@serve.zone/interfaces 32.41.0 → 32.43.0

package/dist_ts/data/networkcredential.d.ts

@@ -39,17 +39,21 @@ export declare const snapshotGetRuntimeManagedVpnCredentialResponse: (value: unk
 export declare const bindGetRuntimeManagedVpnCredentialRequest: (value: unknown, projectionValue: unknown, trustedSessionValue: unknown) => Promise<IGetRuntimeManagedVpnCredentialRequest>;
 /**
  * Whether `next` continues the managed VPN membership `previous` belongs to: the same projection
- * lineage (`id`), the same protected authority, and the same handoff lease, which names the node
- * scope and carries the node's router incarnation. Both must hold a handoff, because a node without
- * one is no member. `next` is `previous` itself or a later generation; an earlier one, or another
- * projection under the same generation, continues nothing.
+ * lineage (`id`), a protected authority that continues the previous one
+ * (`continuesRuntimeNetworkProtection`: the same authority, or its next step that only adds), and
+ * the same handoff lease, which names the node scope and carries the node's router incarnation.
+ * Both must hold a handoff, because a node without one is no member. `next` is `previous` itself
+ * or a later generation; an earlier one, or another projection under the same generation,
+ * continues nothing.
  *
  * Everything else a projection states may move under one membership: its workload endpoints, their
  * readiness, observations and egress, its private networks, its router selection and its DNS window.
- * Those are what the member's network carries, never who the member is. A protection bump, a fresh
- * handoff (router reincarnation) or a new controller epoch ends the membership. Whether the hub a
- * credential names is still selected is the credential's question
- * (`bindGetRuntimeManagedVpnCredentialSuccessor`), not the membership's.
+ * Those are what the member's network carries, never who the member is. So does a cluster topology
+ * change: a node joining the egress or a cluster hub joining the platform endpoints is an additive
+ * protection step, and every member keeps its key pair across it. A protection step that removes or
+ * changes anything, or skips a step, a fresh handoff (router reincarnation) or a new controller
+ * epoch ends the membership. Whether the hub a credential names is still selected is the
+ * credential's question (`bindGetRuntimeManagedVpnCredentialSuccessor`), not the membership's.
  *
  * Validates both complete projections and rejects either that does not validate; a valid pair that
  * is not one membership answers `false`. It samples no clock and fences no session.

package/dist_ts/data/networkcredential.js

@@ -1,5 +1,6 @@
 import { runtimeNetworkAddressPlanContract } from './networkaddressplan.js';
 import { snapshotRuntimeSessionBinding } from './runtimesession.js';
+import { continuesRuntimeNetworkProtection } from './networkauthority.js';
 import { snapshotRuntimeNetworkProjection, validateRuntimeNetworkProjection } from './networkprojection.js';
 import { snapshotRuntimeNetworkDnsLeaseRenewal, validateRuntimeNetworkDnsLeaseRenewal } from './networklease.js';
 import { captureNetwork, failNetwork, networkAuthorityId, networkCounter, networkEffectiveDnsWindow, networkEqual, networkId, networkIpv4, networkNoiseKey, networkRecord, networkReference, networkReferenceOf, networkSafe, networkSameScope, requireNetwork } from '../private/networkcontract.js';
@@ -46,10 +47,10 @@ export const bindGetRuntimeManagedVpnCredentialRequest = async (value, projectio
  * A valid projection's handoff lease names the projection's own node scope, so one handoff
  * reference is one node scope and the scope needs no comparison of its own.
  */
-const continuesMembership = (previous, next) => previous.handoff !== null && next.handoff !== null && previous.id === next.id
-    && networkEqual(networkReferenceOf(previous.protectedAuthority), networkReferenceOf(next.protectedAuthority))
+const continuesMembership = async (previous, next) => previous.handoff !== null && next.handoff !== null && previous.id === next.id
     && networkEqual(networkReferenceOf(previous.handoff), networkReferenceOf(next.handoff))
-    && (next.generation > previous.generation || networkEqual(networkReferenceOf(previous), networkReferenceOf(next)));
+    && (next.generation > previous.generation || networkEqual(networkReferenceOf(previous), networkReferenceOf(next)))
+    && await continuesRuntimeNetworkProtection(previous.protectedAuthority, next.protectedAuthority);
 /** What a membership's credential keeps across its projections: everything but the projection and the expiry. */
 const credentialIdentity = (value) => ({
     transport: value.transport, hub: value.hub, authorityId: value.authorityId, serverPublicKey: value.serverPublicKey,
@@ -57,17 +58,21 @@ const credentialIdentity = (value) => ({
 });
 /**
  * Whether `next` continues the managed VPN membership `previous` belongs to: the same projection
- * lineage (`id`), the same protected authority, and the same handoff lease, which names the node
- * scope and carries the node's router incarnation. Both must hold a handoff, because a node without
- * one is no member. `next` is `previous` itself or a later generation; an earlier one, or another
- * projection under the same generation, continues nothing.
+ * lineage (`id`), a protected authority that continues the previous one
+ * (`continuesRuntimeNetworkProtection`: the same authority, or its next step that only adds), and
+ * the same handoff lease, which names the node scope and carries the node's router incarnation.
+ * Both must hold a handoff, because a node without one is no member. `next` is `previous` itself
+ * or a later generation; an earlier one, or another projection under the same generation,
+ * continues nothing.
  *
  * Everything else a projection states may move under one membership: its workload endpoints, their
  * readiness, observations and egress, its private networks, its router selection and its DNS window.
- * Those are what the member's network carries, never who the member is. A protection bump, a fresh
- * handoff (router reincarnation) or a new controller epoch ends the membership. Whether the hub a
- * credential names is still selected is the credential's question
- * (`bindGetRuntimeManagedVpnCredentialSuccessor`), not the membership's.
+ * Those are what the member's network carries, never who the member is. So does a cluster topology
+ * change: a node joining the egress or a cluster hub joining the platform endpoints is an additive
+ * protection step, and every member keeps its key pair across it. A protection step that removes or
+ * changes anything, or skips a step, a fresh handoff (router reincarnation) or a new controller
+ * epoch ends the membership. Whether the hub a credential names is still selected is the
+ * credential's question (`bindGetRuntimeManagedVpnCredentialSuccessor`), not the membership's.
  *
  * Validates both complete projections and rejects either that does not validate; a valid pair that
  * is not one membership answers `false`. It samples no clock and fences no session.
@@ -146,7 +151,7 @@ export const bindGetRuntimeManagedVpnCredentialSuccessor = async (value, previou
         const previousProjection = await validateRuntimeNetworkProjection(previousInput);
         const projection = await validateRuntimeNetworkProjection(projectionInput);
         const renewal = renewalInput === null ? null : await validateRuntimeNetworkDnsLeaseRenewal(renewalInput);
-        requireNetwork(continuesMembership(previousProjection, projection));
+        requireNetwork(await continuesMembership(previousProjection, projection));
         requireNetwork(networkEqual(previous.session, trusted)
             && networkEqual(previous.projection, networkReferenceOf(previousProjection)));
         requireNetwork(networkEqual(credentialIdentity(previous), credentialIdentity(response)));
@@ -156,4 +161,4 @@ export const bindGetRuntimeManagedVpnCredentialSuccessor = async (value, previou
         return failNetwork();
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxpQ0FBaUMsRUFBb0MsTUFBTSx5QkFBeUIsQ0FBQztBQUM5RyxPQUFPLEVBQUUsNkJBQTZCLEVBQStCLE1BQU0scUJBQXFCLENBQUM7QUFDakcsT0FBTyxFQUFFLGdDQUFnQyxFQUFFLGdDQUFnQyxFQUN6QyxNQUFNLHdCQUF3QixDQUFDO0FBQ2pFLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxxQ0FBcUMsRUFDOUMsTUFBTSxtQkFBbUIsQ0FBQztBQUNqRSxPQUFPLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxrQkFBa0IsRUFBRSxjQUFjLEVBQUUseUJBQXlCLEVBQUUsWUFBWSxFQUMvRyxTQUFTLEVBQUUsV0FBVyxFQUFFLGVBQWUsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUN6RyxnQkFBZ0IsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQStCMUUsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FBQyxLQUFjLEVBQTBDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3hJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM3RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDakgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBK0IsRUFBRTtJQUNsRSxNQUFNLEdBQUcsR0FBRyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsQ0FBQztJQUM3RyxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUM7SUFBQyxPQUFPLEdBQUcsQ0FBQyxTQUFTLENBQUM7QUFDNUMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FBQyxLQUFjLEVBQTJDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQzFJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsYUFBYTtRQUMzRyxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzFFLE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQy9ELE9BQU8sRUFBRSxPQUFPLEVBQUUsNkJBQTZCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO1FBQzFHLFNBQVMsRUFBRSxXQUFXLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUN0QyxHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxJQUFJLEVBQUUsY0FBYyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLEVBQUU7UUFDeEcsV0FBVyxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxlQUFlLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDekcsZUFBZSxFQUFFLGVBQWUsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztRQUNoSCxTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQ2hELENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxXQUFXLEdBQUcsQ0FBQyxPQUErQyxFQUNsRSxVQUFxQyxFQUFFLE9BQStCLEVBQVEsRUFBRTtJQUNoRixjQUFjLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUksWUFBWSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsa0JBQWtCLENBQUMsVUFBVSxDQUFDLENBQUM7V0FDcEgsZ0JBQWdCLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUNwRSxDQUFDLENBQUM7QUFFRjtvRkFDb0Y7QUFDcEYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUFFLEtBQWMsRUFBRSxlQUF3QixFQUN0RyxtQkFBNEIsRUFBbUQsRUFBRTtJQUNqRixJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyw2Q0FBNkMsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRSxNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQ25FLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsV0FBVyxDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDMUMsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBbUMsRUFBRSxJQUErQixFQUFXLEVBQUUsQ0FDNUcsUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksUUFBUSxDQUFDLEVBQUUsS0FBSyxJQUFJLENBQUMsRUFBRTtPQUMxRSxZQUFZLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLGtCQUFrQixDQUFDLEVBQUUsa0JBQWtCLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLENBQUM7T0FDMUcsWUFBWSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7T0FDcEYsQ0FBQyxJQUFJLENBQUMsVUFBVSxHQUFHLFFBQVEsQ0FBQyxVQUFVLElBQUksWUFBWSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVySCxpSEFBaUg7QUFDakgsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLEtBQThDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDOUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLEtBQUssQ0FBQyxHQUFHLEVBQUUsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXLEVBQUUsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0lBQ2xILGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZSxFQUFFLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0I7Q0FDakYsQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7Ozs7Ozs7Ozs7R0FnQkc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxLQUFLLEVBQUUsYUFBc0IsRUFBRSxTQUFrQixFQUFvQixFQUFFO0lBQ3pILElBQUksUUFBbUMsRUFBRSxJQUErQixDQUFDO0lBQ3pFLElBQUksQ0FBQztRQUNILE1BQU0sYUFBYSxHQUFHLGdDQUFnQyxDQUFDLGFBQWEsQ0FBQyxFQUFFLFNBQVMsR0FBRyxnQ0FBZ0MsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMvSCxRQUFRLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNqRSxJQUFJLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUMzRCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQUMsT0FBTyxXQUFXLEVBQUUsQ0FBQztJQUFDLENBQUM7SUFDakMsT0FBTyxtQkFBbUIsQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDN0MsQ0FBQyxDQUFDO0FBRUYsdUVBQXVFO0FBQ3ZFLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUQsRUFBRSxPQUErQyxFQUN0SCxVQUFxQyxFQUFFLE9BQThDLEVBQUUsT0FBK0IsRUFDdEgsR0FBVyxFQUEyQyxFQUFFO0lBQ3hELE1BQU0sTUFBTSxHQUFHLHlCQUF5QixDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUM5RCxXQUFXLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUMxQyxjQUFjLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ3pILGNBQWMsQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDakYsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGtCQUFrQixDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUMzRyxNQUFNLFFBQVEsR0FBRyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxDQUFDLFNBQVMsS0FBSyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDbkgsY0FBYyxDQUFDLFFBQVEsSUFBSSxRQUFRLElBQUksUUFBUSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUMsUUFBUTtXQUN6RSxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxHQUFHLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN2RixjQUFjLENBQUMsTUFBTSxDQUFDLFNBQVMsSUFBSSxHQUFHLElBQUksR0FBRyxHQUFHLFFBQVEsQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLFNBQVMsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUcsT0FBTyxRQUFRLENBQUM7QUFDbEIsQ0FBQyxDQUFDO0FBRUY7Ozs7O3lDQUt5QztBQUN6QyxNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLFlBQXFCLEVBQ3BHLGVBQXdCLEVBQUUsbUJBQTRCLEVBQUUsUUFBaUIsRUFDekUsZUFBK0IsSUFBSSxFQUFvRCxFQUFFO0lBQ3pGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sT0FBTyxHQUFHLDZDQUE2QyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQzVFLE1BQU0sT0FBTyxHQUFHLDZCQUE2QixDQUFDLG1CQUFtQixDQUFDLEVBQUUsR0FBRyxHQUFHLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNuRyxNQUFNLFlBQVksR0FBRyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3hHLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsTUFBTSxPQUFPLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3pHLE9BQU8sWUFBWSxDQUFDLFFBQVEsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUNILE1BQU0sQ0FBQyxNQUFNLDJDQUEyQyxHQUFHLEtBQUssRUFBRSxLQUFjLEVBQUUsYUFBc0IsRUFDdEcsdUJBQWdDLEVBQUUsZUFBd0IsRUFBRSxtQkFBNEIsRUFBRSxRQUFpQixFQUMzRyxlQUErQixJQUFJLEVBQW9ELEVBQUU7SUFDekYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxRQUFRLEdBQUcsOENBQThDLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkUsTUFBTSxRQUFRLEdBQUcsOENBQThDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDL0UsTUFBTSxhQUFhLEdBQUcsZ0NBQWdDLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUNoRixNQUFNLGVBQWUsR0FBRyxnQ0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMxRSxNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLEdBQUcsR0FBRyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDbkcsTUFBTSxZQUFZLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxxQ0FBcUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN4RyxNQUFNLGtCQUFrQixHQUFHLE1BQU0sZ0NBQWdDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDakYsTUFBTSxVQUFVLEdBQUcsTUFBTSxnQ0FBZ0MsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUMzRSxNQUFNLE9BQU8sR0FBRyxZQUFZLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0scUNBQXFDLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDekcsY0FBYyxDQUFDLG1CQUFtQixDQUFDLGtCQUFrQixFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDcEUsY0FBYyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQztlQUNqRCxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNoRixjQUFjLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxFQUFFLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN6RixPQUFPLFlBQVksQ0FBQyxRQUFRLEVBQUUsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2NyZWRlbnRpYWwuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtjcmVkZW50aWFsLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSxpQ0FBaUMsRUFBb0MsTUFBTSx5QkFBeUIsQ0FBQztBQUM5RyxPQUFPLEVBQUUsNkJBQTZCLEVBQStCLE1BQU0scUJBQXFCLENBQUM7QUFDakcsT0FBTyxFQUFFLGlDQUFpQyxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFDMUUsT0FBTyxFQUFFLGdDQUFnQyxFQUFFLGdDQUFnQyxFQUN6QyxNQUFNLHdCQUF3QixDQUFDO0FBQ2pFLE9BQU8sRUFBRSxxQ0FBcUMsRUFBRSxxQ0FBcUMsRUFDOUMsTUFBTSxtQkFBbUIsQ0FBQztBQUNqRSxPQUFPLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxrQkFBa0IsRUFBRSxjQUFjLEVBQUUseUJBQXlCLEVBQUUsWUFBWSxFQUMvRyxTQUFTLEVBQUUsV0FBVyxFQUFFLGVBQWUsRUFBRSxhQUFhLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsV0FBVyxFQUN6RyxnQkFBZ0IsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQStCMUUsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FBQyxLQUFjLEVBQTBDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQ3hJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUM3RSxPQUFPLEVBQUUsT0FBTyxFQUFFLDZCQUE2QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxVQUFVLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7QUFDakgsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBK0IsRUFBRTtJQUNsRSxNQUFNLEdBQUcsR0FBRyxpQ0FBaUMsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsQ0FBQztJQUM3RyxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUM7SUFBQyxPQUFPLEdBQUcsQ0FBQyxTQUFTLENBQUM7QUFDNUMsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsQ0FBQyxLQUFjLEVBQTJDLEVBQUUsQ0FBQyxXQUFXLENBQUMsR0FBRyxFQUFFO0lBQzFJLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsYUFBYTtRQUMzRyxpQkFBaUIsRUFBRSxpQkFBaUIsRUFBRSxrQkFBa0IsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzFFLE1BQU0sR0FBRyxHQUFHLGFBQWEsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQy9ELE9BQU8sRUFBRSxPQUFPLEVBQUUsNkJBQTZCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO1FBQzFHLFNBQVMsRUFBRSxXQUFXLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUN0QyxHQUFHLEVBQUUsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxJQUFJLEVBQUUsY0FBYyxDQUFDLEdBQUcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLEVBQUU7UUFDeEcsV0FBVyxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxlQUFlLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUM7UUFDekcsZUFBZSxFQUFFLGVBQWUsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQztRQUNoSCxTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQ2hELENBQUMsQ0FBQyxDQUFDO0FBRUgsTUFBTSxXQUFXLEdBQUcsQ0FBQyxPQUErQyxFQUNsRSxVQUFxQyxFQUFFLE9BQStCLEVBQVEsRUFBRTtJQUNoRixjQUFjLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsT0FBTyxDQUFDLElBQUksWUFBWSxDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsa0JBQWtCLENBQUMsVUFBVSxDQUFDLENBQUM7V0FDcEgsZ0JBQWdCLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztBQUNwRSxDQUFDLENBQUM7QUFFRjtvRkFDb0Y7QUFDcEYsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUFFLEtBQWMsRUFBRSxlQUF3QixFQUN0RyxtQkFBNEIsRUFBbUQsRUFBRTtJQUNqRixJQUFJLENBQUM7UUFDSCxNQUFNLE9BQU8sR0FBRyw2Q0FBNkMsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyRSxNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQ25FLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsV0FBVyxDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDMUMsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0FBQ25DLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLG1CQUFtQixHQUFHLEtBQUssRUFBRSxRQUFtQyxFQUFFLElBQStCLEVBQW9CLEVBQUUsQ0FDM0gsUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksUUFBUSxDQUFDLEVBQUUsS0FBSyxJQUFJLENBQUMsRUFBRTtPQUMxRSxZQUFZLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztPQUNwRixDQUFDLElBQUksQ0FBQyxVQUFVLEdBQUcsUUFBUSxDQUFDLFVBQVUsSUFBSSxZQUFZLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLEVBQUUsa0JBQWtCLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztPQUMvRyxNQUFNLGlDQUFpQyxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsRUFBRSxJQUFJLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUVuRyxpSEFBaUg7QUFDakgsTUFBTSxrQkFBa0IsR0FBRyxDQUFDLEtBQThDLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDOUUsU0FBUyxFQUFFLEtBQUssQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLEtBQUssQ0FBQyxHQUFHLEVBQUUsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXLEVBQUUsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO0lBQ2xILGVBQWUsRUFBRSxLQUFLLENBQUMsZUFBZSxFQUFFLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxnQkFBZ0I7Q0FDakYsQ0FBQyxDQUFDO0FBRUg7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBb0JHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsS0FBSyxFQUFFLGFBQXNCLEVBQUUsU0FBa0IsRUFBb0IsRUFBRTtJQUN6SCxJQUFJLFFBQW1DLEVBQUUsSUFBK0IsQ0FBQztJQUN6RSxJQUFJLENBQUM7UUFDSCxNQUFNLGFBQWEsR0FBRyxnQ0FBZ0MsQ0FBQyxhQUFhLENBQUMsRUFBRSxTQUFTLEdBQUcsZ0NBQWdDLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDL0gsUUFBUSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDakUsSUFBSSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDM0QsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE9BQU8sV0FBVyxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQ2pDLE9BQU8sbUJBQW1CLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO0FBQzdDLENBQUMsQ0FBQztBQUVGLHVFQUF1RTtBQUN2RSxNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlELEVBQUUsT0FBK0MsRUFDdEgsVUFBcUMsRUFBRSxPQUE4QyxFQUFFLE9BQStCLEVBQ3RILEdBQVcsRUFBMkMsRUFBRTtJQUN4RCxNQUFNLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDOUQsV0FBVyxDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDMUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUN6SCxjQUFjLENBQUMsVUFBVSxDQUFDLE1BQU0sRUFBRSxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ2pGLE1BQU0sUUFBUSxHQUFHLFVBQVUsQ0FBQyxrQkFBa0IsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDM0csTUFBTSxRQUFRLEdBQUcsaUNBQWlDLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEdBQUcsQ0FBQyxTQUFTLEtBQUssUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ25ILGNBQWMsQ0FBQyxRQUFRLElBQUksUUFBUSxJQUFJLFFBQVEsQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDLFFBQVE7V0FDekUsUUFBUSxDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsR0FBRyxDQUFDLE9BQU8sSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdkYsY0FBYyxDQUFDLE1BQU0sQ0FBQyxTQUFTLElBQUksR0FBRyxJQUFJLEdBQUcsR0FBRyxRQUFRLENBQUMsU0FBUyxJQUFJLFFBQVEsQ0FBQyxTQUFTLElBQUksTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzlHLE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGOzs7Ozt5Q0FLeUM7QUFDekMsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsS0FBSyxFQUFFLEtBQWMsRUFBRSxZQUFxQixFQUNwRyxlQUF3QixFQUFFLG1CQUE0QixFQUFFLFFBQWlCLEVBQ3pFLGVBQStCLElBQUksRUFBb0QsRUFBRTtJQUN6RixJQUFJLENBQUM7UUFDSCxNQUFNLFFBQVEsR0FBRyw4Q0FBOEMsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2RSxNQUFNLE9BQU8sR0FBRyw2Q0FBNkMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUM1RSxNQUFNLE9BQU8sR0FBRyw2QkFBNkIsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLEdBQUcsR0FBRyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDbkcsTUFBTSxZQUFZLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxxQ0FBcUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN4RyxNQUFNLFVBQVUsR0FBRyxNQUFNLGdDQUFnQyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQzNFLE1BQU0sT0FBTyxHQUFHLFlBQVksS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTSxxQ0FBcUMsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUN6RyxPQUFPLFlBQVksQ0FBQyxRQUFRLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FpQkc7QUFDSCxNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxLQUFLLEVBQUUsS0FBYyxFQUFFLGFBQXNCLEVBQ3RHLHVCQUFnQyxFQUFFLGVBQXdCLEVBQUUsbUJBQTRCLEVBQUUsUUFBaUIsRUFDM0csZUFBK0IsSUFBSSxFQUFvRCxFQUFFO0lBQ3pGLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sUUFBUSxHQUFHLDhDQUE4QyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQy9FLE1BQU0sYUFBYSxHQUFHLGdDQUFnQyxDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFDaEYsTUFBTSxlQUFlLEdBQUcsZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDMUUsTUFBTSxPQUFPLEdBQUcsNkJBQTZCLENBQUMsbUJBQW1CLENBQUMsRUFBRSxHQUFHLEdBQUcsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ25HLE1BQU0sWUFBWSxHQUFHLFlBQVksS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMscUNBQXFDLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDeEcsTUFBTSxrQkFBa0IsR0FBRyxNQUFNLGdDQUFnQyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ2pGLE1BQU0sVUFBVSxHQUFHLE1BQU0sZ0NBQWdDLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsTUFBTSxPQUFPLEdBQUcsWUFBWSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLHFDQUFxQyxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3pHLGNBQWMsQ0FBQyxNQUFNLG1CQUFtQixDQUFDLGtCQUFrQixFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFDMUUsY0FBYyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQztlQUNqRCxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNoRixjQUFjLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxFQUFFLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN6RixPQUFPLFlBQVksQ0FBQyxRQUFRLEVBQUUsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxrQkFBa0IsQ0FBQyxVQUFVLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQ3JJLENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUMifQ==

package/dist_ts/data/networkegressretirement.d.ts

@@ -0,0 +1,129 @@
+import type { TSha256Digest } from './immutableimage.js';
+import type { IRuntimeAuthorityReference } from './runtimeassignment.js';
+import type { IRuntimeNetworkNodeScope } from './networkprojection.js';
+import type { IRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import { type TNodeRuntimeRetirementDisposition } from './noderetirement.js';
+/** One egress owner of a protected authority, as `IRuntimeNetworkProtectedAuthority.egressAuthorities` names it. */
+export interface IRuntimeNetworkEgressOwner {
+    nodeId: string;
+    runtimeNamespace: string;
+}
+/** A remaining owner's acknowledged projection head, which carries no endpoint of the retired owner. */
+export interface IRuntimeNetworkEgressRetirementClearance extends IRuntimeNetworkEgressOwner {
+    projection: IRuntimeAuthorityReference;
+}
+/**
+ * The independent fence that lets one egress owner leave a protected authority.
+ *
+ * A protected authority's egress owners only grow by default: an owner that is offline, revoked or
+ * gone can never acknowledge a successor, and omitting it is not a revocation. This record is the
+ * controller's statement that the owner holds no packet authority any more, recorded against the
+ * exact authority it is about to leave. Every member is evidence the controller read from its own
+ * durable state when it recorded the fence:
+ *
+ * 1. the node carries an `INodeRuntimeRetirement` row (`disposition` copies it);
+ * 2. both node credentials are revoked (`revokedCredentials`, committed at `revokedAt`), so the node
+ *    can no longer register, renew a DNS lease or fetch a managed VPN credential;
+ * 3. every DNS and managed VPN window the node was ever issued has ended (`packetWindowExpiresAt`),
+ *    so no hub relays for it even if it was never told to stop;
+ * 4. every handoff and workload lease the node was granted is quarantined (`quarantinedHandoffs`,
+ *    `quarantinedWorkloads`) and is never handed out again;
+ * 5. every remaining owner of `protectedAuthority` acknowledged a projection head that carries no
+ *    endpoint of the node (`clearedProjections`). An owner whose own `lost` fence is recorded
+ *    against the same authority is not a remaining owner here: it never acknowledges anything again,
+ *    so it can never clear another owner's endpoints, and it leaves behind its own fence.
+ *
+ * `lastReceipt` is the node's last accepted protection receipt. A `withdrawn` node took part in its
+ * retirement, so it always has one — its null withdrawal; a `lost` node may never have reported.
+ *
+ * A structural snapshot and digest do not authenticate any of it: the controller must fence the
+ * rows it read together with the authority it stages.
+ */
+export interface IRuntimeNetworkEgressRetirement extends IRuntimeNetworkNodeScope {
+    /** The exact protected authority the owner leaves: the predecessor of the step that drops it. */
+    protectedAuthority: IRuntimeAuthorityReference;
+    disposition: TNodeRuntimeRetirementDisposition;
+    lastReceipt: IRuntimeAuthorityReference | null;
+    /** The generation each node credential was revoked at. */
+    revokedCredentials: {
+        spark: number;
+        pallet: number;
+    };
+    /** Unix milliseconds on the controller's clock when the later of the two revocations committed. */
+    revokedAt: number;
+    /**
+     * Unix milliseconds: the latest end of any DNS or managed VPN window the node was ever issued, or
+     * `revokedAt` when it was issued none.
+     */
+    packetWindowExpiresAt: number;
+    /** Unix milliseconds when the fence was recorded: never before `revokedAt` or `packetWindowExpiresAt`. */
+    fencedAt: number;
+    /** Every handoff lease the node was granted, each quarantined, in canonical order. */
+    quarantinedHandoffs: IRuntimeAuthorityReference[];
+    /** Every workload lease the node was granted, each quarantined, in canonical order. */
+    quarantinedWorkloads: IRuntimeAuthorityReference[];
+    /**
+     * One entry per remaining owner of `protectedAuthority` whose own `lost` fence is not recorded
+     * against that authority, in canonical owner order.
+     */
+    clearedProjections: IRuntimeNetworkEgressRetirementClearance[];
+    digest: TSha256Digest;
+}
+export declare const runtimeNetworkEgressRetirementContract: Readonly<{
+    readonly digestDomain: "serve.zone/runtime-network-egress-retirement";
+    readonly maximumQuarantinedHandoffs: 256;
+    readonly maximumQuarantinedWorkloads: 512;
+    readonly maximumClearedProjections: number;
+    /** Fences one step may consume. Each is read on its own, so one step stays bounded. */
+    readonly maximumFencesPerStep: 16;
+    /**
+     * Lost fences one step may hold as exemptions: owners it keeps that no consumed fence's clearance
+     * has to name. At least one owner is kept, so this is one fewer than the owners an authority has.
+     */
+    readonly maximumExemptionsPerStep: number;
+    /**
+     * Retired owners one step may be given: the caller's history restricted to owners `previous` or
+     * `next` names, which is at most every owner of both.
+     */
+    readonly maximumRetiredOwners: number;
+    readonly removal: "absent-owner-requires-fence-bound-to-exact-previous-authority";
+    readonly reentry: "a-fenced-owner-never-returns";
+}>;
+/** Exact-key structural snapshot, detached from its input. It verifies no digest and fences nothing. */
+export declare const snapshotRuntimeNetworkEgressRetirement: (value: unknown) => IRuntimeNetworkEgressRetirement;
+export declare const computeRuntimeNetworkEgressRetirementDigest: (value: IRuntimeNetworkEgressRetirement) => Promise<TSha256Digest>;
+/**
+ * Whether `next` may succeed `previous`, judged on its egress owners and the address space it keeps.
+ *
+ * Pure and fail-closed. `fences` are the egress retirements this step consumes. `exemptions` are
+ * `lost` fences of owners this step keeps, recorded against the same `previous`: such an owner never
+ * acknowledges another projection head, so no consumed fence's clearance can wait for it. They are
+ * read, not consumed, and default to none. `retiredOwners` is the caller's durable history of
+ * fenced owners restricted to the owners `previous` or `next` names, in canonical owner order. The
+ * step is accepted only when:
+ *
+ * - `next` is the exact successor of `previous` under the same controller, and both digests verify;
+ * - an owner of `previous` is absent from `next` only when exactly one fence, recorded against the
+ *   exact `previous` reference and verified by its digest, names it — a fence for an owner `next`
+ *   still names, or for an owner `previous` does not name, refuses the step;
+ * - every exemption verifies by its digest, is `lost`, is recorded under the same controller against
+ *   the exact `previous` reference, and names an owner both `previous` and `next` name, no fence
+ *   names and no other exemption names; at most `maximumExemptionsPerStep`, in canonical owner order;
+ * - every fence's `clearedProjections` names exactly the owners of `previous` this step keeps, less
+ *   the exempt owners; an exemption's own clearance is not judged here, only when its owner leaves;
+ * - `retiredOwners` is empty: any entry is either an owner a side names that was fenced before, or
+ *   not part of the restriction at all, so a fenced owner never returns;
+ * - every pool of `previous` is kept unchanged and the prefixes of `next` cover those of `previous`;
+ *   a step that removes an owner also keeps every resolver of `previous` unchanged.
+ *
+ * Owners that join in the same step are admitted. With no fence this is the additive owner rule:
+ * nobody leaves, and exemptions relax nothing. It verifies no fence evidence against live state and
+ * fences no record: the caller fences every fence and exemption it read together with the authority
+ * it stages.
+ */
+export declare const bindRuntimeNetworkProtectedAuthorityRetirement: (previousValue: unknown, nextValue: unknown, fencesValue: unknown, retiredOwnersValue: unknown, exemptionsValue?: unknown) => Promise<{
+    previous: IRuntimeNetworkProtectedAuthority;
+    next: IRuntimeNetworkProtectedAuthority;
+    fences: IRuntimeNetworkEgressRetirement[];
+    exemptions: IRuntimeNetworkEgressRetirement[];
+}>;

package/dist_ts/data/networkegressretirement.js

@@ -0,0 +1,142 @@
+import { computeRuntimeNetworkProtectedAuthorityDigest, runtimeNetworkAuthorityContract, snapshotRuntimeNetworkProtectedAuthority } from './networkauthority.js';
+import { nodeRuntimeRetirementDispositions } from './noderetirement.js';
+import { readDataElements } from '../private/dataproperties.js';
+import { isOneOf } from '../private/producercontract.js';
+import { captureNetwork, failNetwork, networkCanonical, networkCounter, networkCoveredBy, networkDigest, networkEqual, networkHash, networkId, networkList, networkNodeId, networkRecord, networkReference, networkReferenceOf, networkSafe, networkScope, networkSorted, requireNetwork } from '../private/networkcontract.js';
+export const runtimeNetworkEgressRetirementContract = Object.freeze({
+    digestDomain: 'serve.zone/runtime-network-egress-retirement',
+    maximumQuarantinedHandoffs: runtimeNetworkAuthorityContract.maximumRetainedHandoffLeases,
+    maximumQuarantinedWorkloads: 512,
+    maximumClearedProjections: runtimeNetworkAuthorityContract.maximumEgressAuthorities - 1,
+    /** Fences one step may consume. Each is read on its own, so one step stays bounded. */
+    maximumFencesPerStep: 16,
+    /**
+     * Lost fences one step may hold as exemptions: owners it keeps that no consumed fence's clearance
+     * has to name. At least one owner is kept, so this is one fewer than the owners an authority has.
+     */
+    maximumExemptionsPerStep: runtimeNetworkAuthorityContract.maximumEgressAuthorities - 1,
+    /**
+     * Retired owners one step may be given: the caller's history restricted to owners `previous` or
+     * `next` names, which is at most every owner of both.
+     */
+    maximumRetiredOwners: 2 * runtimeNetworkAuthorityContract.maximumEgressAuthorities,
+    removal: 'absent-owner-requires-fence-bound-to-exact-previous-authority',
+    reentry: 'a-fenced-owner-never-returns',
+});
+const ownerKey = (value) => networkCanonical([value.nodeId, value.runtimeNamespace]);
+const referenceKey = (value) => networkCanonical(value);
+const readOwner = (value) => {
+    const item = networkRecord(value, ['nodeId', 'runtimeNamespace']);
+    return { nodeId: networkNodeId(item.nodeId), runtimeNamespace: networkId(item.runtimeNamespace) };
+};
+const readReferences = (value, maximum) => networkSorted(networkList(value, maximum, networkReference), referenceKey);
+const readClearance = (value) => {
+    const item = networkRecord(value, ['nodeId', 'runtimeNamespace', 'projection']);
+    return { ...readOwner({ nodeId: item.nodeId, runtimeNamespace: item.runtimeNamespace }),
+        projection: networkReference(item.projection) };
+};
+/** Exact-key structural snapshot, detached from its input. It verifies no digest and fences nothing. */
+export const snapshotRuntimeNetworkEgressRetirement = (value) => networkSafe(() => {
+    const item = networkRecord(captureNetwork(value), ['controller', 'nodeId', 'runtimeNamespace', 'protectedAuthority',
+        'disposition', 'lastReceipt', 'revokedCredentials', 'revokedAt', 'packetWindowExpiresAt', 'fencedAt',
+        'quarantinedHandoffs', 'quarantinedWorkloads', 'clearedProjections', 'digest']);
+    const scope = networkScope(item);
+    const disposition = item.disposition;
+    requireNetwork(isOneOf(nodeRuntimeRetirementDispositions, disposition));
+    const lastReceipt = item.lastReceipt === null ? null : networkReference(item.lastReceipt);
+    requireNetwork(disposition === 'lost' || lastReceipt !== null);
+    const credentials = networkRecord(item.revokedCredentials, ['spark', 'pallet']);
+    const revokedAt = networkCounter(item.revokedAt), packetWindowExpiresAt = networkCounter(item.packetWindowExpiresAt);
+    const fencedAt = networkCounter(item.fencedAt);
+    requireNetwork(fencedAt >= revokedAt && fencedAt >= packetWindowExpiresAt);
+    const contract = runtimeNetworkEgressRetirementContract;
+    const clearedProjections = networkSorted(networkList(item.clearedProjections, contract.maximumClearedProjections, readClearance), ownerKey);
+    requireNetwork(clearedProjections.every(owner => ownerKey(owner) !== ownerKey(scope)));
+    return { ...scope, protectedAuthority: networkReference(item.protectedAuthority), disposition, lastReceipt,
+        revokedCredentials: { spark: networkCounter(credentials.spark), pallet: networkCounter(credentials.pallet) },
+        revokedAt, packetWindowExpiresAt, fencedAt,
+        quarantinedHandoffs: readReferences(item.quarantinedHandoffs, contract.maximumQuarantinedHandoffs),
+        quarantinedWorkloads: readReferences(item.quarantinedWorkloads, contract.maximumQuarantinedWorkloads),
+        clearedProjections, digest: networkDigest(item.digest) };
+});
+export const computeRuntimeNetworkEgressRetirementDigest = (value) => networkHash(runtimeNetworkEgressRetirementContract.digestDomain, snapshotRuntimeNetworkEgressRetirement(value));
+/**
+ * Whether `next` may succeed `previous`, judged on its egress owners and the address space it keeps.
+ *
+ * Pure and fail-closed. `fences` are the egress retirements this step consumes. `exemptions` are
+ * `lost` fences of owners this step keeps, recorded against the same `previous`: such an owner never
+ * acknowledges another projection head, so no consumed fence's clearance can wait for it. They are
+ * read, not consumed, and default to none. `retiredOwners` is the caller's durable history of
+ * fenced owners restricted to the owners `previous` or `next` names, in canonical owner order. The
+ * step is accepted only when:
+ *
+ * - `next` is the exact successor of `previous` under the same controller, and both digests verify;
+ * - an owner of `previous` is absent from `next` only when exactly one fence, recorded against the
+ *   exact `previous` reference and verified by its digest, names it — a fence for an owner `next`
+ *   still names, or for an owner `previous` does not name, refuses the step;
+ * - every exemption verifies by its digest, is `lost`, is recorded under the same controller against
+ *   the exact `previous` reference, and names an owner both `previous` and `next` name, no fence
+ *   names and no other exemption names; at most `maximumExemptionsPerStep`, in canonical owner order;
+ * - every fence's `clearedProjections` names exactly the owners of `previous` this step keeps, less
+ *   the exempt owners; an exemption's own clearance is not judged here, only when its owner leaves;
+ * - `retiredOwners` is empty: any entry is either an owner a side names that was fenced before, or
+ *   not part of the restriction at all, so a fenced owner never returns;
+ * - every pool of `previous` is kept unchanged and the prefixes of `next` cover those of `previous`;
+ *   a step that removes an owner also keeps every resolver of `previous` unchanged.
+ *
+ * Owners that join in the same step are admitted. With no fence this is the additive owner rule:
+ * nobody leaves, and exemptions relax nothing. It verifies no fence evidence against live state and
+ * fences no record: the caller fences every fence and exemption it read together with the authority
+ * it stages.
+ */
+export const bindRuntimeNetworkProtectedAuthorityRetirement = async (previousValue, nextValue, fencesValue, retiredOwnersValue, exemptionsValue = []) => {
+    try {
+        const contract = runtimeNetworkEgressRetirementContract;
+        const previous = snapshotRuntimeNetworkProtectedAuthority(captureNetwork(previousValue));
+        const next = snapshotRuntimeNetworkProtectedAuthority(captureNetwork(nextValue));
+        const elements = readDataElements(fencesValue, contract.maximumFencesPerStep);
+        requireNetwork(elements);
+        const fences = networkSorted(elements.map(snapshotRuntimeNetworkEgressRetirement), ownerKey);
+        const exemptionElements = readDataElements(exemptionsValue, contract.maximumExemptionsPerStep);
+        requireNetwork(exemptionElements);
+        const exemptions = networkSorted(exemptionElements.map(snapshotRuntimeNetworkEgressRetirement), ownerKey);
+        const retiredOwners = networkSorted(networkList(captureNetwork(retiredOwnersValue), contract.maximumRetiredOwners, readOwner), ownerKey);
+        requireNetwork(previous.digest === await computeRuntimeNetworkProtectedAuthorityDigest(previous)
+            && next.digest === await computeRuntimeNetworkProtectedAuthorityDigest(next));
+        const reference = networkReferenceOf(previous);
+        requireNetwork(networkEqual(next.controller, previous.controller) && next.id === previous.id
+            && next.generation === previous.generation + 1 && networkEqual(next.previous, reference));
+        const previousOwners = new Set(previous.egressAuthorities.map(ownerKey));
+        const nextOwners = new Set(next.egressAuthorities.map(ownerKey));
+        const fenced = new Set(fences.map(ownerKey));
+        for (const fence of fences) {
+            requireNetwork(fence.digest === await computeRuntimeNetworkEgressRetirementDigest(fence)
+                && networkEqual(fence.controller, previous.controller) && networkEqual(fence.protectedAuthority, reference)
+                && previousOwners.has(ownerKey(fence)) && !nextOwners.has(ownerKey(fence)));
+        }
+        requireNetwork([...previousOwners].every(owner => nextOwners.has(owner) || fenced.has(owner)));
+        for (const exemption of exemptions) {
+            requireNetwork(exemption.digest === await computeRuntimeNetworkEgressRetirementDigest(exemption)
+                && exemption.disposition === 'lost' && networkEqual(exemption.controller, previous.controller)
+                && networkEqual(exemption.protectedAuthority, reference) && previousOwners.has(ownerKey(exemption))
+                && nextOwners.has(ownerKey(exemption)));
+        }
+        // A fence's owner is never named by `next`, so no exemption names an owner a fence names.
+        const exempt = new Set(exemptions.map(ownerKey));
+        const cleared = previous.egressAuthorities.map(ownerKey).filter(owner => !fenced.has(owner) && !exempt.has(owner));
+        for (const fence of fences) {
+            requireNetwork(networkEqual(fence.clearedProjections.map(ownerKey), cleared));
+        }
+        requireNetwork(retiredOwners.length === 0);
+        requireNetwork(previous.pools.every(pool => next.pools.some(candidate => networkEqual(candidate, pool)))
+            && previous.prefixes.every(prefix => networkCoveredBy(next.prefixes, prefix)));
+        if (fences.length > 0) {
+            requireNetwork(previous.resolvers.every(resolver => next.resolvers.some(candidate => networkEqual(candidate, resolver))));
+        }
+        return { previous, next, fences, exemptions };
+    }
+    catch {
+        return failNetwork();
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibmV0d29ya2VncmVzc3JldGlyZW1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25ldHdvcmtlZ3Jlc3NyZXRpcmVtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSw2Q0FBNkMsRUFBRSwrQkFBK0IsRUFDckYsd0NBQXdDLEVBQUUsTUFBTSx1QkFBdUIsQ0FBQztBQUMxRSxPQUFPLEVBQUUsaUNBQWlDLEVBQTBDLE1BQU0scUJBQXFCLENBQUM7QUFDaEgsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDaEUsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBQ3pELE9BQU8sRUFBRSxjQUFjLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixFQUFFLGNBQWMsRUFBRSxnQkFBZ0IsRUFBRSxhQUFhLEVBQUUsWUFBWSxFQUNuSCxXQUFXLEVBQUUsU0FBUyxFQUFFLFdBQVcsRUFBRSxhQUFhLEVBQUUsYUFBYSxFQUFFLGdCQUFnQixFQUFFLGtCQUFrQixFQUFFLFdBQVcsRUFDcEgsWUFBWSxFQUFFLGFBQWEsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQW9FckYsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNsRSxZQUFZLEVBQUUsOENBQThDO0lBQzVELDBCQUEwQixFQUFFLCtCQUErQixDQUFDLDRCQUE0QjtJQUN4RiwyQkFBMkIsRUFBRSxHQUFHO0lBQ2hDLHlCQUF5QixFQUFFLCtCQUErQixDQUFDLHdCQUF3QixHQUFHLENBQUM7SUFDdkYsdUZBQXVGO0lBQ3ZGLG9CQUFvQixFQUFFLEVBQUU7SUFDeEI7OztPQUdHO0lBQ0gsd0JBQXdCLEVBQUUsK0JBQStCLENBQUMsd0JBQXdCLEdBQUcsQ0FBQztJQUN0Rjs7O09BR0c7SUFDSCxvQkFBb0IsRUFBRSxDQUFDLEdBQUcsK0JBQStCLENBQUMsd0JBQXdCO0lBQ2xGLE9BQU8sRUFBRSwrREFBK0Q7SUFDeEUsT0FBTyxFQUFFLDhCQUE4QjtDQUMvQixDQUFDLENBQUM7QUFFWixNQUFNLFFBQVEsR0FBRyxDQUFDLEtBQWlDLEVBQVUsRUFBRSxDQUFDLGdCQUFnQixDQUFDLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDO0FBQ3pILE1BQU0sWUFBWSxHQUFHLENBQUMsS0FBaUMsRUFBVSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLENBQUM7QUFFNUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQThCLEVBQUU7SUFDL0QsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLFFBQVEsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLENBQUM7SUFDbEUsT0FBTyxFQUFFLE1BQU0sRUFBRSxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLGdCQUFnQixFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO0FBQ3BHLENBQUMsQ0FBQztBQUNGLE1BQU0sY0FBYyxHQUFHLENBQUMsS0FBYyxFQUFFLE9BQWUsRUFBZ0MsRUFBRSxDQUN2RixhQUFhLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLENBQUMsRUFBRSxZQUFZLENBQUMsQ0FBQztBQUM3RSxNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBNEMsRUFBRTtJQUNqRixNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsUUFBUSxFQUFFLGtCQUFrQixFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUM7SUFDaEYsT0FBTyxFQUFFLEdBQUcsU0FBUyxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7UUFDckYsVUFBVSxFQUFFLGdCQUFnQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO0FBQ3BELENBQUMsQ0FBQztBQUVGLHdHQUF3RztBQUN4RyxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7SUFDMUgsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFlBQVksRUFBRSxRQUFRLEVBQUUsa0JBQWtCLEVBQUUsb0JBQW9CO1FBQ2pILGFBQWEsRUFBRSxhQUFhLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLHVCQUF1QixFQUFFLFVBQVU7UUFDcEcscUJBQXFCLEVBQUUsc0JBQXNCLEVBQUUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNsRixNQUFNLEtBQUssR0FBRyxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDakMsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQztJQUNyQyxjQUFjLENBQUMsT0FBTyxDQUFDLGlDQUFpQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDeEUsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLFdBQVcsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzFGLGNBQWMsQ0FBQyxXQUFXLEtBQUssTUFBTSxJQUFJLFdBQVcsS0FBSyxJQUFJLENBQUMsQ0FBQztJQUMvRCxNQUFNLFdBQVcsR0FBRyxhQUFhLENBQUMsSUFBSSxDQUFDLGtCQUFrQixFQUFFLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDaEYsTUFBTSxTQUFTLEdBQUcsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxxQkFBcUIsR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDckgsTUFBTSxRQUFRLEdBQUcsY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMvQyxjQUFjLENBQUMsUUFBUSxJQUFJLFNBQVMsSUFBSSxRQUFRLElBQUkscUJBQXFCLENBQUMsQ0FBQztJQUMzRSxNQUFNLFFBQVEsR0FBRyxzQ0FBc0MsQ0FBQztJQUN4RCxNQUFNLGtCQUFrQixHQUFHLGFBQWEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLGtCQUFrQixFQUFFLFFBQVEsQ0FBQyx5QkFBeUIsRUFDOUcsYUFBYSxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDNUIsY0FBYyxDQUFDLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ3ZGLE9BQU8sRUFBRSxHQUFHLEtBQUssRUFBRSxrQkFBa0IsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUMsRUFBRSxXQUFXLEVBQUUsV0FBVztRQUN4RyxrQkFBa0IsRUFBRSxFQUFFLEtBQUssRUFBRSxjQUFjLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxjQUFjLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxFQUFFO1FBQzVHLFNBQVMsRUFBRSxxQkFBcUIsRUFBRSxRQUFRO1FBQzFDLG1CQUFtQixFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsUUFBUSxDQUFDLDBCQUEwQixDQUFDO1FBQ2xHLG9CQUFvQixFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLDJCQUEyQixDQUFDO1FBQ3JHLGtCQUFrQixFQUFFLE1BQU0sRUFBRSxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7QUFDN0QsQ0FBQyxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxDQUFDLEtBQXNDLEVBQTBCLEVBQUUsQ0FDNUgsV0FBVyxDQUFDLHNDQUFzQyxDQUFDLFlBQVksRUFBRSxzQ0FBc0MsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0FBRWxIOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBNEJHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sOENBQThDLEdBQUcsS0FBSyxFQUNqRSxhQUFzQixFQUFFLFNBQWtCLEVBQUUsV0FBb0IsRUFBRSxrQkFBMkIsRUFDN0Ysa0JBQTJCLEVBQUUsRUFNNUIsRUFBRTtJQUNILElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLHNDQUFzQyxDQUFDO1FBQ3hELE1BQU0sUUFBUSxHQUFHLHdDQUF3QyxDQUFDLGNBQWMsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3pGLE1BQU0sSUFBSSxHQUFHLHdDQUF3QyxDQUFDLGNBQWMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1FBQ2pGLE1BQU0sUUFBUSxHQUFHLGdCQUFnQixDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsb0JBQW9CLENBQUMsQ0FBQztRQUM5RSxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDekIsTUFBTSxNQUFNLEdBQUcsYUFBYSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsc0NBQXNDLENBQUMsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUM3RixNQUFNLGlCQUFpQixHQUFHLGdCQUFnQixDQUFDLGVBQWUsRUFBRSxRQUFRLENBQUMsd0JBQXdCLENBQUMsQ0FBQztRQUMvRixjQUFjLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNsQyxNQUFNLFVBQVUsR0FBRyxhQUFhLENBQUMsaUJBQWlCLENBQUMsR0FBRyxDQUFDLHNDQUFzQyxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDMUcsTUFBTSxhQUFhLEdBQUcsYUFBYSxDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsa0JBQWtCLENBQUMsRUFBRSxRQUFRLENBQUMsb0JBQW9CLEVBQy9HLFNBQVMsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3hCLGNBQWMsQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLE1BQU0sNkNBQTZDLENBQUMsUUFBUSxDQUFDO2VBQzNGLElBQUksQ0FBQyxNQUFNLEtBQUssTUFBTSw2Q0FBNkMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLE1BQU0sU0FBUyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQy9DLGNBQWMsQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksSUFBSSxDQUFDLEVBQUUsS0FBSyxRQUFRLENBQUMsRUFBRTtlQUN2RixJQUFJLENBQUMsVUFBVSxLQUFLLFFBQVEsQ0FBQyxVQUFVLEdBQUcsQ0FBQyxJQUFJLFlBQVksQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFFNUYsTUFBTSxjQUFjLEdBQUcsSUFBSSxHQUFHLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQ3pFLE1BQU0sVUFBVSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUNqRSxNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDN0MsS0FBSyxNQUFNLEtBQUssSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUMzQixjQUFjLENBQUMsS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNLDJDQUEyQyxDQUFDLEtBQUssQ0FBQzttQkFDbkYsWUFBWSxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsQ0FBQyxJQUFJLFlBQVksQ0FBQyxLQUFLLENBQUMsa0JBQWtCLEVBQUUsU0FBUyxDQUFDO21CQUN4RyxjQUFjLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxjQUFjLENBQUMsQ0FBQyxHQUFHLGNBQWMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDL0YsS0FBSyxNQUFNLFNBQVMsSUFBSSxVQUFVLEVBQUUsQ0FBQztZQUNuQyxjQUFjLENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxNQUFNLDJDQUEyQyxDQUFDLFNBQVMsQ0FBQzttQkFDM0YsU0FBUyxDQUFDLFdBQVcsS0FBSyxNQUFNLElBQUksWUFBWSxDQUFDLFNBQVMsQ0FBQyxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsQ0FBQzttQkFDM0YsWUFBWSxDQUFDLFNBQVMsQ0FBQyxrQkFBa0IsRUFBRSxTQUFTLENBQUMsSUFBSSxjQUFjLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQzttQkFDaEcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzVDLENBQUM7UUFDRCwwRkFBMEY7UUFDMUYsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQ2pELE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQ25ILEtBQUssTUFBTSxLQUFLLElBQUksTUFBTSxFQUFFLENBQUM7WUFDM0IsY0FBYyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7UUFDaEYsQ0FBQztRQUNELGNBQWMsQ0FBQyxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBRTNDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDO2VBQ25HLFFBQVEsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDakYsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RCLGNBQWMsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM1SCxDQUFDO1FBQ0QsT0FBTyxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxDQUFDO0lBQ2hELENBQUM7SUFBQyxNQUFNLENBQUM7UUFBQyxPQUFPLFdBQVcsRUFBRSxDQUFDO0lBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUMifQ==

package/dist_ts/data/noderetirement.d.ts

@@ -1,10 +1,26 @@
 declare const nodeRuntimeRetirementStates: readonly ["retiring", "retired"];
 /**
  * How far a node's retirement has come: `retiring` while the producer still stops and removes the
- * node's slots, the compiler quarantines its handoff and both node credentials are revoked;
- * `retired` once all of that has settled and nothing but the node document is left to delete.
+ * node's slots, the compiler quarantines its handoff and leases, both node credentials are revoked
+ * and the node's egress fence (`IRuntimeNetworkEgressRetirement`) is not yet recorded; `retired`
+ * once the protected authority no longer names the node and nothing but the node document is left
+ * to delete.
  */
 export type TNodeRuntimeRetirementState = typeof nodeRuntimeRetirementStates[number];
+/** Every way a node can leave its runtime, in the order an escalation moves through them. */
+export declare const nodeRuntimeRetirementDispositions: readonly ["withdrawn", "lost"];
+/**
+ * How the node leaves.
+ *
+ * `withdrawn`: the node still runs and takes part. Its slots are removed against its own removal
+ * receipts, and its Pallet withdraws its protection receipt before its credentials are revoked.
+ *
+ * `lost`: an administrator states that the node will never report again — its host is gone, wiped
+ * or unreachable for good. Its slots are abandoned without removal receipts, which is the one thing
+ * this statement authorizes. It authorizes nothing about packets: a lost node leaves the protected
+ * authority behind exactly the same controller-owned fence as a withdrawn one.
+ */
+export type TNodeRuntimeRetirementDisposition = typeof nodeRuntimeRetirementDispositions[number];
 /**
  * That one node leaves its cluster's runtime, stored beside the node document rather than inside
  * it, because a node update merges caller data and no caller may retire a node with it.
@@ -19,7 +35,9 @@ export interface INodeRuntimeRetirement {
     /** The cluster the node is retiring from, copied by Cloudly; never caller-chosen. */
     clusterId: string;
     state: TNodeRuntimeRetirementState;
-    /** The administrator who asked for the retirement. */
+    /** How the node leaves; a `withdrawn` retirement still `retiring` may be escalated to `lost`. */
+    disposition: TNodeRuntimeRetirementDisposition;
+    /** The administrator who asked for the retirement, or for its escalation. */
     actorId: string;
     /** Unix milliseconds on Cloudly's clock, when the row entered its current state. */
     since: number;
@@ -28,9 +46,11 @@ export interface INodeRuntimeRetirement {
  * Every reason Cloudly answers instead of retiring a node. Each travels as a `TypedResponseError`,
  * and none of them takes anything away: a refused retirement leaves the node exactly as it was.
  */
-export declare const nodeRuntimeRetirementRefusals: readonly ["node-missing", "cluster-runtime-not-pallet", "node-already-retired", "conflict"];
+export declare const nodeRuntimeRetirementRefusals: readonly ["node-missing", "cluster-runtime-not-pallet", "node-already-retired", "conflict", "node-still-reporting"];
 /** One of the reasons Cloudly answers instead of a retirement row. */
 export type TNodeRuntimeRetirementRefusal = typeof nodeRuntimeRetirementRefusals[number];
+/** One disposition, exactly as `nodeRuntimeRetirementDispositions` spells it. */
+export declare const snapshotNodeRuntimeRetirementDisposition: (value: unknown) => TNodeRuntimeRetirementDisposition;
 /**
  * Structural snapshot for exact persistence; whether the node exists and whether its cluster admits
  * the retirement is Cloudly's.

package/dist_ts/data/noderetirement.js

@@ -1,6 +1,8 @@
 import { captureNetwork, networkCounter, networkId, networkNodeId, networkRecord, requireNetwork } from '../private/networkcontract.js';
 import { isOneOf, producerSafe } from '../private/producercontract.js';
 const nodeRuntimeRetirementStates = ['retiring', 'retired'];
+/** Every way a node can leave its runtime, in the order an escalation moves through them. */
+export const nodeRuntimeRetirementDispositions = Object.freeze(['withdrawn', 'lost']);
 /**
  * Every reason Cloudly answers instead of retiring a node. Each travels as a `TypedResponseError`,
  * and none of them takes anything away: a refused retirement leaves the node exactly as it was.
@@ -13,19 +15,34 @@ export const nodeRuntimeRetirementRefusals = Object.freeze([
      * `pallet`. Which of the two it is, `getClusterRuntime` says.
      */
     'cluster-runtime-not-pallet',
-    /** The node already carries a retirement row; neither of its states is left by retiring again. */
+    /**
+     * The node already carries a retirement row that this request cannot move: anything but a
+     * `withdrawn` row still `retiring`, asked again as `lost`.
+     */
     'node-already-retired',
     /** `expectedGeneration` is not the cluster runtime's current generation, so a cutover moved underneath the caller. */
     'conflict',
+    /**
+     * A `lost` retirement of a node whose last accepted report is younger than
+     * `clusterNodeObservationFreshnessMs`: a node that still reports is not lost, and it leaves as
+     * `withdrawn`.
+     */
+    'node-still-reporting',
 ]);
+/** One disposition, exactly as `nodeRuntimeRetirementDispositions` spells it. */
+export const snapshotNodeRuntimeRetirementDisposition = (value) => producerSafe(() => {
+    requireNetwork(isOneOf(nodeRuntimeRetirementDispositions, value));
+    return value;
+});
 /**
  * Structural snapshot for exact persistence; whether the node exists and whether its cluster admits
  * the retirement is Cloudly's.
  */
 export const snapshotNodeRuntimeRetirement = (value) => producerSafe(() => {
-    const item = networkRecord(captureNetwork(value), ['id', 'clusterId', 'state', 'actorId', 'since']);
+    const item = networkRecord(captureNetwork(value), ['id', 'clusterId', 'state', 'disposition', 'actorId', 'since']);
     requireNetwork(isOneOf(nodeRuntimeRetirementStates, item.state));
     return { id: networkNodeId(item.id), clusterId: networkId(item.clusterId), state: item.state,
+        disposition: snapshotNodeRuntimeRetirementDisposition(item.disposition),
         actorId: networkId(item.actorId), since: networkCounter(item.since) };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZXJldGlyZW1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25vZGVyZXRpcmVtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsYUFBYSxFQUFFLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hJLE9BQU8sRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFFdkUsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLFVBQVUsRUFBRSxTQUFTLENBQVUsQ0FBQztBQTZCckU7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN6RCxnRUFBZ0U7SUFDaEUsY0FBYztJQUNkOzs7T0FHRztJQUNILDRCQUE0QjtJQUM1QixrR0FBa0c7SUFDbEcsc0JBQXNCO0lBQ3RCLHNIQUFzSDtJQUN0SCxVQUFVO0NBQ0YsQ0FBQyxDQUFDO0FBS1o7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ3pHLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNwRyxjQUFjLENBQUMsT0FBTyxDQUFDLDJCQUEyQixFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQ2pFLE9BQU8sRUFBRSxFQUFFLEVBQUUsYUFBYSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUs7UUFDMUYsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUMxRSxDQUFDLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZXJldGlyZW1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL25vZGVyZXRpcmVtZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxjQUFjLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsYUFBYSxFQUFFLGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hJLE9BQU8sRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFFdkUsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLFVBQVUsRUFBRSxTQUFTLENBQVUsQ0FBQztBQVdyRSw2RkFBNkY7QUFDN0YsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFdBQVcsRUFBRSxNQUFNLENBQVUsQ0FBQyxDQUFDO0FBcUMvRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3pELGdFQUFnRTtJQUNoRSxjQUFjO0lBQ2Q7OztPQUdHO0lBQ0gsNEJBQTRCO0lBQzVCOzs7T0FHRztJQUNILHNCQUFzQjtJQUN0QixzSEFBc0g7SUFDdEgsVUFBVTtJQUNWOzs7O09BSUc7SUFDSCxzQkFBc0I7Q0FDZCxDQUFDLENBQUM7QUFLWixpRkFBaUY7QUFDakYsTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsQ0FBQyxLQUFjLEVBQXFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQy9ILGNBQWMsQ0FBQyxPQUFPLENBQUMsaUNBQWlDLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNsRSxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQyxDQUFDO0FBRUg7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ3pHLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxhQUFhLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDbkgsY0FBYyxDQUFDLE9BQU8sQ0FBQywyQkFBMkIsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNqRSxPQUFPLEVBQUUsRUFBRSxFQUFFLGFBQWEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLO1FBQzFGLFdBQVcsRUFBRSx3Q0FBd0MsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQ3ZFLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDMUUsQ0FBQyxDQUFDLENBQUMifQ==

package/dist_ts/private/networkcontract.d.ts

@@ -93,3 +93,5 @@ export declare const networkPrefix: (value: unknown) => string;
 export declare const networkPrivatePrefix: (value: unknown) => string;
 export declare const networkContains: (outer: string, inner: string) => boolean;
 export declare const networkOverlaps: (left: string, right: string) => boolean;
+/** Whether the union of `prefixes`, which never overlap one another, covers every address of `prefix`. */
+export declare const networkCoveredBy: (prefixes: string[], prefix: string) => boolean;