@serve.zone/interfaces 32.44.0 → 32.46.0

package/dist_ts/data/serviceplatformownership.js

@@ -0,0 +1,62 @@
+import { captureNetwork, networkCounter, networkId, networkRecord, requireNetwork } from '../private/networkcontract.js';
+/**
+ * Every reason Cloudly answers instead of designating a service platform-owned or withdrawing the
+ * designation. Each travels by name as a `TypedResponseError`, and a refused request changes
+ * nothing.
+ */
+export const servicePlatformOwnershipRefusals = Object.freeze([
+    /** No service of that id belongs to the named organization. */
+    'service-unknown',
+    /** The service's deletion has begun; no new authority outlives it. */
+    'service-deleting',
+    /**
+     * The named organization is not a platform organization (`isPlatformOrganizationId`): an
+     * idp.global organization, whose owner keeps the authority over its runtime network policy, or an
+     * id that is no canonical identifier.
+     */
+    'organization-not-platform',
+    /** Another write changed the service's designation first: read it again. */
+    'conflict',
+]);
+export const servicePlatformOwnershipContract = Object.freeze({
+    error: 'Service platform ownership contract rejected.',
+});
+/**
+ * Whether an organization id names a platform organization, the only kind whose service an
+ * administrator may designate platform-owned.
+ *
+ * Every organization Cloudly assigns outside idp.global is namespaced with `:` — a legacy service's
+ * own `legacy:Service:<id>`, a platform `Organization:<id>` — while idp.global names an
+ * organization by a 21-character nanoid in the URL alphabet (`A-Za-z0-9_-`), which never carries
+ * `:`. An id is a platform organization's exactly when it is a canonical identifier (an ASCII
+ * letter or digit, then up to 199 of letters, digits, `:`, `.`, `_` and `-`) and carries `:`.
+ * Everything else is not: an idp.global id, whichever character it starts with, and any value that
+ * is not a canonical identifier — empty, whitespace, a non-string. The answer fails closed: an id
+ * this rule cannot read never gains administrator authority.
+ */
+export const isPlatformOrganizationId = (organizationId) => {
+    try {
+        return networkId(organizationId).includes(':');
+    }
+    catch {
+        return false;
+    }
+};
+/** Detached exact-schema snapshot of a stored or answered designation. */
+export const snapshotServicePlatformOwnership = (value) => {
+    try {
+        const item = networkRecord(captureNetwork(value), ['organizationId', 'serviceId', 'actorId', 'designatedAt']);
+        const organizationId = networkId(item.organizationId);
+        requireNetwork(isPlatformOrganizationId(organizationId));
+        return {
+            organizationId,
+            serviceId: networkId(item.serviceId),
+            actorId: networkId(item.actorId),
+            designatedAt: networkCounter(item.designatedAt),
+        };
+    }
+    catch {
+        throw new Error(servicePlatformOwnershipContract.error);
+    }
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXBsYXRmb3Jtb3duZXJzaGlwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvZGF0YS9zZXJ2aWNlcGxhdGZvcm1vd25lcnNoaXAudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGNBQWMsRUFBRSxjQUFjLEVBQUUsU0FBUyxFQUFFLGFBQWEsRUFBRSxjQUFjLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQStCekg7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDNUQsK0RBQStEO0lBQy9ELGlCQUFpQjtJQUNqQixzRUFBc0U7SUFDdEUsa0JBQWtCO0lBQ2xCOzs7O09BSUc7SUFDSCwyQkFBMkI7SUFDM0IsNEVBQTRFO0lBQzVFLFVBQVU7Q0FDRixDQUFDLENBQUM7QUFLWixNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzVELEtBQUssRUFBRSwrQ0FBK0M7Q0FDOUMsQ0FBQyxDQUFDO0FBRVo7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxjQUFzQixFQUFXLEVBQUU7SUFDMUUsSUFBSSxDQUFDO1FBQ0gsT0FBTyxTQUFTLENBQUMsY0FBYyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2pELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRiwwRUFBMEU7QUFDMUUsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FBQyxLQUFjLEVBQTZCLEVBQUU7SUFDNUYsSUFBSSxDQUFDO1FBQ0gsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLGdCQUFnQixFQUFFLFdBQVcsRUFBRSxTQUFTLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztRQUM5RyxNQUFNLGNBQWMsR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ3RELGNBQWMsQ0FBQyx3QkFBd0IsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDO1FBQ3pELE9BQU87WUFDTCxjQUFjO1lBQ2QsU0FBUyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3BDLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztZQUNoQyxZQUFZLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7U0FDaEQsQ0FBQztJQUNKLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzFELENBQUM7QUFDSCxDQUFDLENBQUMifQ==

