@serve.zone/interfaces 32.23.0 → 32.24.0

package/changelog.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 2026-09-25 - 32.24.0
+
+### Features
+
+- Add NFS and SMB sources to runtime local storage claims.
+  - `TRuntimeLocalStorageSource` gains `{ kind: 'nfs', server, export, subPath, version }`
+    (`TRuntimeLocalStorageNfsSource`) and `{ kind: 'smb', server, share, subPath, version, credential }`
+    (`TRuntimeLocalStorageSmbSource`); `{ kind: 'directory' }` is unchanged and now also named
+    `TRuntimeLocalStorageDirectorySource`. `credential` is an `IRuntimeAuthorityReference`, never a
+    value, and neither source carries a mount option or a port.
+  - `server` is a lowercase fully qualified hostname or a canonical IP literal; `export` a canonical
+    absolute path; `share` one segment; `subPath` `.` or canonical relative segments. Every segment is
+    printable ASCII without a space, a comma, `=` or a character a mount source or SMB name gives
+    meaning to, and never exactly `.` or `..`. `version` pins one kernel `vers=` value: `3`, `4.0`, `4.1` or `4.2` for NFS,
+    `3.0`, `3.02` or `3.1.1` for SMB (`runtimeLocalStorageClaimContract.nfsVersions`, `smbVersions`).
+  - An `smb` claim is always `initialization: 'empty'`, because SMB carries no POSIX ownership an
+    imported tree could keep.
+- Add the Corestore legacy resource blocker `fence-lineage-conflict`: a bucket whose object-storage
+  fence lineage is duplicated, does not validate, belongs to another authority or has an unfinished
+  mutation, which Corestore's offline adoption refuses. `validateCorestoreLegacyResourceInventory` admits it on a
+  bucket only.
+
+### Maintenance
+
+- Replace real infrastructure addresses in test fixtures with documentation and synthetic addresses.
+  Protected-authority resolvers, platform endpoints and hubs use the synthetic private range
+  `192.168.255.0/24`, which keeps them outside `10.0.0.0/8` as the range-coverage test requires.
+  Host bind addresses and addresses that only need to be valid use RFC 5737 ranges. Tests only; no
+  contract change.
+
 ## 2026-09-25 - 32.23.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.23.0',
+    version: '32.24.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/corestorelegacyadoption.d.ts

@@ -26,9 +26,13 @@ export type TCorestoreLegacyCapability = 'database' | 'objectstorage';
  * - `ordinary-credentials-rotated`: its credentials were rotated, so the delivered ones are no
  *   longer the generation a binding adopts;
  * - `owned-by-binding`: a credential binding or a named storage binding already owns the service
- *   capability, the resource or the bucket.
+ *   capability, the resource or the bucket;
+ * - `fence-lineage-conflict`: the bucket's object-storage fence lineage cannot move to the adopting
+ *   binding, because the bucket has more than one lineage, or its lineage does not validate,
+ *   belongs to another authority or has an unfinished mutation. Only a bucket has a fence lineage,
+ *   so a database never names it.
  */
-export type TCorestoreLegacyResourceBlocker = 'not-adoptable' | 'ordinary-credentials-rotated' | 'owned-by-binding';
+export type TCorestoreLegacyResourceBlocker = 'not-adoptable' | 'ordinary-credentials-rotated' | 'owned-by-binding' | 'fence-lineage-conflict';
 /**
  * `unadopted` names what would stop the offline adoption, or `null` when nothing would;
  * `authorized` names the binding the operator authorized, which is the only binding Corestore will

