@serve.zone/interfaces 32.19.0 → 32.20.0

package/dist_ts/data/runtimesession.js

@@ -2,7 +2,8 @@ import { isSha256Digest } from './immutableimage.js';
 import { getRuntimeAssignmentReference, isResolvedWorkloadAuthorities, snapshotRuntimeAssignmentObservation, snapshotRuntimeAssignment, validateRuntimeAssignmentObservation, validateRuntimeAssignment, } from './runtimeassignment.js';
 import { negotiateProtocol, readProtocolOffer } from '../protocol.js';
 import { bindRuntimeConfigToAssignment, snapshotRuntimeConfig } from './runtimeconfig.js';
-import { canonicalizeStrictJson } from '../private/canonicaljson.js';
+import { snapshotNodeRuntimeLocalBindingConfirmation, snapshotNodeRuntimeLocalRoutingBinding } from './noderuntimebinding.js';
+import { canonicalizeStrictJson, createSha256Hex } from '../private/canonicaljson.js';
 import { isClusterNodeId } from '../private/nodeidentifier.js';
 /**
  * The rules every runtime session registration is judged by.
@@ -225,6 +226,46 @@ export const bindRegisterPalletRuntimeSessionResponse = (valueArg, requestArg) =
         && negotiateProtocol(request.protocol, response.protocol).compatible);
     return response;
 });
+/**
+ * Bind a local controller's registration reply to the node's own local routing binding.
+ *
+ * The counterpart of `bindRegisterPalletRuntimeSessionResponse` for a node bound to a controller on
+ * its own host: the answered session must name exactly the binding's controller, node, cluster and
+ * runtime namespace, the credential generation sent, and an offer compatible with the one sent.
+ * `bindingArg` must come from the node's own durable state, never from the reply.
+ */
+export const bindRegisterPalletLocalRuntimeSessionResponse = (valueArg, requestArg, bindingArg) => safe(() => {
+    const response = snapshotRegisterPalletRuntimeSessionResponse(valueArg);
+    const request = snapshotRegisterPalletRuntimeSessionRequest(requestArg);
+    const binding = snapshotNodeRuntimeLocalRoutingBinding(bindingArg);
+    requireValue(canonical(response.session.controller) === canonical(binding.controller)
+        && request.nodeId === binding.nodeId && response.session.nodeId === binding.nodeId
+        && response.session.clusterId === binding.clusterId
+        && response.session.runtimeNamespace === binding.runtimeNamespace
+        && response.session.credentialGeneration === request.credentialGeneration
+        && negotiateProtocol(request.protocol, response.protocol).compatible);
+    return response;
+});
+/**
+ * Controller-side check of a local node's registration against the credential this controller
+ * pinned at its first local bind. `confirmationArg` must come from the controller's own durable
+ * state, never from the request. This proves the bearer is the one that bind acknowledged; the
+ * socket's file permissions remain the peer authentication, and session admission stays the
+ * controller's.
+ */
+export const bindRegisterPalletLocalRuntimeSessionRequest = async (valueArg, confirmationArg) => {
+    try {
+        const request = snapshotRegisterPalletRuntimeSessionRequest(valueArg);
+        const confirmation = snapshotNodeRuntimeLocalBindingConfirmation(confirmationArg);
+        requireValue(request.nodeId === confirmation.binding.nodeId
+            && request.credentialGeneration === confirmation.credential.generation);
+        requireValue(await createSha256Hex(encoder.encode(request.bearer), fail) === confirmation.credential.tokenHash);
+        return request;
+    }
+    catch {
+        return fail();
+    }
+};
 /** Reject already expired material; issuance policy and current assignment authority remain server-owned. */
 export const bindGetRuntimeRegistryCredentialResponse = (valueArg, nowArg) => safe(() => {
     const response = snapshotGetRuntimeRegistryCredentialResponse(valueArg);
@@ -324,4 +365,4 @@ export const bindGetRuntimeRegistryCredentialRequest = async (valueArg, assignme
         return fail();
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXNlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVzZXNzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUtyRCxPQUFPLEVBQ0wsNkJBQTZCLEVBQUUsNkJBQTZCLEVBQUUsb0NBQW9DLEVBQ2xHLHlCQUF5QixFQUFFLG9DQUFvQyxFQUFFLHlCQUF5QixHQUMzRixNQUFNLHdCQUF3QixDQUFDO0FBQ2hDLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBdUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUUzRixPQUFPLEVBQUUsNkJBQTZCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUMxRixPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUNyRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFrSS9EOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNsRCx5QkFBeUIsRUFBRSxPQUFPO0lBQ2xDLHNCQUFzQixFQUFFLE1BQU07SUFDOUIsNEJBQTRCLEVBQUUsSUFBSTtJQUNsQyxpQkFBaUIsRUFBRSx5REFBeUQ7SUFDNUUsOEJBQThCLEVBQUUsOEJBQThCO0lBQzlELHVCQUF1QixFQUFFLDJDQUEyQztJQUNwRSw4RkFBOEY7SUFDOUYsb0JBQW9CLEVBQUUsMkRBQTJEO0lBQ2pGLEtBQUssRUFBRSxvQ0FBb0M7Q0FDbkMsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM3RSxTQUFTLFlBQVksQ0FBQyxZQUFxQjtJQUN6QyxJQUFJLENBQUMsWUFBWTtRQUFFLElBQUksRUFBRSxDQUFDO0FBQzVCLENBQUM7QUFDRCxNQUFNLElBQUksR0FBRyxDQUFJLFlBQXFCLEVBQUssRUFBRTtJQUMzQyxJQUFJLENBQUM7UUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO0lBQUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ3pELENBQUMsQ0FBQztBQUNGLE1BQU0sT0FBTyxHQUFHLElBQUksV0FBVyxFQUFFLENBQUM7QUFDbEMsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDeEYsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDN0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM3RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLFVBQVUsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUMvQyxZQUFZLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUNGLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzNDLFlBQVksQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN4QyxPQUFPLFFBQWtCLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBQ0YsNEVBQTRFO0FBQzVFLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDdEQsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDcEMsZ0VBQWdFLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztXQUMvRSxRQUFRLEtBQUssc0NBQXNDLENBQUMsQ0FBQztJQUMxRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRix3RkFBd0Y7QUFDeEYsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUFXLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3hELElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztJQUNkLElBQUksV0FBVyxHQUFHLENBQUMsQ0FBQztJQUNwQixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3BDLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYSxFQUFRLEVBQUU7UUFDdEMsWUFBWSxDQUFDLEtBQUssQ0FBQyxNQUFNLElBQUksc0JBQXNCLENBQUMseUJBQXlCLENBQUMsQ0FBQztRQUMvRSxXQUFXLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFDaEQsWUFBWSxDQUFDLFdBQVcsSUFBSSxzQkFBc0IsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2hGLENBQUMsQ0FBQztJQUNGLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBYyxFQUFFLEtBQWEsRUFBVyxFQUFFO1FBQ3RELFlBQVksQ0FBQyxFQUFFLEtBQUssSUFBSSxNQUFNLElBQUksS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQy9DLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssQ0FBQztRQUFDLENBQUM7UUFDaEUsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDNUYsWUFBWSxDQUFDLEtBQUssS0FBSyxJQUFJLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ25GLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNuQyxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQy9DLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSSxDQUFDLENBQUM7WUFDM0csTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNwQyxZQUFZLENBQUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxHQUFHLENBQUMsQ0FBQztZQUNqQyxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUNWLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDLEVBQUUsS0FBSyxDQUFDO2dCQUN2RSxZQUFZLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsSUFBSSxNQUFNLElBQUksQ0FBQyxJQUFJLE1BQU0sSUFBSSxHQUFHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7Z0JBQ3pHLE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztnQkFDN0IsS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO29CQUM1QyxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO29CQUN6RSxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO29CQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO2dCQUNqRCxDQUFDO2dCQUNELE9BQU8sTUFBTSxDQUFDO1lBQ2hCLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBNEIsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUM1RCxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUN2QixZQUFZLENBQUMsT0FBTyxHQUFHLEtBQUssUUFBUSxDQUFDLENBQUM7Z0JBQ3RDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztnQkFDYixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDO2dCQUMvRCxZQUFZLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO2dCQUMzRSxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDO2dCQUFTLENBQUM7WUFBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQUMsQ0FBQztJQUN4QyxDQUFDLENBQUM7SUFDRixNQUFNLFVBQVUsR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hELFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDLFVBQVUsSUFBSSxzQkFBc0IsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ3hHLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUNoQyxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sTUFBTSxHQUFHLENBQ2IsUUFBaUIsRUFBRSxPQUEwQixFQUFFLGtCQUFxQyxFQUFFLEVBQzdELEVBQUU7SUFDM0IsWUFBWSxDQUFDLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7V0FDbEQsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxlQUFlLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNsRixPQUFPLFFBQW1DLENBQUM7QUFDN0MsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUErQixFQUFFO0lBQ25FLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxRQUFRLEVBQUUsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDekUsWUFBWSxDQUFDLE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQy9FLE9BQU8sRUFBRSxZQUFZLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxDQUFDO0FBQ3hILENBQUMsQ0FBQztBQUNGLE1BQU0sT0FBTyxHQUFHLENBQUMsUUFBaUIsRUFBMEIsRUFBRTtJQUM1RCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsbUJBQW1CLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxzQkFBc0I7UUFDaEcsY0FBYyxFQUFFLHNCQUFzQixFQUFFLFlBQVksRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLENBQUM7SUFDN0UsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDckUsWUFBWSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLFVBQVUsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDNUUsT0FBTztRQUNMLGlCQUFpQixFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDcEYsU0FBUyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQ3RDLG9CQUFvQixFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsb0JBQW9CLENBQUMsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUM7UUFDdEcsb0JBQW9CLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQztRQUM1RCxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUksRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRTtRQUN6RyxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDO0tBQ3JELENBQUM7QUFDSixDQUFDLENBQUM7QUFDRixNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQStCLEVBQUUsUUFBZ0MsRUFBVyxFQUFFLENBQ2pHLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0MsTUFBTSxTQUFTLEdBQUcsQ0FBQyxPQUErQixFQUFFLFFBQWdDLEVBQVcsRUFBRSxDQUMvRixPQUFPLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxNQUFNLElBQUksT0FBTyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUztPQUMzRSxPQUFPLENBQUMsZ0JBQWdCLEtBQUssUUFBUSxDQUFDLGdCQUFnQjtPQUN0RCxTQUFTLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7QUFDdEUsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFVBQWtDLEVBQUUsYUFBaUMsRUFBVyxFQUFFLENBQzNHLFVBQVUsQ0FBQyxNQUFNLEtBQUssYUFBYSxDQUFDLE1BQU0sSUFBSSxVQUFVLENBQUMsZ0JBQWdCLEtBQUssYUFBYSxDQUFDLGdCQUFnQjtPQUN6RyxTQUFTLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLENBQUM7QUFFOUUscUZBQXFGO0FBQ3JGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQUMsUUFBaUIsRUFBMEIsRUFBRSxDQUN6RixJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFekMsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FDekQsUUFBaUIsRUFDcUIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDbkQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFDcEMsQ0FBQyxRQUFRLEVBQUUsc0JBQXNCLEVBQUUsUUFBUSxFQUFFLG1CQUFtQixFQUFFLHFCQUFxQixFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDeEcsWUFBWSxDQUFDLE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksMkJBQTJCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ2pHLFlBQVksQ0FBQyw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxDQUFDO0lBQ3ZFLE9BQU87UUFDTCxNQUFNLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxvQkFBb0IsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDO1FBQ3hGLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTSxFQUFFLGlCQUFpQixFQUFFLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQztRQUNuRixtQkFBbUIsRUFBRSxDQUFDLEdBQUcsS0FBSyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsUUFBUSxFQUFFLGlCQUFpQixDQUFDLEtBQUssQ0FBQztLQUN4RixDQUFDO0FBQ0osQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw0Q0FBNEMsR0FBRyxDQUMxRCxRQUFpQixFQUNzQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNwRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDakUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQ2pGLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsQ0FDbkQsUUFBaUIsRUFDZSxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUM3QyxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFlBQVksRUFBRSxRQUFRLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLFVBQVUsR0FBRyx5QkFBeUIsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDL0QsTUFBTSxXQUFXLEdBQUcsS0FBSyxDQUFDLFdBQVcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNyRix5RkFBeUY7SUFDekYsWUFBWSxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksV0FBVyxDQUFDLFlBQVksS0FBSyxVQUFVLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDM0YsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUscUJBQXFCLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLFdBQVcsRUFBRSxDQUFDO0FBQ25ILENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsUUFBaUIsRUFDZ0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDOUMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxLQUFLLFVBQVUsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLFlBQVksQ0FBQyxDQUFDO0lBQ3hHLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxVQUFVLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO0FBQzNFLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0saURBQWlELEdBQUcsQ0FDL0QsUUFBaUIsRUFDMkIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDekQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLE9BQU8sRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxXQUFXLEVBQUUsb0NBQW9DLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7QUFDbkgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSxrREFBa0QsR0FBRyxDQUNoRSxRQUFpQixFQUM0QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUMxRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsYUFBYSxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDekUsWUFBWSxDQUFDLEtBQUssQ0FBQyxZQUFZLEtBQUssaUJBQWlCLElBQUksS0FBSyxDQUFDLFlBQVksS0FBSyxxQkFBcUIsQ0FBQyxDQUFDO0lBQ3ZHLE9BQU8sRUFBRSxXQUFXLEVBQUUsb0NBQW9DLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFFLFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWSxFQUFFLENBQUM7QUFDcEgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxDQUN6RCxRQUFpQixFQUNxQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNuRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDbkUsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDdEYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw0Q0FBNEMsR0FBRyxDQUMxRCxRQUFpQixFQUNzQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNwRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQy9FLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDdkUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxJQUFJLElBQUksSUFBSSxDQUFDLDBCQUEwQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RyxZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3ZFLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLFVBQVUsSUFBSSxzQkFBc0IsQ0FBQyw0QkFBNEI7V0FDaEcsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDcEQsT0FBTyxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDdEcsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxDQUN6RCxRQUFpQixFQUNxQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNuRCxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDbEUsTUFBTSxRQUFRLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2pELFlBQVksQ0FBQyxPQUFPLFFBQVEsQ0FBQyxHQUFHLEtBQUssUUFBUTtXQUN4QyxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sSUFBSSxzQkFBc0IsQ0FBQyxzQkFBc0I7V0FDcEUsa0RBQWtELENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVFLE9BQU8sRUFBRSxRQUFRLEVBQUUsRUFBRSxHQUFHLEVBQUUsUUFBUSxDQUFDLEdBQUcsRUFBRSxFQUFFLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQ2pGLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sNENBQTRDLEdBQUcsQ0FDMUQsUUFBaUIsRUFDc0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDcEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFlBQVksRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3BFLFlBQVksQ0FBQyxLQUFLLENBQUMsVUFBVSxLQUFLLElBQUksQ0FBQyxDQUFDO0lBQ3hDLE9BQU8sRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQ2xFLENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsQ0FDdEQsUUFBaUIsRUFBRSxVQUFtQixFQUNDLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3BELE1BQU0sUUFBUSxHQUFHLDRDQUE0QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sT0FBTyxHQUFHLDJDQUEyQyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hFLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssU0FBUztXQUN0RCxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTTtXQUMxQyxRQUFRLENBQUMsT0FBTyxDQUFDLG9CQUFvQixLQUFLLE9BQU8sQ0FBQyxvQkFBb0I7V0FDdEUsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDeEUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSCw2R0FBNkc7QUFDN0csTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsQ0FDdEQsUUFBaUIsRUFBRSxNQUFjLEVBQ00sRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDcEQsTUFBTSxRQUFRLEdBQUcsNENBQTRDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDeEUsWUFBWSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDcEQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsS0FBSyxFQUNwRCxRQUFpQixFQUFFLGlCQUEwQixFQUNKLEVBQUU7SUFDM0MsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcscUNBQXFDLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDaEUsTUFBTSxjQUFjLEdBQUcsNkJBQTZCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN4RSxZQUFZLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLElBQUksaUJBQWlCLENBQUMsY0FBYyxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3BILE1BQU0sNkJBQTZCLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDeEUsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUVGLG1HQUFtRztBQUNuRyxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUNoRCxRQUFpQixFQUFFLFVBQW1CLEVBQ0wsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDOUMsTUFBTSxRQUFRLEdBQUcsc0NBQXNDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEUsTUFBTSxPQUFPLEdBQUcscUNBQXFDLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDbEUsWUFBWSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLDZCQUE2QixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDOUcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUN4QyxVQUFtQixFQUFFLG9CQUE0QixFQUFFLGFBQXNCLEVBQ3pFLGlCQUEwQixFQUFFLGtCQUEyQixFQUN2QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUM3QyxNQUFNLGVBQWUsR0FBRyw2QkFBNkIsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNsRSxNQUFNLGlCQUFpQixHQUFHLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO0lBQzNELE1BQU0sVUFBVSxHQUFHLHlCQUF5QixDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLE1BQU0sY0FBYyxHQUFHLDZCQUE2QixDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFDeEUsTUFBTSxlQUFlLEdBQUcsNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRSxZQUFZLENBQUMsV0FBVyxDQUFDLGVBQWUsRUFBRSxjQUFjLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxjQUFjLEVBQUUsVUFBVSxDQUFDO1dBQ3JHLGlCQUFpQixLQUFLLGVBQWUsQ0FBQyxpQkFBaUIsSUFBSSxTQUFTLENBQUMsY0FBYyxFQUFFLGVBQWUsQ0FBQyxDQUFDLENBQUM7SUFDNUcsTUFBTSxPQUFPLEdBQUcsV0FBVyxDQUFDLGVBQWUsRUFBRSxjQUFjLENBQUMsQ0FBQztJQUM3RCxZQUFZLENBQUMsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLGlCQUFpQixLQUFLLGNBQWMsQ0FBQyxpQkFBaUI7V0FDMUYsZUFBZSxDQUFDLFlBQVksR0FBRyxjQUFjLENBQUMsWUFBWTtXQUMxRCxlQUFlLENBQUMsb0JBQW9CLElBQUksY0FBYyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQztJQUNuRixPQUFPLEVBQUUsT0FBTyxFQUFFLGVBQWUsRUFBRSxVQUFVLEVBQUUsZUFBZTtRQUM1RCxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMscUJBQXFCLEVBQUUsQ0FBQztBQUN4RSxDQUFDLENBQUMsQ0FBQztBQUVIOzs7Ozs7Ozs7O0dBVUc7QUFDSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxLQUFLLEVBQ2hFLFFBQWlCLEVBQUUsYUFBc0IsRUFBRSxpQkFBMEIsRUFBRSxrQkFBMkIsRUFDZSxFQUFFO0lBQ25ILElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLGlEQUFpRCxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzVFLE1BQU0sT0FBTyxHQUFHLDBCQUEwQixDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsRUFDL0YsYUFBYSxFQUFFLGlCQUFpQixFQUFFLGtCQUFrQixDQUFDLENBQUM7UUFDeEQsWUFBWSxDQUFDLENBQUMsTUFBTSxvQ0FBb0MsQ0FBQyxPQUFPLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNqSCxPQUFPLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWSxFQUFFLENBQUM7SUFDekQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUVGLHNGQUFzRjtBQUN0RixNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUM1RCxRQUFpQixFQUFFLFVBQW1CLEVBQ08sRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDMUQsTUFBTSxRQUFRLEdBQUcsa0RBQWtELENBQUMsUUFBUSxDQUFDLENBQUM7SUFDOUUsTUFBTSxPQUFPLEdBQUcsaURBQWlELENBQUMsVUFBVSxDQUFDLENBQUM7SUFDOUUsWUFBWSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEtBQUssU0FBUyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7V0FDMUUsUUFBUSxDQUFDLFlBQVksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEtBQUssT0FBTyxDQUFDLE9BQU8sQ0FBQyxpQkFBaUI7WUFDdkcsQ0FBQyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7SUFDbEQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSCxrR0FBa0c7QUFDbEcsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsS0FBSyxFQUMxRCxRQUFpQixFQUFFLGFBQXNCLEVBQUUsaUJBQTBCLEVBQ3RCLEVBQUU7SUFDakQsSUFBSSxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsMkNBQTJDLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDdEUsTUFBTSxVQUFVLEdBQUcseUJBQXlCLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7UUFDckUsTUFBTSxjQUFjLEdBQUcsNkJBQTZCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN4RSxZQUFZLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLElBQUksaUJBQWlCLENBQUMsY0FBYyxFQUFFLFVBQVUsQ0FBQztlQUNyRyxVQUFVLENBQUMsV0FBVyxLQUFLLEtBQUs7ZUFDaEMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsNkJBQTZCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzdGLFlBQVksQ0FBQyxDQUFDLE1BQU0seUJBQXlCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDekUsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZXNlc3Npb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVzZXNzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUtyRCxPQUFPLEVBQ0wsNkJBQTZCLEVBQUUsNkJBQTZCLEVBQUUsb0NBQW9DLEVBQ2xHLHlCQUF5QixFQUFFLG9DQUFvQyxFQUFFLHlCQUF5QixHQUMzRixNQUFNLHdCQUF3QixDQUFDO0FBQ2hDLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBdUIsTUFBTSxnQkFBZ0IsQ0FBQztBQUUzRixPQUFPLEVBQUUsNkJBQTZCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUMxRixPQUFPLEVBQUUsMkNBQTJDLEVBQUUsc0NBQXNDLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUM5SCxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZUFBZSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDdEYsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBc0kvRDs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQseUJBQXlCLEVBQUUsT0FBTztJQUNsQyxzQkFBc0IsRUFBRSxNQUFNO0lBQzlCLDRCQUE0QixFQUFFLElBQUk7SUFDbEMsaUJBQWlCLEVBQUUseURBQXlEO0lBQzVFLDhCQUE4QixFQUFFLDhCQUE4QjtJQUM5RCx1QkFBdUIsRUFBRSwyQ0FBMkM7SUFDcEUsOEZBQThGO0lBQzlGLG9CQUFvQixFQUFFLDJEQUEyRDtJQUNqRixLQUFLLEVBQUUsb0NBQW9DO0NBQ25DLENBQUMsQ0FBQztBQUVaLE1BQU0sSUFBSSxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsc0JBQXNCLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDN0UsU0FBUyxZQUFZLENBQUMsWUFBcUI7SUFDekMsSUFBSSxDQUFDLFlBQVk7UUFBRSxJQUFJLEVBQUUsQ0FBQztBQUM1QixDQUFDO0FBQ0QsTUFBTSxJQUFJLEdBQUcsQ0FBSSxZQUFxQixFQUFLLEVBQUU7SUFDM0MsSUFBSSxDQUFDO1FBQUMsT0FBTyxZQUFZLEVBQUUsQ0FBQztJQUFDLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUN6RCxDQUFDLENBQUM7QUFDRixNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDO0FBQ2xDLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFLENBQUMsc0JBQXNCLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO0FBQ3hGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzdDLFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDN0YsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxVQUFVLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDL0MsWUFBWSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNuRyxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFDRixNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUMzQyxZQUFZLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDeEMsT0FBTyxRQUFrQixDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUNGLDRFQUE0RTtBQUM1RSxNQUFNLGlCQUFpQixHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQ3RELFlBQVksQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQ3BDLGdFQUFnRSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7V0FDL0UsUUFBUSxLQUFLLHNDQUFzQyxDQUFDLENBQUM7SUFDMUQsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sT0FBTyxHQUFHLENBQUMsUUFBaUIsRUFBVyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUN4RCxJQUFJLEtBQUssR0FBRyxDQUFDLENBQUM7SUFDZCxJQUFJLFdBQVcsR0FBRyxDQUFDLENBQUM7SUFDcEIsTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNwQyxNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWEsRUFBUSxFQUFFO1FBQ3RDLFlBQVksQ0FBQyxLQUFLLENBQUMsTUFBTSxJQUFJLHNCQUFzQixDQUFDLHlCQUF5QixDQUFDLENBQUM7UUFDL0UsV0FBVyxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsVUFBVSxDQUFDO1FBQ2hELFlBQVksQ0FBQyxXQUFXLElBQUksc0JBQXNCLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUNoRixDQUFDLENBQUM7SUFDRixNQUFNLElBQUksR0FBRyxDQUFDLEtBQWMsRUFBRSxLQUFhLEVBQVcsRUFBRTtRQUN0RCxZQUFZLENBQUMsRUFBRSxLQUFLLElBQUksTUFBTSxJQUFJLEtBQUssSUFBSSxFQUFFLENBQUMsQ0FBQztRQUMvQyxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQUMsT0FBTyxLQUFLLENBQUM7UUFBQyxDQUFDO1FBQ2hFLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxTQUFTLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUTtZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQzVGLFlBQVksQ0FBQyxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNuRixTQUFTLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3JCLElBQUksQ0FBQztZQUNILE1BQU0sS0FBSyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDbkMsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMvQyxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsU0FBUyxLQUFLLE1BQU0sQ0FBQyxTQUFTLElBQUksU0FBUyxLQUFLLElBQUksQ0FBQyxDQUFDO1lBQzNHLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDcEMsWUFBWSxDQUFDLElBQUksQ0FBQyxNQUFNLElBQUksR0FBRyxDQUFDLENBQUM7WUFDakMsSUFBSSxLQUFLLEVBQUUsQ0FBQztnQkFDVixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxFQUFFLEtBQUssQ0FBQztnQkFDdkUsWUFBWSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxJQUFJLENBQUMsSUFBSSxNQUFNLElBQUksR0FBRyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO2dCQUN6RyxNQUFNLE1BQU0sR0FBYyxFQUFFLENBQUM7Z0JBQzdCLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztvQkFDNUMsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztvQkFDekUsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztvQkFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQztnQkFDakQsQ0FBQztnQkFDRCxPQUFPLE1BQU0sQ0FBQztZQUNoQixDQUFDO1lBQ0QsTUFBTSxNQUFNLEdBQTRCLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDNUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztnQkFDdkIsWUFBWSxDQUFDLE9BQU8sR0FBRyxLQUFLLFFBQVEsQ0FBQyxDQUFDO2dCQUN0QyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ2IsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLEtBQUssRUFBRSxHQUFHLENBQUMsQ0FBQztnQkFDL0QsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztnQkFDM0UsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztZQUNsRCxDQUFDO1lBQ0QsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQztnQkFBUyxDQUFDO1lBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUFDLENBQUM7SUFDeEMsQ0FBQyxDQUFDO0lBQ0YsTUFBTSxVQUFVLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNoRCxZQUFZLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQyxVQUFVLElBQUksc0JBQXNCLENBQUMseUJBQXlCLENBQUMsQ0FBQztJQUN4RyxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLENBQUM7QUFDaEMsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLE1BQU0sR0FBRyxDQUNiLFFBQWlCLEVBQUUsT0FBMEIsRUFBRSxrQkFBcUMsRUFBRSxFQUM3RCxFQUFFO0lBQzNCLFlBQVksQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUM1RixNQUFNLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLFlBQVksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1dBQ2xELElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksZUFBZSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbEYsT0FBTyxRQUFtQyxDQUFDO0FBQzdDLENBQUMsQ0FBQztBQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBK0IsRUFBRTtJQUNuRSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsUUFBUSxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUMvRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUN4SCxDQUFDLENBQUM7QUFDRixNQUFNLE9BQU8sR0FBRyxDQUFDLFFBQWlCLEVBQTBCLEVBQUU7SUFDNUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFFBQVEsRUFBRSxDQUFDLG1CQUFtQixFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsc0JBQXNCO1FBQ2hHLGNBQWMsRUFBRSxzQkFBc0IsRUFBRSxZQUFZLEVBQUUsa0JBQWtCLENBQUMsQ0FBQyxDQUFDO0lBQzdFLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsVUFBVSxFQUFFLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3JFLFlBQVksQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQzVFLE9BQU87UUFDTCxpQkFBaUIsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1FBQ3BGLFNBQVMsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUN0QyxvQkFBb0IsRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLG9CQUFvQixDQUFDLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDO1FBQ3RHLG9CQUFvQixFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsb0JBQW9CLENBQUM7UUFDNUQsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJLEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLEVBQUUsS0FBSyxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUU7UUFDekcsZ0JBQWdCLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztLQUNyRCxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBQ0YsTUFBTSxXQUFXLEdBQUcsQ0FBQyxPQUErQixFQUFFLFFBQWdDLEVBQVcsRUFBRSxDQUNqRyxTQUFTLENBQUMsT0FBTyxDQUFDLEtBQUssU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQzdDLE1BQU0sU0FBUyxHQUFHLENBQUMsT0FBK0IsRUFBRSxRQUFnQyxFQUFXLEVBQUUsQ0FDL0YsT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxTQUFTLEtBQUssUUFBUSxDQUFDLFNBQVM7T0FDM0UsT0FBTyxDQUFDLGdCQUFnQixLQUFLLFFBQVEsQ0FBQyxnQkFBZ0I7T0FDdEQsU0FBUyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQ3RFLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxVQUFrQyxFQUFFLGFBQWlDLEVBQVcsRUFBRSxDQUMzRyxVQUFVLENBQUMsTUFBTSxLQUFLLGFBQWEsQ0FBQyxNQUFNLElBQUksVUFBVSxDQUFDLGdCQUFnQixLQUFLLGFBQWEsQ0FBQyxnQkFBZ0I7T0FDekcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsS0FBSyxTQUFTLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBRTlFLHFGQUFxRjtBQUNyRixNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUFDLFFBQWlCLEVBQTBCLEVBQUUsQ0FDekYsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXpDLE1BQU0sQ0FBQyxNQUFNLDJDQUEyQyxHQUFHLENBQ3pELFFBQWlCLEVBQ3FCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ25ELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQ3BDLENBQUMsUUFBUSxFQUFFLHNCQUFzQixFQUFFLFFBQVEsRUFBRSxtQkFBbUIsRUFBRSxxQkFBcUIsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3hHLFlBQVksQ0FBQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUSxJQUFJLDJCQUEyQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNqRyxZQUFZLENBQUMsNkJBQTZCLENBQUMsS0FBSyxDQUFDLG1CQUFtQixDQUFDLENBQUMsQ0FBQztJQUN2RSxPQUFPO1FBQ0wsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQztRQUN4RixNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU0sRUFBRSxpQkFBaUIsRUFBRSxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUM7UUFDbkYsbUJBQW1CLEVBQUUsQ0FBQyxHQUFHLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLFFBQVEsRUFBRSxpQkFBaUIsQ0FBQyxLQUFLLENBQUM7S0FDeEYsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sNENBQTRDLEdBQUcsQ0FDMUQsUUFBaUIsRUFDc0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDcEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2pFLE9BQU8sRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxRQUFRLEVBQUUsaUJBQWlCLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUNqRixDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQ25ELFFBQWlCLEVBQ2UsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDN0MsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLEVBQUUsUUFBUSxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDNUYsTUFBTSxVQUFVLEdBQUcseUJBQXlCLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQy9ELE1BQU0sV0FBVyxHQUFHLEtBQUssQ0FBQyxXQUFXLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDckYseUZBQXlGO0lBQ3pGLFlBQVksQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLFdBQVcsQ0FBQyxZQUFZLEtBQUssVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQzNGLE9BQU8sRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLHFCQUFxQixDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUNuSCxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQ3BELFFBQWlCLEVBQ2dCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQzlDLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUNsRSxZQUFZLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxVQUFVLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxZQUFZLENBQUMsQ0FBQztJQUN4RyxPQUFPLEVBQUUsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsVUFBVSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztBQUMzRSxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLGlEQUFpRCxHQUFHLENBQy9ELFFBQWlCLEVBQzJCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3pELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUNwRSxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsV0FBVyxFQUFFLG9DQUFvQyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO0FBQ25ILENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sa0RBQWtELEdBQUcsQ0FDaEUsUUFBaUIsRUFDNEIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDMUQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLFlBQVksQ0FBQyxLQUFLLENBQUMsWUFBWSxLQUFLLGlCQUFpQixJQUFJLEtBQUssQ0FBQyxZQUFZLEtBQUsscUJBQXFCLENBQUMsQ0FBQztJQUN2RyxPQUFPLEVBQUUsV0FBVyxFQUFFLG9DQUFvQyxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBRSxZQUFZLEVBQUUsS0FBSyxDQUFDLFlBQVksRUFBRSxDQUFDO0FBQ3BILENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FDekQsUUFBaUIsRUFDcUIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDbkQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ25FLE9BQU8sRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO0FBQ3RGLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sNENBQTRDLEdBQUcsQ0FDMUQsUUFBaUIsRUFDc0IsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDcEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFVBQVUsRUFBRSxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMvRSxZQUFZLENBQUMsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQ3ZFLE9BQU8sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLFVBQVUsSUFBSSxJQUFJLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDNUcsWUFBWSxDQUFDLE9BQU8sS0FBSyxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUN2RSxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxVQUFVLElBQUksc0JBQXNCLENBQUMsNEJBQTRCO1dBQ2hHLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3BELE9BQU8sRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVEsRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVEsRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQ3RHLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FDekQsUUFBaUIsRUFDcUIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDbkQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2xFLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNqRCxZQUFZLENBQUMsT0FBTyxRQUFRLENBQUMsR0FBRyxLQUFLLFFBQVE7V0FDeEMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxNQUFNLElBQUksc0JBQXNCLENBQUMsc0JBQXNCO1dBQ3BFLGtEQUFrRCxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUM1RSxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsR0FBRyxFQUFFLFFBQVEsQ0FBQyxHQUFHLEVBQUUsRUFBRSxRQUFRLEVBQUUsaUJBQWlCLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUNqRixDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLENBQzFELFFBQWlCLEVBQ3NCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3BELE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxZQUFZLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNwRSxZQUFZLENBQUMsS0FBSyxDQUFDLFVBQVUsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUN4QyxPQUFPLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsaUJBQWlCLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUNsRSxDQUFDLENBQUMsQ0FBQztBQUVIOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLENBQ3RELFFBQWlCLEVBQUUsVUFBbUIsRUFDQyxFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNwRCxNQUFNLFFBQVEsR0FBRyw0Q0FBNEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4RSxNQUFNLE9BQU8sR0FBRywyQ0FBMkMsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN4RSxZQUFZLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLFNBQVM7V0FDdEQsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssT0FBTyxDQUFDLE1BQU07V0FDMUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxvQkFBb0IsS0FBSyxPQUFPLENBQUMsb0JBQW9CO1dBQ3RFLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hFLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLENBQzNELFFBQWlCLEVBQUUsVUFBbUIsRUFBRSxVQUFtQixFQUNwQixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNwRCxNQUFNLFFBQVEsR0FBRyw0Q0FBNEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN4RSxNQUFNLE9BQU8sR0FBRywyQ0FBMkMsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN4RSxNQUFNLE9BQU8sR0FBRyxzQ0FBc0MsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNuRSxZQUFZLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUM7V0FDaEYsT0FBTyxDQUFDLE1BQU0sS0FBSyxPQUFPLENBQUMsTUFBTSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLE9BQU8sQ0FBQyxNQUFNO1dBQy9FLFFBQVEsQ0FBQyxPQUFPLENBQUMsU0FBUyxLQUFLLE9BQU8sQ0FBQyxTQUFTO1dBQ2hELFFBQVEsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLEtBQUssT0FBTyxDQUFDLGdCQUFnQjtXQUM5RCxRQUFRLENBQUMsT0FBTyxDQUFDLG9CQUFvQixLQUFLLE9BQU8sQ0FBQyxvQkFBb0I7V0FDdEUsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDeEUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDLENBQUM7QUFFSDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSw0Q0FBNEMsR0FBRyxLQUFLLEVBQy9ELFFBQWlCLEVBQUUsZUFBd0IsRUFDSSxFQUFFO0lBQ2pELElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLDJDQUEyQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3RFLE1BQU0sWUFBWSxHQUFHLDJDQUEyQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ2xGLFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLFlBQVksQ0FBQyxPQUFPLENBQUMsTUFBTTtlQUN0RCxPQUFPLENBQUMsb0JBQW9CLEtBQUssWUFBWSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMxRSxZQUFZLENBQUMsTUFBTSxlQUFlLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxDQUFDLEtBQUssWUFBWSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoSCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDNUIsQ0FBQyxDQUFDO0FBRUYsNkdBQTZHO0FBQzdHLE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLENBQ3RELFFBQWlCLEVBQUUsTUFBYyxFQUNNLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3BELE1BQU0sUUFBUSxHQUFHLDRDQUE0QyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3hFLFlBQVksQ0FBQyxRQUFRLENBQUMsU0FBUyxHQUFHLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3BELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLEtBQUssRUFDcEQsUUFBaUIsRUFBRSxpQkFBMEIsRUFDSixFQUFFO0lBQzNDLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLHFDQUFxQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2hFLE1BQU0sY0FBYyxHQUFHLDZCQUE2QixDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDeEUsWUFBWSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxJQUFJLGlCQUFpQixDQUFDLGNBQWMsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUNwSCxNQUFNLDZCQUE2QixDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3hFLE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUM1QixDQUFDLENBQUM7QUFFRixtR0FBbUc7QUFDbkcsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FDaEQsUUFBaUIsRUFBRSxVQUFtQixFQUNMLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQzlDLE1BQU0sUUFBUSxHQUFHLHNDQUFzQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2xFLE1BQU0sT0FBTyxHQUFHLHFDQUFxQyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ2xFLFlBQVksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzlHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FDeEMsVUFBbUIsRUFBRSxvQkFBNEIsRUFBRSxhQUFzQixFQUN6RSxpQkFBMEIsRUFBRSxrQkFBMkIsRUFDdkIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDN0MsTUFBTSxlQUFlLEdBQUcsNkJBQTZCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDbEUsTUFBTSxpQkFBaUIsR0FBRyxVQUFVLENBQUMsb0JBQW9CLENBQUMsQ0FBQztJQUMzRCxNQUFNLFVBQVUsR0FBRyx5QkFBeUIsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUNyRSxNQUFNLGNBQWMsR0FBRyw2QkFBNkIsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQ3hFLE1BQU0sZUFBZSxHQUFHLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDMUUsWUFBWSxDQUFDLFdBQVcsQ0FBQyxlQUFlLEVBQUUsY0FBYyxDQUFDLElBQUksaUJBQWlCLENBQUMsY0FBYyxFQUFFLFVBQVUsQ0FBQztXQUNyRyxpQkFBaUIsS0FBSyxlQUFlLENBQUMsaUJBQWlCLElBQUksU0FBUyxDQUFDLGNBQWMsRUFBRSxlQUFlLENBQUMsQ0FBQyxDQUFDO0lBQzVHLE1BQU0sT0FBTyxHQUFHLFdBQVcsQ0FBQyxlQUFlLEVBQUUsY0FBYyxDQUFDLENBQUM7SUFDN0QsWUFBWSxDQUFDLE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQyxpQkFBaUIsS0FBSyxjQUFjLENBQUMsaUJBQWlCO1dBQzFGLGVBQWUsQ0FBQyxZQUFZLEdBQUcsY0FBYyxDQUFDLFlBQVk7V0FDMUQsZUFBZSxDQUFDLG9CQUFvQixJQUFJLGNBQWMsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLENBQUM7SUFDbkYsT0FBTyxFQUFFLE9BQU8sRUFBRSxlQUFlLEVBQUUsVUFBVSxFQUFFLGVBQWU7UUFDNUQsWUFBWSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLHFCQUFxQixFQUFFLENBQUM7QUFDeEUsQ0FBQyxDQUFDLENBQUM7QUFFSDs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsS0FBSyxFQUNoRSxRQUFpQixFQUFFLGFBQXNCLEVBQUUsaUJBQTBCLEVBQUUsa0JBQTJCLEVBQ2UsRUFBRTtJQUNuSCxJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyxpREFBaUQsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM1RSxNQUFNLE9BQU8sR0FBRywwQkFBMEIsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEVBQy9GLGFBQWEsRUFBRSxpQkFBaUIsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3hELFlBQVksQ0FBQyxDQUFDLE1BQU0sb0NBQW9DLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDakgsT0FBTyxFQUFFLE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQ3pELENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUM1QixDQUFDLENBQUM7QUFFRixzRkFBc0Y7QUFDdEYsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FDNUQsUUFBaUIsRUFBRSxVQUFtQixFQUNPLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQzFELE1BQU0sUUFBUSxHQUFHLGtEQUFrRCxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzlFLE1BQU0sT0FBTyxHQUFHLGlEQUFpRCxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzlFLFlBQVksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1dBQzFFLFFBQVEsQ0FBQyxZQUFZLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLGlCQUFpQixLQUFLLE9BQU8sQ0FBQyxPQUFPLENBQUMsaUJBQWlCO1lBQ3ZHLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDO0lBQ2xELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUgsa0dBQWtHO0FBQ2xHLE1BQU0sQ0FBQyxNQUFNLHVDQUF1QyxHQUFHLEtBQUssRUFDMUQsUUFBaUIsRUFBRSxhQUFzQixFQUFFLGlCQUEwQixFQUN0QixFQUFFO0lBQ2pELElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLDJDQUEyQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3RFLE1BQU0sVUFBVSxHQUFHLHlCQUF5QixDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sY0FBYyxHQUFHLDZCQUE2QixDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDeEUsWUFBWSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxJQUFJLGlCQUFpQixDQUFDLGNBQWMsRUFBRSxVQUFVLENBQUM7ZUFDckcsVUFBVSxDQUFDLFdBQVcsS0FBSyxLQUFLO2VBQ2hDLFNBQVMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLDZCQUE2QixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM3RixZQUFZLENBQUMsQ0FBQyxNQUFNLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ3pFLE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUM1QixDQUFDLENBQUMifQ==

