@serve.zone/interfaces 32.38.0 → 32.39.0

package/changelog.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2026-10-02 - 32.39.0
+
+### Maintenance
+
+- Update release tooling to tsbuild 5.1.0 and tsdoc 3.0.1 (Node.js types stay 26.6.2 and pnpm 12.6.0 until their seven-day release age).
+
+### Features
+
+- A node's managed VPN membership now outlives its network projection.
+  `continuesRuntimeManagedVpnMembership(previous, next)` states what a membership is: one
+  projection lineage under one protected authority and one handoff lease (its node scope and
+  router incarnation), at a later generation (the same generation only as the identical projection). Workload, readiness, egress, router
+  selection and DNS window changes keep it; a protection bump, a fresh handoff or a new controller
+  epoch ends it. `bindGetRuntimeManagedVpnCredentialSuccessor` binds the credential for a successor
+  projection: the same session, transport, hub, authority and key pair as the held credential,
+  with only `projection` and `expiresAt` moved and the expiry inside the successor's effective DNS
+  window, which must cover the caller's time. A controller keeps a member and its key pair across a
+  projection change with it, so the node's hub session survives a workload change.
+
 ## 2026-09-30 - 32.38.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.38.0',
+    version: '32.39.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/networkcredential.d.ts

@@ -7,7 +7,12 @@ export interface IGetRuntimeManagedVpnCredentialRequest {
 }
 /** Secret response over the current authenticated physical peer only. Never
  * persist, hash, log, or include it in a signed network projection. The native
- * Noise owner validates and uses the keys; these shapes confer no TUN readiness. */
+ * Noise owner validates and uses the keys; these shapes confer no TUN readiness.
+ *
+ * One response names one exact projection, but its key pair belongs to the node's managed VPN
+ * membership, which outlives a projection: a credential for a successor projection of the same
+ * membership (`continuesRuntimeManagedVpnMembership`) carries the same transport, hub, authority and
+ * keys, bound by `bindGetRuntimeManagedVpnCredentialSuccessor`. */
 export interface IGetRuntimeManagedVpnCredentialResponse extends IGetRuntimeManagedVpnCredentialRequest {
     transport: TRuntimeNetworkVpnTransport;
     /** The cluster hub endpoint this node dials, named by the id its signed projection selected. */
@@ -32,6 +37,24 @@ export declare const snapshotGetRuntimeManagedVpnCredentialResponse: (value: unk
 /** Content binding only. The caller must resolve the exact current projection
  * and authenticate/fence the current physical peer before and after native work. */
 export declare const bindGetRuntimeManagedVpnCredentialRequest: (value: unknown, projectionValue: unknown, trustedSessionValue: unknown) => Promise<IGetRuntimeManagedVpnCredentialRequest>;
+/**
+ * Whether `next` continues the managed VPN membership `previous` belongs to: the same projection
+ * lineage (`id`), the same protected authority, and the same handoff lease, which names the node
+ * scope and carries the node's router incarnation. Both must hold a handoff, because a node without
+ * one is no member. `next` is `previous` itself or a later generation; an earlier one, or another
+ * projection under the same generation, continues nothing.
+ *
+ * Everything else a projection states may move under one membership: its workload endpoints, their
+ * readiness, observations and egress, its private networks, its router selection and its DNS window.
+ * Those are what the member's network carries, never who the member is. A protection bump, a fresh
+ * handoff (router reincarnation) or a new controller epoch ends the membership. Whether the hub a
+ * credential names is still selected is the credential's question
+ * (`bindGetRuntimeManagedVpnCredentialSuccessor`), not the membership's.
+ *
+ * Validates both complete projections and rejects either that does not validate; a valid pair that
+ * is not one membership answers `false`. It samples no clock and fences no session.
+ */
+export declare const continuesRuntimeManagedVpnMembership: (previousValue: unknown, nextValue: unknown) => Promise<boolean>;
 /** Bind the secret response to the original request and the exact selected router
  * endpoint of the credential's transport, inside the projection's effective DNS window. renewalValue is the
  * bare lease renewal the caller already verified and admitted for this exact
@@ -39,3 +62,22 @@ export declare const bindGetRuntimeManagedVpnCredentialRequest: (value: unknown,
  * this helper does not sample a clock, authenticate a transport, admit policy or
  * prove a running managed connection. */
 export declare const bindGetRuntimeManagedVpnCredentialResponse: (value: unknown, requestValue: unknown, projectionValue: unknown, trustedSessionValue: unknown, nowValue: unknown, renewalValue?: unknown | null) => Promise<IGetRuntimeManagedVpnCredentialResponse>;
+/**
+ * Bind the credential a node holds under its successor projection: `value` names `projectionValue`
+ * and is bound exactly as `bindGetRuntimeManagedVpnCredentialResponse` binds the answer to
+ * `{ session: trustedSession, projection }`, inside that projection's effective DNS window
+ * (`renewalValue`, as there). It must also continue `previousValue`, the credential issued for
+ * `previousProjectionValue` over the same session: the two projections are one membership
+ * (`continuesRuntimeManagedVpnMembership`) and the transport, hub, authority, server key and client
+ * key pair are unchanged. Only `projection` and `expiresAt` move. The current effective window
+ * alone bounds the successor, so a membership whose current window does not cover the
+ * caller-qualified `nowValue` binds no successor; the held credential's own expiry is not
+ * consulted, because a renewal or a successor may have moved the window past it.
