@serve.zone/interfaces 32.32.0 → 32.33.0

package/changelog.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 2026-09-28 - 32.33.0
+
+### Features
+
+- Deployment machine users can be created through the contract. `requests.admin.mutateDeploymentMachineUser`
+  creates a user (`create`), replaces its token (`rotate-token`) or removes its tokens
+  (`revoke-token`), keyed by a `mutationId` for replay. The token is answered once, on the first
+  answer to `create` or `rotate-token`. `requests.admin.getDeploymentMachineUsers` lists the users
+  as value-free `data.IDeploymentMachineUserMetadata`: id, username, token expiries and grants.
+  `data.snapshotDeploymentMachineUserMutation`, `data.snapshotDeploymentMachineUserMetadata`,
+  `data.isDeploymentMachineUsername`, `data.isDeploymentMachineTokenExpiryAdmissible` and
+  `data.deploymentMachineUserContract` state the rules. The refusal names are
+  `data.deploymentMachineUserRefusals`, carried as `data.IDeploymentMachineUserErrorData`. Until now
+  nothing in the contract could create the API machine user that `configureServiceDeploymentMachineUser`
+  requires, so a fresh Cloudly could not complete an immutable deployment.
+- `DEPLOYMENT_MACHINE_IDENTITY_REQUIRED` joins `data.deploymentPreflightBlockerCodes`.
+  `reserveServiceDeployment` refuses, with this code, any actor that is not an API machine user,
+  an administrator included, because only that user's registry push is bound to the operation it
+  reserved.
+
 ## 2026-09-28 - 32.32.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.32.0',
+    version: '32.33.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/deploymentmachineuser.d.ts

@@ -0,0 +1,94 @@
+import { type IServiceDeploymentGrant } from './user.js';
+/**
+ * A deployment machine user is the identity a deployer such as `@git.zone/tsdeploy` authenticates
+ * as: an API machine user that carries a bearer token and the deployment grants an administrator
+ * attaches with `configureServiceDeploymentMachineUser`. An administrator creates one, rotates or
+ * revokes its token, and lists them; nothing else mints one.
+ */
+export declare const deploymentMachineUserContract: Readonly<{
+    /** A token lives at most one year from the mutation that issued it, like every machine token. */
+    maximumTokenLifetimeMs: number;
+    /**
+     * The longest username a created user may take. The username is also the registry login name
+     * a deployer states, so it stays short, lowercase and free of `:` and `/`.
+     */
+    maximumCreatedUsernameLength: 64;
+    /** The longest stored username a listing reports, the bound Cloudly has always stored. */
+    maximumUsernameLength: 200;
+    /** Grants one user carries at most. */
+    maximumGrants: 64;
+    /** Tokens one listed user reports at most. */
+    maximumTokens: 64;
+}>;
+/** One token of a deployment machine user, without its value. */
+export interface IDeploymentMachineTokenMetadata {
+    expiresAt: number;
+}
+/** Value-free metadata of one deployment machine user. No token value is ever part of it. */
+export interface IDeploymentMachineUserMetadata {
+    userId: string;
+    username: string;
+    /** Ascending by expiry; empty after `revoke-token`. */
+    tokens: IDeploymentMachineTokenMetadata[];
+    /** Sorted by `organizationId:serviceId`, as Cloudly stores them. */
+    grants: IServiceDeploymentGrant[];
+}
+interface IDeploymentMachineUserMutationBase {
+    /** Retain the complete mutation and this ID across retries. */
+    mutationId: string;
+}
+/**
+ * `create` makes a new user with one token; the username must not be taken by any user.
+ * `rotate-token` replaces every token of the user with one new token. `revoke-token` removes every
+ * token, which ends the user's authentication while keeping its grants for a later rotation.
+ */
+export type TDeploymentMachineUserMutation = IDeploymentMachineUserMutationBase & ({
+    operation: 'create';
+    username: string;
+    expiresAt: number;
+} | {
+    operation: 'rotate-token';
+    userId: string;
+    expiresAt: number;
+} | {
+    operation: 'revoke-token';
+    userId: string;
+});
+export interface IDeploymentMachineUserMutationResult {
+    /** Historical on replay; read `getDeploymentMachineUsers` for current state. */
+    user: IDeploymentMachineUserMetadata;
+    /**
+     * The new token, answered exactly once: on the first answer to `create` or `rotate-token`.
+     * `revoke-token` and every replay answer `null`; a lost token is replaced by a rotation.
+     */
+    token: string | null;
+    replayed: boolean;
+}
+/**
+ * Every refusal the deployment machine user requests name, as `IDeploymentMachineUserErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: the caller is not an administrator.
+ * - `DEPLOYMENT_MACHINE_USER_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DEPLOYMENT_MACHINE_USERNAME_TAKEN`: another user already has the username.
+ * - `DEPLOYMENT_MACHINE_USER_INVALID`: the user is not a deployment machine user (it does not
+ *   exist, or it is a human, cluster, administrator or service workload identity).
+ * - `DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID`: the expiry is not in the future, or is more than
+ *   `maximumTokenLifetimeMs` away (`isDeploymentMachineTokenExpiryAdmissible`).
+ * - `DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT`: the mutation ID was used for a different mutation
+ *   or by a different administrator.
+ */
+export declare const deploymentMachineUserRefusals: readonly ["ADMIN_AUTHORIZATION_REQUIRED", "DEPLOYMENT_MACHINE_USER_REQUEST_INVALID", "DEPLOYMENT_MACHINE_USERNAME_TAKEN", "DEPLOYMENT_MACHINE_USER_INVALID", "DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID", "DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT"];
+export type TDeploymentMachineUserRefusal = typeof deploymentMachineUserRefusals[number];
+export interface IDeploymentMachineUserErrorData {
+    code: TDeploymentMachineUserRefusal;
+    retryable: false;
+}
+/** Whether a username may be given to a new deployment machine user. */
+export declare const isDeploymentMachineUsername: (value: unknown) => value is string;
+/** Whether a token expiry is in the future and at most `maximumTokenLifetimeMs` after `now`. */
+export declare const isDeploymentMachineTokenExpiryAdmissible: (expiresAt: number, now: number) => boolean;
+/** Structural copy only; the backend authorizes the administrator and the target user. */
+export declare const snapshotDeploymentMachineUserMutation: (value: unknown) => TDeploymentMachineUserMutation;
+/** Structural copy of listed metadata: a stored username, tokens by expiry, valid sorted grants. */
+export declare const snapshotDeploymentMachineUserMetadata: (value: unknown) => IDeploymentMachineUserMetadata;
+export {};