package/dist_ts/data/serviceruntime.d.ts

@@ -73,7 +73,7 @@ export declare const serviceRuntimeContract: Readonly<{
     readonly maximumAssignmentPageSize: 256;
 }>;
 declare const serviceRuntimeWaitingReasons: readonly ["node-network-pending", "conflict", "failure-backoff", "storage-import-pending", "bindings-pending", "legacy-adoption-pending", "objectstorage-retention-pending"];
-declare const serviceRuntimeRefusals: readonly ["cluster-runtime-missing", "organization-missing", "image-plan-missing", "platform-unsupported", "secrets-unsupported", "volumes-unsupported", "port-protocol-unsupported", "ports-too-many", "readiness-target-undeclared", "environment-too-large", "no-eligible-node", "replica-limit", "node-authority-unsupported", "network-policy-missing", "network-policy-mismatch", "network-workload-pool-missing", "network-workload-pool-exhausted", "volume-driver-unsupported", "volume-options-unsupported", "volume-shared-unsupported", "volume-placement-unsupported", "volume-initialization-unknown", "volume-ownership-unknown", "objectstorage-endpoint-missing", "objectstorage-binding-invalid", "objectstorage-environment-conflict", "objectstorage-endpoint-unselected", "database-endpoint-missing", "database-endpoint-unselected", "published-port-reserved", "published-port-symmetric-without-egress"];
+declare const serviceRuntimeRefusals: readonly ["cluster-runtime-missing", "organization-missing", "image-plan-missing", "platform-unsupported", "secrets-unsupported", "volumes-unsupported", "port-protocol-unsupported", "ports-too-many", "readiness-target-undeclared", "environment-too-large", "no-eligible-node", "replica-limit", "node-authority-unsupported", "network-policy-missing", "network-policy-mismatch", "network-workload-pool-missing", "network-workload-pool-exhausted", "volume-driver-unsupported", "volume-options-unsupported", "volume-shared-unsupported", "volume-placement-unsupported", "volume-initialization-unknown", "volume-ownership-unknown", "objectstorage-endpoint-missing", "objectstorage-binding-invalid", "objectstorage-environment-conflict", "objectstorage-endpoint-unselected", "database-endpoint-missing", "database-endpoint-unselected", "published-port-reserved", "published-port-symmetric-without-egress", "readiness-network-unsupported", "cluster-relay-missing", "cluster-ingress-environment-conflict"];
 /**
  * Why the producer is not converging yet, though nothing needs an administrator:
  * `node-network-pending` waits for a node's network readiness, `conflict` for a sweep over inputs
@@ -137,6 +137,22 @@ export type TServiceRuntimeWaitingReason = typeof serviceRuntimeWaitingReasons[n
  * which the handoff leases' `runtimeNetworkHandoffSnatPortRange` owns; a document written before
  * that rule can hold one. `published-port-symmetric-without-egress` is a `symmetric` entry in a
  * document whose `publicEgress` is false, which a projection endpoint refuses.
+ *
+ * `readiness-network-unsupported` is a spec whose network is `isolated` and whose readiness probe is
+ * `tcp` or `http`: an isolated workload has no address its node can dial, so the probe could never
+ * pass and the node refuses the run (`TRuntimeAssignmentFailureCause` `refused` for
+ * `unsupported-readiness`). `isServiceRuntimeReadinessReachable` is this rule; a producer answers
+ * what it returns. The spec snapshot still reads such a spec, so a stored one stays readable and
+ * is answered with this refusal rather than refused as data.
+ *
+ * The two `cluster-` refusals name why the environment of a cluster's designated ingress service
+ * cannot be composed (`composeClusterIngressEnvironment`); a service no designation names is never
+ * judged by them. `cluster-relay-missing` is a cluster that states no valid relay
+ * (`IClusterRelay`): the ingress registers through its relay's exact origin, so without one it has
+ * nothing to start with, and an administrator enables the relay (`enableClusterRelay`).
+ * `cluster-ingress-environment-conflict` is an ingress service whose own environment already sets
+ * one of `clusterIngressEnvironmentNames`: Cloudly owns those names, and a service value would
+ * otherwise silently replace Cloudly's or be replaced by it.
  */
 export type TServiceRuntimeRefusal = typeof serviceRuntimeRefusals[number];
 interface IServiceRuntimeStatusBase {
@@ -164,6 +180,32 @@ export type IServiceRuntimeStatus = IServiceRuntimeStatusBase & ({
  * node admitted but has not yet reported on reads as undelivered.
  */
 export type TServiceRuntimeAssignmentDelivery = 'undelivered' | 'delivered';
+/**
+ * Why one dispatch of an assignment revision to its node ended as it did.
+ *
+ * The node holds the revision: `accepted`, `replay` or `historical` is what the node answered to
+ * the push, and `acknowledged` a revision the node's current session acknowledged before, answered
+ * from that acknowledgement without pushing it again.
+ *
+ * The node does not hold it from this dispatch: `node-busy` while the node already carries its limit
+ * of pushes in flight, `node-not-connected` while no live peer holds a session for the node,
+ * `session-moved` when the session the dispatch began on is no longer the node's current one,
+ * `intent-not-current` when the revision is no longer the one the controller wants on that node,
+ * `request-unbound` when the request does not bind to the session it would travel on,
+ * `node-refused` when the node (or the relay carrying it) answered the push with a refusal,
+ * `push-failed` when the push got no answer in time or its carrier failed, and
+ * `acknowledgement-unbound` when the answer names another revision.
+ */
+export declare const assignmentDispatchReasons: readonly ["accepted", "replay", "historical", "acknowledged", "node-busy", "node-not-connected", "session-moved", "intent-not-current", "request-unbound", "node-refused", "push-failed", "acknowledgement-unbound"];
+export type TAssignmentDispatchReason = typeof assignmentDispatchReasons[number];
+/** The last dispatch of a slot's current assignment, as the controller recorded it. Value-free. */
+export interface IServiceRuntimeAssignmentDispatch {
+    /** Whether the node holds the revision after this dispatch. */
+    delivered: boolean;
+    reason: TAssignmentDispatchReason;
+    /** Unix milliseconds on the controller's clock when this dispatch ended. */
+    at: number;
+}
 /** One replica slot's current assignment, as an administrator reads it. */
 export interface IServiceRuntimeAssignmentView {
     serviceId: string;
@@ -180,12 +222,27 @@ export interface IServiceRuntimeAssignmentView {
     /** Joined stop and remove receipts of this attempt. */
     terminalReceiptCount: 0 | 1 | 2;
     delivery: TServiceRuntimeAssignmentDelivery;
+    /**
+     * The last dispatch of the current revision while the controller still remembers one, null when
+     * it remembers none. Absent from a controller that does not report dispatches. Dispatch is the
+     * controller's push; `delivery` stays the node's own evidence.
+     */
+    dispatch?: IServiceRuntimeAssignmentDispatch | null;
 }
 /**
  * Structural snapshot for exact persistence and for a spec write. Whether the cluster, the nodes and
  * the platform endpoints exist, and whether the service declares the readiness target, is Cloudly's.
  */
 export declare const snapshotServiceRuntimeSpec: (value: unknown) => IServiceRuntimeSpec;
+/**
+ * Whether a spec's readiness probe can reach its workload: false exactly for an `isolated` network
+ * with a `tcp` or `http` probe, which the producer answers as `readiness-network-unsupported`. The
+ * spec is read through `snapshotServiceRuntimeSpec`, so a value that is no spec is refused with its
+ * rejection rather than judged.
+ */
+export declare const isServiceRuntimeReadinessReachable: (value: unknown) => boolean;
+/** Exactly a recorded dispatch of an assignment: a known reason and a positive Unix millisecond time. */
+export declare const isServiceRuntimeAssignmentDispatch: (value: unknown) => value is IServiceRuntimeAssignmentDispatch;
 /** Structural snapshot for exact persistence: a reason belongs to exactly one state. */
 export declare const snapshotServiceRuntimeStatus: (value: unknown) => IServiceRuntimeStatus;
 export {};