+ *
+ * The issuer binds the successor it states for a member, so the node's session and key pair survive
+ * a workload, readiness or policy change; the node binds a fresh answer with it to tell a successor,
+ * which keeps its live session, from a new membership, which replaces it. A previous credential for
+ * the same projection binds too, which is how a renewal moves the expiry. Content binding only, as
+ * for the response binder.
+ */
+export declare const bindGetRuntimeManagedVpnCredentialSuccessor: (value: unknown, previousValue: unknown, previousProjectionValue: unknown, projectionValue: unknown, trustedSessionValue: unknown, nowValue: unknown, renewalValue?: unknown | null) => Promise<IGetRuntimeManagedVpnCredentialResponse>;

package/dist_ts/data/networkcredential.js

@@ -1,6 +1,6 @@
 import { runtimeNetworkAddressPlanContract } from './networkaddressplan.js';
 import { snapshotRuntimeSessionBinding } from './runtimesession.js';
-import { validateRuntimeNetworkProjection } from './networkprojection.js';
+import { snapshotRuntimeNetworkProjection, validateRuntimeNetworkProjection } from './networkprojection.js';
 import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { captureNetwork, failNetwork, networkAuthorityId, networkCounter, networkEffectiveDnsWindow, networkEqual, networkId, networkIpv4, networkNoiseKey, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
 export const snapshotGetRuntimeManagedVpnCredentialRequest = (value) => networkSafe(() => {
@@ -41,6 +41,62 @@ export const bindGetRuntimeManagedVpnCredentialRequest = async (value, projectio
         return failNetwork();
     }
 };
+/**
+ * The membership rule of `continuesRuntimeManagedVpnMembership`, over projections already validated.
+ * A valid projection's handoff lease names the projection's own node scope, so one handoff
+ * reference is one node scope and the scope needs no comparison of its own.
+ */
+const continuesMembership = (previous, next) => previous.handoff !== null && next.handoff !== null && previous.id === next.id
+    && networkEqual(networkReferenceOf(previous.protectedAuthority), networkReferenceOf(next.protectedAuthority))
+    && networkEqual(networkReferenceOf(previous.handoff), networkReferenceOf(next.handoff))
+    && (next.generation > previous.generation || networkEqual(networkReferenceOf(previous), networkReferenceOf(next)));
+/** What a membership's credential keeps across its projections: everything but the projection and the expiry. */
+const credentialIdentity = (value) => ({
+    transport: value.transport, hub: value.hub, authorityId: value.authorityId, serverPublicKey: value.serverPublicKey,
+    clientPublicKey: value.clientPublicKey, clientPrivateKey: value.clientPrivateKey,
+});
+/**
+ * Whether `next` continues the managed VPN membership `previous` belongs to: the same projection
+ * lineage (`id`), the same protected authority, and the same handoff lease, which names the node
+ * scope and carries the node's router incarnation. Both must hold a handoff, because a node without
+ * one is no member. `next` is `previous` itself or a later generation; an earlier one, or another
+ * projection under the same generation, continues nothing.
+ *
+ * Everything else a projection states may move under one membership: its workload endpoints, their
+ * readiness, observations and egress, its private networks, its router selection and its DNS window.
+ * Those are what the member's network carries, never who the member is. A protection bump, a fresh
+ * handoff (router reincarnation) or a new controller epoch ends the membership. Whether the hub a
+ * credential names is still selected is the credential's question
+ * (`bindGetRuntimeManagedVpnCredentialSuccessor`), not the membership's.
+ *
+ * Validates both complete projections and rejects either that does not validate; a valid pair that
+ * is not one membership answers `false`. It samples no clock and fences no session.
