@serve.zone/interfaces 32.14.0 → 32.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,6 +1,7 @@
1
1
  import type { TSha256Digest } from './immutableimage.js';
2
2
  import type { IRuntimeAssignment, IRuntimeAuthorityReference, IRuntimeController } from './runtimeassignment.js';
3
3
  import type { IResolvedFilesystemStorageBinding } from '../platform/storage.js';
4
+ import type { IAppStoreFilesystemStorageRequest } from '../appstore/types.js';
4
5
  /** Only immutable, portable fields of a ready Corestore filesystem binding. */
5
6
  export interface IRuntimeStorageClaimBinding extends Pick<IResolvedFilesystemStorageBinding, 'id' | 'serviceId' | 'requestId' | 'requestDigest' | 'generation' | 'observedGeneration' | 'policy' | 'resourceRef' | 'mountPath'> {
6
7
  kind: 'filesystem';
@@ -11,6 +12,35 @@ export interface IRuntimeStorageClaimBinding extends Pick<IResolvedFilesystemSto
11
12
  topology: 'singleNode';
12
13
  };
13
14
  }
15
+ /**
16
+ * Cloudly's requested filesystem binding identity before the storage provider reports readiness.
17
+ * Provider-produced observation, resource and capability fields cannot be stated in this shape.
18
+ */
19
+ export interface IRuntimeStorageClaimRequestedFilesystemBinding {
20
+ serviceId: string;
21
+ request: IAppStoreFilesystemStorageRequest & {
22
+ accessMode: 'ReadWriteOnce';
23
+ reclaimPolicy: 'retain';
24
+ };
25
+ requestDigest: string;
26
+ }
27
+ /** Cloudly-owned claim identity and desired request before a provider-produced ready binding exists. */
28
+ export interface IRuntimeStorageClaimIntent {
29
+ id: string;
30
+ generation: number;
31
+ previous: IRuntimeAuthorityReference | null;
32
+ controller: IRuntimeController & {
33
+ kind: 'cloudly';
34
+ };
35
+ organizationId: string;
36
+ clusterId: string;
37
+ nodeId: string;
38
+ runtimeNamespace: string;
39
+ serviceId: string;
40
+ requestedBinding: IRuntimeStorageClaimRequestedFilesystemBinding;
41
+ reclaimPolicy: 'retain';
42
+ digest: TSha256Digest;
43
+ }
14
44
  /** Cloudly authority for one retained, node-local volume; no host path or attachment attempt. */
15
45
  export interface IRuntimeStorageClaim {
16
46
  id: string;
@@ -29,14 +59,27 @@ export interface IRuntimeStorageClaim {
29
59
  digest: TSha256Digest;
30
60
  }
31
61
  export declare const runtimeStorageClaimContract: Readonly<{
62
+ readonly intentDigestDomain: "serve.zone/runtime-storage-claim-intent";
32
63
  readonly digestDomain: "serve.zone/runtime-storage-claim";
33
64
  readonly accessMode: "ReadWriteOnce";
34
65
  readonly reclaimPolicy: "retain";
35
66
  }>;
67
+ /** Detached exact-schema snapshot. This shape deliberately cannot state provider readiness. */
68
+ export declare const snapshotRuntimeStorageClaimIntent: (valueArg: unknown) => IRuntimeStorageClaimIntent;
69
+ export declare const computeRuntimeStorageClaimIntentDigest: (valueArg: unknown) => Promise<TSha256Digest>;
70
+ export declare const validateRuntimeStorageClaimIntent: (valueArg: unknown) => Promise<string[]>;
36
71
  /** Detached exact-schema snapshot. Digest and authoritative provider readiness are separate checks. */
37
72
  export declare const snapshotRuntimeStorageClaim: (valueArg: unknown) => IRuntimeStorageClaim;
38
73
  export declare const computeRuntimeStorageClaimDigest: (valueArg: unknown) => Promise<TSha256Digest>;
39
74
  export declare const validateRuntimeStorageClaim: (valueArg: unknown) => Promise<string[]>;
75
+ /**
76
+ * Joins Cloudly-owned identity and request facts to a provider-produced ready binding.
77
+ * This content check does not authenticate either producer or grant attachment authority.
78
+ */
79
+ export declare const bindRuntimeStorageClaimToIntent: (claimArg: unknown, intentArg: unknown) => Promise<{
80
+ claim: IRuntimeStorageClaim;
81
+ intent: IRuntimeStorageClaimIntent;
82
+ }>;
40
83
  /** Content binding only; controller authentication, provider checks and attachment fencing remain owner-owned. */
41
84
  export declare const bindRuntimeStorageClaimToAssignment: (claimArg: unknown, assignmentArg: unknown, expectedClusterIdArg: unknown) => Promise<{
42
85
  claim: IRuntimeStorageClaim;
@@ -1,8 +1,10 @@
1
1
  import { snapshotRuntimeAssignment, validateRuntimeAssignment } from './runtimeassignment.js';
2
2
  import { normalizeServiceAbsolutePath } from './service.js';
3
+ import { createStorageRequestSha256, normalizeStorageRequest } from '../platform/storage.js';
3
4
  import { canonicalizeStrictJson, createCanonicalJsonSha256Hex } from '../private/canonicaljson.js';
4
5
  import { isClusterNodeId } from '../private/nodeidentifier.js';
5
6
  export const runtimeStorageClaimContract = Object.freeze({
7
+ intentDigestDomain: 'serve.zone/runtime-storage-claim-intent',
6
8
  digestDomain: 'serve.zone/runtime-storage-claim',
7
9
  accessMode: 'ReadWriteOnce',
8
10
  reclaimPolicy: 'retain',
@@ -41,6 +43,10 @@ const digest = (valueArg) => {
41
43
  requireValue(typeof valueArg === 'string' && /^sha256:[a-f0-9]{64}$/.test(valueArg));
42
44
  return valueArg;
43
45
  };
46
+ const requestDigest = (valueArg) => {
47
+ requireValue(typeof valueArg === 'string' && /^[a-f0-9]{64}$/.test(valueArg));
48
+ return valueArg;
49
+ };
44
50
  const reference = (valueArg) => {
45
51
  const value = record(valueArg, ['id', 'generation', 'digest']);
46
52
  return { id: assignmentId(value.id), generation: generation(value.generation), digest: digest(value.digest) };
@@ -56,25 +62,69 @@ const mountPath = (valueArg) => {
56
62
  && !valueArg.startsWith('/run/secrets/') && !'/run/secrets'.startsWith(`${valueArg}/`));
57
63
  return valueArg;
58
64
  };
65
+ const requestedBinding = (valueArg) => {
66
+ const value = record(valueArg, ['serviceId', 'request', 'requestDigest']);
67
+ const request = normalizeStorageRequest(value.request);
68
+ requireValue(request.kind === 'filesystem' && request.accessMode === 'ReadWriteOnce'
69
+ && request.reclaimPolicy === 'retain' && mountPath(request.mountPath) === request.mountPath);
70
+ return { serviceId: assignmentId(value.serviceId),
71
+ request: request,
72
+ requestDigest: requestDigest(value.requestDigest) };
73
+ };
59
74
  const binding = (valueArg) => {
60
75
  const value = record(valueArg, ['id', 'serviceId', 'requestId', 'requestDigest', 'kind',
61
76
  'generation', 'observedGeneration', 'status', 'policy', 'resourceRef', 'mountPath',
62
77
  'accessMode', 'capabilities']);
63
78
  requireValue(value.kind === 'filesystem' && value.status === 'ready'
64
- && value.accessMode === 'ReadWriteOnce'
65
- && typeof value.requestDigest === 'string' && /^[a-f0-9]{64}$/.test(value.requestDigest));
79
+ && value.accessMode === 'ReadWriteOnce');
66
80
  const policy = record(value.policy, ['classId', 'revision']);
67
81
  const capabilities = record(value.capabilities, ['durability', 'topology']);
68
82
  requireValue(capabilities.durability === 'persistent' && capabilities.topology === 'singleNode');
69
83
  const bindingGeneration = generation(value.generation);
70
84
  requireValue(generation(value.observedGeneration) === bindingGeneration);
71
85
  return { id: id(value.id), serviceId: assignmentId(value.serviceId), requestId: id(value.requestId),
72
- requestDigest: value.requestDigest, kind: 'filesystem', generation: bindingGeneration,
86
+ requestDigest: requestDigest(value.requestDigest), kind: 'filesystem', generation: bindingGeneration,
73
87
  observedGeneration: bindingGeneration, status: 'ready',
74
88
  policy: { classId: id(policy.classId), revision: id(policy.revision) },
75
89
  resourceRef: id(value.resourceRef), mountPath: mountPath(value.mountPath),
76