package/dist_ts/data/deploymentmachineuser.js

@@ -0,0 +1,121 @@
+import { readDataElements, readDataProperty, readExactDataRecord } from '../private/dataproperties.js';
+import { validateServiceDeploymentGrant } from './user.js';
+/**
+ * A deployment machine user is the identity a deployer such as `@git.zone/tsdeploy` authenticates
+ * as: an API machine user that carries a bearer token and the deployment grants an administrator
+ * attaches with `configureServiceDeploymentMachineUser`. An administrator creates one, rotates or
+ * revokes its token, and lists them; nothing else mints one.
+ */
+export const deploymentMachineUserContract = Object.freeze({
+    /** A token lives at most one year from the mutation that issued it, like every machine token. */
+    maximumTokenLifetimeMs: 365 * 24 * 60 * 60 * 1000,
+    /**
+     * The longest username a created user may take. The username is also the registry login name
+     * a deployer states, so it stays short, lowercase and free of `:` and `/`.
+     */
+    maximumCreatedUsernameLength: 64,
+    /** The longest stored username a listing reports, the bound Cloudly has always stored. */
+    maximumUsernameLength: 200,
+    /** Grants one user carries at most. */
+    maximumGrants: 64,
+    /** Tokens one listed user reports at most. */
+    maximumTokens: 64,
+});
+/**
+ * Every refusal the deployment machine user requests name, as `IDeploymentMachineUserErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: the caller is not an administrator.
+ * - `DEPLOYMENT_MACHINE_USER_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DEPLOYMENT_MACHINE_USERNAME_TAKEN`: another user already has the username.
+ * - `DEPLOYMENT_MACHINE_USER_INVALID`: the user is not a deployment machine user (it does not
+ *   exist, or it is a human, cluster, administrator or service workload identity).
+ * - `DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID`: the expiry is not in the future, or is more than
+ *   `maximumTokenLifetimeMs` away (`isDeploymentMachineTokenExpiryAdmissible`).
+ * - `DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT`: the mutation ID was used for a different mutation
+ *   or by a different administrator.
+ */
+export const deploymentMachineUserRefusals = [
+    'ADMIN_AUTHORIZATION_REQUIRED',
+    'DEPLOYMENT_MACHINE_USER_REQUEST_INVALID',
+    'DEPLOYMENT_MACHINE_USERNAME_TAKEN',
+    'DEPLOYMENT_MACHINE_USER_INVALID',
+    'DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID',
+    'DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT',
+];
+const fail = () => { throw new Error('Deployment machine user contract rejected.'); };
+function requireValue(value) { if (!value)
+    fail(); }
+const safe = (operation) => { try {
+    return operation();
+}
+catch {
+    return fail();
+} };
+/** Exactly this shape's keys, read once as data; an accessor is refused, never invoked. */
+const object = (value, keys) => {
+    const copy = readExactDataRecord(value, keys);
+    requireValue(copy !== null);
+    return copy;
+};
+const identifier = (value) => {
+    requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+    return value;
+};
+const timestamp = (value) => {
+    requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0);
+    return value;
+};
+const createdUsernamePattern = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;
+/** Whether a username may be given to a new deployment machine user. */
+export const isDeploymentMachineUsername = (value) => (typeof value === 'string' && createdUsernamePattern.test(value));
+/** Whether a token expiry is in the future and at most `maximumTokenLifetimeMs` after `now`. */
+export const isDeploymentMachineTokenExpiryAdmissible = (expiresAt, now) => (Number.isSafeInteger(expiresAt) && Number.isSafeInteger(now) && expiresAt > now
+    && expiresAt <= now + deploymentMachineUserContract.maximumTokenLifetimeMs);
+/** Structural copy only; the backend authorizes the administrator and the target user. */
+export const snapshotDeploymentMachineUserMutation = (value) => safe(() => {
+    const operation = readDataProperty(value, 'operation')?.value;
+    requireValue(operation === 'create' || operation === 'rotate-token' || operation === 'revoke-token');
+    if (operation === 'create') {
+        const request = object(value, ['mutationId', 'operation', 'username', 'expiresAt']);
+        requireValue(isDeploymentMachineUsername(request.username));
+        return { mutationId: identifier(request.mutationId), operation, username: request.username,
+            expiresAt: timestamp(request.expiresAt) };
+    }
+    if (operation === 'rotate-token') {
+        const request = object(value, ['mutationId', 'operation', 'userId', 'expiresAt']);
+        return { mutationId: identifier(request.mutationId), operation, userId: identifier(request.userId),
+            expiresAt: timestamp(request.expiresAt) };
+    }
+    const request = object(value, ['mutationId', 'operation', 'userId']);
+    return { mutationId: identifier(request.mutationId), operation, userId: identifier(request.userId) };
+});
+/** Structural copy of listed metadata: a stored username, tokens by expiry, valid sorted grants. */
+export const snapshotDeploymentMachineUserMetadata = (value) => safe(() => {
+    const metadata = object(value, ['userId', 'username', 'tokens', 'grants']);
+    requireValue(typeof metadata.username === 'string' && metadata.username.length > 0
+        && metadata.username.length <= deploymentMachineUserContract.maximumUsernameLength
+        && metadata.username.trim() === metadata.username && !/[\u0000-\u001f\u007f]/.test(metadata.username));
+    const tokenEntries = readDataElements(metadata.tokens, deploymentMachineUserContract.maximumTokens);
+    requireValue(tokenEntries !== null);
+    const tokens = tokenEntries.map((entry) => ({ expiresAt: timestamp(object(entry, ['expiresAt']).expiresAt) }));
+    for (let index = 1; index < tokens.length; index++) {
+        requireValue(tokens[index - 1].expiresAt <= tokens[index].expiresAt);
+    }
+    const grantEntries = readDataElements(metadata.grants, deploymentMachineUserContract.maximumGrants);
+    requireValue(grantEntries !== null);
+    const grants = grantEntries.map((entry) => {
+        const grant = object(entry, ['scope', 'organizationId', 'serviceId', 'capabilities']);
+        const capabilities = readDataElements(grant.capabilities, 64);
+        requireValue(capabilities !== null);
+        const copy = { scope: grant.scope, organizationId: grant.organizationId, serviceId: grant.serviceId,
+            capabilities: [...capabilities] };
+        requireValue(validateServiceDeploymentGrant(copy).length === 0);
+        return copy;
+    });
+    const grantKeys = grants.map((grant) => `${grant.organizationId}:${grant.serviceId}`);
+    for (let index = 1; index < grantKeys.length; index++) {
+        requireValue(grantKeys[index - 1].localeCompare(grantKeys[index]) < 0);
+    }
+    return { userId: identifier(metadata.userId), username: metadata.username, tokens, grants };
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudG1hY2hpbmV1c2VyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9kZXBsb3ltZW50bWFjaGluZXVzZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGdCQUFnQixFQUFFLGdCQUFnQixFQUFFLG1CQUFtQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDdkcsT0FBTyxFQUFFLDhCQUE4QixFQUFnQyxNQUFNLFdBQVcsQ0FBQztBQUV6Rjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDekQsaUdBQWlHO0lBQ2pHLHNCQUFzQixFQUFFLEdBQUcsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJO0lBQ2pEOzs7T0FHRztJQUNILDRCQUE0QixFQUFFLEVBQUU7SUFDaEMsMEZBQTBGO0lBQzFGLHFCQUFxQixFQUFFLEdBQUc7SUFDMUIsdUNBQXVDO0lBQ3ZDLGFBQWEsRUFBRSxFQUFFO0lBQ2pCLDhDQUE4QztJQUM5QyxhQUFhLEVBQUUsRUFBRTtDQUNsQixDQUFDLENBQUM7QUE0Q0g7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUc7SUFDM0MsOEJBQThCO0lBQzlCLHlDQUF5QztJQUN6QyxtQ0FBbUM7SUFDbkMsaUNBQWlDO0lBQ2pDLHlDQUF5QztJQUN6QywyQ0FBMkM7Q0FDbkMsQ0FBQztBQVNYLE1BQU0sSUFBSSxHQUFHLEdBQVUsRUFBRSxHQUFHLE1BQU0sSUFBSSxLQUFLLENBQUMsNENBQTRDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUM3RixTQUFTLFlBQVksQ0FBQyxLQUFjLElBQW1CLElBQUksQ0FBQyxLQUFLO0lBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBQzVFLE1BQU0sSUFBSSxHQUFHLENBQUksU0FBa0IsRUFBSyxFQUFFLEdBQUcsSUFBSSxDQUFDO0lBQUMsT0FBTyxTQUFTLEVBQUUsQ0FBQztBQUFDLENBQUM7QUFBQyxNQUFNLENBQUM7SUFBQyxPQUFPLElBQUksRUFBRSxDQUFDO0FBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUNwRywyRkFBMkY7QUFDM0YsTUFBTSxNQUFNLEdBQUcsQ0FBQyxLQUFjLEVBQUUsSUFBdUIsRUFBMkIsRUFBRTtJQUNsRixNQUFNLElBQUksR0FBRyxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7SUFDOUMsWUFBWSxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsQ0FBQztJQUM1QixPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQztBQUNGLE1BQU0sVUFBVSxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDNUMsWUFBWSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUM3RixPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQztBQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDM0MsWUFBWSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNwRixPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQztBQUNGLE1BQU0sc0JBQXNCLEdBQUcsMENBQTBDLENBQUM7QUFFMUUsd0VBQXdFO0FBQ3hFLE1BQU0sQ0FBQyxNQUFNLDJCQUEyQixHQUFHLENBQUMsS0FBYyxFQUFtQixFQUFFLENBQUMsQ0FDOUUsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLHNCQUFzQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FDaEUsQ0FBQztBQUVGLGdHQUFnRztBQUNoRyxNQUFNLENBQUMsTUFBTSx3Q0FBd0MsR0FBRyxDQUFDLFNBQWlCLEVBQUUsR0FBVyxFQUFXLEVBQUUsQ0FBQyxDQUNuRyxNQUFNLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLElBQUksU0FBUyxHQUFHLEdBQUc7T0FDNUUsU0FBUyxJQUFJLEdBQUcsR0FBRyw2QkFBNkIsQ0FBQyxzQkFBc0IsQ0FDM0UsQ0FBQztBQUVGLDBGQUEwRjtBQUMxRixNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxDQUFDLEtBQWMsRUFBa0MsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUU7SUFDakgsTUFBTSxTQUFTLEdBQUcsZ0JBQWdCLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxFQUFFLEtBQUssQ0FBQztJQUM5RCxZQUFZLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxTQUFTLEtBQUssY0FBYyxJQUFJLFNBQVMsS0FBSyxjQUFjLENBQUMsQ0FBQztJQUNyRyxJQUFJLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMzQixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsWUFBWSxFQUFFLFdBQVcsRUFBRSxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztRQUNwRixZQUFZLENBQUMsMkJBQTJCLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDNUQsT0FBTyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7WUFDeEYsU0FBUyxFQUFFLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM5QyxDQUFDO0lBQ0QsSUFBSSxTQUFTLEtBQUssY0FBYyxFQUFFLENBQUM7UUFDakMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7UUFDbEYsT0FBTyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7WUFDaEcsU0FBUyxFQUFFLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM5QyxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFlBQVksRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNyRSxPQUFPLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDdkcsQ0FBQyxDQUFDLENBQUM7QUFFSCxvR0FBb0c7QUFDcEcsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsQ0FBQyxLQUFjLEVBQWtDLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO0lBQ2pILE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzNFLFlBQVksQ0FBQyxPQUFPLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDN0UsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLElBQUksNkJBQTZCLENBQUMscUJBQXFCO1dBQy9FLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLEtBQUssUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUN6RyxNQUFNLFlBQVksR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLDZCQUE2QixDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3BHLFlBQVksQ0FBQyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDcEMsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDL0csS0FBSyxJQUFJLEtBQUssR0FBRyxDQUFDLEVBQUUsS0FBSyxHQUFHLE1BQU0sQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUNuRCxZQUFZLENBQUMsTUFBTSxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxTQUFTLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLDZCQUE2QixDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3BHLFlBQVksQ0FBQyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUM7SUFDcEMsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFO1FBQ3hDLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQyxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7UUFDdEYsTUFBTSxZQUFZLEdBQUcsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsQ0FBQztRQUM5RCxZQUFZLENBQUMsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDO1FBQ3BDLE1BQU0sSUFBSSxHQUFHLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxLQUFLLEVBQUUsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjLEVBQUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTO1lBQ2pHLFlBQVksRUFBRSxDQUFDLEdBQUcsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNwQyxZQUFZLENBQUMsOEJBQThCLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ2hFLE9BQU8sSUFBK0IsQ0FBQztJQUN6QyxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEdBQUcsS0FBSyxDQUFDLGNBQWMsSUFBSSxLQUFLLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUN0RixLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsU0FBUyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ3RELFlBQVksQ0FBQyxTQUFTLENBQUMsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsQ0FBQztBQUM5RixDQUFDLENBQUMsQ0FBQyJ9