+ */
+export const continuesRuntimeManagedVpnMembership = async (previousValue, nextValue) => {
+    let previous, next;
+    try {
+        const previousInput = snapshotRuntimeNetworkProjection(previousValue), nextInput = snapshotRuntimeNetworkProjection(nextValue);
+        previous = await validateRuntimeNetworkProjection(previousInput);
+        next = await validateRuntimeNetworkProjection(nextInput);
+    }
+    catch {
+        return failNetwork();
+    }
+    return continuesMembership(previous, next);
+};
+/** The response binding over inputs already captured and validated. */
+const bindResponse = (response, request, projection, renewal, trusted, now) => {
+    const window = networkEffectiveDnsWindow(projection, renewal);
+    bindRequest(request, projection, trusted);
+    requireNetwork(networkEqual(response.session, request.session) && networkEqual(response.projection, request.projection));
+    requireNetwork(projection.router?.platformEndpointIds.includes(response.hub.id));
+    const endpoint = projection.protectedAuthority.platformEndpoints.find(item => item.id === response.hub.id);
+    const expected = runtimeNetworkAddressPlanContract.hubTransports.find(row => row.transport === response.transport);
+    requireNetwork(endpoint && expected && endpoint.protocol === expected.protocol
+        && endpoint.address === response.hub.address && endpoint.port === response.hub.port);
+    requireNetwork(window.notBefore <= now && now < response.expiresAt && response.expiresAt <= window.expiresAt);
+    return response;
+};
 /** Bind the secret response to the original request and the exact selected router
  * endpoint of the credential's transport, inside the projection's effective DNS window. renewalValue is the
  * bare lease renewal the caller already verified and admitted for this exact
@@ -55,19 +111,49 @@ export const bindGetRuntimeManagedVpnCredentialResponse = async (value, requestV
         const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
         const projection = await validateRuntimeNetworkProjection(projectionValue);
         const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
-        const window = networkEffectiveDnsWindow(projection, renewal);
-        bindRequest(request, projection, trusted);
-        requireNetwork(networkEqual(response.session, request.session) && networkEqual(response.projection, request.projection));
-        requireNetwork(projection.router?.platformEndpointIds.includes(response.hub.id));
-        const endpoint = projection.protectedAuthority.platformEndpoints.find(item => item.id === response.hub.id);
-        const expected = runtimeNetworkAddressPlanContract.hubTransports.find(row => row.transport === response.transport);
-        requireNetwork(endpoint && expected && endpoint.protocol === expected.protocol
-            && endpoint.address === response.hub.address && endpoint.port === response.hub.port);
-        requireNetwork(window.notBefore <= now && now < response.expiresAt && response.expiresAt <= window.expiresAt);
-        return response;
+        return bindResponse(response, request, projection, renewal, trusted, now);
+    }
+    catch {
+        return failNetwork();
+    }
+};
+/**
+ * Bind the credential a node holds under its successor projection: `value` names `projectionValue`
+ * and is bound exactly as `bindGetRuntimeManagedVpnCredentialResponse` binds the answer to
+ * `{ session: trustedSession, projection }`, inside that projection's effective DNS window
+ * (`renewalValue`, as there). It must also continue `previousValue`, the credential issued for
+ * `previousProjectionValue` over the same session: the two projections are one membership
+ * (`continuesRuntimeManagedVpnMembership`) and the transport, hub, authority, server key and client
+ * key pair are unchanged. Only `projection` and `expiresAt` move. The current effective window
+ * alone bounds the successor, so a membership whose current window does not cover the
+ * caller-qualified `nowValue` binds no successor; the held credential's own expiry is not
+ * consulted, because a renewal or a successor may have moved the window past it.
+ *
+ * The issuer binds the successor it states for a member, so the node's session and key pair survive
+ * a workload, readiness or policy change; the node binds a fresh answer with it to tell a successor,
+ * which keeps its live session, from a new membership, which replaces it. A previous credential for
+ * the same projection binds too, which is how a renewal moves the expiry. Content binding only, as
+ * for the response binder.
