@serve.zone/interfaces 32.3.0 → 32.4.0

package/dist_ts/data/networkaddressplan.d.ts

@@ -1,5 +1,4 @@
 import type { IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
-import type { IGetRuntimeManagedVpnCredentialResponse } from './networkcredential.js';
 /**
  * The address space an administrator gives the runtime network, and the one input the protected
  * authority is composed from. Cloudly keeps a single plan; pools and prefixes only grow, and the
@@ -13,15 +12,34 @@ export interface IRuntimeNetworkAddressPlan {
     prefixes: string[];
     pools: IRuntimeNetworkProtectedAuthority['pools'];
     resolvers: IRuntimeNetworkProtectedAuthority['resolvers'];
-    /** Without the VPN relay, which the composed authority adds as a UDP platform endpoint. */
+    /** Without the cluster hubs, which the composed authority adds from the hubs it is given. */
     platformEndpoints: IRuntimeNetworkProtectedAuthority['platformEndpoints'];
     vpn: {
         /** The private prefix VPN control addresses are allocated from. */
         controlPrefix: string;
-        /** The endpoint every node dials for the managed VPN. */
-        relay: IGetRuntimeManagedVpnCredentialResponse['relay'];
+        /**
+         * The protected prefix every cluster hub binds inside.
+         *
+         * The endpoints themselves are no administrator's input: a cluster's relay reports the one it
+         * bound and the composition turns it into platform endpoints, so this prefix is what an
+         * administrator reserves for them.
+         */
+        hubPrefix: string;
     };
 }
+/**
+ * One cluster's managed VPN hub, as the cluster's relay bound it.
+ *
+ * The hub is its cluster's own packet relay, so `clusterId` names both the hub and the authority
+ * that may select it, and `address` is an underlay address inside the plan's `vpn.hubPrefix`. A hub
+ * offers at least one transport; the port of a transport it did not bind is `null`.
+ */
+export interface IRuntimeNetworkVpnHub {
+    clusterId: string;
+    address: string;
+    quicPort: number | null;
+    websocketPort: number | null;
+}
 /** What an administrator writes; Cloudly supplies the id and the revision. */
 export type TRuntimeNetworkAddressPlanWritableData = Omit<IRuntimeNetworkAddressPlan, 'id' | 'revision'>;
 /** What a protection producer fixes around a plan: the authority's identity, revision chain and egress. */
@@ -54,20 +72,45 @@ export declare const runtimeNetworkAddressPlanContract: Readonly<{
      * is stated: the private-range rule already keeps the control prefix at /8 or longer.
      */
     readonly maximumControlPrefixLength: 30;
-    readonly relayProtocol: "udp";
+    /**
+     * Every transport a hub may offer, in the order a node prefers them.
+     *
+     * One row states all three facts that belong together: the transport a credential names, the
+     * suffix its platform endpoint id carries, and the protocol the endpoint is composed with. A hub
+     * that bound both transports therefore contributes exactly two endpoints of one address.
+     */
+    readonly hubTransports: readonly (Readonly<{
+        transport: "quic";
+        endpointSuffix: "quic";
+        protocol: "udp";
+    }> | Readonly<{
+        transport: "websocket";
+        endpointSuffix: "ws";
+        protocol: "tcp";
+    }>)[];
 }>;
+/** How a node reaches its cluster's hub, read off the one table that states the transports. */
+export type TRuntimeNetworkVpnTransport = typeof runtimeNetworkAddressPlanContract.hubTransports[number]['transport'];
+/**
+ * The platform endpoints one hub contributes to a protected authority: one per transport it bound,
+ * in id order. Every reader derives the same ids from this one function — the composition that seals
+ * the authority, and the router selection that names which of them a node may dial.
+ */
+export declare const runtimeNetworkVpnHubEndpoints: (hubValue: unknown) => IRuntimeNetworkProtectedAuthority["platformEndpoints"];
 /**
- * Structural snapshot for exact persistence and for a plan write. A plan passes only when both
- * authorities it can describe pass the protected authority's own validator: its sets alone, and
- * its sets with the relay added, so no plan can compose an authority that contract refuses.
+ * Structural snapshot for exact persistence and for a plan write. The plan's own sets pass the
+ * protected authority's own validator, so no plan can describe an authority that contract refuses,
+ * and both VPN prefixes are reserved inside the protected space the plan states.
  */
 export declare const snapshotRuntimeNetworkAddressPlan: (value: unknown) => IRuntimeNetworkAddressPlan;
 /**
  * The protected authority a plan describes inside a producer's frame, digest included: the plan's
- * sets with the VPN relay as the UDP platform endpoint every node dials. Both inputs are read before
- * the digest is computed.
+ * sets plus the endpoints of every cluster hub it is given, each bound inside `vpn.hubPrefix`. One
+ * cluster contributes one hub, so `hubs` never names a cluster twice. All inputs are read before the
+ * digest is computed; an empty `hubs` composes the authority of a runtime network whose clusters
+ * have not registered a hub yet.
  */
-export declare const composeRuntimeNetworkProtectedAuthority: (planValue: unknown, frameValue: unknown) => Promise<IRuntimeNetworkProtectedAuthority>;
+export declare const composeRuntimeNetworkProtectedAuthority: (planValue: unknown, frameValue: unknown, hubsValue: unknown) => Promise<IRuntimeNetworkProtectedAuthority>;
 /**
  * The pure decision for replacing `previousValue`, the stored plan or null, with `nextValue` at the
  * following revision. Leases and the managed VPN outlive a plan revision, so every pool stays exactly

package/dist_ts/data/networkaddressplan.js

@@ -1,5 +1,5 @@
-import { computeRuntimeNetworkProtectedAuthorityDigest, snapshotRuntimeNetworkProtectedAuthority } from './networkauthority.js';
-import { captureNetwork, failNetwork, networkContains, networkCounter, networkEqual, networkId, networkIpv4, networkOverlaps, networkPrefixBounds, networkPrivatePrefix, networkRecord, networkSafe, requireNetwork } from '../private/networkcontract.js';
+import { computeRuntimeNetworkProtectedAuthorityDigest, runtimeNetworkAuthorityContract, snapshotRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import { captureNetwork, failNetwork, networkContains, networkCounter, networkEqual, networkId, networkIpv4, networkList, networkOverlaps, networkPrefix, networkPrefixBounds, networkPrivatePrefix, networkRecord, networkSafe, requireNetwork } from '../private/networkcontract.js';
 export const runtimeNetworkAddressPlanContract = Object.freeze({
     id: 'address-plan',
     /**
@@ -7,7 +7,42 @@ export const runtimeNetworkAddressPlanContract = Object.freeze({
      * is stated: the private-range rule already keeps the control prefix at /8 or longer.