90
  accessMode: 'ReadWriteOnce', capabilities: { durability: 'persistent', topology: 'singleNode' } };
77
91
  };
92
+ /** Detached exact-schema snapshot. This shape deliberately cannot state provider readiness. */
93
+ export const snapshotRuntimeStorageClaimIntent = (valueArg) => {
94
+ const value = record(valueArg, ['id', 'generation', 'previous', 'controller', 'organizationId',
95
+ 'clusterId', 'nodeId', 'runtimeNamespace', 'serviceId', 'requestedBinding', 'reclaimPolicy', 'digest']);
96
+ const claimId = assignmentId(value.id), claimGeneration = generation(value.generation);
97
+ const previous = value.previous === null ? null : reference(value.previous);
98
+ requireValue(claimGeneration === 1 ? previous === null
99
+ : previous?.id === claimId && previous.generation === claimGeneration - 1);
100
+ requireValue(isClusterNodeId(value.nodeId) && value.reclaimPolicy === 'retain');
101
+ const claimBinding = requestedBinding(value.requestedBinding), serviceId = assignmentId(value.serviceId);
102
+ requireValue(claimBinding.serviceId === serviceId);
103
+ return { id: claimId, generation: claimGeneration, previous, controller: controller(value.controller),
104
+ organizationId: assignmentId(value.organizationId), clusterId: id(value.clusterId),
105
+ nodeId: value.nodeId, runtimeNamespace: assignmentId(value.runtimeNamespace), serviceId,
106
+ requestedBinding: claimBinding, reclaimPolicy: 'retain', digest: digest(value.digest) };
107
+ };
108
+ export const computeRuntimeStorageClaimIntentDigest = async (valueArg) => {
109
+ const { digest: _digest, ...payload } = snapshotRuntimeStorageClaimIntent(valueArg);
110
+ return `sha256:${await createCanonicalJsonSha256Hex(canonicalizeStrictJson({
111
+ domain: runtimeStorageClaimContract.intentDigestDomain, payload,
112
+ }, fail), fail)}`;
113
+ };
114
+ export const validateRuntimeStorageClaimIntent = async (valueArg) => {
115
+ try {
116
+ const intent = snapshotRuntimeStorageClaimIntent(valueArg);
117
+ if (intent.requestedBinding.requestDigest
118
+ !== await createStorageRequestSha256(intent.requestedBinding.request)) {
119
+ return ['runtime storage claim intent request digest does not match'];
120
+ }
121
+ return intent.digest === await computeRuntimeStorageClaimIntentDigest(intent)
122
+ ? [] : ['runtime storage claim intent digest does not match'];
123
+ }
124
+ catch {
125
+ return ['runtime storage claim intent must use its exact canonical schema'];
126
+ }
127
+ };
78
128
  /** Detached exact-schema snapshot. Digest and authoritative provider readiness are separate checks. */
79
129
  export const snapshotRuntimeStorageClaim = (valueArg) => {
80
130
  const value = record(valueArg, ['id', 'generation', 'previous', 'controller', 'organizationId',
@@ -107,6 +157,40 @@ export const validateRuntimeStorageClaim = async (valueArg) => {
107
157
  return ['runtime storage claim must use its exact canonical schema'];
108
158
  }
109
159
  };
160
+ /**
161
+ * Joins Cloudly-owned identity and request facts to a provider-produced ready binding.
162
+ * This content check does not authenticate either producer or grant attachment authority.
163
+ */
164
+ export const bindRuntimeStorageClaimToIntent = async (claimArg, intentArg) => {
165
+ const claim = snapshotRuntimeStorageClaim(claimArg);
166
+ const intent = snapshotRuntimeStorageClaimIntent(intentArg);
167
+ if ((await validateRuntimeStorageClaim(claim)).length
168
+ || (await validateRuntimeStorageClaimIntent(intent)).length)
169
+ fail();
170
+ const claimPrevious = claim.previous, intentPrevious = intent.previous;
171
+ requireValue(claim.id === intent.id
172
+ && claim.generation === intent.generation
173
+ && (claimPrevious === null
174
+ ? intentPrevious === null
175
+ : intentPrevious !== null
176
+ && claimPrevious.id === intentPrevious.id
177
+ && claimPrevious.generation === intentPrevious.generation
178
+ && claimPrevious.digest === intentPrevious.digest)
179
+ && claim.controller.id === intent.controller.id
180
+ && claim.controller.epoch === intent.controller.epoch
181
+ && claim.organizationId === intent.organizationId
182
+ && claim.clusterId === intent.clusterId
183
+ && claim.nodeId === intent.nodeId
184
+ && claim.runtimeNamespace === intent.runtimeNamespace
185
+ && claim.serviceId === intent.serviceId
186
+ && claim.binding.serviceId === intent.requestedBinding.serviceId
187
+ && claim.binding.requestId === intent.requestedBinding.request.id
188
+ && claim.binding.requestDigest === intent.requestedBinding.requestDigest
189
+ && claim.binding.mountPath === intent.requestedBinding.request.mountPath
190
+ && claim.binding.accessMode === intent.requestedBinding.request.accessMode
191
+ && claim.reclaimPolicy === intent.reclaimPolicy);
192
+ return { claim, intent };
193
+ };
110
194
  /** Content binding only; controller authentication, provider checks and attachment fencing remain owner-owned. */
111
195
  export const bindRuntimeStorageClaimToAssignment = async (claimArg, assignmentArg, expectedClusterIdArg) => {
112
196
  const claim = snapshotRuntimeStorageClaim(claimArg);
@@ -126,4 +210,4 @@ export const bindRuntimeStorageClaimToAssignment = async (claimArg, assignmentAr
126
210
  && assignment.serviceId === claim.serviceId);
127
211
  return { claim, assignment };
128
212
  };
129
- //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXN0b3JhZ2VjbGFpbS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvcnVudGltZXN0b3JhZ2VjbGFpbS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUseUJBQXlCLEVBQUUseUJBQXlCLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUM5RixPQUFPLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFNUQsT0FBTyxFQUFFLHNCQUFzQixFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDbkcsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBNEIvRCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3ZELFlBQVksRUFBRSxrQ0FBa0M7SUFDaEQsVUFBVSxFQUFFLGVBQWU7SUFDM0IsYUFBYSxFQUFFLFFBQVE7Q0FDZixDQUFDLENBQUM7QUFFWixNQUFNLElBQUksR0FBRyxHQUFVLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDM0YsU0FBUyxZQUFZLENBQUMsWUFBcUIsSUFBMEIsSUFBSSxDQUFDLFlBQVk7SUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFDakcsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQTBCLEVBQTJCLEVBQUU7SUFDeEYsWUFBWSxDQUFDLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEQsWUFBWSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsU0FBUyxJQUFJLFNBQVMsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUNuRSxNQUFNLElBQUksR0FBRyxPQUFPLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZDLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDakcsTUFBTSxNQUFNLEdBQTRCLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDNUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxPQUFPLEVBQUUsQ0FBQztRQUMxQixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ2xFLFlBQVksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDM0UsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUM7SUFDakMsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUNGLE1BQU0sRUFBRSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ3ZDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksc0NBQXNDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDcEcsT0FBTyxRQUFrQixDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUNGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ2pELFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUNBQXFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDbkcsT0FBTyxRQUFrQixDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUNGLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQy9DLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7V0FDdEUsUUFBUSxHQUFHLENBQUMsSUFBSSxRQUFRLEdBQUcsTUFBTSxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDekQsT0FBTyxRQUFrQixDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUNGLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBaUIsRUFBRTtJQUNsRCxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3JGLE9BQU8sUUFBeUIsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFDRixNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQThCLEVBQUU7SUFDbEUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUMvRCxPQUFPLEVBQUUsRUFBRSxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztBQUNoSCxDQUFDLENBQUM7QUFDRixNQUFNLFVBQVUsR0FBRyxDQUFDLFFBQWlCLEVBQXNDLEVBQUU7SUFDM0UsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUN4RCxZQUFZLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQztJQUN2QyxPQUFPLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsWUFBWSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsRUFBRSxLQUFLLEVBQUUsWUFBWSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQzNGLENBQUMsQ0FBQztBQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzlDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksNEJBQTRCLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUTtXQUMzRixRQUFRLEtBQUssR0FBRyxJQUFJLFFBQVEsS0FBSyxNQUFNLElBQUksUUFBUSxLQUFLLGNBQWM7V0FDdEUsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxHQUFHLFFBQVEsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUMxRixPQUFPLFFBQWtCLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUErQixFQUFFO0lBQ2pFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQUUsTUFBTTtRQUNyRixZQUFZLEVBQUUsb0JBQW9CLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxhQUFhLEVBQUUsV0FBVztRQUNsRixZQUFZLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUNqQyxZQUFZLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxZQUFZLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxPQUFPO1dBQy9ELEtBQUssQ0FBQyxVQUFVLEtBQUssZUFBZTtXQUNwQyxPQUFPLEtBQUssQ0FBQyxhQUFhLEtBQUssUUFBUSxJQUFJLGdCQUFnQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQzdELE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDNUUsWUFBWSxDQUFDLFlBQVksQ0FBQyxVQUFVLEtBQUssWUFBWSxJQUFJLFlBQVksQ0FBQyxRQUFRLEtBQUssWUFBWSxDQUFDLENBQUM7SUFDakcsTUFBTSxpQkFBaUIsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3ZELFlBQVksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLGtCQUFrQixDQUFDLEtBQUssaUJBQWlCLENBQUMsQ0FBQztJQUN6RSxPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsU0FBUyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQ2pHLGFBQWEsRUFBRSxLQUFLLENBQUMsYUFBdUIsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLFVBQVUsRUFBRSxpQkFBaUI7UUFDL0Ysa0JBQWtCLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLE9BQU87UUFDdEQsTUFBTSxFQUFFLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFDdEUsV0FBVyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQ3pFLFVBQVUsRUFBRSxlQUFlLEVBQUUsWUFBWSxFQUFFLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLEVBQUUsQ0FBQztBQUN0RyxDQUFDLENBQUM7QUFFRix1R0FBdUc7QUFDdkcsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsQ0FBQyxRQUFpQixFQUF3QixFQUFFO0lBQ3JGLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsZ0JBQWdCO1FBQzVGLFdBQVcsRUFBRSxRQUFRLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNqRyxNQUFNLE9BQU8sR0FBRyxZQUFZLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFLGVBQWUsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3ZGLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDNUUsWUFBWSxDQUFDLGVBQWUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsS0FBSyxJQUFJO1FBQ3BELENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxLQUFLLE9BQU8sSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLGVBQWUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM3RSxZQUFZLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsYUFBYSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ2hGLE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsU0FBUyxHQUFHLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDdkYsWUFBWSxDQUFDLFlBQVksQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDbkQsT0FBTyxFQUFFLEVBQUUsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ25HLGNBQWMsRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUNsRixNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQWdCLEVBQUUsZ0JBQWdCLEVBQUUsWUFBWSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFNBQVM7UUFDakcsT0FBTyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDbkYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUFFLFFBQWlCLEVBQTBCLEVBQUU7SUFDbEcsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM5RSxPQUFPLFVBQVUsTUFBTSw0QkFBNEIsQ0FBQyxzQkFBc0IsQ0FBQztRQUN6RSxNQUFNLEVBQUUsMkJBQTJCLENBQUMsWUFBWSxFQUFFLE9BQU87S0FDMUQsRUFBRSxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3BCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQ3hGLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLDJCQUEyQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3BELE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLGdDQUFnQyxDQUFDLEtBQUssQ0FBQztZQUNuRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixrSEFBa0g7QUFDbEgsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsS0FBSyxFQUN0RCxRQUFpQixFQUFFLGFBQXNCLEVBQUUsb0JBQTZCLEVBQ0UsRUFBRTtJQUM1RSxNQUFNLEtBQUssR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNwRCxNQUFNLFVBQVUsR0FBRyx5QkFBeUIsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUM1RCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLE1BQU0seUJBQXlCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNO1FBQUUsSUFBSSxFQUFFLENBQUM7SUFDdEgsTUFBTSxpQkFBaUIsR0FBRyxFQUFFLENBQUMsb0JBQW9CLENBQUMsQ0FBQztJQUNuRCxNQUFNLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pGLFlBQVksQ0FBQyxTQUFTLEVBQUUsVUFBVSxLQUFLLEtBQUssQ0FBQyxVQUFVLElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsTUFBTTtXQUN2RixLQUFLLENBQUMsU0FBUyxLQUFLLGlCQUFpQjtXQUNyQyxVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTO1dBQ3hDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxLQUFLLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRTtXQUNoRCxVQUFVLENBQUMsVUFBVSxDQUFDLEtBQUssS0FBSyxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUs7V0FDdEQsVUFBVSxDQUFDLGNBQWMsS0FBSyxLQUFLLENBQUMsY0FBYztXQUNsRCxVQUFVLENBQUMsTUFBTSxLQUFLLEtBQUssQ0FBQyxNQUFNO1dBQ2xDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxLQUFLLENBQUMsZ0JBQWdCO1dBQ3RELFVBQVUsQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQy9DLE9BQU8sRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLENBQUM7QUFDL0IsQ0FBQyxDQUFDIn0=
213
+ //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXN0b3JhZ2VjbGFpbS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvcnVudGltZXN0b3JhZ2VjbGFpbS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUseUJBQXlCLEVBQUUseUJBQXlCLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUM5RixPQUFPLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFHNUQsT0FBTyxFQUFFLDBCQUEwQixFQUFFLHVCQUF1QixFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFDN0YsT0FBTyxFQUFFLHNCQUFzQixFQUFFLDRCQUE0QixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDbkcsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBeUQvRCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3ZELGtCQUFrQixFQUFFLHlDQUF5QztJQUM3RCxZQUFZLEVBQUUsa0NBQWtDO0lBQ2hELFVBQVUsRUFBRSxlQUFlO0lBQzNCLGFBQWEsRUFBRSxRQUFRO0NBQ2YsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzNGLFNBQVMsWUFBWSxDQUFDLFlBQXFCLElBQTBCLElBQUksQ0FBQyxZQUFZO0lBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQ2pHLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUEwQixFQUEyQixFQUFFO0lBQ3hGLFlBQVksQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xELFlBQVksQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDbkUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2QyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pHLE1BQU0sTUFBTSxHQUE0QixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzVELEtBQUssTUFBTSxHQUFHLElBQUksT0FBTyxFQUFFLENBQUM7UUFDMUIsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNsRSxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDO0lBQ2pDLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFDRixNQUFNLEVBQUUsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUN2QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHNDQUFzQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3BHLE9BQU8sUUFBa0IsQ0FBQztBQUM1QixDQUFDLENBQUM7QUFDRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUNqRCxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sUUFBa0IsQ0FBQztBQUM1QixDQUFDLENBQUM7QUFDRixNQUFNLFVBQVUsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUMvQyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDO1dBQ3RFLFFBQVEsR0FBRyxDQUFDLElBQUksUUFBUSxHQUFHLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3pELE9BQU8sUUFBa0IsQ0FBQztBQUM1QixDQUFDLENBQUM7QUFDRixNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWlCLEVBQWlCLEVBQUU7SUFDbEQsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNyRixPQUFPLFFBQXlCLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxhQUFhLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDbEQsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM5RSxPQUFPLFFBQWtCLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUE4QixFQUFFO0lBQ2xFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDL0QsT0FBTyxFQUFFLEVBQUUsRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDaEgsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxVQUFVLEdBQUcsQ0FBQyxRQUFpQixFQUFzQyxFQUFFO0lBQzNFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDeEQsWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDdkMsT0FBTyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQUUsS0FBSyxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUMzRixDQUFDLENBQUM7QUFDRixNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUM5QyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLDRCQUE0QixDQUFDLFFBQVEsQ0FBQyxLQUFLLFFBQVE7V0FDM0YsUUFBUSxLQUFLLEdBQUcsSUFBSSxRQUFRLEtBQUssTUFBTSxJQUFJLFFBQVEsS0FBSyxjQUFjO1dBQ3RFLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUMsR0FBRyxRQUFRLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDMUYsT0FBTyxRQUFrQixDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUNGLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxRQUFpQixFQUFrRCxFQUFFO0lBQzdGLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxXQUFXLEVBQUUsU0FBUyxFQUFFLGVBQWUsQ0FBQyxDQUFDLENBQUM7SUFDMUUsTUFBTSxPQUFPLEdBQUcsdUJBQXVCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3ZELFlBQVksQ0FBQyxPQUFPLENBQUMsSUFBSSxLQUFLLFlBQVksSUFBSSxPQUFPLENBQUMsVUFBVSxLQUFLLGVBQWU7V0FDL0UsT0FBTyxDQUFDLGFBQWEsS0FBSyxRQUFRLElBQUksU0FBUyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsS0FBSyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDL0YsT0FBTyxFQUFFLFNBQVMsRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUMvQyxPQUFPLEVBQUUsT0FBb0U7UUFDN0UsYUFBYSxFQUFFLGFBQWEsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztBQUN4RCxDQUFDLENBQUM7QUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQStCLEVBQUU7SUFDakUsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQUksRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLGVBQWUsRUFBRSxNQUFNO1FBQ3JGLFlBQVksRUFBRSxvQkFBb0IsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxXQUFXO1FBQ2xGLFlBQVksRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDO0lBQ2pDLFlBQVksQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFlBQVksSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLE9BQU87V0FDL0QsS0FBSyxDQUFDLFVBQVUsS0FBSyxlQUFlLENBQUMsQ0FBQztJQUMzQyxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQzdELE1BQU0sWUFBWSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDNUUsWUFBWSxDQUFDLFlBQVksQ0FBQyxVQUFVLEtBQUssWUFBWSxJQUFJLFlBQVksQ0FBQyxRQUFRLEtBQUssWUFBWSxDQUFDLENBQUM7SUFDakcsTUFBTSxpQkFBaUIsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3ZELFlBQVksQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLGtCQUFrQixDQUFDLEtBQUssaUJBQWlCLENBQUMsQ0FBQztJQUN6RSxPQUFPLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsU0FBUyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQ2pHLGFBQWEsRUFBRSxhQUFhLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxFQUFFLElBQUksRUFBRSxZQUFZLEVBQUUsVUFBVSxFQUFFLGlCQUFpQjtRQUNwRyxrQkFBa0IsRUFBRSxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsT0FBTztRQUN0RCxNQUFNLEVBQUUsRUFBRSxPQUFPLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsRUFBRTtRQUN0RSxXQUFXLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDekUsVUFBVSxFQUFFLGVBQWUsRUFBRSxZQUFZLEVBQUUsRUFBRSxVQUFVLEVBQUUsWUFBWSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsRUFBRSxDQUFDO0FBQ3RHLENBQUMsQ0FBQztBQUVGLCtGQUErRjtBQUMvRixNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUFDLFFBQWlCLEVBQThCLEVBQUU7SUFDakcsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxnQkFBZ0I7UUFDNUYsV0FBVyxFQUFFLFFBQVEsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQUUsa0JBQWtCLEVBQUUsZUFBZSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDMUcsTUFBTSxPQUFPLEdBQUcsWUFBWSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsRUFBRSxlQUFlLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN2RixNQUFNLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzVFLFlBQVksQ0FBQyxlQUFlLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLEtBQUssSUFBSTtRQUNwRCxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsS0FBSyxPQUFPLElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxlQUFlLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDN0UsWUFBWSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLGFBQWEsS0FBSyxRQUFRLENBQUMsQ0FBQztJQUNoRixNQUFNLFlBQVksR0FBRyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxTQUFTLEdBQUcsWUFBWSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUN6RyxZQUFZLENBQUMsWUFBWSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNuRCxPQUFPLEVBQUUsRUFBRSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsZUFBZSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDbkcsY0FBYyxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDLEVBQUUsU0FBUyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQ2xGLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBZ0IsRUFBRSxnQkFBZ0IsRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLEVBQUUsU0FBUztRQUNqRyxnQkFBZ0IsRUFBRSxZQUFZLEVBQUUsYUFBYSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0FBQzVGLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLEtBQUssRUFBRSxRQUFpQixFQUEwQixFQUFFO0lBQ3hHLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsaUNBQWlDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEYsT0FBTyxVQUFVLE1BQU0sNEJBQTRCLENBQUMsc0JBQXNCLENBQUM7UUFDekUsTUFBTSxFQUFFLDJCQUEyQixDQUFDLGtCQUFrQixFQUFFLE9BQU87S0FDaEUsRUFBRSxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3BCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQzlGLElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLGlDQUFpQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzNELElBQUksTUFBTSxDQUFDLGdCQUFnQixDQUFDLGFBQWE7Z0JBQ25DLE1BQU0sMEJBQTBCLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDeEUsT0FBTyxDQUFDLDREQUE0RCxDQUFDLENBQUM7UUFDeEUsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDLE1BQU0sS0FBSyxNQUFNLHNDQUFzQyxDQUFDLE1BQU0sQ0FBQztZQUMzRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO0lBQzlFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRix1R0FBdUc7QUFDdkcsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsQ0FBQyxRQUFpQixFQUF3QixFQUFFO0lBQ3JGLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsZ0JBQWdCO1FBQzVGLFdBQVcsRUFBRSxRQUFRLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNqRyxNQUFNLE9BQU8sR0FBRyxZQUFZLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFLGVBQWUsR0FBRyxVQUFVLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3ZGLE1BQU0sUUFBUSxHQUFHLEtBQUssQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDNUUsWUFBWSxDQUFDLGVBQWUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsS0FBSyxJQUFJO1FBQ3BELENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxLQUFLLE9BQU8sSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLGVBQWUsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM3RSxZQUFZLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsYUFBYSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ2hGLE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsU0FBUyxHQUFHLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDdkYsWUFBWSxDQUFDLFlBQVksQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDbkQsT0FBTyxFQUFFLEVBQUUsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDO1FBQ25HLGNBQWMsRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUNsRixNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQWdCLEVBQUUsZ0JBQWdCLEVBQUUsWUFBWSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFNBQVM7UUFDakcsT0FBTyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDbkYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsS0FBSyxFQUFFLFFBQWlCLEVBQTBCLEVBQUU7SUFDbEcsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsR0FBRyxPQUFPLEVBQUUsR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUM5RSxPQUFPLFVBQVUsTUFBTSw0QkFBNEIsQ0FBQyxzQkFBc0IsQ0FBQztRQUN6RSxNQUFNLEVBQUUsMkJBQTJCLENBQUMsWUFBWSxFQUFFLE9BQU87S0FDMUQsRUFBRSxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO0FBQ3BCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQ3hGLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLDJCQUEyQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3BELE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLGdDQUFnQyxDQUFDLEtBQUssQ0FBQztZQUNuRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxLQUFLLEVBQ2xELFFBQWlCLEVBQ2pCLFNBQWtCLEVBQzRELEVBQUU7SUFDaEYsTUFBTSxLQUFLLEdBQUcsMkJBQTJCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEQsTUFBTSxNQUFNLEdBQUcsaUNBQWlDLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDNUQsSUFBSSxDQUFDLE1BQU0sMkJBQTJCLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNO1dBQ2hELENBQUMsTUFBTSxpQ0FBaUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU07UUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0RSxNQUFNLGFBQWEsR0FBRyxLQUFLLENBQUMsUUFBUSxFQUFFLGNBQWMsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDO0lBQ3ZFLFlBQVksQ0FBQyxLQUFLLENBQUMsRUFBRSxLQUFLLE1BQU0sQ0FBQyxFQUFFO1dBQzlCLEtBQUssQ0FBQyxVQUFVLEtBQUssTUFBTSxDQUFDLFVBQVU7V0FDdEMsQ0FBQyxhQUFhLEtBQUssSUFBSTtZQUN4QixDQUFDLENBQUMsY0FBYyxLQUFLLElBQUk7WUFDekIsQ0FBQyxDQUFDLGNBQWMsS0FBSyxJQUFJO21CQUNwQixhQUFhLENBQUMsRUFBRSxLQUFLLGNBQWMsQ0FBQyxFQUFFO21CQUN0QyxhQUFhLENBQUMsVUFBVSxLQUFLLGNBQWMsQ0FBQyxVQUFVO21CQUN0RCxhQUFhLENBQUMsTUFBTSxLQUFLLGNBQWMsQ0FBQyxNQUFNLENBQUM7V0FDbkQsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLEtBQUssTUFBTSxDQUFDLFVBQVUsQ0FBQyxFQUFFO1dBQzVDLEtBQUssQ0FBQyxVQUFVLENBQUMsS0FBSyxLQUFLLE1BQU0sQ0FBQyxVQUFVLENBQUMsS0FBSztXQUNsRCxLQUFLLENBQUMsY0FBYyxLQUFLLE1BQU0sQ0FBQyxjQUFjO1dBQzlDLEtBQUssQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVM7V0FDcEMsS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLENBQUMsTUFBTTtXQUM5QixLQUFLLENBQUMsZ0JBQWdCLEtBQUssTUFBTSxDQUFDLGdCQUFnQjtXQUNsRCxLQUFLLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxTQUFTO1dBQ3BDLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTO1dBQzdELEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsRUFBRTtXQUM5RCxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsS0FBSyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsYUFBYTtXQUNyRSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLFNBQVM7V0FDckUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLEtBQUssTUFBTSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxVQUFVO1dBQ3ZFLEtBQUssQ0FBQyxhQUFhLEtBQUssTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ25ELE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLENBQUM7QUFDM0IsQ0FBQyxDQUFDO0FBRUYsa0hBQWtIO0FBQ2xILE1BQU0sQ0FBQyxNQUFNLG1DQUFtQyxHQUFHLEtBQUssRUFDdEQsUUFBaUIsRUFBRSxhQUFzQixFQUFFLG9CQUE2QixFQUNFLEVBQUU7SUFDNUUsTUFBTSxLQUFLLEdBQUcsMkJBQTJCLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDcEQsTUFBTSxVQUFVLEdBQUcseUJBQXlCLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDNUQsSUFBSSxDQUFDLE1BQU0sMkJBQTJCLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxNQUFNLElBQUksQ0FBQyxNQUFNLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsTUFBTTtRQUFFLElBQUksRUFBRSxDQUFDO0lBQ3RILE1BQU0saUJBQWlCLEdBQUcsRUFBRSxDQUFDLG9CQUFvQixDQUFDLENBQUM7SUFDbkQsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUN6RixZQUFZLENBQUMsU0FBUyxFQUFFLFVBQVUsS0FBSyxLQUFLLENBQUMsVUFBVSxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLE1BQU07V0FDdkYsS0FBSyxDQUFDLFNBQVMsS0FBSyxpQkFBaUI7V0FDckMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssU0FBUztXQUN4QyxVQUFVLENBQUMsVUFBVSxDQUFDLEVBQUUsS0FBSyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUU7V0FDaEQsVUFBVSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEtBQUssS0FBSyxDQUFDLFVBQVUsQ0FBQyxLQUFLO1dBQ3RELFVBQVUsQ0FBQyxjQUFjLEtBQUssS0FBSyxDQUFDLGNBQWM7V0FDbEQsVUFBVSxDQUFDLE1BQU0sS0FBSyxLQUFLLENBQUMsTUFBTTtXQUNsQyxVQUFVLENBQUMsZ0JBQWdCLEtBQUssS0FBSyxDQUFDLGdCQUFnQjtXQUN0RCxVQUFVLENBQUMsU0FBUyxLQUFLLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMvQyxPQUFPLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBQy9CLENBQUMsQ0FBQyJ9
@@ -2,7 +2,8 @@ import * as plugins from '../plugins.js';
2
2
  import type { IIdentityCredential } from '../data/user.js';
3
3
  import type { IClusterRuntime } from '../data/clusterruntime.js';
4
4
  import type { IServiceRuntimeSpec } from '../data/serviceruntime.js';
5
- import type { IFleetCutoverAcceptedEvidenceReference, IFleetCutoverCorestoreAdoptionReceipt, IFleetCutoverIngressDesignation, IFleetCutoverIngressPreparationRequest, IFleetCutoverIngressAuthority, IFleetCutoverScope, IFleetCutoverScopeClassificationRequest, IFleetCutoverVolumeHandoffIntent, TFleetCutoverPhaseAdvance, TFleetCutoverRuntimeSpecRelease, TFleetCutoverVolumeFence } from '../data/fleetcutover.js';
5
+ import type { IFleetCutoverAcceptedEvidenceReference, IFleetCutoverCorestoreAdoptionReceipt, IFleetCutoverPreparedVolumeHandoffAggregate, IFleetCutoverPreparedVolumeHandoffIntent, IFleetCutoverPreparedVolumeHandoffMutation, IFleetCutoverStorageAdoptionBundle, IFleetCutoverIngressDesignation, IFleetCutoverIngressPreparationRequest, IFleetCutoverIngressAuthority, IFleetCutoverScope, IFleetCutoverScopeClassificationRequest, IFleetCutoverVolumeHandoffIntent, TFleetCutoverPhaseAdvance, TFleetCutoverRuntimeSpecRelease, TFleetCutoverVolumeFence } from '../data/fleetcutover.js';
6
+ import type { IRuntimeStorageClaim } from '../data/runtimestorageclaim.js';
6
7
  export interface IReq_Any_Cloudly_GetFleetCutoverScope extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Any_Cloudly_GetFleetCutoverScope> {
7
8
  method: 'getFleetCutoverScope';
8
9
  request: {
@@ -28,6 +29,23 @@ export interface IReq_Admin_Cloudly_ClassifyFleetCutoverScope extends plugins.ty
28
29
  scope: IFleetCutoverScope;
29
30
  };
30
31
  }
32
+ /**
33
+ * Admin CAS input selects authenticated legacy mounts and desired filesystem requests. Cloudly
34
+ * derives every owner identity and evidence reference, then rewrites one complete aggregate
35
+ * revision without truncating untouched entries.