package/dist_ts/data/deploymentpreflight.d.ts

@@ -8,7 +8,7 @@ export type TDeploymentPreflightDecision = 'GO' | 'NO-GO';
  * judges a report's blockers reads the vocabulary from the contract instead of restating a list
  * the contract could later disagree with.
  */
-export declare const deploymentPreflightBlockerCodes: readonly ["INVALID_REQUEST", "AUTHORIZATION_MISSING", "ORGANIZATION_SCOPE_MISSING", "SERVICE_OWNERSHIP_MISMATCH", "DEPLOYMENT_OPERATION_NOT_FOUND", "DEPLOYMENT_OPERATION_CONFLICT", "DEPLOY_ON_PUSH_MUST_BE_DISABLED", "REGISTRY_AUTHENTICATION_UNAVAILABLE", "REGISTRY_REPOSITORY_MISMATCH", "REGISTRY_TAG_CONFLICT", "SOURCE_REVISION_INVALID", "SOURCE_WORKTREE_DIRTY", "VERSION_NOT_RESERVED", "VERSION_COLLISION", "NAMESPACE_NOT_RESERVED", "NAMESPACE_COLLISION", "NAMESPACE_NOT_PROVEN_BLANK", "CONFIGURATION_DIGEST_INVALID", "INTENT_DIGEST_INVALID", "PROPOSED_CONFIGURATION_INCOMPLETE", "CURRENT_REFERENCE_MUTABLE", "CURRENT_RUNTIME_DIGEST_MISSING", "OCI_INDEX_DIGEST_REQUIRED", "OCI_INDEX_NOT_FOUND", "OCI_INDEX_MEDIA_TYPE_REQUIRED", "OCI_PLATFORM_MISSING", "OCI_PLATFORM_MANIFEST_MISSING", "IMMUTABLE_RELEASE_TAG_REQUIRED", "IMMUTABLE_RELEASE_TAG_NOT_RESERVED", "RELEASE_EVIDENCE_MISSING", "RELEASE_EVIDENCE_INVALID", "RELEASE_EVIDENCE_AMBIGUOUS", "RELEASE_NOT_AUTHORIZED", "GREENFIELD_EXECUTION_UNAVAILABLE", "ROUTE_PROMOTION_FENCE_UNAVAILABLE", "POST_DEPLOYMENT_VERIFICATION_UNAVAILABLE", "WOULD_REPLACE_EXISTING_STATE", "PLATFORM_CAPABILITY_UNAVAILABLE", "CORESTORE_INVENTORY_UNAVAILABLE", "RUNTIME_ATTESTATION_MISMATCH", "ROLLOUT_ACTIVE_CONFLICT", "ROLLOUT_NOT_SUCCEEDED", "ROUTE_UNAVAILABLE", "RELAY_NAME_RESERVED", "ROUTE_VERIFICATION_FAILED", "TLS_VERIFICATION_FAILED"];
+export declare const deploymentPreflightBlockerCodes: readonly ["INVALID_REQUEST", "AUTHORIZATION_MISSING", "DEPLOYMENT_MACHINE_IDENTITY_REQUIRED", "ORGANIZATION_SCOPE_MISSING", "SERVICE_OWNERSHIP_MISMATCH", "DEPLOYMENT_OPERATION_NOT_FOUND", "DEPLOYMENT_OPERATION_CONFLICT", "DEPLOY_ON_PUSH_MUST_BE_DISABLED", "REGISTRY_AUTHENTICATION_UNAVAILABLE", "REGISTRY_REPOSITORY_MISMATCH", "REGISTRY_TAG_CONFLICT", "SOURCE_REVISION_INVALID", "SOURCE_WORKTREE_DIRTY", "VERSION_NOT_RESERVED", "VERSION_COLLISION", "NAMESPACE_NOT_RESERVED", "NAMESPACE_COLLISION", "NAMESPACE_NOT_PROVEN_BLANK", "CONFIGURATION_DIGEST_INVALID", "INTENT_DIGEST_INVALID", "PROPOSED_CONFIGURATION_INCOMPLETE", "CURRENT_REFERENCE_MUTABLE", "CURRENT_RUNTIME_DIGEST_MISSING", "OCI_INDEX_DIGEST_REQUIRED", "OCI_INDEX_NOT_FOUND", "OCI_INDEX_MEDIA_TYPE_REQUIRED", "OCI_PLATFORM_MISSING", "OCI_PLATFORM_MANIFEST_MISSING", "IMMUTABLE_RELEASE_TAG_REQUIRED", "IMMUTABLE_RELEASE_TAG_NOT_RESERVED", "RELEASE_EVIDENCE_MISSING", "RELEASE_EVIDENCE_INVALID", "RELEASE_EVIDENCE_AMBIGUOUS", "RELEASE_NOT_AUTHORIZED", "GREENFIELD_EXECUTION_UNAVAILABLE", "ROUTE_PROMOTION_FENCE_UNAVAILABLE", "POST_DEPLOYMENT_VERIFICATION_UNAVAILABLE", "WOULD_REPLACE_EXISTING_STATE", "PLATFORM_CAPABILITY_UNAVAILABLE", "CORESTORE_INVENTORY_UNAVAILABLE", "RUNTIME_ATTESTATION_MISMATCH", "ROLLOUT_ACTIVE_CONFLICT", "ROLLOUT_NOT_SUCCEEDED", "ROUTE_UNAVAILABLE", "RELAY_NAME_RESERVED", "ROUTE_VERIFICATION_FAILED", "TLS_VERIFICATION_FAILED"];
 export type TDeploymentPreflightBlockerCode = typeof deploymentPreflightBlockerCodes[number];
 export interface IDeploymentPreflightBlocker {
     code: TDeploymentPreflightBlockerCode;

