@serve.zone/interfaces 32.3.0 → 32.4.0

package/changelog.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## 2026-09-19 - 32.4.0
+
+### Features
+
+- This minor removes rather than deprecates `data.IRuntimeNetworkAddressPlan.vpn.relay`,
+  `data.runtimeNetworkAddressPlanContract.relayProtocol` and
+  `data.IGetRuntimeManagedVpnCredentialResponse.relay`, which stays a minor of the one common
+  major 32 because no shipped store holds an address-plan row and a peer that still speaks the old
+  shapes is fenced by the session handshake, each server raising its own `minimumPeerVersion` for
+  `clusterRelay` and `palletRuntime` in its own commit.
+- The managed VPN moves from one platform-wide endpoint to a hub per cluster, carried by that
+  cluster's own relay. `data.IRuntimeNetworkAddressPlan.vpn` is now
+  `{ controlPrefix, hubPrefix }`: `hubPrefix` is the protected prefix every cluster hub binds
+  inside, and the endpoints are no longer administrator input. `runtimeNetworkAddressPlanContract`
+  replaces `relayProtocol` with `hubTransports`, the one table that states each transport's endpoint
+  id suffix and protocol, and `data.runtimeNetworkVpnHubEndpoints(hub)` is the one derivation of
+  what one `data.IRuntimeNetworkVpnHub { clusterId, address, quicPort, websocketPort }` contributes:
+  `<clusterId>:quic` on `udp` and `<clusterId>:ws` on `tcp`.
+  `composeRuntimeNetworkProtectedAuthority(plan, frame, hubs)` takes those hubs as its third
+  argument and requires each address inside `vpn.hubPrefix`, with one hub per cluster; 32 clusters
+  fit one authority's 64 platform endpoints. `plan-vpn-immutable` now guards both prefixes.
+- `data.IGetRuntimeManagedVpnCredentialResponse` names the cluster hub it sends a node to: `relay`
+  becomes `hub`, `transport` widens to `'quic' | 'websocket'`, and the new optional `serverName` is
+  present exactly when the transport is `websocket` — the TLS name that hub is dialled under, which
+  the node cross-checks against the relay origin it stores. The binder requires the selected
+  endpoint to carry the protocol of the credential's transport, so a relay still cannot name itself.
+- `data.IRegisterClusterRelayRequest.relay.vpnHub` is the optional
+  `data.IClusterRelayVpnHub { publicKey, address, quicPort, websocketPort }` a relay reports from its
+  own bind, validated by `data.validateClusterRelayVpnHub`. A relay that serves no hub registers
+  exactly as before, and Cloudly states `relay-vpn-hub-absent` for that cluster.
+- Add `data.IClusterVpnNetwork { authorityId, revision, nodes, grants }`, the complete managed VPN of
+  one cluster, with `snapshotClusterVpnNetwork`, `admitClusterVpnNetwork(held | null, next)`,
+  `clusterVpnControlPolicyDomain`, `clusterVpnWorkloadPolicyDomain` and `clusterVpnNetworkContract`.
+  Every grant must join two workload domains the network itself carries, on two different nodes, so a
+  cross-cluster grant cannot be expressed; Cloudly refuses it by name while it compiles.
+- Add the two carriers on the relay's own session: `requests.cluster.applyClusterVpnNetwork`
+  (`{ network }` → `{ appliedRevision, state }`, with `bindApplyClusterVpnNetworkResponse`) and
+  `requests.cluster.getClusterVpnNetwork` (no request body → `{ network }` or `{ network: null }`),
+  plus the refusal vocabularies `data.applyClusterVpnNetworkRefusals` and
+  `data.clusterVpnNetworkSelectionRefusals`.
+- `data.IRuntimeAssignment.workload.pullEndpoint` is the optional `host[:port]` a node fetches the
+  image from instead of the publishing `registryHost`, and
+  `data.buildRuntimeAssignmentImageReference(workload)` is the one place that choice is made. The
+  reference stays digest-pinned, so the endpoint decides reachability and never content, and
+  `registryHost` keeps its publication identity.
+
 ## 2026-09-18 - 32.3.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.3.0',
+    version: '32.4.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/cluster.d.ts

@@ -48,6 +48,24 @@ export interface ICluster {
 export interface IClusterRelay {
     origin: string;
 }
+/**
+ * The managed VPN hub a cluster relay bound for its own cluster.
+ *
+ * The relay is its cluster's packet relay: every node of the cluster dials this hub and no
+ * inter-node packet leaves the cluster. It reports what it bound, exactly like `listenAddress` and
+ * `listenPort`, and Cloudly composes the platform endpoints from it — a relay names no endpoint id
+ * and no TLS name of its own. `publicKey` is the hub's Noise public key in the one canonical
+ * 32-byte base64 encoding every Noise key of this contract is read with; it is public material and
+ * authenticates nothing by itself. A hub that bound only one transport reports the other port as
+ * `null`.
+ */
+export interface IClusterRelayVpnHub {
+    publicKey: string;
+    /** The address the hub bound, as an IPv4 literal inside the address plan's `vpn.hubPrefix`. */
+    address: string;
+    quicPort: number | null;
+    websocketPort: number | null;
+}
 /**
  * What a cluster relay tells Cloudly about itself once its socket is authenticated.
  *
@@ -74,6 +92,11 @@ export interface IRegisterClusterRelayRequest {
          */
         listenAddress: string;
         listenPort: number;
+        /**
+         * Absent on a relay that serves no managed VPN hub, which registers exactly as it did before.
+         * Cloudly selects no hub for such a cluster and states `relay-vpn-hub-absent` instead.
+         */
+        vpnHub?: IClusterRelayVpnHub;
     };
     /** Monotonic within one relay process; it restarts at 0 when the process restarts. */
     registrationSequence: number;
@@ -118,6 +141,13 @@ export type TClusterRelayUndispatchedRefusal = typeof clusterRelayUndispatchedRe
  * registers over.
  */
 export declare const validateClusterRelay: (valueArg: unknown, pathArg?: string) => string[];
+/**
+ * Validates one hub advertisement and names every reason it is refused.
+ *
+ * Shape only: whether the address sits inside the address plan's `vpn.hubPrefix` is Cloudly's to
+ * decide against the plan it stores, and the endpoints themselves are composed there.
+ */
+export declare const validateClusterRelayVpnHub: (valueArg: unknown, pathArg?: string) => string[];
 /**
  * Validates one cluster relay registration and names every reason it is refused.