package/dist_ts/data/serviceruntime.js

@@ -28,7 +28,29 @@ const serviceRuntimeRefusals = [
     'volume-placement-unsupported', 'volume-initialization-unknown', 'volume-ownership-unknown',
     'objectstorage-endpoint-missing', 'objectstorage-binding-invalid', 'objectstorage-environment-conflict',
     'objectstorage-endpoint-unselected', 'database-endpoint-missing', 'database-endpoint-unselected',
-    'published-port-reserved', 'published-port-symmetric-without-egress',
+    'published-port-reserved', 'published-port-symmetric-without-egress', 'readiness-network-unsupported',
+    'cluster-relay-missing', 'cluster-ingress-environment-conflict',
+];
+/**
+ * Why one dispatch of an assignment revision to its node ended as it did.
+ *
+ * The node holds the revision: `accepted`, `replay` or `historical` is what the node answered to
+ * the push, and `acknowledged` a revision the node's current session acknowledged before, answered
+ * from that acknowledgement without pushing it again.
+ *
+ * The node does not hold it from this dispatch: `node-busy` while the node already carries its limit
+ * of pushes in flight, `node-not-connected` while no live peer holds a session for the node,
+ * `session-moved` when the session the dispatch began on is no longer the node's current one,
+ * `intent-not-current` when the revision is no longer the one the controller wants on that node,
+ * `request-unbound` when the request does not bind to the session it would travel on,
+ * `node-refused` when the node (or the relay carrying it) answered the push with a refusal,
+ * `push-failed` when the push got no answer in time or its carrier failed, and
+ * `acknowledgement-unbound` when the answer names another revision.
+ */
+export const assignmentDispatchReasons = [
+    'accepted', 'replay', 'historical', 'acknowledged',
+    'node-busy', 'node-not-connected', 'session-moved', 'intent-not-current', 'request-unbound', 'node-refused',
+    'push-failed', 'acknowledgement-unbound',
 ];
 /** Sorted, duplicate-free and read by the vocabulary the ids belong to: a node's, or the canonical one. */
 const sortedIds = (value, maximum, read) => networkSorted(networkList(value, maximum, read), id => id);
@@ -86,6 +108,27 @@ export const snapshotServiceRuntimeSpec = (value) => producerSafe(() => {
         placement: placementOf(item.placement), replicasPerNode: item.replicasPerNode, hold: item.hold,
         profile: profileOf(item.profile), network: networkOf(item.network), revision: networkCounter(item.revision) };
 });
+/**
+ * Whether a spec's readiness probe can reach its workload: false exactly for an `isolated` network
+ * with a `tcp` or `http` probe, which the producer answers as `readiness-network-unsupported`. The
+ * spec is read through `snapshotServiceRuntimeSpec`, so a value that is no spec is refused with its
+ * rejection rather than judged.
+ */
+export const isServiceRuntimeReadinessReachable = (value) => {
+    const { profile, network } = snapshotServiceRuntimeSpec(value);
+    return network.mode === 'attached' || profile.readiness.kind === 'process';
+};
+/** Exactly a recorded dispatch of an assignment: a known reason and a positive Unix millisecond time. */
+export const isServiceRuntimeAssignmentDispatch = (value) => {
+    try {
+        const item = networkRecord(captureNetwork(value), ['delivered', 'reason', 'at']);
+        networkCounter(item.at);
+        return typeof item.delivered === 'boolean' && isOneOf(assignmentDispatchReasons, item.reason);
+    }
+    catch {
+        return false;
+    }
+};
 /** Structural snapshot for exact persistence: a reason belongs to exactly one state. */
 export const snapshotServiceRuntimeStatus = (value) => producerSafe(() => {
     const item = networkRecord(captureNetwork(value), ['id', 'specRevision', 'state', 'reason', 'changedAt']);
@@ -102,4 +145,4 @@ export const snapshotServiceRuntimeStatus = (value) => producerSafe(() => {
     requireNetwork(item.state === 'refused' && isOneOf(serviceRuntimeRefusals, item.reason));
     return { ...base, state: item.state, reason: item.reason };
 });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF5RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRztJQUNuQyxzQkFBc0IsRUFBRSxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsd0JBQXdCLEVBQUUsa0JBQWtCO0lBQ25HLHlCQUF5QixFQUFFLGlDQUFpQztDQUNwRCxDQUFDO0FBQ1gsTUFBTSxzQkFBc0IsR0FBRztJQUM3Qix5QkFBeUIsRUFBRSxzQkFBc0IsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0I7SUFDL0YscUJBQXFCLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsZ0JBQWdCO0lBQzNGLDZCQUE2QixFQUFFLHVCQUF1QixFQUFFLGtCQUFrQixFQUFFLGVBQWU7SUFDM0YsNEJBQTRCLEVBQUUsd0JBQXdCLEVBQUUseUJBQXlCO0lBQ2pGLCtCQUErQixFQUFFLGlDQUFpQztJQUNsRSwyQkFBMkIsRUFBRSw0QkFBNEIsRUFBRSwyQkFBMkI7SUFDdEYsOEJBQThCLEVBQUUsK0JBQStCLEVBQUUsMEJBQTBCO0lBQzNGLGdDQUFnQyxFQUFFLCtCQUErQixFQUFFLG9DQUFvQztJQUN2RyxtQ0FBbUMsRUFBRSwyQkFBMkIsRUFBRSw4QkFBOEI7SUFDaEcseUJBQXlCLEVBQUUseUNBQXlDO0NBQzVELENBQUM7QUE4R1gsMkdBQTJHO0FBQzNHLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUFFLE9BQWUsRUFBRSxJQUErQixFQUFZLEVBQUUsQ0FDL0YsYUFBYSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUM7QUFFN0QsTUFBTSxXQUFXLEdBQUcsQ0FBQyxLQUFjLEVBQTRCLEVBQUU7SUFDL0QsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQztJQUN0QyxJQUFJLElBQUksS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUMxQixhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUMvQixPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLEtBQUssT0FBTyxDQUFDLENBQUM7SUFDakMsTUFBTSxPQUFPLEdBQUcsU0FBUyxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxPQUFPLEVBQUUsc0JBQXNCLENBQUMsa0JBQWtCLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDdkksY0FBYyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7SUFDbkMsT0FBTyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUMzQixDQUFDLENBQUM7QUFFRixNQUFNLE9BQU8sR0FBRyxDQUFDLEtBQWMsRUFBbUMsRUFBRTtJQUNsRSxJQUFJLEtBQUssS0FBSyxJQUFJO1FBQUUsT0FBTyxJQUFJLENBQUM7SUFDaEMsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3JELGNBQWMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksdUJBQXVCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7SUFDMUYsT0FBTyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQTBCLEVBQUU7SUFDM0QsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLFdBQVcsRUFBRSxhQUFhLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ2hILGNBQWMsQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksb0JBQW9CLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQztXQUN0RixrQkFBa0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksT0FBTyxJQUFJLENBQUMsY0FBYyxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ2hGLDRHQUE0RztJQUM1RyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksRUFBRSxZQUFZLENBQUMsQ0FBQztJQUNqRSxNQUFNLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQztJQUMxRSxPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLEVBQUUsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXO1FBQy9ELFNBQVMsRUFBRSxJQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBNEI7UUFDbEYsSUFBSSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLEVBQUUsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjLEVBQUUsS0FBSyxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztBQUNySSxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBMEIsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLFVBQVUsRUFBRSxDQUFDO1FBQ3hCLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9CLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksS0FBSyxVQUFVLENBQUMsQ0FBQztJQUNwQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLGNBQWMsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDLENBQUM7SUFDbkYsY0FBYyxDQUFDLE9BQU8sSUFBSSxDQUFDLFlBQVksS0FBSyxTQUFTLENBQUMsQ0FBQztJQUN2RCxPQUFPLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtRQUM1QyxtQkFBbUIsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLG1CQUFtQixFQUFFLHNCQUFzQixDQUFDLHdCQUF3QixFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUM7QUFDM0gsQ0FBQyxDQUFDO0FBRUY7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxLQUFjLEVBQXVCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ25HLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxFQUFFLFdBQVc7UUFDakcsaUJBQWlCLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztJQUNoRSxjQUFjLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDLEVBQUUsc0JBQXNCLENBQUMsc0JBQXNCLENBQUM7V0FDbEcsT0FBTyxJQUFJLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3JDLE9BQU8sRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxjQUFjLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDbkgsU0FBUyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsZUFBZSxFQUFFLElBQUksQ0FBQyxlQUFlLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJO1FBQzlGLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE9BQU8sRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxFQUFFLFFBQVEsRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7QUFDbEgsQ0FBQyxDQUFDLENBQUM7QUFFSCx3RkFBd0Y7QUFDeEYsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsQ0FBQyxLQUFjLEVBQXlCLEVBQUUsQ0FBQyxZQUFZLENBQUMsR0FBRyxFQUFFO0lBQ3ZHLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsY0FBYyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQztJQUMxRyxNQUFNLElBQUksR0FBOEIsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsRUFBRSxZQUFZLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUM7UUFDL0csU0FBUyxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztJQUM5QyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssV0FBVyxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssWUFBWSxFQUFFLENBQUM7UUFDOUQsY0FBYyxDQUFDLElBQUksQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDckMsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUN0RCxDQUFDO0lBQ0QsSUFBSSxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzdCLGNBQWMsQ0FBQyxPQUFPLENBQUMsNEJBQTRCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDbkUsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDN0QsQ0FBQztJQUNELGNBQWMsQ0FBQyxJQUFJLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLENBQUMsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDekYsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7QUFDN0QsQ0FBQyxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZXJ1bnRpbWUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NlcnZpY2VydW50aW1lLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUlBLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hFLE9BQU8sRUFBRSxjQUFjLEVBQUUsZ0JBQWdCLEVBQUUsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxFQUFFLGFBQWEsRUFBRSxhQUFhLEVBQzVILGNBQWMsRUFBRSxNQUFNLCtCQUErQixDQUFDO0FBQ3hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUNoRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsZ0JBQWdCLEVBQUUsa0JBQWtCLEVBQUUsdUJBQXVCLEVBQUUsa0JBQWtCLEVBQ2hILG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUF5RDVELE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDbEQsc0JBQXNCLEVBQUUsRUFBRTtJQUMxQiwrRkFBK0Y7SUFDL0YsZUFBZSxFQUFFLEVBQUU7SUFDbkIsb0hBQW9IO0lBQ3BILGtCQUFrQixFQUFFLCtCQUErQixDQUFDLHdCQUF3QjtJQUM1RSx3QkFBd0IsRUFBRSwrQkFBK0IsQ0FBQyx3QkFBd0I7SUFDbEYsMEZBQTBGO0lBQzFGLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsZ0dBQWdHO0lBQ2hHLHlCQUF5QixFQUFFLEdBQUc7Q0FDdEIsQ0FBQyxDQUFDO0FBRVosTUFBTSw0QkFBNEIsR0FBRztJQUNuQyxzQkFBc0IsRUFBRSxVQUFVLEVBQUUsaUJBQWlCLEVBQUUsd0JBQXdCLEVBQUUsa0JBQWtCO0lBQ25HLHlCQUF5QixFQUFFLGlDQUFpQztDQUNwRCxDQUFDO0FBQ1gsTUFBTSxzQkFBc0IsR0FBRztJQUM3Qix5QkFBeUIsRUFBRSxzQkFBc0IsRUFBRSxvQkFBb0IsRUFBRSxzQkFBc0I7SUFDL0YscUJBQXFCLEVBQUUscUJBQXFCLEVBQUUsMkJBQTJCLEVBQUUsZ0JBQWdCO0lBQzNGLDZCQUE2QixFQUFFLHVCQUF1QixFQUFFLGtCQUFrQixFQUFFLGVBQWU7SUFDM0YsNEJBQTRCLEVBQUUsd0JBQXdCLEVBQUUseUJBQXlCO0lBQ2pGLCtCQUErQixFQUFFLGlDQUFpQztJQUNsRSwyQkFBMkIsRUFBRSw0QkFBNEIsRUFBRSwyQkFBMkI7SUFDdEYsOEJBQThCLEVBQUUsK0JBQStCLEVBQUUsMEJBQTBCO0lBQzNGLGdDQUFnQyxFQUFFLCtCQUErQixFQUFFLG9DQUFvQztJQUN2RyxtQ0FBbUMsRUFBRSwyQkFBMkIsRUFBRSw4QkFBOEI7SUFDaEcseUJBQXlCLEVBQUUseUNBQXlDLEVBQUUsK0JBQStCO0lBQ3JHLHVCQUF1QixFQUFFLHNDQUFzQztDQUN2RCxDQUFDO0FBNEdYOzs7Ozs7Ozs7Ozs7Ozs7R0FlRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHO0lBQ3ZDLFVBQVUsRUFBRSxRQUFRLEVBQUUsWUFBWSxFQUFFLGNBQWM7SUFDbEQsV0FBVyxFQUFFLG9CQUFvQixFQUFFLGVBQWUsRUFBRSxvQkFBb0IsRUFBRSxpQkFBaUIsRUFBRSxjQUFjO0lBQzNHLGFBQWEsRUFBRSx5QkFBeUI7Q0FDaEMsQ0FBQztBQW9DWCwyR0FBMkc7QUFDM0csTUFBTSxTQUFTLEdBQUcsQ0FBQyxLQUFjLEVBQUUsT0FBZSxFQUFFLElBQStCLEVBQVksRUFBRSxDQUMvRixhQUFhLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLEVBQUUsRUFBRSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUU3RCxNQUFNLFdBQVcsR0FBRyxDQUFDLEtBQWMsRUFBNEIsRUFBRTtJQUMvRCxNQUFNLElBQUksR0FBRyxTQUFTLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3RDLElBQUksSUFBSSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQzFCLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9CLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUNsQixDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsQ0FBQztJQUNqQyxNQUFNLE9BQU8sR0FBRyxTQUFTLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxzQkFBc0IsQ0FBQyxrQkFBa0IsRUFBRSxhQUFhLENBQUMsQ0FBQztJQUN2SSxjQUFjLENBQUMsT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNuQyxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQzNCLENBQUMsQ0FBQztBQUVGLE1BQU0sT0FBTyxHQUFHLENBQUMsS0FBYyxFQUFtQyxFQUFFO0lBQ2xFLElBQUksS0FBSyxLQUFLLElBQUk7UUFBRSxPQUFPLElBQUksQ0FBQztJQUNoQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDckQsY0FBYyxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUMxRixPQUFPLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztBQUNoRCxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLEtBQWMsRUFBMEIsRUFBRTtJQUMzRCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUMsV0FBVyxFQUFFLGFBQWEsRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDaEgsY0FBYyxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO1dBQ3RGLGtCQUFrQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxPQUFPLElBQUksQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDaEYsNEdBQTRHO0lBQzVHLHNCQUFzQixDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQ2pFLE1BQU0sRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDO0lBQzFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsRUFBRSxXQUFXLEVBQUUsSUFBSSxDQUFDLFdBQVc7UUFDL0QsU0FBUyxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUE0QjtRQUNsRixJQUFJLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxvQkFBb0IsRUFBRSxXQUFXLEVBQUUsRUFBRSxjQUFjLEVBQUUsSUFBSSxDQUFDLGNBQWMsRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0FBQ3JJLENBQUMsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBYyxFQUEwQixFQUFFO0lBQzNELE1BQU0sSUFBSSxHQUFHLFNBQVMsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7SUFDdEMsSUFBSSxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDeEIsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDL0IsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ2xCLENBQUM7SUFDRCxjQUFjLENBQUMsSUFBSSxLQUFLLFVBQVUsQ0FBQyxDQUFDO0lBQ3BDLE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxNQUFNLEVBQUUsY0FBYyxFQUFFLHFCQUFxQixDQUFDLENBQUMsQ0FBQztJQUNuRixjQUFjLENBQUMsT0FBTyxJQUFJLENBQUMsWUFBWSxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQ3ZELE9BQU8sRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO1FBQzVDLG1CQUFtQixFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsbUJBQW1CLEVBQUUsc0JBQXNCLENBQUMsd0JBQXdCLEVBQUUsU0FBUyxDQUFDLEVBQUUsQ0FBQztBQUMzSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxDQUFDLEtBQWMsRUFBdUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDbkcsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxXQUFXLEVBQUUsV0FBVztRQUNqRyxpQkFBaUIsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUMsRUFBRSxzQkFBc0IsQ0FBQyxzQkFBc0IsQ0FBQztXQUNsRyxPQUFPLElBQUksQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDLENBQUM7SUFDckMsT0FBTyxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLGNBQWMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNuSCxTQUFTLEVBQUUsV0FBVyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLGVBQWUsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLElBQUk7UUFDOUYsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsT0FBTyxFQUFFLFNBQVMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsUUFBUSxFQUFFLGNBQWMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztBQUNsSCxDQUFDLENBQUMsQ0FBQztBQUVIOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FBQyxLQUFjLEVBQVcsRUFBRTtJQUM1RSxNQUFNLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxHQUFHLDBCQUEwQixDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQy9ELE9BQU8sT0FBTyxDQUFDLElBQUksS0FBSyxVQUFVLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxJQUFJLEtBQUssU0FBUyxDQUFDO0FBQzdFLENBQUMsQ0FBQztBQUVGLHlHQUF5RztBQUN6RyxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLEtBQWMsRUFBOEMsRUFBRTtJQUMvRyxJQUFJLENBQUM7UUFDSCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsV0FBVyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDO1FBQ2pGLGNBQWMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDeEIsT0FBTyxPQUFPLElBQUksQ0FBQyxTQUFTLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyx5QkFBeUIsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDaEcsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLHdGQUF3RjtBQUN4RixNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLEtBQWMsRUFBeUIsRUFBRSxDQUFDLFlBQVksQ0FBQyxHQUFHLEVBQUU7SUFDdkcsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDO0lBQzFHLE1BQU0sSUFBSSxHQUE4QixFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxFQUFFLFlBQVksRUFBRSxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQztRQUMvRyxTQUFTLEVBQUUsY0FBYyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO0lBQzlDLElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxXQUFXLElBQUksSUFBSSxDQUFDLEtBQUssS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUM5RCxjQUFjLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsQ0FBQztRQUNyQyxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDN0IsY0FBYyxDQUFDLE9BQU8sQ0FBQyw0QkFBNEIsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUNuRSxPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsY0FBYyxDQUFDLElBQUksQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxzQkFBc0IsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUN6RixPQUFPLEVBQUUsR0FBRyxJQUFJLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztBQUM3RCxDQUFDLENBQUMsQ0FBQyJ9