      */
     maximumControlPrefixLength: 30,
-    relayProtocol: 'udp',
+    /**
+     * Every transport a hub may offer, in the order a node prefers them.
+     *
+     * One row states all three facts that belong together: the transport a credential names, the
+     * suffix its platform endpoint id carries, and the protocol the endpoint is composed with. A hub
+     * that bound both transports therefore contributes exactly two endpoints of one address.
+     */
+    hubTransports: Object.freeze([
+        Object.freeze({ transport: 'quic', endpointSuffix: 'quic', protocol: 'udp' }),
+        Object.freeze({ transport: 'websocket', endpointSuffix: 'ws', protocol: 'tcp' }),
+    ]),
+});
+/** The port a hub bound for one transport, or null when it did not bind that transport. */
+const hubPort = (hub, transport) => transport === 'quic' ? hub.quicPort : hub.websocketPort;
+const byEndpointId = (left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+const hubOf = (value) => {
+    const item = networkRecord(value, ['clusterId', 'address', 'quicPort', 'websocketPort']);
+    const port = (value) => value === null ? null : networkCounter(value, 65535);
+    const hub = { clusterId: networkId(item.clusterId), address: networkIpv4(item.address),
+        quicPort: port(item.quicPort), websocketPort: port(item.websocketPort) };
+    // A hub that bound no transport is not reachable, so it is not a hub a node could be sent to.
+    requireNetwork(runtimeNetworkAddressPlanContract.hubTransports.some(row => hubPort(hub, row.transport) !== null));
+    return hub;
+};
+/**
+ * The platform endpoints one hub contributes to a protected authority: one per transport it bound,
+ * in id order. Every reader derives the same ids from this one function — the composition that seals
+ * the authority, and the router selection that names which of them a node may dial.
+ */
+export const runtimeNetworkVpnHubEndpoints = (hubValue) => networkSafe(() => {
+    const hub = hubOf(captureNetwork(hubValue));
+    return runtimeNetworkAddressPlanContract.hubTransports
+        .filter(row => hubPort(hub, row.transport) !== null)
+        .map(row => ({ id: `${hub.clusterId}:${row.endpointSuffix}`, address: hub.address,
+        protocol: row.protocol, port: hubPort(hub, row.transport) }))
+        .sort(byEndpointId);
 });
 /**
  * The structural authority validator reads a frame's shape and nothing else, and a plan fixes none of
@@ -23,28 +58,32 @@ const unsealedDigest = `sha256:${'0'.repeat(64)}`;
 const authorityOf = (sets, frame) => snapshotRuntimeNetworkProtectedAuthority({ id: frame.id,
     generation: frame.generation, controller: frame.controller, previous: frame.previous, egressAuthorities: frame.egressAuthorities,
     prefixes: sets.prefixes, pools: sets.pools, resolvers: sets.resolvers, platformEndpoints: sets.platformEndpoints, digest: unsealedDigest });
-const setsWithRelay = (plan) => ({
+const setsWithHubs = (plan, hubs) => ({
     prefixes: plan.prefixes, pools: plan.pools, resolvers: plan.resolvers,
-    platformEndpoints: [...plan.platformEndpoints, { ...plan.vpn.relay, protocol: runtimeNetworkAddressPlanContract.relayProtocol }]
-        .sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0),
+    platformEndpoints: [...plan.platformEndpoints, ...hubs.flatMap(runtimeNetworkVpnHubEndpoints)].sort(byEndpointId),
 });
 const vpnOf = (value) => {
-    const item = networkRecord(value, ['controlPrefix', 'relay']);
-    const relay = networkRecord(item.relay, ['id', 'address', 'port']);
+    const item = networkRecord(value, ['controlPrefix', 'hubPrefix']);
     const controlPrefix = networkPrivatePrefix(item.controlPrefix);
     requireNetwork(Number(controlPrefix.split('/')[1]) <= runtimeNetworkAddressPlanContract.maximumControlPrefixLength);
-    return { controlPrefix, relay: { id: networkId(relay.id), address: networkIpv4(relay.address), port: networkCounter(relay.port, 65535) } };
+    return { controlPrefix, hubPrefix: networkPrefix(item.hubPrefix) };
 };
-/** The control prefix is protected, and no pool, resolver or platform endpoint, the relay included, sits inside it. */
-const requireVpnProtected = (authority, controlPrefix) => {
-    requireNetwork(authority.prefixes.some(prefix => networkContains(prefix, controlPrefix))
-        && authority.pools.every(pool => !networkOverlaps(pool.prefix, controlPrefix))
-        && [...authority.resolvers, ...authority.platformEndpoints].every(endpoint => !networkContains(controlPrefix, `${endpoint.address}/32`)));
+/**
+ * Both VPN prefixes are protected, they hold none of the plan's own pools, resolvers or platform
+ * endpoints, and they do not overlap each other: control addresses live inside the tunnel and hub
+ * endpoints on the underlay, so one prefix can never contain the other's addresses.
+ */
+const requireVpnProtected = (authority, vpn) => {
+    const endpoints = [...authority.resolvers, ...authority.platformEndpoints];
+    requireNetwork([vpn.controlPrefix, vpn.hubPrefix].every(prefix => authority.prefixes.some(range => networkContains(range, prefix))
+        && authority.pools.every(pool => !networkOverlaps(pool.prefix, prefix))
+        && endpoints.every(endpoint => !networkContains(prefix, `${endpoint.address}/32`)))
+        && !networkOverlaps(vpn.controlPrefix, vpn.hubPrefix));
 };
 /**
- * Structural snapshot for exact persistence and for a plan write. A plan passes only when both
- * authorities it can describe pass the protected authority's own validator: its sets alone, and
- * its sets with the relay added, so no plan can compose an authority that contract refuses.
+ * Structural snapshot for exact persistence and for a plan write. The plan's own sets pass the
+ * protected authority's own validator, so no plan can describe an authority that contract refuses,
+ * and both VPN prefixes are reserved inside the protected space the plan states.