+ */
+export const bindGetRuntimeManagedVpnCredentialSuccessor = async (value, previousValue, previousProjectionValue, projectionValue, trustedSessionValue, nowValue, renewalValue = null) => {
+    try {
+        const response = snapshotGetRuntimeManagedVpnCredentialResponse(value);
+        const previous = snapshotGetRuntimeManagedVpnCredentialResponse(previousValue);
+        const previousInput = snapshotRuntimeNetworkProjection(previousProjectionValue);
+        const projectionInput = snapshotRuntimeNetworkProjection(projectionValue);
+        const trusted = snapshotRuntimeSessionBinding(trustedSessionValue), now = networkCounter(nowValue);
+        const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
+        const previousProjection = await validateRuntimeNetworkProjection(previousInput);
+        const projection = await validateRuntimeNetworkProjection(projectionInput);
+        const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
+        requireNetwork(continuesMembership(previousProjection, projection));
+        requireNetwork(networkEqual(previous.session, trusted)
+            && networkEqual(previous.projection, networkReferenceOf(previousProjection)));
+        requireNetwork(networkEqual(credentialIdentity(previous), credentialIdentity(response)));
+        return bindResponse(response, { session: trusted, projection: networkReferenceOf(projection) }, projection, renewal, trusted, now);
     }
     catch {
         return failNetwork();
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxpQ0FBaUMsRUFBb0MsTUFBTSx5QkFBeUIsQ0FBQztBQUM5RyxPQUFPLEVBQUUsNkJBQTZCLEVBQStCLE1BQU0scUJBQXFCLENBQUM7QUFDakcsT0FBTyxFQUFFLGdDQUFnQyxFQUFrQyxNQUFNLHdCQUF3QixDQUFDO0FBQzFHLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxxQ0FBcUMsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ2pILE9BQU8sRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLGtCQUFrQixFQUFFLGNBQWMsRUFBRSx5QkFBeUIsRUFBRSxZQUFZLEVBQy9HLFNBQVMsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLGFBQWEsRUFBRSxnQkFBZ0IsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLEVBQ3pHLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBMEIxRSxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUFDLEtBQWMsRUFBMEMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDeEksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQzdFLE9BQU8sRUFBRSxPQUFPLEVBQUUsNkJBQTZCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztBQUNqSCxDQUFDLENBQUMsQ0FBQztBQUVILE1BQU0sV0FBVyxHQUFHLENBQUMsS0FBYyxFQUErQixFQUFFO0lBQ2xFLE1BQU0sR0FBRyxHQUFHLGlDQUFpQyxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsU0FBUyxLQUFLLEtBQUssQ0FBQyxDQUFDO0lBQzdHLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUFDLE9BQU8sR0FBRyxDQUFDLFNBQVMsQ0FBQztBQUM1QyxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4Q0FBOEMsR0FBRyxDQUFDLEtBQWMsRUFBMkMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUksTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFNBQVMsRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxhQUFhO1FBQzNHLGlCQUFpQixFQUFFLGlCQUFpQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDMUUsTUFBTSxHQUFHLEdBQUcsYUFBYSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDL0QsT0FBTyxFQUFFLE9BQU8sRUFBRSw2QkFBNkIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsVUFBVSxFQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUM7UUFDMUcsU0FBUyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ3RDLEdBQUcsRUFBRSxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxXQUFXLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxFQUFFLElBQUksRUFBRSxjQUFjLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsRUFBRTtRQUN4RyxXQUFXLEVBQUUsa0JBQWtCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxFQUFFLGVBQWUsRUFBRSxlQUFlLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQztRQUN6RyxlQUFlLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxlQUFlLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDO1FBQ2hILFNBQVMsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDaEQsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFdBQVcsR0FBRyxDQUFDLE9BQStDLEVBQ2xFLFVBQXFDLEVBQUUsT0FBK0IsRUFBUSxFQUFFO0lBQ2hGLGNBQWMsQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztXQUNwSCxnQkFBZ0IsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLElBQUksVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQ3BFLENBQUMsQ0FBQztBQUVGO29GQUNvRjtBQUNwRixNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLGVBQXdCLEVBQ3RHLG1CQUE0QixFQUFtRCxFQUFFO0lBQ2pGLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sT0FBTyxHQUFHLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFDbkUsTUFBTSxVQUFVLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMzRSxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUY7Ozs7O3lDQUt5QztBQUN6QyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLFlBQXFCLEVBQ3BHLGVBQXdCLEVBQUUsbUJBQTRCLEVBQUUsUUFBaUIsRUFDekUsZUFBK0IsSUFBSSxFQUFvRCxFQUFFO0lBQ3pGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQzVFLE1BQU0sT0FBTyxHQUFHLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLEVBQUUsR0FBRyxHQUFHLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNuRyxNQUFNLFlBQVksR0FBRyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3hHLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsTUFBTSxPQUFPLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3pHLE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM5RCxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUMxQyxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO1FBQ3pILGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDakYsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGtCQUFrQixDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUMzRyxNQUFNLFFBQVEsR0FBRyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDbkgsY0FBYyxDQUFDLFFBQVEsSUFBSSxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtlQUN6RSxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxHQUFHLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN2RixjQUFjLENBQUMsTUFBTSxDQUFDLFNBQVMsSUFBSSxHQUFHLElBQUksR0FBRyxHQUFHLFFBQVEsQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLFNBQVMsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDOUcsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxpQ0FBaUMsRUFBb0MsTUFBTSx5QkFBeUIsQ0FBQztBQUM5RyxPQUFPLEVBQUUsNkJBQTZCLEVBQStCLE1BQU0scUJBQXFCLENBQUM7QUFDakcsT0FBTyxFQUFFLGdDQUFnQyxFQUFFLGdDQUFnQyxFQUN6QyxNQUFNLHdCQUF3QixDQUFDO0FBQ2pFLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxxQ0FBcUMsRUFDOUMsTUFBTSxtQkFBbUIsQ0FBQztBQUNqRSxPQUFPLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxrQkFBa0IsRUFBRSxjQUFjLEVBQUUseUJBQXlCLEVBQUUsWUFBWSxFQUMvRyxTQUFTLEVBQUUsV0FBVyxFQUFFLGVBQWUsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUN6RyxnQkFBZ0IsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQStCMUUsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FBQyxLQUFjLEVBQTBDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3hJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM3RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDakgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBK0IsRUFBRTtJQUNsRSxNQUFNLEdBQUcsR0FBRyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsQ0FBQztJQUM3RyxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUM7SUFBQyxPQUFPLEdBQUcsQ0FBQyxTQUFTLENBQUM7QUFDNUMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FBQyxLQUFjLEVBQTJDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQzFJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsYUFBYTtRQUMzRyxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzFFLE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQy9ELE9BQU8sRUFBRSxPQUFPLEVBQUUsNkJBQTZCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO1FBQzFHLFNBQVMsRUFBRSxXQUFXLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUN0QyxHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxJQUFJLEVBQUUsY0FBYyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLEVBQUU7UUFDeEcsV0FBVyxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxlQUFlLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDekcsZUFBZSxFQUFFLGVBQWUsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztRQUNoSCxTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQ2hELENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxXQUFXLEdBQUcsQ0FBQyxPQUErQyxFQUNsRSxVQUFxQyxFQUFFLE9BQStCLEVBQVEsRUFBRTtJQUNoRixjQUFjLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUksWUFBWSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsa0JBQWtCLENBQUMsVUFBVSxDQUFDLENBQUM7V0FDcEgsZ0JBQWdCLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUNwRSxDQUFDLENBQUM7QUFFRjtvRkFDb0Y7QUFDcEYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUFFLEtBQWMsRUFBRSxlQUF3QixFQUN0RyxtQkFBNEIsRUFBbUQsRUFBRTtJQUNqRixJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyw2Q0FBNkMsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRSxNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQ25FLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsV0FBVyxDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDMUMsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBbUMsRUFBRSxJQUErQixFQUFXLEVBQUUsQ0FDNUcsUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksUUFBUSxDQUFDLEVBQUUsS0FBSyxJQUFJLENBQUMsRUFBRTtPQUMxRSxZQUFZLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLGtCQUFrQixDQUFDLEVBQUUsa0JBQWtCLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLENBQUM7T0FDMUcsWUFBWSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7T0FDcEYsQ0FBQyxJQUFJLENBQUMsVUFBVSxHQUFHLFFBQVEsQ0FBQyxVQUFVLElBQUksWUFBWSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVySCxpSEFBaUg7QUFDakgsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLEtBQThDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDOUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLEtBQUssQ0FBQyxHQUFHLEVBQUUsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXLEVBQUUsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0lBQ2xILGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZSxFQUFFLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0I7Q0FDakYsQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7Ozs7Ozs7Ozs7R0FnQkc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxLQUFLLEVBQUUsYUFBc0IsRUFBRSxTQUFrQixFQUFvQixFQUFFO0lBQ3pILElBQUksUUFBbUMsRUFBRSxJQUErQixDQUFDO0lBQ3pFLElBQUksQ0FBQztRQUNILE1BQU0sYUFBYSxHQUFHLGdDQUFnQyxDQUFDLGFBQWEsQ0FBQyxFQUFFLFNBQVMsR0FBRyxnQ0FBZ0MsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMvSCxRQUFRLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNqRSxJQUFJLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7SUFDakMsT0FBTyxtQkFBbUIsQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDN0MsQ0FBQyxDQUFDO0FBRUYsdUVBQXVFO0FBQ3ZFLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUQsRUFBRSxPQUErQyxFQUN0SCxVQUFxQyxFQUFFLE9BQThDLEVBQUUsT0FBK0IsRUFDdEgsR0FBVyxFQUEyQyxFQUFFO0lBQ3hELE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM5RCxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUMxQyxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3pILGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDakYsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGtCQUFrQixDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUMzRyxNQUFNLFFBQVEsR0FBRyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbkgsY0FBYyxDQUFDLFFBQVEsSUFBSSxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtXQUN6RSxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxHQUFHLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN2RixjQUFjLENBQUMsTUFBTSxDQUFDLFNBQVMsSUFBSSxHQUFHLElBQUksR0FBRyxHQUFHLFFBQVEsQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLFNBQVMsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUY7Ozs7O3lDQUt5QztBQUN6QyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLFlBQXFCLEVBQ3BHLGVBQXdCLEVBQUUsbUJBQTRCLEVBQUUsUUFBaUIsRUFDekUsZUFBK0IsSUFBSSxFQUFvRCxFQUFFO0lBQ3pGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQzVFLE1BQU0sT0FBTyxHQUFHLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLEVBQUUsR0FBRyxHQUFHLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNuRyxNQUFNLFlBQVksR0FBRyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3hHLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsTUFBTSxPQUFPLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3pHLE9BQU8sWUFBWSxDQUFDLFFBQVEsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJDQUEyQyxHQUFHLEtBQUssRUFBRSxLQUFjLEVBQUUsYUFBc0IsRUFDdEcsdUJBQWdDLEVBQUUsZUFBd0IsRUFBRSxtQkFBNEIsRUFBRSxRQUFpQixFQUMzRyxlQUErQixJQUFJLEVBQW9ELEVBQUU7SUFDekYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxRQUFRLEdBQUcsOENBQThDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkUsTUFBTSxRQUFRLEdBQUcsOENBQThDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDL0UsTUFBTSxhQUFhLEdBQUcsZ0NBQWdDLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUNoRixNQUFNLGVBQWUsR0FBRyxnQ0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMxRSxNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLEdBQUcsR0FBRyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDbkcsTUFBTSxZQUFZLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxxQ0FBcUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN4RyxNQUFNLGtCQUFrQixHQUFHLE1BQU0sZ0NBQWdDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDakYsTUFBTSxVQUFVLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMzRSxNQUFNLE9BQU8sR0FBRyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0scUNBQXFDLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDekcsY0FBYyxDQUFDLG1CQUFtQixDQUFDLGtCQUFrQixFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDcEUsY0FBYyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQztlQUNqRCxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNoRixjQUFjLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxFQUFFLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN6RixPQUFPLFlBQVksQ0FBQyxRQUFRLEVBQUUsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.38.0",
+  "version": "32.39.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -27,8 +27,8 @@
     "@tsclass/tsclass": "^9.5.1"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^5.0.0",
-    "@git.zone/tsdoc": "^2.2.2",
+    "@git.zone/tsbuild": "^5.1.0",
+    "@git.zone/tsdoc": "^3.0.1",
     "@git.zone/tsrun": "^3.0.2",
     "@git.zone/tstest": "6.3.2",
     "@types/node": "26.6.2"

package/readme.md

@@ -728,6 +728,32 @@ Expiry must be after the caller-qualified time and no later than the referenced
 projection's effective DNS window (see [DNS Lease Renewals](#dns-lease-renewals));
 acceptance before that window starts rejects.
 
+A credential names one projection, but its key pair belongs to the node's managed VPN
+membership, which outlives it. Every workload add, removal, readiness change or policy change
+signs a new projection generation; none of them changes who the member is.
+`continuesRuntimeManagedVpnMembership(previous, next)` is that rule: `next` continues the
+membership when it is the same projection lineage (`id`) under the same protected authority and
+the same handoff lease (which names the node scope and carries the router incarnation), and is
+`previous` itself or a later generation. A protection bump, a fresh handoff (router
+reincarnation) or a new controller epoch is a new membership; an earlier generation or another
+projection of the same generation continues nothing. It validates both projections and rejects
+one that does not validate.
+
+`bindGetRuntimeManagedVpnCredentialSuccessor(response, previous, previousProjection, projection,
+trustedSession, now, renewal = null)` binds the credential for the successor. `response` is bound
+exactly as the response binder binds an answer to `{ session: trustedSession, projection }`, so
+the hub must still be selected and the expiry stays inside the successor's effective DNS window.
+It must also continue `previous`, the credential issued for `previousProjection` over the same
+session: the two projections are one membership and the transport, hub, authority, server key and
+client key pair are unchanged. Only `projection` and `expiresAt` move. The current effective
+window is the one limit: a membership whose current window does not cover `now` binds no
+successor, while the held credential's own expiry is not consulted, because a renewal or a
+successor may already have moved the window past it. The issuer binds the successor it states
+for a member with it, so the node keeps its key pair and its hub session across a projection
+change; a node binds a fresh answer with it to tell a successor, which keeps the live session,
+from a new membership, which replaces it. A previous credential for the same projection binds as
+its own successor, which is how a DNS lease renewal moves the expiry.
+
 These helpers perform content validation. Callers authenticate and fence the
 current physical peer and projection before and after native work, qualify time
 independently, and retain ownership through revocation and shutdown. The native

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.38.0',
+  version: '32.39.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/networkcredential.ts

@@ -1,8 +1,10 @@
 import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
 import { runtimeNetworkAddressPlanContract, type TRuntimeNetworkVpnTransport } from './networkaddressplan.js';
 import { snapshotRuntimeSessionBinding, type IRuntimeSessionBinding } from './runtimesession.js';
-import { validateRuntimeNetworkProjection, type IRuntimeNetworkProjection } from './networkprojection.js';
-import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
+import { snapshotRuntimeNetworkProjection, validateRuntimeNetworkProjection,
+  type IRuntimeNetworkProjection } from './networkprojection.js';
+import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal,
+  type IRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { captureNetwork, failNetwork, networkAuthorityId, networkCounter, networkEffectiveDnsWindow, networkEqual,
   networkId, networkIpv4, networkNoiseKey, networkRecord, networkReference, networkReferenceOf, networkSafe,
   networkSameScope, requireNetwork } from '../private/networkcontract.js';
@@ -14,7 +16,12 @@ export interface IGetRuntimeManagedVpnCredentialRequest {
 
 /** Secret response over the current authenticated physical peer only. Never
  * persist, hash, log, or include it in a signed network projection. The native
- * Noise owner validates and uses the keys; these shapes confer no TUN readiness. */
+ * Noise owner validates and uses the keys; these shapes confer no TUN readiness.
