@serve.zone/interfaces 32.44.0 → 32.45.0

package/changelog.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 2026-10-04 - 32.45.0
+
+### Features
+
+- A node can say it refused a run. `TRuntimeAssignmentFailureCause` gains
+  `{ kind: 'refused'; reason: TRuntimeAssignmentRefusalReason }` (`runtimeAssignmentRefusalReasons`:
+  `unsupported-readiness`, `unresolved-authority`, `invalid`) for a run refused before any runtime
+  effect, and `{ kind: 'container-refused'; grpcCode }` for a deterministic CRI
+  `CreateContainer` refusal (gRPC status 1..16, as for `image-pull-refused`). Both are exact records and, like `image-pull-refused`, belong only to
+  a failed observation whose `runtime` is null. A `refused` run is never re-placed with an
+  identical configuration: the controller places a new attempt only after the spec or another
+  input of the assignment changed. Consumers earlier than this release refuse an observation that
+  states either cause.
+- `TServiceRuntimeRefusal` gains `readiness-network-unsupported`: an `isolated` spec with a `tcp`
+  or `http` readiness probe. `isServiceRuntimeReadinessReachable(spec)` is the rule; the spec
+  snapshot still reads such a spec, so stored specs stay readable.
+- `IServiceRuntimeAssignmentView.dispatch` (optional, `IServiceRuntimeAssignmentDispatch | null`)
+  states the controller's last dispatch of the slot's current revision: `delivered`, a closed
+  `TAssignmentDispatchReason` (`assignmentDispatchReasons`) and `at`.
+  `isServiceRuntimeAssignmentDispatch` validates one exactly.
+- A platform-owned service takes infrastructure-administrator authority over its published ports;
+  every organization service keeps the federated organization-owner rule. An administrator
+  designates a service that belongs to no idp.global organization (the cluster ingress, a platform
+  call router) with `designatePlatformOwnedService`, withdraws it with
+  `undesignatePlatformOwnedService` and reads it with `getServicePlatformOwnership`
+  (`IServicePlatformOwnership`, `snapshotServicePlatformOwnership`). From then on
+  `getServicePublishedPorts` and `setServicePublishedPorts` for that service require a verified
+  administrator, as `setServiceNetworkEgress` does, and no organization owner. Only a platform
+  organization's service is designated: `isPlatformOrganizationId` is true exactly for a canonical
+  identifier carrying `:` (`legacy:Service:<id>`, `Organization:<id>`) and false for an idp.global
+  nanoid, whichever character it starts with, and for anything that is not a canonical identifier
+  (empty, whitespace). Withdrawing a designation leaves the service's published ports with no
+  writer until it is designated again. Refusals are the closed `servicePlatformOwnershipRefusals`:
+  `service-unknown`, `service-deleting`, `organization-not-platform`, `conflict`.
+
+### Maintenance
+
+- Release tooling: @git.zone/tstest 7.1.0, @git.zone/tsdoc 3.0.2, @types/node 26.6.3.
+
 ## 2026-10-02 - 32.44.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.44.0',
+    version: '32.45.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/index.d.ts

@@ -75,6 +75,7 @@ export * from './sparklegacyretirement.js';
 export * from './sparknodereport.js';
 export * from './service.js';
 export * from './servicecredential.js';
+export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
 export * from './servicevolumeinitialization.js';

package/dist_ts/data/index.js

@@ -71,6 +71,7 @@ export * from './sparklegacyretirement.js';
 export * from './sparknodereport.js';
 export * from './service.js';
 export * from './servicecredential.js';
+export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
 export * from './servicevolumeinitialization.js';
@@ -80,4 +81,4 @@ export * from './traffic.js';
 export * from './user.js';
 export * from './version.js';
 export * from './webpush.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyx3QkFBd0IsQ0FBQztBQUd2QyxPQUFPLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUc5RCxPQUFPLEVBQUUscUNBQXFDLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUVwRixPQUFPLEVBQUUsMENBQTBDLEVBQUUsMENBQTBDLEVBQUUsTUFBTSxrQ0FBa0MsQ0FBQztBQUMxSSxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGtDQUFrQyxDQUFDO0FBQ2pELGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxXQUFXLENBQUM7QUFDMUIsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxjQUFjLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLGNBQWMsb0JBQW9CLENBQUM7QUFDbkMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLDZCQUE2QixDQUFDO0FBQzVDLGNBQWMsYUFBYSxDQUFDO0FBQzVCLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsdUJBQXVCLENBQUM7QUFDdEMsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLHlCQUF5QixDQUFDO0FBQ3hDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFVBQVUsQ0FBQztBQUN6QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHVCQUF1QixDQUFDO0FBQ3RDLGNBQWMsbUJBQW1CLENBQUM7QUFDbEMsY0FBYyxjQUFjLENBQUM7QUFDN0IsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLFlBQVksQ0FBQztBQUMzQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw2QkFBNkIsQ0FBQztBQUM1QyxjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyx5QkFBeUIsQ0FBQztBQUN4QyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMseUJBQXlCLENBQUM7QUFDeEMsY0FBYyx1QkFBdUIsQ0FBQztBQUN0QyxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsc0JBQXNCLENBQUM7QUFDckMsY0FBYyw4QkFBOEIsQ0FBQztBQUM3QyxjQUFjLG1CQUFtQixDQUFDO0FBQ2xDLGNBQWMsa0JBQWtCLENBQUM7QUFDakMsY0FBYyx3QkFBd0IsQ0FBQztBQUd2QyxPQUFPLEVBQUUsMEJBQTBCLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUc5RCxPQUFPLEVBQUUscUNBQXFDLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUVwRixPQUFPLEVBQUUsMENBQTBDLEVBQUUsMENBQTBDLEVBQUUsTUFBTSxrQ0FBa0MsQ0FBQztBQUMxSSxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMscUJBQXFCLENBQUM7QUFDcEMsY0FBYyxxQkFBcUIsQ0FBQztBQUNwQyxjQUFjLGVBQWUsQ0FBQztBQUM5QixjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsd0JBQXdCLENBQUM7QUFDdkMsY0FBYyw0QkFBNEIsQ0FBQztBQUMzQyxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLDBCQUEwQixDQUFDO0FBQ3pDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxnQ0FBZ0MsQ0FBQztBQUMvQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsNkJBQTZCLENBQUM7QUFDNUMsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxnQkFBZ0IsQ0FBQztBQUMvQixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGFBQWEsQ0FBQztBQUM1QixjQUFjLGtCQUFrQixDQUFDO0FBQ2pDLGNBQWMsZUFBZSxDQUFDO0FBQzlCLGNBQWMsNEJBQTRCLENBQUM7QUFDM0MsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyxtQkFBbUIsQ0FBQztBQUNsQyxjQUFjLHFCQUFxQixDQUFDO0FBQ3BDLGNBQWMsa0NBQWtDLENBQUM7QUFDakQsY0FBYyxhQUFhLENBQUM7QUFDNUIsY0FBYyxvQkFBb0IsQ0FBQztBQUNuQyxjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLFdBQVcsQ0FBQztBQUMxQixjQUFjLGNBQWMsQ0FBQztBQUM3QixjQUFjLGNBQWMsQ0FBQyJ9

package/dist_ts/data/runtimeassignment.d.ts

@@ -108,6 +108,14 @@ export type TRuntimeAssignmentDecision = {
  */
 export declare const runtimeImagePullRefusalReasons: readonly ["unauthorized", "not-found", "tls", "transport", "deadline", "unavailable", "other"];
 export type TRuntimeImagePullRefusalReason = typeof runtimeImagePullRefusalReasons[number];
+/**
+ * Why a node refused to start a run before any runtime effect of it, as the node names it:
+ * `unsupported-readiness` a readiness probe the run's network cannot carry (a TCP or HTTP probe of
+ * a run without network authority), `unresolved-authority` a workload authority the node cannot
+ * resolve, and `invalid` an assignment or configuration the node cannot read.
+ */
+export declare const runtimeAssignmentRefusalReasons: readonly ["unsupported-readiness", "unresolved-authority", "invalid"];
+export type TRuntimeAssignmentRefusalReason = typeof runtimeAssignmentRefusalReasons[number];
 /**
  * Why a run failed, as its node can name it. Value-free: it carries a cause word and at most a
  * bounded status number, never a runtime message, a registry, a reference or a path.
@@ -120,9 +128,16 @@ export type TRuntimeImagePullRefusalReason = typeof runtimeImagePullRefusalReaso
  * - `runtime-absent`: the runtime holds no sandbox or container of a run that should be running.
  * - `network-epoch-ended`: the run's network attachment belongs to a network epoch that has ended,
  *   so the node stopped it rather than leave it running without its network.
+ * - `refused`: the node refused the run before any runtime effect of it, for `reason`, so the
+ *   observation carries no runtime identity.
+ * - `container-refused`: the runtime deterministically refused to create the run's container
+ *   (CRI `CreateContainer`), so no container of the run exists and the observation carries no
+ *   runtime identity. `grpcCode` is the runtime's gRPC status code (1..16).
  *
- * The cause explains the failure; it changes nothing about it. Every failed run is replaced the same
- * way, whichever cause it states.
+ * The cause explains the failure. Every failed run is replaced the same way, whichever cause it
+ * states, with one exception: a `refused` run is never re-placed with an identical configuration,
+ * because the node refuses the same input the same way. The controller places a new attempt only
+ * after the service's runtime spec or another input of the assignment changed.
  */
 export type TRuntimeAssignmentFailureCause = {
     kind: 'image-pull-refused';
@@ -135,8 +150,14 @@ export type TRuntimeAssignmentFailureCause = {
     kind: 'runtime-absent';
 } | {
     kind: 'network-epoch-ended';
+} | {
+    kind: 'refused';
+    reason: TRuntimeAssignmentRefusalReason;
+} | {
+    kind: 'container-refused';
+    grpcCode: number;
 };
-export declare const runtimeAssignmentFailureCauseKinds: readonly ["image-pull-refused", "exited", "runtime-absent", "network-epoch-ended"];
+export declare const runtimeAssignmentFailureCauseKinds: readonly ["image-pull-refused", "exited", "runtime-absent", "network-epoch-ended", "refused", "container-refused"];
 /** Value-free execution evidence. Receipt/acceptance alone never means ready. */
 export interface IRuntimeAssignmentObservation {
     assignment: IRuntimeAssignmentReference;