package/dist_ts/data/deploymentpreflight.js

@@ -9,6 +9,12 @@ import { canonicalizeDeploymentHostname, getDeploymentRouteVerificationHostname,
 export const deploymentPreflightBlockerCodes = [
     'INVALID_REQUEST',
     'AUTHORIZATION_MISSING',
+    /**
+     * A reservation is made by a deployment machine user (an API machine user with a deployment
+     * grant) and never by an administrator, whose registry push is not bound to any operation; the
+     * reserve request refuses such an actor with the same code.
+     */
+    'DEPLOYMENT_MACHINE_IDENTITY_REQUIRED',
     'ORGANIZATION_SCOPE_MISSING',
     'SERVICE_OWNERSHIP_MISMATCH',
     'DEPLOYMENT_OPERATION_NOT_FOUND',
@@ -263,4 +269,4 @@ export const validateDeploymentReleaseEvidence = (argsArg) => {
     }
     return blockers;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudHByZWZsaWdodC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudHByZWZsaWdodC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUxRixPQUFPLEVBQUUsdUJBQXVCLEVBQXVCLE1BQU0sZ0JBQWdCLENBQUM7QUFPOUUsT0FBTyxFQUNMLDhCQUE4QixFQUM5QixzQ0FBc0MsRUFDdEMsZ0NBQWdDLEVBQ2hDLHVDQUF1QyxHQUN4QyxNQUFNLDBCQUEwQixDQUFDO0FBSWxDOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRztJQUM3QyxpQkFBaUI7SUFDakIsdUJBQXVCO0lBQ3ZCLDRCQUE0QjtJQUM1Qiw0QkFBNEI7SUFDNUIsZ0NBQWdDO0lBQ2hDLCtCQUErQjtJQUMvQixpQ0FBaUM7SUFDakMscUNBQXFDO0lBQ3JDLDhCQUE4QjtJQUM5Qix1QkFBdUI7SUFDdkIseUJBQXlCO0lBQ3pCLHVCQUF1QjtJQUN2QixzQkFBc0I7SUFDdEIsbUJBQW1CO0lBQ25CLHdCQUF3QjtJQUN4QixxQkFBcUI7SUFDckIsNEJBQTRCO0lBQzVCLDhCQUE4QjtJQUM5Qix1QkFBdUI7SUFDdkIsbUNBQW1DO0lBQ25DLDJCQUEyQjtJQUMzQixnQ0FBZ0M7SUFDaEMsMkJBQTJCO0lBQzNCLHFCQUFxQjtJQUNyQiwrQkFBK0I7SUFDL0Isc0JBQXNCO0lBQ3RCLCtCQUErQjtJQUMvQixnQ0FBZ0M7SUFDaEMsb0NBQW9DO0lBQ3BDLDBCQUEwQjtJQUMxQiwwQkFBMEI7SUFDMUIsNEJBQTRCO0lBQzVCLHdCQUF3QjtJQUN4QixrQ0FBa0M7SUFDbEMsbUNBQW1DO0lBQ25DLDBDQUEwQztJQUMxQyw4QkFBOEI7SUFDOUIsaUNBQWlDO0lBQ2pDLGlDQUFpQztJQUNqQyw4QkFBOEI7SUFDOUIseUJBQXlCO0lBQ3pCLHVCQUF1QjtJQUN2QixtQkFBbUI7SUFDbkI7Ozs7T0FJRztJQUNILHFCQUFxQjtJQUNyQiwyQkFBMkI7SUFDM0IseUJBQXlCO0NBQ2pCLENBQUM7QUFtT1gsTUFBTSxvQkFBb0IsR0FBRyxnQkFBZ0IsQ0FBQztBQUM5QyxNQUFNLG9CQUFvQixHQUFHLDRNQUE0TSxDQUFDO0FBQzFPLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxHQUFHLENBQThDO0lBQ2pGLFlBQVk7SUFDWixNQUFNO0lBQ04sV0FBVztJQUNYLHNCQUFzQjtJQUN0Qix1QkFBdUI7Q0FDeEIsQ0FBQyxDQUFDO0FBRUgsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQzFFLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBRWhGLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELFVBQW1CLEVBQ1ksRUFBRTtJQUNqQyxNQUFNLFFBQVEsR0FBa0MsRUFBRSxDQUFDO0lBQ25ELElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMxQixPQUFPLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLGlEQUFpRCxFQUFFLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxTQUFTLEtBQUssUUFBUTtXQUN2QyxVQUFVLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQ2pDLENBQUMsK0JBQStCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ2pFLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDJDQUEyQyxFQUFFLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxJQUFJLEVBQUUsSUFBSSxVQUFVLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUNsSCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwyQ0FBMkMsRUFBRSxDQUFDLENBQUM7SUFDbkcsQ0FBQztJQUNELElBQUksT0FBTyxVQUFVLENBQUMsY0FBYyxLQUFLLFFBQVEsSUFBSSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUMzRyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHlCQUF5QixFQUFFLE9BQU8sRUFBRSwyREFBMkQsRUFBRSxDQUFDLENBQUM7UUFDekgsSUFBSSxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDbEQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxXQUFXLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDaEQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUseUNBQXlDLEVBQUUsQ0FBQyxDQUFDO0lBQ2pHLENBQUM7U0FBTSxJQUFJLFVBQVUsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNsQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLE9BQU8sRUFBRSxtREFBbUQsRUFBRSxDQUFDLENBQUM7SUFDakgsQ0FBQztJQUNELElBQUksT0FBTyxVQUFVLENBQUMsT0FBTyxLQUFLLFFBQVE7V0FDckMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUMvQixDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUNwRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLE9BQU8sRUFBRSxtREFBbUQsRUFBRSxDQUFDLENBQUM7UUFDOUcsSUFBSSxPQUFPLFVBQVUsQ0FBQyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDM0MsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsK0JBQStCLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZGLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxZQUFZLEtBQUssUUFBUSxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDbkcsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSx1QkFBdUIsRUFBRSxPQUFPLEVBQUUsNkRBQTZELEVBQUUsQ0FBQyxDQUFDO1FBQ3pILElBQUksT0FBTyxVQUFVLENBQUMsWUFBWSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ2hELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLENBQUMsQ0FBQztRQUNoRyxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxVQUFVLENBQUMscUJBQXFCLENBQUM7UUFDOUQsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxxQkFBcUI7UUFDbEMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNkLE1BQU0sMkJBQTJCLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxhQUFhLEVBQUUsY0FBYyxDQUFDO1FBQzlFLENBQUMsQ0FBQyxhQUFhLENBQUMsY0FBYztRQUM5QixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsTUFBTSwwQkFBMEIsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUM7UUFDNUUsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUMsU0FBUyxFQUF1QixFQUFFLENBQUMsQ0FDdkUsT0FBTyxTQUFTLEtBQUssUUFBUSxDQUM5QixDQUFDO1FBQ0YsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLElBQUksdUNBQXVDLENBQUMsYUFBYSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RFLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLHFEQUFxRCxFQUFFLENBQUMsQ0FBQztJQUM3RyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsY0FBYyxLQUFLLFNBQVM7V0FDdEMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMxRyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDJCQUEyQixFQUFFLE9BQU8sRUFBRSxxREFBcUQsRUFBRSxDQUFDLENBQUM7UUFDckgsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsZ0NBQWdDLEVBQUUsQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxVQUFVLEtBQUssU0FBUztXQUNsQyxDQUFDLDRCQUE0QixDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDJCQUEyQixFQUFFLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLElBQUksS0FBSyxTQUFTLElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxJQUFJO1FBQzFFLENBQUMsQ0FBQyxZQUFZO1FBQ2QsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUM7SUFDcEIsSUFBSSxJQUFJLEtBQUssWUFBWSxJQUFJLElBQUksS0FBSyxrQkFBa0IsRUFBRSxDQUFDO1FBQ3pELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDBDQUEwQyxFQUFFLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLFNBQVM7V0FDbEMsQ0FBQyxVQUFVLENBQUMsVUFBVSxLQUFLLElBQUksSUFBSSxJQUFJLEtBQUssWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUMvRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwwQ0FBMEMsRUFBRSxDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTO1dBQzdCLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUM5QixVQUFVLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDOUIsVUFBVSxDQUFDLEtBQUssS0FBSyxPQUFPLEVBQUUsQ0FBQztRQUNsQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSx3Q0FBd0MsRUFBRSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLGNBQWMsS0FBSyxTQUFTO1dBQ3RDLENBQUMsT0FBTyxVQUFVLENBQUMsY0FBYyxLQUFLLFFBQVE7ZUFDNUMsQ0FBQyxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMvRSxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxrREFBa0QsRUFBRSxDQUFDLENBQUM7SUFDMUcsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLFdBQVcsS0FBSyxTQUFTO1dBQ25DLENBQUMsT0FBTyxVQUFVLENBQUMsV0FBVyxLQUFLLFFBQVE7ZUFDekMsQ0FBQyxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM1RSxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwrQ0FBK0MsRUFBRSxDQUFDLENBQUM7SUFDdkcsQ0FBQztJQUNELE1BQU0sY0FBYyxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztRQUNyRCxDQUFDLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ3BDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUTtZQUN6RCxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVE7WUFDbkIsQ0FBQyxDQUFDLFNBQVMsQ0FDZCxDQUFDO1FBQ0YsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUNQLElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksQ0FDckMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7V0FDOUIsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsRUFBRTtXQUM3QixJQUFJLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQyxJQUFJLEtBQUssY0FBYyxDQUFDLE1BQU07V0FDdEQsVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztlQUN0RCxPQUFPLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUTtlQUNyQyw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUSxDQUFDLFFBQVE7ZUFDdkUsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7ZUFDMUMsQ0FBQyxPQUFPLFFBQVEsQ0FBQyxVQUFVLEtBQUssUUFBUTttQkFDdEMsQ0FBQyxRQUFRLENBQUMsVUFBVSxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQyxDQUFDO2VBQzNELENBQUMsUUFBUSxDQUFDLE9BQU8sS0FBSyxTQUFTLElBQUksT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLFNBQVMsQ0FBQztlQUN6RSxDQUFDLDJCQUEyQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO2VBQzFELENBQUMsUUFBUSxDQUFDLG9CQUFvQixLQUFLLFNBQVM7bUJBQzFDLENBQUMsT0FBTyxRQUFRLENBQUMsb0JBQW9CLEtBQUssUUFBUTt1QkFDaEQsOEJBQThCLENBQUMsUUFBUSxDQUFDLG9CQUFvQixDQUFDOzRCQUMxRCxRQUFRLENBQUMsb0JBQW9CLENBQUMsQ0FBQztlQUN0QyxzQ0FBc0MsQ0FDdkMsUUFBOEMsQ0FDL0MsS0FBSyxTQUFTO2VBQ1osQ0FBQyxRQUFRLENBQUMsYUFBYSxLQUFLLFNBQVM7bUJBQ25DLENBQUMsT0FBTyxRQUFRLENBQUMsYUFBYSxLQUFLLFFBQVE7dUJBQ3pDLGdDQUFnQyxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsS0FBSyxRQUFRLENBQUMsYUFBYSxDQUFDLENBQUM7ZUFDekYsQ0FBQyxRQUFRLENBQUMsbUJBQW1CLEtBQUssU0FBUzttQkFDekMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUFDO3VCQUMzQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsTUFBTSxHQUFHLENBQUM7dUJBQ3ZDLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsRUFBRTt1QkFDeEMsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNO3VCQUNsRixRQUFRLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxDQUNsRCxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLElBQUksU0FBUyxHQUFHLEdBQUcsSUFBSSxTQUFTLEdBQUcsR0FBRyxDQUN2RSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQ1osRUFBRSxDQUFDO1FBQ0YsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsNENBQTRDLEVBQUUsQ0FBQyxDQUFDO0lBQ3BHLENBQUM7SUFDRCw4RkFBOEY7SUFDOUYsK0ZBQStGO0lBQy9GLDhGQUE4RjtJQUM5RixnR0FBZ0c7SUFDaEcsOEZBQThGO0lBQzlGLDZGQUE2RjtJQUM3RixNQUFNLGdCQUFnQixHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDakYsTUFBTSxtQkFBbUIsR0FBRyxnQkFBZ0IsS0FBSyxTQUFTO1dBQ3JELENBQUMsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxJQUFJLGdCQUFnQixDQUFDLEtBQUssS0FBSyxTQUFTLENBQUM7UUFDdEYsQ0FBQyxDQUFDLHVCQUF1QixDQUFDLFVBQVUsRUFBRSxxQ0FBcUMsQ0FBQztRQUM1RSxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsSUFBSSxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbkMsUUFBUSxDQUFDLElBQUksQ0FBQztZQUNaLElBQUksRUFBRSxpQkFBaUI7WUFDdkIsT0FBTyxFQUFFLDJDQUEyQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUc7U0FDdEYsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELElBQUksSUFBSSxLQUFLLFlBQVksSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7V0FDeEQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQ2hFLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxPQUFPLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQ3JGLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ04sSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsMEJBQTBCLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUN4RSxRQUFRLENBQUMsSUFBSSxDQUFDO1lBQ1osSUFBSSxFQUFFLGlCQUFpQjtZQUN2QixPQUFPLEVBQUUsK0RBQStEO1NBQ3pFLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUFDLE9BTWpELEVBQWlDLEVBQUU7SUFDbEMsTUFBTSxRQUFRLEdBQWtDLEVBQUUsQ0FBQztJQUNuRCxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2hDLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUscUNBQXFDLEVBQUUsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDO0lBQ2xDLElBQUksUUFBUSxDQUFDLGlCQUFpQixLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3hDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsd0JBQXdCLEVBQUUsT0FBTyxFQUFFLHFEQUFxRCxFQUFFLENBQUMsQ0FBQztJQUNwSCxDQUFDO0lBQ0QsSUFDRSxRQUFRLENBQUMsY0FBYyxLQUFLLE9BQU8sQ0FBQyxjQUFjO1dBQy9DLFFBQVEsQ0FBQyxPQUFPLEtBQUssT0FBTyxDQUFDLE9BQU87V0FDcEMsUUFBUSxDQUFDLG1CQUFtQixLQUFLLE9BQU8sQ0FBQyxtQkFBbUI7V0FDNUQsUUFBUSxDQUFDLGNBQWMsS0FBSyxPQUFPLENBQUMsY0FBYyxFQUNyRCxDQUFDO1FBQ0QsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsa0VBQWtFLEVBQUUsQ0FBQyxDQUFDO0lBQ25JLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBK0MsQ0FBQztJQUN6RSxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3ZGLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQzFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLENBQUMsQ0FBQztJQUN6RyxDQUFDO0lBQ0QsS0FBSyxNQUFNLFdBQVcsSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUN2QyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDM0IsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsd0NBQXdDLEVBQUUsQ0FBQyxDQUFDO1lBQ3ZHLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsV0FBVyxDQUFDLElBQUksQ0FBQztRQUM5QixJQUFJLE9BQU8sSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLHFCQUFxQixDQUFDLEdBQUcsQ0FBQyxJQUFtRCxDQUFDLEVBQUUsQ0FBQztZQUNoSCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxzQ0FBc0MsRUFBRSxDQUFDLENBQUM7WUFDckcsU0FBUztRQUNYLENBQUM7UUFDRCxTQUFTLENBQUMsR0FBRyxDQUFDLElBQW1ELENBQUMsQ0FBQztRQUNuRSxJQUNFLFdBQVcsQ0FBQyxhQUFhLEtBQUssT0FBTyxDQUFDLGNBQWM7ZUFDakQsT0FBTyxXQUFXLENBQUMsZUFBZSxLQUFLLFFBQVE7ZUFDL0MsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUFDO2VBQ25ELE9BQU8sV0FBVyxDQUFDLFFBQVEsS0FBSyxRQUFRO2VBQ3hDLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUU7ZUFDNUIsT0FBTyxXQUFXLENBQUMsVUFBVSxLQUFLLFFBQVE7ZUFDMUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUM7ZUFDN0MsV0FBVyxDQUFDLFVBQVUsR0FBRyxDQUFDLEVBQzdCLENBQUM7WUFDRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxXQUFXLElBQUksWUFBWSxFQUFFLENBQUMsQ0FBQztRQUM1RixDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxZQUFZLElBQUkscUJBQXFCLEVBQUUsQ0FBQztRQUNqRCxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ2pDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLFdBQVcsWUFBWSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQ3BHLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudHByZWZsaWdodC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudHByZWZsaWdodC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUUxRixPQUFPLEVBQUUsdUJBQXVCLEVBQXVCLE1BQU0sZ0JBQWdCLENBQUM7QUFPOUUsT0FBTyxFQUNMLDhCQUE4QixFQUM5QixzQ0FBc0MsRUFDdEMsZ0NBQWdDLEVBQ2hDLHVDQUF1QyxHQUN4QyxNQUFNLDBCQUEwQixDQUFDO0FBSWxDOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRztJQUM3QyxpQkFBaUI7SUFDakIsdUJBQXVCO0lBQ3ZCOzs7O09BSUc7SUFDSCxzQ0FBc0M7SUFDdEMsNEJBQTRCO0lBQzVCLDRCQUE0QjtJQUM1QixnQ0FBZ0M7SUFDaEMsK0JBQStCO0lBQy9CLGlDQUFpQztJQUNqQyxxQ0FBcUM7SUFDckMsOEJBQThCO0lBQzlCLHVCQUF1QjtJQUN2Qix5QkFBeUI7SUFDekIsdUJBQXVCO0lBQ3ZCLHNCQUFzQjtJQUN0QixtQkFBbUI7SUFDbkIsd0JBQXdCO0lBQ3hCLHFCQUFxQjtJQUNyQiw0QkFBNEI7SUFDNUIsOEJBQThCO0lBQzlCLHVCQUF1QjtJQUN2QixtQ0FBbUM7SUFDbkMsMkJBQTJCO0lBQzNCLGdDQUFnQztJQUNoQywyQkFBMkI7SUFDM0IscUJBQXFCO0lBQ3JCLCtCQUErQjtJQUMvQixzQkFBc0I7SUFDdEIsK0JBQStCO0lBQy9CLGdDQUFnQztJQUNoQyxvQ0FBb0M7SUFDcEMsMEJBQTBCO0lBQzFCLDBCQUEwQjtJQUMxQiw0QkFBNEI7SUFDNUIsd0JBQXdCO0lBQ3hCLGtDQUFrQztJQUNsQyxtQ0FBbUM7SUFDbkMsMENBQTBDO0lBQzFDLDhCQUE4QjtJQUM5QixpQ0FBaUM7SUFDakMsaUNBQWlDO0lBQ2pDLDhCQUE4QjtJQUM5Qix5QkFBeUI7SUFDekIsdUJBQXVCO0lBQ3ZCLG1CQUFtQjtJQUNuQjs7OztPQUlHO0lBQ0gscUJBQXFCO0lBQ3JCLDJCQUEyQjtJQUMzQix5QkFBeUI7Q0FDakIsQ0FBQztBQW1PWCxNQUFNLG9CQUFvQixHQUFHLGdCQUFnQixDQUFDO0FBQzlDLE1BQU0sb0JBQW9CLEdBQUcsNE1BQTRNLENBQUM7QUFDMU8sTUFBTSxxQkFBcUIsR0FBRyxJQUFJLEdBQUcsQ0FBOEM7SUFDakYsWUFBWTtJQUNaLE1BQU07SUFDTixXQUFXO0lBQ1gsc0JBQXNCO0lBQ3RCLHVCQUF1QjtDQUN4QixDQUFDLENBQUM7QUFFSCxNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FDMUUsT0FBTyxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFaEYsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FDaEQsVUFBbUIsRUFDWSxFQUFFO0lBQ2pDLE1BQU0sUUFBUSxHQUFrQyxFQUFFLENBQUM7SUFDbkQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzFCLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsaURBQWlELEVBQUUsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3ZDLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLEdBQUc7V0FDakMsQ0FBQywrQkFBK0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDakUsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsMkNBQTJDLEVBQUUsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxJQUFJLFVBQVUsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQ2xILFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDJDQUEyQyxFQUFFLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUSxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQzNHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUseUJBQXlCLEVBQUUsT0FBTyxFQUFFLDJEQUEyRCxFQUFFLENBQUMsQ0FBQztRQUN6SCxJQUFJLE9BQU8sVUFBVSxDQUFDLGNBQWMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNsRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNoRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSx5Q0FBeUMsRUFBRSxDQUFDLENBQUM7SUFDakcsQ0FBQztTQUFNLElBQUksVUFBVSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ2xDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsdUJBQXVCLEVBQUUsT0FBTyxFQUFFLG1EQUFtRCxFQUFFLENBQUMsQ0FBQztJQUNqSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxPQUFPLEtBQUssUUFBUTtXQUNyQyxVQUFVLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQy9CLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ3BELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsT0FBTyxFQUFFLG1EQUFtRCxFQUFFLENBQUMsQ0FBQztRQUM5RyxJQUFJLE9BQU8sVUFBVSxDQUFDLE9BQU8sS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUMzQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNuRyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLHVCQUF1QixFQUFFLE9BQU8sRUFBRSw2REFBNkQsRUFBRSxDQUFDLENBQUM7UUFDekgsSUFBSSxPQUFPLFVBQVUsQ0FBQyxZQUFZLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDaEQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsd0NBQXdDLEVBQUUsQ0FBQyxDQUFDO1FBQ2hHLENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQyxxQkFBcUIsQ0FBQztRQUM5RCxDQUFDLENBQUMsVUFBVSxDQUFDLHFCQUFxQjtRQUNsQyxDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ2QsTUFBTSwyQkFBMkIsR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxjQUFjLENBQUM7UUFDOUUsQ0FBQyxDQUFDLGFBQWEsQ0FBQyxjQUFjO1FBQzlCLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDUCxNQUFNLDBCQUEwQixHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxFQUFFLGFBQWEsQ0FBQztRQUM1RSxDQUFDLENBQUMsYUFBYSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQXVCLEVBQUUsQ0FBQyxDQUN2RSxPQUFPLFNBQVMsS0FBSyxRQUFRLENBQzlCLENBQUM7UUFDRixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsSUFBSSx1Q0FBdUMsQ0FBQyxhQUFhLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEUsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUscURBQXFELEVBQUUsQ0FBQyxDQUFDO0lBQzdHLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxjQUFjLEtBQUssU0FBUztXQUN0QyxDQUFDLE9BQU8sVUFBVSxDQUFDLGNBQWMsS0FBSyxRQUFRLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMkJBQTJCLEVBQUUsT0FBTyxFQUFFLHFEQUFxRCxFQUFFLENBQUMsQ0FBQztRQUNySCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSxnQ0FBZ0MsRUFBRSxDQUFDLENBQUM7SUFDeEYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxTQUFTO1dBQ2xDLENBQUMsNEJBQTRCLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDMUQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsMkJBQTJCLEVBQUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxVQUFVLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLElBQUk7UUFDMUUsQ0FBQyxDQUFDLFlBQVk7UUFDZCxDQUFDLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQztJQUNwQixJQUFJLElBQUksS0FBSyxZQUFZLElBQUksSUFBSSxLQUFLLGtCQUFrQixFQUFFLENBQUM7UUFDekQsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxpQkFBaUIsRUFBRSxPQUFPLEVBQUUsMENBQTBDLEVBQUUsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQyxVQUFVLEtBQUssU0FBUztXQUNsQyxDQUFDLFVBQVUsQ0FBQyxVQUFVLEtBQUssSUFBSSxJQUFJLElBQUksS0FBSyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQy9ELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLDBDQUEwQyxFQUFFLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsS0FBSyxLQUFLLFNBQVM7V0FDN0IsVUFBVSxDQUFDLEtBQUssS0FBSyxTQUFTO1dBQzlCLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUM5QixVQUFVLENBQUMsS0FBSyxLQUFLLE9BQU8sRUFBRSxDQUFDO1FBQ2xDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLHdDQUF3QyxFQUFFLENBQUMsQ0FBQztJQUNoRyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsY0FBYyxLQUFLLFNBQVM7V0FDdEMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxjQUFjLEtBQUssUUFBUTtlQUM1QyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsY0FBYyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQy9FLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLGtEQUFrRCxFQUFFLENBQUMsQ0FBQztJQUMxRyxDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsV0FBVyxLQUFLLFNBQVM7V0FDbkMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxXQUFXLEtBQUssUUFBUTtlQUN6QyxDQUFDLHFDQUFxQyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzVFLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsT0FBTyxFQUFFLCtDQUErQyxFQUFFLENBQUMsQ0FBQztJQUN2RyxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQ3JELENBQUMsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDcEMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRO1lBQ3pELENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUTtZQUNuQixDQUFDLENBQUMsU0FBUyxDQUNkLENBQUM7UUFDRixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUNyQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztXQUM5QixVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxFQUFFO1dBQzdCLElBQUksR0FBRyxDQUFDLGNBQWMsQ0FBQyxDQUFDLElBQUksS0FBSyxjQUFjLENBQUMsTUFBTTtXQUN0RCxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO2VBQ3RELE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRO2VBQ3JDLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxRQUFRLENBQUMsUUFBUTtlQUN2RSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztlQUMxQyxDQUFDLE9BQU8sUUFBUSxDQUFDLFVBQVUsS0FBSyxRQUFRO21CQUN0QyxDQUFDLFFBQVEsQ0FBQyxVQUFVLEdBQUcsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxVQUFVLEdBQUcsS0FBSyxDQUFDLENBQUM7ZUFDM0QsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLFNBQVMsSUFBSSxPQUFPLFFBQVEsQ0FBQyxPQUFPLEtBQUssU0FBUyxDQUFDO2VBQ3pFLENBQUMsMkJBQTJCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7ZUFDMUQsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEtBQUssU0FBUzttQkFDMUMsQ0FBQyxPQUFPLFFBQVEsQ0FBQyxvQkFBb0IsS0FBSyxRQUFRO3VCQUNoRCw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLENBQUM7NEJBQzFELFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO2VBQ3RDLHNDQUFzQyxDQUN2QyxRQUE4QyxDQUMvQyxLQUFLLFNBQVM7ZUFDWixDQUFDLFFBQVEsQ0FBQyxhQUFhLEtBQUssU0FBUzttQkFDbkMsQ0FBQyxPQUFPLFFBQVEsQ0FBQyxhQUFhLEtBQUssUUFBUTt1QkFDekMsZ0NBQWdDLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxLQUFLLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQztlQUN6RixDQUFDLFFBQVEsQ0FBQyxtQkFBbUIsS0FBSyxTQUFTO21CQUN6QyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUM7dUJBQzNDLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLEdBQUcsQ0FBQzt1QkFDdkMsUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxFQUFFO3VCQUN4QyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU07dUJBQ2xGLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLENBQ2xELENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsSUFBSSxTQUFTLEdBQUcsR0FBRyxJQUFJLFNBQVMsR0FBRyxHQUFHLENBQ3ZFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FDWixFQUFFLENBQUM7UUFDRixRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLGlCQUFpQixFQUFFLE9BQU8sRUFBRSw0Q0FBNEMsRUFBRSxDQUFDLENBQUM7SUFDcEcsQ0FBQztJQUNELDhGQUE4RjtJQUM5RiwrRkFBK0Y7SUFDL0YsOEZBQThGO0lBQzlGLGdHQUFnRztJQUNoRyw4RkFBOEY7SUFDOUYsNkZBQTZGO0lBQzdGLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNqRixNQUFNLG1CQUFtQixHQUFHLGdCQUFnQixLQUFLLFNBQVM7V0FDckQsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLElBQUksZ0JBQWdCLENBQUMsS0FBSyxLQUFLLFNBQVMsQ0FBQztRQUN0RixDQUFDLENBQUMsdUJBQXVCLENBQUMsVUFBVSxFQUFFLHFDQUFxQyxDQUFDO1FBQzVFLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDUCxJQUFJLG1CQUFtQixDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNuQyxRQUFRLENBQUMsSUFBSSxDQUFDO1lBQ1osSUFBSSxFQUFFLGlCQUFpQjtZQUN2QixPQUFPLEVBQUUsMkNBQTJDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsR0FBRztTQUN0RixDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEtBQUssWUFBWSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztXQUN4RCxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FDaEUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLE9BQU8sUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FDckYsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDTixJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3hFLFFBQVEsQ0FBQyxJQUFJLENBQUM7WUFDWixJQUFJLEVBQUUsaUJBQWlCO1lBQ3ZCLE9BQU8sRUFBRSwrREFBK0Q7U0FDekUsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLENBQUMsT0FNakQsRUFBaUMsRUFBRTtJQUNsQyxNQUFNLFFBQVEsR0FBa0MsRUFBRSxDQUFDO0lBQ25ELElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDaEMsT0FBTyxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUM7SUFDbEMsSUFBSSxRQUFRLENBQUMsaUJBQWlCLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDeEMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSx3QkFBd0IsRUFBRSxPQUFPLEVBQUUscURBQXFELEVBQUUsQ0FBQyxDQUFDO0lBQ3BILENBQUM7SUFDRCxJQUNFLFFBQVEsQ0FBQyxjQUFjLEtBQUssT0FBTyxDQUFDLGNBQWM7V0FDL0MsUUFBUSxDQUFDLE9BQU8sS0FBSyxPQUFPLENBQUMsT0FBTztXQUNwQyxRQUFRLENBQUMsbUJBQW1CLEtBQUssT0FBTyxDQUFDLG1CQUFtQjtXQUM1RCxRQUFRLENBQUMsY0FBYyxLQUFLLE9BQU8sQ0FBQyxjQUFjLEVBQ3JELENBQUM7UUFDRCxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSxrRUFBa0UsRUFBRSxDQUFDLENBQUM7SUFDbkksQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUErQyxDQUFDO0lBQ3pFLE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDdkYsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDMUMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsd0NBQXdDLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7SUFDRCxLQUFLLE1BQU0sV0FBVyxJQUFJLFlBQVksRUFBRSxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztZQUMzQixRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLDBCQUEwQixFQUFFLE9BQU8sRUFBRSx3Q0FBd0MsRUFBRSxDQUFDLENBQUM7WUFDdkcsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxXQUFXLENBQUMsSUFBSSxDQUFDO1FBQzlCLElBQUksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLENBQUMscUJBQXFCLENBQUMsR0FBRyxDQUFDLElBQW1ELENBQUMsRUFBRSxDQUFDO1lBQ2hILFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLHNDQUFzQyxFQUFFLENBQUMsQ0FBQztZQUNyRyxTQUFTO1FBQ1gsQ0FBQztRQUNELFNBQVMsQ0FBQyxHQUFHLENBQUMsSUFBbUQsQ0FBQyxDQUFDO1FBQ25FLElBQ0UsV0FBVyxDQUFDLGFBQWEsS0FBSyxPQUFPLENBQUMsY0FBYztlQUNqRCxPQUFPLFdBQVcsQ0FBQyxlQUFlLEtBQUssUUFBUTtlQUMvQyxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQUM7ZUFDbkQsT0FBTyxXQUFXLENBQUMsUUFBUSxLQUFLLFFBQVE7ZUFDeEMsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRTtlQUM1QixPQUFPLFdBQVcsQ0FBQyxVQUFVLEtBQUssUUFBUTtlQUMxQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQztlQUM3QyxXQUFXLENBQUMsVUFBVSxHQUFHLENBQUMsRUFDN0IsQ0FBQztZQUNELFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEVBQUUsT0FBTyxFQUFFLFdBQVcsSUFBSSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQzVGLENBQUM7SUFDSCxDQUFDO0lBQ0QsS0FBSyxNQUFNLFlBQVksSUFBSSxxQkFBcUIsRUFBRSxDQUFDO1FBQ2pELElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7WUFDakMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSwwQkFBMEIsRUFBRSxPQUFPLEVBQUUsV0FBVyxZQUFZLFlBQVksRUFBRSxDQUFDLENBQUM7UUFDcEcsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQztBQUNsQixDQUFDLENBQUMifQ==

package/dist_ts/data/index.d.ts

@@ -12,6 +12,7 @@ export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
+export * from './deploymentmachineuser.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
 export * from './migration.js';

package/dist_ts/data/index.js

@@ -12,6 +12,7 @@ export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
+export * from './deploymentmachineuser.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
 export * from './migration.js';
@@ -71,4 +72,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsd0JBQXdCLENBQUM7QUFHdkMsT0FBTyxFQUFFLDBCQUEwQixFQUFFLE1BQU0sa0JBQWtCLENBQUM7QUFHOUQsT0FBTyxFQUFFLHFDQUFxQyxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDcEYsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyxlQUFlLENBQUM7QUFDOUIsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLHNCQUFzQixDQUFDO0FBQ3JDLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsaUJBQWlCLENBQUM7QUFDaEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYywwQkFBMEIsQ0FBQztBQUN6QyxjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsVUFBVSxDQUFDO0FBQ3pCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGdCQUFnQixDQUFDO0FBQy9CLGNBQWMsWUFBWSxDQUFDO0FBQzNCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyx3QkFBd0IsQ0FBQztBQUd2QyxPQUFPLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUc5RCxPQUFPLEVBQUUscUNBQXFDLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUNwRixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxrQkFBa0IsQ0FBQztBQUNqQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxrQ0FBa0MsQ0FBQztBQUNqRCxjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLG9CQUFvQixDQUFDO0FBQ25DLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsV0FBVyxDQUFDO0FBQzFCLGNBQWMsY0FBYyxDQUFDO0FBQzdCLGNBQWMsY0FBYyxDQUFDIn0=