  *

package/dist_ts/data/cluster.js

@@ -3,6 +3,7 @@ import {} from '../data/docker.js';
 import { isPlausibleUnicastIpv4 } from '../private/ipv4.js';
 import { validateProtocolOfferOn } from '../protocol.js';
 import { hasExactKeys } from '../private/dataproperties.js';
+import { networkNoiseKey } from '../private/networkcontract.js';
 /**
  * The registration refusals that end a relay's custody of its cluster.
  *
@@ -96,9 +97,49 @@ const validateClusterRelayListenPort = (valueArg, pathArg) => (typeof valueArg =
 const validateClusterRelayNonNegativeInteger = (valueArg, pathArg) => (typeof valueArg === 'number' && Number.isSafeInteger(valueArg) && valueArg >= 0
     ? []
     : [`${pathArg} must be a non-negative safe integer`]);
+/**
+ * The one canonical 32-byte base64 reading every Noise key of this contract passes, stated as a
+ * refusal this validator's callers can collect: a hub key is the same key material the managed VPN
+ * credential carries, so it is never read by a second rule that could drift from it.
+ */
+const validateClusterRelayVpnKey = (valueArg, pathArg) => {
+    try {
+        networkNoiseKey(valueArg);
+        return [];
+    }
+    catch {
+        return [`${pathArg} must be a canonical 32-byte base64 public key`];
+    }
+};
+/** A port the hub bound, or `null` for a transport it did not bind. */
+const validateClusterRelayHubPort = (valueArg, pathArg) => (valueArg === null || validateClusterRelayListenPort(valueArg, pathArg).length === 0
+    ? []
+    : [`${pathArg} must be null or an integer from 1 to 65535`]);
+/**
+ * Validates one hub advertisement and names every reason it is refused.
+ *
+ * Shape only: whether the address sits inside the address plan's `vpn.hubPrefix` is Cloudly's to
+ * decide against the plan it stores, and the endpoints themselves are composed there.
+ */
+export const validateClusterRelayVpnHub = (valueArg, pathArg = 'cluster relay vpn hub') => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['publicKey', 'address', 'quicPort', 'websocketPort'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [
+        ...validateClusterRelayVpnKey(valueArg.publicKey, `${pathArg} publicKey`),
+        ...validateClusterRelayListenAddress(valueArg.address, `${pathArg} address`),
+        ...validateClusterRelayHubPort(valueArg.quicPort, `${pathArg} quicPort`),
+        ...validateClusterRelayHubPort(valueArg.websocketPort, `${pathArg} websocketPort`),
+    ];
+    if (valueArg.quicPort === null && valueArg.websocketPort === null) {
+        errors.push(`${pathArg} must bind at least one of quicPort and websocketPort`);
+    }
+    return errors;
+};
 const validateClusterRelayEndpoint = (valueArg, pathArg) => {
     if (!isRecord(valueArg)
-        || !hasExactKeys(valueArg, ['version', 'nodeId', 'listenAddress', 'listenPort'])) {
+        || !hasExactKeys(valueArg, ['version', 'nodeId', 'listenAddress', 'listenPort'], ['vpnHub'])) {
         return [`${pathArg} must use its exact schema`];
     }
     return [
@@ -106,6 +147,9 @@ const validateClusterRelayEndpoint = (valueArg, pathArg) => {
         ...validateClusterRelayIdentifier(valueArg.nodeId, `${pathArg} nodeId`),
         ...validateClusterRelayListenAddress(valueArg.listenAddress, `${pathArg} listenAddress`),
         ...validateClusterRelayListenPort(valueArg.listenPort, `${pathArg} listenPort`),
+        ...(Object.keys(valueArg).includes('vpnHub')
+            ? validateClusterRelayVpnHub(valueArg.vpnHub, `${pathArg} vpnHub`)
+            : []),
     ];
 };
 /**
@@ -170,4 +214,4 @@ export const clusterRelayCertificateDomainName = (relayArg) => {
     }
     return new URL(relayArg.origin).hostname;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3Rlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvY2x1c3Rlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEVBQTRCLE1BQU0sbUJBQW1CLENBQUM7QUFFN0QsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDNUQsT0FBTyxFQUFFLHVCQUF1QixFQUF1QixNQUFNLGdCQUFnQixDQUFDO0FBQzlFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQThHNUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzVELCtFQUErRTtJQUMvRSwyQkFBMkI7SUFDM0IsMkZBQTJGO0lBQzNGLG9CQUFvQjtJQUNwQixrR0FBa0c7SUFDbEcsOEJBQThCO0NBQ3RCLENBQUMsQ0FBQztBQUtaLE1BQU0sK0JBQStCLEdBQUcsSUFBSSxDQUFDO0FBQzdDLE1BQU0sZ0NBQWdDLEdBQUcsRUFBRSxDQUFDO0FBRTVDLE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUFDLENBQzNFLE9BQU8sQ0FBQyxRQUFRLENBQUM7T0FDZCxPQUFPLFFBQVEsS0FBSyxRQUFRO09BQzVCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7T0FDeEIsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTO1dBQ25ELE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDLENBQy9DLENBQUM7QUFFRixNQUFNLDBCQUEwQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUNsRixJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDM0IsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3JCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsK0JBQStCLEVBQUUsQ0FBQztRQUN2RCxPQUFPLENBQUMsR0FBRyxPQUFPLDZCQUE2QiwrQkFBK0IsYUFBYSxDQUFDLENBQUM7SUFDL0YsQ0FBQztJQUNELElBQUksWUFBaUIsQ0FBQztJQUN0QixJQUFJLENBQUM7UUFDSCxZQUFZLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbkMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyxHQUFHLE9BQU8seUJBQXlCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksWUFBWSxDQUFDLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLFlBQVksQ0FBQyxRQUFRLElBQUksWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDBCQUEwQixDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUNELElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUNyQyxNQUFNLENBQUMsSUFBSSxDQUNULEdBQUcsT0FBTyxpQ0FBaUMsWUFBWSxDQUFDLE1BQU0sSUFBSTtjQUM5RCxpRUFBaUUsQ0FDdEUsQ0FBQztJQUNKLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUNsQyxRQUFpQixFQUNqQixPQUFPLEdBQUcsZUFBZSxFQUNmLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMvRCxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE9BQU8sMEJBQTBCLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxHQUFHLE9BQU8sU0FBUyxDQUFDLENBQUM7QUFDMUUsQ0FBQyxDQUFDO0FBRUYsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUUsQ0FBQyxDQUNwRixPQUFPLFFBQVEsS0FBSyxRQUFRO09BQ3ZCLFFBQVEsQ0FBQyxNQUFNLElBQUksZ0NBQWdDO09BQ25ELCtCQUErQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7SUFDakQsQ0FBQyxDQUFDLEVBQUU7SUFDSixDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8saUJBQWlCLGdDQUFnQywwQkFBMEI7Y0FDcEYsMEVBQTBFLENBQUMsQ0FDbEYsQ0FBQztBQUVGLDZFQUE2RTtBQUM3RSxNQUFNLDhCQUE4QixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRSxDQUFDLENBQ3ZGLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO0lBQ3JFLENBQUMsQ0FBQyxFQUFFO0lBQ0osQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLHVFQUF1RSxDQUFDLENBQ3hGLENBQUM7QUFFRixNQUFNLGlDQUFpQyxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN6RixJQUFJLENBQUMsc0JBQXNCLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN0QyxPQUFPLENBQUMsR0FBRyxPQUFPLGlDQUFpQyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELDJGQUEyRjtJQUMzRixzRUFBc0U7SUFDdEUsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLEdBQUcsT0FBTyxpQ0FBaUMsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNwQyxPQUFPLENBQUMsR0FBRyxPQUFPLG1DQUFtQyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE9BQU8sRUFBRSxDQUFDO0FBQ1osQ0FBQyxDQUFDO0FBRUYsTUFBTSw4QkFBOEIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUUsQ0FBQyxDQUN2RixPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLElBQUksQ0FBQyxJQUFJLFFBQVEsSUFBSSxLQUFLO0lBQ2xHLENBQUMsQ0FBQyxFQUFFO0lBQ0osQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLHFDQUFxQyxDQUFDLENBQ3RELENBQUM7QUFFRixNQUFNLHNDQUFzQyxHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRSxDQUFDLENBQy9GLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsSUFBSSxDQUFDO0lBQzdFLENBQUMsQ0FBQyxFQUFFO0lBQ0osQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLHNDQUFzQyxDQUFDLENBQ3ZELENBQUM7QUFFRixNQUFNLDRCQUE0QixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUNwRixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLGVBQWUsRUFBRSxZQUFZLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDbkYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxPQUFPO1FBQ0wsR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLEdBQUcsT0FBTyxVQUFVLENBQUM7UUFDdEUsR0FBRyw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLEdBQUcsT0FBTyxTQUFTLENBQUM7UUFDdkUsR0FBRyxpQ0FBaUMsQ0FBQyxRQUFRLENBQUMsYUFBYSxFQUFFLEdBQUcsT0FBTyxnQkFBZ0IsQ0FBQztRQUN4RixHQUFHLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxVQUFVLEVBQUUsR0FBRyxPQUFPLGFBQWEsQ0FBQztLQUNoRixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsQ0FDakQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLDRCQUE0QixFQUM1QixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEIsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsT0FBTyxFQUFFLHNCQUFzQixFQUFFLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM1RSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLHVCQUF1QixDQUFDLFFBQVEsRUFBRSxHQUFHLE9BQU8sV0FBVyxDQUFDLENBQUM7SUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLDRCQUE0QixDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsR0FBRyxPQUFPLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDakYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNDQUFzQyxDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsRUFDakYsR0FBRyxPQUFPLHVCQUF1QixDQUFDLENBQUMsQ0FBQztJQUN0QyxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUE0QkY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FDOUMsUUFBaUIsRUFDakIsT0FBTyxHQUFHLDRCQUE0QixFQUM1QixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxXQUFXLEVBQUUsUUFBUSxFQUFFLGVBQWU7UUFDeEYsWUFBWSxFQUFFLFNBQVMsRUFBRSxzQkFBc0IsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsT0FBTztRQUNMLEdBQUcsOEJBQThCLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxHQUFHLE9BQU8sWUFBWSxDQUFDO1FBQzdFLEdBQUcsOEJBQThCLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxHQUFHLE9BQU8sU0FBUyxDQUFDO1FBQ3ZFLEdBQUcsaUNBQWlDLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxHQUFHLE9BQU8sZ0JBQWdCLENBQUM7UUFDeEYsR0FBRyw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLEdBQUcsT0FBTyxhQUFhLENBQUM7UUFDL0UsR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLEdBQUcsT0FBTyxVQUFVLENBQUM7UUFDdEUsR0FBRyxzQ0FBc0MsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEVBQ3JFLEdBQUcsT0FBTyx1QkFBdUIsQ0FBQztRQUNwQyxHQUFHLHNDQUFzQyxDQUFDLFFBQVEsQ0FBQyxVQUFVLEVBQUUsR0FBRyxPQUFPLGFBQWEsQ0FBQztRQUN2RixHQUFHLENBQUMsT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTyx5QkFBeUIsQ0FBQyxDQUFDO0tBQ3JGLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsUUFBdUIsRUFBVSxFQUFFO0lBQ25GLE1BQU0sTUFBTSxHQUFHLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzlDLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFDRCxPQUFPLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUM7QUFDM0MsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3Rlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvY2x1c3Rlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUV6QyxPQUFPLEVBQTRCLE1BQU0sbUJBQW1CLENBQUM7QUFFN0QsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFDNUQsT0FBTyxFQUFFLHVCQUF1QixFQUF1QixNQUFNLGdCQUFnQixDQUFDO0FBQzlFLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUM1RCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFzSWhFOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM1RCwrRUFBK0U7SUFDL0UsMkJBQTJCO0lBQzNCLDJGQUEyRjtJQUMzRixvQkFBb0I7SUFDcEIsa0dBQWtHO0lBQ2xHLDhCQUE4QjtDQUN0QixDQUFDLENBQUM7QUFLWixNQUFNLCtCQUErQixHQUFHLElBQUksQ0FBQztBQUM3QyxNQUFNLGdDQUFnQyxHQUFHLEVBQUUsQ0FBQztBQUU1QyxNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUMzRSxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUM1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ3hCLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztXQUNuRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUMvQyxDQUFDO0FBRUYsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDbEYsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQzNCLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNyQixRQUFRLENBQUMsTUFBTSxHQUFHLCtCQUErQixFQUFFLENBQUM7UUFDdkQsT0FBTyxDQUFDLEdBQUcsT0FBTyw2QkFBNkIsK0JBQStCLGFBQWEsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLFlBQWlCLENBQUM7SUFDdEIsSUFBSSxDQUFDO1FBQ0gsWUFBWSxHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ25DLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsR0FBRyxPQUFPLHlCQUF5QixDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFlBQVksQ0FBQyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsSUFBSSxZQUFZLENBQUMsUUFBUSxJQUFJLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUNuRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywwQkFBMEIsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFDRCxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDckMsTUFBTSxDQUFDLElBQUksQ0FDVCxHQUFHLE9BQU8saUNBQWlDLFlBQVksQ0FBQyxNQUFNLElBQUk7Y0FDOUQsaUVBQWlFLENBQ3RFLENBQUM7SUFDSixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsQ0FDbEMsUUFBaUIsRUFDakIsT0FBTyxHQUFHLGVBQWUsRUFDZixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDL0QsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxPQUFPLDBCQUEwQixDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsR0FBRyxPQUFPLFNBQVMsQ0FBQyxDQUFDO0FBQzFFLENBQUMsQ0FBQztBQUVGLE1BQU0sMkJBQTJCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFLENBQUMsQ0FDcEYsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUN2QixRQUFRLENBQUMsTUFBTSxJQUFJLGdDQUFnQztPQUNuRCwrQkFBK0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDO0lBQ2pELENBQUMsQ0FBQyxFQUFFO0lBQ0osQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLGlCQUFpQixnQ0FBZ0MsMEJBQTBCO2NBQ3BGLDBFQUEwRSxDQUFDLENBQ2xGLENBQUM7QUFFRiw2RUFBNkU7QUFDN0UsTUFBTSw4QkFBOEIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUUsQ0FBQyxDQUN2RixPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksd0JBQXdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztJQUNyRSxDQUFDLENBQUMsRUFBRTtJQUNKLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTyx1RUFBdUUsQ0FBQyxDQUN4RixDQUFDO0FBRUYsTUFBTSxpQ0FBaUMsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDekYsSUFBSSxDQUFDLHNCQUFzQixDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDdEMsT0FBTyxDQUFDLEdBQUcsT0FBTyxpQ0FBaUMsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFDRCwyRkFBMkY7SUFDM0Ysc0VBQXNFO0lBQ3RFLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2hDLE9BQU8sQ0FBQyxHQUFHLE9BQU8saUNBQWlDLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDcEMsT0FBTyxDQUFDLEdBQUcsT0FBTyxtQ0FBbUMsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxPQUFPLEVBQUUsQ0FBQztBQUNaLENBQUMsQ0FBQztBQUVGLE1BQU0sOEJBQThCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFLENBQUMsQ0FDdkYsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxJQUFJLENBQUMsSUFBSSxRQUFRLElBQUksS0FBSztJQUNsRyxDQUFDLENBQUMsRUFBRTtJQUNKLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTyxxQ0FBcUMsQ0FBQyxDQUN0RCxDQUFDO0FBRUYsTUFBTSxzQ0FBc0MsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUUsQ0FBQyxDQUMvRixPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLElBQUksQ0FBQztJQUM3RSxDQUFDLENBQUMsRUFBRTtJQUNKLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTyxzQ0FBc0MsQ0FBQyxDQUN2RCxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQ2xGLElBQUksQ0FBQztRQUNILGVBQWUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMxQixPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsR0FBRyxPQUFPLGdEQUFnRCxDQUFDLENBQUM7SUFDdEUsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLHVFQUF1RTtBQUN2RSxNQUFNLDJCQUEyQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRSxDQUFDLENBQ3BGLFFBQVEsS0FBSyxJQUFJLElBQUksOEJBQThCLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO0lBQ2pGLENBQUMsQ0FBQyxFQUFFO0lBQ0osQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLDZDQUE2QyxDQUFDLENBQzlELENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLENBQ3hDLFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyx1QkFBdUIsRUFDdkIsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFdBQVcsRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLGVBQWUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHO1FBQ2IsR0FBRywwQkFBMEIsQ0FBQyxRQUFRLENBQUMsU0FBUyxFQUFFLEdBQUcsT0FBTyxZQUFZLENBQUM7UUFDekUsR0FBRyxpQ0FBaUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLEdBQUcsT0FBTyxVQUFVLENBQUM7UUFDNUUsR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLEdBQUcsT0FBTyxXQUFXLENBQUM7UUFDeEUsR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsYUFBYSxFQUFFLEdBQUcsT0FBTyxnQkFBZ0IsQ0FBQztLQUNuRixDQUFDO0lBQ0YsSUFBSSxRQUFRLENBQUMsUUFBUSxLQUFLLElBQUksSUFBSSxRQUFRLENBQUMsYUFBYSxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ2xFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLHVEQUF1RCxDQUFDLENBQUM7SUFDakYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQ3BGLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFNBQVMsRUFBRSxRQUFRLEVBQUUsZUFBZSxFQUFFLFlBQVksQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQy9GLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsT0FBTztRQUNMLEdBQUcsMkJBQTJCLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxHQUFHLE9BQU8sVUFBVSxDQUFDO1FBQ3RFLEdBQUcsOEJBQThCLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxHQUFHLE9BQU8sU0FBUyxDQUFDO1FBQ3ZFLEdBQUcsaUNBQWlDLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxHQUFHLE9BQU8sZ0JBQWdCLENBQUM7UUFDeEYsR0FBRyw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLEdBQUcsT0FBTyxhQUFhLENBQUM7UUFDL0UsR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztZQUMxQyxDQUFDLENBQUMsMEJBQTBCLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxHQUFHLE9BQU8sU0FBUyxDQUFDO1lBQ2xFLENBQUMsQ0FBQyxFQUFFLENBQUM7S0FDUixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsQ0FDakQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLDRCQUE0QixFQUM1QixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEIsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsT0FBTyxFQUFFLHNCQUFzQixFQUFFLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM1RSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLHVCQUF1QixDQUFDLFFBQVEsRUFBRSxHQUFHLE9BQU8sV0FBVyxDQUFDLENBQUM7SUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLDRCQUE0QixDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsR0FBRyxPQUFPLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDakYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNDQUFzQyxDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsRUFDakYsR0FBRyxPQUFPLHVCQUF1QixDQUFDLENBQUMsQ0FBQztJQUN0QyxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUE0QkY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FDOUMsUUFBaUIsRUFDakIsT0FBTyxHQUFHLDRCQUE0QixFQUM1QixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxXQUFXLEVBQUUsUUFBUSxFQUFFLGVBQWU7UUFDeEYsWUFBWSxFQUFFLFNBQVMsRUFBRSxzQkFBc0IsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzFFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsT0FBTztRQUNMLEdBQUcsOEJBQThCLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxHQUFHLE9BQU8sWUFBWSxDQUFDO1FBQzdFLEdBQUcsOEJBQThCLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxHQUFHLE9BQU8sU0FBUyxDQUFDO1FBQ3ZFLEdBQUcsaUNBQWlDLENBQUMsUUFBUSxDQUFDLGFBQWEsRUFBRSxHQUFHLE9BQU8sZ0JBQWdCLENBQUM7UUFDeEYsR0FBRyw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLEdBQUcsT0FBTyxhQUFhLENBQUM7UUFDL0UsR0FBRywyQkFBMkIsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLEdBQUcsT0FBTyxVQUFVLENBQUM7UUFDdEUsR0FBRyxzQ0FBc0MsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEVBQ3JFLEdBQUcsT0FBTyx1QkFBdUIsQ0FBQztRQUNwQyxHQUFHLHNDQUFzQyxDQUFDLFFBQVEsQ0FBQyxVQUFVLEVBQUUsR0FBRyxPQUFPLGFBQWEsQ0FBQztRQUN2RixHQUFHLENBQUMsT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTyx5QkFBeUIsQ0FBQyxDQUFDO0tBQ3JGLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsUUFBdUIsRUFBVSxFQUFFO0lBQ25GLE1BQU0sTUFBTSxHQUFHLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzlDLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFDRCxPQUFPLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUM7QUFDM0MsQ0FBQyxDQUFDIn0=

package/dist_ts/data/clustervpn.d.ts

@@ -0,0 +1,135 @@
+/**
+ * One workload prefix a node owns inside its cluster's managed VPN, and the policy domain that
+ * names it in a grant. Both are Cloudly's words: the relay matches them, it never invents one.