package/dist_ts/data/runtimeassignment.js

@@ -59,8 +59,19 @@ export const isResolvedWorkloadAuthorities = (valueArg) => isCanonicalTokenList(
  */
 export const runtimeImagePullRefusalReasons = ['unauthorized', 'not-found', 'tls', 'transport', 'deadline',
     'unavailable', 'other'];
+/**
+ * Why a node refused to start a run before any runtime effect of it, as the node names it:
+ * `unsupported-readiness` a readiness probe the run's network cannot carry (a TCP or HTTP probe of
+ * a run without network authority), `unresolved-authority` a workload authority the node cannot
+ * resolve, and `invalid` an assignment or configuration the node cannot read.
+ */
+export const runtimeAssignmentRefusalReasons = ['unsupported-readiness', 'unresolved-authority', 'invalid'];
 export const runtimeAssignmentFailureCauseKinds = ['image-pull-refused', 'exited', 'runtime-absent',
-    'network-epoch-ended'];
+    'network-epoch-ended', 'refused', 'container-refused'];
+/** The causes of a run of which nothing ever existed, so their observation names no runtime identity. */
+const causesWithoutRuntime = [
+    'image-pull-refused', 'refused', 'container-refused',
+];
 export const runtimeAssignmentContract = Object.freeze({
     assignmentDigestDomain: 'serve.zone/runtime-assignment',
     observationDigestDomain: 'serve.zone/runtime-assignment-observation',
@@ -301,6 +312,11 @@ const isFailureCause = (valueArg) => {
         case 'runtime-absent':
         case 'network-epoch-ended':
             return isExactRecord(valueArg, ['kind']);
+        case 'refused':
+            return isExactRecord(valueArg, ['kind', 'reason'])
+                && runtimeAssignmentRefusalReasons.some((reasonArg) => reasonArg === valueArg.reason);
+        case 'container-refused':
+            return isExactRecord(valueArg, ['kind', 'grpcCode']) && isBoundedInteger(valueArg.grpcCode, 1, 16);
         default:
             return false;
     }
@@ -326,7 +342,7 @@ const assertObservation = (valueArg) => {
         fail('runtime observation readiness and identity contradict its phase');
     }
     if (Object.hasOwn(valueArg, 'cause') && (valueArg.phase !== 'failed' || !isFailureCause(valueArg.cause)
-        || (valueArg.cause.kind === 'image-pull-refused' && valueArg.runtime !== null))) {
+        || (causesWithoutRuntime.includes(valueArg.cause.kind) && valueArg.runtime !== null))) {
         fail('runtime observation failure cause must be exact and belong to a failed run');
     }
     canonical(valueArg);
@@ -402,4 +418,4 @@ export const evaluateRuntimeAssignmentObservation = async (incomingArg, accepted
         return { status: 'reject', reason: 'invalid' };
     }
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWFzc2lnbm1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVhc3NpZ25tZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN0RixPQUFPLEVBQ0wsc0JBQXNCLEVBQUUsaUJBQWlCLEVBQUUsNEJBQTRCLEdBQ3hFLE1BQU0sNkJBQTZCLENBQUM7QUFDckMsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQy9ELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBK0UvRDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFVLENBQUM7QUFJckYsb0dBQW9HO0FBQ3BHLE1BQU0sd0JBQXdCLEdBR3pCLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDakIsT0FBTyxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsT0FBTyxLQUFLLElBQUk7SUFDdEQsT0FBTyxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsT0FBTyxLQUFLLElBQUk7SUFDdEQsT0FBTyxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDO0NBQ3pELENBQUMsQ0FBQztBQUVIOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsQ0FDekMsV0FBMkMsRUFDZCxFQUFFO0lBQy9CLElBQUksQ0FBQyxhQUFhLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUMzRyxJQUFJLENBQUMscUJBQXFCLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBQ0QsT0FBTywwQkFBMEI7U0FDOUIsTUFBTSxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyx3QkFBd0IsQ0FBQyxZQUFZLENBQUMsQ0FBQyxXQUFXLENBQUMsQ0FBQztTQUM3RSxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQztBQUM3QixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLENBQ2xELFdBQTJDLEVBQ25DLEVBQUU7SUFDVixJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsRUFBRSxZQUFZLEVBQUUsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1FBQ3BFLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxjQUFjLENBQUM7UUFDekQsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUM7SUFDeEQsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksT0FBTyxXQUFXLENBQUMsVUFBVSxLQUFLLFFBQVE7V0FDekUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDeEMsSUFBSSxDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDOUIsQ0FBQztJQUNELE9BQU8sK0JBQStCLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ3BHLENBQUMsQ0FBQztBQUVGLG1HQUFtRztBQUNuRyxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUMzQyxRQUFpQixFQUN3QixFQUFFLENBQzNDLG9CQUFvQixDQUFDLFFBQVEsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDO0FBTzdEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLENBQUMsY0FBYyxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLFVBQVU7SUFDeEcsYUFBYSxFQUFFLE9BQU8sQ0FBVSxDQUFDO0FBd0JuQyxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLG9CQUFvQixFQUFFLFFBQVEsRUFBRSxnQkFBZ0I7SUFDakcscUJBQXFCLENBQXNFLENBQUM7QUF5QjlGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDckQsc0JBQXNCLEVBQUUsK0JBQStCO0lBQ3ZELHVCQUF1QixFQUFFLDJDQUEyQztJQUNwRSx3QkFBd0IsRUFBRSxFQUFFO0lBQzVCLFFBQVEsRUFBRSxXQUFXO0lBQ3JCLE9BQU8sRUFBRSx5Q0FBeUM7Q0FDMUMsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQWtDLENBQUMsVUFBVSxFQUFFLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzdGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUM3RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUNBQXFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ3ZGLHlGQUF5RjtBQUN6RixNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQWdCLEVBQVcsRUFBRSxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUUvRjs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFO0lBQzFFLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9DLE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDNUMsT0FBTyxTQUFTLEdBQUcsQ0FBQyxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNuRSxDQUFDLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQy9DLENBQUMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0IsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDbEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztBQUNqRixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FDaEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUUzRDs7Ozs7R0FLRztBQUNILE1BQU0sYUFBYSxHQUFHLENBQ3BCLFFBQWlCLEVBQ2pCLE9BQTBCLEVBQzFCLGtCQUFxQyxFQUFFLEVBQ0YsRUFBRTtJQUN2QyxJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3ZGLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEQsSUFBSSxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3ZFLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDdkMsT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFO1FBQy9FLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDckUsT0FBTyxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7ZUFDOUYsVUFBVSxFQUFFLFVBQVUsS0FBSyxJQUFJLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDN0UsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQWtDLEVBQUUsQ0FDekUsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLENBQUM7T0FDN0MsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQztPQUMzRCxZQUFZLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDL0QsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLFFBQWlCLEVBQTBDLEVBQUUsQ0FDekYsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUM7T0FDcEQsWUFBWSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUN0RyxNQUFNLHFCQUFxQixHQUFHLENBQUMsUUFBaUIsRUFBMkMsRUFBRSxDQUMzRixhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQztPQUM5RCxZQUFZLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7T0FDN0UsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUUvQixnR0FBZ0c7QUFDaEcsTUFBTSxZQUFZLEdBQUcsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxVQUFVO0lBQzNFLFFBQVEsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBVSxDQUFDO0FBQ3RELDBGQUEwRjtBQUMxRixNQUFNLG9CQUFvQixHQUFHLENBQUMsY0FBYyxDQUFVLENBQUM7QUFDdkQsTUFBTSxxQkFBcUIsR0FBRyxpRUFBaUUsQ0FBQztBQUVoRyxNQUFNLGNBQWMsR0FBRztJQUNyQixZQUFZLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLGtCQUFrQjtJQUM1RCxjQUFjLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLFFBQVE7SUFDaEYsWUFBWSxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxRQUFRO0NBQ3RFLENBQUM7QUFFWCxNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRTtJQUNqRSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxjQUFjLENBQUM7V0FDdkMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNsQyxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3JFLFFBQVEsQ0FBQyxhQUFhLEtBQUsscUJBQXFCO1dBQ2hELENBQUMsQ0FBQyxLQUFLLEVBQUUsZUFBZSxFQUFFLGlDQUFpQyxDQUFDLENBQUMsUUFBUSxDQUN0RSxRQUFRLENBQUMsV0FBcUIsQ0FDL0I7UUFBRSxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUMxRCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ25HLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQUUsSUFBSSxDQUFDLHNCQUFzQixHQUFHLGlDQUFpQyxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELElBQUksQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUFFLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQzNGLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1FBQUUsSUFBSSxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDdkcsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLGVBQWUsRUFBRSxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzlDLElBQUksUUFBUSxDQUFDLEdBQUcsQ0FBQyxLQUFLLElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7WUFBRSxJQUFJLENBQUMsNkJBQTZCLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsS0FBSyxJQUFJO1FBQ3hELENBQUMsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7ZUFDdEMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEtBQUssUUFBUSxDQUFDLFlBQVk7ZUFDeEQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxVQUFVLEtBQU0sUUFBUSxDQUFDLFVBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDNUUsSUFBSSxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUM7SUFDbkMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLEVBQUUsWUFBWSxFQUFFLG9CQUFvQixDQUFDO1dBQzNELE9BQU8sUUFBUSxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFlBQVksQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUMvRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLGNBQWMsQ0FBQztlQUN0QyxDQUFDLE9BQU8sUUFBUSxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFlBQVksQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDLENBQUM7V0FDcEYsT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQzNFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDL0IsQ0FBQyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQWtCLENBQUM7V0FDckUsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3RDLENBQUMsUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7V0FDdEUsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxDQUFDLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztXQUN0RSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztXQUNoQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1FBQ2xGLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFDRCwrQkFBK0IsQ0FBQyxRQUFRLENBQUMsWUFBc0IsRUFDN0QsUUFBUSxDQUFDLFVBQW9CLEVBQUUsUUFBUSxDQUFDLFdBQTRCLENBQUMsQ0FBQztJQUN4RSwrRkFBK0Y7SUFDL0YsMkZBQTJGO0lBQzNGLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUM1QywrQkFBK0IsQ0FBQyxRQUFRLENBQUMsWUFBc0IsRUFDN0QsUUFBUSxDQUFDLFVBQW9CLEVBQUUsUUFBUSxDQUFDLFdBQTRCLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxVQUFVLEdBQUcsRUFBRSxDQUFDO0lBQ3BCLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBSSxRQUFRLENBQUMsT0FBcUIsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUM1RSxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNwRixJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDO2VBQ2pELENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxJQUFJLFVBQVUsRUFBRSxDQUFDO1lBQ2xGLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO1FBQ2pGLENBQUM7UUFDRCxVQUFVLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7SUFDbkMsQ0FBQztJQUNELHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN2QyxPQUFPLFFBQXlDLENBQUM7QUFDbkQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsS0FBSyxFQUFFLFNBQWlCLEVBQUUsUUFBbUMsRUFBMEIsRUFBRTtJQUM3RyxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE9BQU8sRUFBRSxHQUFHLFFBQVEsQ0FBQztJQUNqRCxPQUFPLFVBQVUsTUFBTSw0QkFBNEIsQ0FDakQsc0JBQXNCLENBQUMsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksQ0FDbkUsRUFBRSxDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUYsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsYUFBaUMsRUFDVCxFQUFFLENBQUMsYUFBYSxDQUN4Qyx5QkFBeUIsQ0FBQyxzQkFBc0IsRUFBRSxnQkFBZ0IsQ0FBQyxhQUFhLENBQUMsQ0FDbEYsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQ3RGLElBQUksQ0FBQztRQUNILE1BQU0sVUFBVSxHQUFHLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3ZELE9BQU8sVUFBVSxDQUFDLE1BQU0sS0FBSyxNQUFNLDhCQUE4QixDQUFDLFVBQVUsQ0FBQztZQUMzRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUNqRixJQUFJLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxFQUFFLElBQUksQ0FBQyxDQUF1QixDQUFDO0FBRTdGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQzNDLGFBQWlDLEVBQ0osRUFBRSxDQUFDLENBQUM7SUFDakMsWUFBWSxFQUFFLGFBQWEsQ0FBQyxZQUFZO0lBQ3hDLFVBQVUsRUFBRSxhQUFhLENBQUMsVUFBVTtJQUNwQyxNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU07Q0FDN0IsQ0FBQyxDQUFDO0FBRUgsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDeEYsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLGFBQWlDLEVBQVUsRUFBRTtJQUNyRSxNQUFNLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsYUFBYSxDQUFDO0lBQ2hGLE9BQU8sU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLEtBQUssRUFDNUMsV0FBK0IsRUFDL0IsV0FBc0MsRUFDdEMsZUFBd0MsRUFDSCxFQUFFO0lBQ3ZDLElBQUksQ0FBQztRQUNILFdBQVcsR0FBRyx5QkFBeUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNyRCxXQUFXLEdBQUcsV0FBVyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyx5QkFBeUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNuRixJQUFJLENBQUMsYUFBYSxDQUFDLGVBQWUsRUFBRSxDQUFDLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxRQUFRLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztlQUM5RixDQUFDLFlBQVksQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO2VBQ3pDLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDO2VBQ3pGLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxnQkFBZ0IsQ0FBQztZQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUNyRyxlQUFlLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLENBQTRCLENBQUM7SUFDdEYsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0seUJBQXlCLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxNQUFNO1dBQ3BELENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxDQUFDLE1BQU0seUJBQXlCLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3JGLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsQ0FBQyxhQUFpQyxFQUFXLEVBQUUsQ0FDbEUsYUFBYSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssZUFBZSxDQUFDLFVBQVUsQ0FBQyxJQUFJO1dBQzlELGFBQWEsQ0FBQyxVQUFVLENBQUMsRUFBRSxLQUFLLGVBQWUsQ0FBQyxVQUFVLENBQUMsRUFBRTtXQUM3RCxhQUFhLENBQUMsVUFBVSxDQUFDLEtBQUssS0FBSyxlQUFlLENBQUMsVUFBVSxDQUFDLEtBQUs7V0FDbkUsYUFBYSxDQUFDLGNBQWMsS0FBSyxlQUFlLENBQUMsY0FBYztXQUMvRCxhQUFhLENBQUMsTUFBTSxLQUFLLGVBQWUsQ0FBQyxNQUFNO1dBQy9DLGFBQWEsQ0FBQyxnQkFBZ0IsS0FBSyxlQUFlLENBQUMsZ0JBQWdCLENBQUM7SUFDekUsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3ZGLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO0lBQ3hELENBQUM7SUFDRCxJQUFJLFdBQVcsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUN6QixPQUFPLFdBQVcsQ0FBQyxVQUFVLEtBQUssQ0FBQztlQUM5QixXQUFXLENBQUMsV0FBVyxLQUFLLEtBQUs7WUFDcEMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFO1lBQy9DLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLHNCQUFzQixFQUFFLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLFlBQVksS0FBSyxXQUFXLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDMUQsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixFQUFFLENBQUM7SUFDMUQsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLFVBQVUsR0FBRyxXQUFXLENBQUMsVUFBVTtRQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUNsRyxJQUFJLFdBQVcsQ0FBQyxVQUFVLEtBQUssV0FBVyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ3RELE9BQU8sV0FBVyxDQUFDLE1BQU0sS0FBSyxXQUFXLENBQUMsTUFBTTtZQUM5QyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxLQUFLLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDOUYsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLHNCQUFzQixFQUFFLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEtBQUssZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQWtEO1FBQzNELEdBQUcsRUFBRSxDQUFDLEVBQUUsZUFBZSxFQUFFLENBQUMsRUFBRSxpQ0FBaUMsRUFBRSxDQUFDO0tBQ2pFLENBQUM7SUFDRixJQUFJLEtBQUssQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLEtBQUssS0FBSyxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsd0JBQXdCLEVBQUUsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxDQUFDO0FBQ3ZELENBQUMsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFVBQWtCLEVBQUUsVUFBa0IsRUFBc0IsRUFBRSxDQUN6RyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLElBQUksVUFBVSxJQUFJLFFBQVEsSUFBSSxVQUFVLENBQUM7QUFFckgsd0VBQXdFO0FBQ3hFLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBaUIsRUFBOEMsRUFBRTtJQUN2RixJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3pGLFFBQVEsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3RCLEtBQUssb0JBQW9CO1lBQ3ZCLE9BQU8sYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUM7bUJBQ3pELDhCQUE4QixDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxLQUFLLFFBQVEsQ0FBQyxNQUFNLENBQUM7bUJBQ2pGLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2xELEtBQUssUUFBUTtZQUNYLE9BQU8sYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxVQUFVLENBQUMsQ0FBQzttQkFDL0MsQ0FBQyxRQUFRLENBQUMsUUFBUSxLQUFLLElBQUksSUFBSSxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ25GLEtBQUssZ0JBQWdCLENBQUM7UUFDdEIsS0FBSyxxQkFBcUI7WUFDeEIsT0FBTyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMzQztZQUNFLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsUUFBaUIsRUFBaUMsRUFBRTtJQUM3RSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLFlBQVksRUFBRSxtQkFBbUI7UUFDN0QsVUFBVSxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1dBQ3pFLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUMzQyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEYsQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztXQUNyRSxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUNuQyxDQUFDLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQWUsQ0FBQyxFQUFFLENBQUM7UUFDM0csSUFBSSxDQUFDLCtDQUErQyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFO1FBQ2pFLFdBQVcsRUFBRSxhQUFhLEVBQUUsYUFBYTtLQUMxQyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztXQUN6RixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQUUsSUFBSSxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUM7V0FDL0MsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQztXQUMzRCxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNqRSxJQUFJLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7V0FDbEcsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxvQkFBb0IsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNsRixJQUFJLENBQUMsNEVBQTRFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BCLE9BQU8sUUFBb0QsQ0FBQztBQUM5RCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxLQUFLLEVBQzVELGNBQTZDLEVBQ3JCLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLHlCQUF5QixDQUFDLHVCQUF1QixFQUFFLGlCQUFpQixDQUFDLGNBQWMsQ0FBQyxDQUNyRixDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLENBQ2xELFFBQWlCLEVBQ2MsRUFBRSxDQUNqQyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFrQyxDQUFDO0FBRXRGLHlGQUF5RjtBQUN6RixNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxLQUFLLEVBQ3ZELGNBQXVCLEVBQ3ZCLGFBQWlDLEVBQ2QsRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxNQUFNLFdBQVcsR0FBRyxvQ0FBb0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUN6RSxhQUFhLEdBQUcseUJBQXlCLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLE1BQU0seUJBQXlCLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxNQUFNO1lBQUUsT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDM0YsSUFBSSxTQUFTLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEcsT0FBTyxDQUFDLHlEQUF5RCxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLE1BQU0sS0FBSyxNQUFNLHlDQUF5QyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDeEYsT0FBTyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLEtBQUssSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLEtBQUssS0FBSztlQUN4RCxXQUFXLENBQUMsT0FBTyxFQUFFLFdBQVcsS0FBSyxhQUFhLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDOUUsT0FBTyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUNELE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFNRjs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsS0FBSyxFQUN2RCxXQUEwQyxFQUMxQyxXQUFpRCxFQUNqRCxhQUFpQyxFQUNqQywyQkFBbUMsRUFDRyxFQUFFO0lBQ3hDLElBQUksQ0FBQztRQUNILFdBQVcsR0FBRyxvQ0FBb0MsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNoRSxXQUFXLEdBQUcsV0FBVyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUN2QyxDQUFDLENBQUMsb0NBQW9DLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDdEQsYUFBYSxHQUFHLHlCQUF5QixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3pELElBQUksQ0FBQyxZQUFZLENBQUMsMkJBQTJCLENBQUM7ZUFDekMsQ0FBQyxNQUFNLG9DQUFvQyxDQUFDLFdBQVcsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDLE1BQU07ZUFDL0UsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLENBQzFCLFdBQVcsQ0FBQyxNQUFNLEtBQUssTUFBTSx5Q0FBeUMsQ0FBQyxXQUFXLENBQUM7bUJBQ2hGLFdBQVcsQ0FBQyxVQUFVLENBQUMsWUFBWSxLQUFLLGFBQWEsQ0FBQyxZQUFZO21CQUNsRSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLDZCQUE2QixDQUFDLGFBQWEsQ0FBQyxDQUFDO3VCQUM1RixTQUFTLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FDOUUsQ0FBQztZQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUNyRCxJQUFJLFdBQVcsQ0FBQyxpQkFBaUIsS0FBSywyQkFBMkIsRUFBRSxDQUFDO1lBQ2xFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsRUFBRSxDQUFDO1FBQzFELENBQUM7UUFDRCxJQUFJLFdBQVcsS0FBSyxJQUFJLElBQUksV0FBVyxDQUFDLFFBQVEsSUFBSSxXQUFXLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDekUsSUFBSSxXQUFXLENBQUMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxRQUFRO2dCQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUM5RixPQUFPLFdBQVcsQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLE1BQU07Z0JBQzlDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRTtnQkFDaEQsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDL0MsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLFFBQVEsS0FBSyxDQUFDLFdBQVcsRUFBRSxRQUFRLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDOUQsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxDQUFDO1FBQ3RELENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLENBQUM7SUFDeEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZWFzc2lnbm1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3J1bnRpbWVhc3NpZ25tZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxjQUFjLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN0RixPQUFPLEVBQ0wsc0JBQXNCLEVBQUUsaUJBQWlCLEVBQUUsNEJBQTRCLEdBQ3hFLE1BQU0sNkJBQTZCLENBQUM7QUFDckMsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQy9ELE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBK0UvRDs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFVLENBQUM7QUFJckYsb0dBQW9HO0FBQ3BHLE1BQU0sd0JBQXdCLEdBR3pCLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDakIsT0FBTyxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsT0FBTyxLQUFLLElBQUk7SUFDdEQsT0FBTyxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsT0FBTyxLQUFLLElBQUk7SUFDdEQsT0FBTyxFQUFFLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDO0NBQ3pELENBQUMsQ0FBQztBQUVIOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMkJBQTJCLEdBQUcsQ0FDekMsV0FBMkMsRUFDZCxFQUFFO0lBQy9CLElBQUksQ0FBQyxhQUFhLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUMzRyxJQUFJLENBQUMscUJBQXFCLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBQ0QsT0FBTywwQkFBMEI7U0FDOUIsTUFBTSxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyx3QkFBd0IsQ0FBQyxZQUFZLENBQUMsQ0FBQyxXQUFXLENBQUMsQ0FBQztTQUM3RSxJQUFJLENBQUMsaUJBQWlCLENBQUMsQ0FBQztBQUM3QixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLENBQ2xELFdBQTJDLEVBQ25DLEVBQUU7SUFDVixJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsRUFBRSxZQUFZLEVBQUUsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1FBQ3BFLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxjQUFjLENBQUM7UUFDekQsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUM7SUFDeEQsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksT0FBTyxXQUFXLENBQUMsVUFBVSxLQUFLLFFBQVE7V0FDekUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7UUFDeEMsSUFBSSxDQUFDLHFCQUFxQixDQUFDLENBQUM7SUFDOUIsQ0FBQztJQUNELE9BQU8sK0JBQStCLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBQ3BHLENBQUMsQ0FBQztBQUVGLG1HQUFtRztBQUNuRyxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUMzQyxRQUFpQixFQUN3QixFQUFFLENBQzNDLG9CQUFvQixDQUFDLFFBQVEsRUFBRSwwQkFBMEIsQ0FBQyxDQUFDO0FBTzdEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLENBQUMsY0FBYyxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsV0FBVyxFQUFFLFVBQVU7SUFDeEcsYUFBYSxFQUFFLE9BQU8sQ0FBVSxDQUFDO0FBR25DOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sK0JBQStCLEdBQUcsQ0FBQyx1QkFBdUIsRUFBRSxzQkFBc0IsRUFBRSxTQUFTLENBQVUsQ0FBQztBQWlDckgsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FBQyxvQkFBb0IsRUFBRSxRQUFRLEVBQUUsZ0JBQWdCO0lBQ2pHLHFCQUFxQixFQUFFLFNBQVMsRUFBRSxtQkFBbUIsQ0FBc0UsQ0FBQztBQUU5SCx5R0FBeUc7QUFDekcsTUFBTSxvQkFBb0IsR0FBc0Q7SUFDOUUsb0JBQW9CLEVBQUUsU0FBUyxFQUFFLG1CQUFtQjtDQUNyRCxDQUFDO0FBeUJGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDckQsc0JBQXNCLEVBQUUsK0JBQStCO0lBQ3ZELHVCQUF1QixFQUFFLDJDQUEyQztJQUNwRSx3QkFBd0IsRUFBRSxFQUFFO0lBQzVCLFFBQVEsRUFBRSxXQUFXO0lBQ3JCLE9BQU8sRUFBRSx5Q0FBeUM7Q0FDMUMsQ0FBQyxDQUFDO0FBRVosTUFBTSxJQUFJLEdBQWtDLENBQUMsVUFBVSxFQUFFLEVBQUUsR0FBRyxNQUFNLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzdGLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUM3RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUNBQXFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ3ZGLHlGQUF5RjtBQUN6RixNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQWdCLEVBQVcsRUFBRSxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUUvRjs7Ozs7Ozs7OztHQVVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFO0lBQzFFLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9DLE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDNUMsT0FBTyxTQUFTLEdBQUcsQ0FBQyxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNuRSxDQUFDLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQy9DLENBQUMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLENBQUM7QUFDN0IsQ0FBQyxDQUFDO0FBQ0YsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDbEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztBQUNqRixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FDaEUsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLGNBQWMsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUUzRDs7Ozs7R0FLRztBQUNILE1BQU0sYUFBYSxHQUFHLENBQ3BCLFFBQWlCLEVBQ2pCLE9BQTBCLEVBQzFCLGtCQUFxQyxFQUFFLEVBQ0YsRUFBRTtJQUN2QyxJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3ZGLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDbEQsSUFBSSxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3ZFLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDdkMsT0FBTyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFO1FBQy9FLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDckUsT0FBTyxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7ZUFDOUYsVUFBVSxFQUFFLFVBQVUsS0FBSyxJQUFJLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDN0UsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQWtDLEVBQUUsQ0FDekUsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLENBQUM7T0FDN0MsQ0FBQyxRQUFRLENBQUMsSUFBSSxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQztPQUMzRCxZQUFZLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDL0QsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLFFBQWlCLEVBQTBDLEVBQUUsQ0FDekYsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLENBQUM7T0FDcEQsWUFBWSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsSUFBSSxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUN0RyxNQUFNLHFCQUFxQixHQUFHLENBQUMsUUFBaUIsRUFBMkMsRUFBRSxDQUMzRixhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsY0FBYyxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsQ0FBQztPQUM5RCxZQUFZLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7T0FDN0UsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztBQUUvQixnR0FBZ0c7QUFDaEcsTUFBTSxZQUFZLEdBQUcsQ0FBQyxjQUFjLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxVQUFVO0lBQzNFLFFBQVEsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBVSxDQUFDO0FBQ3RELDBGQUEwRjtBQUMxRixNQUFNLG9CQUFvQixHQUFHLENBQUMsY0FBYyxDQUFVLENBQUM7QUFDdkQsTUFBTSxxQkFBcUIsR0FBRyxpRUFBaUUsQ0FBQztBQUVoRyxNQUFNLGNBQWMsR0FBRztJQUNyQixZQUFZLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLGtCQUFrQjtJQUM1RCxjQUFjLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLEVBQUUsZUFBZSxFQUFFLFFBQVE7SUFDaEYsWUFBWSxFQUFFLFVBQVUsRUFBRSxhQUFhLEVBQUUsZUFBZSxFQUFFLFVBQVUsRUFBRSxRQUFRO0NBQ3RFLENBQUM7QUFFWCxNQUFNLGdCQUFnQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRTtJQUNqRSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxjQUFjLENBQUM7V0FDdkMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNsQyxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3JFLFFBQVEsQ0FBQyxhQUFhLEtBQUsscUJBQXFCO1dBQ2hELENBQUMsQ0FBQyxLQUFLLEVBQUUsZUFBZSxFQUFFLGlDQUFpQyxDQUFDLENBQUMsUUFBUSxDQUN0RSxRQUFRLENBQUMsV0FBcUIsQ0FDL0I7UUFBRSxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUMxRCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsY0FBYyxFQUFFLFdBQVcsRUFBRSxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ25HLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQUUsSUFBSSxDQUFDLHNCQUFzQixHQUFHLGlDQUFpQyxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUNELElBQUksQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztRQUFFLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQzNGLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDO1FBQUUsSUFBSSxDQUFDLG1EQUFtRCxDQUFDLENBQUM7SUFDdkcsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLGVBQWUsRUFBRSxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQzlDLElBQUksUUFBUSxDQUFDLEdBQUcsQ0FBQyxLQUFLLElBQUksSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7WUFBRSxJQUFJLENBQUMsNkJBQTZCLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFFBQVEsS0FBSyxJQUFJO1FBQ3hELENBQUMsQ0FBQyxDQUFDLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7ZUFDdEMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxZQUFZLEtBQUssUUFBUSxDQUFDLFlBQVk7ZUFDeEQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxVQUFVLEtBQU0sUUFBUSxDQUFDLFVBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDNUUsSUFBSSxDQUFDLDZEQUE2RCxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUM7SUFDbkMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxRQUFRLEVBQUUsWUFBWSxFQUFFLG9CQUFvQixDQUFDO1dBQzNELE9BQU8sUUFBUSxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFlBQVksQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUMvRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLGNBQWMsQ0FBQztlQUN0QyxDQUFDLE9BQU8sUUFBUSxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFlBQVksQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDLENBQUM7V0FDcEYsT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxHQUFHO1dBQzNFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDL0IsQ0FBQyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLFFBQWtCLENBQUM7V0FDckUsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ3RDLENBQUMsUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7V0FDdEUsQ0FBQyxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksSUFBSSxDQUFDLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztXQUN0RSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQztXQUNoQyxRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyx5QkFBeUIsQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO1FBQ2xGLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFDRCwrQkFBK0IsQ0FBQyxRQUFRLENBQUMsWUFBc0IsRUFDN0QsUUFBUSxDQUFDLFVBQW9CLEVBQUUsUUFBUSxDQUFDLFdBQTRCLENBQUMsQ0FBQztJQUN4RSwrRkFBK0Y7SUFDL0YsMkZBQTJGO0lBQzNGLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsY0FBYyxDQUFDLEVBQUUsQ0FBQztRQUM1QywrQkFBK0IsQ0FBQyxRQUFRLENBQUMsWUFBc0IsRUFDN0QsUUFBUSxDQUFDLFVBQW9CLEVBQUUsUUFBUSxDQUFDLFdBQTRCLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxVQUFVLEdBQUcsRUFBRSxDQUFDO0lBQ3BCLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBSSxRQUFRLENBQUMsT0FBcUIsQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQztRQUM1RSxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNwRixJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDO2VBQ2pELENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxJQUFJLFVBQVUsRUFBRSxDQUFDO1lBQ2xGLElBQUksQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO1FBQ2pGLENBQUM7UUFDRCxVQUFVLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7SUFDbkMsQ0FBQztJQUNELHNCQUFzQixDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN2QyxPQUFPLFFBQXlDLENBQUM7QUFDbkQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxhQUFhLEdBQUcsS0FBSyxFQUFFLFNBQWlCLEVBQUUsUUFBbUMsRUFBMEIsRUFBRTtJQUM3RyxNQUFNLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLE9BQU8sRUFBRSxHQUFHLFFBQVEsQ0FBQztJQUNqRCxPQUFPLFVBQVUsTUFBTSw0QkFBNEIsQ0FDakQsc0JBQXNCLENBQUMsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksQ0FDbkUsRUFBRSxDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUYsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsYUFBaUMsRUFDVCxFQUFFLENBQUMsYUFBYSxDQUN4Qyx5QkFBeUIsQ0FBQyxzQkFBc0IsRUFBRSxnQkFBZ0IsQ0FBQyxhQUFhLENBQUMsQ0FDbEYsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLEtBQUssRUFBRSxRQUFpQixFQUFxQixFQUFFO0lBQ3RGLElBQUksQ0FBQztRQUNILE1BQU0sVUFBVSxHQUFHLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3ZELE9BQU8sVUFBVSxDQUFDLE1BQU0sS0FBSyxNQUFNLDhCQUE4QixDQUFDLFVBQVUsQ0FBQztZQUMzRSxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUNqRixJQUFJLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxFQUFFLElBQUksQ0FBQyxDQUF1QixDQUFDO0FBRTdGLE1BQU0sQ0FBQyxNQUFNLDZCQUE2QixHQUFHLENBQzNDLGFBQWlDLEVBQ0osRUFBRSxDQUFDLENBQUM7SUFDakMsWUFBWSxFQUFFLGFBQWEsQ0FBQyxZQUFZO0lBQ3hDLFVBQVUsRUFBRSxhQUFhLENBQUMsVUFBVTtJQUNwQyxNQUFNLEVBQUUsYUFBYSxDQUFDLE1BQU07Q0FDN0IsQ0FBQyxDQUFDO0FBRUgsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFVLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLENBQUM7QUFDeEYsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLGFBQWlDLEVBQVUsRUFBRTtJQUNyRSxNQUFNLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEdBQUcsT0FBTyxFQUFFLEdBQUcsYUFBYSxDQUFDO0lBQ2hGLE9BQU8sU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBQzVCLENBQUMsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLEtBQUssRUFDNUMsV0FBK0IsRUFDL0IsV0FBc0MsRUFDdEMsZUFBd0MsRUFDSCxFQUFFO0lBQ3ZDLElBQUksQ0FBQztRQUNILFdBQVcsR0FBRyx5QkFBeUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNyRCxXQUFXLEdBQUcsV0FBVyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyx5QkFBeUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNuRixJQUFJLENBQUMsYUFBYSxDQUFDLGVBQWUsRUFBRSxDQUFDLFlBQVksRUFBRSxnQkFBZ0IsRUFBRSxRQUFRLEVBQUUsa0JBQWtCLENBQUMsQ0FBQztlQUM5RixDQUFDLFlBQVksQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO2VBQ3pDLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDO2VBQ3pGLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxnQkFBZ0IsQ0FBQztZQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUNyRyxlQUFlLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLENBQTRCLENBQUM7SUFDdEYsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0seUJBQXlCLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxNQUFNO1dBQ3BELENBQUMsV0FBVyxLQUFLLElBQUksSUFBSSxDQUFDLE1BQU0seUJBQXlCLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3JGLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsTUFBTSxZQUFZLEdBQUcsQ0FBQyxhQUFpQyxFQUFXLEVBQUUsQ0FDbEUsYUFBYSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEtBQUssZUFBZSxDQUFDLFVBQVUsQ0FBQyxJQUFJO1dBQzlELGFBQWEsQ0FBQyxVQUFVLENBQUMsRUFBRSxLQUFLLGVBQWUsQ0FBQyxVQUFVLENBQUMsRUFBRTtXQUM3RCxhQUFhLENBQUMsVUFBVSxDQUFDLEtBQUssS0FBSyxlQUFlLENBQUMsVUFBVSxDQUFDLEtBQUs7V0FDbkUsYUFBYSxDQUFDLGNBQWMsS0FBSyxlQUFlLENBQUMsY0FBYztXQUMvRCxhQUFhLENBQUMsTUFBTSxLQUFLLGVBQWUsQ0FBQyxNQUFNO1dBQy9DLGFBQWEsQ0FBQyxnQkFBZ0IsS0FBSyxlQUFlLENBQUMsZ0JBQWdCLENBQUM7SUFDekUsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFdBQVcsS0FBSyxJQUFJLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ3ZGLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO0lBQ3hELENBQUM7SUFDRCxJQUFJLFdBQVcsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUN6QixPQUFPLFdBQVcsQ0FBQyxVQUFVLEtBQUssQ0FBQztlQUM5QixXQUFXLENBQUMsV0FBVyxLQUFLLEtBQUs7WUFDcEMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFO1lBQy9DLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLHNCQUFzQixFQUFFLENBQUM7SUFDM0QsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLFlBQVksS0FBSyxXQUFXLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDMUQsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGtCQUFrQixFQUFFLENBQUM7SUFDMUQsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLFVBQVUsR0FBRyxXQUFXLENBQUMsVUFBVTtRQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztJQUNsRyxJQUFJLFdBQVcsQ0FBQyxVQUFVLEtBQUssV0FBVyxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ3RELE9BQU8sV0FBVyxDQUFDLE1BQU0sS0FBSyxXQUFXLENBQUMsTUFBTTtZQUM5QyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxLQUFLLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDOUYsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLHNCQUFzQixFQUFFLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEtBQUssZ0JBQWdCLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNwRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQWtEO1FBQzNELEdBQUcsRUFBRSxDQUFDLEVBQUUsZUFBZSxFQUFFLENBQUMsRUFBRSxpQ0FBaUMsRUFBRSxDQUFDO0tBQ2pFLENBQUM7SUFDRixJQUFJLEtBQUssQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLEtBQUssS0FBSyxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsd0JBQXdCLEVBQUUsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxDQUFDO0FBQ3ZELENBQUMsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLFVBQWtCLEVBQUUsVUFBa0IsRUFBc0IsRUFBRSxDQUN6RyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLElBQUksVUFBVSxJQUFJLFFBQVEsSUFBSSxVQUFVLENBQUM7QUFFckgsd0VBQXdFO0FBQ3hFLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBaUIsRUFBOEMsRUFBRTtJQUN2RixJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ3pGLFFBQVEsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3RCLEtBQUssb0JBQW9CO1lBQ3ZCLE9BQU8sYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUM7bUJBQ3pELDhCQUE4QixDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxLQUFLLFFBQVEsQ0FBQyxNQUFNLENBQUM7bUJBQ2pGLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2xELEtBQUssUUFBUTtZQUNYLE9BQU8sYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxVQUFVLENBQUMsQ0FBQzttQkFDL0MsQ0FBQyxRQUFRLENBQUMsUUFBUSxLQUFLLElBQUksSUFBSSxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ25GLEtBQUssZ0JBQWdCLENBQUM7UUFDdEIsS0FBSyxxQkFBcUI7WUFDeEIsT0FBTyxhQUFhLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMzQyxLQUFLLFNBQVM7WUFDWixPQUFPLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7bUJBQzdDLCtCQUErQixDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsU0FBUyxLQUFLLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMxRixLQUFLLG1CQUFtQjtZQUN0QixPQUFPLGFBQWEsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsVUFBVSxDQUFDLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNyRztZQUNFLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsUUFBaUIsRUFBaUMsRUFBRTtJQUM3RSxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsRUFBRSxDQUFDLFlBQVksRUFBRSxtQkFBbUI7UUFDN0QsVUFBVSxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsRUFBRSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1dBQ3pFLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUMzQyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEYsQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztXQUNyRSxPQUFPLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUztXQUNuQyxDQUFDLENBQUMsU0FBUyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQWUsQ0FBQyxFQUFFLENBQUM7UUFDM0csSUFBSSxDQUFDLCtDQUErQyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFO1FBQ2pFLFdBQVcsRUFBRSxhQUFhLEVBQUUsYUFBYTtLQUMxQyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztXQUN6RixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQUUsSUFBSSxDQUFDLG9DQUFvQyxDQUFDLENBQUM7SUFDMUYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxTQUFTLENBQUM7V0FDL0MsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQztXQUMzRCxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNqRSxJQUFJLENBQUMsaUVBQWlFLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUSxJQUFJLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7V0FDbEcsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN4RixJQUFJLENBQUMsNEVBQTRFLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3BCLE9BQU8sUUFBb0QsQ0FBQztBQUM5RCxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxLQUFLLEVBQzVELGNBQTZDLEVBQ3JCLEVBQUUsQ0FBQyxhQUFhLENBQ3hDLHlCQUF5QixDQUFDLHVCQUF1QixFQUFFLGlCQUFpQixDQUFDLGNBQWMsQ0FBQyxDQUNyRixDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLENBQ2xELFFBQWlCLEVBQ2MsRUFBRSxDQUNqQyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFrQyxDQUFDO0FBRXRGLHlGQUF5RjtBQUN6RixNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxLQUFLLEVBQ3ZELGNBQXVCLEVBQ3ZCLGFBQWlDLEVBQ2QsRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxNQUFNLFdBQVcsR0FBRyxvQ0FBb0MsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUN6RSxhQUFhLEdBQUcseUJBQXlCLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLE1BQU0seUJBQXlCLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxNQUFNO1lBQUUsT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDM0YsSUFBSSxTQUFTLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxhQUFhLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbEcsT0FBTyxDQUFDLHlEQUF5RCxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLE1BQU0sS0FBSyxNQUFNLHlDQUF5QyxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDeEYsT0FBTyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLEtBQUssSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLEtBQUssS0FBSztlQUN4RCxXQUFXLENBQUMsT0FBTyxFQUFFLFdBQVcsS0FBSyxhQUFhLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDOUUsT0FBTyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUNELE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFNRjs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsS0FBSyxFQUN2RCxXQUEwQyxFQUMxQyxXQUFpRCxFQUNqRCxhQUFpQyxFQUNqQywyQkFBbUMsRUFDRyxFQUFFO0lBQ3hDLElBQUksQ0FBQztRQUNILFdBQVcsR0FBRyxvQ0FBb0MsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNoRSxXQUFXLEdBQUcsV0FBVyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUN2QyxDQUFDLENBQUMsb0NBQW9DLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDdEQsYUFBYSxHQUFHLHlCQUF5QixDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQ3pELElBQUksQ0FBQyxZQUFZLENBQUMsMkJBQTJCLENBQUM7ZUFDekMsQ0FBQyxNQUFNLG9DQUFvQyxDQUFDLFdBQVcsRUFBRSxhQUFhLENBQUMsQ0FBQyxDQUFDLE1BQU07ZUFDL0UsQ0FBQyxXQUFXLEtBQUssSUFBSSxJQUFJLENBQzFCLFdBQVcsQ0FBQyxNQUFNLEtBQUssTUFBTSx5Q0FBeUMsQ0FBQyxXQUFXLENBQUM7bUJBQ2hGLFdBQVcsQ0FBQyxVQUFVLENBQUMsWUFBWSxLQUFLLGFBQWEsQ0FBQyxZQUFZO21CQUNsRSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLEtBQUssU0FBUyxDQUFDLDZCQUE2QixDQUFDLGFBQWEsQ0FBQyxDQUFDO3VCQUM1RixTQUFTLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLFNBQVMsQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FDOUUsQ0FBQztZQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUNyRCxJQUFJLFdBQVcsQ0FBQyxpQkFBaUIsS0FBSywyQkFBMkIsRUFBRSxDQUFDO1lBQ2xFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxrQkFBa0IsRUFBRSxDQUFDO1FBQzFELENBQUM7UUFDRCxJQUFJLFdBQVcsS0FBSyxJQUFJLElBQUksV0FBVyxDQUFDLFFBQVEsSUFBSSxXQUFXLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDekUsSUFBSSxXQUFXLENBQUMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxRQUFRO2dCQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUM5RixPQUFPLFdBQVcsQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLE1BQU07Z0JBQzlDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsV0FBVyxFQUFFLFdBQVcsRUFBRTtnQkFDaEQsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDL0MsQ0FBQztRQUNELElBQUksV0FBVyxDQUFDLFFBQVEsS0FBSyxDQUFDLFdBQVcsRUFBRSxRQUFRLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDOUQsT0FBTyxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLGNBQWMsRUFBRSxDQUFDO1FBQ3RELENBQUM7UUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLENBQUM7SUFDeEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0FBQ0gsQ0FBQyxDQUFDIn0=