  */
 export const snapshotRuntimeNetworkAddressPlan = (value) => networkSafe(() => {
     const item = networkRecord(captureNetwork(value), ['id', 'revision', 'prefixes', 'pools', 'resolvers', 'platformEndpoints', 'vpn']);
@@ -53,19 +92,24 @@ export const snapshotRuntimeNetworkAddressPlan = (value) => networkSafe(() => {
         platformEndpoints: item.platformEndpoints }, validationFrame);
     const plan = { id: runtimeNetworkAddressPlanContract.id, revision: networkCounter(item.revision),
         prefixes: own.prefixes, pools: own.pools, resolvers: own.resolvers, platformEndpoints: own.platformEndpoints, vpn: vpnOf(item.vpn) };
-    requireVpnProtected(authorityOf(setsWithRelay(plan), validationFrame), plan.vpn.controlPrefix);
+    requireVpnProtected(own, plan.vpn);
     return plan;
 });
 /**
  * The protected authority a plan describes inside a producer's frame, digest included: the plan's
- * sets with the VPN relay as the UDP platform endpoint every node dials. Both inputs are read before
- * the digest is computed.
+ * sets plus the endpoints of every cluster hub it is given, each bound inside `vpn.hubPrefix`. One
+ * cluster contributes one hub, so `hubs` never names a cluster twice. All inputs are read before the
+ * digest is computed; an empty `hubs` composes the authority of a runtime network whose clusters
+ * have not registered a hub yet.
  */
-export const composeRuntimeNetworkProtectedAuthority = async (planValue, frameValue) => {
+export const composeRuntimeNetworkProtectedAuthority = async (planValue, frameValue, hubsValue) => {
     try {
         const plan = snapshotRuntimeNetworkAddressPlan(planValue);
         const frame = networkRecord(captureNetwork(frameValue), ['id', 'generation', 'controller', 'previous', 'egressAuthorities']);
-        const authority = authorityOf(setsWithRelay(plan), frame);
+        const hubs = networkList(captureNetwork(hubsValue), runtimeNetworkAuthorityContract.maximumPlatformEndpoints, hubOf);
+        requireNetwork(new Set(hubs.map(hub => hub.clusterId)).size === hubs.length
+            && hubs.every(hub => networkContains(plan.vpn.hubPrefix, `${hub.address}/32`)));
+        const authority = authorityOf(setsWithHubs(plan, hubs), frame);
         return { ...authority, digest: await computeRuntimeNetworkProtectedAuthorityDigest(authority) };
     }
     catch {
@@ -111,4 +155,4 @@ export const admitRuntimeNetworkAddressPlanChange = (previousValue, nextValue) =
     return { status: 'accepted', removed: { resolverIds: idsOf(removedOrChanged(previous.resolvers, next.resolvers)),
             platformEndpointIds: idsOf(removedOrChanged(previous.platformEndpoints, next.platformEndpoints)) } };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2FkZHJlc3NwbGFuLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9uZXR3b3JrYWRkcmVzc3BsYW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLDZDQUE2QyxFQUFFLHdDQUF3QyxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFFaEksT0FBTyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLGNBQWMsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxlQUFlLEVBQzFILG1CQUFtQixFQUFFLG9CQUFvQixFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFnRC9ILE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDN0QsRUFBRSxFQUFFLGNBQWM7SUFDbEI7OztPQUdHO0lBQ0gsMEJBQTBCLEVBQUUsRUFBRTtJQUM5QixhQUFhLEVBQUUsS0FBSztDQUNaLENBQUMsQ0FBQztBQUVaOzs7O0dBSUc7QUFDSCxNQUFNLGVBQWUsR0FBMkM7SUFDOUQsRUFBRSxFQUFFLGNBQWMsRUFBRSxVQUFVLEVBQUUsQ0FBQyxFQUFFLFVBQVUsRUFBRSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFBRSxFQUFFLGNBQWMsRUFBRSxLQUFLLEVBQUUsY0FBYyxFQUFFO0lBQzdHLFFBQVEsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsQ0FBQyxFQUFFLE1BQU0sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLENBQUM7Q0FDbEcsQ0FBQztBQUNGLE1BQU0sY0FBYyxHQUFHLFVBQVUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsRUFBbUIsQ0FBQztBQUluRSxzRkFBc0Y7QUFDdEYsTUFBTSxXQUFXLEdBQUcsQ0FDbEIsSUFBMkMsRUFBRSxLQUFvRSxFQUM5RSxFQUFFLENBQUMsd0NBQXdDLENBQUMsRUFBRSxFQUFFLEVBQUUsS0FBSyxDQUFDLEVBQUU7SUFDN0YsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVLEVBQUUsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEVBQUUsaUJBQWlCLEVBQUUsS0FBSyxDQUFDLGlCQUFpQjtJQUNoSSxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRSxpQkFBaUIsRUFBRSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxDQUFDLENBQUM7QUFFOUksTUFBTSxhQUFhLEdBQUcsQ0FBQyxJQUFnQyxFQUFrQixFQUFFLENBQUMsQ0FBQztJQUMzRSxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7SUFDckUsaUJBQWlCLEVBQUUsQ0FBQyxHQUFHLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxFQUFFLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLGlDQUFpQyxDQUFDLGFBQWEsRUFBRSxDQUFDO1NBQzdILElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLEdBQUcsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7Q0FDL0UsQ0FBQyxDQUFDO0FBRUgsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUFjLEVBQXFDLEVBQUU7SUFDbEUsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLGVBQWUsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQzlELE1BQU0sS0FBSyxHQUFHLGFBQWEsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ25FLE1BQU0sYUFBYSxHQUFHLG9CQUFvQixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMvRCxjQUFjLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxpQ0FBaUMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO0lBQ3BILE9BQU8sRUFBRSxhQUFhLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLFdBQVcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsSUFBSSxFQUFFLGNBQWMsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQztBQUM3SSxDQUFDLENBQUM7QUFFRix1SEFBdUg7QUFDdkgsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLFNBQTRDLEVBQUUsYUFBcUIsRUFBUSxFQUFFO0lBQ3hHLGNBQWMsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsYUFBYSxDQUFDLENBQUM7V0FDbkYsU0FBUyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLGFBQWEsQ0FBQyxDQUFDO1dBQzNFLENBQUMsR0FBRyxTQUFTLENBQUMsU0FBUyxFQUFFLEdBQUcsU0FBUyxDQUFDLGlCQUFpQixDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxlQUFlLENBQUMsYUFBYSxFQUFFLEdBQUcsUUFBUSxDQUFDLE9BQU8sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzlJLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUFDLEtBQWMsRUFBOEIsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDaEgsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxXQUFXLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNwSSxjQUFjLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxpQ0FBaUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUNqRSxNQUFNLEdBQUcsR0FBRyxXQUFXLENBQUMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7UUFDN0YsaUJBQWlCLEVBQUUsSUFBSSxDQUFDLGlCQUFpQixFQUFFLEVBQUUsZUFBZSxDQUFDLENBQUM7SUFDaEUsTUFBTSxJQUFJLEdBQStCLEVBQUUsRUFBRSxFQUFFLGlDQUFpQyxDQUFDLEVBQUUsRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDMUgsUUFBUSxFQUFFLEdBQUcsQ0FBQyxRQUFRLEVBQUUsS0FBSyxFQUFFLEdBQUcsQ0FBQyxLQUFLLEVBQUUsU0FBUyxFQUFFLEdBQUcsQ0FBQyxTQUFTLEVBQUUsaUJBQWlCLEVBQUUsR0FBRyxDQUFDLGlCQUFpQixFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7SUFDdkksbUJBQW1CLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsRUFBRSxlQUFlLENBQUMsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQy9GLE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDLENBQUM7QUFFSDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUNBQXVDLEdBQUcsS0FBSyxFQUMxRCxTQUFrQixFQUFFLFVBQW1CLEVBQ0ssRUFBRTtJQUM5QyxJQUFJLENBQUM7UUFDSCxNQUFNLElBQUksR0FBRyxpQ0FBaUMsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMxRCxNQUFNLEtBQUssR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRSxZQUFZLEVBQUUsVUFBVSxFQUFFLG1CQUFtQixDQUFDLENBQUMsQ0FBQztRQUM3SCxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzFELE9BQU8sRUFBRSxHQUFHLFNBQVMsRUFBRSxNQUFNLEVBQUUsTUFBTSw2Q0FBNkMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0lBQ2xHLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRiwwR0FBMEc7QUFDMUcsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFrQixFQUFFLE1BQWMsRUFBVyxFQUFFO0lBQ2hFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEdBQUcsbUJBQW1CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDbEQsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxTQUFTLEVBQUUsRUFBRTtRQUNqRCxNQUFNLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxHQUFHLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ25ELE9BQU8sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVFLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNOLE9BQU8sT0FBTyxLQUFLLElBQUksR0FBRyxLQUFLLEdBQUcsQ0FBQyxDQUFDO0FBQ3RDLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sZ0JBQWdCLEdBQUcsQ0FBSSxRQUFhLEVBQUUsSUFBUyxFQUFPLEVBQUUsQ0FDNUQsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRWxGLE1BQU0sS0FBSyxHQUFHLENBQUMsT0FBOEIsRUFBWSxFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUUzRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxDQUFDLGFBQTZCLEVBQUUsU0FBa0IsRUFBb0MsRUFBRSxDQUMxSSxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ2YsTUFBTSxRQUFRLEdBQUcsYUFBYSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNsRyxNQUFNLElBQUksR0FBRyxpQ0FBaUMsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMxRCxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsS0FBSyxDQUFDLFFBQVEsRUFBRSxRQUFRLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDaEUsSUFBSSxRQUFRLEtBQUssSUFBSTtRQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsbUJBQW1CLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQztJQUM1RyxJQUFJLFlBQVksQ0FBQyxFQUFFLEdBQUcsUUFBUSxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLEVBQUUsSUFBSSxDQUFDO1FBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsQ0FBQztJQUNqRyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQztRQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxvQkFBb0IsRUFBRSxDQUFDO0lBQ3RHLElBQUksZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQztJQUN2SCxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxvQkFBb0IsRUFBRSxDQUFDO0lBQ3JJLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxFQUFFLFdBQVcsRUFBRSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDOUcsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztBQUN6RyxDQUFDLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2FkZHJlc3NwbGFuLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9uZXR3b3JrYWRkcmVzc3BsYW4udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLDZDQUE2QyxFQUFFLCtCQUErQixFQUNyRix3Q0FBd0MsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQzFFLE9BQU8sRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLGVBQWUsRUFBRSxjQUFjLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUN0SCxlQUFlLEVBQUUsYUFBYSxFQUFFLG1CQUFtQixFQUFFLG9CQUFvQixFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQ3JHLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBb0V4RCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzdELEVBQUUsRUFBRSxjQUFjO0lBQ2xCOzs7T0FHRztJQUNILDBCQUEwQixFQUFFLEVBQUU7SUFDOUI7Ozs7OztPQU1HO0lBQ0gsYUFBYSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDM0IsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsY0FBYyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLENBQUM7UUFDN0UsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLENBQUM7S0FDakYsQ0FBQztDQUNNLENBQUMsQ0FBQztBQUtaLDJGQUEyRjtBQUMzRixNQUFNLE9BQU8sR0FBRyxDQUFDLEdBQTBCLEVBQUUsU0FBc0MsRUFBaUIsRUFBRSxDQUNwRyxTQUFTLEtBQUssTUFBTSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDO0FBRTFELE1BQU0sWUFBWSxHQUFHLENBQTJCLElBQU8sRUFBRSxLQUFRLEVBQVUsRUFBRSxDQUMzRSxJQUFJLENBQUMsRUFBRSxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxHQUFHLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRXZELE1BQU0sS0FBSyxHQUFHLENBQUMsS0FBYyxFQUF5QixFQUFFO0lBQ3RELE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxXQUFXLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxlQUFlLENBQUMsQ0FBQyxDQUFDO0lBQ3pGLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBYyxFQUFpQixFQUFFLENBQUMsS0FBSyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3JHLE1BQU0sR0FBRyxHQUEwQixFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztRQUMzRyxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxhQUFhLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO0lBQzNFLDhGQUE4RjtJQUM5RixjQUFjLENBQUMsaUNBQWlDLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLFNBQVMsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUM7SUFDbEgsT0FBTyxHQUFHLENBQUM7QUFDYixDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FBQyxRQUFpQixFQUEwRCxFQUFFLENBQ3pILFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDZixNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDNUMsT0FBTyxpQ0FBaUMsQ0FBQyxhQUFhO1NBQ25ELE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxDQUFDLFNBQVMsQ0FBQyxLQUFLLElBQUksQ0FBQztTQUNuRCxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLEdBQUcsR0FBRyxDQUFDLFNBQVMsSUFBSSxHQUFHLENBQUMsY0FBYyxFQUFFLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxPQUFPO1FBQy9FLFFBQVEsRUFBRSxHQUFHLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxTQUFTLENBQVcsRUFBRSxDQUFDLENBQUM7U0FDeEUsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ3hCLENBQUMsQ0FBQyxDQUFDO0FBRUw7Ozs7R0FJRztBQUNILE1BQU0sZUFBZSxHQUEyQztJQUM5RCxFQUFFLEVBQUUsY0FBYyxFQUFFLFVBQVUsRUFBRSxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsY0FBYyxFQUFFLEtBQUssRUFBRSxjQUFjLEVBQUU7SUFDN0csUUFBUSxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxDQUFDLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxnQkFBZ0IsRUFBRSxjQUFjLEVBQUUsQ0FBQztDQUNsRyxDQUFDO0FBQ0YsTUFBTSxjQUFjLEdBQUcsVUFBVSxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxFQUFtQixDQUFDO0FBSW5FLHNGQUFzRjtBQUN0RixNQUFNLFdBQVcsR0FBRyxDQUNsQixJQUEyQyxFQUFFLEtBQW9FLEVBQzlFLEVBQUUsQ0FBQyx3Q0FBd0MsQ0FBQyxFQUFFLEVBQUUsRUFBRSxLQUFLLENBQUMsRUFBRTtJQUM3RixVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsRUFBRSxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsRUFBRSxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVEsRUFBRSxpQkFBaUIsRUFBRSxLQUFLLENBQUMsaUJBQWlCO0lBQ2hJLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFLGlCQUFpQixFQUFFLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQztBQUU5SSxNQUFNLFlBQVksR0FBRyxDQUFDLElBQWdDLEVBQUUsSUFBNkIsRUFBa0IsRUFBRSxDQUFDLENBQUM7SUFDekcsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO0lBQ3JFLGlCQUFpQixFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLDZCQUE2QixDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDO0NBQ2xILENBQUMsQ0FBQztBQUVILE1BQU0sS0FBSyxHQUFHLENBQUMsS0FBYyxFQUFxQyxFQUFFO0lBQ2xFLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxlQUFlLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUNsRSxNQUFNLGFBQWEsR0FBRyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDL0QsY0FBYyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksaUNBQWlDLENBQUMsMEJBQTBCLENBQUMsQ0FBQztJQUNwSCxPQUFPLEVBQUUsYUFBYSxFQUFFLFNBQVMsRUFBRSxhQUFhLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDckUsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxTQUE0QyxFQUFFLEdBQXNDLEVBQVEsRUFBRTtJQUN6SCxNQUFNLFNBQVMsR0FBRyxDQUFDLEdBQUcsU0FBUyxDQUFDLFNBQVMsRUFBRSxHQUFHLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO0lBQzNFLGNBQWMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxhQUFhLEVBQUUsR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUMvRCxTQUFTLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLGVBQWUsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7V0FDM0QsU0FBUyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1dBQ3BFLFNBQVMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxNQUFNLEVBQUUsR0FBRyxRQUFRLENBQUMsT0FBTyxLQUFLLENBQUMsQ0FBQyxDQUFDO1dBQ2xGLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxhQUFhLEVBQUUsR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7QUFDM0QsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsS0FBYyxFQUE4QixFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRTtJQUNoSCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxVQUFVLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxtQkFBbUIsRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ3BJLGNBQWMsQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLGlDQUFpQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2pFLE1BQU0sR0FBRyxHQUFHLFdBQVcsQ0FBQyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztRQUM3RixpQkFBaUIsRUFBRSxJQUFJLENBQUMsaUJBQWlCLEVBQUUsRUFBRSxlQUFlLENBQUMsQ0FBQztJQUNoRSxNQUFNLElBQUksR0FBK0IsRUFBRSxFQUFFLEVBQUUsaUNBQWlDLENBQUMsRUFBRSxFQUFFLFFBQVEsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQztRQUMxSCxRQUFRLEVBQUUsR0FBRyxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsR0FBRyxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVMsRUFBRSxpQkFBaUIsRUFBRSxHQUFHLENBQUMsaUJBQWlCLEVBQUUsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztJQUN2SSxtQkFBbUIsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ25DLE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDLENBQUM7QUFFSDs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxLQUFLLEVBQzFELFNBQWtCLEVBQUUsVUFBbUIsRUFBRSxTQUFrQixFQUNmLEVBQUU7SUFDOUMsSUFBSSxDQUFDO1FBQ0gsTUFBTSxJQUFJLEdBQUcsaUNBQWlDLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDMUQsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUUsWUFBWSxFQUFFLFVBQVUsRUFBRSxtQkFBbUIsQ0FBQyxDQUFDLENBQUM7UUFDN0gsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLGNBQWMsQ0FBQyxTQUFTLENBQUMsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0IsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNySCxjQUFjLENBQUMsSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsTUFBTTtlQUN0RSxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLEdBQUcsR0FBRyxDQUFDLE9BQU8sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xGLE1BQU0sU0FBUyxHQUFHLFdBQVcsQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQy9ELE9BQU8sRUFBRSxHQUFHLFNBQVMsRUFBRSxNQUFNLEVBQUUsTUFBTSw2Q0FBNkMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0lBQ2xHLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRiwwR0FBMEc7QUFDMUcsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFrQixFQUFFLE1BQWMsRUFBVyxFQUFFO0lBQ2hFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEdBQUcsbUJBQW1CLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDbEQsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxTQUFTLEVBQUUsRUFBRTtRQUNqRCxNQUFNLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxHQUFHLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ25ELE9BQU8sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQzVFLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNOLE9BQU8sT0FBTyxLQUFLLElBQUksR0FBRyxLQUFLLEdBQUcsQ0FBQyxDQUFDO0FBQ3RDLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sZ0JBQWdCLEdBQUcsQ0FBSSxRQUFhLEVBQUUsSUFBUyxFQUFPLEVBQUUsQ0FDNUQsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRWxGLE1BQU0sS0FBSyxHQUFHLENBQUMsT0FBOEIsRUFBWSxFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUUzRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxDQUFDLGFBQTZCLEVBQUUsU0FBa0IsRUFBb0MsRUFBRSxDQUMxSSxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ2YsTUFBTSxRQUFRLEdBQUcsYUFBYSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNsRyxNQUFNLElBQUksR0FBRyxpQ0FBaUMsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMxRCxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsS0FBSyxDQUFDLFFBQVEsRUFBRSxRQUFRLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDaEUsSUFBSSxRQUFRLEtBQUssSUFBSTtRQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxFQUFFLFdBQVcsRUFBRSxFQUFFLEVBQUUsbUJBQW1CLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQztJQUM1RyxJQUFJLFlBQVksQ0FBQyxFQUFFLEdBQUcsUUFBUSxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxFQUFFLEVBQUUsSUFBSSxDQUFDO1FBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsQ0FBQztJQUNqRyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQztRQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxvQkFBb0IsRUFBRSxDQUFDO0lBQ3RHLElBQUksZ0JBQWdCLENBQUMsUUFBUSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7UUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQztJQUN2SCxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxvQkFBb0IsRUFBRSxDQUFDO0lBQ3JJLE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxFQUFFLFdBQVcsRUFBRSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDOUcsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQztBQUN6RyxDQUFDLENBQUMsQ0FBQyJ9

package/dist_ts/data/networkcredential.d.ts

@@ -1,4 +1,5 @@
 import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import { type TRuntimeNetworkVpnTransport } from './networkaddressplan.js';
 import { type IRuntimeSessionBinding } from './runtimesession.js';
 export interface IGetRuntimeManagedVpnCredentialRequest {
     session: IRuntimeSessionBinding;
@@ -8,12 +9,20 @@ export interface IGetRuntimeManagedVpnCredentialRequest {
  * persist, hash, log, or include it in a signed network projection. The native
  * Noise owner validates and uses the keys; these shapes confer no TUN readiness. */
 export interface IGetRuntimeManagedVpnCredentialResponse extends IGetRuntimeManagedVpnCredentialRequest {
-    transport: 'quic';
-    relay: {
+    transport: TRuntimeNetworkVpnTransport;
+    /** The cluster hub endpoint this node dials, named by the id its signed projection selected. */
+    hub: {
         id: string;
         address: string;
         port: number;
     };
+    /**
+     * The TLS name the hub's WebSocket transport is dialled under, present exactly when `transport`
+     * is `websocket` and absent otherwise: QUIC is dialled on the address alone. It is the hub
+     * relay's own origin hostname, which the node cross-checks against the relay origin it stores,
+     * so a name the node does not already trust ends the handshake before any native effect.
