *
+ * The same body travels Cloudly → relay and relay → ingress: the relay carries
+ * the request to the ingress that answers it and the page back, adding nothing.
+ * A reader re-reads yesterday and today on every pass, because a day only stops
+ * changing once it has closed.
+ */
+export interface IReq_Any_Ingress_GetClusterTrafficStatistics extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Ingress_GetClusterTrafficStatistics> {
+    method: 'getClusterTrafficStatistics';
+    request: {
+        /** Inclusive first UTC calendar day, `YYYY-MM-DD`. */
+        fromDayUtc: string;
+        /** Inclusive last UTC calendar day, `YYYY-MM-DD`. */
+        toDayUtc: string;
+        /** Opaque ingress-owned cursor. */
+        cursor?: string;
+        limit: number;
+    };
+    response: {
+        statistics: clusterIngressInterfaces.IClusterTrafficStatistics[];
+        nextCursor?: string;
+    };
+}

package/dist_ts/requests/clusteringress.js

@@ -0,0 +1,3 @@
+import * as clusterIngressInterfaces from '../data/clusteringress.js';
+import * as plugins from '../plugins.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcmluZ3Jlc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9jbHVzdGVyaW5ncmVzcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssd0JBQXdCLE1BQU0sMkJBQTJCLENBQUM7QUFDdEUsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUMifQ==

package/dist_ts/requests/index.d.ts

@@ -5,6 +5,7 @@ import * as baseOsRequests from './baseos.js';
 import * as backupRequests from './backup.js';
 import * as certificateRequests from './certificate.js';
 import * as clusterRequests from './cluster.js';
+import * as clusterIngressRequests from './clusteringress.js';
 import * as configRequests from './config.js';
 import * as coreMailRequests from './coremail.js';
 import * as coreMailAdminRequests from './coremail.admin.js';
@@ -34,7 +35,7 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';

package/dist_ts/requests/index.js

@@ -6,6 +6,7 @@ import * as baseOsRequests from './baseos.js';
 import * as backupRequests from './backup.js';
 import * as certificateRequests from './certificate.js';
 import * as clusterRequests from './cluster.js';
+import * as clusterIngressRequests from './clusteringress.js';
 import * as configRequests from './config.js';
 import * as coreMailRequests from './coremail.js';
 import * as coreMailAdminRequests from './coremail.admin.js';
@@ -35,9 +36,9 @@ import * as statusRequests from './status.js';
 import * as taskRequests from './task.js';
 import * as versionRequests from './version.js';
 import * as webPushRequests from './webpush.js';
-export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
+export { adminRequests as admin, appStoreRequests as appstore, baremetalRequests as baremetal, baseOsRequests as baseos, backupRequests as backup, certificateRequests as certificate, clusterRequests as cluster, clusterIngressRequests as clusteringress, configRequests as config, coreMailRequests as coremail, coreMailAdminRequests as coremailAdmin, corestoreRequests as corestore, deploymentRequests as deployment, dnsRequests as dns, domainRequests as domain, externalRegistryRequests as externalRegistry, gatewayRequests as gateway, hostedAppRequests as hostedapp, identityRequests as identity, imageRequests as image, informRequests as inform, logRequests as log, mailRequests as mail, migrationRequests as migration, networkRequests as network, nodeRequests as node, palletRequests as pallet, platformRequests as platform, routingRequests as routing, runtimeSessionRequests as runtimesession, secretRequests as secret, serviceRequests as service, settingsRequests as settings, statusRequests as status, taskRequests as task, versionRequests as version, webPushRequests as webpush, };
 export * from './inform.js';
 export * from './hostedapp.js';
