@serve.zone/interfaces 32.31.0 → 32.33.0

package/changelog.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 2026-09-28 - 32.33.0
+
+### Features
+
+- Deployment machine users can be created through the contract. `requests.admin.mutateDeploymentMachineUser`
+  creates a user (`create`), replaces its token (`rotate-token`) or removes its tokens
+  (`revoke-token`), keyed by a `mutationId` for replay. The token is answered once, on the first
+  answer to `create` or `rotate-token`. `requests.admin.getDeploymentMachineUsers` lists the users
+  as value-free `data.IDeploymentMachineUserMetadata`: id, username, token expiries and grants.
+  `data.snapshotDeploymentMachineUserMutation`, `data.snapshotDeploymentMachineUserMetadata`,
+  `data.isDeploymentMachineUsername`, `data.isDeploymentMachineTokenExpiryAdmissible` and
+  `data.deploymentMachineUserContract` state the rules. The refusal names are
+  `data.deploymentMachineUserRefusals`, carried as `data.IDeploymentMachineUserErrorData`. Until now
+  nothing in the contract could create the API machine user that `configureServiceDeploymentMachineUser`
+  requires, so a fresh Cloudly could not complete an immutable deployment.
+- `DEPLOYMENT_MACHINE_IDENTITY_REQUIRED` joins `data.deploymentPreflightBlockerCodes`.
+  `reserveServiceDeployment` refuses, with this code, any actor that is not an API machine user,
+  an administrator included, because only that user's registry push is bound to the operation it
+  reserved.
+
+## 2026-09-28 - 32.32.0
+
+### Features
+
+- `findRuntimeNetworkPublishedPortInsideOverlap(ports)` returns the first `{ symmetric, other }`
+  pair of a published-port list in which a `symmetric` entry shares an inside (target) port with
+  another entry of its protocol, or `null`, so Cloudly can refuse a policy write by name
+  (`published-port-symmetric-inside-overlap`) before the snapshot's generic refusal.
+
+### Fixes
+
+- A `symmetric` published port owns its inside ports. `snapshotServicePublishedPorts`,
+  `snapshotSetServicePublishedPorts` and every projection endpoint's `publishedPorts` refuse a
+  symmetric entry whose target port, or any port of its range, is also the target of another entry
+  of the same protocol in that list (such as tcp 80→8000 symmetric beside tcp 443→8000), symmetric
+  or not. The packet engine refuses such a publication because the workload's flows from that port
+  would have two published sources, so a node only discovered it at compile time. Lists without a
+  symmetric entry, and entries of different protocols, are unaffected; every list valid before and
+  outside this rule keeps its bytes and its projection digest.
+
 ## 2026-09-27 - 32.31.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.31.0',
+    version: '32.33.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/deploymentmachineuser.d.ts

@@ -0,0 +1,94 @@
+import { type IServiceDeploymentGrant } from './user.js';
+/**
+ * A deployment machine user is the identity a deployer such as `@git.zone/tsdeploy` authenticates
+ * as: an API machine user that carries a bearer token and the deployment grants an administrator
+ * attaches with `configureServiceDeploymentMachineUser`. An administrator creates one, rotates or
+ * revokes its token, and lists them; nothing else mints one.
+ */
+export declare const deploymentMachineUserContract: Readonly<{
+    /** A token lives at most one year from the mutation that issued it, like every machine token. */
+    maximumTokenLifetimeMs: number;
+    /**
+     * The longest username a created user may take. The username is also the registry login name
+     * a deployer states, so it stays short, lowercase and free of `:` and `/`.
+     */
+    maximumCreatedUsernameLength: 64;
+    /** The longest stored username a listing reports, the bound Cloudly has always stored. */
+    maximumUsernameLength: 200;
+    /** Grants one user carries at most. */
+    maximumGrants: 64;
+    /** Tokens one listed user reports at most. */
+    maximumTokens: 64;
+}>;
+/** One token of a deployment machine user, without its value. */
+export interface IDeploymentMachineTokenMetadata {
+    expiresAt: number;
+}
+/** Value-free metadata of one deployment machine user. No token value is ever part of it. */
+export interface IDeploymentMachineUserMetadata {
+    userId: string;
+    username: string;
+    /** Ascending by expiry; empty after `revoke-token`. */
+    tokens: IDeploymentMachineTokenMetadata[];
+    /** Sorted by `organizationId:serviceId`, as Cloudly stores them. */
+    grants: IServiceDeploymentGrant[];
+}
+interface IDeploymentMachineUserMutationBase {
+    /** Retain the complete mutation and this ID across retries. */
+    mutationId: string;
+}
+/**
+ * `create` makes a new user with one token; the username must not be taken by any user.
+ * `rotate-token` replaces every token of the user with one new token. `revoke-token` removes every
+ * token, which ends the user's authentication while keeping its grants for a later rotation.
+ */
+export type TDeploymentMachineUserMutation = IDeploymentMachineUserMutationBase & ({
+    operation: 'create';
+    username: string;
+    expiresAt: number;
+} | {
+    operation: 'rotate-token';
+    userId: string;
+    expiresAt: number;
+} | {
+    operation: 'revoke-token';
+    userId: string;
+});
+export interface IDeploymentMachineUserMutationResult {
+    /** Historical on replay; read `getDeploymentMachineUsers` for current state. */
+    user: IDeploymentMachineUserMetadata;
+    /**
+     * The new token, answered exactly once: on the first answer to `create` or `rotate-token`.
+     * `revoke-token` and every replay answer `null`; a lost token is replaced by a rotation.
+     */
+    token: string | null;
+    replayed: boolean;
+}
+/**
+ * Every refusal the deployment machine user requests name, as `IDeploymentMachineUserErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: the caller is not an administrator.
+ * - `DEPLOYMENT_MACHINE_USER_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DEPLOYMENT_MACHINE_USERNAME_TAKEN`: another user already has the username.
+ * - `DEPLOYMENT_MACHINE_USER_INVALID`: the user is not a deployment machine user (it does not
+ *   exist, or it is a human, cluster, administrator or service workload identity).
+ * - `DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID`: the expiry is not in the future, or is more than
+ *   `maximumTokenLifetimeMs` away (`isDeploymentMachineTokenExpiryAdmissible`).
+ * - `DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT`: the mutation ID was used for a different mutation
+ *   or by a different administrator.
+ */
+export declare const deploymentMachineUserRefusals: readonly ["ADMIN_AUTHORIZATION_REQUIRED", "DEPLOYMENT_MACHINE_USER_REQUEST_INVALID", "DEPLOYMENT_MACHINE_USERNAME_TAKEN", "DEPLOYMENT_MACHINE_USER_INVALID", "DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID", "DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT"];
+export type TDeploymentMachineUserRefusal = typeof deploymentMachineUserRefusals[number];
+export interface IDeploymentMachineUserErrorData {
+    code: TDeploymentMachineUserRefusal;
+    retryable: false;
+}
+/** Whether a username may be given to a new deployment machine user. */
+export declare const isDeploymentMachineUsername: (value: unknown) => value is string;
+/** Whether a token expiry is in the future and at most `maximumTokenLifetimeMs` after `now`. */
+export declare const isDeploymentMachineTokenExpiryAdmissible: (expiresAt: number, now: number) => boolean;
+/** Structural copy only; the backend authorizes the administrator and the target user. */
+export declare const snapshotDeploymentMachineUserMutation: (value: unknown) => TDeploymentMachineUserMutation;
+/** Structural copy of listed metadata: a stored username, tokens by expiry, valid sorted grants. */
+export declare const snapshotDeploymentMachineUserMetadata: (value: unknown) => IDeploymentMachineUserMetadata;
+export {};

package/dist_ts/data/deploymentmachineuser.js

@@ -0,0 +1,121 @@
+import { readDataElements, readDataProperty, readExactDataRecord } from '../private/dataproperties.js';
+import { validateServiceDeploymentGrant } from './user.js';
+/**
+ * A deployment machine user is the identity a deployer such as `@git.zone/tsdeploy` authenticates
+ * as: an API machine user that carries a bearer token and the deployment grants an administrator
+ * attaches with `configureServiceDeploymentMachineUser`. An administrator creates one, rotates or
+ * revokes its token, and lists them; nothing else mints one.