package/dist_ts/requests/runtimesession.d.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../plugins.js';
 import type * as data from '../data/runtimesession.js';
+import type * as binding from '../data/noderuntimebinding.js';
 import type * as terminal from '../data/runtimeterminalreceipt.js';
 import type * as network from '../data/networkdelivery.js';
 import type * as protection from '../data/networkprotection.js';
@@ -106,6 +107,18 @@ export interface IReq_Pallet_Cloudly_RegisterPalletRuntimeSession extends plugin
     request: data.IRegisterPalletRuntimeSessionRequest;
     response: data.IRegisterPalletRuntimeSessionResponse;
 }
+/**
+ * A local controller's first request on Pallet's root-only Unix socket, before any session:
+ * first bind or exact replay of the node's local routing binding (`nodeRuntimeLocalControllerContract`).
+ * Pallet answers the exact persisted binding and the credential it will register with, then fires
+ * `registerPalletRuntimeSession` at this connection. A node bound to Cloudly refuses it. The
+ * response carries a token hash: exclude it from hooks and logs.
+ */
+export interface IReq_Onebox_Pallet_BindLocalRuntimeController extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Onebox_Pallet_BindLocalRuntimeController> {
+    method: 'bindPalletLocalRuntimeController';
+    request: binding.INodeRuntimeLocalRoutingBinding;
+    response: binding.INodeRuntimeLocalBindingConfirmation;
+}
 /** Controller push over the already authenticated Pallet-initiated connection. */
 export interface IReq_Controller_Pallet_ApplyRuntimeAssignment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Controller_Pallet_ApplyRuntimeAssignment> {
     method: 'applyRuntimeAssignment';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.19.0",
+  "version": "32.20.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -301,6 +301,32 @@ The local operations carry no bearer, signing key, generic configuration field,
 phase mutation or caller-authored permission. `nodeRuntimeBindingContract`
 states the immutable local mutation and routing-only persistence rules.
 