36
+ */
37
+ export interface IReq_Admin_Cloudly_PrepareFleetCutoverVolumeHandoffs extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_PrepareFleetCutoverVolumeHandoffs> {
38
+ method: 'prepareFleetCutoverVolumeHandoffs';
39
+ request: {
40
+ identity: IIdentityCredential;
41
+ mutation: IFleetCutoverPreparedVolumeHandoffMutation;
42
+ };
43
+ response: {
44
+ aggregate: IFleetCutoverPreparedVolumeHandoffAggregate;
45
+ handoffs: IFleetCutoverPreparedVolumeHandoffIntent[];
46
+ replayed: boolean;
47
+ };
48
+ }
31
49
  /**
32
50
  * Forward-only legal phase CAS. All receipt references are dereferenced by Cloudly in the same
33
51
  * transaction; caller-supplied records or booleans never satisfy a cutover condition.
@@ -85,7 +103,10 @@ export interface IReq_Any_Cloudly_GetFleetCutoverIngressAuthority extends plugin
85
103
  authority: IFleetCutoverIngressAuthority | null;
86
104
  };
87
105
  }
88
- /** Root-local only. Holding an intent creates negative storage authority and no runtime session. */
106
+ /**
107
+ * @deprecated Published 32.x declaration retained for wire compatibility. Production owners do
108
+ * not register it; remove at the next protocol major.
109
+ */
89
110
  export interface IReq_PalletLocal_Pallet_HoldFleetCutoverVolumeFence extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PalletLocal_Pallet_HoldFleetCutoverVolumeFence> {
90
111
  method: 'holdFleetCutoverVolumeFence';
91
112
  request: {
@@ -98,6 +119,19 @@ export interface IReq_PalletLocal_Pallet_HoldFleetCutoverVolumeFence extends plu
98
119
  }>;
99
120
  };
100
121
  }
122
+ /** Spark calls only this fixed root-private Pallet socket operation for a prepared handoff. */
123
+ export interface IReq_SparkLocal_Pallet_HoldPreparedFleetCutoverVolumeFence extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_SparkLocal_Pallet_HoldPreparedFleetCutoverVolumeFence> {
124
+ method: 'holdPreparedFleetCutoverVolumeFence';
125
+ request: {
126
+ fenceId: string;
127
+ handoffIntent: IFleetCutoverPreparedVolumeHandoffIntent;
128
+ };
129
+ response: {
130
+ fence: Extract<TFleetCutoverVolumeFence, {
131
+ state: 'held';
132
+ }>;
133
+ };
134
+ }
101
135
  export interface IReq_PalletLocal_Pallet_GetFleetCutoverVolumeFence extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PalletLocal_Pallet_GetFleetCutoverVolumeFence> {
102
136
  method: 'getFleetCutoverVolumeFence';
103
137
  request: {
@@ -108,8 +142,8 @@ export interface IReq_PalletLocal_Pallet_GetFleetCutoverVolumeFence extends plug
108
142
  };
109
143
  }
110
144
  /**
111
- * Pallet consumes the local fence only around a current accepted Corestore adoption result. The
112
- * receipt carries the real ready storage-claim reference; the earlier handoff intent does not.
145
+ * @deprecated Ownership-inverted published 32.x declaration. Production owners do not register
146
+ * or adapt it; remove at the next protocol major.
113
147
  */
114
148
  export interface IReq_PalletLocal_Pallet_ConsumeFleetCutoverVolumeFence extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PalletLocal_Pallet_ConsumeFleetCutoverVolumeFence> {
115
149
  method: 'consumeFleetCutoverVolumeFence';
@@ -124,8 +158,21 @@ export interface IReq_PalletLocal_Pallet_ConsumeFleetCutoverVolumeFence extends
124
158
  };
125
159
  }
126
160
  /**
127
- * Corestore owns the one-shot initial lineage/RWO CAS. The local caller supplies the held fence
128
- * and server-owned handoff intent; Corestore returns the claim only after its provider is ready.
161
+ * Root-private trigger names only the durable hold. Pallet owns the per-volume lane, obtains and
162
+ * later revalidates a current controller grant, invokes Corestore, then consumes atomically.
163
+ */
164
+ export interface IReq_PalletLocal_Pallet_AdoptFleetCutoverVolumeFence extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_PalletLocal_Pallet_AdoptFleetCutoverVolumeFence> {
165
+ method: 'adoptFleetCutoverVolumeFence';
166
+ request: {
167
+ fence: IFleetCutoverAcceptedEvidenceReference;
168
+ };
169
+ response: {
170
+ bundle: IFleetCutoverStorageAdoptionBundle;
171
+ };
172
+ }
173
+ /**
174
+ * @deprecated Published 32.x declaration retained but unsupported and unregistered. Its handoff
175
+ * cannot carry the complete desired claim intent; remove at the next protocol major.
129
176
  */
130
177
  export interface IReq_Pallet_Corestore_AdoptFleetCutoverVolume extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Corestore_AdoptFleetCutoverVolume> {
131
178
  method: 'adoptFleetCutoverVolume';
@@ -139,3 +186,20 @@ export interface IReq_Pallet_Corestore_AdoptFleetCutoverVolume extends plugins.t
139
186
  adoption: IFleetCutoverCorestoreAdoptionReceipt;
140
187
  };
141
188
  }
189
+ /**
190
+ * Private isolated one-shot invocation. Corestore performs physical-lineage proof and initial
191
+ * ready-claim CAS while its native attachment fence is held, with no callback into Pallet.