+ */
+export interface IClusterVpnNetworkPrefix {
+    cidr: string;
+    policyDomain: string;
+}
+/**
+ * One member of a cluster's managed VPN.
+ *
+ * Membership is presence: a node the network does not list is not a member, so there is no
+ * disabled state to carry. `publicKey` is the node's own Noise public key, the one Cloudly issued
+ * the node's credential for, and `expiresAt` is that credential's expiry in Unix milliseconds — the
+ * hub stops relaying for a member whose window ended even if nothing pushes a new network.
+ */
+export interface IClusterVpnNetworkNode {
+    nodeId: string;
+    publicKey: string;
+    controlAddress: string;
+    expiresAt: number;
+    workloadPrefixes: IClusterVpnNetworkPrefix[];
+}
+/** One directed relay permission between two workload policy domains of two different nodes. */
+export interface IClusterVpnNetworkGrant {
+    sourceDomain: string;
+    destinationDomain: string;
+}
+/**
+ * The complete managed VPN of one cluster, as Cloudly states it to that cluster's relay.
+ *
+ * Complete, never a patch: a relay applies it as the whole authority its hub serves, so a member or
+ * a grant that is missing is withdrawn. `revision` is Cloudly's own counter for this authority and
+ * only ever rises; `authorityId` names the authority the hub is bound to, so a network compiled for
+ * another cluster is refused rather than applied.
+ */
+export interface IClusterVpnNetwork {
+    authorityId: string;
+    revision: number;
+    nodes: IClusterVpnNetworkNode[];
+    grants: IClusterVpnNetworkGrant[];
+}
+export declare const clusterVpnNetworkContract: Readonly<{
+    /** The policy domain of a node's control address; the hub relays no grant between control domains. */
+    readonly controlPolicyDomainPrefix: "control:";
+    /** The policy domain of one workload lease, named by that lease's digest. */
+    readonly workloadPolicyDomainPrefix: "workload:";
+    readonly maximumNodes: 256;
+    /** Per node; one workload lease the node's signed projection carries. */
+    readonly maximumWorkloadPrefixes: 128;
+    readonly maximumGrants: 4096;
+    readonly maximumCanonicalBytes: 917504;
+    readonly completeness: "whole-authority-never-a-patch";
+    readonly membership: "presence-only-an-absent-node-is-withdrawn";
+}>;
+/**
+ * Every reason a relay refuses a pushed network, in the words the refusal leads with.
+ *
+ * A push is applied to a daemon whose lifetime Cloudly cannot see, so the refusal is the only
+ * statement about whether the cluster's hub carries this authority. The relay writes
+ * `<name>: <reason>` and Cloudly matches the name, which is why the names are stated here instead
+ * of being spelled out on both sides.
+ */
+export declare const applyClusterVpnNetworkRefusals: readonly ["vpn-network-authority-foreign", "vpn-network-revision-stale"];
+/** One of the reasons a relay states that its hub did not take a network over. */
+export type TApplyClusterVpnNetworkRefusal = typeof applyClusterVpnNetworkRefusals[number];
+/**
+ * Every reason Cloudly states that a cluster has no managed VPN to push.
+ *
+ * Both are Cloudly reading its own records: a hub it cannot select, and a grant it cannot compile
+ * because hubs are per cluster and a grant whose two ends sit in different clusters has no path
+ * through any one of them.
+ */
+export declare const clusterVpnNetworkSelectionRefusals: readonly ["relay-vpn-hub-absent", "grant-cross-cluster-unsupported"];
+/** One of the reasons Cloudly states that it compiled no managed VPN for a cluster. */
+export type TClusterVpnNetworkSelectionRefusal = typeof clusterVpnNetworkSelectionRefusals[number];
+/** What a pushed network did to the cluster's hub, in the hub's own words. */
+export type TClusterVpnNetworkState = 'idle' | 'applying' | 'failed';
+export interface IApplyClusterVpnNetworkRequest {
+    network: IClusterVpnNetwork;
+}
+/**
+ * What the relay answers: the revision its hub has applied, or `null` while it has applied none,
+ * and what the hub is doing. `idle` means the pushed revision is the applied one.
+ */
+export interface IApplyClusterVpnNetworkResponse {
+    appliedRevision: number | null;
+    state: TClusterVpnNetworkState;
+}
+/**
+ * The pull carries no body. The relay's own socket names the cluster, and a hub daemon that just
+ * started holds nothing it could state about what it is missing.
+ */
+export type TGetClusterVpnNetworkRequest = Record<string, never>;
+/** `null` while the cluster has no managed VPN: no address plan, or no hub selected for it yet. */
+export interface IGetClusterVpnNetworkResponse {
+    network: IClusterVpnNetwork | null;
+}
+/** The policy domain of one node's control address. One rule, so both sides name it identically. */
+export declare const clusterVpnControlPolicyDomain: (addressValue: unknown) => string;
+/** The policy domain of one workload lease, from that lease's canonical digest. */
+export declare const clusterVpnWorkloadPolicyDomain: (digestValue: unknown) => string;
+/**
+ * Structural snapshot of a complete cluster network.