+A node can instead be driven by a controller on its own host, such as Onebox.
+`data.INodeRuntimeLocalRoutingBinding` is
+`{ nodeId, clusterId, controller, runtimeNamespace, registryHosts }` with a
+controller of kind `onebox`; it names no Cloudly origin and no relay.
+`nodeRuntimeLocalControllerContract` fixes the transport: the controller is the
+TypedSocket client on Pallet's root-only Unix socket
+`/run/serve.zone/pallet/controller.sock` (mode `0600`, server URL
+`http://localhost`), whose file permissions authenticate the peer. A node carries
+a Cloudly binding or a local one, never both, and the local binding, like the
+Cloudly one, grants no workload permission by itself.
+
+The first request on a local connection is `bindPalletLocalRuntimeController`
+(see [Authenticated Runtime Sessions](#authenticated-runtime-sessions)). It is
+first bind or exact replay. Pallet answers `data.INodeRuntimeLocalBindingConfirmation`:
+the exact persisted binding plus the generation and SHA-256 hash of a bearer that
+Pallet generates and keeps. `bindNodeRuntimeLocalBindingConfirmation` binds that
+answer to the binding sent and to the credential the controller pinned in its
+own durable state at the first bind (`null` for that first bind). A different
+credential for the same binding rejects rather than being adopted, because it
+means the node lost the state the controller enrolled.
+
+`registryHosts` lists, strictly ordered, the canonical `host[:port]` registries
+(`isCanonicalRegistryHost`) whose pull credential the local controller issues.
+`isNodeRuntimeLocalRegistryWorkload` is the local registry rule: a workload's
+`registryHost`, and its `pullEndpoint` when one is stated, must both be listed.
+
 ### Service Machine Credentials
 