package/dist_ts/requests/admin.d.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import type { IIdentity, IIdentityCredential, IServiceDeploymentGrant } from '../data/user.js';
 import type { IServiceMachineCredentialMetadata, IServiceMachineCredentialMutationResult, TServiceMachineCredentialMutation } from '../data/servicecredential.js';
+import type { IDeploymentMachineUserMetadata, IDeploymentMachineUserMutationResult, TDeploymentMachineUserMutation } from '../data/deploymentmachineuser.js';
 export interface IReq_Admin_GetServiceMachineCredential extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_GetServiceMachineCredential> {
     method: 'getServiceMachineCredential';
     request: {
@@ -79,6 +80,40 @@ export interface IReq_Admin_LoginWithUsernameAndPassword extends plugins.typedre
         identity: IIdentity;
     };
 }
+/**
+ * Lists every deployment machine user, value-free: no token value is ever answered here.
+ * Requires an administrator; refusals travel as `IDeploymentMachineUserErrorData`.
+ */
+export interface IReq_Admin_GetDeploymentMachineUsers extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_GetDeploymentMachineUsers> {
+    method: 'getDeploymentMachineUsers';
+    request: {
+        identity: IIdentityCredential;
+    };
+    response: {
+        users: IDeploymentMachineUserMetadata[];
+    };
+}
+/**
+ * Creates a deployment machine user, or rotates or revokes its token.
+ *
+ * Requires an administrator. The token is answered exactly once, on the first answer to `create`
+ * or `rotate-token`; a replay of the same mutation ID by the same administrator answers the
+ * historical metadata with `token: null` and never issues another token. Grants are attached with
+ * `configureServiceDeploymentMachineUser`. Refusals travel as `IDeploymentMachineUserErrorData`.
+ */
+export interface IReq_Admin_MutateDeploymentMachineUser extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_MutateDeploymentMachineUser> {
+    method: 'mutateDeploymentMachineUser';
+    request: {
+        identity: IIdentityCredential;
+        mutation: TDeploymentMachineUserMutation;
+    };
+    response: IDeploymentMachineUserMutationResult;
+}
+/**
+ * Attaches one deployment grant to a deployment machine user that holds a token, replacing the
+ * grant it held for the same organization and service. `mutateDeploymentMachineUser` creates such
+ * a user.
+ */
 export interface IReq_Admin_ConfigureServiceDeploymentMachineUser extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_ConfigureServiceDeploymentMachineUser> {
     method: 'configureServiceDeploymentMachineUser';
     request: {

package/dist_ts/requests/service.d.ts

@@ -153,6 +153,14 @@ export interface IRequest_Any_Cloudly_RollbackServiceImageRelease extends plugin
         operation: IServiceDeploymentOperation;
     };
 }
+/**
+ * Reserves one immutable deployment for the authenticated deployment machine user.
+ *
+ * Only an API machine user can complete the operation it reserves, because only its registry
+ * push is bound to that operation. An actor that is not an API machine user, an administrator
+ * included, is refused with the code `DEPLOYMENT_MACHINE_IDENTITY_REQUIRED` before anything is
+ * reserved.
+ */
 export interface IRequest_Any_Cloudly_ReserveServiceDeployment extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IRequest_Any_Cloudly_ReserveServiceDeployment> {
     method: 'reserveServiceDeployment';
     request: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.32.0",
+  "version": "32.33.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {

package/readme.md

@@ -2961,6 +2961,30 @@ interface IExampleRequest {
 
 Cloudly deployment authority is expressed as an exact `data.IServiceDeploymentGrant`. A `service` grant applies to one owned existing service. An `organization-service-slot` grant reserves authority for one exact future service ID in an organization; it is not an organization-wide wildcard. `configureServiceDeploymentMachineUser` accepts this discriminated `grant` object instead of separate service and capability fields.
 
+A deployer authenticates as a deployment machine user: an API machine user with a bearer token
+and the grants attached to it. An administrator manages these users with two requests:
+
+- `requests.admin.getDeploymentMachineUsers` lists every deployment machine user as
+  `data.IDeploymentMachineUserMetadata`: its id, username, token expiries and grants, never a
+  token value.
+- `requests.admin.mutateDeploymentMachineUser` takes one `data.TDeploymentMachineUserMutation`.
+  `create` makes a user with one token under a username no other user holds;
+  `data.isDeploymentMachineUsername` is the rule (lowercase, at most 64 characters, no `:` or `/`),
+  because the username is also the registry login name. `rotate-token` replaces every token of the
+  user with a new one, and `revoke-token` removes them all while the grants stay. An expiry must be
+  in the future and at most `deploymentMachineUserContract.maximumTokenLifetimeMs` (one year) away
+  (`data.isDeploymentMachineTokenExpiryAdmissible`). The token is answered exactly once, on the
+  first answer to `create` or `rotate-token`; a replay of the same `mutationId` answers the
+  historical metadata with `token: null`, so a lost token is replaced by a rotation.
+
+Both refuse by the names in `data.deploymentMachineUserRefusals`, carried as
+`data.IDeploymentMachineUserErrorData`. `data.snapshotDeploymentMachineUserMutation` and
+`data.snapshotDeploymentMachineUserMetadata` are the structural checks; authorizing the
+administrator and the target user is the backend's. A reservation is made only by an API machine
+user: any other actor, an administrator included, is refused `DEPLOYMENT_MACHINE_IDENTITY_REQUIRED`,
+which is also a preflight blocker code, because only that user's registry push is bound to the
+operation it reserved.
+
 The immutable deployment workflow is:
 
 1. Reserve the exact service, namespace, registry repository/tag, and route intent with `reserveServiceDeployment`.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.32.0',
+  version: '32.33.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/deploymentmachineuser.ts