+     */
+    serverName?: string;
     authorityId: string;
     serverPublicKey: string;
     clientPublicKey: string;
@@ -29,8 +38,8 @@ export declare const snapshotGetRuntimeManagedVpnCredentialResponse: (value: unk
 /** Content binding only. The caller must resolve the exact current projection
  * and authenticate/fence the current physical peer before and after native work. */
 export declare const bindGetRuntimeManagedVpnCredentialRequest: (value: unknown, projectionValue: unknown, trustedSessionValue: unknown) => Promise<IGetRuntimeManagedVpnCredentialRequest>;
-/** Bind the secret response to the original request and exact selected router
- * UDP endpoint, inside the projection's effective DNS window. renewalValue is the
+/** Bind the secret response to the original request and the exact selected router
+ * endpoint of the credential's transport, inside the projection's effective DNS window. renewalValue is the
  * bare lease renewal the caller already verified and admitted for this exact
  * projection, or null; this helper verifies no signature. Time is caller-qualified;
  * this helper does not sample a clock, authenticate a transport, admit policy or

package/dist_ts/data/networkcredential.js

@@ -1,28 +1,44 @@
+import { runtimeNetworkAddressPlanContract } from './networkaddressplan.js';
 import { snapshotRuntimeSessionBinding } from './runtimesession.js';
 import { validateRuntimeNetworkProjection } from './networkprojection.js';
 import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
-import { captureNetwork, failNetwork, networkCounter, networkEffectiveDnsWindow, networkEqual, networkId, networkIpv4, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
-/** Canonical 32-byte key encoding only. Cryptographic key agreement and pair
- * validation belong to the native Noise implementation, not this JSON parser. */
-const key = (value) => {
-    requireNetwork(typeof value === 'string' && /^[A-Za-z0-9+/]{43}=$/.test(value));
-    const decoded = atob(value);
-    requireNetwork(decoded.length === 32 && btoa(decoded) === value && [...decoded].some(byte => byte.charCodeAt(0) !== 0));
-    return value;
-};
+import { captureNetwork, failNetwork, networkCounter, networkEffectiveDnsWindow, networkEqual, networkId, networkIpv4, networkNoiseKey, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
 export const snapshotGetRuntimeManagedVpnCredentialRequest = (value) => networkSafe(() => {
     const item = networkRecord(captureNetwork(value), ['session', 'projection']);
     return { session: snapshotRuntimeSessionBinding(item.session), projection: networkReference(item.projection) };
 });
+/**
+ * The TLS name a WebSocket hub is dialled under: a lower-case domain name of at least two labels,
+ * which is what a relay origin's hostname is and what a certificate can be issued for. An address
+ * literal is not one, so a node can never be sent to a name nothing vouches for.
+ */
+const serverName = (value) => {
+    requireNetwork(typeof value === 'string' && value.length <= 253);
+    const labels = value.split('.');
+    // The last label starts with a letter, which is what makes this a name and not an address
+    // literal: a hub reached by address is reached over QUIC, which needs no name at all.
+    requireNetwork(labels.length >= 2 && labels.every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))
+        && /^[a-z]/.test(labels[labels.length - 1]));
+    return value;
+};
+const transportOf = (value) => {
+    const row = runtimeNetworkAddressPlanContract.hubTransports.find(candidate => candidate.transport === value);
+    requireNetwork(row);
+    return row.transport;
+};
 export const snapshotGetRuntimeManagedVpnCredentialResponse = (value) => networkSafe(() => {
-    const item = networkRecord(captureNetwork(value), ['session', 'projection', 'transport', 'relay', 'authorityId',
-        'serverPublicKey', 'clientPublicKey', 'clientPrivateKey', 'expiresAt']);
-    const relay = networkRecord(item.relay, ['id', 'address', 'port']);
-    requireNetwork(item.transport === 'quic');
-    return { session: snapshotRuntimeSessionBinding(item.session), projection: networkReference(item.projection), transport: 'quic',
-        relay: { id: networkId(relay.id), address: networkIpv4(relay.address), port: networkCounter(relay.port, 65535) },
-        authorityId: networkId(item.authorityId), serverPublicKey: key(item.serverPublicKey), clientPublicKey: key(item.clientPublicKey),
-        clientPrivateKey: key(item.clientPrivateKey), expiresAt: networkCounter(item.expiresAt) };
+    const item = networkRecord(captureNetwork(value), ['session', 'projection', 'transport', 'hub', 'authorityId',
+        'serverPublicKey', 'clientPublicKey', 'clientPrivateKey', 'expiresAt'], ['serverName']);
+    const hub = networkRecord(item.hub, ['id', 'address', 'port']), transport = transportOf(item.transport);
+    // A name belongs to the one transport that is dialled by name; stating it for QUIC would name a
+    // trust the node never checks, and omitting it for WebSocket leaves the TLS identity unstated.