package/dist_ts/requests/network.d.ts

@@ -4,6 +4,7 @@ import type { IRuntimeNetworkAddressPlan, TRuntimeNetworkAddressPlanWritableData
 import type { IRuntimeNetworkNodeReadiness, IRuntimeRouterIncarnation } from '../data/networknode.js';
 import type { IPrivateNetwork, IServicePrivateNetworks, ISetServicePrivateNetworks, TPrivateNetworkMutation } from '../data/privatenetwork.js';
 import type { IServiceNetworkEgress, IServicePublishedPorts, ISetServiceNetworkEgress, ISetServicePublishedPorts } from '../data/networkprojection.js';
+import type { IServicePlatformOwnership } from '../data/serviceplatformownership.js';
 /** Current organization picker data. Entries are never cached authorization grants. */
 export interface IReq_Cloudly_ListOwnedOrganizations extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_ListOwnedOrganizations> {
     method: 'listOwnedOrganizations';
@@ -97,7 +98,14 @@ export interface IReq_Cloudly_SetServicePrivateNetworks extends plugins.typedreq
         replayed: boolean;
     };
 }
-/** null means the service has never had a policy document, neither published ports nor egress. */
+/**
+ * null means the service has never had a policy document, neither published ports nor egress.
+ *
+ * The authority follows the service (`IServicePlatformOwnership`): a platform-owned service is read
+ * by a verified administrator, every other service by a federated sign-in holding the named
+ * organization's freshly introspected `owner` role. A caller without that authority, or naming no
+ * such service, is answered one denial text, whichever it is.
+ */
 export interface IReq_Cloudly_GetServicePublishedPorts extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_GetServicePublishedPorts> {
     method: 'getServicePublishedPorts';
     request: {
@@ -119,6 +127,15 @@ export interface IReq_Cloudly_GetServicePublishedPorts extends plugins.typedrequ
  * attached spec stating `publicEgress: false` and `platformEndpointIds: []` matches it and reaches
  * no public address and no platform endpoint; `network-policy-missing` means the service has no
  * document at all.
+ *
+ * The authority follows the service (`IServicePlatformOwnership`): a platform-owned service is
+ * written by a verified administrator, every other service by a federated sign-in holding the named
+ * organization's freshly introspected `owner` role, and an administrator does not substitute for
+ * that owner. A caller without that authority, or naming no such service, is answered one denial
+ * text, whichever it is. A designation that changes while the write is staged refuses it as the
+ * policy write's own `conflict`, the refusal a stale `expectedRevision` is also answered (read the
+ * document and the authority again); it is a service network policy refusal, not one of
+ * `servicePlatformOwnershipRefusals`.
  */
 export interface IReq_Cloudly_SetServicePublishedPorts extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Cloudly_SetServicePublishedPorts> {
     method: 'setServicePublishedPorts';
@@ -183,6 +200,64 @@ export interface IReq_Admin_Cloudly_SetServiceNetworkEgress extends plugins.type
         replayed: boolean;
     };
 }
+/**
+ * Designates one service platform-owned (`IServicePlatformOwnership`), so that a verified
+ * administrator, and no organization owner, holds the authority over its published ports.
+ *
+ * Only a verified administrator calls it. Cloudly designates only a service of a platform
+ * organization (`isPlatformOrganizationId`: a canonical identifier carrying `:`, such as
+ * `legacy:Service:<id>` or `Organization:<id>`) and refuses every other organization id, an
+ * idp.global one or one that is no canonical identifier, as `organization-not-platform` before it
+ * reads the service. It refuses a service that is not the named organization's (`service-unknown`)
+ * and a deleting one (`service-deleting`); refusals are `servicePlatformOwnershipRefusals`. A
+ * service already designated answers its stored designation unchanged with `changed: false`.
+ */
+export interface IReq_Admin_Cloudly_DesignatePlatformOwnedService extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_DesignatePlatformOwnedService> {
+    method: 'designatePlatformOwnedService';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: IServicePlatformOwnership;
+        changed: boolean;
+    };
+}
+/**
+ * Withdraws a service's platform-owned designation; its published ports stay as they are, and from
+ * then on the organization-owner rule governs them. A designated service is always a platform
+ * organization's, which has no idp.global owner, so after the withdrawal nobody writes or reads its
+ * published ports until an administrator designates it again: the authority fails closed.
+ *
+ * Only a verified administrator calls it. Refusals are `service-unknown` and `conflict`; a service
+ * without a designation answers `changed: false`.
+ */
+export interface IReq_Admin_Cloudly_UndesignatePlatformOwnedService extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_UndesignatePlatformOwnedService> {
+    method: 'undesignatePlatformOwnedService';
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: null;
+        changed: boolean;
+    };
+}
+/** The service's platform-owned designation, or null when it has none. Only a verified administrator reads it. */
+export interface IReq_Admin_Cloudly_GetServicePlatformOwnership extends plugins.typedrequestInterfaces.implementsTR<plugins.typedrequestInterfaces.ITypedRequest, IReq_Admin_Cloudly_GetServicePlatformOwnership> {
+    method: 'getServicePlatformOwnership';
+    /** Refused `service-unknown` when no service of that id belongs to the named organization. */
+    request: {
+        identity: IIdentityCredential;
+        organizationId: string;
+        serviceId: string;
+    };
+    response: {
+        platformOwnership: IServicePlatformOwnership | null;
+    };
+}
 export interface IRequest_Any_Cloudly_GetNetworkNodes {
     method: 'getNetworkNodes';
     request: {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.44.0",
+  "version": "32.46.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -28,10 +28,10 @@
   },
   "devDependencies": {
     "@git.zone/tsbuild": "^5.1.2",
-    "@git.zone/tsdoc": "^3.0.1",
+    "@git.zone/tsdoc": "^3.0.2",
     "@git.zone/tsrun": "^3.0.2",
-    "@git.zone/tstest": "6.3.4",
-    "@types/node": "26.6.2"
+    "@git.zone/tstest": "^7.1.0",
+    "@types/node": "26.6.3"
   },
   "files": [
     "ts/**/*",