 export * from './mail.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLGdCQUFnQixNQUFNLGVBQWUsQ0FBQztBQUNsRCxPQUFPLEtBQUsscUJBQXFCLE1BQU0scUJBQXFCLENBQUM7QUFDN0QsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxrQkFBa0IsTUFBTSxpQkFBaUIsQ0FBQztBQUN0RCxPQUFPLEtBQUssV0FBVyxNQUFNLFVBQVUsQ0FBQztBQUN4QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssd0JBQXdCLE1BQU0sdUJBQXVCLENBQUM7QUFDbEUsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGFBQWEsTUFBTSxZQUFZLENBQUM7QUFDNUMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGlCQUFpQixNQUFNLGdCQUFnQixDQUFDO0FBQ3BELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLHNCQUFzQixNQUFNLHFCQUFxQixDQUFDO0FBQzlELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLFlBQVksTUFBTSxXQUFXLENBQUM7QUFDMUMsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFFaEQsT0FBTyxFQUNMLGFBQWEsSUFBSSxLQUFLLEVBQ3RCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsaUJBQWlCLElBQUksU0FBUyxFQUM5QixjQUFjLElBQUksTUFBTSxFQUN4QixjQUFjLElBQUksTUFBTSxFQUN4QixtQkFBbUIsSUFBSSxXQUFXLEVBQ2xDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIscUJBQXFCLElBQUksYUFBYSxFQUN0QyxpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsc0JBQXNCLElBQUksY0FBYyxFQUN4QyxjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9yZXF1ZXN0cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEtBQUssYUFBYSxNQUFNLFlBQVksQ0FBQztBQUM1QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssbUJBQW1CLE1BQU0sa0JBQWtCLENBQUM7QUFDeEQsT0FBTyxLQUFLLGVBQWUsTUFBTSxjQUFjLENBQUM7QUFDaEQsT0FBTyxLQUFLLHNCQUFzQixNQUFNLHFCQUFxQixDQUFDO0FBQzlELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxnQkFBZ0IsTUFBTSxlQUFlLENBQUM7QUFDbEQsT0FBTyxLQUFLLHFCQUFxQixNQUFNLHFCQUFxQixDQUFDO0FBQzdELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssa0JBQWtCLE1BQU0saUJBQWlCLENBQUM7QUFDdEQsT0FBTyxLQUFLLFdBQVcsTUFBTSxVQUFVLENBQUM7QUFDeEMsT0FBTyxLQUFLLGNBQWMsTUFBTSxhQUFhLENBQUM7QUFDOUMsT0FBTyxLQUFLLHdCQUF3QixNQUFNLHVCQUF1QixDQUFDO0FBQ2xFLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxhQUFhLE1BQU0sWUFBWSxDQUFDO0FBQzVDLE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxXQUFXLE1BQU0sVUFBVSxDQUFDO0FBQ3hDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxpQkFBaUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUNwRCxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssWUFBWSxNQUFNLFdBQVcsQ0FBQztBQUMxQyxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxzQkFBc0IsTUFBTSxxQkFBcUIsQ0FBQztBQUM5RCxPQUFPLEtBQUssY0FBYyxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEtBQUssZUFBZSxNQUFNLGNBQWMsQ0FBQztBQUNoRCxPQUFPLEtBQUssZ0JBQWdCLE1BQU0sZUFBZSxDQUFDO0FBQ2xELE9BQU8sS0FBSyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQzlDLE9BQU8sS0FBSyxZQUFZLE1BQU0sV0FBVyxDQUFDO0FBQzFDLE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBQ2hELE9BQU8sS0FBSyxlQUFlLE1BQU0sY0FBYyxDQUFDO0FBRWhELE9BQU8sRUFDTCxhQUFhLElBQUksS0FBSyxFQUN0QixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsbUJBQW1CLElBQUksV0FBVyxFQUNsQyxlQUFlLElBQUksT0FBTyxFQUMxQixzQkFBc0IsSUFBSSxjQUFjLEVBQ3hDLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIscUJBQXFCLElBQUksYUFBYSxFQUN0QyxpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGtCQUFrQixJQUFJLFVBQVUsRUFDaEMsV0FBVyxJQUFJLEdBQUcsRUFDbEIsY0FBYyxJQUFJLE1BQU0sRUFDeEIsd0JBQXdCLElBQUksZ0JBQWdCLEVBQzVDLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGlCQUFpQixJQUFJLFNBQVMsRUFDOUIsZ0JBQWdCLElBQUksUUFBUSxFQUM1QixhQUFhLElBQUksS0FBSyxFQUN0QixjQUFjLElBQUksTUFBTSxFQUN4QixXQUFXLElBQUksR0FBRyxFQUNsQixZQUFZLElBQUksSUFBSSxFQUNwQixpQkFBaUIsSUFBSSxTQUFTLEVBQzlCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLGdCQUFnQixJQUFJLFFBQVEsRUFDNUIsZUFBZSxJQUFJLE9BQU8sRUFDMUIsc0JBQXNCLElBQUksY0FBYyxFQUN4QyxjQUFjLElBQUksTUFBTSxFQUN4QixlQUFlLElBQUksT0FBTyxFQUMxQixnQkFBZ0IsSUFBSSxRQUFRLEVBQzVCLGNBQWMsSUFBSSxNQUFNLEVBQ3hCLFlBQVksSUFBSSxJQUFJLEVBQ3BCLGVBQWUsSUFBSSxPQUFPLEVBQzFCLGVBQWUsSUFBSSxPQUFPLEdBQzNCLENBQUM7QUFFRixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDIn0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "31.3.0",
+  "version": "31.5.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -1132,12 +1132,27 @@ refused by its own name, because a relay that bound one can never serve the node
 
 Authority stays with Cloudly, and none of it is a request field. The cluster is the one the