+    requireNetwork(Object.hasOwn(item, 'serverName') === (transport === 'websocket'));
+    return { session: snapshotRuntimeSessionBinding(item.session), projection: networkReference(item.projection), transport,
+        hub: { id: networkId(hub.id), address: networkIpv4(hub.address), port: networkCounter(hub.port, 65535) },
+        ...(transport === 'websocket' ? { serverName: serverName(item.serverName) } : {}),
+        authorityId: networkId(item.authorityId), serverPublicKey: networkNoiseKey(item.serverPublicKey),
+        clientPublicKey: networkNoiseKey(item.clientPublicKey), clientPrivateKey: networkNoiseKey(item.clientPrivateKey),
+        expiresAt: networkCounter(item.expiresAt) };
 });
 const bindRequest = (request, projection, trusted) => {
     requireNetwork(networkEqual(request.session, trusted) && networkEqual(request.projection, networkReferenceOf(projection))
@@ -42,8 +58,8 @@ export const bindGetRuntimeManagedVpnCredentialRequest = async (value, projectio
         return failNetwork();
     }
 };
-/** Bind the secret response to the original request and exact selected router
- * UDP endpoint, inside the projection's effective DNS window. renewalValue is the
+/** Bind the secret response to the original request and the exact selected router
+ * endpoint of the credential's transport, inside the projection's effective DNS window. renewalValue is the
  * bare lease renewal the caller already verified and admitted for this exact
  * projection, or null; this helper verifies no signature. Time is caller-qualified;
  * this helper does not sample a clock, authenticate a transport, admit policy or
@@ -59,9 +75,11 @@ export const bindGetRuntimeManagedVpnCredentialResponse = async (value, requestV
         const window = networkEffectiveDnsWindow(projection, renewal);
         bindRequest(request, projection, trusted);
         requireNetwork(networkEqual(response.session, request.session) && networkEqual(response.projection, request.projection));
-        requireNetwork(projection.router?.platformEndpointIds.includes(response.relay.id));
-        const endpoint = projection.protectedAuthority.platformEndpoints.find(item => item.id === response.relay.id);
-        requireNetwork(endpoint && endpoint.protocol === 'udp' && endpoint.address === response.relay.address && endpoint.port === response.relay.port);
+        requireNetwork(projection.router?.platformEndpointIds.includes(response.hub.id));
+        const endpoint = projection.protectedAuthority.platformEndpoints.find(item => item.id === response.hub.id);
+        const expected = runtimeNetworkAddressPlanContract.hubTransports.find(row => row.transport === response.transport);
+        requireNetwork(endpoint && expected && endpoint.protocol === expected.protocol
+            && endpoint.address === response.hub.address && endpoint.port === response.hub.port);
         requireNetwork(window.notBefore <= now && now < response.expiresAt && response.expiresAt <= window.expiresAt);
         return response;
     }
@@ -69,4 +87,4 @@ export const bindGetRuntimeManagedVpnCredentialResponse = async (value, requestV
         return failNetwork();
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSw2QkFBNkIsRUFBK0IsTUFBTSxxQkFBcUIsQ0FBQztBQUNqRyxPQUFPLEVBQUUsZ0NBQWdDLEVBQWtDLE1BQU0sd0JBQXdCLENBQUM7QUFDMUcsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLHFDQUFxQyxFQUFFLE1BQU0sbUJBQW1CLENBQUM7QUFDakgsT0FBTyxFQUFFLGNBQWMsRUFBRSxXQUFXLEVBQUUsY0FBYyxFQUFFLHlCQUF5QixFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUNuSCxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBd0I1STtpRkFDaUY7QUFDakYsTUFBTSxHQUFHLEdBQUcsQ0FBQyxLQUFjLEVBQVUsRUFBRTtJQUNyQyxjQUFjLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2hGLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM1QixjQUFjLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxFQUFFLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEtBQUssSUFBSSxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3hILE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FBQyxLQUFjLEVBQTBDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3hJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM3RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDakgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUFDLEtBQWMsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxhQUFhO1FBQzdHLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDMUUsTUFBTSxLQUFLLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsS0FBSyxNQUFNLENBQUMsQ0FBQztJQUM5RyxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLFNBQVMsRUFBRSxNQUFNO1FBQzdILEtBQUssRUFBRSxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSxjQUFjLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsRUFBRTtRQUNoSCxXQUFXLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxlQUFlLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxlQUFlLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDaEksZ0JBQWdCLEVBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLFNBQVMsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDOUYsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQStDLEVBQ2xFLFVBQXFDLEVBQUUsT0FBK0IsRUFBUSxFQUFFO0lBQ2hGLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztXQUNwSCxnQkFBZ0IsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLElBQUksVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQ3BFLENBQUMsQ0FBQztBQUVGO29GQUNvRjtBQUNwRixNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLGVBQXdCLEVBQ3RHLG1CQUE0QixFQUFtRCxFQUFFO0lBQ2pGLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sT0FBTyxHQUFHLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDbkUsTUFBTSxVQUFVLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMzRSxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUY7Ozs7O3lDQUt5QztBQUN6QyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLFlBQXFCLEVBQ3BHLGVBQXdCLEVBQUUsbUJBQTRCLEVBQUUsUUFBaUIsRUFDekUsZUFBK0IsSUFBSSxFQUFvRCxFQUFFO0lBQ3pGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQzVFLE1BQU0sT0FBTyxHQUFHLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLEVBQUUsR0FBRyxHQUFHLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNuRyxNQUFNLFlBQVksR0FBRyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3hHLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsTUFBTSxPQUFPLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3pHLE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM5RCxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxQyxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3pILGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDbkYsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGtCQUFrQixDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3RyxjQUFjLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxRQUFRLEtBQUssS0FBSyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLEtBQUssQ0FBQyxPQUFPLElBQUksUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2hKLGNBQWMsQ0FBQyxNQUFNLENBQUMsU0FBUyxJQUFJLEdBQUcsSUFBSSxHQUFHLEdBQUcsUUFBUSxDQUFDLFNBQVMsSUFBSSxRQUFRLENBQUMsU0FBUyxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM5RyxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxpQ0FBaUMsRUFBb0MsTUFBTSx5QkFBeUIsQ0FBQztBQUM5RyxPQUFPLEVBQUUsNkJBQTZCLEVBQStCLE1BQU0scUJBQXFCLENBQUM7QUFDakcsT0