 `requests.admin.getServiceMachineCredential` inspects redacted metadata;
@@ -513,10 +539,39 @@ denials overlapping current grants reject. Up to 4,096 retained withdrawals carr
 forward until the caller supplies its exact joined application of the preceding
 projection, with the same receipt boundary as workload withdrawals. These values
 do not prove packet drainage, native enforcement or allocation reuse. Consumers
-must compose both workload and router grants and their separate withdrawals;
+must compose workload, router and host grants and their separate withdrawals;
 they must also fence the actual native source, routing and process lifetimes.
 DNS expiry or readiness changes do not revoke packet authority.
 
+A projection whose controller kind is `onebox` names a controller that runs on
+the node itself, so it has no other node: it refuses every endpoint whose lease
+is not placed on the projection's own node and runtime namespace. Projections of
+a `cloudly` controller keep their remote endpoints.
+
+The optional `IRuntimeNetworkProjection.host` member exists only on `onebox`
+projections; any other controller kind carrying it rejects. It lets the node's
+own host namespace, for example Onebox's reverse proxy, dial exact local workload
+ports directly, with no loopback publication, no loopback DNAT and no change to
+martian filtering. A projection that omits it retains its exact canonical bytes,
+digest and signature and grants no host-origin flows. Each `ingress` entry names
+the exact lease reference of a local endpoint of the same projection, a protocol,
+the workload's own port and an `authorization` reference. The authorization is
+signed with the projection but is not part of the grant identity, so
+re-authorizing an unchanged port neither creates nor withdraws a grant. Entries
+are unique and strictly ordered; at most 1,024 are allowed
+(`runtimeNetworkHostContract`).
+
+`getRuntimeNetworkProjectionHostPacketGrants` validates the complete projection
+and returns detached exact grants. Each binds the current handoff reference and
+its transit host address as the source to the lease reference, lease IPv4 address,
+protocol and exact port as the destination. Unlike router grants, host grants
+need no per-protocol source-port allocation in the handoff. Host withdrawals
+follow the router rules: removing a selection or retiring the handoff or lease
+must explicitly withdraw the old complete grants, unknown denials and denials
+overlapping current grants reject, and up to 4,096 retained withdrawals carry
+forward until the caller supplies its exact joined application of the preceding
+projection.
+
 `admitRuntimeNetworkProjection` checks exact predecessor/replay identity and
 rejects changed same-generation content, regressed membership/readiness evidence,
 changed immutable address/DNS keys, and omitted packet grants without explicit
@@ -917,6 +972,21 @@ keeps a refused registration from touching its packet access.
 `data.bindRegisterPalletRuntimeSessionResponse` binds that answer to the request
 the node sent and negotiates the two offers from the node's side.
 