package/dist_ts/data/corestorelegacyadoption.js

@@ -17,22 +17,25 @@ const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
 const printableNamePattern = /^[\x21-\x7e]+$/;
 const bareSha256Pattern = /^[a-f0-9]{64}$/;
 const blockers = [
-    'not-adoptable', 'ordinary-credentials-rotated', 'owned-by-binding',
+    'not-adoptable', 'ordinary-credentials-rotated', 'owned-by-binding', 'fence-lineage-conflict',
 ];
 const isIdentifier = (valueArg) => (typeof valueArg === 'string' && identifierPattern.test(valueArg));
 const isLegacyName = (valueArg) => (typeof valueArg === 'string'
     && valueArg.length <= corestoreLegacyAdoptionContract.maximumNameLength
     && printableNamePattern.test(valueArg));
 const isCapability = (valueArg) => (valueArg === 'database' || valueArg === 'objectstorage');
-const validateAdoption = (valueArg, pathArg) => {
+const validateAdoption = (valueArg, capabilityArg, pathArg) => {
     if (!isPlainRecord(valueArg))
         return [`${pathArg} must use its exact schema`];
     if (valueArg.state === 'unadopted') {
         if (!hasExactKeys(valueArg, ['state', 'blocker']))
             return [`${pathArg} must use its exact schema`];
-        return valueArg.blocker === null || blockers.includes(valueArg.blocker)
-            ? []
-            : [`${pathArg} blocker must be null or a named blocker`];
+        if (valueArg.blocker !== null && !blockers.includes(valueArg.blocker)) {
+            return [`${pathArg} blocker must be null or a named blocker`];
+        }
+        return valueArg.blocker === 'fence-lineage-conflict' && capabilityArg !== 'objectstorage'
+            ? [`${pathArg} blocker fence-lineage-conflict must name a bucket`]
+            : [];
     }
     if (valueArg.state === 'authorized') {
         if (!hasExactKeys(valueArg, ['state', 'bindingId']))
@@ -50,7 +53,7 @@ const validateResource = (valueArg, pathArg) => {
         if (!hasExactKeys(valueArg, ['capability', 'databaseName', 'adoption'])) {
             return [`${pathArg} must use its exact schema`];
         }
-        const errors = validateAdoption(valueArg.adoption, `${pathArg} adoption`);
+        const errors = validateAdoption(valueArg.adoption, 'database', `${pathArg} adoption`);
         if (!isLegacyName(valueArg.databaseName))
             errors.push(`${pathArg} databaseName must be a bounded printable name`);
         return errors;
@@ -59,7 +62,7 @@ const validateResource = (valueArg, pathArg) => {
         if (!hasExactKeys(valueArg, ['capability', 'bucketName', 'retention', 'adoption'])) {
             return [`${pathArg} must use its exact schema`];
         }
-        const errors = validateAdoption(valueArg.adoption, `${pathArg} adoption`);
+        const errors = validateAdoption(valueArg.adoption, 'objectstorage', `${pathArg} adoption`);
         if (!isLegacyName(valueArg.bucketName)) {
             errors.push(`${pathArg} bucketName must be a bounded printable name`);
         }
@@ -286,4 +289,4 @@ export const readCorestoreLegacyAdoptionRefusal = (statusCodeArg, bodyArg) => (s
     && platformBindingStatusReasons.includes(bodyArg.code)
     ? bodyArg.code
     : null);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZXN0b3JlbGVnYWN5YWRvcHRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NvcmVzdG9yZWxlZ2FjeWFkb3B0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFDTCxrQ0FBa0MsRUFDbEMsb0NBQW9DLEdBQ3JDLE1BQU0sdUNBQXVDLENBQUM7QUFDL0MsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFdkYsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDcEUsT0FBTyxFQUNMLHNCQUFzQixFQUN0QixpQkFBaUIsRUFDakIsNEJBQTRCLEdBQzdCLE1BQU0sNkJBQTZCLENBQUM7QUFDckMsT0FBTyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUMzRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFpSS9ELE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDM0QsZ0dBQWdHO0lBQ2hHLGFBQWEsRUFBRSwyQkFBMkI7SUFDMUMsa0ZBQWtGO0lBQ2xGLGtCQUFrQixFQUFFLElBQUk7SUFDeEIsZUFBZSxFQUFFLElBQUk7SUFDckIsaUJBQWlCLEVBQUUsR0FBRztJQUN0QixZQUFZLEVBQUUsdUNBQXVDO0NBQzdDLENBQUMsQ0FBQztBQUVaLE1BQU0saUJBQWlCLEdBQUcscUNBQXFDLENBQUM7QUFDaEUsTUFBTSxvQkFBb0IsR0FBRyxnQkFBZ0IsQ0FBQztBQUM5QyxNQUFNLGlCQUFpQixHQUFHLGdCQUFnQixDQUFDO0FBQzNDLE1BQU0sUUFBUSxHQUErQztJQUMzRCxlQUFlLEVBQUUsOEJBQThCLEVBQUUsa0JBQWtCO0NBQ3BFLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUM5RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksaUJBQWlCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUNqRSxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDOUQsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUN6QixRQUFRLENBQUMsTUFBTSxJQUFJLCtCQUErQixDQUFDLGlCQUFpQjtPQUNwRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3ZDLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQTBDLEVBQUUsQ0FBQyxDQUNsRixRQUFRLEtBQUssVUFBVSxJQUFJLFFBQVEsS0FBSyxlQUFlLENBQ3hELENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN4RSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUM5RSxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssV0FBVyxFQUFFLENBQUM7UUFDbkMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFBRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7UUFDbkcsT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSyxRQUErQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDO1lBQzdGLENBQUMsQ0FBQyxFQUFFO1lBQ0osQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLDBDQUEwQyxDQUFDLENBQUM7SUFDN0QsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUNwQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQztZQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztRQUNyRyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8sMkNBQTJDLENBQUMsQ0FBQztJQUN6RyxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsT0FBTyx3Q0FBd0MsQ0FBQyxDQUFDO0FBQzlELENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLFdBQVcsR0FBRyxDQUFDLFdBQW9CLEVBQVcsRUFBRSxDQUFDLENBQ3JELGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEtBQUssWUFBWSxJQUFJLFdBQVcsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQ25HLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN4RSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUM5RSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDdkMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxZQUFZLEVBQUUsY0FBYyxFQUFFLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN4RSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsR0FBRyxPQUFPLFdBQVcsQ0FBQyxDQUFDO1FBQzFFLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQztZQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdEQUFnRCxDQUFDLENBQUM7UUFDbEgsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUM1QyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFlBQVksRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNuRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsR0FBRyxPQUFPLFdBQVcsQ0FBQyxDQUFDO1FBQzFFLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztRQUN4RSxDQUFDO2FBQU0sSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxXQUFXLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDakUsMkZBQTJGO1lBQzNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx1Q0FBdUMsQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLEdBQUcsT0FBTyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3hHLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDaEMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLG9DQUFvQyxDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsR0FBRyxPQUFPLFlBQVksQ0FBQyxDQUFDLENBQUM7UUFDbkcsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxPQUFPLENBQUMsR0FBRyxPQUFPLCtDQUErQyxDQUFDLENBQUM7QUFDckUsQ0FBQyxDQUFDO0FBRUYsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDeEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRywrQkFBK0IsQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUNsRyxPQUFPLENBQUMsR0FBRyxPQUFPLDBCQUEwQixDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLGlCQUFxQyxDQUFDO0lBQzFDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNsRCxNQUFNLFdBQVcsR0FBRyxHQUFHLE9BQU8sSUFBSSxLQUFLLEdBQUcsQ0FBQztRQUMzQyxJQUFJLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxDQUFDLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFdBQVcsNEJBQTRCLENBQUMsQ0FBQztZQUN4RCxTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDckMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFdBQVcsMkNBQTJDLENBQUMsQ0FBQztRQUN6RSxDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksaUJBQWlCLEtBQUssU0FBUyxJQUFJLGlCQUFpQixDQUFDLGlCQUFpQixFQUFFLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztnQkFDcEcsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOENBQThDLENBQUMsQ0FBQztZQUN4RSxDQUFDO1lBQ0QsaUJBQWlCLEdBQUcsT0FBTyxDQUFDLFNBQVMsQ0FBQztRQUN4QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN0RyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVywyQ0FBMkMsQ0FBQyxDQUFDO1lBQ3ZFLFNBQVM7UUFDWCxDQUFDO1FBQ0QsS0FBSyxNQUFNLENBQUMsYUFBYSxFQUFFLFFBQVEsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLEdBQUcsV0FBVyxjQUFjLGFBQWEsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQzdCLENBQUMsQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsVUFBVSxLQUFLLFVBQVU7bUJBQ3JGLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLEtBQUssZUFBZSxDQUFDLEVBQUUsQ0FBQztZQUNuRyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVyxxRUFBcUUsQ0FBQyxDQUFDO1FBQ25HLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsc0dBQXNHO0FBQ3RHLE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLENBQ3RELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxxQ0FBcUMsRUFDckMsRUFBRTtJQUNaLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsVUFBVSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3RFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsT0FBTyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLEdBQUcsT0FBTyxXQUFXLENBQUMsQ0FBQztBQUNwRSxDQUFDLENBQUM7QUFFRixpRkFBaUY7QUFDakYsTUFBTSxDQUFDLE1BQU0sK0NBQStDLEdBQUcsQ0FDN0QsUUFBaUIsRUFDakIsT0FBTyxHQUFHLDZDQUE2QyxFQUM3QyxFQUFFO0lBQ1osSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7UUFBRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDOUUsTUFBTSxTQUFTLEdBQUcsUUFBUSxDQUFDLFNBQVMsQ0FBQztJQUNyQyxJQUFJLFNBQVMsS0FBSyxJQUFJO1FBQ3BCLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUMzRSxDQUFDLENBQUMsU0FBUyxLQUFLLEtBQUssSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdEcsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMkJBQTJCLENBQUMsQ0FBQztJQUMxRixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUssUUFBUSxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDcEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sZ0RBQWdELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxTQUFTLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDdkIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsR0FBRyxPQUFPLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDN0UsQ0FBQztTQUFNLElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyw0QkFBNEIsSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLHVCQUF1QixFQUFFLENBQUM7UUFDakgsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8scURBQXFELENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxVQUFVLEdBQUcsQ0FBQyxTQUFpQixFQUFTLEVBQUU7SUFDOUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztBQUM3QixDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxvREFBb0QsR0FBRyxLQUFLLEVBQ3ZFLFlBQXNELEVBQ3JDLEVBQUU7SUFDbkIsTUFBTSxNQUFNLEdBQUcsK0NBQStDLENBQUMsWUFBWSxDQUFDLENBQUM7SUFDN0UsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2xELElBQUksWUFBWSxDQUFDLFNBQVMsS0FBSyxJQUFJO1FBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO0lBQ3RHLE9BQU8sNEJBQTRCLENBQUMsc0JBQXNCLENBQUM7UUFDekQsTUFBTSxFQUFFLCtCQUErQixDQUFDLFlBQVk7UUFDcEQsTUFBTSxFQUFFLFlBQVksQ0FBQyxNQUFNO1FBQzNCLFFBQVEsRUFBRSxZQUFZLENBQUMsUUFBUTtLQUNoQyxFQUFFLFVBQVUsRUFBRSxxQ0FBcUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0FBQ3JFLENBQUMsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBbUQsRUFBVSxFQUFFLENBQ25GLEdBQUcsUUFBUSxDQUFDLFNBQVMsU0FBUyxRQUFRLENBQUMsVUFBVSxFQUFFLENBQUM7QUFFdEQsd0dBQXdHO0FBQ3hHLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLENBQ3ZELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxxQ0FBcUMsRUFDckMsRUFBRTtJQUNaLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUM5QyxRQUFRLENBQUMsTUFBTSxHQUFHLCtCQUErQixDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDMUUsT0FBTyxDQUFDLEdBQUcsT0FBTyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxRQUE0QixDQUFDO0lBQ2pDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxDQUFDLFdBQVcsRUFBRSxZQUFZLENBQUMsQ0FBQztlQUN6RSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sSUFBSSxLQUFLLDhDQUE4QyxDQUFDLENBQUM7WUFDL0UsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLEdBQUcsR0FBRyxZQUFZLENBQUMsS0FBcUQsQ0FBQyxDQUFDO1FBQ2hGLElBQUksUUFBUSxLQUFLLFNBQVMsSUFBSSxpQkFBaUIsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sOERBQThELENBQUMsQ0FBQztRQUN4RixDQUFDO1FBQ0QsUUFBUSxHQUFHLEdBQUcsQ0FBQztJQUNqQixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJDQUEyQyxHQUFHLENBQ3pELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxlQUFlLEVBQ2YsRUFBRTtJQUNaLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNoRCxRQUFRLENBQUMsTUFBTSxHQUFHLCtCQUErQixDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDMUUsT0FBTyxDQUFDLEdBQUcsT0FBTyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQzlDLE1BQU0sVUFBVSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDckMsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ2hELElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxXQUFXLENBQUMsQ0FBQztlQUN0RixDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3pHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLFVBQVUsS0FBSyx3REFBd0QsQ0FBQyxDQUFDO1lBQy9GLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxpQkFBaUIsR0FBRyxZQUFZLENBQUMsS0FBcUQsQ0FBQyxDQUFDO1FBQzlGLElBQUksbUJBQW1CLENBQUMsR0FBRyxDQUFDLGlCQUFpQixDQUFDLElBQUksVUFBVSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBbUIsQ0FBQyxFQUFFLENBQUM7WUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sVUFBVSxLQUFLLDZDQUE2QyxDQUFDLENBQUM7UUFDdEYsQ0FBQztRQUNELG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzNDLFVBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLFNBQW1CLENBQUMsQ0FBQztJQUM1QyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBWUY7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQzVELFVBQStDLEVBQy9DLFlBQXNELEVBQ3RELGtCQUEwQixFQUMxQixPQUFPLEdBQUcsMENBQTBDLEVBQzFDLEVBQUU7SUFDWixJQUFJLCtDQUErQyxDQUFDLFlBQVksQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksWUFBWSxDQUFDLFNBQVMsS0FBSyxJQUFJO1dBQzFHLE9BQU8sa0JBQWtCLEtBQUssUUFBUSxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUMzRixPQUFPLENBQUMsR0FBRyxPQUFPLG1EQUFtRCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQztJQUNwRCxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsRUFBRSxjQUFjLEVBQUUsaUJBQWlCLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdkcsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLE1BQU0sSUFBSSxRQUFRLENBQUMsZUFBZSxLQUFLLGtCQUFrQixFQUFFLENBQUM7UUFDL0YsT0FBTyxDQUFDLEdBQUcsT0FBTyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUM7UUFBRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRDQUE0QyxDQUFDLENBQUM7SUFDMUcsTUFBTSxRQUFRLEdBQUcsWUFBWSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLFVBQVUsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFDLFNBQVMsQ0FBQztRQUN4RyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxVQUFVLEtBQUssVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3RGLElBQUksQ0FBQyxRQUFRO1FBQUUsT0FBTyxDQUFDLEdBQUcsT0FBTyx5REFBeUQsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixNQUFNLFVBQVUsR0FBRyxRQUFRLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztJQUNwRyxJQUFJLFFBQVEsQ0FBQyxZQUFZLEtBQUssVUFBVTtRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGtEQUFrRCxDQUFDLENBQUM7SUFDcEgsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUk7UUFDOUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLFVBQVUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxxRUFBcUUsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssZUFBZSxFQUFFLENBQUM7UUFDNUMsSUFBSSxVQUFVLENBQUMsdUJBQXVCLEtBQUssUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQy9ELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLG9EQUFvRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxJQUFJO1lBQzdCLENBQUMsQ0FBQyxVQUFVLENBQUMsc0JBQXNCLEtBQUssU0FBUztZQUNqRCxDQUFDLENBQUMsQ0FBQyxrQ0FBa0MsQ0FBQyxVQUFVLENBQUMsc0JBQXNCLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1lBQ3ZHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLHVEQUF1RCxDQUFDLENBQUM7UUFDakYsQ0FBQztJQUNILENBQUM7U0FBTSxJQUFJLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxTQUFTLElBQUksVUFBVSxDQUFDLHNCQUFzQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQy9HLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLHFEQUFxRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxDQUN2RCxXQUEyRCxFQUNkLEVBQUU7SUFDL0MsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFO1FBQzFDLElBQUksVUFBVSxDQUFDLHVCQUF1QixLQUFLLFNBQVMsSUFBSSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUM3RixNQUFNLElBQUksS0FBSyxDQUFDLFdBQVcsVUFBVSxDQUFDLEVBQUUsc0NBQXNDLENBQUMsQ0FBQztRQUNsRixDQUFDO1FBQ0QsT0FBTyxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVSxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsRUFBRSxFQUFFLENBQUM7SUFDMUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLENBQUMsaUJBQWlCLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDakcsTUFBTSxNQUFNLEdBQUcsMkNBQTJDLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDakUsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2xELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELGFBQXFCLEVBQ3JCLE9BQWdCLEVBQ3FCLEVBQUUsQ0FBQyxDQUN4QyxhQUFhLEtBQUssR0FBRyxJQUFJLGFBQWEsQ0FBQyxPQUFPLENBQUMsSUFBSSxPQUFPLENBQUMsRUFBRSxLQUFLLEtBQUs7T0FDakUsNEJBQW1ELENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUM7SUFDOUUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFvQztJQUM5QyxDQUFDLENBQUMsSUFBSSxDQUNULENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29yZXN0b3JlbGVnYWN5YWRvcHRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NvcmVzdG9yZWxlZ2FjeWFkb3B0aW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFDTCxrQ0FBa0MsRUFDbEMsb0NBQW9DLEdBQ3JDLE1BQU0sdUNBQXVDLENBQUM7QUFDL0MsT0FBTyxFQUFFLHVDQUF1QyxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFFdkYsT0FBTyxFQUFFLDRCQUE0QixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDcEUsT0FBTyxFQUNMLHNCQUFzQixFQUN0QixpQkFBaUIsRUFDakIsNEJBQTRCLEdBQzdCLE1BQU0sNkJBQTZCLENBQUM7QUFDckMsT0FBTyxFQUFFLFlBQVksRUFBRSxhQUFhLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUMzRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFzSS9ELE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDM0QsZ0dBQWdHO0lBQ2hHLGFBQWEsRUFBRSwyQkFBMkI7SUFDMUMsa0ZBQWtGO0lBQ2xGLGtCQUFrQixFQUFFLElBQUk7SUFDeEIsZUFBZSxFQUFFLElBQUk7SUFDckIsaUJBQWlCLEVBQUUsR0FBRztJQUN0QixZQUFZLEVBQUUsdUNBQXVDO0NBQzdDLENBQUMsQ0FBQztBQUVaLE1BQU0saUJBQWlCLEdBQUcscUNBQXFDLENBQUM7QUFDaEUsTUFBTSxvQkFBb0IsR0FBRyxnQkFBZ0IsQ0FBQztBQUM5QyxNQUFNLGlCQUFpQixHQUFHLGdCQUFnQixDQUFDO0FBQzNDLE1BQU0sUUFBUSxHQUErQztJQUMzRCxlQUFlLEVBQUUsOEJBQThCLEVBQUUsa0JBQWtCLEVBQUUsd0JBQXdCO0NBQzlGLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUM5RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksaUJBQWlCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUNqRSxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDOUQsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUN6QixRQUFRLENBQUMsTUFBTSxJQUFJLCtCQUErQixDQUFDLGlCQUFpQjtPQUNwRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQ3ZDLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQTBDLEVBQUUsQ0FBQyxDQUNsRixRQUFRLEtBQUssVUFBVSxJQUFJLFFBQVEsS0FBSyxlQUFlLENBQ3hELENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQ3ZCLFFBQWlCLEVBQUUsYUFBeUMsRUFBRSxPQUFlLEVBQ25FLEVBQUU7SUFDWixJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUM5RSxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssV0FBVyxFQUFFLENBQUM7UUFDbkMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFBRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7UUFDbkcsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxDQUFFLFFBQStCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzlGLE9BQU8sQ0FBQyxHQUFHLE9BQU8sMENBQTBDLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLHdCQUF3QixJQUFJLGFBQWEsS0FBSyxlQUFlO1lBQ3ZGLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTyxvREFBb0QsQ0FBQztZQUNsRSxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1QsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUNwQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQztZQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztRQUNyRyxPQUFPLFlBQVksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8sMkNBQTJDLENBQUMsQ0FBQztJQUN6RyxDQUFDO0lBQ0QsT0FBTyxDQUFDLEdBQUcsT0FBTyx3Q0FBd0MsQ0FBQyxDQUFDO0FBQzlELENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLFdBQVcsR0FBRyxDQUFDLFdBQW9CLEVBQVcsRUFBRSxDQUFDLENBQ3JELGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEtBQUssWUFBWSxJQUFJLFdBQVcsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQ25HLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN4RSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUM5RSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDdkMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxZQUFZLEVBQUUsY0FBYyxFQUFFLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN4RSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsVUFBVSxFQUFFLEdBQUcsT0FBTyxXQUFXLENBQUMsQ0FBQztRQUN0RixJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7WUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxnREFBZ0QsQ0FBQyxDQUFDO1FBQ2xILE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssZUFBZSxFQUFFLENBQUM7UUFDNUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxZQUFZLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbkYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO1FBQ2xELENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLGVBQWUsRUFBRSxHQUFHLE9BQU8sV0FBVyxDQUFDLENBQUM7UUFDM0YsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7YUFBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLFdBQVcsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNqRSwyRkFBMkY7WUFDM0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHVDQUF1QyxDQUFDLFFBQVEsQ0FBQyxVQUFVLEVBQUUsR0FBRyxPQUFPLGFBQWEsQ0FBQyxDQUFDLENBQUM7UUFDeEcsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsb0NBQW9DLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxHQUFHLE9BQU8sWUFBWSxDQUFDLENBQUMsQ0FBQztRQUNuRyxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUNELE9BQU8sQ0FBQyxHQUFHLE9BQU8sK0NBQStDLENBQUMsQ0FBQztBQUNyRSxDQUFDLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN4RSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLCtCQUErQixDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ2xHLE9BQU8sQ0FBQyxHQUFHLE9BQU8sMEJBQTBCLENBQUMsQ0FBQztJQUNoRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksaUJBQXFDLENBQUM7SUFDMUMsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ2xELE1BQU0sV0FBVyxHQUFHLEdBQUcsT0FBTyxJQUFJLEtBQUssR0FBRyxDQUFDO1FBQzNDLElBQUksQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFLENBQUMsV0FBVyxFQUFFLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNsRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVyw0QkFBNEIsQ0FBQyxDQUFDO1lBQ3hELFNBQVM7UUFDWCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUNyQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVywyQ0FBMkMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxpQkFBaUIsS0FBSyxTQUFTLElBQUksaUJBQWlCLENBQUMsaUJBQWlCLEVBQUUsT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUNwRyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw4Q0FBOEMsQ0FBQyxDQUFDO1lBQ3hFLENBQUM7WUFDRCxpQkFBaUIsR0FBRyxPQUFPLENBQUMsU0FBUyxDQUFDO1FBQ3hDLENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxXQUFXLDJDQUEyQyxDQUFDLENBQUM7WUFDdkUsU0FBUztRQUNYLENBQUM7UUFDRCxLQUFLLE1BQU0sQ0FBQyxhQUFhLEVBQUUsUUFBUSxDQUFDLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQ3BFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLEVBQUUsR0FBRyxXQUFXLGNBQWMsYUFBYSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQzNGLENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDN0IsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLEtBQUssVUFBVTttQkFDckYsYUFBYSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsS0FBSyxlQUFlLENBQUMsRUFBRSxDQUFDO1lBQ25HLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxXQUFXLHFFQUFxRSxDQUFDLENBQUM7UUFDbkcsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixzR0FBc0c7QUFDdEcsTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsQ0FDdEQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLHFDQUFxQyxFQUNyQyxFQUFFO0lBQ1osSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdEUsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxPQUFPLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsR0FBRyxPQUFPLFdBQVcsQ0FBQyxDQUFDO0FBQ3BFLENBQUMsQ0FBQztBQUVGLGlGQUFpRjtBQUNqRixNQUFNLENBQUMsTUFBTSwrQ0FBK0MsR0FBRyxDQUM3RCxRQUFpQixFQUNqQixPQUFPLEdBQUcsNkNBQTZDLEVBQzdDLEVBQUU7SUFDWixJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUM5RSxNQUFNLFNBQVMsR0FBRyxRQUFRLENBQUMsU0FBUyxDQUFDO0lBQ3JDLElBQUksU0FBUyxLQUFLLElBQUk7UUFDcEIsQ0FBQyxDQUFDLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQzNFLENBQUMsQ0FBQyxTQUFTLEtBQUssS0FBSyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN0RyxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7UUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywyQkFBMkIsQ0FBQyxDQUFDO0lBQzFGLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSyxRQUFRLENBQUMsU0FBb0IsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxnREFBZ0QsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxJQUFJLFNBQVMsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUN2QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLFFBQVEsRUFBRSxHQUFHLE9BQU8sV0FBVyxDQUFDLENBQUMsQ0FBQztJQUM3RSxDQUFDO1NBQU0sSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLDRCQUE0QixJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssdUJBQXVCLEVBQUUsQ0FBQztRQUNqSCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxxREFBcUQsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLFVBQVUsR0FBRyxDQUFDLFNBQWlCLEVBQVMsRUFBRTtJQUM5QyxNQUFNLElBQUksS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0FBQzdCLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9EQUFvRCxHQUFHLEtBQUssRUFDdkUsWUFBc0QsRUFDckMsRUFBRTtJQUNuQixNQUFNLE1BQU0sR0FBRywrQ0FBK0MsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUM3RSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbEQsSUFBSSxZQUFZLENBQUMsU0FBUyxLQUFLLElBQUk7UUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLCtDQUErQyxDQUFDLENBQUM7SUFDdEcsT0FBTyw0QkFBNEIsQ0FBQyxzQkFBc0IsQ0FBQztRQUN6RCxNQUFNLEVBQUUsK0JBQStCLENBQUMsWUFBWTtRQUNwRCxNQUFNLEVBQUUsWUFBWSxDQUFDLE1BQU07UUFDM0IsUUFBUSxFQUFFLFlBQVksQ0FBQyxRQUFRO0tBQ2hDLEVBQUUsVUFBVSxFQUFFLHFDQUFxQyxDQUFDLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFDckUsQ0FBQyxDQUFDO0FBRUYsTUFBTSxZQUFZLEdBQUcsQ0FBQyxRQUFtRCxFQUFVLEVBQUUsQ0FDbkYsR0FBRyxRQUFRLENBQUMsU0FBUyxTQUFTLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztBQUV0RCx3R0FBd0c7QUFDeEcsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FDdkQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLHFDQUFxQyxFQUNyQyxFQUFFO0lBQ1osSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQzlDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsK0JBQStCLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUMxRSxPQUFPLENBQUMsR0FBRyxPQUFPLG9DQUFvQyxDQUFDLENBQUM7SUFDMUQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFFBQTRCLENBQUM7SUFDakMsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ2hELElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLENBQUMsV0FBVyxFQUFFLFlBQVksQ0FBQyxDQUFDO2VBQ3pFLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN2RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxJQUFJLEtBQUssOENBQThDLENBQUMsQ0FBQztZQUMvRSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sR0FBRyxHQUFHLFlBQVksQ0FBQyxLQUFxRCxDQUFDLENBQUM7UUFDaEYsSUFBSSxRQUFRLEtBQUssU0FBUyxJQUFJLGlCQUFpQixDQUFDLFFBQVEsRUFBRSxHQUFHLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNwRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw4REFBOEQsQ0FBQyxDQUFDO1FBQ3hGLENBQUM7UUFDRCxRQUFRLEdBQUcsR0FBRyxDQUFDO0lBQ2pCLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FDekQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLGVBQWUsRUFDZixFQUFFO0lBQ1osSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ2hELFFBQVEsQ0FBQyxNQUFNLEdBQUcsK0JBQStCLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztRQUMxRSxPQUFPLENBQUMsR0FBRyxPQUFPLG9DQUFvQyxDQUFDLENBQUM7SUFDMUQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixNQUFNLG1CQUFtQixHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDOUMsTUFBTSxVQUFVLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztJQUNyQyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDaEQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxXQUFXLEVBQUUsWUFBWSxFQUFFLFdBQVcsQ0FBQyxDQUFDO2VBQ3RGLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDekcsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sVUFBVSxLQUFLLHdEQUF3RCxDQUFDLENBQUM7WUFDL0YsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLGlCQUFpQixHQUFHLFlBQVksQ0FBQyxLQUFxRCxDQUFDLENBQUM7UUFDOUYsSUFBSSxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsaUJBQWlCLENBQUMsSUFBSSxVQUFVLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxTQUFtQixDQUFDLEVBQUUsQ0FBQztZQUM1RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxVQUFVLEtBQUssNkNBQTZDLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBQ0QsbUJBQW1CLENBQUMsR0FBRyxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDM0MsVUFBVSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBbUIsQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFZRjs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FDNUQsVUFBK0MsRUFDL0MsWUFBc0QsRUFDdEQsa0JBQTBCLEVBQzFCLE9BQU8sR0FBRywwQ0FBMEMsRUFDMUMsRUFBRTtJQUNaLElBQUksK0NBQStDLENBQUMsWUFBWSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxZQUFZLENBQUMsU0FBUyxLQUFLLElBQUk7V0FDMUcsT0FBTyxrQkFBa0IsS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsRUFBRSxDQUFDO1FBQzNGLE9BQU8sQ0FBQyxHQUFHLE9BQU8sbURBQW1ELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLHVCQUF1QixDQUFDO0lBQ3BELElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxFQUFFLGNBQWMsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN2RyxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxZQUFZLENBQUMsTUFBTSxJQUFJLFFBQVEsQ0FBQyxlQUFlLEtBQUssa0JBQWtCLEVBQUUsQ0FBQztRQUMvRixPQUFPLENBQUMsR0FBRyxPQUFPLDRDQUE0QyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNENBQTRDLENBQUMsQ0FBQztJQUMxRyxNQUFNLFFBQVEsR0FBRyxZQUFZLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLFNBQVMsS0FBSyxVQUFVLENBQUMsU0FBUyxDQUFDO1FBQ3hHLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLFVBQVUsS0FBSyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDdEYsSUFBSSxDQUFDLFFBQVE7UUFBRSxPQUFPLENBQUMsR0FBRyxPQUFPLHlEQUF5RCxDQUFDLENBQUM7SUFDNUYsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sVUFBVSxHQUFHLFFBQVEsQ0FBQyxVQUFVLEtBQUssVUFBVSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO0lBQ3BHLElBQUksUUFBUSxDQUFDLFlBQVksS0FBSyxVQUFVO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sa0RBQWtELENBQUMsQ0FBQztJQUNwSCxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFdBQVcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEtBQUssSUFBSTtRQUM5RSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssVUFBVSxDQUFDLEVBQUUsRUFBRSxDQUFDO1FBQ2xELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLHFFQUFxRSxDQUFDLENBQUM7SUFDL0YsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUM1QyxJQUFJLFVBQVUsQ0FBQyx1QkFBdUIsS0FBSyxRQUFRLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDL0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sb0RBQW9ELENBQUMsQ0FBQztRQUM5RSxDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLElBQUk7WUFDN0IsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsS0FBSyxTQUFTO1lBQ2pELENBQUMsQ0FBQyxDQUFDLGtDQUFrQyxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDdkcsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sdURBQXVELENBQUMsQ0FBQztRQUNqRixDQUFDO0lBQ0gsQ0FBQztTQUFNLElBQUksVUFBVSxDQUFDLHVCQUF1QixLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsc0JBQXNCLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDL0csTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8scURBQXFELENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLENBQ3ZELFdBQTJELEVBQ2QsRUFBRTtJQUMvQyxNQUFNLElBQUksR0FBRyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUU7UUFDMUMsSUFBSSxVQUFVLENBQUMsdUJBQXVCLEtBQUssU0FBUyxJQUFJLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQzdGLE1BQU0sSUFBSSxLQUFLLENBQUMsV0FBVyxVQUFVLENBQUMsRUFBRSxzQ0FBc0MsQ0FBQyxDQUFDO1FBQ2xGLENBQUM7UUFDRCxPQUFPLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxVQUFVLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztJQUMxRyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLEVBQUUsWUFBWSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNqRyxNQUFNLE1BQU0sR0FBRywyQ0FBMkMsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQztRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDbEQsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FDaEQsYUFBcUIsRUFDckIsT0FBZ0IsRUFDcUIsRUFBRSxDQUFDLENBQ3hDLGFBQWEsS0FBSyxHQUFHLElBQUksYUFBYSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sQ0FBQyxFQUFFLEtBQUssS0FBSztPQUNqRSw0QkFBbUQsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztJQUM5RSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQW9DO0lBQzlDLENBQUMsQ0FBQyxJQUFJLENBQ1QsQ0FBQyJ9