192
+ */
193
+ export interface IReq_Pallet_Corestore_AdoptPreparedFleetCutoverVolume extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Corestore_AdoptPreparedFleetCutoverVolume> {
194
+ method: 'adoptPreparedFleetCutoverVolume';
195
+ request: {
196
+ handoffIntent: IFleetCutoverPreparedVolumeHandoffIntent;
197
+ palletFence: Extract<TFleetCutoverVolumeFence, {
198
+ state: 'held';
199
+ }>;
200
+ };
201
+ response: {
202
+ adoption: IFleetCutoverCorestoreAdoptionReceipt;
203
+ claim: IRuntimeStorageClaim;
204
+ };
205
+ }
@@ -5,6 +5,8 @@ import type * as network from '../data/networkdelivery.js';
5
5
  import type * as protection from '../data/networkprotection.js';
6
6
  import type * as credential from '../data/networkcredential.js';
7
7
  import type * as assignmentSecret from '../runtime.assignmentsecret.js';
8
+ import type * as fleet from '../data/fleetcutover.js';
9
+ import type { IRuntimeStorageClaim } from '../data/runtimestorageclaim.js';
8
10
  /** Current-peer, exact-projection authorization; response contains secret keys. */
9
11
  export interface IReq_Pallet_Controller_GetRuntimeManagedVpnCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeManagedVpnCredential> {
10
12
  method: 'getRuntimeManagedVpnCredential';
@@ -17,6 +19,51 @@ export interface IReq_Pallet_Controller_ReportRuntimeNetworkProtection extends p
17
19
  request: protection.IReportRuntimeNetworkProtectionRequest;
18
20
  response: protection.IReportRuntimeNetworkProtectionResponse;
19
21
  }
22
+ /**
23
+ * Current authenticated Pallet session only. Cloudly reads the current pallet runtime and exact
24
+ * owner records, then grants one held prepared handoff; serialized session content is no proof.
25
+ */
26
+ export interface IReq_Pallet_Controller_AuthorizeFleetCutoverStorageAdoption extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_AuthorizeFleetCutoverStorageAdoption> {
27
+ method: 'authorizeFleetCutoverStorageAdoption';
28
+ request: {
29
+ session: data.IRuntimeSessionBinding;
30
+ handoffIntent: fleet.IFleetCutoverAcceptedEvidenceReference;
31
+ fence: fleet.IFleetCutoverAcceptedEvidenceReference;
32
+ };
33
+ response: {
34
+ grant: fleet.IFleetCutoverStorageAdoptionGrant;
35
+ replayed: boolean;
36
+ };
37
+ }
38
+ /**
39
+ * Pallet revalidates current session, pallet phase and grant after the provider call, then reports
40
+ * the exact consumed bundle. A stale grant leaves the durable local hold unchanged.
41
+ */
42
+ export interface IReq_Pallet_Controller_ReportFleetCutoverStorageAdoption extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_ReportFleetCutoverStorageAdoption> {
43
+ method: 'reportFleetCutoverStorageAdoption';
44
+ request: {
45
+ session: data.IRuntimeSessionBinding;
46
+ bundle: fleet.IFleetCutoverStorageAdoptionBundle;
47
+ };
48
+ response: {
49
+ status: 'accepted' | 'replay';
50
+ grant: fleet.IFleetCutoverAcceptedEvidenceReference;
51
+ fence: fleet.IFleetCutoverAcceptedEvidenceReference;
52
+ adoption: fleet.IFleetCutoverAcceptedEvidenceReference;
53
+ claim: fleet.IFleetCutoverAcceptedEvidenceReference;
54
+ };
55
+ }
56
+ /** Current-session read of one accepted ready claim by its exact immutable reference. */
57
+ export interface IReq_Pallet_Controller_GetRuntimeStorageClaim extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Pallet_Controller_GetRuntimeStorageClaim> {
58
+ method: 'getRuntimeStorageClaim';
59
+ request: {
60
+ session: data.IRuntimeSessionBinding;
61
+ claim: fleet.IFleetCutoverAcceptedEvidenceReference;
62
+ };
63
+ response: {
64
+ claim: IRuntimeStorageClaim;
65
+ };
66
+ }
20
67
  /** Dedicated signing trust installed only through the current authenticated physical peer. */
21
68
  export interface IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthority extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeNetworkSigningAuthority> {
22
69
  method: 'applyRuntimeNetworkSigningAuthority';
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@serve.zone/interfaces",
3
- "version": "32.14.0",
3
+ "version": "32.15.0",
4
4
  "private": false,
5
5
  "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
6
6
  "exports": {
package/readme.md CHANGED
@@ -1093,19 +1093,61 @@ current Spark bundle/unit/configuration and old-mode refusal evidence. This is a
1093
1093
  owner; it is never represented as a Pallet assignment. Downstream service holds and storage fences
1094
1094
  therefore depend on a live relay without requiring assignment authority that cannot exist yet.
1095
1095
 
1096
- The storage bootstrap has two different authorities. `IFleetCutoverVolumeHandoffIntent` is
1097
- Cloudly's accepted pre-switch statement of exact service, volume, source-lineage and storage-request
1098
- identity. It also binds the exact persistent `mountIdentityDigest` and accepted source-node
1099
- observation. It is not a ready `IRuntimeStorageClaim`. Pallet persists a root-local
1100
- `TFleetCutoverVolumeFence` in `held` state while the cluster is draining. That state carries no
1101
- claim, session, assignment, attachment, reservation, confirmation or execution authority, and the
1102
- storage owner must block all those operations for the volume. After the cluster reaches `pallet`,
1103
- Corestore performs its one-shot initial lineage/ReadWriteOnce CAS for the same mount identity under
1104
- that held native fence and returns `IFleetCutoverCorestoreAdoptionReceipt`, which for the first time
1105
- binds the real ready
1106
- `IRuntimeStorageClaim` reference. Only that exact accepted receipt can consume the Pallet fence.
1107
- This separation prevents a pre-switch fence from fabricating provider readiness merely to satisfy
1108
- cutover ordering.
1096
+ The storage bootstrap separates desired identity, observed legacy identity and provider-proved
1097
+ physical lineage. `IFleetCutoverPreparedVolumeHandoffIntent` is Cloudly's accepted pre-switch
1098
+ statement. It carries the full sealed `IRuntimeStorageClaimIntent` and the exact persistent
1099
+ `observedMount`, including Docker source, target and combined identity digests. The Docker source
1100
+ digest commits only to Docker's exact source bytes; it is never physical lineage. The prepared
1101
+ handoff deliberately has no `sourceLineageDigest`. Corestore creates that independent commitment
1102
+ from its private device, inode and content proof while the native attachment fence is held.
1103
+
1104
+ An administrator changes prepared handoffs through
1105
+ `prepareFleetCutoverVolumeHandoffs`. Each compare-and-swap mutation contains 1..32 combined upserts
1106
+ and explicit removals. An upsert supplies only `{ nodeId, serviceId, mountIdentityDigest, request }`,
1107
+ where `request` is the full canonical retained `ReadWriteOnce` filesystem request. Cloudly derives
1108
+ the volume, controller, organization, namespace, claim identity, evidence references and request
1109
+ digest from current owner rows. It re-derives the complete required set from the admitted manager
1110
+ task inventory and accepted local observations. The maximum possible physical set is
1111
+ `maximumTasks * maximumMountsPerOwner`, or `4096 * 32 = 131072`; node placement is already carried
1112
+ by each admitted task, so a service-count bound would undercount replicated placement.