+ */
+export const deploymentMachineUserContract = Object.freeze({
+    /** A token lives at most one year from the mutation that issued it, like every machine token. */
+    maximumTokenLifetimeMs: 365 * 24 * 60 * 60 * 1000,
+    /**
+     * The longest username a created user may take. The username is also the registry login name
+     * a deployer states, so it stays short, lowercase and free of `:` and `/`.
+     */
+    maximumCreatedUsernameLength: 64,
+    /** The longest stored username a listing reports, the bound Cloudly has always stored. */
+    maximumUsernameLength: 200,
+    /** Grants one user carries at most. */
+    maximumGrants: 64,
+    /** Tokens one listed user reports at most. */
+    maximumTokens: 64,
+});
+/**
+ * Every refusal the deployment machine user requests name, as `IDeploymentMachineUserErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: the caller is not an administrator.
+ * - `DEPLOYMENT_MACHINE_USER_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DEPLOYMENT_MACHINE_USERNAME_TAKEN`: another user already has the username.
+ * - `DEPLOYMENT_MACHINE_USER_INVALID`: the user is not a deployment machine user (it does not
+ *   exist, or it is a human, cluster, administrator or service workload identity).
+ * - `DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID`: the expiry is not in the future, or is more than
+ *   `maximumTokenLifetimeMs` away (`isDeploymentMachineTokenExpiryAdmissible`).
+ * - `DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT`: the mutation ID was used for a different mutation
+ *   or by a different administrator.
+ */
+export const deploymentMachineUserRefusals = [
+    'ADMIN_AUTHORIZATION_REQUIRED',
+    'DEPLOYMENT_MACHINE_USER_REQUEST_INVALID',
+    'DEPLOYMENT_MACHINE_USERNAME_TAKEN',
+    'DEPLOYMENT_MACHINE_USER_INVALID',
+    'DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID',
+    'DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT',
+];
+const fail = () => { throw new Error('Deployment machine user contract rejected.'); };
+function requireValue(value) { if (!value)
+    fail(); }
+const safe = (operation) => { try {
+    return operation();
+}
+catch {
+    return fail();
+} };
+/** Exactly this shape's keys, read once as data; an accessor is refused, never invoked. */
+const object = (value, keys) => {
+    const copy = readExactDataRecord(value, keys);
+    requireValue(copy !== null);
+    return copy;
+};
+const identifier = (value) => {
+    requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+    return value;
+};
+const timestamp = (value) => {
+    requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0);
+    return value;
+};
+const createdUsernamePattern = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;
+/** Whether a username may be given to a new deployment machine user. */
+export const isDeploymentMachineUsername = (value) => (typeof value === 'string' && createdUsernamePattern.test(value));
+/** Whether a token expiry is in the future and at most `maximumTokenLifetimeMs` after `now`. */
+export const isDeploymentMachineTokenExpiryAdmissible = (expiresAt, now) => (Number.isSafeInteger(expiresAt) && Number.isSafeInteger(now) && expiresAt > now
+    && expiresAt <= now + deploymentMachineUserContract.maximumTokenLifetimeMs);
+/** Structural copy only; the backend authorizes the administrator and the target user. */
+export const snapshotDeploymentMachineUserMutation = (value) => safe(() => {
+    const operation = readDataProperty(value, 'operation')?.value;
+    requireValue(operation === 'create' || operation === 'rotate-token' || operation === 'revoke-token');
+    if (operation === 'create') {
+        const request = object(value, ['mutationId', 'operation', 'username', 'expiresAt']);
+        requireValue(isDeploymentMachineUsername(request.username));
+        return { mutationId: identifier(request.mutationId), operation, username: request.username,
+            expiresAt: timestamp(request.expiresAt) };
+    }
+    if (operation === 'rotate-token') {
+        const request = object(value, ['mutationId', 'operation', 'userId', 'expiresAt']);
+        return { mutationId: identifier(request.mutationId), operation, userId: identifier(request.userId),
+            expiresAt: timestamp(request.expiresAt) };
+    }
+    const request = object(value, ['mutationId', 'operation', 'userId']);
+    return { mutationId: identifier(request.mutationId), operation, userId: identifier(request.userId) };
+});
+/** Structural copy of listed metadata: a stored username, tokens by expiry, valid sorted grants. */
+export const snapshotDeploymentMachineUserMetadata = (value) => safe(() => {
+    const metadata = object(value, ['userId', 'username', 'tokens', 'grants']);
+    requireValue(typeof metadata.username === 'string' && metadata.username.length > 0
+        && metadata.username.length <= deploymentMachineUserContract.maximumUsernameLength
+        && metadata.username.trim() === metadata.username && !/[\u0000-\u001f\u007f]/.test(metadata.username));
+    const tokenEntries = readDataElements(metadata.tokens, deploymentMachineUserContract.maximumTokens);
+    requireValue(tokenEntries !== null);
+    const tokens = tokenEntries.map((entry) => ({ expiresAt: timestamp(object(entry, ['expiresAt']).expiresAt) }));
+    for (let index = 1; index < tokens.length; index++) {
+        requireValue(tokens[index - 1].expiresAt <= tokens[index].expiresAt);
+    }
+    const grantEntries = readDataElements(metadata.grants, deploymentMachineUserContract.maximumGrants);
+    requireValue(grantEntries !== null);
+    const grants = grantEntries.map((entry) => {
+        const grant = object(entry, ['scope', 'organizationId', 'serviceId', 'capabilities']);
+        const capabilities = readDataElements(grant.capabilities, 64);
+        requireValue(capabilities !== null);
+        const copy = { scope: grant.scope, organizationId: grant.organizationId, serviceId: grant.serviceId,
+            capabilities: [...capabilities] };
+        requireValue(validateServiceDeploymentGrant(copy).length === 0);
+        return copy;
+    });
+    const grantKeys = grants.map((grant) => `${grant.organizationId}:${grant.serviceId}`);
+    for (let index = 1; index < grantKeys.length; index++) {
+        requireValue(grantKeys[index - 1].localeCompare(grantKeys[index]) < 0);
+    }