 verified machine identity on that socket names; whether `relay.nodeId` is a node of that cluster
-is decided against Cloudly's own records; and one cluster has one relay, so when two peers are
-live the one holding the highest accepted `registrationSequence` is the relay and the other is
-never selected. The response carries the origin Cloudly published, or `null` while the cluster
-carries no relay block, which a relay must read as "not enabled yet" rather than as licence to
-invent an origin: it is how the relay checks that the certificate it holds and the name its nodes
-are told to reach are the same one.
+is decided against Cloudly's own records; and one cluster has one relay. A registration for a
+cluster whose relay nobody enabled is refused by name, because there is no origin to register
+into, so an accepted registration always answers with the origin Cloudly published: that is how
+a relay checks that the certificate it holds and the name its nodes are told to reach are the
+same one.
+
+`registrationSequence` restarts with the relay process, so it orders registrations only within
+one live peer: there it must strictly increase, a refused registration does not consume it (the
+same body may be re-sent once the cause is gone), and a retry that repeats a sequence Cloudly
+already accepted is refused. Across peers it says nothing, because a restarted relay counts from
+zero again; there Cloudly's own acceptance time orders the registrations, and a registration
+arriving on a live verified socket supersedes the stored one.
+
+An administrator reads the result with `getClusterRelayRegistrations { identity, clusterIds? }`,
+answered with `IClusterRelayRegistration` per cluster: the cluster, the node, the listen address
+and port, the relay version, the sequence that relay counted, Cloudly's `acceptedAt` — and
+`live`, whether a verified socket carries that relay at this instant. `live` is a liveness fact
+and grants nothing: a registration that is perfectly current reads `live: false` while its socket
+is gone, and a cluster whose relay never registered is absent from the answer rather than
+present with an empty one. `validateClusterRelayRegistration(value, path?)` returns one named
+reason per violation, as every validator here does.
 
 ```typescript
 const registration: data.IClusterRelayRegistrationV1 = {
@@ -1154,6 +1169,91 @@ const registration: data.IClusterRelayRegistrationV1 = {
 const registrationReasons = data.validateClusterRelayRegistrationV1(registration); // []
 ```
 
+### Cluster Ingress
+
+A cluster's ingress terminates TLS for the hostnames its services publish and forwards to the
+host ports Pallet published for the workloads behind them. Cloudly computes what it serves — it
+is the only party that knows every service, every ready endpoint, the node address each published
+port answers on and the certificate each hostname needs — and the cluster relay carries that table
+to the ingress and the ingress's counters back. These contracts carry no version suffix and no
+schema field: the protocol version is the installed `@serve.zone/interfaces` version.
+
+`IClusterRouteTable { revision, issuedAt, routes, portRoutes }` is the whole table, never a delta.
+`revision` is its only idempotency: a relay and an ingress apply a table whose revision is greater
+than the one they hold and ignore anything else, so a repeated push, a replayed push and a push
+that crossed a newer one all settle the same way. `IClusterHttpRoute` names one hostname, its
+`destinations` (`{ address, port }`, unicast IPv4 and a real port), the `certificate` that
+terminates it and optional Basic `authentication`; `IClusterPortRoute` forwards a TCP or UDP
+listen port without terminating anything. `validateClusterRouteTable(value, path?)` returns one
+named reason per violation, refuses two routes for one hostname and two port routes for one
+transport and port, and — because a validation reason travels into logs — **never quotes
+certificate material or a password in a reason**.