package/dist_ts/data/serviceplatformownership.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Which authority writes a service's runtime network policy, decided by whether the service is
+ * platform-owned.
+ *
+ * A service of an idp.global organization is that organization's: its published ports are written
+ * only by a federated sign-in holding the organization's freshly introspected `owner` role, and an
+ * infrastructure administrator does not substitute for it. A platform-owned service belongs to no
+ * idp.global organization — the cluster ingress, a platform call router — so no organization owner
+ * exists who could authorize it. An infrastructure administrator designates such a service
+ * platform-owned, and from then on only a verified administrator reads and writes its published
+ * ports, as only an administrator writes its egress and its runtime spec. The designation names
+ * the authority and nothing else: it grants no port, egress or placement by itself.
+ *
+ * Only a service of a platform organization (`isPlatformOrganizationId`) is ever designated, so the
+ * federated owner rule stays the only rule for every other service, including any whose
+ * organization id is not a canonical identifier at all. Withdrawing the designation hands the
+ * ports back to the organization-owner rule, and a platform organization has no idp.global owner:
+ * the service's published ports then have no writer, and stay as they are, until an administrator
+ * designates it again.
+ */
+export interface IServicePlatformOwnership {
+    organizationId: string;
+    serviceId: string;
+    /** The administrator who designated the service. */
+    actorId: string;
+    /** Unix milliseconds on Cloudly's clock. */
+    designatedAt: number;
+}
+/**
+ * Every reason Cloudly answers instead of designating a service platform-owned or withdrawing the
+ * designation. Each travels by name as a `TypedResponseError`, and a refused request changes
+ * nothing.
+ */
+export declare const servicePlatformOwnershipRefusals: readonly ["service-unknown", "service-deleting", "organization-not-platform", "conflict"];
+/** One of the reasons Cloudly answers instead of a designation change. */
+export type TServicePlatformOwnershipRefusal = typeof servicePlatformOwnershipRefusals[number];
+export declare const servicePlatformOwnershipContract: Readonly<{
+    readonly error: "Service platform ownership contract rejected.";
+}>;
+/**
+ * Whether an organization id names a platform organization, the only kind whose service an
+ * administrator may designate platform-owned.
+ *
+ * Every organization Cloudly assigns outside idp.global is namespaced with `:` — a legacy service's
+ * own `legacy:Service:<id>`, a platform `Organization:<id>` — while idp.global names an
+ * organization by a 21-character nanoid in the URL alphabet (`A-Za-z0-9_-`), which never carries
+ * `:`. An id is a platform organization's exactly when it is a canonical identifier (an ASCII
+ * letter or digit, then up to 199 of letters, digits, `:`, `.`, `_` and `-`) and carries `:`.
+ * Everything else is not: an idp.global id, whichever character it starts with, and any value that
+ * is not a canonical identifier — empty, whitespace, a non-string. The answer fails closed: an id
+ * this rule cannot read never gains administrator authority.
+ */
+export declare const isPlatformOrganizationId: (organizationId: string) => boolean;
+/** Detached exact-schema snapshot of a stored or answered designation. */
+export declare const snapshotServicePlatformOwnership: (value: unknown) => IServicePlatformOwnership;