+    return { userId: identifier(metadata.userId), username: metadata.username, tokens, grants };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudG1hY2hpbmV1c2VyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9kZXBsb3ltZW50bWFjaGluZXVzZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGdCQUFnQixFQUFFLGdCQUFnQixFQUFFLG1CQUFtQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDdkcsT0FBTyxFQUFFLDhCQUE4QixFQUFnQyxNQUFNLFdBQVcsQ0FBQztBQUV6Rjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDekQsaUdBQWlHO0lBQ2pHLHNCQUFzQixFQUFFLEdBQUcsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJO0lBQ2pEOzs7T0FHRztJQUNILDRCQUE0QixFQUFFLEVBQUU7SUFDaEMsMEZBQTBGO0lBQzFGLHFCQUFxQixFQUFFLEdBQUc7SUFDMUIsdUNBQXVDO0lBQ3ZDLGFBQWEsRUFBRSxFQUFFO0lBQ2pCLDhDQUE4QztJQUM5QyxhQUFhLEVBQUUsRUFBRTtDQUNsQixDQUFDLENBQUM7QUE0Q0g7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUc7SUFDM0MsOEJBQThCO0lBQzlCLHlDQUF5QztJQUN6QyxtQ0FBbUM7SUFDbkMsaUNBQWlDO0lBQ2pDLHlDQUF5QztJQUN6QywyQ0FBMkM7Q0FDbkMsQ0FBQztBQVNYLE1BQU0sSUFBSSxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsNENBQTRDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM3RixTQUFTLFlBQVksQ0FBQyxLQUFjLElBQW1CLElBQUksQ0FBQyxLQUFLO0lBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQzVFLE1BQU0sSUFBSSxHQUFHLENBQUksU0FBa0IsRUFBSyxFQUFFLEdBQUcsSUFBSSxDQUFDO0lBQUMsT0FBTyxTQUFTLEVBQUUsQ0FBQztBQUFDLENBQUM7QUFBQyxNQUFNLENBQUM7SUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0FBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNwRywyRkFBMkY7QUFDM0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxLQUFjLEVBQUUsSUFBdUIsRUFBMkIsRUFBRTtJQUNsRixNQUFNLElBQUksR0FBRyxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUMsWUFBWSxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsQ0FBQztJQUM1QixPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQztBQUNGLE1BQU0sVUFBVSxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDNUMsWUFBWSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUM3RixPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQztBQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDM0MsWUFBWSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNwRixPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQztBQUNGLE1BQU0sc0JBQXNCLEdBQUcsMENBQTBDLENBQUM7QUFFMUUsd0VBQXdFO0FBQ3hFLE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQUMsQ0FDOUUsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FDaEUsQ0FBQztBQUVGLGdHQUFnRztBQUNoRyxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxDQUFDLFNBQWlCLEVBQUUsR0FBVyxFQUFXLEVBQUUsQ0FBQyxDQUNuRyxNQUFNLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLElBQUksU0FBUyxHQUFHLEdBQUc7T0FDNUUsU0FBUyxJQUFJLEdBQUcsR0FBRyw2QkFBNkIsQ0FBQyxzQkFBc0IsQ0FDM0UsQ0FBQztBQUVGLDBGQUEwRjtBQUMxRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxDQUFDLEtBQWMsRUFBa0MsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDakgsTUFBTSxTQUFTLEdBQUcsZ0JBQWdCLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxFQUFFLEtBQUssQ0FBQztJQUM5RCxZQUFZLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxTQUFTLEtBQUssY0FBYyxJQUFJLFNBQVMsS0FBSyxjQUFjLENBQUMsQ0FBQztJQUNyRyxJQUFJLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMzQixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsWUFBWSxFQUFFLFdBQVcsRUFBRSxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztRQUNwRixZQUFZLENBQUMsMkJBQTJCLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDNUQsT0FBTyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7WUFDeEYsU0FBUyxFQUFFLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM5QyxDQUFDO0lBQ0QsSUFBSSxTQUFTLEtBQUssY0FBYyxFQUFFLENBQUM7UUFDakMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7UUFDbEYsT0FBTyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7WUFDaEcsU0FBUyxFQUFFLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM5QyxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNyRSxPQUFPLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDdkcsQ0FBQyxDQUFDLENBQUM7QUFFSCxvR0FBb0c7QUFDcEcsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsQ0FBQyxLQUFjLEVBQWtDLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ2pILE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzNFLFlBQVksQ0FBQyxPQUFPLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDN0UsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLElBQUksNkJBQTZCLENBQUMscUJBQXFCO1dBQy9FLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLEtBQUssUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN6RyxNQUFNLFlBQVksR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLDZCQUE2QixDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3BHLFlBQVksQ0FBQyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDcEMsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDL0csS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNuRCxZQUFZLENBQUMsTUFBTSxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxTQUFTLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLDZCQUE2QixDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3BHLFlBQVksQ0FBQyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDcEMsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1FBQ3hDLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7UUFDdEYsTUFBTSxZQUFZLEdBQUcsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM5RCxZQUFZLENBQUMsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDO1FBQ3BDLE1BQU0sSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjLEVBQUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTO1lBQ2pHLFlBQVksRUFBRSxDQUFDLEdBQUcsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNwQyxZQUFZLENBQUMsOEJBQThCLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLE9BQU8sSUFBK0IsQ0FBQztJQUN6QyxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEdBQUcsS0FBSyxDQUFDLGNBQWMsSUFBSSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUN0RixLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsU0FBUyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ3RELFlBQVksQ0FBQyxTQUFTLENBQUMsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUM5RixDQUFDLENBQUMsQ0FBQyJ9

package/dist_ts/data/deploymentpreflight.d.ts

@@ -8,7 +8,7 @@ export type TDeploymentPreflightDecision = 'GO' | 'NO-GO';
  * judges a report's blockers reads the vocabulary from the contract instead of restating a list
  * the contract could later disagree with.
  */
-export declare const deploymentPreflightBlockerCodes: readonly ["INVALID_REQUEST", "AUTHORIZATION_MISSING", "ORGANIZATION_SCOPE_MISSING", "SERVICE_OWNERSHIP_MISMATCH", "DEPLOYMENT_OPERATION_NOT_FOUND", "DEPLOYMENT_OPERATION_CONFLICT", "DEPLOY_ON_PUSH_MUST_BE_DISABLED", "REGISTRY_AUTHENTICATION_UNAVAILABLE", "REGISTRY_REPOSITORY_MISMATCH", "REGISTRY_TAG_CONFLICT", "SOURCE_REVISION_INVALID", "SOURCE_WORKTREE_DIRTY", "VERSION_NOT_RESERVED", "VERSION_COLLISION", "NAMESPACE_NOT_RESERVED", "NAMESPACE_COLLISION", "NAMESPACE_NOT_PROVEN_BLANK", "CONFIGURATION_DIGEST_INVALID", "INTENT_DIGEST_INVALID", "PROPOSED_CONFIGURATION_INCOMPLETE", "CURRENT_REFERENCE_MUTABLE", "CURRENT_RUNTIME_DIGEST_MISSING", "OCI_INDEX_DIGEST_REQUIRED", "OCI_INDEX_NOT_FOUND", "OCI_INDEX_MEDIA_TYPE_REQUIRED", "OCI_PLATFORM_MISSING", "OCI_PLATFORM_MANIFEST_MISSING", "IMMUTABLE_RELEASE_TAG_REQUIRED", "IMMUTABLE_RELEASE_TAG_NOT_RESERVED", "RELEASE_EVIDENCE_MISSING", "RELEASE_EVIDENCE_INVALID", "RELEASE_EVIDENCE_AMBIGUOUS", "RELEASE_NOT_AUTHORIZED", "GREENFIELD_EXECUTION_UNAVAILABLE", "ROUTE_PROMOTION_FENCE_UNAVAILABLE", "POST_DEPLOYMENT_VERIFICATION_UNAVAILABLE", "WOULD_REPLACE_EXISTING_STATE", "PLATFORM_CAPABILITY_UNAVAILABLE", "CORESTORE_INVENTORY_UNAVAILABLE", "RUNTIME_ATTESTATION_MISMATCH", "ROLLOUT_ACTIVE_CONFLICT", "ROLLOUT_NOT_SUCCEEDED", "ROUTE_UNAVAILABLE", "RELAY_NAME_RESERVED", "ROUTE_VERIFICATION_FAILED", "TLS_VERIFICATION_FAILED"];