+
+The table is secret-bearing end to end: it carries the private key of every hostname the ingress
+serves. Exclude it from hooks, logs, journals and disk on every hop, exactly as a runtime session
+credential is excluded.
+
+| Method | Direction | Body |
+| --- | --- | --- |
+| `pushClusterRouteTable` | Cloudly → relay | `{ table }` → `{ appliedRevision }` |
+| `getClusterRouteTable` | relay → Cloudly | `{}` → `{ table \| null }` |
+| `registerClusterIngress` | ingress → relay → Cloudly | `{ bearer, version, nodeId, capabilities? }` → `{ accepted: true, revision \| null }` |
+| `getClusterIngressRouteTable` | ingress → relay | `{ knownRevision \| null }` → `{ table \| null }` |
+| `getClusterTrafficStatistics` | Cloudly → relay → ingress | `{ fromDayUtc, toDayUtc, cursor?, limit }` → `{ statistics, nextCursor? }` |
+
+`null` for a table means Cloudly has computed none yet — a fact, not an empty table, and an
+ingress must not serve it as one. An ingress announces itself with a **method**, not a connection
+tag: the relay learns what connected from what it registered through, which a server owns, rather
+than from a label a client authored.
+
+**Who may be the ingress is Cloudly's decision, not the relay's.** The ingress shares the relay's
+node listener, so anything that reaches it could ask to register, and a relay cannot tell an
+ingress from anything else. `registerClusterIngress` therefore carries the `bearer` Cloudly minted
+into the ingress workload's assignment environment and travels both hops with one body: the
+ingress sends it to its relay, the relay forwards it untouched, and Cloudly verifies the bearer
+and derives the cluster from the identity tag on the relay's own session. The bearer is sensitive
+ephemeral input — excluded from hooks, logs, diagnostics and journals on every hop, and never
+quoted in a validation reason.
+
+Isolation on that shared listener is therefore by **authorization, not by routing**: only the
+connection whose registration Cloudly accepted is the ingress, `getClusterIngressRouteTable` and
+`getClusterTrafficStatistics` are answered for that connection alone, and any other connection —
+including a Pallet node's — is refused by name. `validateClusterIngressRegistration(value, path?)`
+checks shape only: whether the bearer is the one Cloudly minted is Cloudly's to verify.
+
+`IClusterTrafficStatistics` is one UTC day of one hostname's traffic on one node —
+`requests`, `bytesIn`, `bytesOut`, `connections` and the backend failures the proxy can observe
+(`connect`, `handshake`, `request`). Day buckets rather than rates: a rate answers "how busy is it
+now", which the live proxy already answers, while a bucket survives a restart, a poll that
+straddles midnight and a Cloudly outage. HTTP status classes are deliberately absent — the proxy
+exposes no status counters today, and a number this contract cannot source would be a guess.
+Readers page it exactly like CoreMail's mail statistics — the same `fromDayUtc`, `toDayUtc`,
+`cursor` and `limit`, answered as `{ statistics, nextCursor? }` — re-reading yesterday and today on
+every pass because a day only stops changing once it has closed. `dayUtc` must name a day that
+exists: the shared UTC calendar-day rule round-trips through `Date.UTC`, so `2026-13-45` is
+refused rather than stored.
+
+```typescript
+const reasons = data.validateClusterRouteTable(table); // []
+const pageReasons = data.validateClusterTrafficStatisticsPage({ statistics: [] }); // []
+const ingressReasons = data.validateClusterIngressRegistration({
+  bearer: ingressBearerFromAssignmentEnvironment,
+  version: '3.0.0',
+  nodeId: 'node-a',
+}); // []
+```
+
+### Node Uplink Address
+
+A route to a node's published host ports needs the address that node answers on, and only the
+node can prove it: it holds the uplink observation the address belongs to. It therefore states it
+on the network report it already sends — `IReportRuntimeNetworkProtectionRequestV1` gains the
+optional `uplinkAddress`, a unicast IPv4 literal that is neither loopback nor link-local
+(`runtimeNodeUplinkAddress`). Absence stays absent: a node that states no address is told apart
+from one that states a value, and nothing downstream defaults or infers one. Cloudly stores what
+the node stated and resolves it into the route table; the relay never substitutes an address of
+its own.