@@ -0,0 +1,174 @@
+import { readDataElements, readDataProperty, readExactDataRecord } from '../private/dataproperties.js';
+import { validateServiceDeploymentGrant, type IServiceDeploymentGrant } from './user.js';
+
+/**
+ * A deployment machine user is the identity a deployer such as `@git.zone/tsdeploy` authenticates
+ * as: an API machine user that carries a bearer token and the deployment grants an administrator
+ * attaches with `configureServiceDeploymentMachineUser`. An administrator creates one, rotates or
+ * revokes its token, and lists them; nothing else mints one.
+ */
+export const deploymentMachineUserContract = Object.freeze({
+  /** A token lives at most one year from the mutation that issued it, like every machine token. */
+  maximumTokenLifetimeMs: 365 * 24 * 60 * 60 * 1000,
+  /**
+   * The longest username a created user may take. The username is also the registry login name
+   * a deployer states, so it stays short, lowercase and free of `:` and `/`.
+   */
+  maximumCreatedUsernameLength: 64,
+  /** The longest stored username a listing reports, the bound Cloudly has always stored. */
+  maximumUsernameLength: 200,
+  /** Grants one user carries at most. */
+  maximumGrants: 64,
+  /** Tokens one listed user reports at most. */
+  maximumTokens: 64,
+});
+
+/** One token of a deployment machine user, without its value. */
+export interface IDeploymentMachineTokenMetadata {
+  expiresAt: number;
+}
+
+/** Value-free metadata of one deployment machine user. No token value is ever part of it. */
+export interface IDeploymentMachineUserMetadata {
+  userId: string;
+  username: string;
+  /** Ascending by expiry; empty after `revoke-token`. */
+  tokens: IDeploymentMachineTokenMetadata[];
+  /** Sorted by `organizationId:serviceId`, as Cloudly stores them. */
+  grants: IServiceDeploymentGrant[];
+}
+
+interface IDeploymentMachineUserMutationBase {
+  /** Retain the complete mutation and this ID across retries. */
+  mutationId: string;
+}
+
+/**
+ * `create` makes a new user with one token; the username must not be taken by any user.
+ * `rotate-token` replaces every token of the user with one new token. `revoke-token` removes every
+ * token, which ends the user's authentication while keeping its grants for a later rotation.
+ */
+export type TDeploymentMachineUserMutation = IDeploymentMachineUserMutationBase & (
+  | { operation: 'create'; username: string; expiresAt: number }
+  | { operation: 'rotate-token'; userId: string; expiresAt: number }
+  | { operation: 'revoke-token'; userId: string }
+);
+
+export interface IDeploymentMachineUserMutationResult {
+  /** Historical on replay; read `getDeploymentMachineUsers` for current state. */
+  user: IDeploymentMachineUserMetadata;
+  /**
+   * The new token, answered exactly once: on the first answer to `create` or `rotate-token`.
+   * `revoke-token` and every replay answer `null`; a lost token is replaced by a rotation.
+   */
+  token: string | null;
+  replayed: boolean;
+}
+
+/**
+ * Every refusal the deployment machine user requests name, as `IDeploymentMachineUserErrorData`.
+ *
+ * - `ADMIN_AUTHORIZATION_REQUIRED`: the caller is not an administrator.
+ * - `DEPLOYMENT_MACHINE_USER_REQUEST_INVALID`: the request does not satisfy this contract.
+ * - `DEPLOYMENT_MACHINE_USERNAME_TAKEN`: another user already has the username.
+ * - `DEPLOYMENT_MACHINE_USER_INVALID`: the user is not a deployment machine user (it does not
+ *   exist, or it is a human, cluster, administrator or service workload identity).
+ * - `DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID`: the expiry is not in the future, or is more than
+ *   `maximumTokenLifetimeMs` away (`isDeploymentMachineTokenExpiryAdmissible`).
+ * - `DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT`: the mutation ID was used for a different mutation
+ *   or by a different administrator.
+ */
+export const deploymentMachineUserRefusals = [
+  'ADMIN_AUTHORIZATION_REQUIRED',
+  'DEPLOYMENT_MACHINE_USER_REQUEST_INVALID',
+  'DEPLOYMENT_MACHINE_USERNAME_TAKEN',
+  'DEPLOYMENT_MACHINE_USER_INVALID',
+  'DEPLOYMENT_MACHINE_TOKEN_EXPIRY_INVALID',
+  'DEPLOYMENT_MACHINE_USER_MUTATION_CONFLICT',
+] as const;
+
+export type TDeploymentMachineUserRefusal = typeof deploymentMachineUserRefusals[number];
+
+export interface IDeploymentMachineUserErrorData {
+  code: TDeploymentMachineUserRefusal;
+  retryable: false;
+}
+
+const fail = (): never => { throw new Error('Deployment machine user contract rejected.'); };
+function requireValue(value: unknown): asserts value { if (!value) fail(); }
+const safe = <T>(operation: () => T): T => { try { return operation(); } catch { return fail(); } };
+/** Exactly this shape's keys, read once as data; an accessor is refused, never invoked. */
+const object = (value: unknown, keys: readonly string[]): Record<string, unknown> => {
+  const copy = readExactDataRecord(value, keys);
+  requireValue(copy !== null);
+  return copy;
+};
+const identifier = (value: unknown): string => {
+  requireValue(typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/.test(value));
+  return value;
+};
+const timestamp = (value: unknown): number => {
+  requireValue(typeof value === 'number' && Number.isSafeInteger(value) && value > 0);
+  return value;
+};
+const createdUsernamePattern = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;
+
+/** Whether a username may be given to a new deployment machine user. */
+export const isDeploymentMachineUsername = (value: unknown): value is string => (
+  typeof value === 'string' && createdUsernamePattern.test(value)
+);
+
+/** Whether a token expiry is in the future and at most `maximumTokenLifetimeMs` after `now`. */
+export const isDeploymentMachineTokenExpiryAdmissible = (expiresAt: number, now: number): boolean => (
+  Number.isSafeInteger(expiresAt) && Number.isSafeInteger(now) && expiresAt > now
+  && expiresAt <= now + deploymentMachineUserContract.maximumTokenLifetimeMs
+);
+
+/** Structural copy only; the backend authorizes the administrator and the target user. */
+export const snapshotDeploymentMachineUserMutation = (value: unknown): TDeploymentMachineUserMutation => safe(() => {
+  const operation = readDataProperty(value, 'operation')?.value;
+  requireValue(operation === 'create' || operation === 'rotate-token' || operation === 'revoke-token');
+  if (operation === 'create') {
+    const request = object(value, ['mutationId', 'operation', 'username', 'expiresAt']);
+    requireValue(isDeploymentMachineUsername(request.username));
+    return { mutationId: identifier(request.mutationId), operation, username: request.username,
+      expiresAt: timestamp(request.expiresAt) };
+  }
+  if (operation === 'rotate-token') {
+    const request = object(value, ['mutationId', 'operation', 'userId', 'expiresAt']);
+    return { mutationId: identifier(request.mutationId), operation, userId: identifier(request.userId),
+      expiresAt: timestamp(request.expiresAt) };
+  }
+  const request = object(value, ['mutationId', 'operation', 'userId']);
+  return { mutationId: identifier(request.mutationId), operation, userId: identifier(request.userId) };
+});
+
+/** Structural copy of listed metadata: a stored username, tokens by expiry, valid sorted grants. */
+export const snapshotDeploymentMachineUserMetadata = (value: unknown): IDeploymentMachineUserMetadata => safe(() => {
+  const metadata = object(value, ['userId', 'username', 'tokens', 'grants']);
+  requireValue(typeof metadata.username === 'string' && metadata.username.length > 0
+    && metadata.username.length <= deploymentMachineUserContract.maximumUsernameLength
+    && metadata.username.trim() === metadata.username && !/[\u0000-\u001f\u007f]/.test(metadata.username));
+  const tokenEntries = readDataElements(metadata.tokens, deploymentMachineUserContract.maximumTokens);
+  requireValue(tokenEntries !== null);
+  const tokens = tokenEntries.map((entry) => ({ expiresAt: timestamp(object(entry, ['expiresAt']).expiresAt) }));
+  for (let index = 1; index < tokens.length; index++) {
+    requireValue(tokens[index - 1].expiresAt <= tokens[index].expiresAt);
+  }
+  const grantEntries = readDataElements(metadata.grants, deploymentMachineUserContract.maximumGrants);
+  requireValue(grantEntries !== null);
+  const grants = grantEntries.map((entry) => {
+    const grant = object(entry, ['scope', 'organizationId', 'serviceId', 'capabilities']);
+    const capabilities = readDataElements(grant.capabilities, 64);
+    requireValue(capabilities !== null);
+    const copy = { scope: grant.scope, organizationId: grant.organizationId, serviceId: grant.serviceId,
+      capabilities: [...capabilities] };
+    requireValue(validateServiceDeploymentGrant(copy).length === 0);
+    return copy as IServiceDeploymentGrant;
+  });
+  const grantKeys = grants.map((grant) => `${grant.organizationId}:${grant.serviceId}`);
+  for (let index = 1; index < grantKeys.length; index++) {
+    requireValue(grantKeys[index - 1].localeCompare(grantKeys[index]) < 0);
+  }
+  return { userId: identifier(metadata.userId), username: metadata.username, tokens, grants };
+});

package/ts/data/deploymentpreflight.ts

@@ -29,6 +29,12 @@ export type TDeploymentPreflightDecision = 'GO' | 'NO-GO';
 export const deploymentPreflightBlockerCodes = [
   'INVALID_REQUEST',
   'AUTHORIZATION_MISSING',
+  /**
+   * A reservation is made by a deployment machine user (an API machine user with a deployment
+   * grant) and never by an administrator, whose registry push is not bound to any operation; the
+   * reserve request refuses such an actor with the same code.
+   */
+  'DEPLOYMENT_MACHINE_IDENTITY_REQUIRED',
   'ORGANIZATION_SCOPE_MISSING',
   'SERVICE_OWNERSHIP_MISMATCH',
   'DEPLOYMENT_OPERATION_NOT_FOUND',

package/ts/data/index.ts

@@ -12,6 +12,7 @@ export * from './coremail.js';
 export * from './coremail.runtime.js';
 export * from './deployment.js';
 export * from './deploymentadoption.js';
+export * from './deploymentmachineuser.js';
 export * from './deploymentoperation.js';
 export * from './deploymentpreflight.js';
 export * from './migration.js';

package/ts/requests/admin.ts

@@ -4,6 +4,10 @@ import type {
   IServiceMachineCredentialMetadata, IServiceMachineCredentialMutationResult,
   TServiceMachineCredentialMutation,
 } from '../data/servicecredential.js';
+import type {
+  IDeploymentMachineUserMetadata, IDeploymentMachineUserMutationResult,
+  TDeploymentMachineUserMutation,
+} from '../data/deploymentmachineuser.js';
 
 export interface IReq_Admin_GetServiceMachineCredential extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_GetServiceMachineCredential
@@ -84,6 +88,39 @@ export interface IReq_Admin_LoginWithUsernameAndPassword extends plugins.typedre
   }
 }
 
+/**
+ * Lists every deployment machine user, value-free: no token value is ever answered here.
+ * Requires an administrator; refusals travel as `IDeploymentMachineUserErrorData`.
+ */
+export interface IReq_Admin_GetDeploymentMachineUsers extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_GetDeploymentMachineUsers
+> {
+  method: 'getDeploymentMachineUsers';
+  request: { identity: IIdentityCredential };
+  response: { users: IDeploymentMachineUserMetadata[] };
+}
+
+/**
+ * Creates a deployment machine user, or rotates or revokes its token.
+ *
+ * Requires an administrator. The token is answered exactly once, on the first answer to `create`
+ * or `rotate-token`; a replay of the same mutation ID by the same administrator answers the
+ * historical metadata with `token: null` and never issues another token. Grants are attached with
+ * `configureServiceDeploymentMachineUser`. Refusals travel as `IDeploymentMachineUserErrorData`.
+ */
+export interface IReq_Admin_MutateDeploymentMachineUser extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_MutateDeploymentMachineUser
+> {
+  method: 'mutateDeploymentMachineUser';
+  request: { identity: IIdentityCredential; mutation: TDeploymentMachineUserMutation };
+  response: IDeploymentMachineUserMutationResult;
+}
+
+/**
+ * Attaches one deployment grant to a deployment machine user that holds a token, replacing the
+ * grant it held for the same organization and service. `mutateDeploymentMachineUser` creates such
+ * a user.
+ */
 export interface IReq_Admin_ConfigureServiceDeploymentMachineUser
 extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,

package/ts/requests/service.ts

@@ -231,6 +231,14 @@ extends plugins.typedrequestInterfaces.implementsTR<
   };
 }
 
+/**
+ * Reserves one immutable deployment for the authenticated deployment machine user.
+ *
+ * Only an API machine user can complete the operation it reserves, because only its registry
+ * push is bound to that operation. An actor that is not an API machine user, an administrator
+ * included, is refused with the code `DEPLOYMENT_MACHINE_IDENTITY_REQUIRED` before anything is
+ * reserved.
+ */
 export interface IRequest_Any_Cloudly_ReserveServiceDeployment
 extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest,