@serve.zone/interfaces 32.50.0 → 32.51.0

package/changelog.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 2026-10-06 - 32.51.0
+
+### Features
+
+- A legacy service's runtime attestation is captured from an administrator's host observation, so
+  it no longer needs a fleet Coreflow session or Spark, which legacy hosts do not run.
+  `IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation` now carries `hostObservation`
+  (`ILegacyServiceHostObservation`, `data/deploymentlegacyimport.ts`): the Swarm service name, spec
+  image and mode (`TLegacyHostSwarmServiceMode`, replicated with its desired replicas, or global),
+  and per replica the node hostname, Swarm task id, full container id, the engine's image store
+  (`TLegacyHostImageStore`), the container's image id, the image's `RepoDigests`, the container
+  state (`TLegacyHostContainerState`) and its health (`TLegacyHostContainerHealth`, `none` when no
+  healthcheck applies). `validateLegacyServiceHostObservation` judges its exact shape,
+  `selectLegacyServiceHostObservationRootDigest` names the one root every replica runs from the
+  service's own repository, and `judgeLegacyServiceHostObservation` judges it against that root as
+  Cloudly reads it: exactly the desired replicas of a replicated service, a spec image naming the
+  repository by the source tag or the root digest, every replica running and healthy or without a
+  healthcheck (`unhealthy` and `starting` are refused), and each container's image id the root
+  digest on the containerd image store or a platform image configuration digest of the root on the
+  classic store. The source tag need not still name the root.
+  `ILegacyServiceRuntimeAttestation.data.runtime` records `evidenceSource`
+  (`TLegacyServiceRuntimeEvidenceSource`, `administrator-host-observation`) and the
+  `hostObservation` it was built from; `validateLegacyServiceRuntimeAttestation` requires both and
+  that `requiredReplicaCount` and `tasks` are the observed desired replicas and Swarm tasks.
+  The capture request's `hostObservation` and the record's `evidenceSource`/`hostObservation` are
+  new required members, which stays a minor of the one common major 32 because the previous capture
+  had no success path on a fleet without a Coreflow session, no shipped store holds an attestation
+  record, and Cloudly is the only code consumer.
+
+### Maintenance
+
+- Release tooling: `@git.zone/tstest` 7.1.0 → 7.2.0. pnpm stays at 12.8.1 until 12.8.2 is seven days old (2026-10-07 01:15 UTC); `@types/node` stays at 26.6.3 until 26.6.4 is seven days old (2026-10-08 22:39 UTC).
+
 ## 2026-10-06 - 32.50.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.50.0',
+    version: '32.51.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/deploymentlegacyimport.d.ts

@@ -4,8 +4,10 @@ import type { TImmutableContainerPlatform, TOciManifestMediaType, TSha256Digest
  * service already runs, instead of one built from a source revision.
  *
  * A legacy service without deployable source still has an image in Cloudly's registry and, until
- * its runtime is frozen, healthy replicas running it. An administrator captures that fact once as
- * a {@link ILegacyServiceRuntimeAttestation} while the replicas still run. A greenfield successor
+ * its runtime is frozen, replicas running it. An administrator observes those replicas on the
+ * hosts that run them ({@link ILegacyServiceHostObservation}) while they still run, and Cloudly
+ * captures that observation once as a {@link ILegacyServiceRuntimeAttestation} after it verified
+ * the observed root against its own registry. A greenfield successor
  * reservation names the attestation in `legacyImport` instead of a `sourceRevision`, and Cloudly
  * then imports the attested image into the successor's own repository and release tag itself:
  * the bytes never leave the registry and the release records that it was imported, not built.
@@ -44,18 +46,86 @@ export interface ILegacyServiceImageSource {
      */
     platforms: ILegacyImagePlatformManifest[];
 }
-/** One healthy replica of the legacy service, observed running the attested digest. */
+/**
+ * One replica of the legacy service, observed running the attested digest in its own stated
+ * health: healthy, or running with no healthcheck that could state one.
+ */
 export interface ILegacyServiceRuntimeTaskAttestation {
+    /** The replica's runtime identity: the Swarm task it was observed as. */
     deploymentId: string;
+    /** The hostname of the node the replica was observed on. */
     nodeName: string;
     observedDigest: TSha256Digest;
 }
+/**
+ * Where the runtime part of an attestation comes from. `administrator-host-observation`: an
+ * administrator read the legacy Swarm service and its containers on the hosts that run them, and
+ * Cloudly judged that observation against its own registry.
+ */
+export type TLegacyServiceRuntimeEvidenceSource = 'administrator-host-observation';
+/** A container's state as the Docker engine reports it (`State.Status`). */
+export type TLegacyHostContainerState = 'created' | 'running' | 'paused' | 'restarting' | 'removing' | 'exited' | 'dead';
+/**
+ * A container's health as the Docker engine reports it (`State.Health.Status`). `none`: no
+ * healthcheck applies to the container — the image declares none and the service adds none — so
+ * the engine reports no health state at all.
+ */
+export type TLegacyHostContainerHealth = 'healthy' | 'unhealthy' | 'starting' | 'none';
+/**
+ * The image store of the Docker engine that runs a container. On the `containerd` store a
+ * container's image id is the digest of the root it was pulled as; on the `classic` store it is
+ * the image configuration digest of the platform manifest the engine pulled.
+ */
+export type TLegacyHostImageStore = 'containerd' | 'classic';
+/** A Swarm service's mode (`Spec.Mode`): a replicated service states its desired replicas. */
+export type TLegacyHostSwarmServiceMode = {
+    kind: 'replicated';
+    desiredReplicas: number;
+} | {
+    kind: 'global';
+};
+/** One replica of a legacy Swarm service, as an administrator read it on the node that runs it. */
+export interface ILegacyHostReplicaObservation {
+    /** The hostname of the node the task runs on. */
+    nodeHostname: string;
+    /** The Swarm task id (25 lowercase base-36 characters). */
+    swarmTaskId: string;
+    /** The full container id of the task (64 lowercase hex characters). */
+    containerId: string;
+    imageStore: TLegacyHostImageStore;
+    /** The container's image id (`Image`), a sha256 digest. */
+    containerImageId: TSha256Digest;
+    /** The `RepoDigests` of the container's image, exactly as the engine lists them. */
+    imageRepoDigests: string[];
+    state: TLegacyHostContainerState;
+    health: TLegacyHostContainerHealth;
+}
+/**
+ * An administrator's observation of the legacy Swarm service of one legacy service and of every
+ * container its tasks run, read on the hosts while the legacy runtime still runs.
+ *
+ * It states facts, not conclusions: Cloudly judges it against its own registry
+ * ({@link judgeLegacyServiceHostObservation}) before it attests anything.
+ */
+export interface ILegacyServiceHostObservation {
+    /** The Swarm service name. */
+    swarmServiceName: string;
+    /** The image reference of the Swarm service spec (`Spec.TaskTemplate.ContainerSpec.Image`). */
+    specImage: string;
+    mode: TLegacyHostSwarmServiceMode;
+    /** When the administrator read the hosts, in milliseconds since the epoch. */
+    observedAt: number;
+    /** Every running task's replica, sorted by `swarmTaskId`. */
+    replicas: ILegacyHostReplicaObservation[];
+}
 /**
  * Durable evidence, captured by an administrator while the legacy runtime still ran, that every
- * required replica of a legacy service was healthy and ran exactly the registry root it names.
+ * desired replica of a legacy service ran, in its own stated health, exactly the registry root it
+ * names.
  *
  * Cloudly writes one and never changes it. A capture only succeeds on complete evidence, so a
- * stored attestation is by construction one whose runtime digest is its source root digest.
+ * stored attestation is by construction one whose runtime digest is its source root digest and
+ * whose runtime part is exactly the host observation it records.
  */
 export interface ILegacyServiceRuntimeAttestation {
     id: string;
@@ -64,11 +134,16 @@ export interface ILegacyServiceRuntimeAttestation {
         organizationId: string;
         source: ILegacyServiceImageSource;
         runtime: {
+            /** The desired replicas of the observed replicated Swarm service. */
             requiredReplicaCount: number;
+            /** Replicas observed running healthy, or running with no healthcheck (`health: 'none'`). */
             healthyReplicaCount: number;
             runtimeDigest: TSha256Digest;
-            /** Sorted by deploymentId, one per required replica. */
+            /** Sorted by deploymentId, one per required replica: the observed replicas. */
             tasks: ILegacyServiceRuntimeTaskAttestation[];
+            evidenceSource: TLegacyServiceRuntimeEvidenceSource;
+            /** The observation the runtime part was built from, as the administrator submitted it. */
+            hostObservation: ILegacyServiceHostObservation;
         };
         capturedByUserId: string;
         capturedAt: number;
@@ -89,4 +164,43 @@ export declare const isLegacyImagePlatformManifestMediaType: (valueArg: unknown)
 /** True when a media type names an index of either family. */
 export declare const isLegacyImageImportIndexMediaType: (valueArg: unknown) => valueArg is TLegacyImageImportIndexMediaType;
 export declare const validateLegacyImageImportReference: (referenceArg: unknown) => string[];
+/**
+ * The shape of a host observation: exact keys at every level, Docker's own value sets, at most 64
+ * replicas, unique and sorted by Swarm task id, each container observed once. It judges nothing
+ * against a registry; {@link judgeLegacyServiceHostObservation} does.
+ */
+export declare const validateLegacyServiceHostObservation: (observationArg: unknown, labelArg?: string) => string[];
+/** True when a value is a well-formed host observation. */
+export declare const isLegacyServiceHostObservation: (valueArg: unknown) => valueArg is ILegacyServiceHostObservation;
+/**
+ * The one root digest every observed replica runs from the legacy service's own repository, which
+ * is the digest Cloudly then inspects in its registry. Refused when a replica's root from that
+ * repository is unknown, when the replicas run more than one root, or when nothing was observed.
+ */
+export declare const selectLegacyServiceHostObservationRootDigest: (argsArg: {
+    observation: ILegacyServiceHostObservation;
+    registryHost: string;
+    repository: string;
+}) => {
+    rootDigest?: TSha256Digest;
+    errors: string[];
+};
+/**
+ * Judges a well-formed host observation against the registry source Cloudly inspected for it.
+ * Every rule an attestation's runtime part must meet:
+ *
+ * - the Swarm service is replicated, with at least one desired replica, and exactly its desired
+ *   replicas were observed;
+ * - its spec image names the source repository by the source tag, by the root digest, or by both;
+ * - every replica is `running`, and `healthy` or without a healthcheck (`none`) — `unhealthy` and
+ *   `starting` are refused;
+ * - every replica runs the source root from the source repository: its image lists
+ *   `registryHost/repository@rootDigest`, and its image id is the root digest on the containerd
+ *   store or one of the root's platform image configuration digests on the classic store.
+ */
+export declare const judgeLegacyServiceHostObservation: (argsArg: {
+    observation: ILegacyServiceHostObservation;
+    source: ILegacyServiceImageSource;
+    label?: string;
+}) => string[];
 export declare const validateLegacyServiceRuntimeAttestation: (attestationArg: unknown) => string[];