package/readme.md

@@ -515,6 +515,34 @@ list is a valid policy meaning the service publishes nothing. Callers never supp
 from the accepted policy revision and digest, and node-level host-port placement
 stays Cloudly's decision.
 
+Who authors a service's published ports follows the service. A service of an
+idp.global organization is that organization's: only a federated sign-in holding
+its freshly introspected `owner` role reads and writes them, and an
+infrastructure administrator does not substitute for it. A platform-owned
+service (`data.IServicePlatformOwnership`: `organizationId`, `serviceId`, the
+designating administrator's `actorId`, `designatedAt`) belongs to no idp.global
+organization, such as the cluster ingress or a platform call router; only a
+verified administrator reads and writes its published ports, as only an
+administrator writes its egress. An administrator designates such a service
+with `designatePlatformOwnedService`, withdraws it with
+`undesignatePlatformOwnedService` and reads it with `getServicePlatformOwnership`
+(`requests.network.IReq_Admin_Cloudly_DesignatePlatformOwnedService`,
+`IReq_Admin_Cloudly_UndesignatePlatformOwnedService`,
+`IReq_Admin_Cloudly_GetServicePlatformOwnership`). Only a platform
+organization's service is designated: `data.isPlatformOrganizationId` is true
+exactly for a canonical identifier that carries `:` (`legacy:Service:<id>`,
+`Organization:<id>`), and false for an idp.global nanoid, whichever character it
+starts with, and for any value that is not a canonical identifier, such as an
+empty or whitespace id. Cloudly refuses every other id as
+`organization-not-platform`, and further designation refusals are
+`service-unknown`, `service-deleting` and `conflict`
+(`data.servicePlatformOwnershipRefusals`). The designation grants no port, egress
+or placement by itself. Withdrawing it leaves the service's published ports as
+they are with no writer, because a platform organization has no idp.global
+owner, until an administrator designates the service again. A published-port
+write staged while the designation changes is refused as the policy write's
+`conflict`.
+
 A published entry with `hostPortEnd` publishes every port from `hostPort` to
 `hostPortEnd` inclusive, each to the same port inside the workload, so its
 `targetPort` equals `hostPort` and a one-port range is written without the member.
@@ -1878,7 +1906,8 @@ evidence has not arrived). `refused` carries a `TServiceRuntimeRefusal`:
 `volume-options-unsupported`, `volume-shared-unsupported`, `volume-placement-unsupported`,
 `volume-initialization-unknown`, `volume-ownership-unknown`, `objectstorage-endpoint-missing`,
 `objectstorage-binding-invalid`, `objectstorage-environment-conflict`,
-`objectstorage-endpoint-unselected`, `database-endpoint-missing` or `database-endpoint-unselected`.
+`objectstorage-endpoint-unselected`, `database-endpoint-missing`, `database-endpoint-unselected`,
+`cluster-relay-missing` or `cluster-ingress-environment-conflict`.
 The first four volume
 refusals name what a local storage claim cannot express: a volume driver other than a node-local
 directory, driver or mount options, one volume mounted by more than one replica or service, and a
@@ -1888,7 +1917,12 @@ refusals, `objectstorage-endpoint-missing`, `objectstorage-binding-invalid` and
 `objectstorage-environment-conflict` name why a binding's environment cannot be composed, see
 [Object-Storage Binding Environment](#object-storage-binding-environment), and
 `objectstorage-endpoint-unselected`, like `database-endpoint-unselected`, names an endpoint the
-workload's network does not select (below). `ports-too-many` is a service declaring more target ports than the
+workload's network does not select (below). The two `cluster-` refusals concern only a cluster's
+designated ingress service, whose environment `composeClusterIngressEnvironment` composes, see
+[Cluster Ingress](#cluster-ingress): `cluster-relay-missing` is a cluster that states no valid
+relay, which an administrator enables with `enableClusterRelay`, and
+`cluster-ingress-environment-conflict` an ingress service whose own environment already sets one of
+`clusterIngressEnvironmentNames`. `ports-too-many` is a service declaring more target ports than the
 `runtimeConfigContract.maximumTargetPorts` (64) a config carries, where `port-protocol-unsupported`
 is about one port's protocol; `node-authority-unsupported` is a node whose session resolved fewer
 workload authorities than the spec needs, refused at the admit step rather than handed to a node
@@ -3217,6 +3251,24 @@ already applied and ignores a hint that is not newer, so a lost or repeated hint
 `SERVEZONE_CLUSTER_RELAY_ORIGIN` (the exact `IClusterRelay.origin`) and `SERVEZONE_CLUSTER_NODE_ID`
 (the node the assignment runs on). Cloudly writes them; the ingress reads them.
 
+`composeClusterIngressEnvironment(serviceEnvironment, { relayOrigin, nodeId })` is how Cloudly
+writes the two non-secret names for one replica of the designated ingress service: the service's
+own environment with `SERVEZONE_CLUSTER_RELAY_ORIGIN` and `SERVEZONE_CLUSTER_NODE_ID` added
+(`IClusterIngressLaunchFacts`; `relayOrigin` is the cluster's `IClusterRelay.origin` or `null`,
+`nodeId` the node the replica's assignment runs on). The bearer is not added: it reaches the
+workload through its secret manifest. The answer is a `TClusterIngressEnvironmentComposition`:
+
+| `status` | `reason` | When |
+| --- | --- | --- |
+| `composed` | — | `environment` is the service's own with both names added. |
+| `refused` | `cluster-relay-missing` | `relayOrigin` is `null` or `validateClusterRelay` refuses it. Answered first. |
+| `refused` | `cluster-ingress-environment-conflict` | The service's own environment already sets one of the three names; the message names every such key and no value. |
+
+`refused` carries the contract's `message`, and both reasons are `TClusterIngressEnvironmentRefusal`,
+members of `TServiceRuntimeRefusal`. A `nodeId` that is not a node id is the caller's error and is
+thrown. Both values are part of what the replica runs, so a moved relay or another node is another
+environment. The inputs are not changed.
+
 A cluster born on Pallet has no cutover scope, census or target set, so its ingress is designated by
 `IClusterIngressDesignation { id, generation, previous, clusterId, runtime, ingressServiceId,
 preparedSpecRevision, credential, actorId, acceptedAt, digest }` instead of the fleet-cutover

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.44.0',
+  version: '32.46.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusteringress.ts

@@ -3,6 +3,8 @@ import { isUtcCalendarDay } from '../private/utccalendarday.js';
 import { validateProtocolOfferOn } from '../protocol.js';
 import { hasExactKeys, readExactDataRecord } from '../private/dataproperties.js';
 import { isClusterNodeId } from '../private/nodeidentifier.js';
+import { validateClusterRelay } from './cluster.js';
+import type { TServiceRuntimeRefusal } from './serviceruntime.js';
 
 /**
  * The cluster ingress contracts.
@@ -440,6 +442,74 @@ export const clusterIngressEnvironmentNames = Object.freeze({
   nodeId: 'SERVEZONE_CLUSTER_NODE_ID',
 } as const);
 
+/**
+ * The service runtime refusals the ingress environment reports: `cluster-relay-missing`, a cluster
+ * that states no valid relay, and `cluster-ingress-environment-conflict`, a service environment
+ * that already sets one of `clusterIngressEnvironmentNames`.
+ */
+export type TClusterIngressEnvironmentRefusal = Extract<
+  TServiceRuntimeRefusal,
+  'cluster-relay-missing' | 'cluster-ingress-environment-conflict'
+>;
+
+/** What the designated ingress service runs with, or the one reason it cannot be composed. */
+export type TClusterIngressEnvironmentComposition =
+  | { status: 'composed'; environment: Record<string, string> }
+  | { status: 'refused'; reason: TClusterIngressEnvironmentRefusal; message: string };
+
+/** The facts Cloudly states about one replica of the designated ingress service. */
+export interface IClusterIngressLaunchFacts {
+  /** The cluster's `IClusterRelay.origin`, or `null` when the cluster states no relay. */
+  relayOrigin: string | null;
+  /** The node the replica's assignment runs on. */
+  nodeId: string;
+}
+
+/**
+ * The environment one replica of a cluster's designated ingress service runs with: the service's
+ * own values with `relayOrigin` and `nodeId` added under their `clusterIngressEnvironmentNames`.
+ *
+ * The bearer is not added here: it is a secret and reaches the workload through its secret manifest.
+ * Its name is still Cloudly's, so a service environment that sets any of the three names is
+ * refused `cluster-ingress-environment-conflict`, naming every such key and none of their values,
+ * rather than having one value silently replace another. A relay origin that is `null` or that
+ * `validateClusterRelay` refuses is `cluster-relay-missing`, answered before a conflict. A node id
+ * that is not a node id is the caller's error, not a refusal: the assignment named it, and it is
+ * thrown. The inputs are not changed. Both values are part of what the replica runs, so a relay or
+ * node that changes is a new environment.
+ */
+export const composeClusterIngressEnvironment = (
+  serviceEnvironmentArg: Readonly<Record<string, string>>,
+  launchArg: IClusterIngressLaunchFacts,
+): TClusterIngressEnvironmentComposition => {
+  const { relayOrigin, nodeId } = launchArg;
+  if (!isClusterNodeId(nodeId)) {
+    throw new Error('cluster ingress environment requires a node id');
+  }
+  if (relayOrigin === null) {
+    return { status: 'refused', reason: 'cluster-relay-missing',
+      message: 'cluster ingress has no relay origin: the cluster states no relay' };
+  }
+  const relayErrors = validateClusterRelay({ origin: relayOrigin });
+  if (relayErrors.length > 0) {
+    return { status: 'refused', reason: 'cluster-relay-missing',
+      message: `cluster ingress has no relay origin: ${relayErrors.join('; ')}` };
+  }
+  const collisions = Object.values(clusterIngressEnvironmentNames)
+    .filter((nameArg) => Object.hasOwn(serviceEnvironmentArg, nameArg))
+    .sort();
+  if (collisions.length > 0) {
+    return { status: 'refused', reason: 'cluster-ingress-environment-conflict',
+      message: `cluster ingress environment collides with ${collisions.join(', ')} already set on the `
+        + 'service' };
+  }
+  return { status: 'composed', environment: {
+    ...serviceEnvironmentArg,
+    [clusterIngressEnvironmentNames.relayOrigin]: relayOrigin,
+    [clusterIngressEnvironmentNames.nodeId]: nodeId,
+  } };
+};
+
 /**
  * Every reason Cloudly refuses a cluster ingress registration, in the order it judges them.
  *

package/ts/data/index.ts

@@ -76,6 +76,7 @@ export * from './sparklegacyretirement.js';
 export * from './sparknodereport.js';
 export * from './service.js';
 export * from './servicecredential.js';
+export * from './serviceplatformownership.js';
 export * from './serviceports.js';
 export * from './serviceruntime.js';
 export * from './servicevolumeinitialization.js';