package/dist_ts/data/runtimelocalstorageclaim.d.ts

@@ -1,16 +1,65 @@
 import type { TSha256Digest } from './immutableimage.js';
 import type { IRuntimeAssignment, IRuntimeAuthorityReference, IRuntimeController } from './runtimeassignment.js';
 import type { IRuntimeSessionBinding } from './runtimesession.js';
+/** A node-local directory the node derives from the claim's identity under a root only the node knows. */
+export type TRuntimeLocalStorageDirectorySource = {
+    kind: 'directory';
+};
 /**
- * Where a local storage claim's bytes live, named by kind and never by path.
+ * A directory on an NFS export. The node mounts `server:export` and uses `subPath` below it.
  *
- * `directory` is a node-local directory the node derives from the claim's identity under a root
- * only the node knows. Network filesystems join this union as further kinds; their credentials
- * travel as secrets and never inside a claim.
+ * `server` is a lowercase fully qualified hostname or a canonical IP literal, on the standard port.
+ * `export` is the canonical absolute path the server exports, `/` included. `subPath` is the
+ * volume's directory below the export, as canonical relative segments, or `.` for the export
+ * itself. `version` pins one protocol version. NFS authenticates the node's host, not a user, so
+ * the source names no credential.
  */
-export type TRuntimeLocalStorageSource = {
-    kind: 'directory';
+export type TRuntimeLocalStorageNfsSource = {
+    kind: 'nfs';
+    server: string;
+    export: string;
+    subPath: string;
+    version: TRuntimeLocalStorageNfsVersion;
+};
+/**
+ * A directory on an SMB share. The node mounts `//server/share` and uses `subPath` below it.
+ *
+ * `server` and `subPath` follow the NFS rules; `share` is one share name. `version` pins one
+ * dialect. `credential` names the credential authority the node authenticates with, by reference
+ * only: the claim never carries a user name, password or domain, and the node resolves the material
+ * through the controller's secret delivery.
+ */
+export type TRuntimeLocalStorageSmbSource = {
+    kind: 'smb';
+    server: string;
+    share: string;
+    subPath: string;
+    version: TRuntimeLocalStorageSmbVersion;
+    credential: IRuntimeAuthorityReference;
 };
+/**
+ * Where a local storage claim's bytes live, named by kind and never by a node's host path.
+ *
+ * A network source names the remote location and nothing about how to mount it: no mount option,
+ * no port and no credential value. The node derives every mount parameter from these fields alone.
+ * The kinds are type aliases, as `{ kind: 'directory' }` always was, so a source stays assignable
+ * to a plain record.
+ */
+export type TRuntimeLocalStorageSource = TRuntimeLocalStorageDirectorySource | TRuntimeLocalStorageNfsSource | TRuntimeLocalStorageSmbSource;
+/**
+ * The NFS protocol versions a claim may pin, spelled as the kernel's NFS `vers=` parameter spells
+ * them. NFS version 4 is always stated with its minor version: the bare `4` negotiates one, which
+ * the kernel keeps only for backward compatibility, and a claim must mean the same mount on every
+ * node. Version 2 is refused.
+ */
+export type TRuntimeLocalStorageNfsVersion = (typeof runtimeLocalStorageClaimContract.nfsVersions)[number];
+/**
+ * The SMB dialects a claim may pin, spelled as the kernel's CIFS `vers=` parameter spells them.
+ * Only SMB 3 dialects, the first that encrypt; the kernel refuses 1.0 and 2.0 unless built with
+ * insecure legacy dialects. `3` alone negotiates one and is refused for the same reason as a bare
+ * NFS `4`.
+ */
+export type TRuntimeLocalStorageSmbVersion = (typeof runtimeLocalStorageClaimContract.smbVersions)[number];
 /** The owner and permission bits a node gives an `empty` volume's root directory when it creates it. */
 export interface IRuntimeLocalStorageOwnership {
     uid: number;
@@ -29,15 +78,19 @@ export interface IRuntimeLocalStorageMount {
  */
 export type TRuntimeLocalStorageLifecycle = 'bound' | 'purge';
 /**
- * A controller's authority for one retained, node-local volume of one service.
+ * A controller's authority for one retained volume of one service, mounted on one node.
  *
- * Cloudly and Onebox issue it alike. It names the volume by identity only: no host path, no
- * device, no mount option and no credential. The node resolves the identity to its own storage.
+ * Cloudly and Onebox issue it alike. It never names a host path, a device, a mount option or a
+ * credential value. A `directory` source names the volume by identity only, and the node resolves
+ * it to its own storage; a network source names the remote directory and, for SMB, the credential
+ * by reference.
  *
  * `initialization` says what the node does when the volume does not exist yet. `empty` creates an
  * empty root with `initialOwnership`, which it must state, so a workload that runs as the image's
  * own user never meets a root-owned directory by accident. `import` waits for the volume's bytes to
- * be imported and states no ownership: an imported tree keeps the ownership it carries.
+ * be imported and states no ownership: an imported tree keeps the ownership it carries. SMB carries
+ * no POSIX ownership, so the node presents an SMB volume with `initialOwnership`, and an `smb`
+ * source is always `empty`.
  */
 export interface IRuntimeLocalStorageClaim {
     id: string;
@@ -90,6 +143,16 @@ export declare const runtimeLocalStorageClaimContract: Readonly<{
     readonly reclaimPolicy: "retain";
     /** Every permission bit a claim may state: setgid, sticky and the rwx triplets. */
     readonly directoryModeBits: 2047;
+    readonly nfsVersions: readonly ["3", "4.0", "4.1", "4.2"];
+    readonly smbVersions: readonly ["3.0", "3.02", "3.1.1"];
+    /** The longest hostname a network source may name, in characters. */
+    readonly maximumServerLength: 253;
+    /** The longest `export` or `subPath`, in characters; every character is printable ASCII. */
+    readonly maximumPathLength: 1024;
+    /** The longest segment of an `export` or `subPath`. */
+    readonly maximumSegmentLength: 255;
+    /** The longest SMB share name. */
+    readonly maximumShareLength: 80;
 }>;
 /** Detached exact-schema snapshot. The digest is a separate check. */
 export declare const snapshotRuntimeLocalStorageClaim: (valueArg: unknown) => IRuntimeLocalStorageClaim;