package/dist_ts/data/deploymentlegacyimport.js

@@ -1,5 +1,5 @@
 import { normalizeSha256Digest } from './immutableimage.js';
-import { hasExactKeys, isPlainRecord } from '../private/dataproperties.js';
+import { hasExactKeys, isPlainRecord, readDataElements, readDataProperties, } from '../private/dataproperties.js';
 const identifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
 /** An OCI tag, the mutable `latest` included: the source tag is whatever the legacy service ran. */
 const ociTagRegex = /^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$/;
@@ -16,6 +16,31 @@ const legacyImageImportIndexMediaTypes = [
     'application/vnd.docker.distribution.manifest.list.v2+json',
 ];
 const legacyImagePlatforms = ['linux/amd64', 'linux/arm64'];
+const legacyHostContainerStates = [
+    'created',
+    'running',
+    'paused',
+    'restarting',
+    'removing',
+    'exited',
+    'dead',
+];
+const legacyHostContainerHealths = [
+    'healthy',
+    'unhealthy',
+    'starting',
+    'none',
+];
+/** The health states a replica may be attested in: healthy, or no healthcheck at all. */
+const attestableLegacyHostContainerHealths = ['healthy', 'none'];
+const legacyHostImageStores = ['containerd', 'classic'];
+const swarmTaskIdRegex = /^[a-z0-9]{25}$/;
+const containerIdRegex = /^[0-9a-f]{64}$/;
+const swarmServiceNameRegex = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/;
+const nodeHostnameRegex = /^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+const imageReferenceRegex = /^\S{1,512}$/;
+const repoDigestRegex = /^[^\s@]{1,440}@sha256:[0-9a-f]{64}$/;
+const maximumRepoDigestCount = 32;
 const isIdentifier = (valueArg) => (typeof valueArg === 'string' && identifierRegex.test(valueArg));
 const isCanonicalDigest = (valueArg) => (typeof valueArg === 'string' && normalizeSha256Digest(valueArg) === valueArg);
 const isPositiveSafeInteger = (valueArg, maximumArg) => (typeof valueArg === 'number'
@@ -44,6 +69,232 @@ export const validateLegacyImageImportReference = (referenceArg) => {
     }
     return errors;
 };
+const validateHostReplicaObservation = (replicaArg, labelArg) => {
+    const replica = readDataProperties(replicaArg);
+    if (replica === null)
+        return [`${labelArg} must be a plain data object`];
+    const errors = [];
+    if (!hasExactKeys(replica, [
+        'nodeHostname',
+        'swarmTaskId',
+        'containerId',
+        'imageStore',
+        'containerImageId',
+        'imageRepoDigests',
+        'state',
+        'health',
+    ])) {
+        errors.push(`${labelArg} must use its exact schema`);
+    }
+    if (typeof replica.nodeHostname !== 'string' || !nodeHostnameRegex.test(replica.nodeHostname)) {
+        errors.push(`${labelArg}.nodeHostname must be a host name`);
+    }
+    if (typeof replica.swarmTaskId !== 'string' || !swarmTaskIdRegex.test(replica.swarmTaskId)) {
+        errors.push(`${labelArg}.swarmTaskId must be a Swarm task id`);
+    }
+    if (typeof replica.containerId !== 'string' || !containerIdRegex.test(replica.containerId)) {
+        errors.push(`${labelArg}.containerId must be a full container id`);
+    }
+    if (!legacyHostImageStores.some((storeArg) => storeArg === replica.imageStore)) {
+        errors.push(`${labelArg}.imageStore must be containerd or classic`);
+    }
+    if (!isCanonicalDigest(replica.containerImageId)) {
+        errors.push(`${labelArg}.containerImageId must be a canonical sha256 digest`);
+    }
+    const repoDigests = readDataElements(replica.imageRepoDigests, maximumRepoDigestCount);
+    if (repoDigests === null
+        || repoDigests.some((entryArg) => typeof entryArg !== 'string' || !repoDigestRegex.test(entryArg))
+        || new Set(repoDigests).size !== repoDigests.length) {
+        errors.push(`${labelArg}.imageRepoDigests must be unique digested image references`);
+    }
+    if (!legacyHostContainerStates.some((stateArg) => stateArg === replica.state)) {
+        errors.push(`${labelArg}.state must be a Docker container state`);
+    }
+    if (!legacyHostContainerHealths.some((healthArg) => healthArg === replica.health)) {
+        errors.push(`${labelArg}.health must be healthy, unhealthy, starting or none`);
+    }
+    return errors;
+};
+const validateHostSwarmServiceMode = (modeArg, labelArg) => {
+    const mode = readDataProperties(modeArg);
+    if (mode === null)
+        return [`${labelArg} must be a plain data object`];
+    if (mode.kind === 'global') {
+        return hasExactKeys(mode, ['kind']) ? [] : [`${labelArg} must use its exact schema`];
+    }
+    if (mode.kind !== 'replicated')
+        return [`${labelArg}.kind must be replicated or global`];
+    const errors = [];
+    if (!hasExactKeys(mode, ['kind', 'desiredReplicas'])) {
+        errors.push(`${labelArg} must use its exact schema`);
+    }
+    if (typeof mode.desiredReplicas !== 'number'
+        || !Number.isSafeInteger(mode.desiredReplicas)
+        || mode.desiredReplicas < 0
+        || mode.desiredReplicas > maximumReplicaCount) {
+        errors.push(`${labelArg}.desiredReplicas must be a bounded replica count`);
+    }
+    return errors;
+};
+/**
+ * The shape of a host observation: exact keys at every level, Docker's own value sets, at most 64
+ * replicas, unique and sorted by Swarm task id, each container observed once. It judges nothing
+ * against a registry; {@link judgeLegacyServiceHostObservation} does.
+ */
+export const validateLegacyServiceHostObservation = (observationArg, labelArg = 'hostObservation') => {
+    const observation = readDataProperties(observationArg);
+    if (observation === null)
+        return [`${labelArg} must be a plain data object`];
+    const errors = [];
+    if (!hasExactKeys(observation, ['swarmServiceName', 'specImage', 'mode', 'observedAt', 'replicas'])) {
+        errors.push(`${labelArg} must use its exact schema`);
+    }
+    if (typeof observation.swarmServiceName !== 'string'
+        || !swarmServiceNameRegex.test(observation.swarmServiceName)) {
+        errors.push(`${labelArg}.swarmServiceName must be a Swarm service name`);
+    }
+    if (typeof observation.specImage !== 'string' || !imageReferenceRegex.test(observation.specImage)) {
+        errors.push(`${labelArg}.specImage must be a bounded image reference`);
+    }
+    errors.push(...validateHostSwarmServiceMode(observation.mode, `${labelArg}.mode`));
+    if (!isPositiveSafeInteger(observation.observedAt, Number.MAX_SAFE_INTEGER)) {
+        errors.push(`${labelArg}.observedAt must be a positive timestamp`);
+    }
+    const replicas = readDataElements(observation.replicas, maximumReplicaCount);
+    if (replicas === null) {
+        errors.push(`${labelArg}.replicas must be a list of at most ${maximumReplicaCount} replicas`);
+        return errors;
+    }
+    replicas.forEach((replicaArg, indexArg) => {
+        errors.push(...validateHostReplicaObservation(replicaArg, `${labelArg}.replicas[${indexArg}]`));
+    });
+    const readReplicaKey = (replicaArg, keyArg) => (readDataProperties(replicaArg)?.[keyArg]);
+    const taskIds = replicas.map((replicaArg) => readReplicaKey(replicaArg, 'swarmTaskId'));
+    const sortedTaskIds = taskIds
+        .filter((idArg) => typeof idArg === 'string')
+        .sort();
+    if (new Set(taskIds).size !== taskIds.length
+        || JSON.stringify(taskIds) !== JSON.stringify(sortedTaskIds)) {
+        errors.push(`${labelArg}.replicas must be unique and sorted by swarmTaskId`);
+    }
+    const containerIds = replicas.map((replicaArg) => readReplicaKey(replicaArg, 'containerId'));
+    if (new Set(containerIds).size !== containerIds.length) {
+        errors.push(`${labelArg}.replicas must observe each container once`);
+    }
+    return errors;
+};
+/** True when a value is a well-formed host observation. */
+export const isLegacyServiceHostObservation = (valueArg) => (validateLegacyServiceHostObservation(valueArg).length === 0);
+/**
+ * The root digest one replica was pulled as from `registryHost/repository`.
+ *
+ * On the containerd store that is the container's image id, which the image's `RepoDigests` must
+ * list for the repository. On the classic store it is the one digest `RepoDigests` lists for the
+ * repository; none, or more than one, leaves the root unknown.
+ */
+const selectReplicaRootDigest = (replicaArg, repositoryReferenceArg) => {
+    const prefix = `${repositoryReferenceArg}@`;
+    const repositoryDigests = replicaArg.imageRepoDigests
+        .filter((entryArg) => entryArg.startsWith(prefix))
+        .map((entryArg) => normalizeSha256Digest(entryArg.slice(prefix.length)))
+        .filter((digestArg) => digestArg !== undefined);
+    if (replicaArg.imageStore === 'containerd') {
+        return repositoryDigests.includes(replicaArg.containerImageId)
+            ? replicaArg.containerImageId
+            : undefined;
+    }
+    return repositoryDigests.length === 1 ? repositoryDigests[0] : undefined;
+};
+/**
+ * The one root digest every observed replica runs from the legacy service's own repository, which
+ * is the digest Cloudly then inspects in its registry. Refused when a replica's root from that
+ * repository is unknown, when the replicas run more than one root, or when nothing was observed.
+ */
+export const selectLegacyServiceHostObservationRootDigest = (argsArg) => {
+    const repositoryReference = `${argsArg.registryHost}/${argsArg.repository}`;
+    const errors = [];
+    const roots = new Set();
+    argsArg.observation.replicas.forEach((replicaArg, indexArg) => {
+        const root = selectReplicaRootDigest(replicaArg, repositoryReference);
+        if (root === undefined) {
+            errors.push(replicaArg.imageStore === 'containerd'
+                ? `hostObservation.replicas[${indexArg}] image is not listed as ${repositoryReference}@<its image id>`
+                : `hostObservation.replicas[${indexArg}] image lists not exactly one digest of ${repositoryReference}`);
+            return;
+        }
+        roots.add(root);
+    });
+    if (argsArg.observation.replicas.length === 0) {
+        errors.push('hostObservation must observe at least one replica');
+    }
+    if (roots.size > 1) {
+        errors.push('hostObservation replicas run more than one root digest');
+    }
+    const [rootDigest] = [...roots];
+    return errors.length === 0 && rootDigest !== undefined ? { rootDigest, errors } : { errors };
+};
+/**
+ * Judges a well-formed host observation against the registry source Cloudly inspected for it.
+ * Every rule an attestation's runtime part must meet:
+ *
+ * - the Swarm service is replicated, with at least one desired replica, and exactly its desired
+ *   replicas were observed;
+ * - its spec image names the source repository by the source tag, by the root digest, or by both;
+ * - every replica is `running`, and `healthy` or without a healthcheck (`none`) — `unhealthy` and
+ *   `starting` are refused;
+ * - every replica runs the source root from the source repository: its image lists
+ *   `registryHost/repository@rootDigest`, and its image id is the root digest on the containerd
+ *   store or one of the root's platform image configuration digests on the classic store.
+ */
+export const judgeLegacyServiceHostObservation = (argsArg) => {
+    const label = argsArg.label ?? 'hostObservation';
+    const { observation, source } = argsArg;
+    const errors = [];
+    if (observation.mode.kind !== 'replicated') {
+        errors.push(`${label}.mode must be replicated: a legacy service runs as a replicated Swarm service`);
+    }
+    else if (observation.mode.desiredReplicas < 1) {
+        errors.push(`${label}.mode must desire at least one replica`);
+    }
+    else if (observation.replicas.length !== observation.mode.desiredReplicas) {
+        errors.push(`${label} must observe exactly the ${observation.mode.desiredReplicas} desired replicas`);
+    }
+    const repositoryReference = `${source.registryHost}/${source.repository}`;
+    const specImages = [
+        `${repositoryReference}:${source.tag}`,
+        `${repositoryReference}@${source.rootDigest}`,
+        `${repositoryReference}:${source.tag}@${source.rootDigest}`,
+    ];
+    if (!specImages.includes(observation.specImage)) {
+        errors.push(`${label}.specImage must name ${repositoryReference} by its source tag or root digest`);
+    }
+    const imageConfigDigests = source.platforms.map((platformArg) => platformArg.imageConfigDigest);
+    observation.replicas.forEach((replicaArg, indexArg) => {
+        const replicaLabel = `${label}.replicas[${indexArg}]`;
+        if (replicaArg.state !== 'running') {
+            errors.push(`${replicaLabel}.state must be running`);
+        }
+        if (!attestableLegacyHostContainerHealths.includes(replicaArg.health)) {