+
 Shared service port helpers are exported from `data` so Cloudly, App Store resolution, Coreflow, Coretraffic, Onebox, and dcrouter agree on the same normalization rules:
 
 ```typescript

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '31.3.0',
+  version: '31.5.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/cluster.ts

@@ -68,8 +68,9 @@ export interface IClusterRelayV1 {
  * is the one its verified machine identity names and is never a field here. `relay.nodeId` is
  * the cluster node the relay process runs on, `listenAddress` and `listenPort` are the exact
  * endpoint it bound for the Pallet nodes of its cluster, and `registrationSequence` counts up
- * once per registration within one relay process, so Cloudly can tell a newer registration from
- * a replayed older one while both peers are live.
+ * once per attempt within one relay process. It orders registrations only within one live
+ * peer, where it must strictly increase, a refused registration does not consume it, and a
+ * repeat of an accepted sequence is refused; across peers Cloudly's own acceptance time orders.
  */
 export interface IClusterRelayRegistrationV1 {
   schemaVersion: 1;
@@ -96,13 +97,13 @@ export interface IClusterRelayRegistrationV1 {
  * What Cloudly tells the relay back.
  *
  * `origin` is the origin Cloudly has published for this cluster, so a relay can check that the
- * certificate it holds and the name its nodes are told to reach are the same one. It is `null`
- * while the cluster carries no relay block, which a relay must treat as "not enabled yet"
- * rather than as an origin it may invent.
+ * certificate it holds and the name its nodes are told to reach are the same one. An accepted
+ * registration always carries one: a cluster whose relay nobody enabled has no origin to
+ * register into, and that registration is refused by name instead of answered.
  */
 export interface IClusterRelayRegistrationResponseV1 {
   accepted: true;
-  origin: string | null;
+  origin: string;
 }
 
 const maximumClusterRelayOriginLength = 2048;
@@ -185,8 +186,8 @@ const validateClusterRelayVersion = (valueArg: unknown, pathArg: string): string
       + 'digits, dot, plus, underscore or hyphen, starting with a letter or digit']
 );
 
-/** The same node id rule a node's own runtime session registers under. */
-const validateClusterRelayNodeId = (valueArg: unknown, pathArg: string): string[] => (
+/** The same identifier rule a node's own runtime session registers under. */
+const validateClusterRelayIdentifier = (valueArg: unknown, pathArg: string): string[] => (
   typeof valueArg === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(valueArg)
     ? []
     : [`${pathArg} must be 1 to 128 characters of letters, digits, underscore or hyphen`]
@@ -213,6 +214,12 @@ const validateClusterRelayListenPort = (valueArg: unknown, pathArg: string): str
     : [`${pathArg} must be an integer from 1 to 65535`]
 );
 
+const validateClusterRelayNonNegativeInteger = (valueArg: unknown, pathArg: string): string[] => (
+  typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && valueArg >= 0
+    ? []
+    : [`${pathArg} must be a non-negative safe integer`]
+);
+
 const validateClusterRelayEndpoint = (valueArg: unknown, pathArg: string): string[] => {
   if (!isRecord(valueArg)
     || !hasExactKeys(valueArg, ['version', 'nodeId', 'listenAddress', 'listenPort'])) {
@@ -220,7 +227,7 @@ const validateClusterRelayEndpoint = (valueArg: unknown, pathArg: string): strin
   }
   return [
     ...validateClusterRelayVersion(valueArg.version, `${pathArg} version`),
-    ...validateClusterRelayNodeId(valueArg.nodeId, `${pathArg} nodeId`),
+    ...validateClusterRelayIdentifier(valueArg.nodeId, `${pathArg} nodeId`),
     ...validateClusterRelayListenAddress(valueArg.listenAddress, `${pathArg} listenAddress`),
     ...validateClusterRelayListenPort(valueArg.listenPort, `${pathArg} listenPort`),
   ];
@@ -231,9 +238,10 @@ const validateClusterRelayEndpoint = (valueArg: unknown, pathArg: string): strin
  *
  * Shape only, exactly like every other validator here: which cluster the relay speaks for comes
  * from the verified identity on its socket, whether `relay.nodeId` is a node of that cluster is
- * Cloudly's to decide against its own records, and whether this registration supersedes a live
- * one is Cloudly's comparison of `registrationSequence` between peers. A registration that
- * passes here has claimed nothing.