+ *
+ * One response names one exact projection, but its key pair belongs to the node's managed VPN
+ * membership, which outlives a projection: a credential for a successor projection of the same
+ * membership (`continuesRuntimeManagedVpnMembership`) carries the same transport, hub, authority and
+ * keys, bound by `bindGetRuntimeManagedVpnCredentialSuccessor`. */
 export interface IGetRuntimeManagedVpnCredentialResponse extends IGetRuntimeManagedVpnCredentialRequest {
   transport: TRuntimeNetworkVpnTransport;
   /** The cluster hub endpoint this node dials, named by the id its signed projection selected. */
@@ -72,6 +79,66 @@ export const bindGetRuntimeManagedVpnCredentialRequest = async (value: unknown,
   } catch { return failNetwork(); }
 };
 
+/**
+ * The membership rule of `continuesRuntimeManagedVpnMembership`, over projections already validated.
+ * A valid projection's handoff lease names the projection's own node scope, so one handoff
+ * reference is one node scope and the scope needs no comparison of its own.
+ */
+const continuesMembership = (previous: IRuntimeNetworkProjection, next: IRuntimeNetworkProjection): boolean =>
+  previous.handoff !== null && next.handoff !== null && previous.id === next.id
+  && networkEqual(networkReferenceOf(previous.protectedAuthority), networkReferenceOf(next.protectedAuthority))
+  && networkEqual(networkReferenceOf(previous.handoff), networkReferenceOf(next.handoff))
+  && (next.generation > previous.generation || networkEqual(networkReferenceOf(previous), networkReferenceOf(next)));
+
+/** What a membership's credential keeps across its projections: everything but the projection and the expiry. */
+const credentialIdentity = (value: IGetRuntimeManagedVpnCredentialResponse) => ({
+  transport: value.transport, hub: value.hub, authorityId: value.authorityId, serverPublicKey: value.serverPublicKey,
+  clientPublicKey: value.clientPublicKey, clientPrivateKey: value.clientPrivateKey,
+});
+
+/**
+ * Whether `next` continues the managed VPN membership `previous` belongs to: the same projection
+ * lineage (`id`), the same protected authority, and the same handoff lease, which names the node
+ * scope and carries the node's router incarnation. Both must hold a handoff, because a node without
+ * one is no member. `next` is `previous` itself or a later generation; an earlier one, or another
+ * projection under the same generation, continues nothing.
+ *
+ * Everything else a projection states may move under one membership: its workload endpoints, their
+ * readiness, observations and egress, its private networks, its router selection and its DNS window.
+ * Those are what the member's network carries, never who the member is. A protection bump, a fresh
+ * handoff (router reincarnation) or a new controller epoch ends the membership. Whether the hub a
+ * credential names is still selected is the credential's question
+ * (`bindGetRuntimeManagedVpnCredentialSuccessor`), not the membership's.
+ *
+ * Validates both complete projections and rejects either that does not validate; a valid pair that
+ * is not one membership answers `false`. It samples no clock and fences no session.