+A node bound to a local controller
+([Node Runtime Routing Binding](#node-runtime-routing-binding)) serves the same
+session family on its root-only Unix socket. The controller connects and first
+sends `requests.runtimesession.IReq_Onebox_Pallet_BindLocalRuntimeController`
+(`bindPalletLocalRuntimeController`); Pallet then fires the unchanged
+`registerPalletRuntimeSession` at that connection, and every other request keeps
+its direction. The controller checks the registration with
+`data.bindRegisterPalletLocalRuntimeSessionRequest`, which requires the node and
+credential generation of its pinned confirmation and the bearer whose SHA-256
+that confirmation acknowledged. Pallet binds the answer with
+`data.bindRegisterPalletLocalRuntimeSessionResponse`: the session must name
+exactly its own local binding's controller, node, cluster and runtime namespace,
+the credential generation sent and a compatible offer. The Cloudly binder keeps
+refusing a `onebox` session.
+
 A changed nonce, or a changed credential generation, is a new registration: the
 controller mints a new binding and a new session epoch and fences the node's
 previous session. An unchanged nonce with an unchanged generation is a replay

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.19.0',
+  version: '32.20.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/immutableimage.ts

@@ -529,6 +529,14 @@ export const isSha256Digest = (digest: string): digest is TSha256Digest =>
 const registryHostRegex = /^(?:localhost|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::[1-9][0-9]{0,4})?$/;
 const repositoryRegex = /^[a-z0-9]+(?:[._-][a-z0-9]+)*(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
 
+/**
+ * True for a canonical OCI registry host, `host[:port]`: the host grammar
+ * `buildDigestPinnedImageReference` accepts, bounded to 253 characters like an assignment's
+ * `registryHost`.
+ */
+export const isCanonicalRegistryHost = (valueArg: unknown): valueArg is string =>
+  typeof valueArg === 'string' && valueArg.length <= 253 && registryHostRegex.test(valueArg);
+
 export const buildDigestPinnedImageReference = (
   registryHost: string,
   repository: string,

package/ts/data/index.ts

@@ -38,6 +38,8 @@ export * from './networklease.js';
 export * from './networknode.js';
 export * from './networkprojection.js';
 export type { IRuntimeNetworkRouterPacketGrant, IRuntimeNetworkRouterProjection } from './networkrouter.js';
+export type { IRuntimeNetworkHostIngress, IRuntimeNetworkHostPacketGrant, IRuntimeNetworkHostProjection } from './networkhost.js';
+export { runtimeNetworkHostContract } from './networkhost.js';
 export * from './networkprotection.js';
 export * from './networksigning.js';
 export * from './privatenetwork.js';

package/ts/data/networkhost.ts

@@ -0,0 +1,98 @@
+import type { IRuntimeAuthorityReference, IRuntimeController } from './runtimeassignment.js';
+import type { IRuntimeNetworkHandoffLease } from './networkauthority.js';
+import type { IRuntimeNetworkWorkloadLease } from './networkprojection.js';
+import { networkCanonical, networkCounter, networkEqual, networkIpv4, networkList, networkRecord, networkReference,
+  networkReferenceOf, networkSameScope, networkSorted, requireNetwork } from '../private/networkcontract.js';
+
+/**
+ * Exact host-origin flow authority: the node's own host network namespace dials one port of one
+ * local workload at its lease address, from the current handoff's transit host address.
+ *
+ * It exists for a controller that runs on the node itself — Onebox's reverse proxy — and grants
+ * nothing else: no loopback, no wildcard, no published port and no workload-origin traffic.
+ */
+export interface IRuntimeNetworkHostPacketGrant {
+  source: { handoff: IRuntimeAuthorityReference; address: string };
+  destination: { lease: IRuntimeAuthorityReference; address: string; protocol: 'tcp' | 'udp'; port: number };
+}
+
+/** One workload port the host may dial, and the controller decision that authorized it. */
+export interface IRuntimeNetworkHostIngress {
+  /** Exact lease of an endpoint of this projection, placed on this node. */
+  lease: IRuntimeAuthorityReference;
+  protocol: 'tcp' | 'udp';
+  /** The workload's own listening port inside its network namespace. */
+  port: number;
+  /** Covered by the projection signature; it never enters the packet grant's identity. */
+  authorization: IRuntimeAuthorityReference;
+}
+
+/**
+ * Host-origin selections plus retained denials. Only a projection of a `onebox` controller may
+ * carry it; omitting it keeps the projection's canonical bytes and grants no host-origin flow.
+ */
+export interface IRuntimeNetworkHostProjection {
+  /** Strictly increasing by the canonical form of `[lease.id, protocol, port]`, so one entry per tuple. */
+  ingress: IRuntimeNetworkHostIngress[];
+  withdrawals: IRuntimeNetworkHostPacketGrant[];
+}
+
+export const runtimeNetworkHostContract = Object.freeze({
+  controllerKind: 'onebox',
+  source: 'current-handoff-transit-host-address',
+  destination: 'local-workload-lease-address-exact-port',
+  maximumIngress: 1024,
+  maximumWithdrawals: 4096,
+} as const);
+
+const ingressKey = (value: { lease: IRuntimeAuthorityReference; protocol: string; port: number }): string =>
+  networkCanonical([value.lease.id, value.protocol, value.port]);
+const protocol = (value: unknown): 'tcp' | 'udp' => {
+  requireNetwork(value === 'tcp' || value === 'udp'); return value;
+};
+
+const grant = (value: unknown): IRuntimeNetworkHostPacketGrant => {
+  const item = networkRecord(value, ['source', 'destination']);
+  const source = networkRecord(item.source, ['handoff', 'address']);
+  const destination = networkRecord(item.destination, ['lease', 'address', 'protocol', 'port']);
+  return { source: { handoff: networkReference(source.handoff), address: networkIpv4(source.address) },
+    destination: { lease: networkReference(destination.lease), address: networkIpv4(destination.address),
+      protocol: protocol(destination.protocol), port: networkCounter(destination.port, 65535) } };
+};
+
+const ingress = (value: unknown): IRuntimeNetworkHostIngress => {
+  const item = networkRecord(value, ['lease', 'protocol', 'port', 'authorization']);
+  return { lease: networkReference(item.lease), protocol: protocol(item.protocol),
+    port: networkCounter(item.port, 65535), authorization: networkReference(item.authorization) };
+};
+
+/** Internal parser: the enclosing projection has already captured caller input. */
+export const snapshotHostProjection = (value: unknown): IRuntimeNetworkHostProjection => {
+  const item = networkRecord(value, ['ingress', 'withdrawals']);
+  return { ingress: networkSorted(networkList(item.ingress, runtimeNetworkHostContract.maximumIngress, ingress), ingressKey),
+    withdrawals: networkSorted(networkList(item.withdrawals, runtimeNetworkHostContract.maximumWithdrawals, grant), networkCanonical) };
+};
+
+/** Internal composition after capture. The public helper validates the whole projection. */
+export const hostPacketGrantsOf = (projection: {
+  controller: IRuntimeController;
+  nodeId: string;
+  runtimeNamespace: string;
+  host?: IRuntimeNetworkHostProjection;
+  handoff: IRuntimeNetworkHandoffLease | null;
+  endpoints: Array<{ lease: IRuntimeNetworkWorkloadLease }>;
+}): IRuntimeNetworkHostPacketGrant[] => {
+  const selected = projection.host;
+  if (!selected) return [];
+  requireNetwork(projection.controller.kind === runtimeNetworkHostContract.controllerKind);
+  if (selected.ingress.length === 0) return [];
+  const handoff = projection.handoff; requireNetwork(handoff);
+  const result = selected.ingress.map((entry): IRuntimeNetworkHostPacketGrant => {
+    const endpoint = projection.endpoints.find(candidate => networkEqual(networkReferenceOf(candidate.lease), entry.lease));
+    requireNetwork(endpoint && networkSameScope(endpoint.lease, projection));
+    return { source: { handoff: networkReferenceOf(handoff), address: handoff.transit.hostAddress },
+      destination: { lease: networkReferenceOf(endpoint.lease), address: endpoint.lease.ipv4.address,
+        protocol: entry.protocol, port: entry.port } };
+  });
+  return result.sort((left, right) => networkCanonical(left) < networkCanonical(right) ? -1 : 1);
+};

package/ts/data/networkprojection.ts

@@ -7,6 +7,8 @@ import { bindRuntimeNetworkHandoffLease, computeRuntimeNetworkProtectedAuthority
 import type { IPrivateNetwork, IServicePrivateNetworks, IServicePrivateNetworkDnsPolicy } from './privatenetwork.js';
 import { routerPacketGrantsOf, snapshotRouterProjection,
   type IRuntimeNetworkRouterPacketGrant, type IRuntimeNetworkRouterProjection } from './networkrouter.js';
+import { hostPacketGrantsOf, snapshotHostProjection,
+  type IRuntimeNetworkHostPacketGrant, type IRuntimeNetworkHostProjection } from './networkhost.js';
 import { buildPrivateNetworkFqdn, composeServicePrivateNetworkDnsPolicy,
   snapshotPrivateNetwork, snapshotServicePrivateNetworks } from './privatenetwork.js';
 import { captureNetwork, failNetwork, networkCanonical, networkContains, networkCounter, networkDigest,
@@ -159,6 +161,12 @@ export interface IRuntimeNetworkProjection extends IRuntimeNetworkNodeScope {
    * projection's canonical bytes and grants no router-origin flows.
    */
   router?: IRuntimeNetworkRouterProjection;
+  /**
+   * Host-origin selections of a `onebox` projection: the node's own host dials exact local workload
+   * ports (`IRuntimeNetworkHostPacketGrant`). Omitted, it keeps the canonical bytes and grants no
+   * host-origin flow; any other controller kind carrying it is refused.
+   */
+  host?: IRuntimeNetworkHostProjection;
   digest: TSha256Digest;
 }
 