package/dist_ts/data/runtimelocalstorageclaim.js

@@ -1,6 +1,7 @@
 import { snapshotRuntimeAssignment, validateRuntimeAssignment } from './runtimeassignment.js';
 import { snapshotRuntimeSessionBinding } from './runtimesession.js';
 import { captureNetwork, networkController, networkDigest, networkEqual, networkHash, networkId, networkNodeId, networkRecord, networkReference, networkReferenceOf, networkRevision, requireNetwork, } from '../private/networkcontract.js';
+import { parseCanonicalIpAddress } from '../private/ipaddress.js';
 import { isRuntimeIdentityNumber } from '../private/runtimepolicy.js';
 import { createStorageContractReaders } from '../private/storagecontract.js';
 export const runtimeLocalStorageClaimContract = Object.freeze({
@@ -10,6 +11,16 @@ export const runtimeLocalStorageClaimContract = Object.freeze({
     reclaimPolicy: 'retain',
     /** Every permission bit a claim may state: setgid, sticky and the rwx triplets. */
     directoryModeBits: 0o3777,
+    nfsVersions: ['3', '4.0', '4.1', '4.2'],
+    smbVersions: ['3.0', '3.02', '3.1.1'],
+    /** The longest hostname a network source may name, in characters. */
+    maximumServerLength: 253,
+    /** The longest `export` or `subPath`, in characters; every character is printable ASCII. */
+    maximumPathLength: 1024,
+    /** The longest segment of an `export` or `subPath`. */
+    maximumSegmentLength: 255,
+    /** The longest SMB share name. */
+    maximumShareLength: 80,
 });
 const fail = () => { throw new Error(runtimeLocalStorageClaimContract.error); };
 const safe = (operationArg) => { try {
@@ -21,7 +32,81 @@ catch {
 const { readMountPath } = createStorageContractReaders(fail);
 const claimStates = ['ready', 'import-required', 'purged', 'uncertain'];
 const responseStatuses = ['accepted', 'replay', 'historical'];
+const hostnameLabelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/**
+ * Printable ASCII without a space. One spelling per name, so two claims cannot name one directory
+ * two ways, and nothing a mount source or an option string reads as a separator.
+ */
+const printableAsciiPattern = /^[\x21-\x7e]+$/;
+/** A comma or `=` would read as a mount option; the rest have meaning in a mount source or an SMB name. */
+const pathSegmentForbiddenPattern = /["*,/:<=>?\\|]/;
+/** SMB refuses these in a share name, beyond what it refuses in a path segment. */
+const shareForbiddenPattern = /[+;\[\]]/;
+/**
+ * A lowercase fully qualified hostname of two or more labels whose last label is not numeric, or a
+ * canonical IP literal. One label would resolve through each node's own search domains; a numeric
+ * last label would let a non-canonical address pass as a hostname. There is no port and no
+ * userinfo: the node connects to the protocol's standard port.
+ */
+const serverOf = (valueArg) => {
+    requireNetwork(typeof valueArg === 'string');
+    if (parseCanonicalIpAddress(valueArg) !== null)
+        return valueArg;
+    const labels = valueArg.split('.');
+    requireNetwork(valueArg.length <= runtimeLocalStorageClaimContract.maximumServerLength && labels.length >= 2
+        && labels.every((labelArg) => hostnameLabelPattern.test(labelArg))
+        && !/^[0-9]+$/.test(labels[labels.length - 1]));
+    return valueArg;
+};
+const isPathSegment = (valueArg) => valueArg.length <= runtimeLocalStorageClaimContract.maximumSegmentLength
+    && printableAsciiPattern.test(valueArg) && !pathSegmentForbiddenPattern.test(valueArg)
+    && valueArg !== '.' && valueArg !== '..';
+const isRelativeSegments = (valueArg) => valueArg.length <= runtimeLocalStorageClaimContract.maximumPathLength
+    && valueArg.split('/').every(isPathSegment);
+/** `/`, or `/` followed by canonical segments without a trailing slash. */
+const exportOf = (valueArg) => {
+    requireNetwork(typeof valueArg === 'string' && valueArg.length <= runtimeLocalStorageClaimContract.maximumPathLength
+        && valueArg.startsWith('/') && (valueArg === '/' || isRelativeSegments(valueArg.slice(1))));
+    return valueArg;
+};
+/** `.`, or canonical relative segments. */
+const subPathOf = (valueArg) => {
+    requireNetwork(typeof valueArg === 'string' && (valueArg === '.' || isRelativeSegments(valueArg)));
+    return valueArg;
+};
+const shareOf = (valueArg) => {
+    requireNetwork(typeof valueArg === 'string' && valueArg.length <= runtimeLocalStorageClaimContract.maximumShareLength
+        && isPathSegment(valueArg) && !shareForbiddenPattern.test(valueArg));
+    return valueArg;
+};
+const literalOf = (valueArg, allowedArg) => {
+    requireNetwork(allowedArg.includes(valueArg));
+    return valueArg;
+};
 const sourceOf = (valueArg) => {
+    requireNetwork(valueArg !== null && typeof valueArg === 'object');
+    const { kind } = valueArg;
+    if (kind === 'nfs') {
+        const value = networkRecord(valueArg, ['kind', 'server', 'export', 'subPath', 'version']);
+        return {
+            kind: 'nfs',
+            server: serverOf(value.server),
+            export: exportOf(value.export),
+            subPath: subPathOf(value.subPath),
+            version: literalOf(value.version, runtimeLocalStorageClaimContract.nfsVersions),
+        };
+    }
+    if (kind === 'smb') {
+        const value = networkRecord(valueArg, ['kind', 'server', 'share', 'subPath', 'version', 'credential']);
+        return {
+            kind: 'smb',
+            server: serverOf(value.server),
+            share: shareOf(value.share),
+            subPath: subPathOf(value.subPath),
+            version: literalOf(value.version, runtimeLocalStorageClaimContract.smbVersions),
+            credential: networkReference(value.credential),
+        };
+    }
     const value = networkRecord(valueArg, ['kind']);
     requireNetwork(value.kind === 'directory');
     return { kind: 'directory' };
@@ -48,6 +133,8 @@ export const snapshotRuntimeLocalStorageClaim = (valueArg) => safe(() => {
         || (value.initialization === 'import' && value.initialOwnership === null));
     requireNetwork(value.accessMode === 'ReadWriteOnce' && value.reclaimPolicy === 'retain');
     requireNetwork(value.lifecycle === 'bound' || (value.lifecycle === 'purge' && previous !== null));
+    const source = sourceOf(value.source);
+    requireNetwork(source.kind !== 'smb' || value.initialization === 'empty');
     return {
         id, generation, previous,
         controller: networkController(value.controller),
@@ -57,7 +144,7 @@ export const snapshotRuntimeLocalStorageClaim = (valueArg) => safe(() => {
         runtimeNamespace: networkId(value.runtimeNamespace),
         serviceId: networkId(value.serviceId),
         volumeId: networkId(value.volumeId),
-        source: sourceOf(value.source),
+        source,
         initialization: value.initialization,
         initialOwnership: value.initialOwnership === null ? null : ownershipOf(value.initialOwnership),
         mount: mountOf(value.mount),
@@ -164,4 +251,4 @@ export const bindApplyRuntimeLocalStorageClaimResponse = (valueArg, requestArg)
     }
     return response;
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWxvY2Fsc3RvcmFnZWNsYWltLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9ydW50aW1lbG9jYWxzdG9yYWdlY2xhaW0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLHlCQUF5QixFQUFFLHlCQUF5QixFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFFOUYsT0FBTyxFQUFFLDZCQUE2QixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDcEUsT0FBTyxFQUFFLGNBQWMsRUFBRSxpQkFBaUIsRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQzdGLGFBQWEsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsZUFBZSxFQUFFLGNBQWMsR0FDcEcsTUFBTSwrQkFBK0IsQ0FBQztBQUN2QyxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUN0RSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQTBGN0UsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM1RCxZQUFZLEVBQUUsd0NBQXdDO0lBQ3RELEtBQUssRUFBRSxnREFBZ0Q7SUFDdkQsVUFBVSxFQUFFLGVBQWU7SUFDM0IsYUFBYSxFQUFFLFFBQVE7SUFDdkIsbUZBQW1GO0lBQ25GLGlCQUFpQixFQUFFLE1BQU07Q0FDakIsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN2RixNQUFNLElBQUksR0FBRyxDQUFJLFlBQXFCLEVBQUssRUFBRSxHQUFHLElBQUksQ0FBQztJQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7QUFBQyxDQUFDO0FBQUMsTUFBTSxDQUFDO0lBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztBQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDMUcsTUFBTSxFQUFFLGFBQWEsRUFBRSxHQUFHLDRCQUE0QixDQUFDLElBQUksQ0FBQyxDQUFDO0FBQzdELE1BQU0sV0FBVyxHQUFHLENBQUMsT0FBTyxFQUFFLGlCQUFpQixFQUFFLFFBQVEsRUFBRSxXQUFXLENBQVUsQ0FBQztBQUNqRixNQUFNLGdCQUFnQixHQUFHLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLENBQVUsQ0FBQztBQUV2RSxNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQThCLEVBQUU7SUFDakUsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDaEQsY0FBYyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDM0MsT0FBTyxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUMvQixDQUFDLENBQUM7QUFFRixNQUFNLFdBQVcsR0FBRyxDQUFDLFFBQWlCLEVBQWlDLEVBQUU7SUFDdkUsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLEtBQUssRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUM5RCxjQUFjLENBQUMsdUJBQXVCLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxJQUFJLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUM7V0FDbEYsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUssS0FBSyxDQUFDLElBQWUsSUFBSSxDQUFDO1dBQy9ELENBQUUsS0FBSyxDQUFDLElBQWUsR0FBRyxDQUFDLGdDQUFnQyxDQUFDLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDM0YsT0FBTyxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBYSxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBYSxFQUFFLElBQUksRUFBRSxLQUFLLENBQUMsSUFBYyxFQUFFLENBQUM7QUFDNUYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxPQUFPLEdBQUcsQ0FBQyxRQUFpQixFQUE2QixFQUFFO0lBQy9ELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNqRSxjQUFjLENBQUMsT0FBTyxLQUFLLENBQUMsUUFBUSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3BELE9BQU8sRUFBRSxTQUFTLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsV0FBVyxDQUFDLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUUsQ0FBQztBQUM5RixDQUFDLENBQUM7QUFFRixzRUFBc0U7QUFDdEUsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FBQyxRQUFpQixFQUE2QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUMxRyxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxVQUFVLEVBQUUsWUFBWTtRQUNqRyxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsUUFBUSxFQUFFLGtCQUFrQixFQUFFLFdBQVcsRUFBRSxVQUFVLEVBQUUsUUFBUTtRQUM5RixnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLGVBQWUsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN4RyxNQUFNLEVBQUUsRUFBRSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsR0FBRyxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDNUQsY0FBYyxDQUFDLENBQUMsS0FBSyxDQUFDLGNBQWMsS0FBSyxPQUFPLElBQUksS0FBSyxDQUFDLGdCQUFnQixLQUFLLElBQUksQ0FBQztXQUMvRSxDQUFDLEtBQUssQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQzdFLGNBQWMsQ0FBQyxLQUFLLENBQUMsVUFBVSxLQUFLLGVBQWUsSUFBSSxLQUFLLENBQUMsYUFBYSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQ3pGLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLEtBQUssT0FBTyxJQUFJLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDO0lBQ2xHLE9BQU87UUFDTCxFQUFFLEVBQUUsVUFBVSxFQUFFLFFBQVE7UUFDeEIsVUFBVSxFQUFFLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDL0MsY0FBYyxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDO1FBQy9DLFNBQVMsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUNyQyxNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDbkMsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztRQUNuRCxTQUFTLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDckMsUUFBUSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDO1FBQ25DLE1BQU0sRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztRQUM5QixjQUFjLEVBQUUsS0FBSyxDQUFDLGNBQTZEO1FBQ25GLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztRQUM5RixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDM0IsVUFBVSxFQUFFLGVBQWU7UUFDM0IsYUFBYSxFQUFFLFFBQVE7UUFDdkIsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUEwQztRQUMzRCxNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7S0FDcEMsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsS0FBSyxFQUFFLFFBQWlCLEVBQTBCLEVBQUU7SUFDdkcsTUFBTSxLQUFLLEdBQUcsZ0NBQWdDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekQsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLFdBQVcsQ0FBQyxnQ0FBZ0MsQ0FBQyxZQUFZLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFDaEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQzdGLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLHFDQUFxQyxDQUFDLEtBQUssQ0FBQztZQUN4RSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQzdFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixnR0FBZ0c7QUFDaEcsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FBQyxRQUFpQixFQUE4QixFQUFFLENBQ3BHLGtCQUFrQixDQUFDLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFakU7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxLQUFLLEVBQzNELFFBQWlCLEVBQUUsYUFBc0IsRUFBRSxvQkFBNkIsRUFDTyxFQUFFO0lBQ2pGLE1BQU0sS0FBSyxHQUFHLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyx5QkFBeUIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3hFLElBQUksQ0FBQyxNQUFNLGdDQUFnQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTTtXQUNyRCxDQUFDLE1BQU0seUJBQXlCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNO1FBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEUsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUNSLE1BQU0saUJBQWlCLEdBQUcsU0FBUyxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDMUQsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixjQUFjLENBQUMsU0FBUyxLQUFLLFNBQVM7ZUFDakMsWUFBWSxDQUFDLFNBQVMsRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztlQUNwRSxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU87ZUFDM0IsS0FBSyxDQUFDLFNBQVMsS0FBSyxpQkFBaUI7ZUFDckMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsQ0FBQztlQUNyRCxVQUFVLENBQUMsY0FBYyxLQUFLLEtBQUssQ0FBQyxjQUFjO2VBQ2xELFVBQVUsQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLE1BQU07ZUFDbEMsVUFBVSxDQUFDLGdCQUFnQixLQUFLLEtBQUssQ0FBQyxnQkFBZ0I7ZUFDdEQsVUFBVSxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDakQsQ0FBQyxDQUFDLENBQUM7SUFDSCxPQUFPLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBQy9CLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLENBQzFELFFBQWlCLEVBQ3NCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3BELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUM1RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsZ0NBQWdDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDekgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLGNBQWMsQ0FBRSxnQkFBdUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztXQUN4RSxXQUFrQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNoRSxPQUFPO1FBQ0wsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUEwRDtRQUN4RSxLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQXVDO1FBQ3BELEtBQUssRUFBRSxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDO0tBQ3JDLENBQUM7QUFDSixDQUFDLENBQUMsQ0FBQztBQUVIOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxLQUFLLEVBQzNELFFBQWlCLEVBQUUsaUJBQTBCLEVBQ0csRUFBRTtJQUNsRCxNQUFNLE9BQU8sR0FBRyw0Q0FBNEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2RSxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsNkJBQTZCLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLElBQUksQ0FBQyxNQUFNLGdDQUFnQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU07UUFBRSxJQUFJLEVBQUUsQ0FBQztJQUMzRSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQztXQUNsRSxZQUFZLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsY0FBYyxDQUFDLFVBQVUsQ0FBQztXQUNqRSxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsS0FBSyxjQUFjLENBQUMsU0FBUztXQUNwRCxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxjQUFjLENBQUMsTUFBTTtXQUM5QyxPQUFPLENBQUMsS0FBSyxDQUFDLGdCQUFnQixLQUFLLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDMUUsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxDQUN2RCxRQUFpQixFQUFFLFVBQW1CLEVBQ0UsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDckQsTUFBTSxRQUFRLEdBQUcsNkNBQTZDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekUsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLDRDQUE0QyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzNFLGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQ3JDLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU87WUFDeEMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssV0FBVztZQUMvRCxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxPQUFPLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxXQUFXO21CQUN6RCxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssaUJBQWlCLElBQUksS0FBSyxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWxvY2Fsc3RvcmFnZWNsYWltLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9ydW50aW1lbG9jYWxzdG9yYWdlY2xhaW0udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLHlCQUF5QixFQUFFLHlCQUF5QixFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFFOUYsT0FBTyxFQUFFLDZCQUE2QixFQUFFLE1BQU0scUJBQXFCLENBQUM7QUFDcEUsT0FBTyxFQUFFLGNBQWMsRUFBRSxpQkFBaUIsRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQzdGLGFBQWEsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsZUFBZSxFQUFFLGNBQWMsR0FDcEcsTUFBTSwrQkFBK0IsQ0FBQztBQUN2QyxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUNsRSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUN0RSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQXlKN0UsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM1RCxZQUFZLEVBQUUsd0NBQXdDO0lBQ3RELEtBQUssRUFBRSxnREFBZ0Q7SUFDdkQsVUFBVSxFQUFFLGVBQWU7SUFDM0IsYUFBYSxFQUFFLFFBQVE7SUFDdkIsbUZBQW1GO0lBQ25GLGlCQUFpQixFQUFFLE1BQU07SUFDekIsV0FBVyxFQUFFLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsS0FBSyxDQUFDO0lBQ3ZDLFdBQVcsRUFBRSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDO0lBQ3JDLHFFQUFxRTtJQUNyRSxtQkFBbUIsRUFBRSxHQUFHO0lBQ3hCLDRGQUE0RjtJQUM1RixpQkFBaUIsRUFBRSxJQUFJO0lBQ3ZCLHVEQUF1RDtJQUN2RCxvQkFBb0IsRUFBRSxHQUFHO0lBQ3pCLGtDQUFrQztJQUNsQyxrQkFBa0IsRUFBRSxFQUFFO0NBQ2QsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUN2RixNQUFNLElBQUksR0FBRyxDQUFJLFlBQXFCLEVBQUssRUFBRSxHQUFHLElBQUksQ0FBQztJQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7QUFBQyxDQUFDO0FBQUMsTUFBTSxDQUFDO0lBQUMsT0FBTyxJQUFJLEVBQUUsQ0FBQztBQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFDMUcsTUFBTSxFQUFFLGFBQWEsRUFBRSxHQUFHLDRCQUE0QixDQUFDLElBQUksQ0FBQyxDQUFDO0FBQzdELE1BQU0sV0FBVyxHQUFHLENBQUMsT0FBTyxFQUFFLGlCQUFpQixFQUFFLFFBQVEsRUFBRSxXQUFXLENBQVUsQ0FBQztBQUNqRixNQUFNLGdCQUFnQixHQUFHLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLENBQVUsQ0FBQztBQUV2RSxNQUFNLG9CQUFvQixHQUFHLHdDQUF3QyxDQUFDO0FBQ3RFOzs7R0FHRztBQUNILE1BQU0scUJBQXFCLEdBQUcsZ0JBQWdCLENBQUM7QUFDL0MsMkdBQTJHO0FBQzNHLE1BQU0sMkJBQTJCLEdBQUcsZ0JBQWdCLENBQUM7QUFDckQsbUZBQW1GO0FBQ25GLE1BQU0scUJBQXFCLEdBQUcsVUFBVSxDQUFDO0FBRXpDOzs7OztHQUtHO0FBQ0gsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDN0MsY0FBYyxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQzdDLElBQUksdUJBQXVCLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSTtRQUFFLE9BQU8sUUFBUSxDQUFDO0lBQ2hFLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbkMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxNQUFNLElBQUksZ0NBQWdDLENBQUMsbUJBQW1CLElBQUksTUFBTSxDQUFDLE1BQU0sSUFBSSxDQUFDO1dBQ3ZHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztXQUMvRCxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2xELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sYUFBYSxHQUFHLENBQUMsUUFBZ0IsRUFBVyxFQUFFLENBQ2xELFFBQVEsQ0FBQyxNQUFNLElBQUksZ0NBQWdDLENBQUMsb0JBQW9CO09BQ3JFLHFCQUFxQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLDJCQUEyQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7T0FDbkYsUUFBUSxLQUFLLEdBQUcsSUFBSSxRQUFRLEtBQUssSUFBSSxDQUFDO0FBRTNDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxRQUFnQixFQUFXLEVBQUUsQ0FDdkQsUUFBUSxDQUFDLE1BQU0sSUFBSSxnQ0FBZ0MsQ0FBQyxpQkFBaUI7T0FDbEUsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsYUFBYSxDQUFDLENBQUM7QUFFOUMsMkVBQTJFO0FBQzNFLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzdDLGNBQWMsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sSUFBSSxnQ0FBZ0MsQ0FBQyxpQkFBaUI7V0FDL0csUUFBUSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFFBQVEsS0FBSyxHQUFHLElBQUksa0JBQWtCLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM5RixPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRiwyQ0FBMkM7QUFDM0MsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUU7SUFDOUMsY0FBYyxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLFFBQVEsS0FBSyxHQUFHLElBQUksa0JBQWtCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sT0FBTyxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFO0lBQzVDLGNBQWMsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sSUFBSSxnQ0FBZ0MsQ0FBQyxrQkFBa0I7V0FDaEgsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDdkUsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsQ0FBMEIsUUFBaUIsRUFBRSxVQUErQixFQUFZLEVBQUU7SUFDMUcsY0FBYyxDQUFFLFVBQWlDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDdEUsT0FBTyxRQUFvQixDQUFDO0FBQzlCLENBQUMsQ0FBQztBQUVGLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBOEIsRUFBRTtJQUNqRSxjQUFjLENBQUMsUUFBUSxLQUFLLElBQUksSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLENBQUMsQ0FBQztJQUNsRSxNQUFNLEVBQUUsSUFBSSxFQUFFLEdBQUcsUUFBbUMsQ0FBQztJQUNyRCxJQUFJLElBQUksS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNuQixNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDMUYsT0FBTztZQUNMLElBQUksRUFBRSxLQUFLO1lBQ1gsTUFBTSxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1lBQzlCLE1BQU0sRUFBRSxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztZQUM5QixPQUFPLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7WUFDakMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLGdDQUFnQyxDQUFDLFdBQVcsQ0FBQztTQUNoRixDQUFDO0lBQ0osQ0FBQztJQUNELElBQUksSUFBSSxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQ25CLE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7UUFDdkcsT0FBTztZQUNMLElBQUksRUFBRSxLQUFLO1lBQ1gsTUFBTSxFQUFFLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1lBQzlCLEtBQUssRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQztZQUMzQixPQUFPLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7WUFDakMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLGdDQUFnQyxDQUFDLFdBQVcsQ0FBQztZQUMvRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQztTQUMvQyxDQUFDO0lBQ0osQ0FBQztJQUNELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ2hELGNBQWMsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsQ0FBQyxDQUFDO0lBQzNDLE9BQU8sRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFDL0IsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxRQUFpQixFQUFpQyxFQUFFO0lBQ3ZFLE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDOUQsY0FBYyxDQUFDLHVCQUF1QixDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsSUFBSSx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDO1dBQ2xGLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFLLEtBQUssQ0FBQyxJQUFlLElBQUksQ0FBQztXQUMvRCxDQUFFLEtBQUssQ0FBQyxJQUFlLEdBQUcsQ0FBQyxnQ0FBZ0MsQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzNGLE9BQU8sRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQWEsRUFBRSxHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQWEsRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQWMsRUFBRSxDQUFDO0FBQzVGLENBQUMsQ0FBQztBQUVGLE1BQU0sT0FBTyxHQUFHLENBQUMsUUFBaUIsRUFBNkIsRUFBRTtJQUMvRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDakUsY0FBYyxDQUFDLE9BQU8sS0FBSyxDQUFDLFFBQVEsS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNwRCxPQUFPLEVBQUUsU0FBUyxFQUFFLGFBQWEsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLFdBQVcsQ0FBQyxFQUFFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUM7QUFDOUYsQ0FBQyxDQUFDO0FBRUYsc0VBQXNFO0FBQ3RFLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQUMsUUFBaUIsRUFBNkIsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDMUcsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUUsVUFBVSxFQUFFLFlBQVk7UUFDakcsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFFBQVEsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQUUsVUFBVSxFQUFFLFFBQVE7UUFDOUYsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxlQUFlLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDeEcsTUFBTSxFQUFFLEVBQUUsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLEdBQUcsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzVELGNBQWMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxjQUFjLEtBQUssT0FBTyxJQUFJLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJLENBQUM7V0FDL0UsQ0FBQyxLQUFLLENBQUMsY0FBYyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsZ0JBQWdCLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQztJQUM3RSxjQUFjLENBQUMsS0FBSyxDQUFDLFVBQVUsS0FBSyxlQUFlLElBQUksS0FBSyxDQUFDLGFBQWEsS0FBSyxRQUFRLENBQUMsQ0FBQztJQUN6RixjQUFjLENBQUMsS0FBSyxDQUFDLFNBQVMsS0FBSyxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU8sSUFBSSxRQUFRLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQztJQUNsRyxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLGNBQWMsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxLQUFLLENBQUMsY0FBYyxLQUFLLE9BQU8sQ0FBQyxDQUFDO0lBQzFFLE9BQU87UUFDTCxFQUFFLEVBQUUsVUFBVSxFQUFFLFFBQVE7UUFDeEIsVUFBVSxFQUFFLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUM7UUFDL0MsY0FBYyxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUFDO1FBQy9DLFNBQVMsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQztRQUNyQyxNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7UUFDbkMsZ0JBQWdCLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztRQUNuRCxTQUFTLEVBQUUsU0FBUyxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUM7UUFDckMsUUFBUSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDO1FBQ25DLE1BQU07UUFDTixjQUFjLEVBQUUsS0FBSyxDQUFDLGNBQTZEO1FBQ25GLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQztRQUM5RixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDM0IsVUFBVSxFQUFFLGVBQWU7UUFDM0IsYUFBYSxFQUFFLFFBQVE7UUFDdkIsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUEwQztRQUMzRCxNQUFNLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUM7S0FDcEMsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsS0FBSyxFQUFFLFFBQWlCLEVBQTBCLEVBQUU7SUFDdkcsTUFBTSxLQUFLLEdBQUcsZ0NBQWdDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekQsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLFdBQVcsQ0FBQyxnQ0FBZ0MsQ0FBQyxZQUFZLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sSUFBSSxFQUFFLENBQUM7SUFDaEIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQzdGLElBQUksQ0FBQztRQUNILE1BQU0sS0FBSyxHQUFHLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3pELE9BQU8sS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLHFDQUFxQyxDQUFDLEtBQUssQ0FBQztZQUN4RSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQzdFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixnR0FBZ0c7QUFDaEcsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FBQyxRQUFpQixFQUE4QixFQUFFLENBQ3BHLGtCQUFrQixDQUFDLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFakU7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxLQUFLLEVBQzNELFFBQWlCLEVBQUUsYUFBc0IsRUFBRSxvQkFBNkIsRUFDTyxFQUFFO0lBQ2pGLE1BQU0sS0FBSyxHQUFHLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyx5QkFBeUIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO0lBQ3hFLElBQUksQ0FBQyxNQUFNLGdDQUFnQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsTUFBTTtXQUNyRCxDQUFDLE1BQU0seUJBQXlCLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxNQUFNO1FBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEUsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUNSLE1BQU0saUJBQWlCLEdBQUcsU0FBUyxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDMUQsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN6RixjQUFjLENBQUMsU0FBUyxLQUFLLFNBQVM7ZUFDakMsWUFBWSxDQUFDLFNBQVMsRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztlQUNwRSxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU87ZUFDM0IsS0FBSyxDQUFDLFNBQVMsS0FBSyxpQkFBaUI7ZUFDckMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsQ0FBQztlQUNyRCxVQUFVLENBQUMsY0FBYyxLQUFLLEtBQUssQ0FBQyxjQUFjO2VBQ2xELFVBQVUsQ0FBQyxNQUFNLEtBQUssS0FBSyxDQUFDLE1BQU07ZUFDbEMsVUFBVSxDQUFDLGdCQUFnQixLQUFLLEtBQUssQ0FBQyxnQkFBZ0I7ZUFDdEQsVUFBVSxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDakQsQ0FBQyxDQUFDLENBQUM7SUFDSCxPQUFPLEVBQUUsS0FBSyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBQy9CLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLENBQzFELFFBQWlCLEVBQ3NCLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ3BELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUM1RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsZ0NBQWdDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDekgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxRQUFpQixFQUN1QixFQUFFLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRTtJQUNyRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLGNBQWMsQ0FBRSxnQkFBdUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQztXQUN4RSxXQUFrQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNoRSxPQUFPO1FBQ0wsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUEwRDtRQUN4RSxLQUFLLEVBQUUsS0FBSyxDQUFDLEtBQXVDO1FBQ3BELEtBQUssRUFBRSxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDO0tBQ3JDLENBQUM7QUFDSixDQUFDLENBQUMsQ0FBQztBQUVIOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxLQUFLLEVBQzNELFFBQWlCLEVBQUUsaUJBQTBCLEVBQ0csRUFBRTtJQUNsRCxNQUFNLE9BQU8sR0FBRyw0Q0FBNEMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2RSxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsNkJBQTZCLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO0lBQ3BGLElBQUksQ0FBQyxNQUFNLGdDQUFnQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU07UUFBRSxJQUFJLEVBQUUsQ0FBQztJQUMzRSxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQztXQUNsRSxZQUFZLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsY0FBYyxDQUFDLFVBQVUsQ0FBQztXQUNqRSxPQUFPLENBQUMsS0FBSyxDQUFDLFNBQVMsS0FBSyxjQUFjLENBQUMsU0FBUztXQUNwRCxPQUFPLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxjQUFjLENBQUMsTUFBTTtXQUM5QyxPQUFPLENBQUMsS0FBSyxDQUFDLGdCQUFnQixLQUFLLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUM7SUFDMUUsT0FBTyxPQUFPLENBQUM7QUFDakIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxDQUN2RCxRQUFpQixFQUFFLFVBQW1CLEVBQ0UsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDckQsTUFBTSxRQUFRLEdBQUcsNkNBQTZDLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDekUsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLDRDQUE0QyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzNFLGNBQWMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxvQ0FBb0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQ3JDLGNBQWMsQ0FBQyxLQUFLLENBQUMsU0FBUyxLQUFLLE9BQU87WUFDeEMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssV0FBVztZQUMvRCxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxPQUFPLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxXQUFXO21CQUN6RCxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssaUJBQWlCLElBQUksS0FBSyxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMsQ0FBQyJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.23.0",
+  "version": "32.24.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -1984,25 +1984,64 @@ native fence.
 