+            errors.push(`${replicaLabel}.health must be healthy or none`);
+        }
+        if (!replicaArg.imageRepoDigests.includes(`${repositoryReference}@${source.rootDigest}`)) {
+            errors.push(`${replicaLabel} image must be ${repositoryReference}@${source.rootDigest}`);
+        }
+        if (replicaArg.imageStore === 'containerd') {
+            if (replicaArg.containerImageId !== source.rootDigest) {
+                errors.push(`${replicaLabel}.containerImageId must be the root digest on the containerd image store`);
+            }
+            return;
+        }
+        if (!imageConfigDigests.includes(replicaArg.containerImageId)) {
+            errors.push(`${replicaLabel}.containerImageId must be a platform image configuration digest of the root on the classic image store`);
+        }
+        if (selectReplicaRootDigest(replicaArg, repositoryReference) === undefined) {
+            errors.push(`${replicaLabel} image must list exactly one digest of ${repositoryReference} on the classic image store`);
+        }
+    });
+    return errors;
+};
 const validatePlatformManifest = (manifestArg, indexArg) => {
     const label = `source.platforms[${indexArg}]`;
     if (!isPlainRecord(manifestArg))
@@ -137,18 +388,51 @@ const validateImageSource = (sourceArg) => {
     }
     return errors;
 };
-const validateRuntime = (runtimeArg, rootDigestArg) => {
+const isLegacyServiceImageSource = (valueArg) => (validateImageSource(valueArg).length === 0);
+const validateRuntime = (runtimeArg, sourceArg) => {
     if (!isPlainRecord(runtimeArg))
         return ['runtime must be an object'];
+    const rootDigest = isPlainRecord(sourceArg) ? sourceArg.rootDigest : undefined;
     const errors = [];
     if (!hasExactKeys(runtimeArg, [
         'requiredReplicaCount',
         'healthyReplicaCount',
         'runtimeDigest',
         'tasks',
+        'evidenceSource',
+        'hostObservation',
     ])) {
         errors.push('runtime must use its exact schema');
     }
+    if (runtimeArg.evidenceSource !== 'administrator-host-observation') {
+        errors.push('runtime.evidenceSource must be administrator-host-observation');
+    }
+    const hostObservation = runtimeArg.hostObservation;
+    const observationErrors = validateLegacyServiceHostObservation(hostObservation, 'runtime.hostObservation');
+    errors.push(...observationErrors);
+    if (observationErrors.length === 0
+        && isLegacyServiceHostObservation(hostObservation)
+        && isLegacyServiceImageSource(sourceArg)) {
+        errors.push(...judgeLegacyServiceHostObservation({
+            observation: hostObservation,
+            source: sourceArg,
+            label: 'runtime.hostObservation',
+        }));
+        if (hostObservation.mode.kind === 'replicated'
+            && runtimeArg.requiredReplicaCount !== hostObservation.mode.desiredReplicas) {
+            errors.push('runtime.requiredReplicaCount must be the observed desired replicas');
+        }
+        const recordedTasks = readDataElements(runtimeArg.tasks, maximumReplicaCount) ?? [];
+        if (recordedTasks.length !== hostObservation.replicas.length
+            || hostObservation.replicas.some((replicaArg, indexArg) => {
+                const task = recordedTasks[indexArg];
+                return !isPlainRecord(task)
+                    || task.deploymentId !== replicaArg.swarmTaskId
+                    || task.nodeName !== replicaArg.nodeHostname;
+            })) {
+            errors.push('runtime.tasks must be the observed replicas: each Swarm task on its node');
+        }
+    }
     if (!isPositiveSafeInteger(runtimeArg.requiredReplicaCount, maximumReplicaCount)) {
         errors.push('runtime.requiredReplicaCount must be a positive bounded replica count');
     }
@@ -158,7 +442,7 @@ const validateRuntime = (runtimeArg, rootDigestArg) => {
     if (!isCanonicalDigest(runtimeArg.runtimeDigest)) {
         errors.push('runtime.runtimeDigest must be a canonical sha256 digest');
     }
-    else if (runtimeArg.runtimeDigest !== rootDigestArg) {
+    else if (runtimeArg.runtimeDigest !== rootDigest) {
         errors.push('runtime.runtimeDigest must be the attested source root digest');
     }
     if (!Array.isArray(runtimeArg.tasks) || runtimeArg.tasks.length !== runtimeArg.requiredReplicaCount) {
@@ -231,7 +515,7 @@ export const validateLegacyServiceRuntimeAttestation = (attestationArg) => {
         errors.push('capturedAt must be a positive timestamp');
     }
     errors.push(...validateImageSource(data.source));
-    errors.push(...validateRuntime(data.runtime, isPlainRecord(data.source) ? data.source.rootDigest : undefined));
+    errors.push(...validateRuntime(data.runtime, data.source));
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudGxlZ2FjeWltcG9ydC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudGxlZ2FjeWltcG9ydC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUM1RCxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBbUczRSxNQUFNLGVBQWUsR0FBRyxxQ0FBcUMsQ0FBQztBQUM5RCxvR0FBb0c7QUFDcEcsTUFBTSxXQUFXLEdBQUcscUNBQXFDLENBQUM7QUFDMUQsTUFBTSxpQkFBaUIsR0FBRywwREFBMEQsQ0FBQztBQUNyRixNQUFNLGVBQWUsR0FBRyxxRkFBcUYsQ0FBQztBQUM5RyxNQUFNLG1CQUFtQixHQUFHLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxDQUFDO0FBQzVDLE1BQU0sbUJBQW1CLEdBQUcsRUFBRSxDQUFDO0FBRS9CLE1BQU0scUNBQXFDLEdBQXFEO0lBQzlGLDRDQUE0QztJQUM1QyxzREFBc0Q7Q0FDdkQsQ0FBQztBQUNGLE1BQU0sZ0NBQWdDLEdBQWdEO0lBQ3BGLHlDQUF5QztJQUN6QywyREFBMkQ7Q0FDNUQsQ0FBQztBQUNGLE1BQU0sb0JBQW9CLEdBQTJDLENBQUMsYUFBYSxFQUFFLGFBQWEsQ0FBQyxDQUFDO0FBRXBHLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQzlELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUMvRCxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FBQyxDQUMxRSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUJBQXFCLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUSxDQUM3RSxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsVUFBa0IsRUFBc0IsRUFBRSxDQUFDLENBQzNGLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDekIsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7T0FDOUIsUUFBUSxJQUFJLENBQUM7T0FDYixRQUFRLElBQUksVUFBVSxDQUMxQixDQUFDO0FBRUYsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQ3BELFFBQWlCLEVBQ2tDLEVBQUUsQ0FBQyxDQUN0RCxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVksS0FBSyxRQUFRLENBQUMsQ0FDeEYsQ0FBQztBQUVGLDhEQUE4RDtBQUM5RCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUMvQyxRQUFpQixFQUM2QixFQUFFLENBQUMsQ0FDakQsZ0NBQWdDLENBQUMsSUFBSSxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyxZQUFZLEtBQUssUUFBUSxDQUFDLENBQ25GLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLFlBQXFCLEVBQVksRUFBRTtJQUNwRixJQUFJLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQztRQUFFLE9BQU8sQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO0lBQzVFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksRUFBRSxDQUFDLGlCQUFpQixFQUFFLGVBQWUsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMxRixNQUFNLENBQUMsSUFBSSxDQUFDLHdDQUF3QyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1FBQzlDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLHdCQUF3QixHQUFHLENBQy9CLFdBQW9CLEVBQ3BCLFFBQWdCLEVBQ04sRUFBRTtJQUNaLE1BQU0sS0FBSyxHQUFHLG9CQUFvQixRQUFRLEdBQUcsQ0FBQztJQUM5QyxJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQztRQUFFLE9BQU8sQ0FBQyxHQUFHLEtBQUssb0JBQW9CLENBQUMsQ0FBQztJQUN2RSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUU7UUFDN0IsVUFBVTtRQUNWLGdCQUFnQjtRQUNoQixtQkFBbUI7UUFDbkIsY0FBYztRQUNkLG1CQUFtQjtLQUNwQixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLDRCQUE0QixDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUNELElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLFdBQVcsS0FBSyxXQUFXLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUN0RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsV0FBVyxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7UUFDbkQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssbURBQW1ELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHNDQUFzQyxDQUFDLFdBQVcsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssOERBQThELENBQUMsQ0FBQztJQUN0RixDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxZQUFZLEVBQUUsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLHNEQUFzRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxXQUFXLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO1FBQ3RELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLHNEQUFzRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxTQUFrQixFQUFZLEVBQUU7SUFDM0QsSUFBSSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUM7UUFBRSxPQUFPLENBQUMsMEJBQTBCLENBQUMsQ0FBQztJQUNuRSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUU7UUFDM0IsY0FBYztRQUNkLFlBQVk7UUFDWixLQUFLO1FBQ0wsWUFBWTtRQUNaLGVBQWU7UUFDZixXQUFXO0tBQ1osQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELElBQUksT0FBTyxTQUFTLENBQUMsWUFBWSxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUNsRyxNQUFNLENBQUMsSUFBSSxDQUFDLHVEQUF1RCxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksT0FBTyxTQUFTLENBQUMsVUFBVSxLQUFLLFFBQVE7V0FDdkMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUNqQyxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLE9BQU8sU0FBUyxDQUFDLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0JBQStCLENBQUMsQ0FBQztJQUMvQyxDQUFDO0lBQ0QsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQzdDLE1BQU0sQ0FBQyxJQUFJLENBQUMscURBQXFELENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsc0NBQXNDLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQ3ZGLE1BQU0sV0FBVyxHQUFHLGlDQUFpQyxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMvRSxJQUFJLENBQUMsY0FBYyxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDcEMsTUFBTSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDO1dBQ2xDLFNBQVMsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDOUIsU0FBUyxDQUFDLFNBQVMsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO1FBQy9FLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxTQUFTLENBQUMsU0FBc0IsQ0FBQztJQUNuRCxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUMsV0FBVyxFQUFFLFFBQVEsRUFBRSxFQUFFO1FBQzFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx3QkFBd0IsQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQztJQUNsRSxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sYUFBYSxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQ25ELGFBQWEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUM5RCxDQUFDLENBQUM7SUFDSCxNQUFNLG1CQUFtQixHQUFHLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FDdkUsYUFBYSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FDcEMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQzFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0RBQXdELENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQ0QsSUFBSSxjQUFjLEVBQUUsQ0FBQztRQUNuQixNQUFNLFlBQVksR0FBRyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDbEMsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDckIsQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDO2VBQzVCLFlBQVksQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLFVBQVU7ZUFDcEQsWUFBWSxDQUFDLGlCQUFpQixLQUFLLFNBQVMsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7UUFDckYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFdBQVcsSUFBSSxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUNqRCxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsVUFBVSxDQUNsRixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxVQUFtQixFQUFFLGFBQXNCLEVBQVksRUFBRTtJQUNoRixJQUFJLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQztRQUFFLE9BQU8sQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO0lBQ3JFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLFVBQVUsRUFBRTtRQUM1QixzQkFBc0I7UUFDdEIscUJBQXFCO1FBQ3JCLGVBQWU7UUFDZixPQUFPO0tBQ1IsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFtQyxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsb0JBQW9CLEVBQUUsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQ2pGLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsbUJBQW1CLEtBQUssVUFBVSxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7U0FBTSxJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssYUFBYSxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssVUFBVSxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDcEcsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO1FBQzdFLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBa0IsQ0FBQztJQUM1QyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFO1FBQ2xDLE1BQU0sS0FBSyxHQUFHLGlCQUFpQixRQUFRLEdBQUcsQ0FBQztRQUMzQyxJQUFJLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDNUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssb0JBQW9CLENBQUMsQ0FBQztZQUMxQyxPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyw0QkFBNEIsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLHNEQUFzRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7WUFDL0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssNENBQTRDLENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLFVBQVUsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN4RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxxREFBcUQsQ0FBQyxDQUFDO1FBQzdFLENBQUM7SUFDSCxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sYUFBYSxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQzNDLGFBQWEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUMxRCxDQUFDLENBQUM7SUFDSCxNQUFNLG1CQUFtQixHQUFHLGFBQWE7U0FDdEMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFtQixFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDO1NBQzdELElBQUksRUFBRSxDQUFDO0lBQ1YsSUFBSSxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsQ0FBQyxJQUFJLEtBQUssYUFBYSxDQUFDLE1BQU07V0FDbkQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVDQUF1QyxHQUFHLENBQUMsY0FBdUIsRUFBWSxFQUFFO0lBQzNGLElBQUksQ0FBQyxhQUFhLENBQUMsY0FBYyxDQUFDO1FBQUUsT0FBTyxDQUFDLCtCQUErQixDQUFDLENBQUM7SUFDN0UsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxFQUFFLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDckMsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDO0lBQ2pDLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDO1FBQUUsT0FBTyxDQUFDLEdBQUcsTUFBTSxFQUFFLHdCQUF3QixDQUFDLENBQUM7SUFDdkUsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUU7UUFDdEIsaUJBQWlCO1FBQ2pCLGdCQUFnQjtRQUNoQixRQUFRO1FBQ1IsU0FBUztRQUNULGtCQUFrQjtRQUNsQixZQUFZO0tBQ2IsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSxDQUM1QixJQUFJLENBQUMsT0FBTyxFQUNaLGFBQWEsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQ2hFLENBQUMsQ0FBQztJQUNILE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudGxlZ2FjeWltcG9ydC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2RhdGEvZGVwbG95bWVudGxlZ2FjeWltcG9ydC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFLQSxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUM1RCxPQUFPLEVBQ0wsWUFBWSxFQUNaLGFBQWEsRUFDYixnQkFBZ0IsRUFDaEIsa0JBQWtCLEdBQ25CLE1BQU0sOEJBQThCLENBQUM7QUF5THRDLE1BQU0sZUFBZSxHQUFHLHFDQUFxQyxDQUFDO0FBQzlELG9HQUFvRztBQUNwRyxNQUFNLFdBQVcsR0FBRyxxQ0FBcUMsQ0FBQztBQUMxRCxNQUFNLGlCQUFpQixHQUFHLDBEQUEwRCxDQUFDO0FBQ3JGLE1BQU0sZUFBZSxHQUFHLHFGQUFxRixDQUFDO0FBQzlHLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxHQUFHLElBQUksR0FBRyxJQUFJLENBQUM7QUFDNUMsTUFBTSxtQkFBbUIsR0FBRyxFQUFFLENBQUM7QUFFL0IsTUFBTSxxQ0FBcUMsR0FBcUQ7SUFDOUYsNENBQTRDO0lBQzVDLHNEQUFzRDtDQUN2RCxDQUFDO0FBQ0YsTUFBTSxnQ0FBZ0MsR0FBZ0Q7SUFDcEYseUNBQXlDO0lBQ3pDLDJEQUEyRDtDQUM1RCxDQUFDO0FBQ0YsTUFBTSxvQkFBb0IsR0FBMkMsQ0FBQyxhQUFhLEVBQUUsYUFBYSxDQUFDLENBQUM7QUFDcEcsTUFBTSx5QkFBeUIsR0FBeUM7SUFDdEUsU0FBUztJQUNULFNBQVM7SUFDVCxRQUFRO0lBQ1IsWUFBWTtJQUNaLFVBQVU7SUFDVixRQUFRO0lBQ1IsTUFBTTtDQUNQLENBQUM7QUFDRixNQUFNLDBCQUEwQixHQUEwQztJQUN4RSxTQUFTO0lBQ1QsV0FBVztJQUNYLFVBQVU7SUFDVixNQUFNO0NBQ1AsQ0FBQztBQUNGLHlGQUF5RjtBQUN6RixNQUFNLG9DQUFvQyxHQUEwQyxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQztBQUN4RyxNQUFNLHFCQUFxQixHQUFxQyxDQUFDLFlBQVksRUFBRSxTQUFTLENBQUMsQ0FBQztBQUMxRixNQUFNLGdCQUFnQixHQUFHLGdCQUFnQixDQUFDO0FBQzFDLE1BQU0sZ0JBQWdCLEdBQUcsZ0JBQWdCLENBQUM7QUFDMUMsTUFBTSxxQkFBcUIsR0FBRyxtQ0FBbUMsQ0FBQztBQUNsRSxNQUFNLGlCQUFpQixHQUFHLGtIQUFrSCxDQUFDO0FBQzdJLE1BQU0sbUJBQW1CLEdBQUcsYUFBYSxDQUFDO0FBQzFDLE1BQU0sZUFBZSxHQUFHLHFDQUFxQyxDQUFDO0FBQzlELE1BQU0sc0JBQXNCLEdBQUcsRUFBRSxDQUFDO0FBRWxDLE1BQU0sWUFBWSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQzlELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUMvRCxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQTZCLEVBQUUsQ0FBQyxDQUMxRSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUkscUJBQXFCLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUSxDQUM3RSxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsVUFBa0IsRUFBc0IsRUFBRSxDQUFDLENBQzNGLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDekIsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUM7T0FDOUIsUUFBUSxJQUFJLENBQUM7T0FDYixRQUFRLElBQUksVUFBVSxDQUMxQixDQUFDO0FBRUYsb0ZBQW9GO0FBQ3BGLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQ3BELFFBQWlCLEVBQ2tDLEVBQUUsQ0FBQyxDQUN0RCxxQ0FBcUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxZQUFZLEVBQUUsRUFBRSxDQUFDLFlBQVksS0FBSyxRQUFRLENBQUMsQ0FDeEYsQ0FBQztBQUVGLDhEQUE4RDtBQUM5RCxNQUFNLENBQUMsTUFBTSxpQ0FBaUMsR0FBRyxDQUMvQyxRQUFpQixFQUM2QixFQUFFLENBQUMsQ0FDakQsZ0NBQWdDLENBQUMsSUFBSSxDQUFDLENBQUMsWUFBWSxFQUFFLEVBQUUsQ0FBQyxZQUFZLEtBQUssUUFBUSxDQUFDLENBQ25GLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUFDLFlBQXFCLEVBQVksRUFBRTtJQUNwRixJQUFJLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQztRQUFFLE9BQU8sQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO0lBQzVFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksRUFBRSxDQUFDLGlCQUFpQixFQUFFLGVBQWUsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMxRixNQUFNLENBQUMsSUFBSSxDQUFDLHdDQUF3QyxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1FBQzlDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLDhCQUE4QixHQUFHLENBQ3JDLFVBQW1CLEVBQ25CLFFBQWdCLEVBQ04sRUFBRTtJQUNaLE1BQU0sT0FBTyxHQUFHLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQy9DLElBQUksT0FBTyxLQUFLLElBQUk7UUFBRSxPQUFPLENBQUMsR0FBRyxRQUFRLDhCQUE4QixDQUFDLENBQUM7SUFDekUsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFO1FBQ3pCLGNBQWM7UUFDZCxhQUFhO1FBQ2IsYUFBYTtRQUNiLFlBQVk7UUFDWixrQkFBa0I7UUFDbEIsa0JBQWtCO1FBQ2xCLE9BQU87UUFDUCxRQUFRO0tBQ1QsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDOUYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsbUNBQW1DLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxXQUFXLEtBQUssUUFBUSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQzNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLHNDQUFzQyxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELElBQUksT0FBTyxPQUFPLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUMzRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSwwQ0FBMEMsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7SUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLEtBQUssT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsMkNBQTJDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEscURBQXFELENBQUMsQ0FBQztJQUNoRixDQUFDO0lBQ0QsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLGdCQUFnQixFQUFFLHNCQUFzQixDQUFDLENBQUM7SUFDdkYsSUFBSSxXQUFXLEtBQUssSUFBSTtXQUNuQixXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1dBQy9GLElBQUksR0FBRyxDQUFDLFdBQVcsQ0FBQyxDQUFDLElBQUksS0FBSyxXQUFXLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsNERBQTRELENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxLQUFLLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLHlDQUF5QyxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksQ0FBQywwQkFBMEIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsS0FBSyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUNsRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSxzREFBc0QsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLDRCQUE0QixHQUFHLENBQUMsT0FBZ0IsRUFBRSxRQUFnQixFQUFZLEVBQUU7SUFDcEYsTUFBTSxJQUFJLEdBQUcsa0JBQWtCLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDekMsSUFBSSxJQUFJLEtBQUssSUFBSTtRQUFFLE9BQU8sQ0FBQyxHQUFHLFFBQVEsOEJBQThCLENBQUMsQ0FBQztJQUN0RSxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDM0IsT0FBTyxZQUFZLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsUUFBUSw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3ZGLENBQUM7SUFDRCxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssWUFBWTtRQUFFLE9BQU8sQ0FBQyxHQUFHLFFBQVEsb0NBQW9DLENBQUMsQ0FBQztJQUN6RixNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxNQUFNLEVBQUUsaUJBQWlCLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDckQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsNEJBQTRCLENBQUMsQ0FBQztJQUN2RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLElBQUksQ0FBQyxlQUFlLEtBQUssUUFBUTtXQUN2QyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQztXQUMzQyxJQUFJLENBQUMsZUFBZSxHQUFHLENBQUM7V0FDeEIsSUFBSSxDQUFDLGVBQWUsR0FBRyxtQkFBbUIsRUFBRSxDQUFDO1FBQ2hELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLGtEQUFrRCxDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxDQUNsRCxjQUF1QixFQUN2QixRQUFRLEdBQUcsaUJBQWlCLEVBQ2xCLEVBQUU7SUFDWixNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUN2RCxJQUFJLFdBQVcsS0FBSyxJQUFJO1FBQUUsT0FBTyxDQUFDLEdBQUcsUUFBUSw4QkFBOEIsQ0FBQyxDQUFDO0lBQzdFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDLGtCQUFrQixFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNwRyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFDRCxJQUFJLE9BQU8sV0FBVyxDQUFDLGdCQUFnQixLQUFLLFFBQVE7V0FDL0MsQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSxnREFBZ0QsQ0FBQyxDQUFDO0lBQzNFLENBQUM7SUFDRCxJQUFJLE9BQU8sV0FBVyxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDbEcsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsOENBQThDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLDRCQUE0QixDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsR0FBRyxRQUFRLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDbkYsSUFBSSxDQUFDLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxVQUFVLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUM1RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSwwQ0FBMEMsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7SUFDRCxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsUUFBUSxFQUFFLG1CQUFtQixDQUFDLENBQUM7SUFDN0UsSUFBSSxRQUFRLEtBQUssSUFBSSxFQUFFLENBQUM7UUFDdEIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFFBQVEsdUNBQXVDLG1CQUFtQixXQUFXLENBQUMsQ0FBQztRQUM5RixPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFVBQVUsRUFBRSxRQUFRLEVBQUUsRUFBRTtRQUN4QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsOEJBQThCLENBQUMsVUFBVSxFQUFFLEdBQUcsUUFBUSxhQUFhLFFBQVEsR0FBRyxDQUFDLENBQUMsQ0FBQztJQUNsRyxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sY0FBYyxHQUFHLENBQUMsVUFBbUIsRUFBRSxNQUFjLEVBQVcsRUFBRSxDQUFDLENBQ3ZFLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLENBQ3pDLENBQUM7SUFDRixNQUFNLE9BQU8sR0FBRyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxjQUFjLENBQUMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDeEYsTUFBTSxhQUFhLEdBQUcsT0FBTztTQUMxQixNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQW1CLEVBQUUsQ0FBQyxPQUFPLEtBQUssS0FBSyxRQUFRLENBQUM7U0FDN0QsSUFBSSxFQUFFLENBQUM7SUFDVixJQUFJLElBQUksR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsTUFBTTtXQUN2QyxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztRQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsUUFBUSxvREFBb0QsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxjQUFjLENBQUMsVUFBVSxFQUFFLGFBQWEsQ0FBQyxDQUFDLENBQUM7SUFDN0YsSUFBSSxJQUFJLEdBQUcsQ0FBQyxZQUFZLENBQUMsQ0FBQyxJQUFJLEtBQUssWUFBWSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3ZELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxRQUFRLDRDQUE0QyxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLDJEQUEyRDtBQUMzRCxNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxRQUFpQixFQUMwQixFQUFFLENBQUMsQ0FDOUMsb0NBQW9DLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FDNUQsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sdUJBQXVCLEdBQUcsQ0FDOUIsVUFBeUMsRUFDekMsc0JBQThCLEVBQ0gsRUFBRTtJQUM3QixNQUFNLE1BQU0sR0FBRyxHQUFHLHNCQUFzQixHQUFHLENBQUM7SUFDNUMsTUFBTSxpQkFBaUIsR0FBRyxVQUFVLENBQUMsZ0JBQWdCO1NBQ2xELE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztTQUNqRCxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7U0FDdkUsTUFBTSxDQUFDLENBQUMsU0FBUyxFQUE4QixFQUFFLENBQUMsU0FBUyxLQUFLLFNBQVMsQ0FBQyxDQUFDO0lBQzlFLElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxZQUFZLEVBQUUsQ0FBQztRQUMzQyxPQUFPLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLENBQUM7WUFDNUQsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0I7WUFDN0IsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNoQixDQUFDO0lBQ0QsT0FBTyxpQkFBaUIsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQzNFLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSw0Q0FBNEMsR0FBRyxDQUFDLE9BSTVELEVBQW9ELEVBQUU7SUFDckQsTUFBTSxtQkFBbUIsR0FBRyxHQUFHLE9BQU8sQ0FBQyxZQUFZLElBQUksT0FBTyxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQzVFLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBaUIsQ0FBQztJQUN2QyxPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxVQUFVLEVBQUUsUUFBUSxFQUFFLEVBQUU7UUFDNUQsTUFBTSxJQUFJLEdBQUcsdUJBQXVCLENBQUMsVUFBVSxFQUFFLG1CQUFtQixDQUFDLENBQUM7UUFDdEUsSUFBSSxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDdkIsTUFBTSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxLQUFLLFlBQVk7Z0JBQ2hELENBQUMsQ0FBQyw0QkFBNEIsUUFBUSw0QkFBNEIsbUJBQW1CLGlCQUFpQjtnQkFDdEcsQ0FBQyxDQUFDLDRCQUE0QixRQUFRLDJDQUEyQyxtQkFBbUIsRUFBRSxDQUFDLENBQUM7WUFDMUcsT0FBTztRQUNULENBQUM7UUFDRCxLQUFLLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ2xCLENBQUMsQ0FBQyxDQUFDO0lBQ0gsSUFBSSxPQUFPLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDOUMsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLEtBQUssQ0FBQyxJQUFJLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDbkIsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxNQUFNLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEtBQUssQ0FBQyxDQUFDO0lBQ2hDLE9BQU8sTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksVUFBVSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUM7QUFDL0YsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FBQyxPQUlqRCxFQUFZLEVBQUU7SUFDYixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxJQUFJLGlCQUFpQixDQUFDO0lBQ2pELE1BQU0sRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEdBQUcsT0FBTyxDQUFDO0lBQ3hDLE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFdBQVcsQ0FBQyxJQUFJLENBQUMsSUFBSSxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQzNDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLCtFQUErRSxDQUFDLENBQUM7SUFDdkcsQ0FBQztTQUFNLElBQUksV0FBVyxDQUFDLElBQUksQ0FBQyxlQUFlLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssd0NBQXdDLENBQUMsQ0FBQztJQUNoRSxDQUFDO1NBQU0sSUFBSSxXQUFXLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxXQUFXLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQzVFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLDZCQUE2QixXQUFXLENBQUMsSUFBSSxDQUFDLGVBQWUsbUJBQW1CLENBQUMsQ0FBQztJQUN4RyxDQUFDO0lBQ0QsTUFBTSxtQkFBbUIsR0FBRyxHQUFHLE1BQU0sQ0FBQyxZQUFZLElBQUksTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQzFFLE1BQU0sVUFBVSxHQUFHO1FBQ2pCLEdBQUcsbUJBQW1CLElBQUksTUFBTSxDQUFDLEdBQUcsRUFBRTtRQUN0QyxHQUFHLG1CQUFtQixJQUFJLE1BQU0sQ0FBQyxVQUFVLEVBQUU7UUFDN0MsR0FBRyxtQkFBbUIsSUFBSSxNQUFNLENBQUMsR0FBRyxJQUFJLE1BQU0sQ0FBQyxVQUFVLEVBQUU7S0FDNUQsQ0FBQztJQUNGLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ2hELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLHdCQUF3QixtQkFBbUIsbUNBQW1DLENBQUMsQ0FBQztJQUN0RyxDQUFDO0lBQ0QsTUFBTSxrQkFBa0IsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLGlCQUFpQixDQUFDLENBQUM7SUFDaEcsV0FBVyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxVQUFVLEVBQUUsUUFBUSxFQUFFLEVBQUU7UUFDcEQsTUFBTSxZQUFZLEdBQUcsR0FBRyxLQUFLLGFBQWEsUUFBUSxHQUFHLENBQUM7UUFDdEQsSUFBSSxVQUFVLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxZQUFZLHdCQUF3QixDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUNELElBQUksQ0FBQyxvQ0FBb0MsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDdEUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFlBQVksaUNBQWlDLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsR0FBRyxtQkFBbUIsSUFBSSxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3pGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxZQUFZLGtCQUFrQixtQkFBbUIsSUFBSSxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxVQUFVLENBQUMsVUFBVSxLQUFLLFlBQVksRUFBRSxDQUFDO1lBQzNDLElBQUksVUFBVSxDQUFDLGdCQUFnQixLQUFLLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztnQkFDdEQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFlBQVkseUVBQXlFLENBQUMsQ0FBQztZQUN4RyxDQUFDO1lBQ0QsT0FBTztRQUNULENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7WUFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLFlBQVksd0dBQXdHLENBQUMsQ0FBQztRQUN2SSxDQUFDO1FBQ0QsSUFBSSx1QkFBdUIsQ0FBQyxVQUFVLEVBQUUsbUJBQW1CLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsWUFBWSwwQ0FBMEMsbUJBQW1CLDZCQUE2QixDQUFDLENBQUM7UUFDekgsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSx3QkFBd0IsR0FBRyxDQUMvQixXQUFvQixFQUNwQixRQUFnQixFQUNOLEVBQUU7SUFDWixNQUFNLEtBQUssR0FBRyxvQkFBb0IsUUFBUSxHQUFHLENBQUM7SUFDOUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLENBQUM7UUFBRSxPQUFPLENBQUMsR0FBRyxLQUFLLG9CQUFvQixDQUFDLENBQUM7SUFDdkUsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFO1FBQzdCLFVBQVU7UUFDVixnQkFBZ0I7UUFDaEIsbUJBQW1CO1FBQ25CLGNBQWM7UUFDZCxtQkFBbUI7S0FDcEIsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFDRCxJQUFJLENBQUMsb0JBQW9CLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxXQUFXLEtBQUssV0FBVyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssOENBQThDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLG1EQUFtRCxDQUFDLENBQUM7SUFDM0UsQ0FBQztJQUNELElBQUksQ0FBQyxzQ0FBc0MsQ0FBQyxXQUFXLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLDhEQUE4RCxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsWUFBWSxFQUFFLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxzREFBc0QsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsV0FBVyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztRQUN0RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxzREFBc0QsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLG1CQUFtQixHQUFHLENBQUMsU0FBa0IsRUFBWSxFQUFFO0lBQzNELElBQUksQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDO1FBQUUsT0FBTyxDQUFDLDBCQUEwQixDQUFDLENBQUM7SUFDbkUsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFO1FBQzNCLGNBQWM7UUFDZCxZQUFZO1FBQ1osS0FBSztRQUNMLFlBQVk7UUFDWixlQUFlO1FBQ2YsV0FBVztLQUNaLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxJQUFJLE9BQU8sU0FBUyxDQUFDLFlBQVksS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDbEcsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxJQUFJLE9BQU8sU0FBUyxDQUFDLFVBQVUsS0FBSyxRQUFRO1dBQ3ZDLFNBQVMsQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLEdBQUc7V0FDakMsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsMkRBQTJELENBQUMsQ0FBQztJQUMzRSxDQUFDO0lBQ0QsSUFBSSxPQUFPLFNBQVMsQ0FBQyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLCtCQUErQixDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUM3QyxNQUFNLENBQUMsSUFBSSxDQUFDLHFEQUFxRCxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUNELE1BQU0sY0FBYyxHQUFHLHNDQUFzQyxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUN2RixNQUFNLFdBQVcsR0FBRyxpQ0FBaUMsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDL0UsSUFBSSxDQUFDLGNBQWMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQztXQUNsQyxTQUFTLENBQUMsU0FBUyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQzlCLFNBQVMsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzlELE1BQU0sQ0FBQyxJQUFJLENBQUMsaUVBQWlFLENBQUMsQ0FBQztRQUMvRSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQUcsU0FBUyxDQUFDLFNBQXNCLENBQUM7SUFDbkQsU0FBUyxDQUFDLE9BQU8sQ0FBQyxDQUFDLFdBQVcsRUFBRSxRQUFRLEVBQUUsRUFBRTtRQUMxQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsd0JBQXdCLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDbEUsQ0FBQyxDQUFDLENBQUM7SUFDSCxNQUFNLGFBQWEsR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUNuRCxhQUFhLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FDOUQsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxtQkFBbUIsR0FBRyxvQkFBb0IsQ0FBQyxNQUFNLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQ3ZFLGFBQWEsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQ3BDLENBQUMsQ0FBQztJQUNILElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdEQUF3RCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksY0FBYyxFQUFFLENBQUM7UUFDbkIsTUFBTSxZQUFZLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2xDLElBQUksU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ3JCLENBQUMsYUFBYSxDQUFDLFlBQVksQ0FBQztlQUM1QixZQUFZLENBQUMsY0FBYyxLQUFLLFNBQVMsQ0FBQyxVQUFVO2VBQ3BELFlBQVksQ0FBQyxpQkFBaUIsS0FBSyxTQUFTLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDaEUsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO1FBQ3JGLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxXQUFXLElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FDakQsYUFBYSxDQUFDLFdBQVcsQ0FBQyxJQUFJLFdBQVcsQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLFVBQVUsQ0FDbEYsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLG1FQUFtRSxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxRQUFpQixFQUF5QyxFQUFFLENBQUMsQ0FDL0YsbUJBQW1CLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsQ0FDM0MsQ0FBQztBQUVGLE1BQU0sZUFBZSxHQUFHLENBQUMsVUFBbUIsRUFBRSxTQUFrQixFQUFZLEVBQUU7SUFDNUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxVQUFVLENBQUM7UUFBRSxPQUFPLENBQUMsMkJBQTJCLENBQUMsQ0FBQztJQUNyRSxNQUFNLFVBQVUsR0FBRyxhQUFhLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUMvRSxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxVQUFVLEVBQUU7UUFDNUIsc0JBQXNCO1FBQ3RCLHFCQUFxQjtRQUNyQixlQUFlO1FBQ2YsT0FBTztRQUNQLGdCQUFnQjtRQUNoQixpQkFBaUI7S0FDbEIsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFtQyxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLGNBQWMsS0FBSyxnQ0FBZ0MsRUFBRSxDQUFDO1FBQ25FLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0RBQStELENBQUMsQ0FBQztJQUMvRSxDQUFDO0lBQ0QsTUFBTSxlQUFlLEdBQUcsVUFBVSxDQUFDLGVBQWUsQ0FBQztJQUNuRCxNQUFNLGlCQUFpQixHQUFHLG9DQUFvQyxDQUM1RCxlQUFlLEVBQUUseUJBQXlCLENBQUMsQ0FBQztJQUM5QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsaUJBQWlCLENBQUMsQ0FBQztJQUNsQyxJQUFJLGlCQUFpQixDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQzdCLDhCQUE4QixDQUFDLGVBQWUsQ0FBQztXQUMvQywwQkFBMEIsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQzNDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxpQ0FBaUMsQ0FBQztZQUMvQyxXQUFXLEVBQUUsZUFBZTtZQUM1QixNQUFNLEVBQUUsU0FBUztZQUNqQixLQUFLLEVBQUUseUJBQXlCO1NBQ2pDLENBQUMsQ0FBQyxDQUFDO1FBQ0osSUFBSSxlQUFlLENBQUMsSUFBSSxDQUFDLElBQUksS0FBSyxZQUFZO2VBQ3pDLFVBQVUsQ0FBQyxvQkFBb0IsS0FBSyxlQUFlLENBQUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1lBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztRQUNwRixDQUFDO1FBQ0QsTUFBTSxhQUFhLEdBQUcsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxtQkFBbUIsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNwRixJQUFJLGFBQWEsQ0FBQyxNQUFNLEtBQUssZUFBZSxDQUFDLFFBQVEsQ0FBQyxNQUFNO2VBQ3ZELGVBQWUsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxFQUFFO2dCQUN4RCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsUUFBUSxDQUFDLENBQUM7Z0JBQ3JDLE9BQU8sQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDO3VCQUN0QixJQUFJLENBQUMsWUFBWSxLQUFLLFVBQVUsQ0FBQyxXQUFXO3VCQUM1QyxJQUFJLENBQUMsUUFBUSxLQUFLLFVBQVUsQ0FBQyxZQUFZLENBQUM7WUFDakQsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsMEVBQTBFLENBQUMsQ0FBQztRQUMxRixDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsb0JBQW9CLEVBQUUsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQ2pGLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsSUFBSSxVQUFVLENBQUMsbUJBQW1CLEtBQUssVUFBVSxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxJQUFJLENBQUMsaUJBQWlCLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyx5REFBeUQsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7U0FBTSxJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDbkQsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLElBQUksVUFBVSxDQUFDLEtBQUssQ0FBQyxNQUFNLEtBQUssVUFBVSxDQUFDLG9CQUFvQixFQUFFLENBQUM7UUFDcEcsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO1FBQzdFLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFDRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBa0IsQ0FBQztJQUM1QyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFO1FBQ2xDLE1BQU0sS0FBSyxHQUFHLGlCQUFpQixRQUFRLEdBQUcsQ0FBQztRQUMzQyxJQUFJLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDNUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssb0JBQW9CLENBQUMsQ0FBQztZQUMxQyxPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxFQUFFLENBQUMsY0FBYyxFQUFFLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyw0QkFBNEIsQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxLQUFLLHNEQUFzRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsR0FBRyxFQUFFLENBQUM7WUFDL0YsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLEtBQUssNENBQTRDLENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsY0FBYyxLQUFLLFVBQVUsQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN4RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxxREFBcUQsQ0FBQyxDQUFDO1FBQzdFLENBQUM7SUFDSCxDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sYUFBYSxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLENBQzNDLGFBQWEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUMxRCxDQUFDLENBQUM7SUFDSCxNQUFNLG1CQUFtQixHQUFHLGFBQWE7U0FDdEMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFtQixFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDO1NBQzdELElBQUksRUFBRSxDQUFDO0lBQ1YsSUFBSSxJQUFJLEdBQUcsQ0FBQyxhQUFhLENBQUMsQ0FBQyxJQUFJLEtBQUssYUFBYSxDQUFDLE1BQU07V0FDbkQsSUFBSSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVDQUF1QyxHQUFHLENBQUMsY0FBdUIsRUFBWSxFQUFFO0lBQzNGLElBQUksQ0FBQyxhQUFhLENBQUMsY0FBYyxDQUFDO1FBQUUsT0FBTyxDQUFDLCtCQUErQixDQUFDLENBQUM7SUFDN0UsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxFQUFFLENBQUMsSUFBSSxFQUFFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNsRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVDQUF1QyxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDckMsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsSUFBSSxDQUFDO0lBQ2pDLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDO1FBQUUsT0FBTyxDQUFDLEdBQUcsTUFBTSxFQUFFLHdCQUF3QixDQUFDLENBQUM7SUFDdkUsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUU7UUFDdEIsaUJBQWlCO1FBQ2pCLGdCQUFnQjtRQUNoQixRQUFRO1FBQ1IsU0FBUztRQUNULGtCQUFrQjtRQUNsQixZQUFZO0tBQ2IsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsdURBQXVELENBQUMsQ0FBQztJQUN2RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLHFCQUFxQixDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztRQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDM0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDIn0=

package/dist_ts/requests/service.d.ts

@@ -9,7 +9,7 @@ import type { IImageRelease } from '../data/immutableimage.js';
 import type { IDeploymentPreflightReport, IDeploymentPreflightRequestData } from '../data/deploymentpreflight.js';
 import type { IDeploymentReservationInput, IServiceDeploymentOperation, IServiceDeploymentStatus } from '../data/deploymentoperation.js';
 import type { TSha256Digest } from '../data/immutableimage.js';
-import type { ILegacyServiceRuntimeAttestation } from '../data/deploymentlegacyimport.js';
+import type { ILegacyServiceHostObservation, ILegacyServiceRuntimeAttestation } from '../data/deploymentlegacyimport.js';
 import type { IProtocolOffer } from '../protocol.js';
 import type { IRuntimeAssignmentLogAttemptPage, IRuntimeAssignmentLogPage } from '../data/runtimeassignmentlogs.js';
 import type { IServiceRuntimeAssignmentView, IServiceRuntimeSpec, IServiceRuntimeStatus, TServiceRuntimeSpecWritableData } from '../data/serviceruntime.js';
@@ -224,10 +224,13 @@ export interface IRequest_Any_Cloudly_CleanupServiceDeployment extends plugins.t
     };
 }
 /**
- * Captures durable evidence that a legacy `deployOnPush` service runs exactly the registry root its
- * tag names: every required replica observed healthy on that one digest, with the root's platform
- * manifests read from Cloudly's own registry. Administrators only, and only while the legacy
- * runtime still runs — incomplete evidence is refused, never stored.
+ * Captures durable evidence that a legacy `deployOnPush` service runs exactly one registry root of
+ * its own repository, from an administrator's observation of its Swarm service and containers on
+ * the hosts that run them (`hostObservation`). Cloudly judges the observation itself
+ * (`data.judgeLegacyServiceHostObservation`): every desired replica running, healthy or without a
+ * healthcheck, on one root that is whole in Cloudly's own registry, its platform manifests read
+ * from there. The source tag need not still name that root. Administrators only, and only while
+ * the legacy runtime still runs — incomplete evidence is refused, never stored.
  *
  * `expectedRuntimeDigest`, when stated, is an assertion the observed digest must equal. Capturing
  * again for an unchanged digest returns the attestation already stored.
@@ -238,6 +241,7 @@ export interface IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation ext
         identity: IIdentityCredential;
         legacyServiceId: string;
         expectedRuntimeDigest?: TSha256Digest;
+        hostObservation: ILegacyServiceHostObservation;
     };
     response: {
         attestation: ILegacyServiceRuntimeAttestation;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.50.0",
+  "version": "32.51.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -30,7 +30,7 @@
     "@git.zone/tsbuild": "^5.1.2",
     "@git.zone/tsdoc": "^3.0.2",
     "@git.zone/tsrun": "^3.0.2",
-    "@git.zone/tstest": "^7.1.0",
+    "@git.zone/tstest": "^7.2.0",
     "@types/node": "26.6.3"
   },
   "files": [

package/readme.md

@@ -3640,7 +3640,7 @@ The immutable deployment workflow is:
 
 A legacy `deployOnPush` service without deployable source moves to a greenfield successor by a legacy import, which replaces step 2:
 
-- While the legacy replicas still run — before its runtime is frozen — an administrator captures the evidence with `captureLegacyServiceRuntimeAttestation` (`requests.service.IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation`). The stored `data.ILegacyServiceRuntimeAttestation` records every required replica healthy on one digest, the registry root the legacy tag names, and that root's platform manifests; `data.validateLegacyServiceRuntimeAttestation` states its rules. Incomplete evidence is refused, never stored, and there is no substitute once the runtime is stopped. `getLegacyServiceRuntimeAttestations` lists what Cloudly holds for a legacy service; both requests are for administrators only.
+- While the legacy replicas still run — before its runtime is frozen — an administrator reads the legacy Swarm service and every container of its tasks on the hosts that run them, and submits that as `hostObservation` (`data.ILegacyServiceHostObservation`: Swarm service name, spec image and mode with its desired replicas; per replica the node hostname, Swarm task id, container id, the engine's image store, the container's image id, the image's `RepoDigests`, the container state and its health, `none` when no healthcheck applies) to `captureLegacyServiceRuntimeAttestation` (`requests.service.IRequest_Any_Cloudly_CaptureLegacyServiceRuntimeAttestation`). `data.validateLegacyServiceHostObservation` judges its shape, `data.selectLegacyServiceHostObservationRootDigest` names the one root every replica runs from the service's own repository, and `data.judgeLegacyServiceHostObservation` judges it against that root as Cloudly reads it from its own registry: exactly the desired replicas of a replicated service, its spec image naming the repository by the source tag or the root digest, every replica `running` and `healthy` or `none`, each container's image id the root digest on the containerd image store or one of the root's platform image configuration digests on the classic store. The source tag need not still name the root. The stored `data.ILegacyServiceRuntimeAttestation` records that root, its platform manifests, the replicas, the evidence source `administrator-host-observation` and the observation itself; `data.validateLegacyServiceRuntimeAttestation` states its rules. Incomplete evidence is refused, never stored, and there is no substitute once the runtime is stopped. `getLegacyServiceRuntimeAttestations` lists what Cloudly holds for a legacy service; both requests are for administrators only.
 - The greenfield reservation, and every preflight of it, names `legacyImport` (`data.ILegacyImageImportReference`: legacy service, attestation, asserted source root digest) instead of `sourceRevision`, `sourceDirty` and release evidence. Refusals are the blockers `LEGACY_IMPORT_ATTESTATION_MISSING`, `LEGACY_IMPORT_SOURCE_MISMATCH` and `LEGACY_IMPORT_PLATFORM_MISMATCH`.
 - Instead of the registry push, the deployer calls `importServiceDeploymentLegacyImage`: Cloudly imports the attested image from its own registry into the reserved tag — an index root as it is, a single platform manifest under a one-descriptor index of the manifest's own family — and records release evidence of source `cloudly-legacy-import` naming the legacy source. Steps 3 to 5 follow unchanged; `selectTrustedImageReleaseEvidence` accepts that evidence only with `evidenceSource: 'cloudly-legacy-import'`.
 - The reservation and the import need the capability `deployment:import-legacy`, which only an organization-service-slot grant can carry.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.50.0',
+  version: '32.51.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/deploymentlegacyimport.ts

@@ -4,15 +4,22 @@ import type {
   TSha256Digest,
 } from './immutableimage.js';
 import { normalizeSha256Digest } from './immutableimage.js';
-import { hasExactKeys, isPlainRecord } from '../private/dataproperties.js';
+import {
+  hasExactKeys,
+  isPlainRecord,
+  readDataElements,
+  readDataProperties,
+} from '../private/dataproperties.js';
 
 /**
  * Legacy image import: a greenfield deployment whose image is the one a legacy `deployOnPush`
  * service already runs, instead of one built from a source revision.
  *
  * A legacy service without deployable source still has an image in Cloudly's registry and, until
- * its runtime is frozen, healthy replicas running it. An administrator captures that fact once as
- * a {@link ILegacyServiceRuntimeAttestation} while the replicas still run. A greenfield successor
+ * its runtime is frozen, replicas running it. An administrator observes those replicas on the
+ * hosts that run them ({@link ILegacyServiceHostObservation}) while they still run, and Cloudly
+ * captures that observation once as a {@link ILegacyServiceRuntimeAttestation} after it verified
+ * the observed root against its own registry. A greenfield successor
  * reservation names the attestation in `legacyImport` instead of a `sourceRevision`, and Cloudly
  * then imports the attested image into the successor's own repository and release tag itself:
  * the bytes never leave the registry and the release records that it was imported, not built.
@@ -60,19 +67,98 @@ export interface ILegacyServiceImageSource {
   platforms: ILegacyImagePlatformManifest[];
 }
 
-/** One healthy replica of the legacy service, observed running the attested digest. */
+/**
+ * One replica of the legacy service, observed running the attested digest in its own stated
+ * health: healthy, or running with no healthcheck that could state one.
+ */
 export interface ILegacyServiceRuntimeTaskAttestation {
+  /** The replica's runtime identity: the Swarm task it was observed as. */
   deploymentId: string;
+  /** The hostname of the node the replica was observed on. */
   nodeName: string;
   observedDigest: TSha256Digest;
 }
 
+/**
+ * Where the runtime part of an attestation comes from. `administrator-host-observation`: an
+ * administrator read the legacy Swarm service and its containers on the hosts that run them, and
+ * Cloudly judged that observation against its own registry.
+ */
+export type TLegacyServiceRuntimeEvidenceSource = 'administrator-host-observation';
+
+/** A container's state as the Docker engine reports it (`State.Status`). */
+export type TLegacyHostContainerState =
+  | 'created'
+  | 'running'
+  | 'paused'
+  | 'restarting'
+  | 'removing'
+  | 'exited'
+  | 'dead';
+
+/**
+ * A container's health as the Docker engine reports it (`State.Health.Status`). `none`: no
+ * healthcheck applies to the container — the image declares none and the service adds none — so
+ * the engine reports no health state at all.
+ */
+export type TLegacyHostContainerHealth = 'healthy' | 'unhealthy' | 'starting' | 'none';
+
+/**
+ * The image store of the Docker engine that runs a container. On the `containerd` store a
+ * container's image id is the digest of the root it was pulled as; on the `classic` store it is
+ * the image configuration digest of the platform manifest the engine pulled.
+ */
+export type TLegacyHostImageStore = 'containerd' | 'classic';
+
+/** A Swarm service's mode (`Spec.Mode`): a replicated service states its desired replicas. */
+export type TLegacyHostSwarmServiceMode =
+  | { kind: 'replicated'; desiredReplicas: number }
+  | { kind: 'global' };
+
+/** One replica of a legacy Swarm service, as an administrator read it on the node that runs it. */
+export interface ILegacyHostReplicaObservation {
+  /** The hostname of the node the task runs on. */
+  nodeHostname: string;
+  /** The Swarm task id (25 lowercase base-36 characters). */
+  swarmTaskId: string;
+  /** The full container id of the task (64 lowercase hex characters). */
+  containerId: string;
+  imageStore: TLegacyHostImageStore;
+  /** The container's image id (`Image`), a sha256 digest. */
+  containerImageId: TSha256Digest;
+  /** The `RepoDigests` of the container's image, exactly as the engine lists them. */
+  imageRepoDigests: string[];
+  state: TLegacyHostContainerState;
+  health: TLegacyHostContainerHealth;
+}
+
+/**
+ * An administrator's observation of the legacy Swarm service of one legacy service and of every
+ * container its tasks run, read on the hosts while the legacy runtime still runs.
+ *
+ * It states facts, not conclusions: Cloudly judges it against its own registry
+ * ({@link judgeLegacyServiceHostObservation}) before it attests anything.
+ */
+export interface ILegacyServiceHostObservation {
+  /** The Swarm service name. */
+  swarmServiceName: string;
+  /** The image reference of the Swarm service spec (`Spec.TaskTemplate.ContainerSpec.Image`). */
+  specImage: string;
+  mode: TLegacyHostSwarmServiceMode;
+  /** When the administrator read the hosts, in milliseconds since the epoch. */
+  observedAt: number;
+  /** Every running task's replica, sorted by `swarmTaskId`. */
+  replicas: ILegacyHostReplicaObservation[];
+}
+
 /**
  * Durable evidence, captured by an administrator while the legacy runtime still ran, that every
- * required replica of a legacy service was healthy and ran exactly the registry root it names.
+ * desired replica of a legacy service ran, in its own stated health, exactly the registry root it
+ * names.
  *
  * Cloudly writes one and never changes it. A capture only succeeds on complete evidence, so a
- * stored attestation is by construction one whose runtime digest is its source root digest.
+ * stored attestation is by construction one whose runtime digest is its source root digest and
+ * whose runtime part is exactly the host observation it records.
  */
 export interface ILegacyServiceRuntimeAttestation {
   id: string;
@@ -81,11 +167,16 @@ export interface ILegacyServiceRuntimeAttestation {
     organizationId: string;
     source: ILegacyServiceImageSource;
     runtime: {
+      /** The desired replicas of the observed replicated Swarm service. */
       requiredReplicaCount: number;
+      /** Replicas observed running healthy, or running with no healthcheck (`health: 'none'`). */
       healthyReplicaCount: number;
       runtimeDigest: TSha256Digest;
-      /** Sorted by deploymentId, one per required replica. */
+      /** Sorted by deploymentId, one per required replica: the observed replicas. */
       tasks: ILegacyServiceRuntimeTaskAttestation[];
+      evidenceSource: TLegacyServiceRuntimeEvidenceSource;
+      /** The observation the runtime part was built from, as the administrator submitted it. */
+      hostObservation: ILegacyServiceHostObservation;
     };
     capturedByUserId: string;
     capturedAt: number;
@@ -120,6 +211,31 @@ const legacyImageImportIndexMediaTypes: readonly TLegacyImageImportIndexMediaTyp
   'application/vnd.docker.distribution.manifest.list.v2+json',
 ];
 const legacyImagePlatforms: readonly TImmutableContainerPlatform[] = ['linux/amd64', 'linux/arm64'];
+const legacyHostContainerStates: readonly TLegacyHostContainerState[] = [
+  'created',
+  'running',
+  'paused',
+  'restarting',
+  'removing',
+  'exited',
+  'dead',
+];
+const legacyHostContainerHealths: readonly TLegacyHostContainerHealth[] = [
+  'healthy',
+  'unhealthy',
+  'starting',
+  'none',
+];
+/** The health states a replica may be attested in: healthy, or no healthcheck at all. */
+const attestableLegacyHostContainerHealths: readonly TLegacyHostContainerHealth[] = ['healthy', 'none'];
+const legacyHostImageStores: readonly TLegacyHostImageStore[] = ['containerd', 'classic'];
+const swarmTaskIdRegex = /^[a-z0-9]{25}$/;
+const containerIdRegex = /^[0-9a-f]{64}$/;
+const swarmServiceNameRegex = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/;
+const nodeHostnameRegex = /^(?=.{1,253}$)[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?)*$/;
+const imageReferenceRegex = /^\S{1,512}$/;
+const repoDigestRegex = /^[^\s@]{1,440}@sha256:[0-9a-f]{64}$/;
+const maximumRepoDigestCount = 32;
 
 const isIdentifier = (valueArg: unknown): valueArg is string => (
   typeof valueArg === 'string' && identifierRegex.test(valueArg)
@@ -168,6 +284,256 @@ export const validateLegacyImageImportReference = (referenceArg: unknown): strin
   return errors;
 };
 
+const validateHostReplicaObservation = (
+  replicaArg: unknown,
+  labelArg: string,
+): string[] => {
+  const replica = readDataProperties(replicaArg);
+  if (replica === null) return [`${labelArg} must be a plain data object`];
+  const errors: string[] = [];
+  if (!hasExactKeys(replica, [
+    'nodeHostname',
+    'swarmTaskId',
+    'containerId',
+    'imageStore',
+    'containerImageId',
+    'imageRepoDigests',
+    'state',
+    'health',
+  ])) {
+    errors.push(`${labelArg} must use its exact schema`);
+  }
+  if (typeof replica.nodeHostname !== 'string' || !nodeHostnameRegex.test(replica.nodeHostname)) {
+    errors.push(`${labelArg}.nodeHostname must be a host name`);
+  }
+  if (typeof replica.swarmTaskId !== 'string' || !swarmTaskIdRegex.test(replica.swarmTaskId)) {
+    errors.push(`${labelArg}.swarmTaskId must be a Swarm task id`);
+  }
+  if (typeof replica.containerId !== 'string' || !containerIdRegex.test(replica.containerId)) {
+    errors.push(`${labelArg}.containerId must be a full container id`);
+  }
+  if (!legacyHostImageStores.some((storeArg) => storeArg === replica.imageStore)) {
+    errors.push(`${labelArg}.imageStore must be containerd or classic`);
+  }
+  if (!isCanonicalDigest(replica.containerImageId)) {
+    errors.push(`${labelArg}.containerImageId must be a canonical sha256 digest`);
+  }
+  const repoDigests = readDataElements(replica.imageRepoDigests, maximumRepoDigestCount);
+  if (repoDigests === null
+    || repoDigests.some((entryArg) => typeof entryArg !== 'string' || !repoDigestRegex.test(entryArg))
+    || new Set(repoDigests).size !== repoDigests.length) {
+    errors.push(`${labelArg}.imageRepoDigests must be unique digested image references`);
+  }
+  if (!legacyHostContainerStates.some((stateArg) => stateArg === replica.state)) {
+    errors.push(`${labelArg}.state must be a Docker container state`);
+  }
+  if (!legacyHostContainerHealths.some((healthArg) => healthArg === replica.health)) {
+    errors.push(`${labelArg}.health must be healthy, unhealthy, starting or none`);
+  }
+  return errors;
+};
+
+const validateHostSwarmServiceMode = (modeArg: unknown, labelArg: string): string[] => {
+  const mode = readDataProperties(modeArg);
+  if (mode === null) return [`${labelArg} must be a plain data object`];
+  if (mode.kind === 'global') {
+    return hasExactKeys(mode, ['kind']) ? [] : [`${labelArg} must use its exact schema`];
+  }
+  if (mode.kind !== 'replicated') return [`${labelArg}.kind must be replicated or global`];
+  const errors: string[] = [];
+  if (!hasExactKeys(mode, ['kind', 'desiredReplicas'])) {
+    errors.push(`${labelArg} must use its exact schema`);
+  }
+  if (typeof mode.desiredReplicas !== 'number'
+    || !Number.isSafeInteger(mode.desiredReplicas)
+    || mode.desiredReplicas < 0
+    || mode.desiredReplicas > maximumReplicaCount) {
+    errors.push(`${labelArg}.desiredReplicas must be a bounded replica count`);
+  }
+  return errors;
+};
+
+/**
+ * The shape of a host observation: exact keys at every level, Docker's own value sets, at most 64
+ * replicas, unique and sorted by Swarm task id, each container observed once. It judges nothing
+ * against a registry; {@link judgeLegacyServiceHostObservation} does.
+ */
+export const validateLegacyServiceHostObservation = (
+  observationArg: unknown,
+  labelArg = 'hostObservation',
+): string[] => {
+  const observation = readDataProperties(observationArg);
+  if (observation === null) return [`${labelArg} must be a plain data object`];
+  const errors: string[] = [];
+  if (!hasExactKeys(observation, ['swarmServiceName', 'specImage', 'mode', 'observedAt', 'replicas'])) {
+    errors.push(`${labelArg} must use its exact schema`);
+  }
+  if (typeof observation.swarmServiceName !== 'string'
+    || !swarmServiceNameRegex.test(observation.swarmServiceName)) {
+    errors.push(`${labelArg}.swarmServiceName must be a Swarm service name`);
+  }
+  if (typeof observation.specImage !== 'string' || !imageReferenceRegex.test(observation.specImage)) {
+    errors.push(`${labelArg}.specImage must be a bounded image reference`);
+  }
+  errors.push(...validateHostSwarmServiceMode(observation.mode, `${labelArg}.mode`));
+  if (!isPositiveSafeInteger(observation.observedAt, Number.MAX_SAFE_INTEGER)) {
+    errors.push(`${labelArg}.observedAt must be a positive timestamp`);
+  }
+  const replicas = readDataElements(observation.replicas, maximumReplicaCount);
+  if (replicas === null) {
+    errors.push(`${labelArg}.replicas must be a list of at most ${maximumReplicaCount} replicas`);
+    return errors;
+  }
+  replicas.forEach((replicaArg, indexArg) => {
+    errors.push(...validateHostReplicaObservation(replicaArg, `${labelArg}.replicas[${indexArg}]`));
+  });
+  const readReplicaKey = (replicaArg: unknown, keyArg: string): unknown => (
+    readDataProperties(replicaArg)?.[keyArg]
+  );
+  const taskIds = replicas.map((replicaArg) => readReplicaKey(replicaArg, 'swarmTaskId'));
+  const sortedTaskIds = taskIds
+    .filter((idArg): idArg is string => typeof idArg === 'string')
+    .sort();
+  if (new Set(taskIds).size !== taskIds.length
+    || JSON.stringify(taskIds) !== JSON.stringify(sortedTaskIds)) {
+    errors.push(`${labelArg}.replicas must be unique and sorted by swarmTaskId`);
+  }
+  const containerIds = replicas.map((replicaArg) => readReplicaKey(replicaArg, 'containerId'));
+  if (new Set(containerIds).size !== containerIds.length) {
+    errors.push(`${labelArg}.replicas must observe each container once`);
+  }
+  return errors;
+};
+
+/** True when a value is a well-formed host observation. */
+export const isLegacyServiceHostObservation = (
+  valueArg: unknown,
+): valueArg is ILegacyServiceHostObservation => (
+  validateLegacyServiceHostObservation(valueArg).length === 0
+);
+
+/**
+ * The root digest one replica was pulled as from `registryHost/repository`.
+ *
+ * On the containerd store that is the container's image id, which the image's `RepoDigests` must
+ * list for the repository. On the classic store it is the one digest `RepoDigests` lists for the
+ * repository; none, or more than one, leaves the root unknown.
+ */
+const selectReplicaRootDigest = (
+  replicaArg: ILegacyHostReplicaObservation,
+  repositoryReferenceArg: string,
+): TSha256Digest | undefined => {
+  const prefix = `${repositoryReferenceArg}@`;
+  const repositoryDigests = replicaArg.imageRepoDigests
+    .filter((entryArg) => entryArg.startsWith(prefix))
+    .map((entryArg) => normalizeSha256Digest(entryArg.slice(prefix.length)))
+    .filter((digestArg): digestArg is TSha256Digest => digestArg !== undefined);
+  if (replicaArg.imageStore === 'containerd') {
+    return repositoryDigests.includes(replicaArg.containerImageId)
+      ? replicaArg.containerImageId
+      : undefined;
+  }
+  return repositoryDigests.length === 1 ? repositoryDigests[0] : undefined;
+};
+
+/**
+ * The one root digest every observed replica runs from the legacy service's own repository, which
+ * is the digest Cloudly then inspects in its registry. Refused when a replica's root from that
+ * repository is unknown, when the replicas run more than one root, or when nothing was observed.
+ */
+export const selectLegacyServiceHostObservationRootDigest = (argsArg: {
+  observation: ILegacyServiceHostObservation;
+  registryHost: string;
+  repository: string;
+}): { rootDigest?: TSha256Digest; errors: string[] } => {
+  const repositoryReference = `${argsArg.registryHost}/${argsArg.repository}`;
+  const errors: string[] = [];
+  const roots = new Set<TSha256Digest>();
+  argsArg.observation.replicas.forEach((replicaArg, indexArg) => {
+    const root = selectReplicaRootDigest(replicaArg, repositoryReference);
+    if (root === undefined) {
+      errors.push(replicaArg.imageStore === 'containerd'
+        ? `hostObservation.replicas[${indexArg}] image is not listed as ${repositoryReference}@<its image id>`
+        : `hostObservation.replicas[${indexArg}] image lists not exactly one digest of ${repositoryReference}`);
+      return;
+    }
+    roots.add(root);
+  });
+  if (argsArg.observation.replicas.length === 0) {
+    errors.push('hostObservation must observe at least one replica');
+  }
+  if (roots.size > 1) {
+    errors.push('hostObservation replicas run more than one root digest');
+  }
+  const [rootDigest] = [...roots];
+  return errors.length === 0 && rootDigest !== undefined ? { rootDigest, errors } : { errors };
+};
+
+/**
+ * Judges a well-formed host observation against the registry source Cloudly inspected for it.
+ * Every rule an attestation's runtime part must meet:
+ *
+ * - the Swarm service is replicated, with at least one desired replica, and exactly its desired
+ *   replicas were observed;
+ * - its spec image names the source repository by the source tag, by the root digest, or by both;
+ * - every replica is `running`, and `healthy` or without a healthcheck (`none`) — `unhealthy` and
+ *   `starting` are refused;
+ * - every replica runs the source root from the source repository: its image lists
+ *   `registryHost/repository@rootDigest`, and its image id is the root digest on the containerd
+ *   store or one of the root's platform image configuration digests on the classic store.
+ */
+export const judgeLegacyServiceHostObservation = (argsArg: {
+  observation: ILegacyServiceHostObservation;
+  source: ILegacyServiceImageSource;
+  label?: string;
+}): string[] => {
+  const label = argsArg.label ?? 'hostObservation';
+  const { observation, source } = argsArg;
+  const errors: string[] = [];
+  if (observation.mode.kind !== 'replicated') {
+    errors.push(`${label}.mode must be replicated: a legacy service runs as a replicated Swarm service`);
+  } else if (observation.mode.desiredReplicas < 1) {
+    errors.push(`${label}.mode must desire at least one replica`);
+  } else if (observation.replicas.length !== observation.mode.desiredReplicas) {
+    errors.push(`${label} must observe exactly the ${observation.mode.desiredReplicas} desired replicas`);
+  }
+  const repositoryReference = `${source.registryHost}/${source.repository}`;
+  const specImages = [
+    `${repositoryReference}:${source.tag}`,
+    `${repositoryReference}@${source.rootDigest}`,
+    `${repositoryReference}:${source.tag}@${source.rootDigest}`,
+  ];
+  if (!specImages.includes(observation.specImage)) {
+    errors.push(`${label}.specImage must name ${repositoryReference} by its source tag or root digest`);
+  }
+  const imageConfigDigests = source.platforms.map((platformArg) => platformArg.imageConfigDigest);
+  observation.replicas.forEach((replicaArg, indexArg) => {
+    const replicaLabel = `${label}.replicas[${indexArg}]`;
+    if (replicaArg.state !== 'running') {
+      errors.push(`${replicaLabel}.state must be running`);
+    }
+    if (!attestableLegacyHostContainerHealths.includes(replicaArg.health)) {
+      errors.push(`${replicaLabel}.health must be healthy or none`);
+    }
+    if (!replicaArg.imageRepoDigests.includes(`${repositoryReference}@${source.rootDigest}`)) {
+      errors.push(`${replicaLabel} image must be ${repositoryReference}@${source.rootDigest}`);
+    }
+    if (replicaArg.imageStore === 'containerd') {
+      if (replicaArg.containerImageId !== source.rootDigest) {
+        errors.push(`${replicaLabel}.containerImageId must be the root digest on the containerd image store`);
+      }
+      return;
+    }
+    if (!imageConfigDigests.includes(replicaArg.containerImageId)) {
+      errors.push(`${replicaLabel}.containerImageId must be a platform image configuration digest of the root on the classic image store`);
+    }
+    if (selectReplicaRootDigest(replicaArg, repositoryReference) === undefined) {
+      errors.push(`${replicaLabel} image must list exactly one digest of ${repositoryReference} on the classic image store`);
+    }
+  });
+  return errors;
+};
+
 const validatePlatformManifest = (
   manifestArg: unknown,
   indexArg: number,
@@ -270,17 +636,54 @@ const validateImageSource = (sourceArg: unknown): string[] => {
   return errors;
 };
 
-const validateRuntime = (runtimeArg: unknown, rootDigestArg: unknown): string[] => {
+const isLegacyServiceImageSource = (valueArg: unknown): valueArg is ILegacyServiceImageSource => (
+  validateImageSource(valueArg).length === 0
+);
+
+const validateRuntime = (runtimeArg: unknown, sourceArg: unknown): string[] => {
   if (!isPlainRecord(runtimeArg)) return ['runtime must be an object'];
+  const rootDigest = isPlainRecord(sourceArg) ? sourceArg.rootDigest : undefined;
   const errors: string[] = [];
   if (!hasExactKeys(runtimeArg, [
     'requiredReplicaCount',
     'healthyReplicaCount',
     'runtimeDigest',
     'tasks',
+    'evidenceSource',
+    'hostObservation',
   ])) {
     errors.push('runtime must use its exact schema');
   }
+  if (runtimeArg.evidenceSource !== 'administrator-host-observation') {
+    errors.push('runtime.evidenceSource must be administrator-host-observation');
+  }
+  const hostObservation = runtimeArg.hostObservation;
+  const observationErrors = validateLegacyServiceHostObservation(
+    hostObservation, 'runtime.hostObservation');
+  errors.push(...observationErrors);
+  if (observationErrors.length === 0
+    && isLegacyServiceHostObservation(hostObservation)
+    && isLegacyServiceImageSource(sourceArg)) {
+    errors.push(...judgeLegacyServiceHostObservation({
+      observation: hostObservation,
+      source: sourceArg,
+      label: 'runtime.hostObservation',
+    }));
+    if (hostObservation.mode.kind === 'replicated'
+      && runtimeArg.requiredReplicaCount !== hostObservation.mode.desiredReplicas) {
+      errors.push('runtime.requiredReplicaCount must be the observed desired replicas');
+    }
+    const recordedTasks = readDataElements(runtimeArg.tasks, maximumReplicaCount) ?? [];
+    if (recordedTasks.length !== hostObservation.replicas.length
+      || hostObservation.replicas.some((replicaArg, indexArg) => {
+        const task = recordedTasks[indexArg];
+        return !isPlainRecord(task)
+          || task.deploymentId !== replicaArg.swarmTaskId
+          || task.nodeName !== replicaArg.nodeHostname;
+      })) {
+      errors.push('runtime.tasks must be the observed replicas: each Swarm task on its node');
+    }
+  }
   if (!isPositiveSafeInteger(runtimeArg.requiredReplicaCount, maximumReplicaCount)) {
     errors.push('runtime.requiredReplicaCount must be a positive bounded replica count');
   }
@@ -289,7 +692,7 @@ const validateRuntime = (runtimeArg: unknown, rootDigestArg: unknown): string[]
   }
   if (!isCanonicalDigest(runtimeArg.runtimeDigest)) {
     errors.push('runtime.runtimeDigest must be a canonical sha256 digest');
-  } else if (runtimeArg.runtimeDigest !== rootDigestArg) {
+  } else if (runtimeArg.runtimeDigest !== rootDigest) {
     errors.push('runtime.runtimeDigest must be the attested source root digest');
   }
   if (!Array.isArray(runtimeArg.tasks) || runtimeArg.tasks.length !== runtimeArg.requiredReplicaCount) {
@@ -363,9 +766,6 @@ export const validateLegacyServiceRuntimeAttestation = (attestationArg: unknown)
     errors.push('capturedAt must be a positive timestamp');
   }
   errors.push(...validateImageSource(data.source));
-  errors.push(...validateRuntime(
-    data.runtime,
-    isPlainRecord(data.source) ? data.source.rootDigest : undefined,
-  ));
+  errors.push(...validateRuntime(data.runtime, data.source));
   return errors;
 };

package/ts/requests/service.ts

@@ -17,7 +17,10 @@ import type {
   IServiceDeploymentStatus,
 } from '../data/deploymentoperation.js';
 import type { TSha256Digest } from '../data/immutableimage.js';
-import type { ILegacyServiceRuntimeAttestation } from '../data/deploymentlegacyimport.js';
+import type {
+  ILegacyServiceHostObservation,
+  ILegacyServiceRuntimeAttestation,
+} from '../data/deploymentlegacyimport.js';
 import type { IProtocolOffer } from '../protocol.js';
 import type {
   IRuntimeAssignmentLogAttemptPage,
@@ -330,10 +333,13 @@ extends plugins.typedrequestInterfaces.implementsTR<
 }
 
 /**
- * Captures durable evidence that a legacy `deployOnPush` service runs exactly the registry root its
- * tag names: every required replica observed healthy on that one digest, with the root's platform
- * manifests read from Cloudly's own registry. Administrators only, and only while the legacy
- * runtime still runs — incomplete evidence is refused, never stored.
+ * Captures durable evidence that a legacy `deployOnPush` service runs exactly one registry root of
+ * its own repository, from an administrator's observation of its Swarm service and containers on
+ * the hosts that run them (`hostObservation`). Cloudly judges the observation itself
+ * (`data.judgeLegacyServiceHostObservation`): every desired replica running, healthy or without a
+ * healthcheck, on one root that is whole in Cloudly's own registry, its platform manifests read
+ * from there. The source tag need not still name that root. Administrators only, and only while
+ * the legacy runtime still runs — incomplete evidence is refused, never stored.
  *
  * `expectedRuntimeDigest`, when stated, is an assertion the observed digest must equal. Capturing
  * again for an unchanged digest returns the attestation already stored.
@@ -348,6 +354,7 @@ extends plugins.typedrequestInterfaces.implementsTR<
     identity: IIdentityCredential;
     legacyServiceId: string;
     expectedRuntimeDigest?: TSha256Digest;
+    hostObservation: ILegacyServiceHostObservation;
   };
   response: {
     attestation: ILegacyServiceRuntimeAttestation;