@@ -313,9 +321,10 @@ export const snapshotRuntimeNetworkProjection = (value: unknown): IRuntimeNetwor
   const captured = captureNetwork(value);
   requireNetwork(new TextEncoder().encode(networkCanonical(captured)).length <= runtimeNetworkProjectionContract.maximumCanonicalBytes);
   const hasRouter = captured !== null && typeof captured === 'object' && Object.hasOwn(captured, 'router');
+  const hasHost = captured !== null && typeof captured === 'object' && Object.hasOwn(captured, 'host');
   const item = networkRecord(captured, ['id', 'generation', 'previous', 'controller', 'nodeId', 'runtimeNamespace',
     'protectedAuthority', 'allocationAuthorities', 'handoff', 'networks', 'memberships', 'endpoints', 'dns', 'withdrawals', 'retiredLeases', 'retiredHandoffs', 'digest',
-    ...(hasRouter ? ['router'] : [])]);
+    ...(hasRouter ? ['router'] : []), ...(hasHost ? ['host'] : [])]);
   return { ...networkRevision(item), ...networkScope(item),
     protectedAuthority: snapshotRuntimeNetworkProtectedAuthority(item.protectedAuthority),
     allocationAuthorities: networkSorted(networkList(item.allocationAuthorities, 16, snapshotRuntimeNetworkProtectedAuthority), refKey),
@@ -325,6 +334,7 @@ export const snapshotRuntimeNetworkProjection = (value: unknown): IRuntimeNetwor
     endpoints: networkSorted(networkList(item.endpoints, 256, endpoint), value => value.lease.id), dns: networkDnsWindow(item.dns),
     withdrawals: networkSorted(networkList(item.withdrawals, 4096, packetGrant), networkCanonical),
     ...(hasRouter ? { router: snapshotRouterProjection(item.router) } : {}),
+    ...(hasHost ? { host: snapshotHostProjection(item.host) } : {}),
     retiredLeases: sortedReferences(item.retiredLeases), retiredHandoffs: sortedReferences(item.retiredHandoffs), digest: networkDigest(item.digest) };
 });
 
@@ -402,6 +412,8 @@ export const validateRuntimeNetworkProjection = async (value: unknown): Promise<
     const assignments = new Set<string>(), attempts = new Set<string>(), readyReplicas = new Set<string>(), hostPorts = new Set<string>();
     for (const endpoint of projection.endpoints) {
       const lease = endpoint.lease, authority = allocationAuthority(lease.protectedAuthority);
+      // A controller on the node itself has no other node: every endpoint it projects is local.
+      requireNetwork(projection.controller.kind !== 'onebox' || networkSameScope(lease, projection));
       requireNetwork(networkEqual(lease.controller, projection.controller) && members.has(ownerKey(lease))
         && !assignments.has(lease.assignmentId) && !attempts.has(attemptKey(lease)));
       assignments.add(lease.assignmentId); attempts.add(attemptKey(lease));
@@ -430,6 +442,8 @@ export const validateRuntimeNetworkProjection = async (value: unknown): Promise<
     requireNetwork(projection.withdrawals.every(grant => !grants.has(networkCanonical(grant))));
     const routerGrants = new Set(routerPacketGrantsOf(projection).map(networkCanonical));
     requireNetwork((projection.router?.withdrawals ?? []).every(grant => !routerGrants.has(networkCanonical(grant))));
+    const hostGrants = new Set(hostPacketGrantsOf(projection).map(networkCanonical));
+    requireNetwork((projection.host?.withdrawals ?? []).every(grant => !hostGrants.has(networkCanonical(grant))));
     requireNetwork(projection.digest === await computeRuntimeNetworkProjectionDigest(projection));
     return projection;
   } catch { return failNetwork(); }
@@ -443,6 +457,10 @@ export const getRuntimeNetworkProjectionPacketGrants = async (value: unknown): P
 export const getRuntimeNetworkProjectionRouterPacketGrants = async (value: unknown): Promise<IRuntimeNetworkRouterPacketGrant[]> =>
   routerPacketGrantsOf(await validateRuntimeNetworkProjection(value));
 
+/** Host-origin authority comes only from explicit signed `onebox` selections of local workload ports. */
+export const getRuntimeNetworkProjectionHostPacketGrants = async (value: unknown): Promise<IRuntimeNetworkHostPacketGrant[]> =>
+  hostPacketGrantsOf(await validateRuntimeNetworkProjection(value));
+
 /** Complete offline DNS material, including authorized names never previously queried. */
 /** Select exact local receivers before expansion; all targets still come from
  * the complete validated projection. Selection supplies no attachment authority. */
@@ -507,7 +525,7 @@ export const admitRuntimeNetworkProjection = async (
     requireNetwork(networkSameScope(projection, trusted));
     if (previousInput === null) {
       requireNetwork(projection.generation === 1 && applied === null && projection.withdrawals.length === 0
-        && (projection.router?.withdrawals.length ?? 0) === 0
+        && (projection.router?.withdrawals.length ?? 0) === 0 && (projection.host?.withdrawals.length ?? 0) === 0
         && projection.retiredLeases.length === 0 && projection.retiredHandoffs.length === 0);
       return { status: 'accepted', projection };
     }
@@ -543,6 +561,12 @@ export const admitRuntimeNetworkProjection = async (
     for (const grant of previousRouterGrants) requireNetwork(routerGrants.has(networkCanonical(grant)) || routerWithdrawals.has(networkCanonical(grant)));
     const knownRouterWithdrawals = new Set([...previousRouterGrants, ...(previous.router?.withdrawals ?? [])].map(networkCanonical));
     requireNetwork((projection.router?.withdrawals ?? []).every(grant => knownRouterWithdrawals.has(networkCanonical(grant))));
+    const hostGrants = new Set(hostPacketGrantsOf(projection).map(networkCanonical));
+    const hostWithdrawals = new Set((projection.host?.withdrawals ?? []).map(networkCanonical));
+    const previousHostGrants = hostPacketGrantsOf(previous);
+    for (const grant of previousHostGrants) requireNetwork(hostGrants.has(networkCanonical(grant)) || hostWithdrawals.has(networkCanonical(grant)));
+    const knownHostWithdrawals = new Set([...previousHostGrants, ...(previous.host?.withdrawals ?? [])].map(networkCanonical));
+    requireNetwork((projection.host?.withdrawals ?? []).every(grant => knownHostWithdrawals.has(networkCanonical(grant))));
     const knownLeases = [...previous.endpoints.map(endpoint => networkReferenceOf(endpoint.lease)), ...previous.retiredLeases];
     const knownHandoffs = [...(previous.handoff ? [networkReferenceOf(previous.handoff)] : []), ...previous.retiredHandoffs];
     requireNetwork(projection.retiredLeases.every(retired => knownLeases.some(known => networkEqual(known, retired)))
@@ -553,6 +577,7 @@ export const admitRuntimeNetworkProjection = async (
     if (applied === null) {
       for (const grant of previous.withdrawals) requireNetwork(withdrawn.has(networkCanonical(grant)));
       for (const grant of previous.router?.withdrawals ?? []) requireNetwork(routerWithdrawals.has(networkCanonical(grant)));
+      for (const grant of previous.host?.withdrawals ?? []) requireNetwork(hostWithdrawals.has(networkCanonical(grant)));
       requireCarried(previous.retiredLeases, projection.retiredLeases); requireCarried(previous.retiredHandoffs, projection.retiredHandoffs);
     }
     for (const old of previous.endpoints) {