FBTyxFQUFFLGdDQUFnQyxFQUFrQyxNQUFNLHdCQUF3QixDQUFDO0FBQzFHLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ2pILE9BQU8sRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLGNBQWMsRUFBRSx5QkFBeUIsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFDbkgsZUFBZSxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLEVBQ25HLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBZ0N4RCxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUFDLEtBQWMsRUFBMEMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDeEksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQzdFLE9BQU8sRUFBRSxPQUFPLEVBQUUsNkJBQTZCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztBQUNqSCxDQUFDLENBQUMsQ0FBQztBQUVIOzs7O0dBSUc7QUFDSCxNQUFNLFVBQVUsR0FBRyxDQUFDLEtBQWMsRUFBVSxFQUFFO0lBQzVDLGNBQWMsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sSUFBSSxHQUFHLENBQUMsQ0FBQztJQUNqRSxNQUFNLE1BQU0sR0FBSSxLQUFnQixDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUM1QywwRkFBMEY7SUFDMUYsc0ZBQXNGO0lBQ3RGLGNBQWMsQ0FBQyxNQUFNLENBQUMsTUFBTSxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsd0NBQXdDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1dBQzNHLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9DLE9BQU8sS0FBZSxDQUFDO0FBQ3pCLENBQUMsQ0FBQztBQUVGLE1BQU0sV0FBVyxHQUFHLENBQUMsS0FBYyxFQUErQixFQUFFO0lBQ2xFLE1BQU0sR0FBRyxHQUFHLGlDQUFpQyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLEtBQUssQ0FBQyxDQUFDO0lBQzdHLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUFDLE9BQU8sR0FBRyxDQUFDLFNBQVMsQ0FBQztBQUM1QyxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUFDLEtBQWMsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxhQUFhO1FBQzNHLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUMxRixNQUFNLEdBQUcsR0FBRyxhQUFhLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxTQUFTLEdBQUcsV0FBVyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUN4RyxnR0FBZ0c7SUFDaEcsK0ZBQStGO0lBQy9GLGNBQWMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxZQUFZLENBQUMsS0FBSyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQ2xGLE9BQU8sRUFBRSxPQUFPLEVBQUUsNkJBQTZCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsU0FBUztRQUNySCxHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxJQUFJLEVBQUUsY0FBYyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLEVBQUU7UUFDeEcsR0FBRyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2pGLFdBQVcsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxFQUFFLGVBQWUsRUFBRSxlQUFlLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQztRQUNoRyxlQUFlLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxlQUFlLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDO1FBQ2hILFNBQVMsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDaEQsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQStDLEVBQ2xFLFVBQXFDLEVBQUUsT0FBK0IsRUFBUSxFQUFFO0lBQ2hGLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztXQUNwSCxnQkFBZ0IsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLElBQUksVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQ3BFLENBQUMsQ0FBQztBQUVGO29GQUNvRjtBQUNwRixNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLGVBQXdCLEVBQ3RHLG1CQUE0QixFQUFtRCxFQUFFO0lBQ2pGLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sT0FBTyxHQUFHLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDbkUsTUFBTSxVQUFVLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMzRSxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUY7Ozs7O3lDQUt5QztBQUN6QyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLFlBQXFCLEVBQ3BHLGVBQXdCLEVBQUUsbUJBQTRCLEVBQUUsUUFBaUIsRUFDekUsZUFBK0IsSUFBSSxFQUFvRCxFQUFFO0lBQ3pGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQzVFLE1BQU0sT0FBTyxHQUFHLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLEVBQUUsR0FBRyxHQUFHLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNuRyxNQUFNLFlBQVksR0FBRyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3hHLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsTUFBTSxPQUFPLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3pHLE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM5RCxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxQyxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3pILGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDakYsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGtCQUFrQixDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUMzRyxNQUFNLFFBQVEsR0FBRyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDbkgsY0FBYyxDQUFDLFFBQVEsSUFBSSxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtlQUN6RSxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxHQUFHLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN2RixjQUFjLENBQUMsTUFBTSxDQUFDLFNBQVMsSUFBSSxHQUFHLElBQUksR0FBRyxHQUFHLFFBQVEsQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLFNBQVMsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDOUcsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQyJ9

package/dist_ts/data/runtimeassignment.d.ts

@@ -41,7 +41,20 @@ export interface IRuntimeAssignment extends IRuntimeAssignmentScope {
     /** No automatic relocation or expiry-based claim of a stopped writer. */
     offlinePolicy: 'continue-node-bound';
     workload: {
+        /**
+         * The registry that published this image, which is the publication identity the image release
+         * is bound to. It is never rewritten: only `pullEndpoint` decides where the bytes are fetched.
+         */
         registryHost: string;
+        /**
+         * Where this node fetches the image instead of `registryHost`, as `host[:port]`.
+         *
+         * A cluster whose relay forwards the registry states the relay's own origin here, so a node
+         * pulls inside its cluster and nothing cluster-side dials the control plane. Absent when the
+         * node pulls from the publishing registry itself. The reference stays digest-pinned either
+         * way, so the endpoint decides reachability and never content.
+         */
+        pullEndpoint?: string;
         repository: string;
         imageDigest: TSha256Digest;
         platform: TImmutableContainerPlatform;
@@ -70,6 +83,16 @@ export type TRuntimeWorkloadAuthority = (typeof runtimeWorkloadAuthorities)[numb
  * `TypeError` out of a member read.
  */
 export declare const requiredWorkloadAuthorities: (workloadArg: IRuntimeAssignment["workload"]) => TRuntimeWorkloadAuthority[];
+/**
+ * The digest-pinned image reference a node pulls this workload by.
+ *
+ * One function decides where the bytes come from: the stated `pullEndpoint`, else the publishing
+ * `registryHost`. The digest is the same either way, so a node that pulls through its cluster's
+ * relay fetches exactly the content the publishing registry named, and a controller and a node can
+ * never disagree about the reference. The workload is read as a wire value, so one whose members
+ * this contract refuses is refused here rather than by a member read.
+ */
+export declare const buildRuntimeAssignmentImageReference: (workloadArg: IRuntimeAssignment["workload"]) => string;
 /** True when a value is exactly a canonical authority list drawn from the authority vocabulary. */
 export declare const isResolvedWorkloadAuthorities: (valueArg: unknown) => valueArg is TRuntimeWorkloadAuthority[];
 export type TRuntimeAssignmentDecision = {