+ */
+export const continuesRuntimeManagedVpnMembership = async (previousValue: unknown, nextValue: unknown): Promise<boolean> => {
+  let previous: IRuntimeNetworkProjection, next: IRuntimeNetworkProjection;
+  try {
+    const previousInput = snapshotRuntimeNetworkProjection(previousValue), nextInput = snapshotRuntimeNetworkProjection(nextValue);
+    previous = await validateRuntimeNetworkProjection(previousInput);
+    next = await validateRuntimeNetworkProjection(nextInput);
+  } catch { return failNetwork(); }
+  return continuesMembership(previous, next);
+};
+
+/** The response binding over inputs already captured and validated. */
+const bindResponse = (response: IGetRuntimeManagedVpnCredentialResponse, request: IGetRuntimeManagedVpnCredentialRequest,
+  projection: IRuntimeNetworkProjection, renewal: IRuntimeNetworkDnsLeaseRenewal | null, trusted: IRuntimeSessionBinding,
+  now: number): IGetRuntimeManagedVpnCredentialResponse => {
+  const window = networkEffectiveDnsWindow(projection, renewal);
+  bindRequest(request, projection, trusted);
+  requireNetwork(networkEqual(response.session, request.session) && networkEqual(response.projection, request.projection));
+  requireNetwork(projection.router?.platformEndpointIds.includes(response.hub.id));
+  const endpoint = projection.protectedAuthority.platformEndpoints.find(item => item.id === response.hub.id);
+  const expected = runtimeNetworkAddressPlanContract.hubTransports.find(row => row.transport === response.transport);
+  requireNetwork(endpoint && expected && endpoint.protocol === expected.protocol
+    && endpoint.address === response.hub.address && endpoint.port === response.hub.port);
+  requireNetwork(window.notBefore <= now && now < response.expiresAt && response.expiresAt <= window.expiresAt);
+  return response;
+};
+
 /** Bind the secret response to the original request and the exact selected router
  * endpoint of the credential's transport, inside the projection's effective DNS window. renewalValue is the
  * bare lease renewal the caller already verified and admitted for this exact
@@ -88,15 +155,45 @@ export const bindGetRuntimeManagedVpnCredentialResponse = async (value: unknown,
     const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
     const projection = await validateRuntimeNetworkProjection(projectionValue);
     const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
-    const window = networkEffectiveDnsWindow(projection, renewal);
-    bindRequest(request, projection, trusted);
-    requireNetwork(networkEqual(response.session, request.session) && networkEqual(response.projection, request.projection));
-    requireNetwork(projection.router?.platformEndpointIds.includes(response.hub.id));
-    const endpoint = projection.protectedAuthority.platformEndpoints.find(item => item.id === response.hub.id);
-    const expected = runtimeNetworkAddressPlanContract.hubTransports.find(row => row.transport === response.transport);
-    requireNetwork(endpoint && expected && endpoint.protocol === expected.protocol
-      && endpoint.address === response.hub.address && endpoint.port === response.hub.port);
-    requireNetwork(window.notBefore <= now && now < response.expiresAt && response.expiresAt <= window.expiresAt);
-    return response;
+    return bindResponse(response, request, projection, renewal, trusted, now);
+  } catch { return failNetwork(); }
+};
+
+/**
+ * Bind the credential a node holds under its successor projection: `value` names `projectionValue`
+ * and is bound exactly as `bindGetRuntimeManagedVpnCredentialResponse` binds the answer to
+ * `{ session: trustedSession, projection }`, inside that projection's effective DNS window
+ * (`renewalValue`, as there). It must also continue `previousValue`, the credential issued for
+ * `previousProjectionValue` over the same session: the two projections are one membership
+ * (`continuesRuntimeManagedVpnMembership`) and the transport, hub, authority, server key and client
+ * key pair are unchanged. Only `projection` and `expiresAt` move. The current effective window
+ * alone bounds the successor, so a membership whose current window does not cover the
+ * caller-qualified `nowValue` binds no successor; the held credential's own expiry is not
+ * consulted, because a renewal or a successor may have moved the window past it.
+ *
+ * The issuer binds the successor it states for a member, so the node's session and key pair survive
+ * a workload, readiness or policy change; the node binds a fresh answer with it to tell a successor,
+ * which keeps its live session, from a new membership, which replaces it. A previous credential for
+ * the same projection binds too, which is how a renewal moves the expiry. Content binding only, as
+ * for the response binder.
+ */
+export const bindGetRuntimeManagedVpnCredentialSuccessor = async (value: unknown, previousValue: unknown,
+  previousProjectionValue: unknown, projectionValue: unknown, trustedSessionValue: unknown, nowValue: unknown,
+  renewalValue: unknown | null = null): Promise<IGetRuntimeManagedVpnCredentialResponse> => {
+  try {
+    const response = snapshotGetRuntimeManagedVpnCredentialResponse(value);
+    const previous = snapshotGetRuntimeManagedVpnCredentialResponse(previousValue);
+    const previousInput = snapshotRuntimeNetworkProjection(previousProjectionValue);
+    const projectionInput = snapshotRuntimeNetworkProjection(projectionValue);
+    const trusted = snapshotRuntimeSessionBinding(trustedSessionValue), now = networkCounter(nowValue);
+    const renewalInput = renewalValue === null ? null : snapshotRuntimeNetworkDnsLeaseRenewal(renewalValue);
+    const previousProjection = await validateRuntimeNetworkProjection(previousInput);
+    const projection = await validateRuntimeNetworkProjection(projectionInput);
+    const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
+    requireNetwork(continuesMembership(previousProjection, projection));
+    requireNetwork(networkEqual(previous.session, trusted)
+      && networkEqual(previous.projection, networkReferenceOf(previousProjection)));
+    requireNetwork(networkEqual(credentialIdentity(previous), credentialIdentity(response)));
+    return bindResponse(response, { session: trusted, projection: networkReferenceOf(projection) }, projection, renewal, trusted, now);
   } catch { return failNetwork(); }
 };