+ *
+ * Every node, prefix and grant is stated once and in canonical order, and every grant names a
+ * workload domain this network itself carries, on two different nodes. That last rule is what a
+ * per-cluster hub means: a grant whose other end sits on another cluster's hub cannot be expressed
+ * here at all, which is why Cloudly refuses it by name while it compiles instead of pushing it.
+ */
+export declare const snapshotClusterVpnNetwork: (value: unknown) => IClusterVpnNetwork;
+export type TClusterVpnNetworkAdmission = {
+    status: 'accepted';
+} | {
+    status: 'replay';
+} | {
+    status: 'refused';
+    reason: TApplyClusterVpnNetworkRefusal;
+};
+/**
+ * The pure decision a relay makes about a pushed network against the one its hub holds, or null
+ * when the hub holds none — which is every hub that just started, because a daemon restart starts
+ * empty. A repeat of the held network is a replay the relay may apply again without effect; a lower
+ * revision, or the same revision with different content, is stale and refused by name.
+ */
+export declare const admitClusterVpnNetwork: (heldValue: unknown | null, nextValue: unknown) => TClusterVpnNetworkAdmission;
+export declare const snapshotApplyClusterVpnNetworkRequest: (value: unknown) => IApplyClusterVpnNetworkRequest;
+export declare const snapshotApplyClusterVpnNetworkResponse: (value: unknown) => IApplyClusterVpnNetworkResponse;
+/**
+ * Compare the answer with the exact SENT network: a hub that reports itself idle has applied the
+ * revision it was sent, and no hub can report having applied a later one than exists.
+ */
+export declare const bindApplyClusterVpnNetworkResponse: (value: unknown, sentRequestValue: unknown) => IApplyClusterVpnNetworkResponse;
+export declare const snapshotGetClusterVpnNetworkRequest: (value: unknown) => TGetClusterVpnNetworkRequest;
+export declare const snapshotGetClusterVpnNetworkResponse: (value: unknown) => IGetClusterVpnNetworkResponse;

package/dist_ts/data/clustervpn.js

@@ -0,0 +1,147 @@
+import { captureNetwork, failNetwork, networkCanonical, networkCounter, networkEqual, networkId, networkIpv4, networkList, networkNoiseKey, networkPrivatePrefix, networkRecord, networkSafe, networkSorted, requireNetwork } from '../private/networkcontract.js';
+export const clusterVpnNetworkContract = Object.freeze({
+    /** The policy domain of a node's control address; the hub relays no grant between control domains. */
+    controlPolicyDomainPrefix: 'control:',
+    /** The policy domain of one workload lease, named by that lease's digest. */
+    workloadPolicyDomainPrefix: 'workload:',
+    maximumNodes: 256,
+    /** Per node; one workload lease the node's signed projection carries. */
+    maximumWorkloadPrefixes: 128,
+    maximumGrants: 4096,
+    maximumCanonicalBytes: 917_504,
+    completeness: 'whole-authority-never-a-patch',
+    membership: 'presence-only-an-absent-node-is-withdrawn',
+});
+/**
+ * Every reason a relay refuses a pushed network, in the words the refusal leads with.
+ *
+ * A push is applied to a daemon whose lifetime Cloudly cannot see, so the refusal is the only
+ * statement about whether the cluster's hub carries this authority. The relay writes
+ * `<name>: <reason>` and Cloudly matches the name, which is why the names are stated here instead
+ * of being spelled out on both sides.
+ */
+export const applyClusterVpnNetworkRefusals = Object.freeze([
+    /** The network names another authority than the one this cluster's hub is bound to. */
+    'vpn-network-authority-foreign',
+    /** A revision the hub has already passed, or the same revision with different content. */
+    'vpn-network-revision-stale',
+]);
+/**
+ * Every reason Cloudly states that a cluster has no managed VPN to push.
+ *
+ * Both are Cloudly reading its own records: a hub it cannot select, and a grant it cannot compile
+ * because hubs are per cluster and a grant whose two ends sit in different clusters has no path
+ * through any one of them.
+ */
+export const clusterVpnNetworkSelectionRefusals = Object.freeze([
+    /** The cluster's relay registered no hub, so no node of it may be sent to one. */
+    'relay-vpn-hub-absent',
+    /** The grant's two workloads are placed on two clusters; hub federation is a later lane. */
+    'grant-cross-cluster-unsupported',
+]);
+/** The policy domain of one node's control address. One rule, so both sides name it identically. */
+export const clusterVpnControlPolicyDomain = (addressValue) => networkSafe(() => `${clusterVpnNetworkContract.controlPolicyDomainPrefix}${networkIpv4(addressValue)}`);
+/** The policy domain of one workload lease, from that lease's canonical digest. */
+export const clusterVpnWorkloadPolicyDomain = (digestValue) => networkSafe(() => {
+    requireNetwork(typeof digestValue === 'string' && /^sha256:[a-f0-9]{64}$/.test(digestValue));
+    return `${clusterVpnNetworkContract.workloadPolicyDomainPrefix}${digestValue.slice(7)}`;
+});
+const workloadPolicyDomain = (value) => {
+    requireNetwork(typeof value === 'string'
+        && value.startsWith(clusterVpnNetworkContract.workloadPolicyDomainPrefix)
+        && /^[a-f0-9]{64}$/.test(value.slice(clusterVpnNetworkContract.workloadPolicyDomainPrefix.length)));
+    return value;
+};
+const prefixOf = (value) => {
+    const item = networkRecord(value, ['cidr', 'policyDomain']);
+    return { cidr: networkPrivatePrefix(item.cidr), policyDomain: workloadPolicyDomain(item.policyDomain) };
+};
+const nodeOf = (value) => {
+    const item = networkRecord(value, ['nodeId', 'publicKey', 'controlAddress', 'expiresAt', 'workloadPrefixes']);
+    return { nodeId: networkId(item.nodeId), publicKey: networkNoiseKey(item.publicKey), controlAddress: networkIpv4(item.controlAddress),
+        expiresAt: networkCounter(item.expiresAt),
+        workloadPrefixes: networkSorted(networkList(item.workloadPrefixes, clusterVpnNetworkContract.maximumWorkloadPrefixes, prefixOf), prefix => prefix.cidr) };
+};
+const grantOf = (value) => {
+    const item = networkRecord(value, ['sourceDomain', 'destinationDomain']);
+    return { sourceDomain: workloadPolicyDomain(item.sourceDomain), destinationDomain: workloadPolicyDomain(item.destinationDomain) };
+};
+const grantKey = (grant) => `${grant.sourceDomain}\0${grant.destinationDomain}`;
+/**
+ * Structural snapshot of a complete cluster network.
