@serve.zone/interfaces 32.54.0 → 32.55.0

package/changelog.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## 2026-10-13 - 32.55.0
+
+### Features
+
+- `IClusterHttpRoute` takes an optional `sourceAllowList`: the only sources the cluster ingress
+  serves the hostname to, as 1 to `clusterIngressLimits.maximumSourceAllowListEntries` (64)
+  distinct canonical address prefixes of either family, none of length zero; absent means every
+  source. `validateClusterRouteSourceAllowList(value, path?)` judges one list, and
+  `validateClusterRouteTable` judges it on every route that carries it. A reader built before the
+  member refuses the whole table that carries it, so an ingress that applies it registers with the
+  new `clusterIngressCapabilities.routeSourceAllowList` (`route-source-allowlist`,
+  `TClusterIngressCapability`), and Cloudly sends it only to such an ingress through a relay on this
+  release or later.
+- `ICloudlySettings.dcrouterForwardSourceAddresses`: the source addresses dcrouter's forwarded
+  connections arrive from at a node, as canonical address prefixes judged by
+  `validateClusterRouteSourceAllowList`. Cloudly restricts every non-public hostname a node's
+  cluster ingress serves to them, so the gateway that checks the hostname's source profile stays
+  the only way in.
+
+### Maintenance
+
+- release tooling: @git.zone/tstest 7.2.1, pnpm 12.10.1
+
 ## 2026-10-12 - 32.54.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/interfaces',
-    version: '32.54.0',
+    version: '32.55.0',
     description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFNBQVM7SUFDbEIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/data/clusteringress.d.ts

@@ -18,11 +18,23 @@ export declare const clusterIngressLimits: Readonly<{
     maximumRoutes: 4096;
     maximumPortRoutes: 1024;
     maximumDestinationsPerRoute: 64;
+    maximumSourceAllowListEntries: 64;
     maximumStatisticsPageSize: 1000;
     maximumCursorLength: 512;
     maximumIdentifierLength: 200;
     maximumIngressCapabilities: 32;
 }>;
+/**
+ * The capabilities an ingress names on its registration, each spelled once here.
+ *
+ * `routeSourceAllowList`: the ingress applies `IClusterHttpRoute.sourceAllowList`. A route table
+ * that carries the member is refused whole by a reader built before it, so Cloudly sends a route
+ * with a source allowlist only to an ingress that registered with this capability.
+ */
+export declare const clusterIngressCapabilities: Readonly<{
+    readonly routeSourceAllowList: 'route-source-allowlist';
+}>;
+export type TClusterIngressCapability = (typeof clusterIngressCapabilities)[keyof typeof clusterIngressCapabilities];
 /** One backend a route forwards to: an address a node answers on, and its port. */
 export interface IClusterRouteDestination {
     address: string;
@@ -50,6 +62,18 @@ export interface IClusterHttpRoute {
         privateKey: string;
     };
     authentication?: IClusterRouteAuthentication;
+    /**
+     * The only sources the ingress serves `hostName` to, as canonical address prefixes of either
+     * family (`192.0.2.10/32`, `2001:db8::/64`); a request from any other source is refused.
+     * Absent means every source. When present it lists 1 to
+     * `clusterIngressLimits.maximumSourceAllowListEntries` distinct prefixes, none of length zero:
+     * an unrestricted route omits the member rather than spelling "everyone" a second way.
+     *
+     * Cloudly sets it on a hostname that is not public, to the addresses the gateway forwards from,
+     * so the gateway that checked the source stays the only way in. An ingress that applies it
+     * registers with `clusterIngressCapabilities.routeSourceAllowList`.
+     */
+    sourceAllowList?: string[];
 }
 /** One TCP or UDP port the ingress forwards without terminating anything. */
 export interface IClusterPortRoute {
@@ -108,6 +132,12 @@ export interface IClusterTrafficStatistics {
  * table that carried both would serve one of them without a certificate.
  */
 export declare const isClusterIngressHostName: (valueArg: unknown) => valueArg is string;
+/**
+ * Validates one source allowlist (`IClusterHttpRoute.sourceAllowList`) and names every reason it is
+ * refused: 1 to `clusterIngressLimits.maximumSourceAllowListEntries` distinct canonical address
+ * prefixes whose host bits are zero, none of length zero.
+ */
+export declare const validateClusterRouteSourceAllowList: (valueArg: unknown, pathArg?: string) => string[];
 /**
  * Validates one route table and names every reason it is refused.
  *

package/dist_ts/data/clusteringress.js

@@ -1,7 +1,8 @@
 import { isPlausibleUnicastIpv4 } from '../private/ipv4.js';
 import { isUtcCalendarDay } from '../private/utccalendarday.js';
 import { validateProtocolOfferOn } from '../protocol.js';
-import { hasExactKeys, readExactDataRecord } from '../private/dataproperties.js';
+import { hasExactKeys, readDataElements, readExactDataRecord } from '../private/dataproperties.js';
+import { parseCanonicalIpPrefix } from '../private/ipaddress.js';
 import { isClusterNodeId } from '../private/nodeidentifier.js';
 import { validateClusterRelay } from './cluster.js';
 /**
@@ -23,11 +24,22 @@ export const clusterIngressLimits = Object.freeze({
     maximumRoutes: 4096,
     maximumPortRoutes: 1024,
     maximumDestinationsPerRoute: 64,
+    maximumSourceAllowListEntries: 64,
     maximumStatisticsPageSize: 1000,
     maximumCursorLength: 512,
     maximumIdentifierLength: 200,
     maximumIngressCapabilities: 32,
 });
+/**
+ * The capabilities an ingress names on its registration, each spelled once here.
+ *
+ * `routeSourceAllowList`: the ingress applies `IClusterHttpRoute.sourceAllowList`. A route table
+ * that carries the member is refused whole by a reader built before it, so Cloudly sends a route
+ * with a source allowlist only to an ingress that registered with this capability.
+ */
+export const clusterIngressCapabilities = Object.freeze({
+    routeSourceAllowList: 'route-source-allowlist',
+});
 const isRecord = (valueArg) => (Boolean(valueArg)
     && typeof valueArg === 'object'
     && !Array.isArray(valueArg)
@@ -101,9 +113,36 @@ const validateAuthentication = (valueArg, pathArg) => {
         ? []
         : [`${pathArg} must be Basic authentication with a user and a pass`];
 };
+/**
+ * Validates one source allowlist (`IClusterHttpRoute.sourceAllowList`) and names every reason it is
+ * refused: 1 to `clusterIngressLimits.maximumSourceAllowListEntries` distinct canonical address
+ * prefixes whose host bits are zero, none of length zero.
+ */
+export const validateClusterRouteSourceAllowList = (valueArg, pathArg = 'sourceAllowList') => {
+    const maximum = clusterIngressLimits.maximumSourceAllowListEntries;
+    const prefixes = readDataElements(valueArg, maximum);
+    if (prefixes === null || prefixes.length === 0) {
+        return [`${pathArg} must list 1 to ${maximum} address prefixes`];
+    }
+    const errors = [];
+    prefixes.forEach((prefixArg, indexArg) => {
+        const prefix = parseCanonicalIpPrefix(prefixArg);
+        if (prefix === null) {
+            errors.push(`${pathArg}[${indexArg}] must be a canonical address prefix whose host bits are zero`);
+        }
+        else if (prefix.length === 0) {
+            errors.push(`${pathArg}[${indexArg}] must not admit a whole address family; `
+                + 'an unrestricted route omits sourceAllowList');
+        }
+        else if (prefixes.indexOf(prefixArg) !== indexArg) {
+            errors.push(`${pathArg}[${indexArg}] repeats ${prefixArg}`);
+        }
+    });
+    return errors;
+};
 const validateHttpRoute = (valueArg, pathArg) => {
     if (!isRecord(valueArg)
-        || !hasExactKeys(valueArg, ['hostName', 'destinations', 'certificate'], ['authentication'])) {
+        || !hasExactKeys(valueArg, ['hostName', 'destinations', 'certificate'], ['authentication', 'sourceAllowList'])) {
         return [`${pathArg} must use its exact schema`];
     }
     const errors = [];
@@ -115,6 +154,9 @@ const validateHttpRoute = (valueArg, pathArg) => {
     if (valueArg.authentication !== undefined) {
         errors.push(...validateAuthentication(valueArg.authentication, `${pathArg} authentication`));
     }
+    if (valueArg.sourceAllowList !== undefined) {
+        errors.push(...validateClusterRouteSourceAllowList(valueArg.sourceAllowList, `${pathArg} sourceAllowList`));
+    }
     return errors;
 };
 const validatePortRoute = (valueArg, pathArg) => {
@@ -441,4 +483,4 @@ export const validateClusterIngressRouteTableChange = (valueArg, pathArg = 'clus
         ? []
         : [`${pathArg} revision must be a non-negative safe integer`];
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcmluZ3Jlc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJpbmdyZXNzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzVELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQ2hFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQ3pELE9BQU8sRUFBRSxZQUFZLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUNqRixPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDL0QsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBR3BEOzs7Ozs7Ozs7OztHQVdHO0FBRUgsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNoRCwwQkFBMEIsRUFBRSxFQUFFO0lBQzlCLDBCQUEwQixFQUFFLElBQUk7SUFDaEMscUJBQXFCLEVBQUUsR0FBRztJQUMxQixhQUFhLEVBQUUsSUFBSTtJQUNuQixpQkFBaUIsRUFBRSxJQUFJO0lBQ3ZCLDJCQUEyQixFQUFFLEVBQUU7SUFDL0IseUJBQXlCLEVBQUUsSUFBSTtJQUMvQixtQkFBbUIsRUFBRSxHQUFHO0lBQ3hCLHVCQUF1QixFQUFFLEdBQUc7SUFDNUIsMEJBQTBCLEVBQUUsRUFBRTtDQUMvQixDQUFDLENBQUM7QUFzRkgsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsQ0FDM0UsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUNkLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDNUIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUN4QixDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssTUFBTSxDQUFDLFNBQVM7V0FDbkQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQzNELE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUssUUFBbUIsSUFBSSxDQUFDLENBQzVELENBQUM7QUFFRixNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN4RCxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLElBQUksQ0FBQyxJQUFLLFFBQW1CLElBQUksTUFBTSxDQUM5RixDQUFDO0FBRUYsTUFBTSxnQkFBZ0IsR0FBRyx3Q0FBd0MsQ0FBQztBQUNsRSw2RUFBNkU7QUFDN0UsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLE1BQU0sQ0FDbEMsaUNBQWlDLG9CQUFvQixDQUFDLHVCQUF1QixHQUFHLENBQUMsSUFBSSxDQUN0RixDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUU7SUFDaEYsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRO1dBQzNCLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNyQixRQUFRLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLHFCQUFxQixFQUFFLENBQUM7UUFDbEUsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNuQyxPQUFPLE1BQU0sQ0FBQyxNQUFNLElBQUksQ0FBQyxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO0FBQzNGLENBQUMsQ0FBQztBQUVGLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQzVFLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztXQUN2QixRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDckIsUUFBUSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQywyQkFBMkIsRUFBRSxDQUFDO1FBQ3hFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sa0JBQWtCO2tCQUNoQyxHQUFHLG9CQUFvQixDQUFDLDJCQUEyQixlQUFlLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUN0RCxNQUFNLGVBQWUsR0FBRyxHQUFHLE9BQU8sSUFBSSxLQUFLLEdBQUcsQ0FBQztRQUMvQyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUsNEJBQTRCLENBQUMsQ0FBQztZQUM1RCxTQUFTO1FBQ1gsQ0FBQztRQUNELElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSx5Q0FBeUMsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQzlCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxlQUFlLDBDQUEwQyxDQUFDLENBQUM7UUFDNUUsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLG1CQUFtQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUMzRSwrRUFBK0U7SUFDL0UsMEVBQTBFO0lBQzFFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsV0FBVyxFQUFFLFlBQVksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sUUFBUSxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMkNBQTJDLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBQ0QsSUFBSSxPQUFPLFFBQVEsQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDRDQUE0QyxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQzlFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDN0UsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxPQUFPLFFBQVEsQ0FBQyxJQUFJLEtBQUssT0FBTztXQUMzQixPQUFPLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDN0QsT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQ2hFLENBQUMsQ0FBQyxFQUFFO1FBQ0osQ0FBQyxDQUFDLENBQUMsR0FBRyxPQUFPLHNEQUFzRCxDQUFDLENBQUM7QUFDekUsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDekUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEIsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsVUFBVSxFQUFFLGNBQWMsRUFBRSxhQUFhLENBQUMsRUFBRSxDQUFDLGdCQUFnQixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzlGLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxzRUFBc0UsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsb0JBQW9CLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSxHQUFHLE9BQU8sZUFBZSxDQUFDLENBQUMsQ0FBQztJQUN2RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsbUJBQW1CLENBQUMsUUFBUSxDQUFDLFdBQVcsRUFBRSxHQUFHLE9BQU8sY0FBYyxDQUFDLENBQUMsQ0FBQztJQUNwRixJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDMUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNCQUFzQixDQUFDLFFBQVEsQ0FBQyxjQUFjLEVBQUUsR0FBRyxPQUFPLGlCQUFpQixDQUFDLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDekUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEIsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxFQUFFLFlBQVksRUFBRSxXQUFXLEVBQUUsY0FBYyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2xGLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNoRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ2pDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdEQUFnRCxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxLQUFLLElBQUksUUFBUSxDQUFDLFNBQVMsS0FBSyxLQUFLLEVBQUUsQ0FBQztRQUNqRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywrQkFBK0IsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsb0JBQW9CLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSxHQUFHLE9BQU8sZUFBZSxDQUFDLENBQUMsQ0FBQztJQUN2RixPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRjs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsQ0FDdkMsUUFBaUIsRUFDakIsT0FBTyxHQUFHLHFCQUFxQixFQUNyQixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEIsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsWUFBWSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQy9FLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDbEMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sK0NBQStDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQVEsQ0FBQyxRQUFtQixJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ25GLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDBEQUEwRCxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUM7V0FDOUIsUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDakUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sNkJBQTZCLG9CQUFvQixDQUFDLGFBQWEsU0FBUyxDQUFDLENBQUM7SUFDbEcsQ0FBQztTQUFNLENBQUM7UUFDTixNQUFNLGFBQWEsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ3hDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUMsSUFBSSxRQUFRLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7WUFDdkQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGlCQUFpQixDQUFDLEtBQUssRUFBRSxHQUFHLE9BQU8sV0FBVyxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDeEUsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7WUFDOUQsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQztnQkFDakMsSUFBSSxhQUFhLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7b0JBQ2hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLFdBQVcsS0FBSyxzQkFBc0IsUUFBUSxFQUFFLENBQUMsQ0FBQztnQkFDMUUsQ0FBQztnQkFDRCxhQUFhLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQzlCLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDbEMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztRQUN6RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxnQ0FBZ0M7Y0FDbEQsR0FBRyxvQkFBb0IsQ0FBQyxpQkFBaUIsY0FBYyxDQUFDLENBQUM7SUFDL0QsQ0FBQztTQUFNLENBQUM7UUFDTixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ3BDLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxTQUFTLENBQUMsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7WUFDL0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGlCQUFpQixDQUFDLFNBQVMsRUFBRSxHQUFHLE9BQU8sZUFBZSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7WUFDaEYsSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO2dCQUN6QixTQUFTO1lBQ1gsQ0FBQztZQUNELE1BQU0sR0FBRyxHQUFHLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsSUFBSSxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDN0UsSUFBSSxTQUFTLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3ZCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGVBQWUsS0FBSyxhQUFhLEdBQUcsRUFBRSxDQUFDLENBQUM7WUFDaEUsQ0FBQztZQUNELFNBQVMsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDckIsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixvREFBb0Q7QUFDcEQsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FDOUMsUUFBaUIsRUFDakIsT0FBTyxHQUFHLDRCQUE0QixFQUM1QixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7UUFDakQsV0FBVyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsVUFBVTtRQUM5RSxhQUFhLEVBQUUsZUFBZSxFQUFFLFdBQVc7S0FDNUMsQ0FBQyxFQUFFLENBQUM7UUFDSCxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sUUFBUSxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDMUYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8seUNBQXlDLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN0QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywyQkFBMkIsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFDRCxJQUFJLENBQUMsd0JBQXdCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sK0NBQStDLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQ0QsSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLG9EQUFvRCxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxhQUFhLENBQVUsRUFBRSxDQUFDO1FBQzlFLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM5QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxJQUFJLEdBQUcsc0NBQXNDLENBQUMsQ0FBQztRQUN2RSxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sYUFBYSxHQUFHLFFBQVEsQ0FBQyxhQUFhLENBQUM7SUFDN0MsSUFBSSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUM7V0FDdkIsQ0FBQyxZQUFZLENBQUMsYUFBYSxFQUFFLENBQUMsU0FBUyxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQztXQUNqRSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDO1dBQ2pDLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUM7V0FDbkMsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sbUVBQW1FLENBQUMsQ0FBQztJQUM3RixDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxJQUFLLFFBQVEsQ0FBQyxTQUFvQixJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ3JGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDJEQUEyRCxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsQ0FDbEQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLGlDQUFpQyxFQUNqQyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNuRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1dBQ2xDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLHlCQUF5QixFQUFFLENBQUM7UUFDakYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sZ0NBQWdDO2NBQ2xELEdBQUcsb0JBQW9CLENBQUMseUJBQXlCLFVBQVUsQ0FBQyxDQUFDO0lBQ25FLENBQUM7U0FBTSxDQUFDO1FBQ04sS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUMxRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZ0NBQWdDLENBQUMsSUFBSSxFQUFFLEdBQUcsT0FBTyxlQUFlLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztRQUM1RixDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxTQUFTO1dBQ2hDLENBQUMsT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVE7ZUFDdEMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQztlQUNoQyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLENBQUM7UUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMkJBQTJCO2NBQzdDLEdBQUcsb0JBQW9CLENBQUMsbUJBQW1CLDBCQUEwQixDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7Ozs7Ozs7Ozs7Ozs7O0dBZ0JHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsQ0FDaEQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLDhCQUE4QixFQUM5QixFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7V0FDbEIsQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsUUFBUSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FBQyxjQUFjLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDNUYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSx1QkFBdUIsQ0FBQyxRQUFRLEVBQUUsR0FBRyxPQUFPLFdBQVcsQ0FBQyxDQUFDO0lBQ2xGLElBQUksT0FBTyxRQUFRLENBQUMsTUFBTSxLQUFLLFFBQVE7V0FDbEMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsMEJBQTBCO1dBQ3hFLFFBQVEsQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLDBCQUEwQixFQUFFLENBQUM7UUFDOUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sbUJBQW1CLG9CQUFvQixDQUFDLDBCQUEwQixNQUFNO2NBQzFGLEdBQUcsb0JBQW9CLENBQUMsMEJBQTBCLGFBQWEsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFDRCxJQUFJLE9BQU8sUUFBUSxDQUFDLE9BQU8sS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sdUNBQXVDLENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN0QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywyQkFBMkIsQ0FBQyxDQUFDO0lBQ3JELENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxZQUFZLEtBQUssU0FBUztXQUNsQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDO2VBQ3BDLFFBQVEsQ0FBQyxZQUFZLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLDBCQUEwQjtlQUM5RSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQyxDQUNqRCxPQUFPLGFBQWEsS0FBSyxRQUFRLElBQUksaUJBQWlCLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUMzRSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ1IsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sZ0NBQWdDO2NBQ2xELEdBQUcsb0JBQW9CLENBQUMsMEJBQTBCLG1DQUFtQyxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sOEJBQThCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUMxRCxNQUFNLEVBQUUsa0NBQWtDO0lBQzFDLFdBQVcsRUFBRSxnQ0FBZ0M7SUFDN0MsTUFBTSxFQUFFLDJCQUEyQjtDQUMzQixDQUFDLENBQUM7QUF5Qlo7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FDOUMscUJBQXVELEVBQ3ZELFNBQXFDLEVBQ0UsRUFBRTtJQUN6QyxNQUFNLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxHQUFHLFNBQVMsQ0FBQztJQUMxQyxJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDN0IsTUFBTSxJQUFJLEtBQUssQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxJQUFJLFdBQVcsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUN6QixPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsdUJBQXVCO1lBQ3pELE9BQU8sRUFBRSxrRUFBa0UsRUFBRSxDQUFDO0lBQ2xGLENBQUM7SUFDRCxNQUFNLFdBQVcsR0FBRyxvQkFBb0IsQ0FBQyxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQ2xFLElBQUksV0FBVyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUMzQixPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsdUJBQXVCO1lBQ3pELE9BQU8sRUFBRSx3Q0FBd0MsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7SUFDaEYsQ0FBQztJQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsOEJBQThCLENBQUM7U0FDN0QsTUFBTSxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLHFCQUFxQixFQUFFLE9BQU8sQ0FBQyxDQUFDO1NBQ2xFLElBQUksRUFBRSxDQUFDO0lBQ1YsSUFBSSxVQUFVLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzFCLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSxzQ0FBc0M7WUFDeEUsT0FBTyxFQUFFLDZDQUE2QyxVQUFVLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxzQkFBc0I7a0JBQzdGLFNBQVMsRUFBRSxDQUFDO0lBQ3BCLENBQUM7SUFDRCxPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQVUsRUFBRSxXQUFXLEVBQUU7WUFDeEMsR0FBRyxxQkFBcUI7WUFDeEIsQ0FBQyw4QkFBOEIsQ0FBQyxXQUFXLENBQUMsRUFBRSxXQUFXO1lBQ3pELENBQUMsOEJBQThCLENBQUMsTUFBTSxDQUFDLEVBQUUsTUFBTTtTQUNoRCxFQUFFLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDcEUsbUdBQW1HO0lBQ25HLFdBQVc7SUFDWCwyREFBMkQ7SUFDM0Qsc0JBQXNCO0lBQ3RCLHVHQUF1RztJQUN2RyxxQkFBcUI7SUFDckIsd0RBQXdEO0lBQ3hELHdCQUF3QjtJQUN4Qix5RUFBeUU7SUFDekUsZUFBZTtJQUNmOzs7T0FHRztJQUNILHdCQUF3QjtJQUN4Qiw4REFBOEQ7SUFDOUQsZ0JBQWdCO0lBQ2hCLGdHQUFnRztJQUNoRyxVQUFVO0NBQ0YsQ0FBQyxDQUFDO0FBSVosTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM5RCxXQUFXLEVBQUUsc0NBQXNDO0lBQ25ELG1CQUFtQixFQUFFLEtBQUs7SUFDMUIsbUJBQW1CLEVBQUUsT0FBTztDQUNwQixDQUFDLENBQUM7QUFhWixNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUNoRSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQztPQUMxQixRQUFtQixJQUFJLGtDQUFrQyxDQUFDLG1CQUFtQjtPQUM3RSxRQUFtQixJQUFJLGtDQUFrQyxDQUFDLG1CQUFtQixDQUNsRixDQUFDO0FBRUYsK0VBQStFO0FBQy9FLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLENBQ3ZELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxzQ0FBc0MsRUFDdEMsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxjQUFjLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdkYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLGtDQUFrQyxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ3JFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGlCQUFpQixrQ0FBa0MsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDO0lBQzNGLENBQUM7SUFDRCxJQUFJLENBQUUsd0NBQStELENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ2hHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLCtEQUErRCxDQUFDLENBQUM7SUFDekYsQ0FBQztJQUNELElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDM0MsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sd0NBQXdDO2NBQzFELEdBQUcsa0NBQWtDLENBQUMsbUJBQW1CLE1BQU07Y0FDL0QsR0FBRyxrQ0FBa0MsQ0FBQyxtQkFBbUIsRUFBRSxDQUFDLENBQUM7SUFDbkUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUNBQXFDLEdBQUcsQ0FDbkQsUUFBaUIsRUFDMEIsRUFBRTtJQUM3QyxNQUFNLE9BQU8sR0FBRyxtQkFBbUIsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDbEYsSUFBSSxPQUFPLEtBQUssSUFBSSxJQUFJLHlDQUF5QyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUN0RixPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDbkIsSUFBSSxFQUFFLGtDQUFrQyxDQUFDLFdBQVc7UUFDcEQsTUFBTSxFQUFFLE9BQU8sQ0FBQyxNQUFrRDtRQUNsRSxZQUFZLEVBQUUsT0FBTyxDQUFDLFlBQXNCO0tBQzdDLENBQUMsQ0FBQztBQUNMLENBQUMsQ0FBQztBQWFGLDZDQUE2QztBQUM3QyxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FBRyxDQUNwRCxRQUFpQixFQUNqQixPQUFPLEdBQUcsb0NBQW9DLEVBQ3BDLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFVBQVUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNqRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE9BQU8sU0FBUyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUM7UUFDakMsQ0FBQyxDQUFDLEVBQUU7UUFDSixDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8sK0NBQStDLENBQUMsQ0FBQztBQUNsRSxDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcmluZ3Jlc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJpbmdyZXNzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzVELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQ2hFLE9BQU8sRUFBRSx1QkFBdUIsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBQ3pELE9BQU8sRUFBRSxZQUFZLEVBQUUsZ0JBQWdCLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUNuRyxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUNqRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDL0QsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sY0FBYyxDQUFDO0FBR3BEOzs7Ozs7Ozs7OztHQVdHO0FBRUgsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNoRCwwQkFBMEIsRUFBRSxFQUFFO0lBQzlCLDBCQUEwQixFQUFFLElBQUk7SUFDaEMscUJBQXFCLEVBQUUsR0FBRztJQUMxQixhQUFhLEVBQUUsSUFBSTtJQUNuQixpQkFBaUIsRUFBRSxJQUFJO0lBQ3ZCLDJCQUEyQixFQUFFLEVBQUU7SUFDL0IsNkJBQTZCLEVBQUUsRUFBRTtJQUNqQyx5QkFBeUIsRUFBRSxJQUFJO0lBQy9CLG1CQUFtQixFQUFFLEdBQUc7SUFDeEIsdUJBQXVCLEVBQUUsR0FBRztJQUM1QiwwQkFBMEIsRUFBRSxFQUFFO0NBQy9CLENBQUMsQ0FBQztBQUVIOzs7Ozs7R0FNRztBQUNILE1BQU0sQ0FBQyxNQUFNLDBCQUEwQixHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDdEQsb0JBQW9CLEVBQUUsd0JBQXdCO0NBQ3RDLENBQUMsQ0FBQztBQXFHWixNQUFNLFFBQVEsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUMzRSxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ2QsT0FBTyxRQUFRLEtBQUssUUFBUTtPQUM1QixDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO09BQ3hCLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxNQUFNLENBQUMsU0FBUztXQUNuRCxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLElBQUksQ0FBQyxDQUMvQyxDQUFDO0FBRUYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDM0QsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSyxRQUFtQixJQUFJLENBQUMsQ0FDNUQsQ0FBQztBQUVGLE1BQU0sTUFBTSxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ3hELE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUssUUFBbUIsSUFBSSxDQUFDLElBQUssUUFBbUIsSUFBSSxNQUFNLENBQzlGLENBQUM7QUFFRixNQUFNLGdCQUFnQixHQUFHLHdDQUF3QyxDQUFDO0FBQ2xFLDZFQUE2RTtBQUM3RSxNQUFNLGlCQUFpQixHQUFHLElBQUksTUFBTSxDQUNsQyxpQ0FBaUMsb0JBQW9CLENBQUMsdUJBQXVCLEdBQUcsQ0FBQyxJQUFJLENBQ3RGLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLHdCQUF3QixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRTtJQUNoRixJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVE7V0FDM0IsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3JCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMscUJBQXFCLEVBQUUsQ0FBQztRQUNsRSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ25DLE9BQU8sTUFBTSxDQUFDLE1BQU0sSUFBSSxDQUFDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFDM0YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDNUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO1dBQ3ZCLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQztXQUNyQixRQUFRLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLDJCQUEyQixFQUFFLENBQUM7UUFDeEUsT0FBTyxDQUFDLEdBQUcsT0FBTyxrQkFBa0I7a0JBQ2hDLEdBQUcsb0JBQW9CLENBQUMsMkJBQTJCLGVBQWUsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ3RELE1BQU0sZUFBZSxHQUFHLEdBQUcsT0FBTyxJQUFJLEtBQUssR0FBRyxDQUFDO1FBQy9DLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSw0QkFBNEIsQ0FBQyxDQUFDO1lBQzVELFNBQVM7UUFDWCxDQUFDO1FBQ0QsSUFBSSxDQUFDLHNCQUFzQixDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxlQUFlLHlDQUF5QyxDQUFDLENBQUM7UUFDM0UsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDOUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUsMENBQTBDLENBQUMsQ0FBQztRQUM1RSxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQzNFLCtFQUErRTtJQUMvRSwwRUFBMEU7SUFDMUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxXQUFXLEVBQUUsWUFBWSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksT0FBTyxRQUFRLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsU0FBUyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywyQ0FBMkMsQ0FBQyxDQUFDO0lBQ3JFLENBQUM7SUFDRCxJQUFJLE9BQU8sUUFBUSxDQUFDLFVBQVUsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sNENBQTRDLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDOUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM3RSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxPQUFPO1dBQzNCLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQztXQUM3RCxPQUFPLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxHQUFHLENBQUM7UUFDaEUsQ0FBQyxDQUFDLEVBQUU7UUFDSixDQUFDLENBQUMsQ0FBQyxHQUFHLE9BQU8sc0RBQXNELENBQUMsQ0FBQztBQUN6RSxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sbUNBQW1DLEdBQUcsQ0FDakQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLGlCQUFpQixFQUNqQixFQUFFO0lBQ1osTUFBTSxPQUFPLEdBQUcsb0JBQW9CLENBQUMsNkJBQTZCLENBQUM7SUFDbkUsTUFBTSxRQUFRLEdBQUcsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ3JELElBQUksUUFBUSxLQUFLLElBQUksSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQy9DLE9BQU8sQ0FBQyxHQUFHLE9BQU8sbUJBQW1CLE9BQU8sbUJBQW1CLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxTQUFTLEVBQUUsUUFBUSxFQUFFLEVBQUU7UUFDdkMsTUFBTSxNQUFNLEdBQUcsc0JBQXNCLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDakQsSUFBSSxNQUFNLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDcEIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sSUFBSSxRQUFRLCtEQUErRCxDQUFDLENBQUM7UUFDckcsQ0FBQzthQUFNLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMvQixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxJQUFJLFFBQVEsMkNBQTJDO2tCQUN6RSw2Q0FBNkMsQ0FBQyxDQUFDO1FBQ3JELENBQUM7YUFBTSxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sSUFBSSxRQUFRLGFBQWEsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUM5RCxDQUFDO0lBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDSCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN6RSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxVQUFVLEVBQUUsY0FBYyxFQUFFLGFBQWEsQ0FBQyxFQUNwRSxDQUFDLGdCQUFnQixFQUFFLGlCQUFpQixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzNDLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxzRUFBc0UsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsb0JBQW9CLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSxHQUFHLE9BQU8sZUFBZSxDQUFDLENBQUMsQ0FBQztJQUN2RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsbUJBQW1CLENBQUMsUUFBUSxDQUFDLFdBQVcsRUFBRSxHQUFHLE9BQU8sY0FBYyxDQUFDLENBQUMsQ0FBQztJQUNwRixJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDMUMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHNCQUFzQixDQUFDLFFBQVEsQ0FBQyxjQUFjLEVBQUUsR0FBRyxPQUFPLGlCQUFpQixDQUFDLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsZUFBZSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzNDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxtQ0FBbUMsQ0FBQyxRQUFRLENBQUMsZUFBZSxFQUN6RSxHQUFHLE9BQU8sa0JBQWtCLENBQUMsQ0FBQyxDQUFDO0lBQ25DLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUN6RSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxjQUFjLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDbEYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLFFBQVEsQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1FBQ2hGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLG9DQUFvQyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDakMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sZ0RBQWdELENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLEtBQUssSUFBSSxRQUFRLENBQUMsU0FBUyxLQUFLLEtBQUssRUFBRSxDQUFDO1FBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLCtCQUErQixDQUFDLENBQUM7SUFDekQsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxvQkFBb0IsQ0FBQyxRQUFRLENBQUMsWUFBWSxFQUFFLEdBQUcsT0FBTyxlQUFlLENBQUMsQ0FBQyxDQUFDO0lBQ3ZGLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUN2QyxRQUFpQixFQUNqQixPQUFPLEdBQUcscUJBQXFCLEVBQ3JCLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxVQUFVLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxZQUFZLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNsQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywrQ0FBK0MsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUssUUFBUSxDQUFDLFFBQW1CLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDbkYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMERBQTBELENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztXQUM5QixRQUFRLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNqRSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw2QkFBNkIsb0JBQW9CLENBQUMsYUFBYSxTQUFTLENBQUMsQ0FBQztJQUNsRyxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sYUFBYSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7UUFDeEMsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUN2RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsaUJBQWlCLENBQUMsS0FBSyxFQUFFLEdBQUcsT0FBTyxXQUFXLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztZQUN4RSxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztZQUM5RCxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUNqQyxJQUFJLGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztvQkFDaEMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sV0FBVyxLQUFLLHNCQUFzQixRQUFRLEVBQUUsQ0FBQyxDQUFDO2dCQUMxRSxDQUFDO2dCQUNELGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDOUIsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNsQyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQztjQUNsRCxHQUFHLG9CQUFvQixDQUFDLGlCQUFpQixjQUFjLENBQUMsQ0FBQztJQUMvRCxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7UUFDcEMsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxJQUFJLFFBQVEsQ0FBQyxVQUFVLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsaUJBQWlCLENBQUMsU0FBUyxFQUFFLEdBQUcsT0FBTyxlQUFlLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQztZQUNoRixJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7Z0JBQ3pCLFNBQVM7WUFDWCxDQUFDO1lBQ0QsTUFBTSxHQUFHLEdBQUcsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUM3RSxJQUFJLFNBQVMsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDdkIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sZUFBZSxLQUFLLGFBQWEsR0FBRyxFQUFFLENBQUMsQ0FBQztZQUNoRSxDQUFDO1lBQ0QsU0FBUyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNyQixDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLG9EQUFvRDtBQUNwRCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxDQUM5QyxRQUFpQixFQUNqQixPQUFPLEdBQUcsNEJBQTRCLEVBQzVCLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRTtRQUNqRCxXQUFXLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxVQUFVO1FBQzlFLGFBQWEsRUFBRSxlQUFlLEVBQUUsV0FBVztLQUM1QyxDQUFDLEVBQUUsQ0FBQztRQUNILE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksT0FBTyxRQUFRLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUMxRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyx5Q0FBeUMsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDJCQUEyQixDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywrQ0FBK0MsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxJQUFJLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sb0RBQW9ELENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBQ0QsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLGFBQWEsQ0FBVSxFQUFFLENBQUM7UUFDOUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzlCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksR0FBRyxzQ0FBc0MsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQUcsUUFBUSxDQUFDLGFBQWEsQ0FBQztJQUM3QyxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQztXQUN2QixDQUFDLFlBQVksQ0FBQyxhQUFhLEVBQUUsQ0FBQyxTQUFTLEVBQUUsV0FBVyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1dBQ2pFLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUM7V0FDakMsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQztXQUNuQyxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxtRUFBbUUsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLElBQUssUUFBUSxDQUFDLFNBQW9CLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDckYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMkRBQTJELENBQUMsQ0FBQztJQUNyRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxvQ0FBb0MsR0FBRyxDQUNsRCxRQUFpQixFQUNqQixPQUFPLEdBQUcsaUNBQWlDLEVBQ2pDLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ25GLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDbEMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMseUJBQXlCLEVBQUUsQ0FBQztRQUNqRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxnQ0FBZ0M7Y0FDbEQsR0FBRyxvQkFBb0IsQ0FBQyx5QkFBeUIsVUFBVSxDQUFDLENBQUM7SUFDbkUsQ0FBQztTQUFNLENBQUM7UUFDTixLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQzFELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxnQ0FBZ0MsQ0FBQyxJQUFJLEVBQUUsR0FBRyxPQUFPLGVBQWUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQzVGLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLFNBQVM7V0FDaEMsQ0FBQyxPQUFPLFFBQVEsQ0FBQyxVQUFVLEtBQUssUUFBUTtlQUN0QyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ2hDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywyQkFBMkI7Y0FDN0MsR0FBRyxvQkFBb0IsQ0FBQyxtQkFBbUIsMEJBQTBCLENBQUMsQ0FBQztJQUM3RSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7Ozs7Ozs7R0FnQkc7QUFDSCxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxDQUNoRCxRQUFpQixFQUNqQixPQUFPLEdBQUcsOEJBQThCLEVBQzlCLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM1RixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLHVCQUF1QixDQUFDLFFBQVEsRUFBRSxHQUFHLE9BQU8sV0FBVyxDQUFDLENBQUM7SUFDbEYsSUFBSSxPQUFPLFFBQVEsQ0FBQyxNQUFNLEtBQUssUUFBUTtXQUNsQyxRQUFRLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEI7V0FDeEUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsMEJBQTBCLEVBQUUsQ0FBQztRQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxtQkFBbUIsb0JBQW9CLENBQUMsMEJBQTBCLE1BQU07Y0FDMUYsR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEIsYUFBYSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUN0RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxJQUFJLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDJCQUEyQixDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFlBQVksS0FBSyxTQUFTO1dBQ2xDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7ZUFDcEMsUUFBUSxDQUFDLFlBQVksQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsMEJBQTBCO2VBQzlFLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxhQUFhLEVBQUUsRUFBRSxDQUFDLENBQ2pELE9BQU8sYUFBYSxLQUFLLFFBQVEsSUFBSSxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQzNFLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDUixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxnQ0FBZ0M7Y0FDbEQsR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEIsbUNBQW1DLENBQUMsQ0FBQztJQUM3RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzFELE1BQU0sRUFBRSxrQ0FBa0M7SUFDMUMsV0FBVyxFQUFFLGdDQUFnQztJQUM3QyxNQUFNLEVBQUUsMkJBQTJCO0NBQzNCLENBQUMsQ0FBQztBQXlCWjs7Ozs7Ozs7Ozs7O0dBWUc7QUFDSCxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxDQUM5QyxxQkFBdUQsRUFDdkQsU0FBcUMsRUFDRSxFQUFFO0lBQ3pDLE1BQU0sRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLEdBQUcsU0FBUyxDQUFDO0lBQzFDLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM3QixNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksV0FBVyxLQUFLLElBQUksRUFBRSxDQUFDO1FBQ3pCLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSx1QkFBdUI7WUFDekQsT0FBTyxFQUFFLGtFQUFrRSxFQUFFLENBQUM7SUFDbEYsQ0FBQztJQUNELE1BQU0sV0FBVyxHQUFHLG9CQUFvQixDQUFDLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFDbEUsSUFBSSxXQUFXLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQzNCLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRSx1QkFBdUI7WUFDekQsT0FBTyxFQUFFLHdDQUF3QyxXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsQ0FBQztJQUNoRixDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyw4QkFBOEIsQ0FBQztTQUM3RCxNQUFNLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMscUJBQXFCLEVBQUUsT0FBTyxDQUFDLENBQUM7U0FDbEUsSUFBSSxFQUFFLENBQUM7SUFDVixJQUFJLFVBQVUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDMUIsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLHNDQUFzQztZQUN4RSxPQUFPLEVBQUUsNkNBQTZDLFVBQVUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLHNCQUFzQjtrQkFDN0YsU0FBUyxFQUFFLENBQUM7SUFDcEIsQ0FBQztJQUNELE9BQU8sRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRTtZQUN4QyxHQUFHLHFCQUFxQjtZQUN4QixDQUFDLDhCQUE4QixDQUFDLFdBQVcsQ0FBQyxFQUFFLFdBQVc7WUFDekQsQ0FBQyw4QkFBOEIsQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNO1NBQ2hELEVBQUUsQ0FBQztBQUNOLENBQUMsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0NBQXdDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNwRSxtR0FBbUc7SUFDbkcsV0FBVztJQUNYLDJEQUEyRDtJQUMzRCxzQkFBc0I7SUFDdEIsdUdBQXVHO0lBQ3ZHLHFCQUFxQjtJQUNyQix3REFBd0Q7SUFDeEQsd0JBQXdCO0lBQ3hCLHlFQUF5RTtJQUN6RSxlQUFlO0lBQ2Y7OztPQUdHO0lBQ0gsd0JBQXdCO0lBQ3hCLDhEQUE4RDtJQUM5RCxnQkFBZ0I7SUFDaEIsZ0dBQWdHO0lBQ2hHLFVBQVU7Q0FDRixDQUFDLENBQUM7QUFJWixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzlELFdBQVcsRUFBRSxzQ0FBc0M7SUFDbkQsbUJBQW1CLEVBQUUsS0FBSztJQUMxQixtQkFBbUIsRUFBRSxPQUFPO0NBQ3BCLENBQUMsQ0FBQztBQWFaLE1BQU0sY0FBYyxHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRSxDQUFDLENBQ2hFLE1BQU0sQ0FBQyxhQUFhLENBQUMsUUFBUSxDQUFDO09BQzFCLFFBQW1CLElBQUksa0NBQWtDLENBQUMsbUJBQW1CO09BQzdFLFFBQW1CLElBQUksa0NBQWtDLENBQUMsbUJBQW1CLENBQ2xGLENBQUM7QUFFRiwrRUFBK0U7QUFDL0UsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsQ0FDdkQsUUFBaUIsRUFDakIsT0FBTyxHQUFHLHNDQUFzQyxFQUN0QyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN2RixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFFBQVEsQ0FBQyxJQUFJLEtBQUssa0NBQWtDLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDckUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8saUJBQWlCLGtDQUFrQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUM7SUFDM0YsQ0FBQztJQUNELElBQUksQ0FBRSx3Q0FBK0QsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDaEcsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sK0RBQStELENBQUMsQ0FBQztJQUN6RixDQUFDO0lBQ0QsSUFBSSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUMzQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyx3Q0FBd0M7Y0FDMUQsR0FBRyxrQ0FBa0MsQ0FBQyxtQkFBbUIsTUFBTTtjQUMvRCxHQUFHLGtDQUFrQyxDQUFDLG1CQUFtQixFQUFFLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7O0dBS0c7QUFDSCxNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxDQUNuRCxRQUFpQixFQUMwQixFQUFFO0lBQzdDLE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztJQUNsRixJQUFJLE9BQU8sS0FBSyxJQUFJLElBQUkseUNBQXlDLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RGLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQztRQUNuQixJQUFJLEVBQUUsa0NBQWtDLENBQUMsV0FBVztRQUNwRCxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQWtEO1FBQ2xFLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBc0I7S0FDN0MsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBYUYsNkNBQTZDO0FBQzdDLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQ3BELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxvQ0FBb0MsRUFDcEMsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsVUFBVSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsT0FBTyxTQUFTLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztRQUNqQyxDQUFDLENBQUMsRUFBRTtRQUNKLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTywrQ0FBK0MsQ0FBQyxDQUFDO0FBQ2xFLENBQUMsQ0FBQyJ9

package/dist_ts/data/settings.d.ts

@@ -29,6 +29,15 @@ export interface ICloudlySettings {
     dcrouterTargetHost?: string;
     dcrouterTargetPort?: number;
     dcrouterTargetHostsByNode?: Record<string, string>;
+    /**
+     * The source addresses dcrouter's forwarded connections arrive from at a node, as canonical
+     * address prefixes (`192.0.2.10/32`). Cloudly restricts every non-public hostname a node's
+     * cluster ingress serves to them (`IClusterHttpRoute.sourceAllowList`), so the gateway that checks
+     * the hostname's source profile stays the only way in. Absent: no non-public hostname is served
+     * by a cluster ingress. A value is accepted only when `validateClusterRouteSourceAllowList`
+     * answers no error.
+     */
+    dcrouterForwardSourceAddresses?: string[];
     dcrouterMailSubmissionHost?: string;
     dcrouterMailSubmissionPort?: number;
     dcrouterMailSubmissionTlsMode?: 'plain' | 'starttls' | 'implicitTls';

package/dist_ts/data/settings.js

@@ -122,4 +122,4 @@ export const validateExternalGatewayEnrollmentState = (valueArg) => {
     }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2V0dGluZ3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NldHRpbmdzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSxZQUFZLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQXVFaEYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNwRCxJQUFJLEVBQUUsUUFBUTtJQUNkLFFBQVEsRUFBRSxrQkFBa0I7Q0FDUyxDQUFDLENBQUM7QUFFekMsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQzdDLHlCQUFtRSxDQUFDO0FBRXRFLHVFQUF1RTtBQUN2RSxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ25ELFlBQVksRUFBRSxlQUFlO0lBQzdCLGVBQWUsRUFBRSxrQkFBa0I7SUFDbkMsK0JBQStCLEVBQUUsb0NBQW9DO0lBQ3JFLHVCQUF1QixFQUFFLDRCQUE0QjtJQUNyRCxlQUFlLEVBQUUsbUJBQW1CO0lBQ3BDLG9CQUFvQixFQUFFLHdCQUF3QjtJQUM5QyxnQkFBZ0IsRUFBRSxtQkFBbUI7SUFDckMsWUFBWSxFQUFFLGdCQUFnQjtJQUM5QixZQUFZLEVBQUUsZ0JBQWdCO0lBQzlCLFNBQVMsRUFBRSxZQUFZO0lBQ3ZCLGlCQUFpQixFQUFFLG9CQUFvQjtJQUN2QyxhQUFhLEVBQUUsaUJBQWlCO0lBQ2hDLGlCQUFpQixFQUFFLHFCQUFxQjtJQUN4QyxhQUFhLEVBQUUsaUJBQWlCO0lBQ2hDLG1CQUFtQixFQUFFLHVCQUF1QjtJQUM1QyxjQUFjLEVBQUUsa0JBQWtCO0lBQ2xDLG9CQUFvQixFQUFFLHlCQUF5QjtJQUMvQyxXQUFXLEVBQUUsZUFBZTtJQUM1QixXQUFXLEVBQUUsY0FBYztJQUMzQixpQkFBaUIsRUFBRSxxQkFBcUI7SUFDeEMsb0JBQW9CLEVBQUUsd0JBQXdCO0lBQzlDLGNBQWMsRUFBRSxrQkFBa0I7SUFDbEMsaUJBQWlCLEVBQUUscUJBQXFCO0lBQ3hDLGlCQUFpQixFQUFFLHFCQUFxQjtJQUN4QyxzQkFBc0IsRUFBRSwwQkFBMEI7SUFDbEQsK0JBQStCLEVBQUUsb0NBQW9DO0lBQ3JFLCtCQUErQixFQUFFLG9DQUFvQztJQUNyRTs7OztPQUlHO0lBQ0gsNkJBQTZCLEVBQUUsbUNBQW1DO0lBQ2xFLDRCQUE0QixFQUFFLG1DQUFtQztDQUN6RCxDQUFDLENBQUM7QUFtQ1osTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM3RCxjQUFjO0lBQ2QsVUFBVTtJQUNWLE9BQU87SUFDUCxVQUFVO0lBQ1YsMEJBQTBCO0NBQ29DLENBQUMsQ0FBQztBQUVsRSxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzVEOzs7T0FHRztJQUNILGlCQUFpQixFQUFFLEtBQUs7SUFDeEIsdUVBQXVFO0lBQ3ZFLG1CQUFtQixFQUFFLEtBQUs7SUFDMUIsa0ZBQWtGO0lBQ2xGLHVCQUF1QixFQUFFLEtBQUs7SUFDOUIsdUZBQXVGO0lBQ3ZGLDRCQUE0QixFQUFFLEdBQUc7Q0FDekIsQ0FBQyxDQUFDO0FBRVosMkZBQTJGO0FBQzNGLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDNUQsMkZBQTJGO0lBQzNGLHNCQUFzQjtJQUN0Qjs7O09BR0c7SUFDSCx5QkFBeUI7SUFDekIsMkZBQTJGO0lBQzNGLHlCQUF5QjtJQUN6Qix1RkFBdUY7SUFDdkYsMEJBQTBCO0lBQzFCLGlHQUFpRztJQUNqRywyQkFBMkI7SUFDM0IsaUdBQWlHO0lBQ2pHLDZCQUE2QjtJQUM3QixvR0FBb0c7SUFDcEcscUJBQXFCO0lBQ3JCLDhGQUE4RjtJQUM5RixnQ0FBZ0M7Q0FDeEIsQ0FBQyxDQUFDO0FBSVo7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLENBQUMsUUFBaUIsRUFBMEIsRUFBRSxDQUFDLENBQzVGLFFBQVEsWUFBWSxVQUFVO09BQzNCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztPQUNuQixRQUFRLENBQUMsTUFBTSxJQUFJLGdDQUFnQyxDQUFDLGlCQUFpQjtPQUNyRSxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLElBQUksSUFBSSxJQUFJLE9BQU8sSUFBSSxJQUFJLENBQUMsQ0FDbkUsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFXLEVBQUUsQ0FBQyxDQUMxRCxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLElBQUksQ0FBQyxDQUM1RCxDQUFDO0FBRUYsK0ZBQStGO0FBQy9GLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQUMsUUFBaUIsRUFBWSxFQUFFO0lBQ3BGLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzNDLElBQUksS0FBSyxLQUFLLElBQUk7UUFBRSxPQUFPLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUN4RixNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsdUJBQXVCLEVBQUUscUJBQXFCLENBQUMsRUFDakYsQ0FBQyxRQUFRLEVBQUUsZUFBZSxFQUFFLGFBQWEsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM5QyxNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELElBQUksQ0FBQyxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN2RixNQUFNLENBQUMsSUFBSSxDQUFDLCtDQUErQyxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksQ0FBQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtXQUM5RCxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3pCLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLGdDQUFnQyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUNqRixNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsYUFBYSxDQUFVLEVBQUUsQ0FBQztRQUM1RCxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxTQUFTLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0JBQStCLEdBQUcsNkJBQTZCLENBQUMsQ0FBQztRQUMvRSxDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxxQkFBcUIsQ0FBVSxFQUFFLENBQUM7UUFDNUUsSUFBSSxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNwQyxNQUFNLENBQUMsSUFBSSxDQUFDLCtCQUErQixHQUFHLG9CQUFvQixDQUFDLENBQUM7UUFDdEUsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2V0dGluZ3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL3NldHRpbmdzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUVBLE9BQU8sRUFBRSxZQUFZLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQWdGaEYsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNwRCxJQUFJLEVBQUUsUUFBUTtJQUNkLFFBQVEsRUFBRSxrQkFBa0I7Q0FDUyxDQUFDLENBQUM7QUFFekMsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQzdDLHlCQUFtRSxDQUFDO0FBRXRFLHVFQUF1RTtBQUN2RSxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ25ELFlBQVksRUFBRSxlQUFlO0lBQzdCLGVBQWUsRUFBRSxrQkFBa0I7SUFDbkMsK0JBQStCLEVBQUUsb0NBQW9DO0lBQ3JFLHVCQUF1QixFQUFFLDRCQUE0QjtJQUNyRCxlQUFlLEVBQUUsbUJBQW1CO0lBQ3BDLG9CQUFvQixFQUFFLHdCQUF3QjtJQUM5QyxnQkFBZ0IsRUFBRSxtQkFBbUI7SUFDckMsWUFBWSxFQUFFLGdCQUFnQjtJQUM5QixZQUFZLEVBQUUsZ0JBQWdCO0lBQzlCLFNBQVMsRUFBRSxZQUFZO0lBQ3ZCLGlCQUFpQixFQUFFLG9CQUFvQjtJQUN2QyxhQUFhLEVBQUUsaUJBQWlCO0lBQ2hDLGlCQUFpQixFQUFFLHFCQUFxQjtJQUN4QyxhQUFhLEVBQUUsaUJBQWlCO0lBQ2hDLG1CQUFtQixFQUFFLHVCQUF1QjtJQUM1QyxjQUFjLEVBQUUsa0JBQWtCO0lBQ2xDLG9CQUFvQixFQUFFLHlCQUF5QjtJQUMvQyxXQUFXLEVBQUUsZUFBZTtJQUM1QixXQUFXLEVBQUUsY0FBYztJQUMzQixpQkFBaUIsRUFBRSxxQkFBcUI7SUFDeEMsb0JBQW9CLEVBQUUsd0JBQXdCO0lBQzlDLGNBQWMsRUFBRSxrQkFBa0I7SUFDbEMsaUJBQWlCLEVBQUUscUJBQXFCO0lBQ3hDLGlCQUFpQixFQUFFLHFCQUFxQjtJQUN4QyxzQkFBc0IsRUFBRSwwQkFBMEI7SUFDbEQsK0JBQStCLEVBQUUsb0NBQW9DO0lBQ3JFLCtCQUErQixFQUFFLG9DQUFvQztJQUNyRTs7OztPQUlHO0lBQ0gsNkJBQTZCLEVBQUUsbUNBQW1DO0lBQ2xFLDRCQUE0QixFQUFFLG1DQUFtQztDQUN6RCxDQUFDLENBQUM7QUFtQ1osTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM3RCxjQUFjO0lBQ2QsVUFBVTtJQUNWLE9BQU87SUFDUCxVQUFVO0lBQ1YsMEJBQTBCO0NBQ29DLENBQUMsQ0FBQztBQUVsRSxNQUFNLENBQUMsTUFBTSxnQ0FBZ0MsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzVEOzs7T0FHRztJQUNILGlCQUFpQixFQUFFLEtBQUs7SUFDeEIsdUVBQXVFO0lBQ3ZFLG1CQUFtQixFQUFFLEtBQUs7SUFDMUIsa0ZBQWtGO0lBQ2xGLHVCQUF1QixFQUFFLEtBQUs7SUFDOUIsdUZBQXVGO0lBQ3ZGLDRCQUE0QixFQUFFLEdBQUc7Q0FDekIsQ0FBQyxDQUFDO0FBRVosMkZBQTJGO0FBQzNGLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDNUQsMkZBQTJGO0lBQzNGLHNCQUFzQjtJQUN0Qjs7O09BR0c7SUFDSCx5QkFBeUI7SUFDekIsMkZBQTJGO0lBQzNGLHlCQUF5QjtJQUN6Qix1RkFBdUY7SUFDdkYsMEJBQTBCO0lBQzFCLGlHQUFpRztJQUNqRywyQkFBMkI7SUFDM0IsaUdBQWlHO0lBQ2pHLDZCQUE2QjtJQUM3QixvR0FBb0c7SUFDcEcscUJBQXFCO0lBQ3JCLDhGQUE4RjtJQUM5RixnQ0FBZ0M7Q0FDeEIsQ0FBQyxDQUFDO0FBSVo7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLCtCQUErQixHQUFHLENBQUMsUUFBaUIsRUFBMEIsRUFBRSxDQUFDLENBQzVGLFFBQVEsWUFBWSxVQUFVO09BQzNCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztPQUNuQixRQUFRLENBQUMsTUFBTSxJQUFJLGdDQUFnQyxDQUFDLGlCQUFpQjtPQUNyRSxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLElBQUksSUFBSSxJQUFJLE9BQU8sSUFBSSxJQUFJLENBQUMsQ0FDbkUsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxRQUFpQixFQUFXLEVBQUUsQ0FBQyxDQUMxRCxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLElBQUksQ0FBQyxDQUM1RCxDQUFDO0FBRUYsK0ZBQStGO0FBQy9GLE1BQU0sQ0FBQyxNQUFNLHNDQUFzQyxHQUFHLENBQUMsUUFBaUIsRUFBWSxFQUFFO0lBQ3BGLE1BQU0sS0FBSyxHQUFHLGtCQUFrQixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzNDLElBQUksS0FBSyxLQUFLLElBQUk7UUFBRSxPQUFPLENBQUMsMERBQTBELENBQUMsQ0FBQztJQUN4RixNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxRQUFRLEVBQUUsdUJBQXVCLEVBQUUscUJBQXFCLENBQUMsRUFDakYsQ0FBQyxRQUFRLEVBQUUsZUFBZSxFQUFFLGFBQWEsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM5QyxNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELElBQUksQ0FBQyxpQ0FBaUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN2RixNQUFNLENBQUMsSUFBSSxDQUFDLCtDQUErQyxDQUFDLENBQUM7SUFDL0QsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksQ0FBQyxPQUFPLEtBQUssQ0FBQyxNQUFNLEtBQUssUUFBUTtXQUM5RCxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3pCLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLGdDQUFnQyxDQUFDLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztRQUNqRixNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxlQUFlLEVBQUUsYUFBYSxDQUFVLEVBQUUsQ0FBQztRQUM1RCxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxTQUFTLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0JBQStCLEdBQUcsNkJBQTZCLENBQUMsQ0FBQztRQUMvRSxDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxxQkFBcUIsQ0FBVSxFQUFFLENBQUM7UUFDNUUsSUFBSSxPQUFPLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNwQyxNQUFNLENBQUMsSUFBSSxDQUFDLCtCQUErQixHQUFHLG9CQUFvQixDQUFDLENBQUM7UUFDdEUsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serve.zone/interfaces",
-  "version": "32.54.0",
+  "version": "32.55.0",
   "private": false,
   "description": "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.",
   "exports": {
@@ -30,7 +30,7 @@
     "@git.zone/tsbuild": "^6.0.2",
     "@git.zone/tsdoc": "^3.0.2",
     "@git.zone/tsrun": "^3.0.3",
-    "@git.zone/tstest": "^7.2.0",
+    "@git.zone/tstest": "^7.2.1",
     "@types/node": "26.6.4",
     "typescript": "^6.0.3"
   },

package/readme.md

@@ -3329,8 +3329,17 @@ schema field: the protocol version is the installed `@serve.zone/interfaces` ver
 than the one they hold and ignore anything else, so a repeated push, a replayed push and a push
 that crossed a newer one all settle the same way. `IClusterHttpRoute` names one hostname, its
 `destinations` (`{ address, port }`, unicast IPv4 and a real port), the `certificate` that
-terminates it and optional Basic `authentication`; `IClusterPortRoute` forwards a TCP or UDP
-listen port without terminating anything. `validateClusterRouteTable(value, path?)` returns one
+terminates it, optional Basic `authentication` and an optional `sourceAllowList`: the only
+sources the ingress serves the hostname to, as 1 to `clusterIngressLimits.maximumSourceAllowListEntries`
+(64) distinct canonical address prefixes of either family (`192.0.2.10/32`), none of length zero;
+absent means every source. Cloudly sets it on a hostname that is not public, to the addresses the
+gateway forwards from (`ICloudlySettings.dcrouterForwardSourceAddresses`), so the gateway that
+checks the hostname's source profile stays the only way in whether or not the node's uplink is
+reachable from elsewhere. `validateClusterRouteSourceAllowList(value, path?)` judges one list. A
+reader built before the member refuses the whole table that carries it, so an ingress that applies
+it registers with `clusterIngressCapabilities.routeSourceAllowList` (`route-source-allowlist`), and
+Cloudly sends the member only to such an ingress through a relay that reads it.
+`IClusterPortRoute` forwards a TCP or UDP listen port without terminating anything. `validateClusterRouteTable(value, path?)` returns one
 named reason per violation, refuses two routes for one hostname and two port routes for one
 transport and port, and — because a validation reason travels into logs — **never quotes
 certificate material or a password in a reason**.

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/interfaces',
-  version: '32.54.0',
+  version: '32.55.0',
   description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
 }

package/ts/data/clusteringress.ts

@@ -1,7 +1,8 @@
 import { isPlausibleUnicastIpv4 } from '../private/ipv4.js';
 import { isUtcCalendarDay } from '../private/utccalendarday.js';
 import { validateProtocolOfferOn } from '../protocol.js';
-import { hasExactKeys, readExactDataRecord } from '../private/dataproperties.js';
+import { hasExactKeys, readDataElements, readExactDataRecord } from '../private/dataproperties.js';
+import { parseCanonicalIpPrefix } from '../private/ipaddress.js';
 import { isClusterNodeId } from '../private/nodeidentifier.js';
 import { validateClusterRelay } from './cluster.js';
 import type { TServiceRuntimeRefusal } from './serviceruntime.js';
@@ -26,12 +27,27 @@ export const clusterIngressLimits = Object.freeze({
   maximumRoutes: 4096,
   maximumPortRoutes: 1024,
   maximumDestinationsPerRoute: 64,
+  maximumSourceAllowListEntries: 64,
   maximumStatisticsPageSize: 1000,
   maximumCursorLength: 512,
   maximumIdentifierLength: 200,
   maximumIngressCapabilities: 32,
 });
 
+/**
+ * The capabilities an ingress names on its registration, each spelled once here.
+ *
+ * `routeSourceAllowList`: the ingress applies `IClusterHttpRoute.sourceAllowList`. A route table
+ * that carries the member is refused whole by a reader built before it, so Cloudly sends a route
+ * with a source allowlist only to an ingress that registered with this capability.
+ */
+export const clusterIngressCapabilities = Object.freeze({
+  routeSourceAllowList: 'route-source-allowlist',
+} as const);
+
+export type TClusterIngressCapability =
+  (typeof clusterIngressCapabilities)[keyof typeof clusterIngressCapabilities];
+
 /** One backend a route forwards to: an address a node answers on, and its port. */
 export interface IClusterRouteDestination {
   address: string;
@@ -61,6 +77,18 @@ export interface IClusterHttpRoute {
     privateKey: string;
   };
   authentication?: IClusterRouteAuthentication;
+  /**
+   * The only sources the ingress serves `hostName` to, as canonical address prefixes of either
+   * family (`192.0.2.10/32`, `2001:db8::/64`); a request from any other source is refused.
+   * Absent means every source. When present it lists 1 to
+   * `clusterIngressLimits.maximumSourceAllowListEntries` distinct prefixes, none of length zero:
+   * an unrestricted route omits the member rather than spelling "everyone" a second way.
+   *
+   * Cloudly sets it on a hostname that is not public, to the addresses the gateway forwards from,
+   * so the gateway that checked the source stays the only way in. An ingress that applies it
+   * registers with `clusterIngressCapabilities.routeSourceAllowList`.
+   */
+  sourceAllowList?: string[];
 }
 
 /** One TCP or UDP port the ingress forwards without terminating anything. */
@@ -205,9 +233,39 @@ const validateAuthentication = (valueArg: unknown, pathArg: string): string[] =>
     : [`${pathArg} must be Basic authentication with a user and a pass`];
 };
 
+/**
+ * Validates one source allowlist (`IClusterHttpRoute.sourceAllowList`) and names every reason it is
+ * refused: 1 to `clusterIngressLimits.maximumSourceAllowListEntries` distinct canonical address
+ * prefixes whose host bits are zero, none of length zero.
+ */
+export const validateClusterRouteSourceAllowList = (
+  valueArg: unknown,
+  pathArg = 'sourceAllowList',
+): string[] => {
+  const maximum = clusterIngressLimits.maximumSourceAllowListEntries;
+  const prefixes = readDataElements(valueArg, maximum);
+  if (prefixes === null || prefixes.length === 0) {
+    return [`${pathArg} must list 1 to ${maximum} address prefixes`];
+  }
+  const errors: string[] = [];
+  prefixes.forEach((prefixArg, indexArg) => {
+    const prefix = parseCanonicalIpPrefix(prefixArg);
+    if (prefix === null) {
+      errors.push(`${pathArg}[${indexArg}] must be a canonical address prefix whose host bits are zero`);
+    } else if (prefix.length === 0) {
+      errors.push(`${pathArg}[${indexArg}] must not admit a whole address family; `
+        + 'an unrestricted route omits sourceAllowList');
+    } else if (prefixes.indexOf(prefixArg) !== indexArg) {
+      errors.push(`${pathArg}[${indexArg}] repeats ${prefixArg}`);
+    }
+  });
+  return errors;
+};
+
 const validateHttpRoute = (valueArg: unknown, pathArg: string): string[] => {
   if (!isRecord(valueArg)
-    || !hasExactKeys(valueArg, ['hostName', 'destinations', 'certificate'], ['authentication'])) {
+    || !hasExactKeys(valueArg, ['hostName', 'destinations', 'certificate'],
+      ['authentication', 'sourceAllowList'])) {
     return [`${pathArg} must use its exact schema`];
   }
   const errors: string[] = [];
@@ -219,6 +277,10 @@ const validateHttpRoute = (valueArg: unknown, pathArg: string): string[] => {
   if (valueArg.authentication !== undefined) {
     errors.push(...validateAuthentication(valueArg.authentication, `${pathArg} authentication`));
   }
+  if (valueArg.sourceAllowList !== undefined) {
+    errors.push(...validateClusterRouteSourceAllowList(valueArg.sourceAllowList,
+      `${pathArg} sourceAllowList`));
+  }
   return errors;
 };
 

package/ts/data/settings.ts

@@ -39,6 +39,15 @@ export interface ICloudlySettings {
   dcrouterTargetHost?: string;
   dcrouterTargetPort?: number;
   dcrouterTargetHostsByNode?: Record<string, string>;
+  /**
+   * The source addresses dcrouter's forwarded connections arrive from at a node, as canonical
+   * address prefixes (`192.0.2.10/32`). Cloudly restricts every non-public hostname a node's
+   * cluster ingress serves to them (`IClusterHttpRoute.sourceAllowList`), so the gateway that checks
+   * the hostname's source profile stays the only way in. Absent: no non-public hostname is served
+   * by a cluster ingress. A value is accepted only when `validateClusterRouteSourceAllowList`
+   * answers no error.
+   */
+  dcrouterForwardSourceAddresses?: string[];
   dcrouterMailSubmissionHost?: string;
   dcrouterMailSubmissionPort?: number;
   dcrouterMailSubmissionTlsMode?: 'plain' | 'starttls' | 'implicitTls';