1113
+
1114
+ `IFleetCutoverPreparedVolumeHandoffAggregate` is a revisioned header with required/actual counts,
1115
+ state, page count and a complete set digest. It does not inline page references. Each immutable
1116
+ `IFleetCutoverPreparedVolumeHandoffPage` contains 1..32 sorted handoff references, with the owning
1117
+ `nodeId` committed beside every exact handoff revision, plus its content digest and the exact
1118
+ aggregate revision. Readers pin one aggregate, fetch every consecutive page and reject missing,
1119
+ duplicate, stale or mixed-revision pages. The set digest covers the ordered page-content digests. A
1120
+ 32-entry mutation is therefore a wire bound, not a fleet volume ceiling.
1121
+
1122
+ Spark reads one pinned page from
1123
+ `/spark/swarm-nodes/fleet-cutover-prepared-volume-handoffs`. The response carries the full immutable
1124
+ page and the authenticated node's complete full-handoff subset, including an explicit empty subset.
1125
+ Spark forwards held fences through the optional `fleetCutoverHeldVolumeFences` member available in
1126
+ every Swarm-observation state. The page's node-bearing references determine the exact subset; fetch
1127
+ responses and fence evidence must match every committed reference in page order, so omission is
1128
+ rejected and an empty report is valid only for a node with no entry on that page. The request binds
1129
+ the evidence node to the authenticated reporter. That evidence has a dedicated 128 KiB encoded
1130
+ budget and never displaces the existing census snapshots. One node's page report proves only that
1131
+ node's subset; Cloudly establishes global completeness across accepted reports for every page and
1132
+ node.
1133
+
1134
+ Pallet persists `TFleetCutoverVolumeFence` in `held` state while draining. A hold grants no claim,
1135
+ session, assignment, attachment, reservation, confirmation or execution authority. After the real
1136
+ current runtime reaches `pallet`, Pallet obtains `IFleetCutoverStorageAdoptionGrant` through its live
1137
+ authenticated session. The grant binds the exact prepared handoff, held fence, current pallet
1138
+ runtime, session generation/epoch and observed mount. Pallet keeps its per-volume lane while it
1139
+ invokes the isolated Corestore one-shot. Corestore performs physical-lineage proof and the initial
1140
+ ready-claim CAS under its native attachment fence, without calling back into Pallet, and returns the
1141
+ full claim with `IFleetCutoverCorestoreAdoptionReceipt`. Pallet revalidates the live session, runtime
1142
+ phase and grant after that potentially long operation before consuming the durable hold. A stale
1143
+ grant leaves the hold intact.
1144
+
1145
+ `bindFleetCutoverAdoptionToStorageClaim` joins the provider receipt and full ready claim to the
1146
+ prepared desired intent. `bindFleetCutoverStorageAdoptionBundle` additionally joins the current
1147
+ grant and consumed fence. Neither binder equates the provider physical-lineage digest with the
1148
+ observed Docker source digest or requires the provider's opaque `resourceRef` to equal Cloudly's
1149
+ volume ID. They are content checks; current owner dereferencing, peer authentication and native
1150
+ attachment fencing remain mandatory.
1109
1151
 
1110
1152
  `IFleetCutoverCoreflowRetirementEvidence` binds the real pre-switch Docker Coreflow32 relay by exact
1111
1153
  service ID, container ID, spec version/spec digest and image digest to accepted manager and local
@@ -1154,9 +1196,14 @@ application release may cite that authority. The legacy Docker Coretraffic insta
1154
1196
  remains through `switching`; the new ingress runs without public ports before exact port ownership
1155
1197
  moves, and applications remain held until the new authoritative route is read back.
1156
1198
 
1157
- The owner methods live under `requests.fleetcutover`: administrator scope classification, ingress
1158
- preparation and forward phase CAS, root-local Pallet volume-fence hold/read/
1159
- consume, one-shot Corestore adoption, ingress-authority read, and ingress/application spec release.
1199
+ The owner methods live under `requests.fleetcutover`: administrator scope classification, storage
1200
+ handoff preparation, ingress preparation and forward phase CAS; root-private prepared-fence hold,
1201
+ read and owner-triggered adoption; isolated Corestore prepared-volume adoption; ingress-authority
1202
+ read; and ingress/application spec release. Current-session adoption authorization, accepted bundle
1203
+ reporting and full claim readback live under `requests.runtimesession`. The published 32.x
1204
+ `holdFleetCutoverVolumeFence`, `consumeFleetCutoverVolumeFence` and `adoptFleetCutoverVolume`
1205
+ declarations remain for type compatibility only. Production owners do not register or adapt those
1206
+ incomplete operations; they are marked for removal at the next protocol major.
1160
1207
  Spark transports local and manager evidence through its existing authenticated Swarm-observation
1161
1208
  route, and Cloudly assembles census and Coreflow-retirement records from accepted owner state; there
1162
1209
  is no caller-supplied census or retirement proof endpoint.
@@ -1671,6 +1718,15 @@ or sender addresses itself.
1671
1718
 
1672
1719
  ### Runtime filesystem storage claims
1673
1720
 
1721
+ `data.IRuntimeStorageClaimIntent` is the non-ready Cloudly-owned precursor to a claim. It fixes the
1722
+ controller epoch, organization, cluster, node, runtime namespace, service, claim ID/generation and
1723
+ predecessor, plus `IRuntimeStorageClaimRequestedFilesystemBinding`. That requested binding fixes the
1724
+ service, full normalized retained `ReadWriteOnce` filesystem request and its canonical bare digest.
1725
+ It structurally cannot state a provider binding ID/generation, policy selection, status, observed
1726
+ generation, resource reference or granted capability. The intent is exact-schema and digest-bound
1727
+ under `serve.zone/runtime-storage-claim-intent`; it grants no assignment, session, execution or
1728
+ attachment authority.
1729
+
1674
1730
  `data.IRuntimeStorageClaim` is the portable, Cloudly-issued authority for one
1675
1731
  ready, retained `ReadWriteOnce` filesystem binding on one cluster node. It
1676
1732
  names the organization, service, cluster, node, runtime namespace, controller
@@ -1695,6 +1751,14 @@ provider readiness and policy, durably admit the assignment, and obtain a
1695
1751
  fenced native attachment from the storage owner before a CRI mount. An absent
1696
1752
  claim or an unverified opaque resource reference never authorizes a mount.
1697
1753
 
1754
+ `data.bindRuntimeStorageClaimToIntent(claim, intent)` verifies both canonical digests and requires
1755
+ the ready claim to preserve every Cloudly-owned identity and requested filesystem fact: service,
1756
+ request ID/digest, mount path, access mode and reclaim policy. Only the full claim may add the
1757
+ storage provider's binding identity/generation, selected policy, matching observed generation,
1758
+ `ready` status, opaque resource reference and persistent single-node capabilities. This is a content
1759
+ join: callers still authenticate Cloudly and the provider, check current readiness and retain the
1760
+ native fence.
1761
+
1698
1762
  `platform.storagemigration` defines the provider-neutral cutover contract for a
1699
1763
  named object-storage binding. Corestore atomically owns and fences the source
1700
1764
  binding after validating a distinct, unfenced active-object snapshot. Onebox
@@ -3,6 +3,6 @@
3
3
  */
4
4
  export const commitinfo = {
5
5
  name: '@serve.zone/interfaces',
6
- version: '32.14.0',
6
+ version: '32.15.0',
7
7
  description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
8
8
  }