+ *
+ * Every node, prefix and grant is stated once and in canonical order, and every grant names a
+ * workload domain this network itself carries, on two different nodes. That last rule is what a
+ * per-cluster hub means: a grant whose other end sits on another cluster's hub cannot be expressed
+ * here at all, which is why Cloudly refuses it by name while it compiles instead of pushing it.
+ */
+export const snapshotClusterVpnNetwork = (value) => networkSafe(() => {
+    const captured = captureNetwork(value);
+    requireNetwork(new TextEncoder().encode(networkCanonical(captured)).length <= clusterVpnNetworkContract.maximumCanonicalBytes);
+    const item = networkRecord(captured, ['authorityId', 'revision', 'nodes', 'grants']);
+    const nodes = networkSorted(networkList(item.nodes, clusterVpnNetworkContract.maximumNodes, nodeOf), node => node.nodeId);
+    const grants = networkSorted(networkList(item.grants, clusterVpnNetworkContract.maximumGrants, grantOf), grantKey);
+    const domainOwners = new Map();
+    const addresses = new Set(), keys = new Set(), cidrs = new Set();
+    for (const node of nodes) {
+        requireNetwork(!keys.has(node.publicKey) && !addresses.has(node.controlAddress));
+        keys.add(node.publicKey);
+        addresses.add(node.controlAddress);
+        for (const prefix of node.workloadPrefixes) {
+            requireNetwork(!cidrs.has(prefix.cidr) && !domainOwners.has(prefix.policyDomain));
+            cidrs.add(prefix.cidr);
+            domainOwners.set(prefix.policyDomain, node.nodeId);
+        }
+    }
+    for (const grant of grants) {
+        const source = domainOwners.get(grant.sourceDomain), destination = domainOwners.get(grant.destinationDomain);
+        requireNetwork(source && destination && source !== destination);
+    }
+    return { authorityId: networkId(item.authorityId), revision: networkCounter(item.revision), nodes, grants };
+});
+/**
+ * The pure decision a relay makes about a pushed network against the one its hub holds, or null
+ * when the hub holds none — which is every hub that just started, because a daemon restart starts
+ * empty. A repeat of the held network is a replay the relay may apply again without effect; a lower
+ * revision, or the same revision with different content, is stale and refused by name.
+ */
+export const admitClusterVpnNetwork = (heldValue, nextValue) => networkSafe(() => {
+    const next = snapshotClusterVpnNetwork(nextValue);
+    if (heldValue === null)
+        return { status: 'accepted' };
+    const held = snapshotClusterVpnNetwork(heldValue);
+    if (held.authorityId !== next.authorityId)
+        return { status: 'refused', reason: 'vpn-network-authority-foreign' };
+    if (next.revision > held.revision)
+        return { status: 'accepted' };
+    return networkEqual(held, next) ? { status: 'replay' } : { status: 'refused', reason: 'vpn-network-revision-stale' };
+});
+export const snapshotApplyClusterVpnNetworkRequest = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['network']);
+    return { network: snapshotClusterVpnNetwork(item.network) };
+});
+export const snapshotApplyClusterVpnNetworkResponse = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['appliedRevision', 'state']);
+    requireNetwork(item.state === 'idle' || item.state === 'applying' || item.state === 'failed');
+    return { appliedRevision: item.appliedRevision === null ? null : networkCounter(item.appliedRevision), state: item.state };
+});
+/**
+ * Compare the answer with the exact SENT network: a hub that reports itself idle has applied the
+ * revision it was sent, and no hub can report having applied a later one than exists.
+ */
+export const bindApplyClusterVpnNetworkResponse = (value, sentRequestValue) => networkSafe(() => {
+    const response = snapshotApplyClusterVpnNetworkResponse(value);
+    const sent = snapshotApplyClusterVpnNetworkRequest(sentRequestValue);
+    requireNetwork(response.appliedRevision === null || response.appliedRevision <= sent.network.revision);
+    requireNetwork(response.state !== 'idle' || response.appliedRevision === sent.network.revision);
+    return response;
+});
+export const snapshotGetClusterVpnNetworkRequest = (value) => networkSafe(() => {
+    networkRecord(captureNetwork(value), []);
+    return {};
+});
+export const snapshotGetClusterVpnNetworkResponse = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['network']);
+    return { network: item.network === null ? null : snapshotClusterVpnNetwork(item.network) };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcnZwbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvY2x1c3RlcnZwbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxnQkFBZ0IsRUFBRSxjQUFjLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUN2SCxlQUFlLEVBQUUsb0JBQW9CLEVBQUUsYUFBYSxFQUFFLFdBQVcsRUFBRSxhQUFhLEVBQ2hGLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBZ0R4RCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3JELHNHQUFzRztJQUN0Ryx5QkFBeUIsRUFBRSxVQUFVO0lBQ3JDLDZFQUE2RTtJQUM3RSwwQkFBMEIsRUFBRSxXQUFXO0lBQ3ZDLFlBQVksRUFBRSxHQUFHO0lBQ2pCLHlFQUF5RTtJQUN6RSx1QkFBdUIsRUFBRSxHQUFHO0lBQzVCLGFBQWEsRUFBRSxJQUFJO0lBQ25CLHFCQUFxQixFQUFFLE9BQU87SUFDOUIsWUFBWSxFQUFFLCtCQUErQjtJQUM3QyxVQUFVLEVBQUUsMkNBQTJDO0NBQy9DLENBQUMsQ0FBQztBQUVaOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzFELHVGQUF1RjtJQUN2RiwrQkFBK0I7SUFDL0IsMEZBQTBGO0lBQzFGLDRCQUE0QjtDQUNwQixDQUFDLENBQUM7QUFLWjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzlELGtGQUFrRjtJQUNsRixzQkFBc0I7SUFDdEIsNEZBQTRGO0lBQzVGLGlDQUFpQztDQUN6QixDQUFDLENBQUM7QUFnQ1osb0dBQW9HO0FBQ3BHLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQUMsWUFBcUIsRUFBVSxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRSxDQUMvRixHQUFHLHlCQUF5QixDQUFDLHlCQUF5QixHQUFHLFdBQVcsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDLENBQUM7QUFFeEYsbUZBQW1GO0FBQ25GLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLENBQUMsV0FBb0IsRUFBVSxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUMvRixjQUFjLENBQUMsT0FBTyxXQUFXLEtBQUssUUFBUSxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sR0FBRyx5QkFBeUIsQ0FBQywwQkFBMEIsR0FBSSxXQUFzQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0FBQ3RHLENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLEtBQWMsRUFBVSxFQUFFO0lBQ3RELGNBQWMsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRO1dBQ25DLEtBQUssQ0FBQyxVQUFVLENBQUMseUJBQXlCLENBQUMsMEJBQTBCLENBQUM7V0FDdEUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMseUJBQXlCLENBQUMsMEJBQTBCLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3RHLE9BQU8sS0FBZSxDQUFDO0FBQ3pCLENBQUMsQ0FBQztBQUVGLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBYyxFQUE0QixFQUFFO0lBQzVELE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUM1RCxPQUFPLEVBQUUsSUFBSSxFQUFFLG9CQUFvQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxZQUFZLEVBQUUsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7QUFDMUcsQ0FBQyxDQUFDO0FBRUYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUU7SUFDeEQsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLFFBQVEsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLGtCQUFrQixDQUFDLENBQUMsQ0FBQztJQUM5RyxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsY0FBYyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDO1FBQ25JLFNBQVMsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUN6QyxnQkFBZ0IsRUFBRSxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSx5QkFBeUIsQ0FBQyx1QkFBdUIsRUFBRSxRQUFRLENBQUMsRUFDN0gsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztBQUMvQixDQUFDLENBQUM7QUFFRixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWMsRUFBMkIsRUFBRTtJQUMxRCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsY0FBYyxFQUFFLG1CQUFtQixDQUFDLENBQUMsQ0FBQztJQUN6RSxPQUFPLEVBQUUsWUFBWSxFQUFFLG9CQUFvQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxpQkFBaUIsRUFBRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO0FBQ3BJLENBQUMsQ0FBQztBQUVGLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBOEIsRUFBVSxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsWUFBWSxLQUFLLEtBQUssQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO0FBRWpIOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLEtBQWMsRUFBc0IsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDaEcsTUFBTSxRQUFRLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQ3ZDLGNBQWMsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sSUFBSSx5QkFBeUIsQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQy9ILE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxhQUFhLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQ3JGLE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSx5QkFBeUIsQ0FBQyxZQUFZLEVBQUUsTUFBTSxDQUFDLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDMUgsTUFBTSxNQUFNLEdBQUcsYUFBYSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLHlCQUF5QixDQUFDLGFBQWEsRUFBRSxPQUFPLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQztJQUNuSCxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUcsRUFBa0IsQ0FBQztJQUMvQyxNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxFQUFFLElBQUksR0FBRyxJQUFJLEdBQUcsRUFBVSxFQUFFLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3pGLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7UUFDekIsY0FBYyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDO1FBQ2pGLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDN0QsS0FBSyxNQUFNLE1BQU0sSUFBSSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUMzQyxjQUFjLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7WUFDbEYsS0FBSyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7WUFBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxZQUFZLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzdFLENBQUM7SUFDSCxDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxNQUFNLEVBQUUsQ0FBQztRQUMzQixNQUFNLE1BQU0sR0FBRyxZQUFZLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBRSxXQUFXLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUM3RyxjQUFjLENBQUMsTUFBTSxJQUFJLFdBQVcsSUFBSSxNQUFNLEtBQUssV0FBVyxDQUFDLENBQUM7SUFDbEUsQ0FBQztJQUNELE9BQU8sRUFBRSxXQUFXLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLENBQUM7QUFDOUcsQ0FBQyxDQUFDLENBQUM7QUFPSDs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsU0FBeUIsRUFBRSxTQUFrQixFQUErQixFQUFFLENBQ25ILFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDZixNQUFNLElBQUksR0FBRyx5QkFBeUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNsRCxJQUFJLFNBQVMsS0FBSyxJQUFJO1FBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsQ0FBQztJQUN0RCxNQUFNLElBQUksR0FBRyx5QkFBeUIsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNsRCxJQUFJLElBQUksQ0FBQyxXQUFXLEtBQUssSUFBSSxDQUFDLFdBQVc7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsK0JBQStCLEVBQUUsQ0FBQztJQUNqSCxJQUFJLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVE7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQ2pFLE9BQU8sWUFBWSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsNEJBQTRCLEVBQUUsQ0FBQztBQUN2SCxDQUFDLENBQUMsQ0FBQztBQUVMLE1BQU0sQ0FBQyxNQUFNLHFDQUFxQyxHQUFHLENBQUMsS0FBYyxFQUFrQyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUN4SCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUMvRCxPQUFPLEVBQUUsT0FBTyxFQUFFLHlCQUF5QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO0FBQzlELENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FBQyxLQUFjLEVBQW1DLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQzFILE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ2hGLGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxLQUFLLE1BQU0sSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFVBQVUsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDO0lBQzlGLE9BQU8sRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWUsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO0FBQzdILENBQUMsQ0FBQyxDQUFDO0FBRUg7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FBQyxLQUFjLEVBQUUsZ0JBQXlCLEVBQW1DLEVBQUUsQ0FDL0gsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUNmLE1BQU0sUUFBUSxHQUFHLHNDQUFzQyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQy9ELE1BQU0sSUFBSSxHQUFHLHFDQUFxQyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDckUsY0FBYyxDQUFDLFFBQVEsQ0FBQyxlQUFlLEtBQUssSUFBSSxJQUFJLFFBQVEsQ0FBQyxlQUFlLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN2RyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssS0FBSyxNQUFNLElBQUksUUFBUSxDQUFDLGVBQWUsS0FBSyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2hHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQyxDQUFDO0FBRUwsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsQ0FBQyxLQUFjLEVBQWdDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3BILGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDekMsT0FBTyxFQUFFLENBQUM7QUFDWixDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLENBQUMsS0FBYyxFQUFpQyxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUN0SCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUMvRCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO0FBQzdGLENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/data/index.d.ts

@@ -1,6 +1,7 @@
 export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './clusterruntime.js';
+export * from './clustervpn.js';
 export * from './clusteringress.js';
 export * from './config.js';
 export * from './corestore.js';

package/dist_ts/data/index.js

@@ -1,6 +1,7 @@
 export * from './cloudlyconfig.js';
 export * from './cluster.js';
 export * from './clusterruntime.js';
+export * from './clustervpn.js';
 export * from './clusteringress.js';
 export * from './config.js';
 export * from './corestore.js';
@@ -58,4 +59,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxVQUFVLENBQUM7QUFDekIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsd0JBQXdCLENBQUM7QUFFdkMsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxZQUFZLENBQUM7QUFDM0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyx3QkFBd0IsQ0FBQztBQUV2QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==