+ * Cloudly's to decide against its own records, and whether this registration supersedes the
+ * stored one is Cloudly's decision too. `registrationSequence` restarts with the relay process,
+ * so it orders registrations only within one live peer. A registration that passes here has
+ * claimed nothing.
  */
 export const validateClusterRelayRegistrationV1 = (
   valueArg: unknown,
@@ -248,14 +256,65 @@ export const validateClusterRelayRegistrationV1 = (
     errors.push(`${pathArg} schemaVersion must be 1`);
   }
   errors.push(...validateClusterRelayEndpoint(valueArg.relay, `${pathArg} relay`));
-  if (typeof valueArg.registrationSequence !== 'number'
-    || !Number.isSafeInteger(valueArg.registrationSequence)
-    || valueArg.registrationSequence < 0) {
-    errors.push(`${pathArg} registrationSequence must be a non-negative safe integer`);
-  }
+  errors.push(...validateClusterRelayNonNegativeInteger(valueArg.registrationSequence,
+    `${pathArg} registrationSequence`));
   return errors;
 };
 
+/**
+ * One cluster's relay as Cloudly serves it to an administrator.
+ *
+ * This is the read shape, not the registration a relay sends: `IClusterRelayRegistrationV1` is
+ * what the relay puts on the wire, and this is what Cloudly answers with after it accepted one.
+ * `clusterId` names the cluster the relay serves, and `acceptedAt` is Cloudly's own acceptance
+ * time, which is what orders two registrations of one cluster.
+ */
+export interface IClusterRelayRegistration {
+  clusterId: string;
+  nodeId: string;
+  listenAddress: string;
+  listenPort: number;
+  version: string;
+  registrationSequence: number;
+  acceptedAt: number;
+  /**
+   * Whether a verified socket carries this relay at this instant.
+   *
+   * A liveness fact and nothing else: it grants no authority, it is not part of what was
+   * registered, and it is false for a relay whose registration is perfectly current but whose
+   * socket is gone, so a reader must not treat it as a statement about the registration.
+   */
+  live: boolean;
+}
+
+/**
+ * Validates one served relay registration and names every reason it is refused.
+ *
+ * Shape only, like every validator here. Whether the cluster exists, whether the node still
+ * belongs to it and whether the relay is really connected are Cloudly's own records; a value
+ * that passes here has claimed nothing.
+ */
+export const validateClusterRelayRegistration = (
+  valueArg: unknown,
+  pathArg = 'cluster relay registration',
+): string[] => {
+  if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['clusterId', 'nodeId', 'listenAddress',
+    'listenPort', 'version', 'registrationSequence', 'acceptedAt', 'live'])) {
+    return [`${pathArg} must use its exact schema`];
+  }
+  return [
+    ...validateClusterRelayIdentifier(valueArg.clusterId, `${pathArg} clusterId`),
+    ...validateClusterRelayIdentifier(valueArg.nodeId, `${pathArg} nodeId`),
+    ...validateClusterRelayListenAddress(valueArg.listenAddress, `${pathArg} listenAddress`),
+    ...validateClusterRelayListenPort(valueArg.listenPort, `${pathArg} listenPort`),
+    ...validateClusterRelayVersion(valueArg.version, `${pathArg} version`),
+    ...validateClusterRelayNonNegativeInteger(valueArg.registrationSequence,
+      `${pathArg} registrationSequence`),
+    ...validateClusterRelayNonNegativeInteger(valueArg.acceptedAt, `${pathArg} acceptedAt`),
+    ...(typeof valueArg.live === 'boolean' ? [] : [`${pathArg} live must be a boolean`]),
+  ];
+};
+
 /**
  * The name the relay's certificate is issued for, and the A record Cloudly
  * owns for it. Derived from the origin so every consumer derives it