package/dist_ts/data/serviceplatformownership.js

@@ -0,0 +1,62 @@
+import { captureNetwork, networkCounter, networkId, networkRecord, requireNetwork } from '../private/networkcontract.js';
+/**
+ * Every reason Cloudly answers instead of designating a service platform-owned or withdrawing the
+ * designation. Each travels by name as a `TypedResponseError`, and a refused request changes
+ * nothing.
+ */
+export const servicePlatformOwnershipRefusals = Object.freeze([
+    /** No service of that id belongs to the named organization. */
+    'service-unknown',
+    /** The service's deletion has begun; no new authority outlives it. */
+    'service-deleting',
+    /**
+     * The named organization is not a platform organization (`isPlatformOrganizationId`): an
+     * idp.global organization, whose owner keeps the authority over its runtime network policy, or an
+     * id that is no canonical identifier.
+     */
+    'organization-not-platform',
+    /** Another write changed the service's designation first: read it again. */
+    'conflict',
+]);
+export const servicePlatformOwnershipContract = Object.freeze({
+    error: 'Service platform ownership contract rejected.',
+});
+/**
+ * Whether an organization id names a platform organization, the only kind whose service an
+ * administrator may designate platform-owned.
+ *
+ * Every organization Cloudly assigns outside idp.global is namespaced with `:` — a legacy service's
+ * own `legacy:Service:<id>`, a platform `Organization:<id>` — while idp.global names an
+ * organization by a 21-character nanoid in the URL alphabet (`A-Za-z0-9_-`), which never carries
+ * `:`. An id is a platform organization's exactly when it is a canonical identifier (an ASCII
+ * letter or digit, then up to 199 of letters, digits, `:`, `.`, `_` and `-`) and carries `:`.
+ * Everything else is not: an idp.global id, whichever character it starts with, and any value that
+ * is not a canonical identifier — empty, whitespace, a non-string. The answer fails closed: an id
+ * this rule cannot read never gains administrator authority.
+ */
+export const isPlatformOrganizationId = (organizationId) => {
+    try {
+        return networkId(organizationId).includes(':');
+    }
+    catch {
+        return false;
+    }
+};
+/** Detached exact-schema snapshot of a stored or answered designation. */
+export const snapshotServicePlatformOwnership = (value) => {
+    try {
+        const item = networkRecord(captureNetwork(value), ['organizationId', 'serviceId', 'actorId', 'designatedAt']);
+        const organizationId = networkId(item.organizationId);
+        requireNetwork(isPlatformOrganizationId(organizationId));
+        return {
+            organizationId,
+            serviceId: networkId(item.serviceId),
+            actorId: networkId(item.actorId),
+            designatedAt: networkCounter(item.designatedAt),
+        };
+    }
+    catch {
+        throw new Error(servicePlatformOwnershipContract.error);
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXBsYXRmb3Jtb3duZXJzaGlwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9zZXJ2aWNlcGxhdGZvcm1vd25lcnNoaXAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGNBQWMsRUFBRSxjQUFjLEVBQUUsU0FBUyxFQUFFLGFBQWEsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQStCekg7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDNUQsK0RBQStEO0lBQy9ELGlCQUFpQjtJQUNqQixzRUFBc0U7SUFDdEUsa0JBQWtCO0lBQ2xCOzs7O09BSUc7SUFDSCwyQkFBMkI7SUFDM0IsNEVBQTRFO0lBQzVFLFVBQVU7Q0FDRixDQUFDLENBQUM7QUFLWixNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzVELEtBQUssRUFBRSwrQ0FBK0M7Q0FDOUMsQ0FBQyxDQUFDO0FBRVo7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxjQUFzQixFQUFXLEVBQUU7SUFDMUUsSUFBSSxDQUFDO1FBQ0gsT0FBTyxTQUFTLENBQUMsY0FBYyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRiwwRUFBMEU7QUFDMUUsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FBQyxLQUFjLEVBQTZCLEVBQUU7SUFDNUYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLGdCQUFnQixFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztRQUM5RyxNQUFNLGNBQWMsR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ3RELGNBQWMsQ0FBQyx3QkFBd0IsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDO1FBQ3pELE9BQU87WUFDTCxjQUFjO1lBQ2QsU0FBUyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3BDLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztZQUNoQyxZQUFZLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7U0FDaEQsQ0FBQztJQUNKLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzFELENBQUM7QUFDSCxDQUFDLENBQUMifQ==

package/dist_ts/data/serviceruntime.d.ts

@@ -73,7 +73,7 @@ export declare const serviceRuntimeContract: Readonly<{
     readonly maximumAssignmentPageSize: 256;
 }>;
 declare const serviceRuntimeWaitingReasons: readonly ["node-network-pending", "conflict", "failure-backoff", "storage-import-pending", "bindings-pending", "legacy-adoption-pending", "objectstorage-retention-pending"];
-declare const serviceRuntimeRefusals: readonly ["cluster-runtime-missing", "organization-missing", "image-plan-missing", "platform-unsupported", "secrets-unsupported", "volumes-unsupported", "port-protocol-unsupported", "ports-too-many", "readiness-target-undeclared", "environment-too-large", "no-eligible-node", "replica-limit", "node-authority-unsupported", "network-policy-missing", "network-policy-mismatch", "network-workload-pool-missing", "network-workload-pool-exhausted", "volume-driver-unsupported", "volume-options-unsupported", "volume-shared-unsupported", "volume-placement-unsupported", "volume-initialization-unknown", "volume-ownership-unknown", "objectstorage-endpoint-missing", "objectstorage-binding-invalid", "objectstorage-environment-conflict", "objectstorage-endpoint-unselected", "database-endpoint-missing", "database-endpoint-unselected", "published-port-reserved", "published-port-symmetric-without-egress"];
+declare const serviceRuntimeRefusals: readonly ["cluster-runtime-missing", "organization-missing", "image-plan-missing", "platform-unsupported", "secrets-unsupported", "volumes-unsupported", "port-protocol-unsupported", "ports-too-many", "readiness-target-undeclared", "environment-too-large", "no-eligible-node", "replica-limit", "node-authority-unsupported", "network-policy-missing", "network-policy-mismatch", "network-workload-pool-missing", "network-workload-pool-exhausted", "volume-driver-unsupported", "volume-options-unsupported", "volume-shared-unsupported", "volume-placement-unsupported", "volume-initialization-unknown", "volume-ownership-unknown", "objectstorage-endpoint-missing", "objectstorage-binding-invalid", "objectstorage-environment-conflict", "objectstorage-endpoint-unselected", "database-endpoint-missing", "database-endpoint-unselected", "published-port-reserved", "published-port-symmetric-without-egress", "readiness-network-unsupported"];
 /**
  * Why the producer is not converging yet, though nothing needs an administrator:
  * `node-network-pending` waits for a node's network readiness, `conflict` for a sweep over inputs
@@ -137,6 +137,13 @@ export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[n
  * which the handoff leases' `runtimeNetworkHandoffSnatPortRange` owns; a document written before
  * that rule can hold one. `published-port-symmetric-without-egress` is a `symmetric` entry in a
  * document whose `publicEgress` is false, which a projection endpoint refuses.
+ *
+ * `readiness-network-unsupported` is a spec whose network is `isolated` and whose readiness probe is
+ * `tcp` or `http`: an isolated workload has no address its node can dial, so the probe could never
+ * pass and the node refuses the run (`TRuntimeAssignmentFailureCause` `refused` for
+ * `unsupported-readiness`). `isServiceRuntimeReadinessReachable` is this rule; a producer answers
+ * what it returns. The spec snapshot still reads such a spec, so a stored one stays readable and
+ * is answered with this refusal rather than refused as data.
  */
 export type TServiceRuntimeRefusal = typeof serviceRuntimeRefusals[number];
 interface IServiceRuntimeStatusBase {
@@ -164,6 +171,32 @@ export type IServiceRuntimeStatus = IServiceRuntimeStatusBase & ({
  * node admitted but has not yet reported on reads as undelivered.
  */
 export type TServiceRuntimeAssignmentDelivery = 'undelivered' | 'delivered';
+/**
+ * Why one dispatch of an assignment revision to its node ended as it did.
+ *
+ * The node holds the revision: `accepted`, `replay` or `historical` is what the node answered to
+ * the push, and `acknowledged` a revision the node's current session acknowledged before, answered
+ * from that acknowledgement without pushing it again.
+ *
+ * The node does not hold it from this dispatch: `node-busy` while the node already carries its limit
+ * of pushes in flight, `node-not-connected` while no live peer holds a session for the node,
+ * `session-moved` when the session the dispatch began on is no longer the node's current one,
+ * `intent-not-current` when the revision is no longer the one the controller wants on that node,
+ * `request-unbound` when the request does not bind to the session it would travel on,
+ * `node-refused` when the node (or the relay carrying it) answered the push with a refusal,
+ * `push-failed` when the push got no answer in time or its carrier failed, and
+ * `acknowledgement-unbound` when the answer names another revision.
+ */
+export declare const assignmentDispatchReasons: readonly ["accepted", "replay", "historical", "acknowledged", "node-busy", "node-not-connected", "session-moved", "intent-not-current", "request-unbound", "node-refused", "push-failed", "acknowledgement-unbound"];
+export type TAssignmentDispatchReason = typeof assignmentDispatchReasons[number];
+/** The last dispatch of a slot's current assignment, as the controller recorded it. Value-free. */
+export interface IServiceRuntimeAssignmentDispatch {
+    /** Whether the node holds the revision after this dispatch. */
+    delivered: boolean;
+    reason: TAssignmentDispatchReason;
+    /** Unix milliseconds on the controller's clock when this dispatch ended. */
+    at: number;
+}
 /** One replica slot's current assignment, as an administrator reads it. */
 export interface IServiceRuntimeAssignmentView {
     serviceId: string;
@@ -180,12 +213,27 @@ export interface IServiceRuntimeAssignmentView {
     /** Joined stop and remove receipts of this attempt. */
     terminalReceiptCount: 0 | 1 | 2;
     delivery: TServiceRuntimeAssignmentDelivery;
+    /**
+     * The last dispatch of the current revision while the controller still remembers one, null when
+     * it remembers none. Absent from a controller that does not report dispatches. Dispatch is the
+     * controller's push; `delivery` stays the node's own evidence.
+     */
+    dispatch?: IServiceRuntimeAssignmentDispatch | null;
 }
 /**
  * Structural snapshot for exact persistence and for a spec write. Whether the cluster, the nodes and
  * the platform endpoints exist, and whether the service declares the readiness target, is Cloudly's.
  */
 export declare const snapshotServiceRuntimeSpec: (value: unknown) => IServiceRuntimeSpec;
+/**
+ * Whether a spec's readiness probe can reach its workload: false exactly for an `isolated` network
+ * with a `tcp` or `http` probe, which the producer answers as `readiness-network-unsupported`. The
+ * spec is read through `snapshotServiceRuntimeSpec`, so a value that is no spec is refused with its
+ * rejection rather than judged.
+ */
+export declare const isServiceRuntimeReadinessReachable: (value: unknown) => boolean;
+/** Exactly a recorded dispatch of an assignment: a known reason and a positive Unix millisecond time. */
+export declare const isServiceRuntimeAssignmentDispatch: (value: unknown) => value is IServiceRuntimeAssignmentDispatch;
 /** Structural snapshot for exact persistence: a reason belongs to exactly one state. */
 export declare const snapshotServiceRuntimeStatus: (value: unknown) => IServiceRuntimeStatus;
 export {};