 ### Runtime local storage claims
 
-`data.IRuntimeLocalStorageClaim` is a controller's authority for one retained, node-local volume of
-one service. Cloudly and Onebox issue it alike (`controller.kind` is `cloudly` or `onebox`). It names
-the claim revision (`id`, `generation`, `previous`), the organization, cluster, node, runtime
-namespace, service and the service's own `volumeId`, and it states:
-
-- `source`: `{ kind: 'directory' }`, a node-local directory the node derives from the claim's
-  identity under a root only the node knows. Network filesystems join this union later as further
-  kinds, with their credentials delivered as secrets and never inside a claim;
+`data.IRuntimeLocalStorageClaim` is a controller's authority for one retained volume of one service,
+mounted on one node. Cloudly and Onebox issue it alike (`controller.kind` is `cloudly` or `onebox`).
+It names the claim revision (`id`, `generation`, `previous`), the organization, cluster, node,
+runtime namespace, service and the service's own `volumeId`, and it states:
+
+- `source` (`TRuntimeLocalStorageSource`), one of:
+  - `{ kind: 'directory' }` (`TRuntimeLocalStorageDirectorySource`), a node-local directory the node
+    derives from the claim's identity under a root only the node knows;
+  - `{ kind: 'nfs', server, export, subPath, version }` (`TRuntimeLocalStorageNfsSource`), the
+    directory `subPath` below the NFS export `server:export`;
+  - `{ kind: 'smb', server, share, subPath, version, credential }` (`TRuntimeLocalStorageSmbSource`),
+    the directory `subPath` below the SMB share `//server/share`. `credential` is an
+    `IRuntimeAuthorityReference { id, generation, digest }` naming the credential the node
+    authenticates with; the claim never carries a user name, password or domain, and the node
+    resolves the material through the controller's secret delivery. NFS authenticates the node's
+    host, so an `nfs` source names no credential;
 - `initialization`: `empty` creates an empty root with `initialOwnership { uid, gid, mode }`, which
   an `empty` claim must state, so a workload without `runAs` never meets a root-owned directory by
   accident; `import` waits for the volume's bytes to be imported and states `initialOwnership: null`,
   because an imported tree keeps its own ownership. `mode` holds directory permission bits only
-  (`runtimeLocalStorageClaimContract.directoryModeBits`, `0o3777`; setuid is refused);
+  (`runtimeLocalStorageClaimContract.directoryModeBits`, `0o3777`; setuid is refused). SMB carries no
+  POSIX ownership, so the node presents an SMB volume with `initialOwnership`, and an `smb` claim is
+  always `empty`;
 - `mount { mountPath, readOnly }`, judged by the storage request's own mount path rule: canonical,
   absolute, not `/`, and never overlapping `/run/secrets`;
 - `accessMode: 'ReadWriteOnce'`, `reclaimPolicy: 'retain'`, and `lifecycle`: `bound` keeps the
   volume, `purge` orders its bytes deleted and always follows a bound generation of the same claim.
 
-The claim carries no host path, device, mount option or credential.
+A network source names the remote directory and nothing about how to mount it, so the node derives
+every mount parameter from these fields alone and a claim cannot smuggle an option in:
+
+| Field | Rule |
+| --- | --- |
+| `server` | a lowercase fully qualified hostname of two or more labels whose last label is not numeric (a single label would resolve through each node's own search domains), or a canonical IP literal (a dotted quad without leading zeros, or RFC 5952 IPv6 without brackets or zone). No scheme, user info or port: the node connects to the protocol's standard port |
+| `export` | `/`, or `/` and canonical segments without a trailing slash |
+| `subPath` | `.` for the export or share itself, or canonical relative segments |
+| `share` | one segment of at most 80 characters, without `+`, `;`, `[` or `]` |
+| `version` | `nfs`: `3`, `4.0`, `4.1` or `4.2`; `smb`: `3.0`, `3.02` or `3.1.1` |
+
+A segment is printable ASCII without a space, at most 255 characters, never `.` or `..`, and holds
+none of `"`, `*`, `,`, `/`, `:`, `<`, `=`, `>`, `?`, `\` or `|`: a comma or `=` would read as a mount
+option, and the rest have meaning in a mount source or an SMB name. `export` and `subPath` are at
+most 1024 characters. ASCII keeps one spelling per segment, but one remote directory can still be
+named several ways: a hostname and an address of the same server, a different `export`/`subPath`
+split, or a nested `subPath`. The contract cannot detect these aliases, so the controller must refuse
+overlapping bound claims itself. The versions are the kernel's own `vers=` spellings, and each pins one protocol version: a
+bare NFS `4` or SMB `3` negotiates one, which a claim that must mean the same mount on every node
+cannot allow. NFS version 2 and the SMB 1 and 2 dialects are refused; SMB 3 is the first dialect
+that encrypts. The bounds and version lists
+are `runtimeLocalStorageClaimContract.nfsVersions`, `smbVersions`, `maximumServerLength`,
+`maximumPathLength`, `maximumSegmentLength` and `maximumShareLength`.
+
+`ReadWriteOnce` holds on the node that mounts the claim. A network directory is reachable from more
+than one node, so the controller issues at most one bound claim per remote directory; a node cannot
+see another node's mounts. A `purge` of a network claim deletes everything below `subPath`, the
+whole export or share for `.`.
+
+The claim carries no host path, device, mount option or credential value.
 `snapshotRuntimeLocalStorageClaim` makes a detached exact-schema snapshot,
 `computeRuntimeLocalStorageClaimDigest` hashes it under `serve.zone/runtime-local-storage-claim`,
 `validateRuntimeLocalStorageClaim` verifies the stated digest, and
@@ -3394,9 +3433,13 @@ Coreflow, all exported from `data` and `platform`:
    `{ state: 'authorized', bindingId }`. The blocker names what would stop the offline adoption,
    `null` when nothing would: `not-adoptable` (an allocation-managed database, another provider, a
    resource name that is not its database or bucket name, or a bucket name that is not a canonical S3
-   name), `ordinary-credentials-rotated` or `owned-by-binding`. An adoptable bucket must have a
-   canonical S3 name, because a binding request carries only such a name. A consumed adoption removes
-   the legacy entry, so it never appears.
+   name), `ordinary-credentials-rotated`, `owned-by-binding` or `fence-lineage-conflict` (the
+   bucket's object-storage fence lineage cannot move to the adopting binding: the bucket has more than
+   one lineage, or its lineage does not validate, belongs to another authority or has an unfinished
+   mutation).
+   Only a bucket has a fence lineage, so a database never names `fence-lineage-conflict`. An
+   adoptable bucket must have a canonical S3 name, because a binding request carries only such a
+   name. A consumed adoption removes the legacy entry, so it never appears.
 2. **Relay.** `getClusterCorestoreLegacyResources { nodeId }` asks the relay for one node's
    inventory, answered as `TClusterCorestoreLegacyResourceInventory`: `reachable: true` with the
    services, or `reachable: false` with `errorCode` `CORESTORE_ENDPOINT_UNKNOWN` or

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.23.0',
+  version: '32.24.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/corestorelegacyadoption.ts

@@ -42,12 +42,17 @@ export type TCorestoreLegacyCapability = 'database' | 'objectstorage';
  * - `ordinary-credentials-rotated`: its credentials were rotated, so the delivered ones are no
  *   longer the generation a binding adopts;
  * - `owned-by-binding`: a credential binding or a named storage binding already owns the service
- *   capability, the resource or the bucket.
+ *   capability, the resource or the bucket;
+ * - `fence-lineage-conflict`: the bucket's object-storage fence lineage cannot move to the adopting
+ *   binding, because the bucket has more than one lineage, or its lineage does not validate,
+ *   belongs to another authority or has an unfinished mutation. Only a bucket has a fence lineage,
+ *   so a database never names it.
  */
 export type TCorestoreLegacyResourceBlocker =
   | 'not-adoptable'
   | 'ordinary-credentials-rotated'
-  | 'owned-by-binding';
+  | 'owned-by-binding'
+  | 'fence-lineage-conflict';
 
 /**
  * `unadopted` names what would stop the offline adoption, or `null` when nothing would;
@@ -155,7 +160,7 @@ const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
 const printableNamePattern = /^[\x21-\x7e]+$/;
 const bareSha256Pattern = /^[a-f0-9]{64}$/;
 const blockers: readonly TCorestoreLegacyResourceBlocker[] = [
-  'not-adoptable', 'ordinary-credentials-rotated', 'owned-by-binding',
+  'not-adoptable', 'ordinary-credentials-rotated', 'owned-by-binding', 'fence-lineage-conflict',
 ];
 
 const isIdentifier = (valueArg: unknown): valueArg is string => (
@@ -172,13 +177,18 @@ const isCapability = (valueArg: unknown): valueArg is TCorestoreLegacyCapability
   valueArg === 'database' || valueArg === 'objectstorage'
 );
 
-const validateAdoption = (valueArg: unknown, pathArg: string): string[] => {
+const validateAdoption = (
+  valueArg: unknown, capabilityArg: TCorestoreLegacyCapability, pathArg: string,
+): string[] => {
   if (!isPlainRecord(valueArg)) return [`${pathArg} must use its exact schema`];
   if (valueArg.state === 'unadopted') {
     if (!hasExactKeys(valueArg, ['state', 'blocker'])) return [`${pathArg} must use its exact schema`];
-    return valueArg.blocker === null || (blockers as readonly unknown[]).includes(valueArg.blocker)
-      ? []
-      : [`${pathArg} blocker must be null or a named blocker`];
+    if (valueArg.blocker !== null && !(blockers as readonly unknown[]).includes(valueArg.blocker)) {
+      return [`${pathArg} blocker must be null or a named blocker`];
+    }
+    return valueArg.blocker === 'fence-lineage-conflict' && capabilityArg !== 'objectstorage'
+      ? [`${pathArg} blocker fence-lineage-conflict must name a bucket`]
+      : [];
   }
   if (valueArg.state === 'authorized') {
     if (!hasExactKeys(valueArg, ['state', 'bindingId'])) return [`${pathArg} must use its exact schema`];
@@ -198,7 +208,7 @@ const validateResource = (valueArg: unknown, pathArg: string): string[] => {
     if (!hasExactKeys(valueArg, ['capability', 'databaseName', 'adoption'])) {
       return [`${pathArg} must use its exact schema`];
     }
-    const errors = validateAdoption(valueArg.adoption, `${pathArg} adoption`);
+    const errors = validateAdoption(valueArg.adoption, 'database', `${pathArg} adoption`);
     if (!isLegacyName(valueArg.databaseName)) errors.push(`${pathArg} databaseName must be a bounded printable name`);
     return errors;
   }
@@ -206,7 +216,7 @@ const validateResource = (valueArg: unknown, pathArg: string): string[] => {
     if (!hasExactKeys(valueArg, ['capability', 'bucketName', 'retention', 'adoption'])) {
       return [`${pathArg} must use its exact schema`];
     }
-    const errors = validateAdoption(valueArg.adoption, `${pathArg} adoption`);
+    const errors = validateAdoption(valueArg.adoption, 'objectstorage', `${pathArg} adoption`);
     if (!isLegacyName(valueArg.bucketName)) {
       errors.push(`${pathArg} bucketName must be a bounded printable name`);
     } else if (errors.length === 0 && isAdoptable(valueArg.adoption)) {

package/ts/data/runtimelocalstorageclaim.ts

@@ -6,17 +6,77 @@ import { snapshotRuntimeSessionBinding } from './runtimesession.js';
 import { captureNetwork, networkController, networkDigest, networkEqual, networkHash, networkId,
   networkNodeId, networkRecord, networkReference, networkReferenceOf, networkRevision, requireNetwork,
 } from '../private/networkcontract.js';
+import { parseCanonicalIpAddress } from '../private/ipaddress.js';
 import { isRuntimeIdentityNumber } from '../private/runtimepolicy.js';
 import { createStorageContractReaders } from '../private/storagecontract.js';
 
+/** A node-local directory the node derives from the claim's identity under a root only the node knows. */
+export type TRuntimeLocalStorageDirectorySource = {
+  kind: 'directory';
+};
+
+/**
+ * A directory on an NFS export. The node mounts `server:export` and uses `subPath` below it.
+ *
+ * `server` is a lowercase fully qualified hostname or a canonical IP literal, on the standard port.
+ * `export` is the canonical absolute path the server exports, `/` included. `subPath` is the
+ * volume's directory below the export, as canonical relative segments, or `.` for the export
+ * itself. `version` pins one protocol version. NFS authenticates the node's host, not a user, so
+ * the source names no credential.
+ */
+export type TRuntimeLocalStorageNfsSource = {
+  kind: 'nfs';
+  server: string;
+  export: string;
+  subPath: string;
+  version: TRuntimeLocalStorageNfsVersion;
+};
+
 /**
- * Where a local storage claim's bytes live, named by kind and never by path.
+ * A directory on an SMB share. The node mounts `//server/share` and uses `subPath` below it.
  *
- * `directory` is a node-local directory the node derives from the claim's identity under a root
- * only the node knows. Network filesystems join this union as further kinds; their credentials
- * travel as secrets and never inside a claim.
+ * `server` and `subPath` follow the NFS rules; `share` is one share name. `version` pins one
+ * dialect. `credential` names the credential authority the node authenticates with, by reference
+ * only: the claim never carries a user name, password or domain, and the node resolves the material
+ * through the controller's secret delivery.
  */
-export type TRuntimeLocalStorageSource = { kind: 'directory' };
+export type TRuntimeLocalStorageSmbSource = {
+  kind: 'smb';
+  server: string;
+  share: string;
+  subPath: string;
+  version: TRuntimeLocalStorageSmbVersion;
+  credential: IRuntimeAuthorityReference;
+};
+
+/**
+ * Where a local storage claim's bytes live, named by kind and never by a node's host path.
+ *
+ * A network source names the remote location and nothing about how to mount it: no mount option,
+ * no port and no credential value. The node derives every mount parameter from these fields alone.
+ * The kinds are type aliases, as `{ kind: 'directory' }` always was, so a source stays assignable
+ * to a plain record.
+ */
+export type TRuntimeLocalStorageSource =
+  | TRuntimeLocalStorageDirectorySource
+  | TRuntimeLocalStorageNfsSource
+  | TRuntimeLocalStorageSmbSource;
+
+/**
+ * The NFS protocol versions a claim may pin, spelled as the kernel's NFS `vers=` parameter spells
+ * them. NFS version 4 is always stated with its minor version: the bare `4` negotiates one, which
+ * the kernel keeps only for backward compatibility, and a claim must mean the same mount on every
+ * node. Version 2 is refused.
+ */
+export type TRuntimeLocalStorageNfsVersion = (typeof runtimeLocalStorageClaimContract.nfsVersions)[number];
+
+/**
+ * The SMB dialects a claim may pin, spelled as the kernel's CIFS `vers=` parameter spells them.
+ * Only SMB 3 dialects, the first that encrypt; the kernel refuses 1.0 and 2.0 unless built with
+ * insecure legacy dialects. `3` alone negotiates one and is refused for the same reason as a bare
+ * NFS `4`.
+ */
+export type TRuntimeLocalStorageSmbVersion = (typeof runtimeLocalStorageClaimContract.smbVersions)[number];
 
 /** The owner and permission bits a node gives an `empty` volume's root directory when it creates it. */
 export interface IRuntimeLocalStorageOwnership {
@@ -39,15 +99,19 @@ export interface IRuntimeLocalStorageMount {
 export type TRuntimeLocalStorageLifecycle = 'bound' | 'purge';
 
 /**
- * A controller's authority for one retained, node-local volume of one service.
+ * A controller's authority for one retained volume of one service, mounted on one node.
  *
- * Cloudly and Onebox issue it alike. It names the volume by identity only: no host path, no
- * device, no mount option and no credential. The node resolves the identity to its own storage.
+ * Cloudly and Onebox issue it alike. It never names a host path, a device, a mount option or a
+ * credential value. A `directory` source names the volume by identity only, and the node resolves
+ * it to its own storage; a network source names the remote directory and, for SMB, the credential
+ * by reference.
  *
  * `initialization` says what the node does when the volume does not exist yet. `empty` creates an
  * empty root with `initialOwnership`, which it must state, so a workload that runs as the image's
  * own user never meets a root-owned directory by accident. `import` waits for the volume's bytes to
- * be imported and states no ownership: an imported tree keeps the ownership it carries.
+ * be imported and states no ownership: an imported tree keeps the ownership it carries. SMB carries
+ * no POSIX ownership, so the node presents an SMB volume with `initialOwnership`, and an `smb`
+ * source is always `empty`.
  */
 export interface IRuntimeLocalStorageClaim {
   id: string;
@@ -104,6 +168,16 @@ export const runtimeLocalStorageClaimContract = Object.freeze({
   reclaimPolicy: 'retain',
   /** Every permission bit a claim may state: setgid, sticky and the rwx triplets. */
   directoryModeBits: 0o3777,
+  nfsVersions: ['3', '4.0', '4.1', '4.2'],
+  smbVersions: ['3.0', '3.02', '3.1.1'],
+  /** The longest hostname a network source may name, in characters. */
+  maximumServerLength: 253,
+  /** The longest `export` or `subPath`, in characters; every character is printable ASCII. */
+  maximumPathLength: 1024,
+  /** The longest segment of an `export` or `subPath`. */
+  maximumSegmentLength: 255,
+  /** The longest SMB share name. */
+  maximumShareLength: 80,
 } as const);
 
 const fail = (): never => { throw new Error(runtimeLocalStorageClaimContract.error); };
@@ -112,7 +186,90 @@ const { readMountPath } = createStorageContractReaders(fail);
 const claimStates = ['ready', 'import-required', 'purged', 'uncertain'] as const;
 const responseStatuses = ['accepted', 'replay', 'historical'] as const;
 
+const hostnameLabelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+/**
+ * Printable ASCII without a space. One spelling per name, so two claims cannot name one directory
+ * two ways, and nothing a mount source or an option string reads as a separator.
+ */
+const printableAsciiPattern = /^[\x21-\x7e]+$/;
+/** A comma or `=` would read as a mount option; the rest have meaning in a mount source or an SMB name. */
+const pathSegmentForbiddenPattern = /["*,/:<=>?\\|]/;
+/** SMB refuses these in a share name, beyond what it refuses in a path segment. */
+const shareForbiddenPattern = /[+;\[\]]/;
+
+/**
+ * A lowercase fully qualified hostname of two or more labels whose last label is not numeric, or a
+ * canonical IP literal. One label would resolve through each node's own search domains; a numeric
+ * last label would let a non-canonical address pass as a hostname. There is no port and no
+ * userinfo: the node connects to the protocol's standard port.
+ */
+const serverOf = (valueArg: unknown): string => {
+  requireNetwork(typeof valueArg === 'string');
+  if (parseCanonicalIpAddress(valueArg) !== null) return valueArg;
+  const labels = valueArg.split('.');
+  requireNetwork(valueArg.length <= runtimeLocalStorageClaimContract.maximumServerLength && labels.length >= 2
+    && labels.every((labelArg) => hostnameLabelPattern.test(labelArg))
+    && !/^[0-9]+$/.test(labels[labels.length - 1]));
+  return valueArg;
+};
+
+const isPathSegment = (valueArg: string): boolean =>
+  valueArg.length <= runtimeLocalStorageClaimContract.maximumSegmentLength
+  && printableAsciiPattern.test(valueArg) && !pathSegmentForbiddenPattern.test(valueArg)
+  && valueArg !== '.' && valueArg !== '..';
+
+const isRelativeSegments = (valueArg: string): boolean =>
+  valueArg.length <= runtimeLocalStorageClaimContract.maximumPathLength
+  && valueArg.split('/').every(isPathSegment);
+
+/** `/`, or `/` followed by canonical segments without a trailing slash. */
+const exportOf = (valueArg: unknown): string => {
+  requireNetwork(typeof valueArg === 'string' && valueArg.length <= runtimeLocalStorageClaimContract.maximumPathLength
+    && valueArg.startsWith('/') && (valueArg === '/' || isRelativeSegments(valueArg.slice(1))));
+  return valueArg;
+};
+
+/** `.`, or canonical relative segments. */
+const subPathOf = (valueArg: unknown): string => {
+  requireNetwork(typeof valueArg === 'string' && (valueArg === '.' || isRelativeSegments(valueArg)));
+  return valueArg;
+};
+
+const shareOf = (valueArg: unknown): string => {
+  requireNetwork(typeof valueArg === 'string' && valueArg.length <= runtimeLocalStorageClaimContract.maximumShareLength
+    && isPathSegment(valueArg) && !shareForbiddenPattern.test(valueArg));
+  return valueArg;
+};
+
+const literalOf = <TLiteral extends string>(valueArg: unknown, allowedArg: readonly TLiteral[]): TLiteral => {
+  requireNetwork((allowedArg as readonly unknown[]).includes(valueArg));
+  return valueArg as TLiteral;
+};
+
 const sourceOf = (valueArg: unknown): TRuntimeLocalStorageSource => {
+  requireNetwork(valueArg !== null && typeof valueArg === 'object');
+  const { kind } = valueArg as Record<string, unknown>;
+  if (kind === 'nfs') {
+    const value = networkRecord(valueArg, ['kind', 'server', 'export', 'subPath', 'version']);
+    return {
+      kind: 'nfs',
+      server: serverOf(value.server),
+      export: exportOf(value.export),
+      subPath: subPathOf(value.subPath),
+      version: literalOf(value.version, runtimeLocalStorageClaimContract.nfsVersions),
+    };
+  }
+  if (kind === 'smb') {
+    const value = networkRecord(valueArg, ['kind', 'server', 'share', 'subPath', 'version', 'credential']);
+    return {
+      kind: 'smb',
+      server: serverOf(value.server),
+      share: shareOf(value.share),
+      subPath: subPathOf(value.subPath),
+      version: literalOf(value.version, runtimeLocalStorageClaimContract.smbVersions),
+      credential: networkReference(value.credential),
+    };
+  }
   const value = networkRecord(valueArg, ['kind']);
   requireNetwork(value.kind === 'directory');
   return { kind: 'directory' };
@@ -142,6 +299,8 @@ export const snapshotRuntimeLocalStorageClaim = (valueArg: unknown): IRuntimeLoc
     || (value.initialization === 'import' && value.initialOwnership === null));
   requireNetwork(value.accessMode === 'ReadWriteOnce' && value.reclaimPolicy === 'retain');
   requireNetwork(value.lifecycle === 'bound' || (value.lifecycle === 'purge' && previous !== null));
+  const source = sourceOf(value.source);
+  requireNetwork(source.kind !== 'smb' || value.initialization === 'empty');
   return {
     id, generation, previous,
     controller: networkController(value.controller),
@@ -151,7 +310,7 @@ export const snapshotRuntimeLocalStorageClaim = (valueArg: unknown): IRuntimeLoc
     runtimeNamespace: networkId(value.runtimeNamespace),
     serviceId: networkId(value.serviceId),
     volumeId: networkId(value.volumeId),
-    source: sourceOf(value.source),
+    source,
     initialization: value.initialization as IRuntimeLocalStorageClaim['initialization'],
     initialOwnership: value.initialOwnership === null ? null : ownershipOf(value.initialOwnership),
     mount: mountOf(value.mount),