+export declare const deploymentPreflightBlockerCodes: readonly ["INVALID_REQUEST", "AUTHORIZATION_MISSING", "DEPLOYMENT_MACHINE_IDENTITY_REQUIRED", "ORGANIZATION_SCOPE_MISSING", "SERVICE_OWNERSHIP_MISMATCH", "DEPLOYMENT_OPERATION_NOT_FOUND", "DEPLOYMENT_OPERATION_CONFLICT", "DEPLOY_ON_PUSH_MUST_BE_DISABLED", "REGISTRY_AUTHENTICATION_UNAVAILABLE", "REGISTRY_REPOSITORY_MISMATCH", "REGISTRY_TAG_CONFLICT", "SOURCE_REVISION_INVALID", "SOURCE_WORKTREE_DIRTY", "VERSION_NOT_RESERVED", "VERSION_COLLISION", "NAMESPACE_NOT_RESERVED", "NAMESPACE_COLLISION", "NAMESPACE_NOT_PROVEN_BLANK", "CONFIGURATION_DIGEST_INVALID", "INTENT_DIGEST_INVALID", "PROPOSED_CONFIGURATION_INCOMPLETE", "CURRENT_REFERENCE_MUTABLE", "CURRENT_RUNTIME_DIGEST_MISSING", "OCI_INDEX_DIGEST_REQUIRED", "OCI_INDEX_NOT_FOUND", "OCI_INDEX_MEDIA_TYPE_REQUIRED", "OCI_PLATFORM_MISSING", "OCI_PLATFORM_MANIFEST_MISSING", "IMMUTABLE_RELEASE_TAG_REQUIRED", "IMMUTABLE_RELEASE_TAG_NOT_RESERVED", "RELEASE_EVIDENCE_MISSING", "RELEASE_EVIDENCE_INVALID", "RELEASE_EVIDENCE_AMBIGUOUS", "RELEASE_NOT_AUTHORIZED", "GREENFIELD_EXECUTION_UNAVAILABLE", "ROUTE_PROMOTION_FENCE_UNAVAILABLE", "POST_DEPLOYMENT_VERIFICATION_UNAVAILABLE", "WOULD_REPLACE_EXISTING_STATE", "PLATFORM_CAPABILITY_UNAVAILABLE", "CORESTORE_INVENTORY_UNAVAILABLE", "RUNTIME_ATTESTATION_MISMATCH", "ROLLOUT_ACTIVE_CONFLICT", "ROLLOUT_NOT_SUCCEEDED", "ROUTE_UNAVAILABLE", "RELAY_NAME_RESERVED", "ROUTE_VERIFICATION_FAILED", "TLS_VERIFICATION_FAILED"];
 export type TDeploymentPreflightBlockerCode = typeof deploymentPreflightBlockerCodes[number];
 export interface IDeploymentPreflightBlocker {
     code: TDeploymentPreflightBlockerCode;

package/dist_ts/data/deploymentpreflight.js

@@ -9,6 +9,12 @@ import { canonicalizeDeploymentHostname, getDeploymentRouteVerificationHostname,
 export const deploymentPreflightBlockerCodes = [
     'INVALID_REQUEST',
     'AUTHORIZATION_MISSING',
+    /**
+     * A reservation is made by a deployment machine user (an API machine user with a deployment
+     * grant) and never by an administrator, whose registry push is not bound to any operation; the
+     * reserve request refuses such an actor with the same code.
+     */
+    'DEPLOYMENT_MACHINE_IDENTITY_REQUIRED',
     'ORGANIZATION_SCOPE_MISSING',
     'SERVICE_OWNERSHIP_MISMATCH',
     'DEPLOYMENT_OPERATION_NOT_FOUND',
@@ -263,4 +269,4 @@ export const validateDeploymentReleaseEvidence = (argsArg) => {
     }
     return blockers;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudHByZWZsaWdodC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudHByZWZsaWdodC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUxRixPQUFPLEVBQUUsdUJBQXVCLEVBQXVCLE1BQU0sZ0JBQWdCLENBQUM7QUFPOUUsT0FBTyxFQUNMLDhCQUE4QixFQUM5QixzQ0FBc0MsRUFDdEMsZ0NBQWdDLEVBQ2hDLHVDQUF1QyxHQUN4QyxNQUFNLDBCQUEwQixDQUFDO0FBSWxDOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRztJQUM3QyxpQkFBaUI7SUFDakIsdUJBQXVCO0lBQ3ZCLDRCQUE0QjtJQUM1Qiw0QkFBNEI7SUFDNUIsZ0NBQWdDO0lBQ2hDLCtCQUErQjtJQUMvQixpQ0FBaUM7SUFDakMscUNBQXFDO0lBQ3JDLDhCQUE4QjtJQUM5Qix1QkFBdUI7SUFDdkIseUJBQXlCO0lBQ3pCLHVCQUF1QjtJQUN2QixzQkFBc0I7SUFDdEIsbUJBQW1CO0lBQ25CLHdCQUF3QjtJQUN4QixxQkFBcUI7SUFDckIsNEJBQTRCO0lBQzVCLDhCQUE4QjtJQUM5Qix1QkFBdUI7SUFDdkIsbUNBQW1DO0lBQ25DLDJCQUEyQjtJQUMzQixnQ0FBZ0M7SUFDaEMsMkJBQTJCO0lBQzNCLHFCQUFxQjtJQUNyQiwrQkFBK0I7SUFDL0Isc0JBQXNCO0lBQ3RCLCtCQUErQjtJQUMvQixnQ0FBZ0M7SUFDaEMsb0NBQW9DO0lBQ3BDLDBCQUEwQjtJQUMxQiwwQkFBMEI7SUFDMUIsNEJBQTRCO0lBQzVCLHdCQUF3QjtJQUN4QixrQ0FBa0M7SUFDbEMsbUNBQW1DO0lBQ25DLDBDQUEwQztJQUMxQyw4QkFBOEI7SUFDOUIsaUNBQWlDO0lBQ2pDLGlDQUFpQztJQUNqQyw4QkFBOEI7SUFDOUIseUJBQXlCO0lBQ3pCLHVCQUF1QjtJQUN2QixtQkFBbUI7SUFDbkI7Ozs7T0FJRztJQUNILHFCQUFxQjtJQUNyQiwyQkFBMkI7SUFDM0IseUJBQXlCO0NBQ2pCLENBQUM7QUFtT1gsTUFBTSxvQkFBb0IsR0FBRyxnQkFBZ0IsQ0FBQztBQUM5QyxNQUFNLG9CQUFvQixHQUFHLDRNQUE0TSxDQUFDO0FBQzFPLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxHQUFHLENBQThDO0lBQ2pGLFlBQVk7SUFDWixNQUFNO0lBQ04sV0FBVztJQUNYLHNCQUFzQjtJQUN0Qix1QkFBdUI7Q0FDeEIsQ0FBQyxDQUFDO0FBRUgsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQzFFLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRWhGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELFVBQW1CLEVBQ1ksRUFBRTtJQUNqQyxNQUFNLFFBQVEsR0FBa0MsRUFBRSxDQUFDO0lBQ25ELElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMxQixPQUFPLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLGlEQUFpRCxFQUFFLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxVQUFVLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQ2pDLENBQUMsK0JBQStCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ2pFLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDJDQUEyQyxFQUFFLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUNsSCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwyQ0FBMkMsRUFBRSxDQUFDLENBQUM7SUFDbkcsQ0FBQztJQUNELElBQUksT0FBTyxVQUFVLENBQUMsY0FBYyxLQUFLLFFBQVEsSUFBSSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUMzRyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLE9BQU8sRUFBRSwyREFBMkQsRUFBRSxDQUFDLENBQUM7UUFDekgsSUFBSSxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDbEQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDaEQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUseUNBQXlDLEVBQUUsQ0FBQyxDQUFDO0lBQ2pHLENBQUM7U0FBTSxJQUFJLFVBQVUsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNsQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLE9BQU8sRUFBRSxtREFBbUQsRUFBRSxDQUFDLENBQUM7SUFDakgsQ0FBQztJQUNELElBQUksT0FBTyxVQUFVLENBQUMsT0FBTyxLQUFLLFFBQVE7V0FDckMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUMvQixDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNwRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLE9BQU8sRUFBRSxtREFBbUQsRUFBRSxDQUFDLENBQUM7UUFDOUcsSUFBSSxPQUFPLFVBQVUsQ0FBQyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDM0MsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxZQUFZLEtBQUssUUFBUSxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDbkcsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSx1QkFBdUIsRUFBRSxPQUFPLEVBQUUsNkRBQTZELEVBQUUsQ0FBQyxDQUFDO1FBQ3pILElBQUksT0FBTyxVQUFVLENBQUMsWUFBWSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ2hELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLENBQUMsQ0FBQztRQUNoRyxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxVQUFVLENBQUMscUJBQXFCLENBQUM7UUFDOUQsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxxQkFBcUI7UUFDbEMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNkLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxhQUFhLEVBQUUsY0FBYyxDQUFDO1FBQzlFLENBQUMsQ0FBQyxhQUFhLENBQUMsY0FBYztRQUM5QixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsTUFBTSwwQkFBMEIsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUM7UUFDNUUsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUMsU0FBUyxFQUF1QixFQUFFLENBQUMsQ0FDdkUsT0FBTyxTQUFTLEtBQUssUUFBUSxDQUM5QixDQUFDO1FBQ0YsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLElBQUksdUNBQXVDLENBQUMsYUFBYSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RFLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLHFEQUFxRCxFQUFFLENBQUMsQ0FBQztJQUM3RyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsY0FBYyxLQUFLLFNBQVM7V0FDdEMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMxRyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDJCQUEyQixFQUFFLE9BQU8sRUFBRSxxREFBcUQsRUFBRSxDQUFDLENBQUM7UUFDckgsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsZ0NBQWdDLEVBQUUsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxVQUFVLEtBQUssU0FBUztXQUNsQyxDQUFDLDRCQUE0QixDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDJCQUEyQixFQUFFLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTLElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxJQUFJO1FBQzFFLENBQUMsQ0FBQyxZQUFZO1FBQ2QsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUM7SUFDcEIsSUFBSSxJQUFJLEtBQUssWUFBWSxJQUFJLElBQUksS0FBSyxrQkFBa0IsRUFBRSxDQUFDO1FBQ3pELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDBDQUEwQyxFQUFFLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLFNBQVM7V0FDbEMsQ0FBQyxVQUFVLENBQUMsVUFBVSxLQUFLLElBQUksSUFBSSxJQUFJLEtBQUssWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUMvRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwwQ0FBMEMsRUFBRSxDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTO1dBQzdCLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUM5QixVQUFVLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDOUIsVUFBVSxDQUFDLEtBQUssS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUNsQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSx3Q0FBd0MsRUFBRSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLGNBQWMsS0FBSyxTQUFTO1dBQ3RDLENBQUMsT0FBTyxVQUFVLENBQUMsY0FBYyxLQUFLLFFBQVE7ZUFDNUMsQ0FBQyxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMvRSxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxrREFBa0QsRUFBRSxDQUFDLENBQUM7SUFDMUcsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLFdBQVcsS0FBSyxTQUFTO1dBQ25DLENBQUMsT0FBTyxVQUFVLENBQUMsV0FBVyxLQUFLLFFBQVE7ZUFDekMsQ0FBQyxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM1RSxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwrQ0FBK0MsRUFBRSxDQUFDLENBQUM7SUFDdkcsQ0FBQztJQUNELE1BQU0sY0FBYyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztRQUNyRCxDQUFDLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ3BDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUTtZQUN6RCxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVE7WUFDbkIsQ0FBQyxDQUFDLFNBQVMsQ0FDZCxDQUFDO1FBQ0YsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksQ0FDckMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7V0FDOUIsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsRUFBRTtXQUM3QixJQUFJLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQyxJQUFJLEtBQUssY0FBYyxDQUFDLE1BQU07V0FDdEQsVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztlQUN0RCxPQUFPLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUTtlQUNyQyw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUSxDQUFDLFFBQVE7ZUFDdkUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7ZUFDMUMsQ0FBQyxPQUFPLFFBQVEsQ0FBQyxVQUFVLEtBQUssUUFBUTttQkFDdEMsQ0FBQyxRQUFRLENBQUMsVUFBVSxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQyxDQUFDO2VBQzNELENBQUMsUUFBUSxDQUFDLE9BQU8sS0FBSyxTQUFTLElBQUksT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLFNBQVMsQ0FBQztlQUN6RSxDQUFDLDJCQUEyQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO2VBQzFELENBQUMsUUFBUSxDQUFDLG9CQUFvQixLQUFLLFNBQVM7bUJBQzFDLENBQUMsT0FBTyxRQUFRLENBQUMsb0JBQW9CLEtBQUssUUFBUTt1QkFDaEQsOEJBQThCLENBQUMsUUFBUSxDQUFDLG9CQUFvQixDQUFDOzRCQUMxRCxRQUFRLENBQUMsb0JBQW9CLENBQUMsQ0FBQztlQUN0QyxzQ0FBc0MsQ0FDdkMsUUFBOEMsQ0FDL0MsS0FBSyxTQUFTO2VBQ1osQ0FBQyxRQUFRLENBQUMsYUFBYSxLQUFLLFNBQVM7bUJBQ25DLENBQUMsT0FBTyxRQUFRLENBQUMsYUFBYSxLQUFLLFFBQVE7dUJBQ3pDLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsS0FBSyxRQUFRLENBQUMsYUFBYSxDQUFDLENBQUM7ZUFDekYsQ0FBQyxRQUFRLENBQUMsbUJBQW1CLEtBQUssU0FBUzttQkFDekMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUFDO3VCQUMzQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsTUFBTSxHQUFHLENBQUM7dUJBQ3ZDLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsRUFBRTt1QkFDeEMsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNO3VCQUNsRixRQUFRLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxDQUNsRCxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLElBQUksU0FBUyxHQUFHLEdBQUcsSUFBSSxTQUFTLEdBQUcsR0FBRyxDQUN2RSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQ1osRUFBRSxDQUFDO1FBQ0YsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsNENBQTRDLEVBQUUsQ0FBQyxDQUFDO0lBQ3BHLENBQUM7SUFDRCw4RkFBOEY7SUFDOUYsK0ZBQStGO0lBQy9GLDhGQUE4RjtJQUM5RixnR0FBZ0c7SUFDaEcsOEZBQThGO0lBQzlGLDZGQUE2RjtJQUM3RixNQUFNLGdCQUFnQixHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDakYsTUFBTSxtQkFBbUIsR0FBRyxnQkFBZ0IsS0FBSyxTQUFTO1dBQ3JELENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxJQUFJLGdCQUFnQixDQUFDLEtBQUssS0FBSyxTQUFTLENBQUM7UUFDdEYsQ0FBQyxDQUFDLHVCQUF1QixDQUFDLFVBQVUsRUFBRSxxQ0FBcUMsQ0FBQztRQUM1RSxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsSUFBSSxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbkMsUUFBUSxDQUFDLElBQUksQ0FBQztZQUNaLElBQUksRUFBRSxpQkFBaUI7WUFDdkIsT0FBTyxFQUFFLDJDQUEyQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUc7U0FDdEYsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELElBQUksSUFBSSxLQUFLLFlBQVksSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7V0FDeEQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ2hFLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQ3JGLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ04sSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsMEJBQTBCLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUN4RSxRQUFRLENBQUMsSUFBSSxDQUFDO1lBQ1osSUFBSSxFQUFFLGlCQUFpQjtZQUN2QixPQUFPLEVBQUUsK0RBQStEO1NBQ3pFLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUFDLE9BTWpELEVBQWlDLEVBQUU7SUFDbEMsTUFBTSxRQUFRLEdBQWtDLEVBQUUsQ0FBQztJQUNuRCxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2hDLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUscUNBQXFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDO0lBQ2xDLElBQUksUUFBUSxDQUFDLGlCQUFpQixLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3hDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsT0FBTyxFQUFFLHFEQUFxRCxFQUFFLENBQUMsQ0FBQztJQUNwSCxDQUFDO0lBQ0QsSUFDRSxRQUFRLENBQUMsY0FBYyxLQUFLLE9BQU8sQ0FBQyxjQUFjO1dBQy9DLFFBQVEsQ0FBQyxPQUFPLEtBQUssT0FBTyxDQUFDLE9BQU87V0FDcEMsUUFBUSxDQUFDLG1CQUFtQixLQUFLLE9BQU8sQ0FBQyxtQkFBbUI7V0FDNUQsUUFBUSxDQUFDLGNBQWMsS0FBSyxPQUFPLENBQUMsY0FBYyxFQUNyRCxDQUFDO1FBQ0QsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsa0VBQWtFLEVBQUUsQ0FBQyxDQUFDO0lBQ25JLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBK0MsQ0FBQztJQUN6RSxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3ZGLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQzFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLENBQUMsQ0FBQztJQUN6RyxDQUFDO0lBQ0QsS0FBSyxNQUFNLFdBQVcsSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUN2QyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDM0IsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsd0NBQXdDLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZHLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLElBQUksQ0FBQztRQUM5QixJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLHFCQUFxQixDQUFDLEdBQUcsQ0FBQyxJQUFtRCxDQUFDLEVBQUUsQ0FBQztZQUNoSCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxzQ0FBc0MsRUFBRSxDQUFDLENBQUM7WUFDckcsU0FBUztRQUNYLENBQUM7UUFDRCxTQUFTLENBQUMsR0FBRyxDQUFDLElBQW1ELENBQUMsQ0FBQztRQUNuRSxJQUNFLFdBQVcsQ0FBQyxhQUFhLEtBQUssT0FBTyxDQUFDLGNBQWM7ZUFDakQsT0FBTyxXQUFXLENBQUMsZUFBZSxLQUFLLFFBQVE7ZUFDL0MsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUFDO2VBQ25ELE9BQU8sV0FBVyxDQUFDLFFBQVEsS0FBSyxRQUFRO2VBQ3hDLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUU7ZUFDNUIsT0FBTyxXQUFXLENBQUMsVUFBVSxLQUFLLFFBQVE7ZUFDMUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7ZUFDN0MsV0FBVyxDQUFDLFVBQVUsR0FBRyxDQUFDLEVBQzdCLENBQUM7WUFDRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxXQUFXLElBQUksWUFBWSxFQUFFLENBQUMsQ0FBQztRQUM1RixDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxZQUFZLElBQUkscUJBQXFCLEVBQUUsQ0FBQztRQUNqRCxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ2pDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLFdBQVcsWUFBWSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQ3BHLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudHByZWZsaWdodC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudHByZWZsaWdodC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUxRixPQUFPLEVBQUUsdUJBQXVCLEVBQXVCLE1BQU0sZ0JBQWdCLENBQUM7QUFPOUUsT0FBTyxFQUNMLDhCQUE4QixFQUM5QixzQ0FBc0MsRUFDdEMsZ0NBQWdDLEVBQ2hDLHVDQUF1QyxHQUN4QyxNQUFNLDBCQUEwQixDQUFDO0FBSWxDOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRztJQUM3QyxpQkFBaUI7SUFDakIsdUJBQXVCO0lBQ3ZCOzs7O09BSUc7SUFDSCxzQ0FBc0M7SUFDdEMsNEJBQTRCO0lBQzVCLDRCQUE0QjtJQUM1QixnQ0FBZ0M7SUFDaEMsK0JBQStCO0lBQy9CLGlDQUFpQztJQUNqQyxxQ0FBcUM7SUFDckMsOEJBQThCO0lBQzlCLHVCQUF1QjtJQUN2Qix5QkFBeUI7SUFDekIsdUJBQXVCO0lBQ3ZCLHNCQUFzQjtJQUN0QixtQkFBbUI7SUFDbkIsd0JBQXdCO0lBQ3hCLHFCQUFxQjtJQUNyQiw0QkFBNEI7SUFDNUIsOEJBQThCO0lBQzlCLHVCQUF1QjtJQUN2QixtQ0FBbUM7SUFDbkMsMkJBQTJCO0lBQzNCLGdDQUFnQztJQUNoQywyQkFBMkI7SUFDM0IscUJBQXFCO0lBQ3JCLCtCQUErQjtJQUMvQixzQkFBc0I7SUFDdEIsK0JBQStCO0lBQy9CLGdDQUFnQztJQUNoQyxvQ0FBb0M7SUFDcEMsMEJBQTBCO0lBQzFCLDBCQUEwQjtJQUMxQiw0QkFBNEI7SUFDNUIsd0JBQXdCO0lBQ3hCLGtDQUFrQztJQUNsQyxtQ0FBbUM7SUFDbkMsMENBQTBDO0lBQzFDLDhCQUE4QjtJQUM5QixpQ0FBaUM7SUFDakMsaUNBQWlDO0lBQ2pDLDhCQUE4QjtJQUM5Qix5QkFBeUI7SUFDekIsdUJBQXVCO0lBQ3ZCLG1CQUFtQjtJQUNuQjs7OztPQUlHO0lBQ0gscUJBQXFCO0lBQ3JCLDJCQUEyQjtJQUMzQix5QkFBeUI7Q0FDakIsQ0FBQztBQW1PWCxNQUFNLG9CQUFvQixHQUFHLGdCQUFnQixDQUFDO0FBQzlDLE1BQU0sb0JBQW9CLEdBQUcsNE1BQTRNLENBQUM7QUFDMU8sTUFBTSxxQkFBcUIsR0FBRyxJQUFJLEdBQUcsQ0FBOEM7SUFDakYsWUFBWTtJQUNaLE1BQU07SUFDTixXQUFXO0lBQ1gsc0JBQXNCO0lBQ3RCLHVCQUF1QjtDQUN4QixDQUFDLENBQUM7QUFFSCxNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FDMUUsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFaEYsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FDaEQsVUFBbUIsRUFDWSxFQUFFO0lBQ2pDLE1BQU0sUUFBUSxHQUFrQyxFQUFFLENBQUM7SUFDbkQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFCLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsaURBQWlELEVBQUUsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3ZDLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLEdBQUc7V0FDakMsQ0FBQywrQkFBK0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDakUsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsMkNBQTJDLEVBQUUsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxJQUFJLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQ2xILFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDJDQUEyQyxFQUFFLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQzNHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsT0FBTyxFQUFFLDJEQUEyRCxFQUFFLENBQUMsQ0FBQztRQUN6SCxJQUFJLE9BQU8sVUFBVSxDQUFDLGNBQWMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNsRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNoRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSx5Q0FBeUMsRUFBRSxDQUFDLENBQUM7SUFDakcsQ0FBQztTQUFNLElBQUksVUFBVSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ2xDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsdUJBQXVCLEVBQUUsT0FBTyxFQUFFLG1EQUFtRCxFQUFFLENBQUMsQ0FBQztJQUNqSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxPQUFPLEtBQUssUUFBUTtXQUNyQyxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQy9CLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ3BELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsT0FBTyxFQUFFLG1EQUFtRCxFQUFFLENBQUMsQ0FBQztRQUM5RyxJQUFJLE9BQU8sVUFBVSxDQUFDLE9BQU8sS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUMzQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNuRyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLE9BQU8sRUFBRSw2REFBNkQsRUFBRSxDQUFDLENBQUM7UUFDekgsSUFBSSxPQUFPLFVBQVUsQ0FBQyxZQUFZLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDaEQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsd0NBQXdDLEVBQUUsQ0FBQyxDQUFDO1FBQ2hHLENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQyxxQkFBcUIsQ0FBQztRQUM5RCxDQUFDLENBQUMsVUFBVSxDQUFDLHFCQUFxQjtRQUNsQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ2QsTUFBTSwyQkFBMkIsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxjQUFjLENBQUM7UUFDOUUsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxjQUFjO1FBQzlCLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDUCxNQUFNLDBCQUEwQixHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxFQUFFLGFBQWEsQ0FBQztRQUM1RSxDQUFDLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQXVCLEVBQUUsQ0FBQyxDQUN2RSxPQUFPLFNBQVMsS0FBSyxRQUFRLENBQzlCLENBQUM7UUFDRixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsSUFBSSx1Q0FBdUMsQ0FBQyxhQUFhLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEUsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUscURBQXFELEVBQUUsQ0FBQyxDQUFDO0lBQzdHLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxjQUFjLEtBQUssU0FBUztXQUN0QyxDQUFDLE9BQU8sVUFBVSxDQUFDLGNBQWMsS0FBSyxRQUFRLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsT0FBTyxFQUFFLHFEQUFxRCxFQUFFLENBQUMsQ0FBQztRQUNySCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxnQ0FBZ0MsRUFBRSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxTQUFTO1dBQ2xDLENBQUMsNEJBQTRCLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsMkJBQTJCLEVBQUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLElBQUk7UUFDMUUsQ0FBQyxDQUFDLFlBQVk7UUFDZCxDQUFDLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQztJQUNwQixJQUFJLElBQUksS0FBSyxZQUFZLElBQUksSUFBSSxLQUFLLGtCQUFrQixFQUFFLENBQUM7UUFDekQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsMENBQTBDLEVBQUUsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxVQUFVLEtBQUssU0FBUztXQUNsQyxDQUFDLFVBQVUsQ0FBQyxVQUFVLEtBQUssSUFBSSxJQUFJLElBQUksS0FBSyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQy9ELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDBDQUEwQyxFQUFFLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDN0IsVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTO1dBQzlCLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUM5QixVQUFVLENBQUMsS0FBSyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ2xDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLENBQUMsQ0FBQztJQUNoRyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsY0FBYyxLQUFLLFNBQVM7V0FDdEMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUTtlQUM1QyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQy9FLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLGtEQUFrRCxFQUFFLENBQUMsQ0FBQztJQUMxRyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsV0FBVyxLQUFLLFNBQVM7V0FDbkMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxXQUFXLEtBQUssUUFBUTtlQUN6QyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzVFLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLCtDQUErQyxFQUFFLENBQUMsQ0FBQztJQUN2RyxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQ3JELENBQUMsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDcEMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRO1lBQ3pELENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUTtZQUNuQixDQUFDLENBQUMsU0FBUyxDQUNkLENBQUM7UUFDRixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUNyQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztXQUM5QixVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxFQUFFO1dBQzdCLElBQUksR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDLElBQUksS0FBSyxjQUFjLENBQUMsTUFBTTtXQUN0RCxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO2VBQ3RELE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRO2VBQ3JDLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxRQUFRLENBQUMsUUFBUTtlQUN2RSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztlQUMxQyxDQUFDLE9BQU8sUUFBUSxDQUFDLFVBQVUsS0FBSyxRQUFRO21CQUN0QyxDQUFDLFFBQVEsQ0FBQyxVQUFVLEdBQUcsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxVQUFVLEdBQUcsS0FBSyxDQUFDLENBQUM7ZUFDM0QsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLFNBQVMsSUFBSSxPQUFPLFFBQVEsQ0FBQyxPQUFPLEtBQUssU0FBUyxDQUFDO2VBQ3pFLENBQUMsMkJBQTJCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7ZUFDMUQsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEtBQUssU0FBUzttQkFDMUMsQ0FBQyxPQUFPLFFBQVEsQ0FBQyxvQkFBb0IsS0FBSyxRQUFRO3VCQUNoRCw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLENBQUM7NEJBQzFELFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO2VBQ3RDLHNDQUFzQyxDQUN2QyxRQUE4QyxDQUMvQyxLQUFLLFNBQVM7ZUFDWixDQUFDLFFBQVEsQ0FBQyxhQUFhLEtBQUssU0FBUzttQkFDbkMsQ0FBQyxPQUFPLFFBQVEsQ0FBQyxhQUFhLEtBQUssUUFBUTt1QkFDekMsZ0NBQWdDLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxLQUFLLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQztlQUN6RixDQUFDLFFBQVEsQ0FBQyxtQkFBbUIsS0FBSyxTQUFTO21CQUN6QyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUM7dUJBQzNDLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQzt1QkFDdkMsUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxFQUFFO3VCQUN4QyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU07dUJBQ2xGLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLENBQ2xELENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsSUFBSSxTQUFTLEdBQUcsR0FBRyxJQUFJLFNBQVMsR0FBRyxHQUFHLENBQ3ZFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDWixFQUFFLENBQUM7UUFDRixRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSw0Q0FBNEMsRUFBRSxDQUFDLENBQUM7SUFDcEcsQ0FBQztJQUNELDhGQUE4RjtJQUM5RiwrRkFBK0Y7SUFDL0YsOEZBQThGO0lBQzlGLGdHQUFnRztJQUNoRyw4RkFBOEY7SUFDOUYsNkZBQTZGO0lBQzdGLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNqRixNQUFNLG1CQUFtQixHQUFHLGdCQUFnQixLQUFLLFNBQVM7V0FDckQsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLElBQUksZ0JBQWdCLENBQUMsS0FBSyxLQUFLLFNBQVMsQ0FBQztRQUN0RixDQUFDLENBQUMsdUJBQXVCLENBQUMsVUFBVSxFQUFFLHFDQUFxQyxDQUFDO1FBQzVFLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDUCxJQUFJLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNuQyxRQUFRLENBQUMsSUFBSSxDQUFDO1lBQ1osSUFBSSxFQUFFLGlCQUFpQjtZQUN2QixPQUFPLEVBQUUsMkNBQTJDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRztTQUN0RixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEtBQUssWUFBWSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztXQUN4RCxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDaEUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FDckYsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDTixJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3hFLFFBQVEsQ0FBQyxJQUFJLENBQUM7WUFDWixJQUFJLEVBQUUsaUJBQWlCO1lBQ3ZCLE9BQU8sRUFBRSwrREFBK0Q7U0FDekUsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsT0FNakQsRUFBaUMsRUFBRTtJQUNsQyxNQUFNLFFBQVEsR0FBa0MsRUFBRSxDQUFDO0lBQ25ELElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUM7SUFDbEMsSUFBSSxRQUFRLENBQUMsaUJBQWlCLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDeEMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSx3QkFBd0IsRUFBRSxPQUFPLEVBQUUscURBQXFELEVBQUUsQ0FBQyxDQUFDO0lBQ3BILENBQUM7SUFDRCxJQUNFLFFBQVEsQ0FBQyxjQUFjLEtBQUssT0FBTyxDQUFDLGNBQWM7V0FDL0MsUUFBUSxDQUFDLE9BQU8sS0FBSyxPQUFPLENBQUMsT0FBTztXQUNwQyxRQUFRLENBQUMsbUJBQW1CLEtBQUssT0FBTyxDQUFDLG1CQUFtQjtXQUM1RCxRQUFRLENBQUMsY0FBYyxLQUFLLE9BQU8sQ0FBQyxjQUFjLEVBQ3JELENBQUM7UUFDRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxrRUFBa0UsRUFBRSxDQUFDLENBQUM7SUFDbkksQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUErQyxDQUFDO0lBQ3pFLE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDdkYsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDMUMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsd0NBQXdDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7SUFDRCxLQUFLLE1BQU0sV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMzQixRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSx3Q0FBd0MsRUFBRSxDQUFDLENBQUM7WUFDdkcsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxXQUFXLENBQUMsSUFBSSxDQUFDO1FBQzlCLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLENBQUMscUJBQXFCLENBQUMsR0FBRyxDQUFDLElBQW1ELENBQUMsRUFBRSxDQUFDO1lBQ2hILFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLHNDQUFzQyxFQUFFLENBQUMsQ0FBQztZQUNyRyxTQUFTO1FBQ1gsQ0FBQztRQUNELFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBbUQsQ0FBQyxDQUFDO1FBQ25FLElBQ0UsV0FBVyxDQUFDLGFBQWEsS0FBSyxPQUFPLENBQUMsY0FBYztlQUNqRCxPQUFPLFdBQVcsQ0FBQyxlQUFlLEtBQUssUUFBUTtlQUMvQyxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQUM7ZUFDbkQsT0FBTyxXQUFXLENBQUMsUUFBUSxLQUFLLFFBQVE7ZUFDeEMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRTtlQUM1QixPQUFPLFdBQVcsQ0FBQyxVQUFVLEtBQUssUUFBUTtlQUMxQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQztlQUM3QyxXQUFXLENBQUMsVUFBVSxHQUFHLENBQUMsRUFDN0IsQ0FBQztZQUNELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLFdBQVcsSUFBSSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQzVGLENBQUM7SUFDSCxDQUFDO0lBQ0QsS0FBSyxNQUFNLFlBQVksSUFBSSxxQkFBcUIsRUFBRSxDQUFDO1FBQ2pELElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7WUFDakMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsV0FBVyxZQUFZLFlBQVksRUFBRSxDQUFDLENBQUM7UUFDcEcsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMifQ==

package/dist_ts/data/index.d.ts

@@ -12,6 +12,7 @@ export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
+export * from './deploymentmachineuser.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
 export * from './migration.js';

package/dist_ts/data/index.js

@@ -12,6 +12,7 @@ export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
+export * from './deploymentmachineuser.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
 export * from './migration.js';
@@ -71,4 +72,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsd0JBQXdCLENBQUM7QUFHdkMsT0FBTyxFQUFFLDBCQUEwQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFHOUQsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDcEYsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyx3QkFBd0IsQ0FBQztBQUd2QyxPQUFPLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUc5RCxPQUFPLEVBQUUscUNBQXFDLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUNwRixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxrQ0FBa0MsQ0FBQztBQUNqRCxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/data/networkprojection.d.ts

@@ -71,7 +71,9 @@ export interface IRuntimeNetworkPublishedPort {
      * Outbound flows the workload originates from a published target port leave the node from the
      * matching host port, so a peer sees one address and port in both directions (SIP, RTP). Only
      * `true` is ever stated; omitted, outbound flows keep the handoff lease's translation. It grants
-     * no egress: an endpoint carrying a symmetric entry has `publicEgress: true`.
+     * no egress: an endpoint carrying a symmetric entry has `publicEgress: true`. Its target ports
+     * are its own: no other entry of the list publishes to any of them
+     * (`findRuntimeNetworkPublishedPortInsideOverlap`).
      */
     symmetric?: true;
     /**
@@ -98,7 +100,10 @@ export interface IRuntimeNetworkPublishedPortRequest {
     /** The last port of a range; `targetPort` then equals `hostPort`. */
     hostPortEnd?: number;
     targetPort: number;
-    /** Same-port outbound; valid only while the service's policy document grants public egress. */
+    /**
+     * Same-port outbound; valid only while the service's policy document grants public egress, and
+     * only on target ports no other entry of the list publishes to.
+     */
     symmetric?: true;
 }
 /**
@@ -114,7 +119,8 @@ export interface IServicePublishedPorts {
     /**
      * Sorted by protocol and host port, never overlapping, at most
      * `runtimeNetworkPublishedPortContract.maximumEntries` entries covering at most its
-     * `maximumPortsPerService` ports. Empty means the service publishes nothing.
+     * `maximumPortsPerService` ports, and no symmetric entry sharing a target port with another
+     * entry of its protocol. Empty means the service publishes nothing.
      */
     publishedPorts: IRuntimeNetworkPublishedPortRequest[];
 }
@@ -213,7 +219,8 @@ export interface IRuntimeNetworkEndpoint {
     /**
      * Sorted by protocol and host port and never overlapping, within the bounds of
      * `runtimeNetworkPublishedPortContract`. Absent publishes nothing; a present member is never
-     * empty. A `symmetric` entry is admitted only while `publicEgress` is true.
+     * empty. A `symmetric` entry is admitted only while `publicEgress` is true and only on target
+     * ports no other entry of the endpoint publishes to.
      */
     publishedPorts?: IRuntimeNetworkPublishedPort[];
 }
@@ -336,6 +343,22 @@ type TPublishedPortSpan = Pick<IRuntimeNetworkPublishedPortRequest, 'protocol' |
  * Cloudly's `published-port-reserved`. It judges an entry its snapshot already accepted.
  */
 export declare const isRuntimeNetworkPublishedPortReserved: (value: TPublishedPortSpan) => boolean;
+type TPublishedPortInside = Pick<IRuntimeNetworkPublishedPortRequest, 'protocol' | 'hostPort' | 'hostPortEnd' | 'targetPort' | 'symmetric'>;
+/**
+ * The first pair of one list in which a `symmetric` entry's inside ports (`targetPort` onwards, a
+ * range's every port) share a port with another entry of the same protocol, or `null`: Cloudly's
+ * `published-port-symmetric-inside-overlap`.
+ *
+ * A symmetric entry translates the flows its workload opens from those ports back to its own host
+ * ports, so no other entry of the workload may publish to any of them, symmetric or not: the flows
+ * would have two published sources. The lists of one service's policy document and of each of its
+ * projection endpoints are judged alike, and their snapshots refuse any pair. Distinct protocols
+ * never conflict. It judges entries their snapshot already accepted.
+ */
+export declare const findRuntimeNetworkPublishedPortInsideOverlap: <T extends TPublishedPortInside>(ports: readonly T[]) => {
+    symmetric: T;
+    other: T;
+} | null;
 /** Structural snapshot only; node placement, quota and authorization remain Cloudly's decision. */
 export declare const snapshotServicePublishedPorts: (value: unknown) => IServicePublishedPorts;
 export declare const snapshotSetServicePublishedPorts: (value: unknown) => ISetServicePublishedPorts;