package/dist_ts/data/serviceruntime.js

@@ -28,7 +28,28 @@ const serviceRuntimeRefusals = [
     'volume-placement-unsupported', 'volume-initialization-unknown', 'volume-ownership-unknown',
     'objectstorage-endpoint-missing', 'objectstorage-binding-invalid', 'objectstorage-environment-conflict',
     'objectstorage-endpoint-unselected', 'database-endpoint-missing', 'database-endpoint-unselected',
-    'published-port-reserved', 'published-port-symmetric-without-egress',
+    'published-port-reserved', 'published-port-symmetric-without-egress', 'readiness-network-unsupported',
+];
+/**
+ * Why one dispatch of an assignment revision to its node ended as it did.
+ *
+ * The node holds the revision: `accepted`, `replay` or `historical` is what the node answered to
+ * the push, and `acknowledged` a revision the node's current session acknowledged before, answered
+ * from that acknowledgement without pushing it again.
+ *
+ * The node does not hold it from this dispatch: `node-busy` while the node already carries its limit
+ * of pushes in flight, `node-not-connected` while no live peer holds a session for the node,
+ * `session-moved` when the session the dispatch began on is no longer the node's current one,
+ * `intent-not-current` when the revision is no longer the one the controller wants on that node,
+ * `request-unbound` when the request does not bind to the session it would travel on,
+ * `node-refused` when the node (or the relay carrying it) answered the push with a refusal,
+ * `push-failed` when the push got no answer in time or its carrier failed, and
+ * `acknowledgement-unbound` when the answer names another revision.
+ */
+export const assignmentDispatchReasons = [
+    'accepted', 'replay', 'historical', 'acknowledged',
+    'node-busy', 'node-not-connected', 'session-moved', 'intent-not-current', 'request-unbound', 'node-refused',
+    'push-failed', 'acknowledgement-unbound',
 ];
 /** Sorted, duplicate-free and read by the vocabulary the ids belong to: a node's, or the canonical one. */
 const sortedIds = (value, maximum, read) => networkSorted(networkList(value, maximum, read), id => id);
@@ -86,6 +107,27 @@ export const snapshotServiceRuntimeSpec = (value) => producerSafe(() => {
         placement: placementOf(item.placement), replicasPerNode: item.replicasPerNode, hold: item.hold,
         profile: profileOf(item.profile), network: networkOf(item.network), revision: networkCounter(item.revision) };
 });
+/**
+ * Whether a spec's readiness probe can reach its workload: false exactly for an `isolated` network
+ * with a `tcp` or `http` probe, which the producer answers as `readiness-network-unsupported`. The
+ * spec is read through `snapshotServiceRuntimeSpec`, so a value that is no spec is refused with its
+ * rejection rather than judged.
+ */
+export const isServiceRuntimeReadinessReachable = (value) => {
+    const { profile, network } = snapshotServiceRuntimeSpec(value);
+    return network.mode === 'attached' || profile.readiness.kind === 'process';
+};
+/** Exactly a recorded dispatch of an assignment: a known reason and a positive Unix millisecond time. */
+export const isServiceRuntimeAssignmentDispatch = (value) => {
+    try {
+        const item = networkRecord(captureNetwork(value), ['delivered', 'reason', 'at']);
+        networkCounter(item.at);
+        return typeof item.delivered === 'boolean' && isOneOf(assignmentDispatchReasons, item.reason);
+    }
+    catch {
+        return false;
+    }
+};
 /** Structural snapshot for exact persistence: a reason belongs to exactly one state. */
 export const snapshotServiceRuntimeStatus = (value) => producerSafe(() => {
     const item = networkRecord(captureNetwork(value), ['id', 'specRevision', 'state', 'reason', 'changedAt']);
@@ -102,4 +144,4 @@ export const snapshotServiceRuntimeStatus = (value) => producerSafe(() => {
     requireNetwork(item.state === 'refused' && isOneOf(serviceRuntimeRefusals, item.reason));
     return { ...base, state: item.state, reason: item.reason };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF5RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRztJQUNuQyxzQkFBc0IsRUFBRSxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsd0JBQXdCLEVBQUUsa0JBQWtCO0lBQ25HLHlCQUF5QixFQUFFLGlDQUFpQztDQUNwRCxDQUFDO0FBQ1gsTUFBTSxzQkFBc0IsR0FBRztJQUM3Qix5QkFBeUIsRUFBRSxzQkFBc0IsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0I7SUFDL0YscUJBQXFCLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsZ0JBQWdCO0lBQzNGLDZCQUE2QixFQUFFLHVCQUF1QixFQUFFLGtCQUFrQixFQUFFLGVBQWU7SUFDM0YsNEJBQTRCLEVBQUUsd0JBQXdCLEVBQUUseUJBQXlCO0lBQ2pGLCtCQUErQixFQUFFLGlDQUFpQztJQUNsRSwyQkFBMkIsRUFBRSw0QkFBNEIsRUFBRSwyQkFBMkI7SUFDdEYsOEJBQThCLEVBQUUsK0JBQStCLEVBQUUsMEJBQTBCO0lBQzNGLGdDQUFnQyxFQUFFLCtCQUErQixFQUFFLG9DQUFvQztJQUN2RyxtQ0FBbUMsRUFBRSwyQkFBMkIsRUFBRSw4QkFBOEI7SUFDaEcseUJBQXlCLEVBQUUseUNBQXlDO0NBQzVELENBQUM7QUE4R1gsMkdBQTJHO0FBQzNHLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFFLE9BQWUsRUFBRSxJQUErQixFQUFZLEVBQUUsQ0FDL0YsYUFBYSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7QUFFN0QsTUFBTSxXQUFXLEdBQUcsQ0FBQyxLQUFjLEVBQTRCLEVBQUU7SUFDL0QsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0QyxJQUFJLElBQUksS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUMxQixhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLEtBQUssT0FBTyxDQUFDLENBQUM7SUFDakMsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxPQUFPLEVBQUUsc0JBQXNCLENBQUMsa0JBQWtCLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDdkksY0FBYyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbkMsT0FBTyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUMzQixDQUFDLENBQUM7QUFFRixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRTtJQUNsRSxJQUFJLEtBQUssS0FBSyxJQUFJO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDaEMsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3JELGNBQWMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksdUJBQXVCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUYsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUU7SUFDM0QsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLFdBQVcsRUFBRSxhQUFhLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ2hILGNBQWMsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksb0JBQW9CLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQztXQUN0RixrQkFBa0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksT0FBTyxJQUFJLENBQUMsY0FBYyxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ2hGLDRHQUE0RztJQUM1RyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLENBQUMsQ0FBQztJQUNqRSxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQztJQUMxRSxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLEVBQUUsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXO1FBQy9ELFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBNEI7UUFDbEYsSUFBSSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLEVBQUUsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUNySSxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBMEIsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3hCLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9CLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksS0FBSyxVQUFVLENBQUMsQ0FBQztJQUNwQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLGNBQWMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7SUFDbkYsY0FBYyxDQUFDLE9BQU8sSUFBSSxDQUFDLFlBQVksS0FBSyxTQUFTLENBQUMsQ0FBQztJQUN2RCxPQUFPLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtRQUM1QyxtQkFBbUIsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLHNCQUFzQixDQUFDLHdCQUF3QixFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDM0gsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxLQUFjLEVBQXVCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ25HLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFdBQVc7UUFDakcsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNoRSxjQUFjLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDLEVBQUUsc0JBQXNCLENBQUMsc0JBQXNCLENBQUM7V0FDbEcsT0FBTyxJQUFJLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3JDLE9BQU8sRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxjQUFjLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDbkgsU0FBUyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsZUFBZSxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQzlGLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFFBQVEsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7QUFDbEgsQ0FBQyxDQUFDLENBQUM7QUFFSCx3RkFBd0Y7QUFDeEYsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxLQUFjLEVBQXlCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ3ZHLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsY0FBYyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMxRyxNQUFNLElBQUksR0FBOEIsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxZQUFZLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7UUFDL0csU0FBUyxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM5QyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssV0FBVyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDOUQsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDckMsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzdCLGNBQWMsQ0FBQyxPQUFPLENBQUMsNEJBQTRCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDbkUsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDN0QsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDekYsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDN0QsQ0FBQyxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF5RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRztJQUNuQyxzQkFBc0IsRUFBRSxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsd0JBQXdCLEVBQUUsa0JBQWtCO0lBQ25HLHlCQUF5QixFQUFFLGlDQUFpQztDQUNwRCxDQUFDO0FBQ1gsTUFBTSxzQkFBc0IsR0FBRztJQUM3Qix5QkFBeUIsRUFBRSxzQkFBc0IsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0I7SUFDL0YscUJBQXFCLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsZ0JBQWdCO0lBQzNGLDZCQUE2QixFQUFFLHVCQUF1QixFQUFFLGtCQUFrQixFQUFFLGVBQWU7SUFDM0YsNEJBQTRCLEVBQUUsd0JBQXdCLEVBQUUseUJBQXlCO0lBQ2pGLCtCQUErQixFQUFFLGlDQUFpQztJQUNsRSwyQkFBMkIsRUFBRSw0QkFBNEIsRUFBRSwyQkFBMkI7SUFDdEYsOEJBQThCLEVBQUUsK0JBQStCLEVBQUUsMEJBQTBCO0lBQzNGLGdDQUFnQyxFQUFFLCtCQUErQixFQUFFLG9DQUFvQztJQUN2RyxtQ0FBbUMsRUFBRSwyQkFBMkIsRUFBRSw4QkFBOEI7SUFDaEcseUJBQXlCLEVBQUUseUNBQXlDLEVBQUUsK0JBQStCO0NBQzdGLENBQUM7QUFtR1g7Ozs7Ozs7Ozs7Ozs7OztHQWVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUc7SUFDdkMsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsY0FBYztJQUNsRCxXQUFXLEVBQUUsb0JBQW9CLEVBQUUsZUFBZSxFQUFFLG9CQUFvQixFQUFFLGlCQUFpQixFQUFFLGNBQWM7SUFDM0csYUFBYSxFQUFFLHlCQUF5QjtDQUNoQyxDQUFDO0FBb0NYLDJHQUEyRztBQUMzRyxNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBRSxPQUFlLEVBQUUsSUFBK0IsRUFBWSxFQUFFLENBQy9GLGFBQWEsQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUMsRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0FBRTdELE1BQU0sV0FBVyxHQUFHLENBQUMsS0FBYyxFQUE0QixFQUFFO0lBQy9ELE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdEMsSUFBSSxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDMUIsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDL0IsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxDQUFDO0lBQ2pDLE1BQU0sT0FBTyxHQUFHLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsT0FBTyxFQUFFLHNCQUFzQixDQUFDLGtCQUFrQixFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQ3ZJLGNBQWMsQ0FBQyxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDO0lBQ25DLE9BQU8sRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUM7QUFDM0IsQ0FBQyxDQUFDO0FBRUYsTUFBTSxPQUFPLEdBQUcsQ0FBQyxLQUFjLEVBQW1DLEVBQUU7SUFDbEUsSUFBSSxLQUFLLEtBQUssSUFBSTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ2hDLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNyRCxjQUFjLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLHVCQUF1QixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzFGLE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO0FBQ2hELENBQUMsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUEwQixFQUFFO0lBQzNELE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxXQUFXLEVBQUUsYUFBYSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNoSCxjQUFjLENBQUMsa0JBQWtCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLG9CQUFvQixDQUFDLElBQUksQ0FBQyxXQUFXLENBQUM7V0FDdEYsa0JBQWtCLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLE9BQU8sSUFBSSxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNoRiw0R0FBNEc7SUFDNUcsc0JBQXNCLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDakUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLG9CQUFvQixFQUFFLFdBQVcsRUFBRSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUM7SUFDMUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUyxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztRQUMvRCxTQUFTLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQTRCO1FBQ2xGLElBQUksRUFBRSxFQUFFLGdCQUFnQixFQUFFLG9CQUFvQixFQUFFLFdBQVcsRUFBRSxFQUFFLGNBQWMsRUFBRSxJQUFJLENBQUMsY0FBYyxFQUFFLEtBQUssRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7QUFDckksQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUU7SUFDM0QsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0QyxJQUFJLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztRQUN4QixhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLEtBQUssVUFBVSxDQUFDLENBQUM7SUFDcEMsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxjQUFjLEVBQUUscUJBQXFCLENBQUMsQ0FBQyxDQUFDO0lBQ25GLGNBQWMsQ0FBQyxPQUFPLElBQUksQ0FBQyxZQUFZLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDdkQsT0FBTyxFQUFFLElBQUksRUFBRSxZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7UUFDNUMsbUJBQW1CLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxzQkFBc0IsQ0FBQyx3QkFBd0IsRUFBRSxTQUFTLENBQUMsRUFBRSxDQUFDO0FBQzNILENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLENBQUMsS0FBYyxFQUF1QixFQUFFLENBQUMsWUFBWSxDQUFDLEdBQUcsRUFBRTtJQUNuRyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLGdCQUFnQixFQUFFLFdBQVcsRUFBRSxXQUFXO1FBQ2pHLGlCQUFpQixFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7SUFDaEUsY0FBYyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQyxFQUFFLHNCQUFzQixDQUFDLHNCQUFzQixDQUFDO1dBQ2xHLE9BQU8sSUFBSSxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsQ0FBQztJQUNyQyxPQUFPLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsY0FBYyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLEVBQUUsU0FBUyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ25ILFNBQVMsRUFBRSxXQUFXLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLGVBQWUsRUFBRSxJQUFJLENBQUMsZUFBZSxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSTtRQUM5RixPQUFPLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO0FBQ2xILENBQUMsQ0FBQyxDQUFDO0FBRUg7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLEtBQWMsRUFBVyxFQUFFO0lBQzVFLE1BQU0sRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEdBQUcsMEJBQTBCLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDL0QsT0FBTyxPQUFPLENBQUMsSUFBSSxLQUFLLFVBQVUsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUM7QUFDN0UsQ0FBQyxDQUFDO0FBRUYseUdBQXlHO0FBQ3pHLE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQUMsS0FBYyxFQUE4QyxFQUFFO0lBQy9HLElBQUksQ0FBQztRQUNILE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxXQUFXLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDakYsY0FBYyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4QixPQUFPLE9BQU8sSUFBSSxDQUFDLFNBQVMsS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLHlCQUF5QixFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNoRyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsd0ZBQXdGO0FBQ3hGLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsS0FBYyxFQUF5QixFQUFFLENBQUMsWUFBWSxDQUFDLEdBQUcsRUFBRTtJQUN2RyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLGNBQWMsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDMUcsTUFBTSxJQUFJLEdBQThCLEVBQUUsRUFBRSxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsWUFBWSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQy9HLFNBQVMsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7SUFDOUMsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFdBQVcsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQzlELGNBQWMsQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDO1FBQ3JDLE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDdEQsQ0FBQztJQUNELElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM3QixjQUFjLENBQUMsT0FBTyxDQUFDLDRCQUE0QixFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQ25FLE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQzdELENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxDQUFDLEtBQUssS0FBSyxTQUFTLElBQUksT0FBTyxDQUFDLHNCQUFzQixFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQ3pGLE9BQU8sRUFBRSxHQUFHLElBQUksRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO0FBQzdELENBQUMsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/network.d.ts

@@ -4,6 +4,7 @@ import type { IRuntimeNetworkAddressPlan, TRuntimeNetworkAddressPlanWritableData
 import type { IRuntimeNetworkNodeReadiness, IRuntimeRouterIncarnation } from '../data/networknode.js';
 import type { IPrivateNetwork, IServicePrivateNetworks, ISetServicePrivateNetworks, TPrivateNetworkMutation } from '../data/privatenetwork.js';
 import type { IServiceNetworkEgress, IServicePublishedPorts, ISetServiceNetworkEgress, ISetServicePublishedPorts } from '../data/networkprojection.js';
+import type { IServicePlatformOwnership } from '../data/serviceplatformownership.js';
 /** Current organization picker data. Entries are never cached authorization grants. */
 export interface IReq_Cloudly_ListOwnedOrganizations extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListOwnedOrganizations> {
     method: 'listOwnedOrganizations';
@@ -97,7 +98,14 @@ export interface IReq_Cloudly_SetServicePrivateNetworks extends plugins.typedreq
         replayed: boolean;
     };
 }
-/** null means the service has never had a policy document, neither published ports nor egress. */
+/**
+ * null means the service has never had a policy document, neither published ports nor egress.
+ *
+ * The authority follows the service (`IServicePlatformOwnership`): a platform-owned service is read
+ * by a verified administrator, every other service by a federated sign-in holding the named
+ * organization's freshly introspected `owner` role. A caller without that authority, or naming no
+ * such service, is answered one denial text, whichever it is.
+ */
 export interface IReq_Cloudly_GetServicePublishedPorts extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_GetServicePublishedPorts> {
     method: 'getServicePublishedPorts';
     request: {
@@ -119,6 +127,15 @@ export interface IReq_Cloudly_GetServicePublishedPorts extends plugins.typedrequ
  * attached spec stating `publicEgress: false` and `platformEndpointIds: []` matches it and reaches
  * no public address and no platform endpoint; `network-policy-missing` means the service has no
  * document at all.
+ *
+ * The authority follows the service (`IServicePlatformOwnership`): a platform-owned service is
+ * written by a verified administrator, every other service by a federated sign-in holding the named
+ * organization's freshly introspected `owner` role, and an administrator does not substitute for
+ * that owner. A caller without that authority, or naming no such service, is answered one denial
+ * text, whichever it is. A designation that changes while the write is staged refuses it as the
+ * policy write's own `conflict`, the refusal a stale `expectedRevision` is also answered (read the
+ * document and the authority again); it is a service network policy refusal, not one of
+ * `servicePlatformOwnershipRefusals`.
  */
 export interface IReq_Cloudly_SetServicePublishedPorts extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_SetServicePublishedPorts> {
     method: 'setServicePublishedPorts';
@@ -183,6 +200,64 @@ export interface IReq_Admin_Cloudly_SetServiceNetworkEgress extends plugins.type
         replayed: boolean;
     };
 }
+/**
+ * Designates one service platform-owned (`IServicePlatformOwnership`), so that a verified
+ * administrator, and no organization owner, holds the authority over its published ports.
+ *
+ * Only a verified administrator calls it. Cloudly designates only a service of a platform
+ * organization (`isPlatformOrganizationId`: a canonical identifier carrying `:`, such as
+ * `legacy:Service:<id>` or `Organization:<id>`) and refuses every other organization id, an
+ * idp.global one or one that is no canonical identifier, as `organization-not-platform` before it
+ * reads the service. It refuses a service that is not the named organization's (`service-unknown`)
+ * and a deleting one (`service-deleting`); refusals are `servicePlatformOwnershipRefusals`. A
+ * service already designated answers its stored designation unchanged with `changed: false`.
+ */
+export interface IReq_Admin_Cloudly_DesignatePlatformOwnedService extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_DesignatePlatformOwnedService> {
+    method: 'designatePlatformOwnedService';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: IServicePlatformOwnership;
+        changed: boolean;
+    };
+}
+/**
+ * Withdraws a service's platform-owned designation; its published ports stay as they are, and from
+ * then on the organization-owner rule governs them. A designated service is always a platform
+ * organization's, which has no idp.global owner, so after the withdrawal nobody writes or reads its
+ * published ports until an administrator designates it again: the authority fails closed.
+ *
+ * Only a verified administrator calls it. Refusals are `service-unknown` and `conflict`; a service
+ * without a designation answers `changed: false`.
+ */
+export interface IReq_Admin_Cloudly_UndesignatePlatformOwnedService extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_UndesignatePlatformOwnedService> {
+    method: 'undesignatePlatformOwnedService';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: null;
+        changed: boolean;
+    };
+}
+/** The service's platform-owned designation, or null when it has none. Only a verified administrator reads it. */
+export interface IReq_Admin_Cloudly_GetServicePlatformOwnership extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_GetServicePlatformOwnership> {
+    method: 'getServicePlatformOwnership';
+    /** Refused `service-unknown` when no service of that id belongs to the named organization. */
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: IServicePlatformOwnership | null;
+    };
+}
 export interface IRequest_Any_Cloudly_GetNetworkNodes {
     method: 'getNetworkNodes';
     request: {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.44.0",
+  "version": "32.45.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -28,10 +28,10 @@
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^5.1.2",
-    "@git.zone/tsdoc": "^3.0.1",
+    "@git.zone/tsdoc": "^3.0.2",
     "@git.zone/tsrun": "^3.0.2",
-    "@git.zone/tstest": "6.3.4",
-    "@types/node": "26.6.2"
+    "@git.zone/tstest": "^7.1.0",
+    "@types/node": "26.6.3"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -515,6 +515,34 @@ list is a valid policy meaning the service publishes nothing. Callers never supp
 from the accepted policy revision and digest, and node-level host-port placement
 stays Cloudly's decision.
 
+Who authors a service's published ports follows the service. A service of an
+idp.global organization is that organization's: only a federated sign-in holding
+its freshly introspected `owner` role reads and writes them, and an
+infrastructure administrator does not substitute for it. A platform-owned
+service (`data.IServicePlatformOwnership`: `organizationId`, `serviceId`, the
+designating administrator's `actorId`, `designatedAt`) belongs to no idp.global
+organization, such as the cluster ingress or a platform call router; only a
+verified administrator reads and writes its published ports, as only an
+administrator writes its egress. An administrator designates such a service
+with `designatePlatformOwnedService`, withdraws it with
+`undesignatePlatformOwnedService` and reads it with `getServicePlatformOwnership`
+(`requests.network.IReq_Admin_Cloudly_DesignatePlatformOwnedService`,
+`IReq_Admin_Cloudly_UndesignatePlatformOwnedService`,
+`IReq_Admin_Cloudly_GetServicePlatformOwnership`). Only a platform
+organization's service is designated: `data.isPlatformOrganizationId` is true
+exactly for a canonical identifier that carries `:` (`legacy:Service:<id>`,
+`Organization:<id>`), and false for an idp.global nanoid, whichever character it
+starts with, and for any value that is not a canonical identifier, such as an
+empty or whitespace id. Cloudly refuses every other id as
+`organization-not-platform`, and further designation refusals are
+`service-unknown`, `service-deleting` and `conflict`
+(`data.servicePlatformOwnershipRefusals`). The designation grants no port, egress
+or placement by itself. Withdrawing it leaves the service's published ports as
+they are with no writer, because a platform organization has no idp.global
+owner, until an administrator designates the service again. A published-port
+write staged while the designation changes is refused as the policy write's
+`conflict`.
+
 A published entry with `hostPortEnd` publishes every port from `hostPort` to
 `hostPortEnd` inclusive, each to the same port inside the workload, so its
 `targetPort` equals `hostPort` and a one-port range is written without the member.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.44.0',
+  version: '32.45.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/index.ts

@@ -76,6 +76,7 @@ export * from './sparklegacyretirement.js';
 export * from './sparknodereport.js';
 export * from './service.js';
 export * from './servicecredential.js';
+export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
 export * from './servicevolumeinitialization.js';

package/ts/data/runtimeassignment.ts

@@ -164,6 +164,15 @@ export const runtimeImagePullRefusalReasons = ['unauthorized', 'not-found', 'tls
   'unavailable', 'other'] as const;
 export type TRuntimeImagePullRefusalReason = typeof runtimeImagePullRefusalReasons[number];
 
+/**
+ * Why a node refused to start a run before any runtime effect of it, as the node names it:
+ * `unsupported-readiness` a readiness probe the run's network cannot carry (a TCP or HTTP probe of
+ * a run without network authority), `unresolved-authority` a workload authority the node cannot
+ * resolve, and `invalid` an assignment or configuration the node cannot read.
+ */
+export const runtimeAssignmentRefusalReasons = ['unsupported-readiness', 'unresolved-authority', 'invalid'] as const;
+export type TRuntimeAssignmentRefusalReason = typeof runtimeAssignmentRefusalReasons[number];
+
 /**
  * Why a run failed, as its node can name it. Value-free: it carries a cause word and at most a
  * bounded status number, never a runtime message, a registry, a reference or a path.
@@ -176,17 +185,31 @@ export type TRuntimeImagePullRefusalReason = typeof runtimeImagePullRefusalReaso
  * - `runtime-absent`: the runtime holds no sandbox or container of a run that should be running.
  * - `network-epoch-ended`: the run's network attachment belongs to a network epoch that has ended,
  *   so the node stopped it rather than leave it running without its network.
+ * - `refused`: the node refused the run before any runtime effect of it, for `reason`, so the
+ *   observation carries no runtime identity.
+ * - `container-refused`: the runtime deterministically refused to create the run's container
+ *   (CRI `CreateContainer`), so no container of the run exists and the observation carries no
+ *   runtime identity. `grpcCode` is the runtime's gRPC status code (1..16).
  *
- * The cause explains the failure; it changes nothing about it. Every failed run is replaced the same
- * way, whichever cause it states.
+ * The cause explains the failure. Every failed run is replaced the same way, whichever cause it
+ * states, with one exception: a `refused` run is never re-placed with an identical configuration,
+ * because the node refuses the same input the same way. The controller places a new attempt only
+ * after the service's runtime spec or another input of the assignment changed.
  */
 export type TRuntimeAssignmentFailureCause =
   | { kind: 'image-pull-refused'; reason: TRuntimeImagePullRefusalReason; grpcCode: number }
   | { kind: 'exited'; exitCode: number | null }
   | { kind: 'runtime-absent' }
-  | { kind: 'network-epoch-ended' };
+  | { kind: 'network-epoch-ended' }
+  | { kind: 'refused'; reason: TRuntimeAssignmentRefusalReason }
+  | { kind: 'container-refused'; grpcCode: number };
 export const runtimeAssignmentFailureCauseKinds = ['image-pull-refused', 'exited', 'runtime-absent',
-  'network-epoch-ended'] as const satisfies readonly TRuntimeAssignmentFailureCause['kind'][];
+  'network-epoch-ended', 'refused', 'container-refused'] as const satisfies readonly TRuntimeAssignmentFailureCause['kind'][];
+
+/** The causes of a run of which nothing ever existed, so their observation names no runtime identity. */
+const causesWithoutRuntime: readonly TRuntimeAssignmentFailureCause['kind'][] = [
+  'image-pull-refused', 'refused', 'container-refused',
+];
 
 /** Value-free execution evidence. Receipt/acceptance alone never means ready. */
 export interface IRuntimeAssignmentObservation {
@@ -483,6 +506,11 @@ const isFailureCause = (valueArg: unknown): valueArg is TRuntimeAssignmentFailur
     case 'runtime-absent':
     case 'network-epoch-ended':
       return isExactRecord(valueArg, ['kind']);
+    case 'refused':
+      return isExactRecord(valueArg, ['kind', 'reason'])
+        && runtimeAssignmentRefusalReasons.some((reasonArg) => reasonArg === valueArg.reason);
+    case 'container-refused':
+      return isExactRecord(valueArg, ['kind', 'grpcCode']) && isBoundedInteger(valueArg.grpcCode, 1, 16);
     default:
       return false;
   }
@@ -508,7 +536,7 @@ const assertObservation = (valueArg: unknown): IRuntimeAssignmentObservation =>
     fail('runtime observation readiness and identity contradict its phase');
   }
   if (Object.hasOwn(valueArg, 'cause') && (valueArg.phase !== 'failed' || !isFailureCause(valueArg.cause)
-    || (valueArg.cause.kind === 'image-pull-refused' && valueArg.runtime !== null))) {
+    || (causesWithoutRuntime.includes(valueArg.cause.kind) && valueArg.runtime !== null))) {
     fail('runtime observation failure cause must be exact and belong to a failed run');
   }
   canonical(valueArg);

package/ts/data/serviceplatformownership.ts

@@ -0,0 +1,95 @@
+import { captureNetwork, networkCounter, networkId, networkRecord, requireNetwork } from '../private/networkcontract.js';
+
+/**
+ * Which authority writes a service's runtime network policy, decided by whether the service is
+ * platform-owned.
+ *
+ * A service of an idp.global organization is that organization's: its published ports are written
+ * only by a federated sign-in holding the organization's freshly introspected `owner` role, and an
+ * infrastructure administrator does not substitute for it. A platform-owned service belongs to no
+ * idp.global organization — the cluster ingress, a platform call router — so no organization owner
+ * exists who could authorize it. An infrastructure administrator designates such a service
+ * platform-owned, and from then on only a verified administrator reads and writes its published
+ * ports, as only an administrator writes its egress and its runtime spec. The designation names
+ * the authority and nothing else: it grants no port, egress or placement by itself.
+ *
+ * Only a service of a platform organization (`isPlatformOrganizationId`) is ever designated, so the
+ * federated owner rule stays the only rule for every other service, including any whose
+ * organization id is not a canonical identifier at all. Withdrawing the designation hands the
+ * ports back to the organization-owner rule, and a platform organization has no idp.global owner:
+ * the service's published ports then have no writer, and stay as they are, until an administrator
+ * designates it again.
+ */
+export interface IServicePlatformOwnership {
+  organizationId: string;
+  serviceId: string;
+  /** The administrator who designated the service. */
+  actorId: string;
+  /** Unix milliseconds on Cloudly's clock. */
+  designatedAt: number;
+}
+
+/**
+ * Every reason Cloudly answers instead of designating a service platform-owned or withdrawing the
+ * designation. Each travels by name as a `TypedResponseError`, and a refused request changes
+ * nothing.
+ */
+export const servicePlatformOwnershipRefusals = Object.freeze([
+  /** No service of that id belongs to the named organization. */
+  'service-unknown',
+  /** The service's deletion has begun; no new authority outlives it. */
+  'service-deleting',
+  /**
+   * The named organization is not a platform organization (`isPlatformOrganizationId`): an
+   * idp.global organization, whose owner keeps the authority over its runtime network policy, or an
+   * id that is no canonical identifier.
+   */
+  'organization-not-platform',
+  /** Another write changed the service's designation first: read it again. */
+  'conflict',
+] as const);
+
+/** One of the reasons Cloudly answers instead of a designation change. */
+export type TServicePlatformOwnershipRefusal = typeof servicePlatformOwnershipRefusals[number];
+
+export const servicePlatformOwnershipContract = Object.freeze({
+  error: 'Service platform ownership contract rejected.',
+} as const);
+
+/**
+ * Whether an organization id names a platform organization, the only kind whose service an
+ * administrator may designate platform-owned.
+ *
+ * Every organization Cloudly assigns outside idp.global is namespaced with `:` — a legacy service's
+ * own `legacy:Service:<id>`, a platform `Organization:<id>` — while idp.global names an
+ * organization by a 21-character nanoid in the URL alphabet (`A-Za-z0-9_-`), which never carries
+ * `:`. An id is a platform organization's exactly when it is a canonical identifier (an ASCII
+ * letter or digit, then up to 199 of letters, digits, `:`, `.`, `_` and `-`) and carries `:`.
+ * Everything else is not: an idp.global id, whichever character it starts with, and any value that
+ * is not a canonical identifier — empty, whitespace, a non-string. The answer fails closed: an id
+ * this rule cannot read never gains administrator authority.
+ */
+export const isPlatformOrganizationId = (organizationId: string): boolean => {
+  try {
+    return networkId(organizationId).includes(':');
+  } catch {
+    return false;
+  }
+};
+
+/** Detached exact-schema snapshot of a stored or answered designation. */
+export const snapshotServicePlatformOwnership = (value: unknown): IServicePlatformOwnership => {
+  try {
+    const item = networkRecord(captureNetwork(value), ['organizationId', 'serviceId', 'actorId', 'designatedAt']);
+    const organizationId = networkId(item.organizationId);
+    requireNetwork(isPlatformOrganizationId(organizationId));
+    return {
+      organizationId,
+      serviceId: networkId(item.serviceId),
+      actorId: networkId(item.actorId),
+      designatedAt: networkCounter(item.designatedAt),
+    };
+  } catch {
+    throw new Error(servicePlatformOwnershipContract.error);
+  }
+};

package/ts/data/serviceruntime.ts

@@ -91,7 +91,7 @@ const serviceRuntimeRefusals = [
   'volume-placement-unsupported', 'volume-initialization-unknown', 'volume-ownership-unknown',
   'objectstorage-endpoint-missing', 'objectstorage-binding-invalid', 'objectstorage-environment-conflict',
   'objectstorage-endpoint-unselected', 'database-endpoint-missing', 'database-endpoint-unselected',
-  'published-port-reserved', 'published-port-symmetric-without-egress',
+  'published-port-reserved', 'published-port-symmetric-without-egress', 'readiness-network-unsupported',
 ] as const;
 
 /**
@@ -158,6 +158,13 @@ export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[n
  * which the handoff leases' `runtimeNetworkHandoffSnatPortRange` owns; a document written before
  * that rule can hold one. `published-port-symmetric-without-egress` is a `symmetric` entry in a
  * document whose `publicEgress` is false, which a projection endpoint refuses.
+ *
+ * `readiness-network-unsupported` is a spec whose network is `isolated` and whose readiness probe is
+ * `tcp` or `http`: an isolated workload has no address its node can dial, so the probe could never
+ * pass and the node refuses the run (`TRuntimeAssignmentFailureCause` `refused` for
+ * `unsupported-readiness`). `isServiceRuntimeReadinessReachable` is this rule; a producer answers
+ * what it returns. The spec snapshot still reads such a spec, so a stored one stays readable and
+ * is answered with this refusal rather than refused as data.
  */
 export type TServiceRuntimeRefusal = typeof serviceRuntimeRefusals[number];
 
@@ -184,6 +191,38 @@ export type IServiceRuntimeStatus = IServiceRuntimeStatusBase & (
  */
 export type TServiceRuntimeAssignmentDelivery = 'undelivered' | 'delivered';
 
+/**
+ * Why one dispatch of an assignment revision to its node ended as it did.
+ *
+ * The node holds the revision: `accepted`, `replay` or `historical` is what the node answered to
+ * the push, and `acknowledged` a revision the node's current session acknowledged before, answered
+ * from that acknowledgement without pushing it again.
+ *
+ * The node does not hold it from this dispatch: `node-busy` while the node already carries its limit
+ * of pushes in flight, `node-not-connected` while no live peer holds a session for the node,
+ * `session-moved` when the session the dispatch began on is no longer the node's current one,
+ * `intent-not-current` when the revision is no longer the one the controller wants on that node,
+ * `request-unbound` when the request does not bind to the session it would travel on,
+ * `node-refused` when the node (or the relay carrying it) answered the push with a refusal,
+ * `push-failed` when the push got no answer in time or its carrier failed, and
+ * `acknowledgement-unbound` when the answer names another revision.
+ */
+export const assignmentDispatchReasons = [
+  'accepted', 'replay', 'historical', 'acknowledged',
+  'node-busy', 'node-not-connected', 'session-moved', 'intent-not-current', 'request-unbound', 'node-refused',
+  'push-failed', 'acknowledgement-unbound',
+] as const;
+export type TAssignmentDispatchReason = typeof assignmentDispatchReasons[number];
+
+/** The last dispatch of a slot's current assignment, as the controller recorded it. Value-free. */
+export interface IServiceRuntimeAssignmentDispatch {
+  /** Whether the node holds the revision after this dispatch. */
+  delivered: boolean;
+  reason: TAssignmentDispatchReason;
+  /** Unix milliseconds on the controller's clock when this dispatch ended. */
+  at: number;
+}
+
 /** One replica slot's current assignment, as an administrator reads it. */
 export interface IServiceRuntimeAssignmentView {
   serviceId: string;
@@ -200,6 +239,12 @@ export interface IServiceRuntimeAssignmentView {
   /** Joined stop and remove receipts of this attempt. */
   terminalReceiptCount: 0 | 1 | 2;
   delivery: TServiceRuntimeAssignmentDelivery;
+  /**
+   * The last dispatch of the current revision while the controller still remembers one, null when
+   * it remembers none. Absent from a controller that does not report dispatches. Dispatch is the
+   * controller's push; `delivery` stays the node's own evidence.
+   */
+  dispatch?: IServiceRuntimeAssignmentDispatch | null;
 }
 
 /** Sorted, duplicate-free and read by the vocabulary the ids belong to: a node's, or the canonical one. */
@@ -264,6 +309,28 @@ export const snapshotServiceRuntimeSpec = (value: unknown): IServiceRuntimeSpec
     profile: profileOf(item.profile), network: networkOf(item.network), revision: networkCounter(item.revision) };
 });
 
+/**
+ * Whether a spec's readiness probe can reach its workload: false exactly for an `isolated` network
+ * with a `tcp` or `http` probe, which the producer answers as `readiness-network-unsupported`. The
+ * spec is read through `snapshotServiceRuntimeSpec`, so a value that is no spec is refused with its
+ * rejection rather than judged.
+ */
+export const isServiceRuntimeReadinessReachable = (value: unknown): boolean => {
+  const { profile, network } = snapshotServiceRuntimeSpec(value);
+  return network.mode === 'attached' || profile.readiness.kind === 'process';
+};
+
+/** Exactly a recorded dispatch of an assignment: a known reason and a positive Unix millisecond time. */
+export const isServiceRuntimeAssignmentDispatch = (value: unknown): value is IServiceRuntimeAssignmentDispatch => {
+  try {
+    const item = networkRecord(captureNetwork(value), ['delivered', 'reason', 'at']);
+    networkCounter(item.at);
+    return typeof item.delivered === 'boolean' && isOneOf(assignmentDispatchReasons, item.reason);
+  } catch {
+    return false;
+  }
+};
+
 /** Structural snapshot for exact persistence: a reason belongs to exactly one state. */
 export const snapshotServiceRuntimeStatus = (value: unknown): IServiceRuntimeStatus => producerSafe(() => {
   const item = networkRecord(captureNetwork(value), ['id', 'specRevision', 'state', 'reason', 'changedAt']);

package/ts/requests/network.ts

@@ -9,6 +9,7 @@ import type {
 import type {
   IServiceNetworkEgress, IServicePublishedPorts, ISetServiceNetworkEgress, ISetServicePublishedPorts,
 } from '../data/networkprojection.js';
+import type { IServicePlatformOwnership } from '../data/serviceplatformownership.js';
 
 /** Current organization picker data. Entries are never cached authorization grants. */
 export interface IReq_Cloudly_ListOwnedOrganizations extends plugins.typedrequestInterfaces.implementsTR<
@@ -73,7 +74,14 @@ export interface IReq_Cloudly_SetServicePrivateNetworks extends plugins.typedreq
   response: { membership: IServicePrivateNetworks; replayed: boolean };
 }
 
-/** null means the service has never had a policy document, neither published ports nor egress. */
+/**
+ * null means the service has never had a policy document, neither published ports nor egress.
+ *
+ * The authority follows the service (`IServicePlatformOwnership`): a platform-owned service is read
+ * by a verified administrator, every other service by a federated sign-in holding the named
+ * organization's freshly introspected `owner` role. A caller without that authority, or naming no
+ * such service, is answered one denial text, whichever it is.
+ */
 export interface IReq_Cloudly_GetServicePublishedPorts extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_GetServicePublishedPorts
 > {
@@ -92,6 +100,15 @@ export interface IReq_Cloudly_GetServicePublishedPorts extends plugins.typedrequ
  * attached spec stating `publicEgress: false` and `platformEndpointIds: []` matches it and reaches
  * no public address and no platform endpoint; `network-policy-missing` means the service has no
  * document at all.
+ *
+ * The authority follows the service (`IServicePlatformOwnership`): a platform-owned service is
+ * written by a verified administrator, every other service by a federated sign-in holding the named
+ * organization's freshly introspected `owner` role, and an administrator does not substitute for
+ * that owner. A caller without that authority, or naming no such service, is answered one denial
+ * text, whichever it is. A designation that changes while the write is staged refuses it as the
+ * policy write's own `conflict`, the refusal a stale `expectedRevision` is also answered (read the
+ * document and the authority again); it is a service network policy refusal, not one of
+ * `servicePlatformOwnershipRefusals`.
  */
 export interface IReq_Cloudly_SetServicePublishedPorts extends plugins.typedrequestInterfaces.implementsTR<
   plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_SetServicePublishedPorts
@@ -147,6 +164,53 @@ export interface IReq_Admin_Cloudly_SetServiceNetworkEgress extends plugins.type
   response: { networkEgress: IServiceNetworkEgress; replayed: boolean };
 }
 
+/**
+ * Designates one service platform-owned (`IServicePlatformOwnership`), so that a verified
+ * administrator, and no organization owner, holds the authority over its published ports.
+ *
+ * Only a verified administrator calls it. Cloudly designates only a service of a platform
+ * organization (`isPlatformOrganizationId`: a canonical identifier carrying `:`, such as
+ * `legacy:Service:<id>` or `Organization:<id>`) and refuses every other organization id, an
+ * idp.global one or one that is no canonical identifier, as `organization-not-platform` before it
+ * reads the service. It refuses a service that is not the named organization's (`service-unknown`)
+ * and a deleting one (`service-deleting`); refusals are `servicePlatformOwnershipRefusals`. A
+ * service already designated answers its stored designation unchanged with `changed: false`.
+ */
+export interface IReq_Admin_Cloudly_DesignatePlatformOwnedService extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_DesignatePlatformOwnedService
+> {
+  method: 'designatePlatformOwnedService';
+  request: { identity: IIdentityCredential; organizationId: string; serviceId: string };
+  response: { platformOwnership: IServicePlatformOwnership; changed: boolean };
+}
+
+/**
+ * Withdraws a service's platform-owned designation; its published ports stay as they are, and from
+ * then on the organization-owner rule governs them. A designated service is always a platform
+ * organization's, which has no idp.global owner, so after the withdrawal nobody writes or reads its
+ * published ports until an administrator designates it again: the authority fails closed.
+ *
+ * Only a verified administrator calls it. Refusals are `service-unknown` and `conflict`; a service
+ * without a designation answers `changed: false`.
+ */
+export interface IReq_Admin_Cloudly_UndesignatePlatformOwnedService extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_UndesignatePlatformOwnedService
+> {
+  method: 'undesignatePlatformOwnedService';
+  request: { identity: IIdentityCredential; organizationId: string; serviceId: string };
+  response: { platformOwnership: null; changed: boolean };
+}
+
+/** The service's platform-owned designation, or null when it has none. Only a verified administrator reads it. */
+export interface IReq_Admin_Cloudly_GetServicePlatformOwnership extends plugins.typedrequestInterfaces.implementsTR<
+  plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_GetServicePlatformOwnership
+> {
+  method: 'getServicePlatformOwnership';
+  /** Refused `service-unknown` when no service of that id belongs to the named organization. */
+  request: { identity: IIdentityCredential; organizationId: string; serviceId: string };
+  response: { platformOwnership: IServicePlatformOwnership | null };
+}
+
 export interface IRequest_Any_Cloudly_GetNetworkNodes {
   method: 'getNetworkNodes';
   request: {};